WO2020075224A1

WO2020075224A1 - Secrecy analysis device, secrecy analysis system, secrecy analysis method, and secrecy analysis program

Info

Publication number: WO2020075224A1
Application number: PCT/JP2018/037603
Authority: WO
Inventors: 豊川合; 貴人平野
Original assignee: 三菱電機株式会社
Priority date: 2018-10-09
Filing date: 2018-10-09
Publication date: 2020-04-16

Abstract

This secrecy analysis device (60) accepts a ciphertext c'_i obtained by encrypting a message x_i and a secret key sk_y having a value set for y as inputs, and acquires a ciphertext c_i which is obtained, using an encoding token etk, by encrypting the ciphertext c'_i through a multiple-input functional encryption that outputs an arithmetic result when the message x_i and the value y are inputted in function f. The secrecy analysis device (60) generates the ciphertext c'_i by decoding the ciphertext c_i using a decoding token dtk, and computes an arithmetic result by decoding the ciphertext c'_i using the secret key sk_y.

Description

Security analysis device, security analysis system, security analysis method and security analysis program

The present invention relates to a technique for executing an operation while being encrypted.

-In principle, once data is encrypted, it is impossible to view and edit internal data without decrypting it. Therefore, when editing the ciphertext data, it is necessary to decrypt the ciphertext once to make it plaintext, edit it, and then encrypt it again.

There is a functional encryption that can calculate the inner product (hereinafter referred to as inner product encryption) (see Patent Document 1 and Non-Patent Document 1). In the inner product encryption, a vector x is set when the encryption is executed, a vector y is set in the user secret key, and an inner product <x, y> of the vector x and the vector y is output when the ciphertext is decrypted. That is, the inner product cipher is a cipher capable of calculating the inner product while being encrypted. In the following description, the inner product of the vector x and the vector y will be written as <x, y>.

The inner product cipher can be divided into a single input inner product cipher and a plurality of input inner product ciphers. The inner product cipher that can be single-input can only calculate one inner product at the time of decryption. On the other hand, the inner product cipher capable of inputting a plurality of numbers has N vectors y ₁ ,. . . , Y _N can be set, and when N pieces of ciphertext are input at the time of decryption, <x ₁ , y ₁ > + <x ₂ , y ₂ > + ... + <x _N , y _N >. Can be calculated.

JP, 2009-272995, A

The method described in Non-Patent Document 1 can calculate the sum of N inner products. However, in the method described in Non-Patent Document 1, a user who possesses at least one user private key and can execute encryption can infer a vector associated with a ciphertext. Is.

The inner product cryptography that allows multiple inputs is expected to be analyzed as an inner product without decrypting the multiple ciphertexts uploaded to the cloud. However, unlike the method described in Non-Patent Document 1, information set in each ciphertext that should not be originally leaked, for example, a vector value in the case of an inner product is leaked.

The purpose of this invention is to prevent the leakage of the information set in the ciphertext while enabling the calculation such as the inner product while being encrypted.

The confidentiality analysis device according to the present invention is
For integer n greater than or equal to 1, i = 1 ,. . . , Ciphertext c _'i of encrypted messages x _i for each integer i of n, as inputs the secret key sk _y value y is set, the said value and the message x _i for each integer i The ciphertext c ′ _i in the multi-input function cryptography that outputs y and y to the function f to obtain the operation result is a ciphertext acquisition for obtaining the ciphertext c _i encrypted using the encryption token etk Department,
A decryption key acquisition unit for acquiring the secret key sk _y of the plurality input function code,
A token acquisition unit for acquiring a decryption token dtk corresponding to the encryption token etk;
By the ciphertext c _i and decrypted using the decryption token dtk 'generates a _i, the ciphertext c using the secret key sk _y' the ciphertext c decodes the _i, the calculation result And a decoding unit for calculating.

In the present invention, the ciphertext c ′ _i in the common-key multiple-input-function encryption is encrypted using the encryption token etk to obtain the ciphertext c _i , and the ciphertext c _i is decrypted using the decryption token dtk. 'generates a _i, ciphertext c using the private key sk _y' ciphertext c by decoding the _i, to calculate the calculation result. Even if the user has the private key sk, the operation cannot be performed without the decryption token dtk. Therefore, it is possible to prevent the information from being leaked to the user who has the private key sk.

1 is a configuration diagram of a confidentiality analysis system 10 according to the first embodiment. FIG. 2 is a configuration diagram of a setup device 20 according to the first embodiment. 3 is a configuration diagram of a key generation device 30 according to the first embodiment. FIG. 3 is a configuration diagram of a token generation device 40 according to the first embodiment. FIG. FIG. 3 is a configuration diagram of the encryption device 50 according to the first embodiment. 1 is a configuration diagram of a confidentiality analysis device 60 according to the first embodiment. 3 is a flowchart showing the operation of the setup device 20 according to the first embodiment. 5 is a flowchart showing the operation of the key generation device 30 according to the first embodiment. 3 is a flowchart showing the operation of the token generation device 40 according to the first embodiment. 6 is a flowchart showing the operation of the encryption device 50 according to the first embodiment. 6 is a flowchart showing the operation of the confidentiality analysis device 60 according to the first embodiment. The block diagram of the setup apparatus 20 which concerns on the modification 1. FIG. 8 is a configuration diagram of a key generation device 30 according to Modification 1. The block diagram of the token generation apparatus 40 which concerns on the modification 1. The block diagram of the encryption apparatus 50 which concerns on the modification 1. The block diagram of the confidentiality analysis apparatus 60 which concerns on the modification 1. FIG.

Embodiment 1.
The configuration of the confidentiality analysis system 10 according to the first embodiment will be described with reference to FIG.
The confidentiality analysis system 10 includes a setup device 20, a key generation device 30, a token generation device 40, an encryption device 50, and a confidentiality analysis device 60.
The setup device 20, the key generation device 30, the token generation device 40, the encryption device 50, the confidentiality analysis device 60, and the confidentiality analysis device 60 are connected via a transmission line 90. The transmission path 90 is, for example, the Internet or a LAN (Local Area Network).
The confidentiality analysis system 10 may include a plurality of key generation devices 30, token generation devices 40, encryption devices 50, and confidentiality analysis devices 60.

The configuration of the setup device 20 according to the first embodiment will be described with reference to FIG.
The setup device 20 includes hardware such as a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected to other hardware via a signal line, and controls the other hardware.

The setup device 20 includes a parameter acquisition unit 211, a master key generation unit 212, and a transmission unit 213 as functional components. The function of each functional component of the setup device 20 is realized by software.
The storage 23 stores programs that implement the functions of the functional components of the setup device 20. This program is read into the memory 22 by the processor 21 and executed by the processor 21. As a result, the function of each functional component of the setup device 20 is realized.
The storage 23 also realizes the function of the master key storage unit 231.

The configuration of the key generation device 30 according to the first embodiment will be described with reference to FIG.
The key generation device 30 includes hardware such as a processor 31, a memory 32, a storage 33, and a communication interface 34. The processor 31 is connected to other hardware via a signal line, and controls the other hardware.

The key generation device 30 includes a master key acquisition unit 311, a value acquisition unit 312, a secret key generation unit 313, and a transmission unit 314 as functional components. The function of each functional component of the key generation device 30 is realized by software.
The storage 33 stores programs that implement the functions of the functional components of the key generation device 30. This program is read into the memory 32 by the processor 31 and executed by the processor 31. Thereby, the function of each functional component of the key generation device 30 is realized.
The storage 33 also realizes the function of the master key storage unit 331.

The configuration of the token generation device 40 according to the first embodiment will be described with reference to FIG.
The token generation device 40 includes hardware such as a processor 41, a memory 42, a storage 43, and a communication interface 44. The processor 41 is connected to other hardware via a signal line and controls these other hardware.

The token generation device 40 includes a parameter acquisition unit 411, a token generation unit 412, and a transmission unit 413 as functional components. The function of each functional component of the token generation device 40 is realized by software.
The storage 43 stores programs that implement the functions of the functional components of the token generation device 40. This program is read into the memory 42 by the processor 41 and executed by the processor 41. Thereby, the function of each functional component of the token generation device 40 is realized.

The configuration of the encryption device 50 according to the first embodiment will be described with reference to FIG.
The encryption device 50 includes hardware such as a processor 51, a memory 52, a storage 53, and a communication interface 54. The processor 51 is connected to other hardware via a signal line, and controls these other hardware.

The encryption device 50 includes a master key acquisition unit 511, a token acquisition unit 512, a message acquisition unit 513, an encryption unit 514, and a transmission unit 515 as functional components. The function of each functional component of the encryption device 50 is realized by software.
The storage 53 stores programs that implement the functions of the functional components of the encryption device 50. This program is read into the memory 52 by the processor 51 and executed by the processor 51. As a result, the function of each functional component of the encryption device 50 is realized.
The storage 53 also realizes the functions of the master key storage unit 531 and the token storage unit 532.

The configuration of the confidentiality analysis device 60 according to the first embodiment will be described with reference to FIG.
The confidentiality analysis device 60 includes hardware such as a processor 61, a memory 62, a storage 63, and a communication interface 64. The processor 61 is connected to other hardware via a signal line, and controls these other hardware.

The confidentiality analysis device 60 includes a secret key acquisition unit 611, a token acquisition unit 612, a ciphertext acquisition unit 613, a decryption unit 614, and a transmission unit 615 as functional components. The function of each functional component of the confidentiality analysis device 60 is realized by software.
The storage 63 stores a program that realizes the function of each functional component of the confidentiality analysis device 60. This program is read into the memory 62 by the processor 61 and executed by the processor 61. As a result, the function of each functional component of the confidentiality analysis device 60 is realized.
The storage 63 realizes the functions of the secret key storage unit 631, the token storage unit 632, and the ciphertext storage unit 633.

The

processors

21, 31, 41, 51, 61 are ICs (Integrated Circuits) that perform arithmetic processing. The

processors

21, 31, 41, 51, 61 are, as specific examples, a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).

The

memories

22, 32, 42, 52, 62 are storage devices for temporarily storing data. The

memory

22, 32, 42, 52, 62 is, for example, SRAM (Static Random Access Memory) or DRAM (Dynamic Random Access Memory).

The

storages

23, 33, 43, 53, 63 are storage devices for storing data. The

storages

23, 33, 43, 53, 63 are, as a specific example, HDDs (Hard Disk Drives). The

storages

23, 33, 43, 53, 63 are SD (registered trademark, Secure Digital) memory cards, CF (CompactFlash, registered trademark), NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk. It may be a portable storage medium such as a DVD (Digital Versatile Disk).

The communication interfaces 24, 34, 44, 54, 64 are interfaces for communicating with external devices. The communication interfaces 24, 34, 44, 54, 64 are, as specific examples, Ethernet (registered trademark), USB (Universal Serial Bus), and HDMI (registered trademark, High-Definition Multimedia Interface) ports.

In FIG. 2, only one processor 21 is shown. However, the setup device 20 may include a plurality of processors that replace the processor 21. Similarly, the key generation device 30 may include a plurality of processors that replace the processor 31. The token generation device 40 may include a plurality of processors that replace the processor 41. The encryption device 50 may include a plurality of processors that replace the processor 51. The confidentiality analysis device 60 may include a plurality of processors that replace the processor 61.
These multiple processors share the execution of programs that implement the functions of the functional components. Each of the processors is an IC that performs arithmetic processing similarly to the

processors

21, 31, 41, 51 and 61.

*** Explanation of operation ***
The operation of the confidentiality analysis system 10 according to the first embodiment will be described with reference to FIGS. 7 to 11.

** Public key cryptography **
The secret analysis system 10 uses public key cryptography. The public key cryptography is the following PKE. KeyGen algorithm and PKE. Enc algorithm and PKE. And the Dec algorithm. Any specific public key cryptosystem may be used.

<PKE. KeyGen Algorithm>
PKE. The KeyGen algorithm is a key generation algorithm. PKE. The KeyGen algorithm inputs the security parameter λ and outputs a pair of the public key pk and the secret key sk.
<PKE. Enc algorithm>
PKE. The Enc algorithm is an encryption algorithm. PKE. The Enc algorithm inputs the public key pk and the message x and outputs the ciphertext c obtained by encrypting the message x.
<PKE. Dec Algorithm>
PKE. The Dec algorithm is a decoding algorithm. PKE. The Dec algorithm inputs the secret key sk and the ciphertext c and outputs the message x or the special symbol ⊥.

** Common key type multiple input function encryption **
In the confidentiality analysis system 10, common key type multiple input function encryption is used. The common key type multiple input function encryption is described in M. Setup algorithm and M.G. KeyGen algorithm and M.G. Enc algorithm, and M.G. And the Dec algorithm. Any specific common key type multiple input function encryption method may be used.

<M. Setup algorithm>
M. The Setup algorithm is a master key generation algorithm. M. The Setup algorithm receives the security parameter λ as an input and outputs a pair of the public key mpk and the master secret key msk.
<M. KeyGen Algorithm>
M. The KeyGen algorithm is a secret key generation algorithm. M. The KeyGen algorithm inputs the master secret key msk and the value y and outputs the secret key sk _y in which the value y is set.
<M. Enc algorithm>
M. The Enc algorithm is an encryption algorithm. M. The Enc algorithm inputs the master secret key msk, the index i, and the message x _i, and outputs the ciphertext c _i .
<M. Dec Algorithm>
M. The Dec algorithm is a decoding algorithm. M. The Dec algorithm is such that, for a secret key sk _y and an integer n of 1 or more, i = 1 ,. . . , N of ciphertexts c _i (c ₁ , ..., C _n ) for each integer i, and a message x _i and a value y for each integer i input to a function f. The result f (x ₁ , ..., X _n , y) or the special symbol ⊥ is output.

** Token-based multiple input function encryption **
The confidentiality analysis system 10 implements token-based multiple input function encryption using public key encryption and common key type multiple input function encryption. The token-based multi-input function cryptography includes the following Setup algorithm, KeyGen algorithm, GenToken algorithm, Enc algorithm, and Dec algorithm.

<Setup algorithm>
The Setup algorithm inputs the security parameter λ and outputs the public key PK and the master secret key MSK.
<KeyGen algorithm>
The KeyGen algorithm inputs the master secret key MSK and the value y and outputs the secret key sk _y in which the value y is set.
<GenToken algorithm>
The GenToken algorithm takes a public key mpk as an input, and i = 1 ,. . . , Cryptographic token _ETK i for each integer i of _{u (etk 1, ..., etk} u) and outputs the decoded token dtk.
<Enc algorithm>
Enc algorithm, as input and a master secret key MSK, and the index i, and the encryption token etk _i, and a message _{x i,} and outputs the cipher text _{c i.}
<Dec algorithm>
Dec algorithm, and the decryption token dtk, and the secret key sk _y, i = 1 ,. . . , N of ciphertexts c _i (c ₁ , ..., C _n ) for each integer i, and a message x _i and a value y for each integer i input to a function f. The result f (x ₁ , ..., X _n , y) or the special symbol ⊥ is output.

** Operation of the setup device 20 **
The operation of the setup device 20 according to the first embodiment will be described with reference to FIG. 7.
The operation of the setup device 20 according to the first embodiment corresponds to the setup method according to the first embodiment. The operation of the setup device 20 according to the first embodiment corresponds to the process of the setup program according to the first embodiment.
The setup device 20 implements the Setup algorithm in token-based multiple input function encryption.

(Step S11: Parameter acquisition process)
The parameter acquisition unit 211 acquires the security parameter λ.
Specifically, the parameter acquisition unit 211 receives the security parameter λ input by operating the input device by the user of the setup device 20. The parameter acquisition unit 211 writes the security parameter λ in the memory 22.

(Step S12: Master Key Generation Processing)
The master key generation unit 212 reads the security parameter λ from the memory 22. The master key generation unit 212 receives the security parameter λ as an input and outputs the M. The Setup algorithm is executed to generate a public key mpk and a master secret key msk.
The master key generation unit 212 sets the public key mpk as the public key MPK and sets the master secret key msk as the master secret key MSK. The master key generation unit 212 writes the public key MPK and the master secret key MSK in the memory 22 and the master key storage unit 231.

(Step S13: transmission process)
The transmission unit 213 reads the master secret key MSK from the memory 22. The transmission unit 213 secretly transmits the master secret key MSK to the key generation device 30 and the encryption device 50 via the communication interface 24. The secret transmission means, for example, that the data is encrypted by an existing encryption method and then transmitted.
Then, the master key acquisition unit 311 of the key generation device 30 acquires the master secret key MSK and writes it in the master key storage unit 331. Also, the master key acquisition unit 511 of the encryption device 50 acquires the master secret key MSK and writes it in the master key storage unit 531.

** Operation of the key generation device 30 **
The operation of the key generation device 30 according to the first embodiment will be described with reference to FIG.
The operation of the key generation device 30 according to the first embodiment corresponds to the key generation method according to the first embodiment. The operation of the key generation device 30 according to the first embodiment corresponds to the processing of the key generation program according to the first embodiment.
The key generation device 30 implements the KeyGen algorithm in token-based multiple input function encryption.

(Step S21: value acquisition process)
The value acquisition unit 312 acquires the value y. The value y is a value to be calculated.
Specifically, the value acquisition unit 312 receives the value y input by operating the input device by the user of the key generation device 30. The value acquisition unit 312 writes the value y in the memory 32.

(Step S22: Private Key Generation Processing)
The secret key generation unit 313 reads the master secret key MSK from the master key storage unit 331. The secret key generation unit 313 also reads the value y from the memory 32. The secret key generation unit 313 receives the master secret key MSK and the value y as input, and outputs the M.M. The KeyGen algorithm is executed to generate the secret key sk _y with the value y set. The secret key generating unit 313 writes the secret key sk _y in the memory 32.

(Step S23: transmission process)
The transmission unit 314 reads the secret key sk _y from the memory 32. Transmitting unit 314, a secret key sk _y, via the communication interface 34, transmits secretly in the hidden analyzer 60.
Then, the private key acquiring section 611 of the concealment analyzer 60 obtains the private key sk _y, written in the secret key storage unit 631.

** Operation of token generator 40 **
The operation of the token generation device 40 according to the first embodiment will be described with reference to FIG.
The operation of the token generation device 40 according to the first embodiment corresponds to the token generation method according to the first embodiment. The operation of the token generation device 40 according to the first embodiment corresponds to the processing of the token generation program according to the first embodiment.
The token generation device 40 implements the GenToken algorithm in token-based multiple input function cryptography.

(Step S31: Parameter acquisition process)
The parameter acquisition unit 411 acquires the security parameter λ. The security parameter λ may be the same parameter as the security parameter λ acquired in step S11, or may be a different parameter.
Specifically, the parameter acquisition unit 411 receives the security parameter λ input by operating the input device by the user of the token generation device 40. The parameter acquisition unit 411 writes the security parameter λ in the memory 42.

(Step S32: token generation process)
The token generation unit 412 reads the security parameter λ from the memory 42. The token generation unit 412 receives the security parameter λ as an input and outputs the PKE. The KeyGen algorithm is executed to generate a public key pk and private key sk pair.
The token generation unit 412 uses i = 1 ,. . . , N, the public key pk is set in the encryption token etk _i . Further, the token generation unit 412 sets the private key sk in the decryption token dtk. Here, n is an integer of 1 or more. That is, etk ₁ ,. . . , Etk _n : = pk and dtk = sk. The token generation unit 412 uses i = 1 ,. . . Writes the encrypted token ETK _i for each integer i of n, a decoding token dtk in memory 42.

(Step S33: transmission process)
The transmission unit 413 determines that i = 1 ,. . . Reads an encrypted token ETK _i for each integer i of n, a decoding token dtk from the memory 42. The transmission unit 413 determines that i = 1 ,. . . The cryptographic token ETK _i for each integer i of n, via the communication interface 44, transmits secretly encryption device 50. Further, the transmission unit 413 secretly transmits the decryption token dtk to the confidentiality analysis device 60 via the communication interface 44.
Then, the token acquisition unit 512 of the encryption device 50 makes i = 1 ,. . . , N for each integer i of the encrypted token etk _i , and writes it in the token storage unit 532. Further, the token acquisition unit 612 of the confidentiality analysis device 60 acquires the decryption token dtk and writes it in the token storage unit 632.

Here, if the encryption device 50 there are a plurality of transmission unit 413 transmits the encrypted token ETK _i required for each encryption device 50. For example, i = 1 ,. . . , N, when there is an encryption device 50i for each integer i, the transmission unit 413 determines that i = 1 ,. . . , N may be transmitted to the encryption device 50i with the encryption token etk _i .

** Operation of the encryption device 50 **
The operation of the encryption device 50 according to the first embodiment will be described with reference to FIG.
The operation of the encryption device 50 according to the first embodiment corresponds to the encryption method according to the first embodiment. The operation of the encryption device 50 according to the first embodiment corresponds to the processing of the encryption program according to the first embodiment.
The encryption device 50 implements the Enc algorithm in token-based multiple input function encryption.

(Step S41: message acquisition process)
The message acquisition unit 513 acquires the index i and the message x _i corresponding to the index i.
Specifically, the message acquisition unit 513 receives the index x and the message x _i input by the user of the encryption device 50 operating the input device. The message acquisition unit 513 writes the index i and the message x _i in the memory 52.
If the index i corresponds to the encryption device 50, the message acquisition unit 513 may acquire only the message x _i .

(Step S42: First encryption process)
The encryption unit 514 reads the master secret key MSK from the master key storage unit 531. The encryption unit 514 also reads the index i and the message x _i from the memory 52. The encryption unit 514 receives the master secret key MSK, the index i, and the message x _i as inputs and outputs the M.M. The Enc algorithm is executed to generate the ciphertext c ′ _i . The encryption unit 514 writes the ciphertext c ′ _i in the memory 52.

(Step S43: Second encryption process)
Encryption unit 514 reads the encrypted token ETK _i from the token storage unit 532. The encryption unit 514 also reads the ciphertext c ′ _i from the memory 52. The encryption unit 514 receives the encryption token etk _i (= pk) and the ciphertext c ′ _i as input and outputs the PKE. The Enc algorithm is executed to generate the ciphertext c _i . That is, the encryption unit 514 determines that the PKE. The ciphertext c ′ _i is encrypted by the Enc algorithm to generate the ciphertext c _i . The encryption unit 514 writes the ciphertext c _i in the memory 52.

(Step S44: transmission process)
The transmission unit 515 reads the ciphertext c _i from the memory 52. The transmission unit 515 transmits the ciphertext c _i to the confidentiality analysis device 60 via the communication interface 54.
Then, the ciphertext acquisition unit 613 of the concealment analyzer 60 acquires the ciphertext _{c i,} writes the ciphertext storage unit 633.

** Operation of the confidential analysis device 60 **
The operation of the confidentiality analysis device 60 according to the first embodiment will be described with reference to FIG.
The operation of the confidentiality analysis device 60 according to the first embodiment corresponds to the confidentiality analysis method according to the first embodiment. The operation of the confidentiality analysis device 60 according to the first embodiment corresponds to the processing of the confidentiality analysis program according to the first embodiment.
The confidentiality analysis device 60 implements the Dec algorithm in the token-based multiple input function encryption.

(Step S51: First decryption process)
The decryption unit 614 reads the decryption token dtk from the token acquisition unit 612. In addition, the decoding unit 614 determines that i = 1 ,. . . Reads ciphertext _{c i} for each integer i of n from the ciphertext storage unit 633. The decoding unit 614 determines that i = 1 ,. . . , N for each integer i, the decryption token dtk (= sk) and the ciphertext c _i are input, and PKE. The dec algorithm is executed to generate the ciphertext c ′ _i . That is, the decoding unit 614 decodes the cipher text _{c i,} and generates a ciphertext c _'i. The decryption unit 614 writes the ciphertext c ′ _i in the memory 62.

(Step S52: Second decoding process)
Decoding unit 614 reads the secret key sk _y from the secret key storage unit 631. In addition, the decoding unit 614 determines that i = 1 ,. . . , N, the ciphertext c ′ _i for each integer i is read from the memory 62. Decoding unit 614, a secret key sk _y, i = 1 ,. . . , N for ciphertexts c ′ _i for each integer i of M. Executing the Dec algorithm and inputting the message x _i and the value y for each integer i into the function f, the operation result f (x ₁ , ..., X _n , y) or a special symbol Generate ⊥. The decoding unit 614 writes the calculation result f (x ₁ , ..., X _n , y) or the special symbol ⊥ in the memory 62.

(Step S53: transmission process)
The transmission unit 615 reads the calculation result f (x ₁ , ..., X _n , y) or the special symbol ⊥ from the memory 62. The transmission unit 615 outputs the calculation result f (x ₁ , ..., X _n , y) or the special symbol ⊥ via the communication interface 64.

*** Effects of Embodiment 1 ***
As described above, in the confidentiality analysis system 10 according to the first embodiment, the confidentiality analysis device 60 allows the ciphertext c ′ _i in the common-key multiple-input-function encryption to be encrypted using the encryption token etk. _{Get i} . Then, concealment analyzer 60 decodes using the decoding token dtk ciphertext c _i 'generates a _i, ciphertext c using the private key sk _y' ciphertext c by decoding the _i, computation Calculate the result. Even if the user has the private key sk, the operation cannot be performed without the decryption token dtk. Therefore, it is possible to prevent the information from being leaked to the user who has the private key sk.

*** Other configuration ***
<Modification 1>
In the first embodiment, each functional component is realized by software. However, as a first modification, each functional component may be realized by hardware. Differences between the first modification and the first embodiment will be described.

The configuration of the setup device 20 according to the first modification will be described with reference to FIG.
When the function is realized by hardware, the setup device 20 includes an electronic circuit 25 instead of the processor 21, the memory 22, and the storage 23. The electronic circuit 25 is a dedicated circuit that realizes the functional components of the setup device 20 and the functions of the memory 22 and the storage 23.

The configuration of the key generation device 30 according to the first modification will be described with reference to FIG.
When the function is realized by hardware, the key generation device 30 includes an electronic circuit 35 instead of the processor 31, the memory 32, and the storage 33. The electronic circuit 35 is a dedicated circuit that implements the functional components of the key generation device 30 and the functions of the memory 32 and the storage 33.

The configuration of the token generation device 40 according to the first modification will be described with reference to FIG.
When the function is realized by hardware, the token generation device 40 includes an electronic circuit 45 instead of the processor 41, the memory 42, and the storage 43. The electronic circuit 45 is a dedicated circuit that realizes the functional components of the token generation device 40 and the functions of the memory 42 and the storage 43.

The configuration of the encryption device 50 according to the first modification will be described with reference to FIG.
When the function is implemented by hardware, the encryption device 50 includes an electronic circuit 55 instead of the processor 51, the memory 52, and the storage 53. The electronic circuit 55 is a dedicated circuit for realizing the functional components of the encryption device 50 and the functions of the memory 52 and the storage 53.

The configuration of the confidentiality analysis device 60 according to the first modification will be described with reference to FIG.
When the function is realized by hardware, the confidentiality analysis device 60 includes an electronic circuit 65 instead of the processor 61, the memory 62, and the storage 63. The electronic circuit 65 is a dedicated circuit for realizing the functional components of the confidentiality analysis device 60 and the functions of the memory 62 and the storage 63.

The

electronic circuits

25, 35, 45, 55, 65 are a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), and an FPGA (FPGA). Field-Programmable Gate Array) is assumed.
The function of each functional constituent element of the setup device 20 may be realized by one electronic circuit 25, or the function of each functional constituent element may be distributed to a plurality of electronic circuits 25 and realized. Similarly, for each of the key generation device 30, the token generation device 40, the encryption device 50, and the confidentiality analysis device 60, even if the functions of the respective functional components are realized by one

electronic circuit

35, 45, 55, 65. Alternatively, the function of each functional component may be distributed to a plurality of

electronic circuits

35, 45, 55, and 65 to be realized.

<Modification 2>
As a second modification, some functions may be realized by hardware and other functions may be realized by software. That is, among the functional components, some functions may be realized by hardware and other functions may be realized by software.

The

processor

21, 31, 41, 51, 61, the

memory

22, 32, 42, 52, 62, the

storage

23, 33, 43, 53, 63 and the

electronic circuit

25, 35, 45, 55, 65 are called a processing circuit. That is, the function of each functional component is realized by the processing circuit.

Embodiment 2.
The second embodiment differs from the first embodiment in that a pseudo random function is used instead of public key encryption. In the second embodiment, these different points will be described, and description of the same points will be omitted.

The operation of the confidentiality analysis system 10 according to the second embodiment will be described with reference to FIGS. 9 to 11.
The operations of the setup device 20 and the key generation device 30 are the same as in the first embodiment. Therefore, the operations of the token generation device 40, the encryption device 50, and the confidentiality analysis device 60 will be described here.

** Pseudo-random function **
The confidentiality analysis system 10 uses a pseudo-random function. The pseudo-random function F: K × D → R has the following PRF. KeyGen algorithm and PRF. And the Eval algorithm. Here, K is a key space, D is a domain of input values, and R is a range of output values.

<PRF. KeyGen Algorithm>
PRF. The KeyGen algorithm is a key generation algorithm. PRF. The KeyGen algorithm inputs the security parameter λ and outputs the key kεK of the pseudo-random function.
<PRF. Eval algorithm>
PRF. The Eval algorithm is an evaluation algorithm. PRF. The Eval algorithm inputs the key k of the pseudo-random function and the value jεD, and outputs the value mεR.

** Operation of token generator 40 **
The operation of the token generation device 40 according to the second embodiment will be described with reference to FIG.
The operation of the token generation device 40 according to the second embodiment corresponds to the token generation method according to the second embodiment. The operation of the token generation device 40 according to the second embodiment corresponds to the processing of the token generation program according to the second embodiment.
The token generation device 40 implements the GenToken algorithm in token-based multiple input function cryptography.

The processing of step S31 and step S33 is the same as that of the first embodiment.

(Step S32: token generation process)
The token generation unit 412 reads the security parameter λ from the memory 42. The token generation unit 412 uses i = 1 ,. . . , N for each integer i, with security parameter λ as input, PRF. The KeyGen algorithm is run to generate the key k _i for the pseudo-random function.
The token generation unit 412 uses i = 1 ,. . . , N for each integer i of the pseudo-random function, the set of the key k _i and the value j = 0 is set in the encryption token etk _i . In addition, the token generation unit 412 uses i = 1 ,. . . , Sets the key k _i of the pseudo random function for each integer i of n to the decoding token dtk. That is, i = 1 ,. . . , And n for each integer i, etk _i : = (k _i , j = 0) and dtk: = (k ₁ , ..., K _n ). The token generation unit 412 uses i = 1 ,. . . Writes the encrypted token ETK _i for each integer i of n, a decoding token dtk in memory 42.

** Operation of the encryption device 50 **
The operation of the encryption device 50 according to the second embodiment will be described with reference to FIG.
The operation of the encryption device 50 according to the second embodiment corresponds to the encryption method according to the second embodiment. The operation of the encryption device 50 according to the second embodiment corresponds to the processing of the encryption program according to the second embodiment.
The encryption device 50 implements the Enc algorithm in token-based multiple input function encryption.

The processing of step S41, step S42, and step S44 is the same as that of the first embodiment.

(Step S43: Second encryption process)
The encryption unit 514 reads the encrypted token etk _i : = (k _i , j) from the token storage unit 532. The encryption unit 514 also reads the ciphertext c ′ _i from the memory 52. Encryption unit 514 is input with a key _{k i} and the value j of the pseudo random function in encrypted token ETK _i, PRF. Run the Eval algorithm to generate the value m _i .
Encryption unit 514, a ciphertext c _'i, and calculates the exclusive OR between the value _{m i,} to generate ciphertext ^c _{* i.} The encryption unit 514 sets a pair of the ciphertext c ^* _i and the value j in the ciphertext c _i . The encryption unit 514 writes the ciphertext c _i in the memory 52.
Further, the encryption unit 514 adds 1 to the value j to update the encrypted token etk _i : = (k _i , j) stored in the token storage unit 532. That is, the value j is updated to a different value each time it is encrypted. For example, when the read encrypted token ETK _i is _(k i, 0) is encrypted token ETK _i becomes _(k i, 1). Accordingly, when the second encryption process is executed again for the same index i, a different value m _i will be generated. Although 1 is added to the value j here, the value j may be updated by another method as long as the value j has a different value.

** Operation of the confidential analysis device 60 **
The operation of the privacy analysis apparatus 60 according to the second embodiment will be described with reference to FIG.
The operation of the confidentiality analysis device 60 according to the second embodiment corresponds to the confidentiality analysis method according to the second embodiment. The operation of the confidentiality analysis device 60 according to the second embodiment corresponds to the processing of the confidentiality analysis program according to the second embodiment.
The confidentiality analysis device 60 implements the Dec algorithm in the token-based multiple input function encryption.

The processing of steps S52 and S53 is the same as that of the first embodiment.

(Step S51: First decryption process)
The decryption unit 614 reads the decryption token dtk from the token acquisition unit 612. In addition, the decoding unit 614 determines that i = 1 ,. . . Reads ciphertext _{c i} for each integer i of n from the ciphertext storage unit 633. The decoding unit 614 determines that i = 1 ,. . . For each integer i of n, as inputs and the key _{k i} of the pseudo random function that is included in the decoded token dtk, the value j included in the ciphertext _{c i,} PRF. Run the Eval algorithm to generate the value m _i .
The decoding unit 614 determines that i = 1 ,. . . , N for each integer i, the exclusive OR of the ciphertext c ^* _i and the value m _i is calculated to generate the ciphertext c ′ _i . The decryption unit 614 writes the ciphertext c ′ _i in the memory 62.

*** Effects of Embodiment 2 ***
As described above, the confidentiality analysis system 10 according to the second embodiment can achieve the same effect as that of the first embodiment by using the pseudo-random function instead of the public key encryption.
Further, the concealment analysis system 10 according to the second embodiment, the value j for use in generating the value m _i is different value for each encryption. Therefore, since the value m _i is different for each encryption, high security can be realized.

10 secret analysis system, 20 setup device, 21 processor, 22 memory, 23 storage, 24 communication interface, 25 electronic circuit, 211 parameter acquisition unit, 212 master key generation unit, 213 transmission unit, 231 master key storage unit, 30 key generation Device, 31 processor, 32 memory, 33 storage, 34 communication interface, 35 electronic circuit, 311, master key acquisition unit, 312 value acquisition unit, 313 secret key generation unit, 314 transmission unit, 331 master key storage unit, 40 token generation device , 41 processor, 42 memory, 43 storage, 44 communication interface, 45 electronic circuit, 411 parameter acquisition part, 412 token generation part, 413 transmission part, 50 encryption device, 51 process Service, 52 memory, 53 storage, 54 communication interface, 55 electronic circuit, 511 master key acquisition unit, 512 token acquisition unit, 513 message acquisition unit, 514 encryption unit, 515 transmission unit, 531 master key storage unit, 532 token storage Section, 60 confidentiality analyzer, 61 processor, 62 memory, 63 storage, 64 communication interface, 65 electronic circuit, 611 private key acquisition section, 612 token acquisition section, 613 ciphertext acquisition section, 614 decryption section, 615 transmission section, 631 Private key storage unit, 632 token storage unit, 633 ciphertext storage unit, 90 transmission path.

Claims

For integer n greater than or equal to 1, i = 1 ,. . . , Ciphertext c 'i of encrypted messages x i for each integer i of n, as inputs the secret key sk y value y is set, the said value and the message x i for each integer i The ciphertext c ′ i in the common key type multiple-input function cryptography that outputs the operation result obtained by inputting y and the function f obtains the ciphertext c i encrypted using the encryption token etk. Ciphertext acquisition unit,
A decryption key acquisition unit for acquiring the secret key sk y in the common key type multiple input function code,
A token acquisition unit for acquiring a decryption token dtk corresponding to the encryption token etk;
By the ciphertext c i and decrypted using the decryption token dtk 'generates a i, the ciphertext c using the secret key sk y' the ciphertext c decodes the i, the calculation result A confidentiality analysis device comprising a decryption unit for calculating.
The encryption token etk is a public key in public key cryptography,
The decryption token is a secret key in the public key encryption,
The ciphertext c i is generated by encrypting the ciphertext c ′ i by the encryption algorithm of the public key encryption using the encryption token etk,
The confidentiality analysis device according to claim 1, wherein the decryption unit decrypts the ciphertext c i by the decryption algorithm of the public key encryption using the decryption token dtk to generate the ciphertext c ′ i .
The encryption token etk and the decryption token are keys of a pseudo-random function,
The cipher text c i, using the evaluation value m i obtained by estimation algorithm of the pseudo random function said encrypted token etk as inputs, the ciphertext c 'i is generated encrypted,
The decryption unit decrypts the ciphertext c i using the evaluation value m ′ i obtained by the evaluation algorithm of the pseudo-random function with the decryption token as an input to generate the ciphertext c ′ i. The confidentiality analysis device according to Item 1.
The encryption token etk is a set of a pseudo random function key and a value j that is updated to a different value each time encrypted.
The evaluation value m i is obtained by an evaluation algorithm of the pseudo random function, using the key of the pseudo random function and the value j as inputs,
The cipher text c i is the ciphertext c * i to the ciphertext c 'i is encrypted using the evaluation value m i, and the value j input in calculating the evaluation value m i Including,
The confidentiality analysis device according to claim 3, wherein the evaluation value m ′ i is obtained by an evaluation algorithm of the pseudo-random function with the decryption token and the value j included in the ciphertext c i as inputs.
The ciphertext c * i is a ciphertext obtained by calculating an exclusive OR of the ciphertext c 'i and the evaluation value m i,
The decoder calculates an exclusive OR of the evaluation value m 'i and the ciphertext c * i, concealment analyzer according to claim 4 for decoding the cipher text c i.
i = 1 ,. . . , Ciphertext c 'i of encrypted messages x i for each integer i of n, as inputs the secret key sk y value y is set, the said value and the message x i for each integer i A secret analysis system using common key type multi-input function encryption, which outputs a calculation result obtained by inputting y and a function f,
An encryption device for encrypting the ciphertext c ′ i in the common key type multi-input function encryption using an encryption token etk to generate a ciphertext c i ;
The ciphertext c i and decrypted using the decryption token dtk corresponding to the cryptographic token etk to generate the ciphertext c 'i, by using the secret key sk y in the common key type multiple input function cipher A confidentiality analysis system comprising: a decryption device that decrypts the ciphertext c ′ i to calculate the calculation result.
The ciphertext acquisition unit in the confidentiality analysis device determines that i = 1 ,. . . , Ciphertext c 'i of encrypted messages x i for each integer i of n, as inputs the secret key sk y value y is set, the said value and the message x i for each integer i The ciphertext c ′ i in the common key type multi-input function encryption that outputs y and y to the function f to obtain the operation result acquires the ciphertext c i encrypted using the encryption token etk. ,
The decryption key acquisition unit concealment analyzer acquires the secret key sk y in the common key type multiple input function code,
A token acquisition unit in the confidentiality analysis device acquires a decryption token dtk corresponding to the encrypted token etk,
Said decoding unit in the concealment analyzer, the cipher text c i and decrypted using the decryption token dtk 'generates a i, the ciphertext c using the secret key sk y' the ciphertext c to i A confidentiality analysis method for calculating the calculation result by decoding.
For integer n greater than or equal to 1, i = 1 ,. . . , Ciphertext c 'i of encrypted messages x i for each integer i of n, as inputs the secret key sk y value y is set, the said value and the message x i for each integer i The ciphertext c ′ i in the common key type multiple-input function cryptography that outputs the operation result obtained by inputting y and the function f obtains the ciphertext c i encrypted using the encryption token etk. Ciphertext acquisition process,
A decryption key acquisition process of acquiring the secret key sk y in the common key type multiple input function code,
A token acquisition process for acquiring a decryption token dtk corresponding to the encryption token etk;
By the ciphertext c i and decrypted using the decryption token dtk 'generates a i, the ciphertext c using the secret key sk y' the ciphertext c decodes the i, the calculation result A confidentiality analysis program that causes a computer to function as a confidentiality analysis device that performs a decryption process for calculation.