WO2024013924A1

WO2024013924A1 - Encryption system, key issuing device, key issuing method, and key issuing program

Info

Publication number: WO2024013924A1
Application number: PCT/JP2022/027681
Authority: WO
Inventors: 光土田
Original assignee: 日本電気株式会社
Priority date: 2022-07-14
Filing date: 2022-07-14
Publication date: 2024-01-18

Abstract

Provided is an encryption system comprising a key issuing device, a decryption device, and an encryption device, which are connected to one another via a network, wherein the key issuing device comprises: a setup unit that generates a master secret key and public parameters defining attribute indices; a user decryption key generation unit that generates a user decryption key by using the master secret key, an attribute related to a user who receives issuance of the user decryption key, a user ID used by the entire system, and a decryption key ID; a master secret key storage unit that stores the master secret key; a public parameter storage unit that stores the public parameters; an effective key list storage unit that stores, as an effective key list, decryption key IDs indicating effective user decryption keys among issued user decryption keys; and a managed attribute storage unit that stores managed attributes, wherein the decryption device comprises: a ciphertext decryption unit that decrypts ciphertext by using the user decryption key defining such an attribute, user ID, and decryption key ID as to satisfy the effective key list and an access condition expression defined in the ciphertext to be decrypted; and a user decryption key storage unit that stores the user decryption key, and wherein the encryption device comprises: a ciphertext generation unit that generates ciphertext by using the public parameters, the effective key list, and the access condition expression; a public parameter storage unit that stores the public parameters; and an effective key list storage unit that stores the effective key list.

Description

Cryptographic system, key issuing device, key issuing method, and key issuing program

The present invention relates to a cryptographic system, a key issuing device, a key issuing method, and a key issuing program.

Role-based access control is one of the access control technologies in computer security. Role-based access control grants privileges to users by their assigned roles, rather than by individual users. Here, a role represents, for example, a user's role, attribute, or affiliation in a system or organization, and the administrator assigns a role to each user based on the attribute within the organization and permissions are also granted to the role.

Attribute-based encryption is a cryptographic method that achieves this role-based access control. In attribute-based encryption, rather than directly specifying the decryptor, the authority to decrypt is specified using attributes. In attribute-based encryption, encryption is performed by incorporating not only a decryption key for decrypting ciphertext, but also an attribute of the authority that can decrypt it. In decryption of attribute-based encryption, authentication is performed using a conditional expression that determines the attribute of the authority that can decrypt, which is incorporated into the ciphertext, and only the decryptor with the attribute of authority that can decrypt can succeed in decryption. For example, the encryption technique described in Patent Document 1 uses a process of determining the attributes of a decryption-permitted user who is permitted to decrypt encrypted data.

International Publication No. 2016/132546

Furthermore, each disclosure of the above-mentioned prior art documents is incorporated into this book by reference. The following analysis was performed by the inventors.

By the way, there are various problems with existing attribute-based cryptography, and the following three problems can be cited as typical ones.
1. Issues related to the entity that manages attributes 2. Issue 3 regarding the parameter size published by the key issuing authority. Issues with decryption key revocation

The problem with the entity that manages attributes stems from the fact that it is not always possible for only one entity to manage the attributes of decryptable authority. A decryptor using attribute-based encryption may have multiple attributes, and these multiple attributes may be managed independently by multiple entities.

The problem with the parameter size published by the key issuing authority is that as the number of attributes managed by the key issuing authority increases, the parameter size published by the key issuing authority also increases accordingly. The parameters published by the key issuing authority are also used when creating the ciphertext and influence the size of the encrypted ciphertext. Therefore, a method that does not depend on the number of attributes managed by the issuing organization is preferable.

The problem with decryption key revocation stems from the fact that decryption keys are not necessarily reliable. If the attribute incorporated in the decryption key satisfies the conditional expression set in the ciphertext, decryption will be successful, but the decryption key may have been leaked or may have expired. For such cases, a function to revoke the decryption key is also required.

Note that the above three problems are independent problems, so it is also possible to solve only some of the problems, such as one or two of the three. In fact, in the prior art, only one or two of the above three problems were often solved. However, when considering the purpose of implementing and operating an actual system, a method that solves all of the above three problems is preferable.

In view of the above-mentioned problems, an object of the present invention is to provide a cryptographic system, a key issuing device, a key issuing method, and a key issuing program that contribute to appropriately and efficiently handling attribute-based cryptography.

A first aspect of the present invention includes a key issuing device, a decrypting device, and an encrypting device that are connected via a network, and each of the key issuing devices generates a public parameter that defines an index related to an attribute and a master private key. a user decryption key generation unit that generates a user decryption key using the master private key, attributes related to the user to be issued, a user ID used throughout the system, and an ID related to the decryption key; A master private key storage unit that stores the master private key, a public parameter storage unit that stores the public parameters, and a decryption key that indicates which user decryption key is valid among the issued user decryption keys. The decryption device includes a valid key list storage unit that stores IDs as a valid key list, and a management attribute storage unit that stores managed attributes, and the decryption device stores an access condition expression defined in a ciphertext to be decrypted and the valid key. a ciphertext decryption unit that decrypts a ciphertext using the user decryption key in which an attribute that satisfies the list, the user ID, and an ID related to the decryption key are defined; and a user decryption key storage unit that stores the user decryption key. The encryption device includes: a ciphertext creation unit that creates a ciphertext using the public parameters, the valid key list, and the access condition expression; a public parameter storage unit that stores the public parameters; A cryptographic system is provided, comprising: a valid key list storage unit that stores the valid key list.

In a second aspect of the present invention, there is provided a setup unit that generates public parameters that define indexes related to attributes and a master private key, and a setup unit that generates public parameters that define indexes related to attributes and a master private key, and a set-up unit that generates public parameters that define indexes related to attributes, and attributes that are related to the master private key, a user to whom the key is issued, and a user that is used in the entire system. a user decryption key generation unit that generates a user decryption key using an ID and an ID related to the decryption key; a master private key storage unit that stores the master private key; a public parameter storage unit that stores parameters; and a list of valid keys that the encryption device uses to create a ciphertext, including IDs related to decryption keys that indicate which user decryption keys are valid among the user decryption keys that have already been issued; It is equipped with a valid key list storage unit that stores the valid key list as A key issuing device is provided.

In a third aspect of the present invention, a public parameter that defines an index related to attributes and a master private key are generated, and the master private key, attributes related to the user to be issued, and a user ID used in the entire system are decrypted. A key issuing method is provided in which a user decryption key is generated using an ID related to a key, and the user decryption key is issued to a decryption device that decrypts a ciphertext created by an encryption device connected via a network.

In a fourth aspect of the present invention, a public parameter that defines an index related to an attribute and a master private key are generated, and the master private key, an attribute related to the user to be issued, and a user ID used in the entire system are decrypted. A key issuing program is provided that generates a user decryption key using an ID related to the key, and issues the user decryption key to a decryption device that decrypts a ciphertext created by an encryption device connected via a network.
Note that this program can be recorded on a computer-readable storage medium. The storage medium can be non-transient, such as a semiconductor memory, a hard disk, a magnetic recording medium, an optical recording medium, etc. The invention can also be implemented as a computer program product.

According to each aspect of the present invention, it is possible to provide a cryptographic system, a key issuing device, a key issuing method, and a key issuing program that contribute to appropriately and efficiently handling attribute-based cryptography.

FIG. 1 is a diagram showing an overview of role-based access control using attribute-based cryptography. FIG. 2 is a configuration diagram showing an overview of a cryptographic system according to an embodiment of the present invention. FIG. 3 is a diagram showing an example of a binary tree used to determine the validity of a decryption key. FIG. 4 is a diagram showing an example of a hardware configuration of a key issuing device, a decrypting device, and an encrypting device.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiments described below. Further, in each drawing, the same or corresponding elements are designated by the same reference numerals as appropriate. Furthermore, it should be noted that the drawings are schematic and the dimensional relationship of each element, the ratio of each element, etc. may differ from the actual one. Drawings may also include portions that differ in dimensional relationships and ratios.

[Role-based access control using attribute-based encryption]
First, role-based access control using attribute-based cryptography to which the present invention is expected to be applied will be explained. FIG. 1 is a diagram showing an overview of role-based access control using attribute-based cryptography.

As shown in FIG. 1, in role-based access control using attribute-based encryption, a key issuing authority issues a decryption key, and a decryptor, who is a user, decrypts a ciphertext using this decryption key. The ciphertext is created by a ciphertext creator and stored in, for example, cloud storage. The decryption key issued by the key issuing authority incorporates an attribute set that includes the user's attribute information, and when the decryptor (user) decrypts the ciphertext, it is used to determine the authority to decrypt. . The ciphertext created by the ciphertext creator has embedded a conditional expression used to determine the authority to decrypt it, and when decrypting the ciphertext, the attributes included in the decryption key are The authority for decryption is determined by applying the attribute information to a conditional expression.

The conditional expression used to determine the authority to decrypt is created from public parameters related to the list of valid keys (attributes) managed by the key issuing authority and embedded in the ciphertext. Therefore, a malicious administrator cannot change this conditional expression, which is highly secure.

[Cryptographic system according to embodiment]
FIG. 2 is a configuration diagram showing an overview of a cryptographic system according to an embodiment of the present invention. As shown in FIG. 2, the cryptographic system 10 according to the embodiment of the present invention includes a plurality of key issuing devices 100 ₁ to 100 _n , a decrypting device 110, and an encrypting device 120.

Each of the plurality of key issuing apparatuses 100 ₁ to 100 _n is operated by a different key issuing entity. That is, each of the plurality of key issuing devices 100 ₁ to 100 _n manages different attribute information, and generates a user decryption key using the attribute information managed by each one. Further, the plurality of key issuing devices 100 ₁ to 100 _n generate and manage a valid key list indicating which user decryption keys are valid among the generated user decryption keys. Note that the plurality of key issuing apparatuses 100 ₁ to 100 _n can each be operated by a different key issuing entity and manage different attributes, but they can also have the same apparatus configuration, so the following will be explained below. Now, the configuration of the key issuing device ₁₀₀₁ will be explained as a representative.

The decryption device 110 decrypts the ciphertext generated by the encryption device 120 using the user decryption keys issued by the key issuing devices 100 ₁ to 100 _n . Attribute information is embedded in the user decryption keys issued by the key issuing devices 100 ₁ to 100 _n . On the other hand, the ciphertext generated by the encryption device 120 has a conditional expression used to determine the authority to decrypt it, and if the attribute information incorporated in the user decryption key clears this conditional expression, , the ciphertext is successfully decrypted.

The encryption device 120 uses the valid key list generated by the key issuing devices 100 ₁ to 100 _n to create a conditional expression for determining permission to decrypt a ciphertext, and creates a ciphertext incorporating this conditional expression. Note that the ciphertext created by the encryption device 120 may be held as is by the encryption device 120, and the decryption device 110 may access the ciphertext held in the encryption device 120 and decrypt the ciphertext. However, it is also possible to store the ciphertext in a separate storage server and have the decryption device 110 access the ciphertext stored in the storage server.

Here, the functions and configurations of the key issuing devices 100 ₁ to 100 _n , the decrypting device 110, and the encrypting device 120 will be explained in more detail.

Each key issuing device 100 ₁ to 100 _n has a setup section 101 ₁ , a user decryption key generation section 102 ₁ , a master private key storage section 103 ₁ , a public parameter storage section 104 ₁ , a valid key list storage section 105 ₁ , and a management attribute storage section. ₁₀₆₁ .

The setup unit 1011 generates a public parameter and a master private key with the parameter size as a constant by defining an index related to the attribute. The user decryption key generation unit 1021 generates a user decryption key using a master private key, attributes related to the user to be issued, a user ID used throughout the system, and an ID related to the decryption key.

The master private key storage unit ₁₀₃₁ is a storage device for storing a master private key. The public parameter storage unit ₁₀₄₁ is a storage device for storing public parameters in which the parameter size is a constant by defining an index related to an attribute. The valid key list storage unit ₁₀₅₁ is a storage device for storing IDs related to decryption keys as a list indicating which user decryption keys are valid among issued user decryption keys. The managed attribute storage unit 1061 is a storage device for storing managed attributes. The setup unit 101 ₁ and the user decryption key generation unit 102 ₁ store information stored in the master private key storage unit 103 ₁ , the public parameter storage unit 104 ₁ , the valid key list storage unit 105 ₁ and the management attribute storage unit 106 ₁ . 1, generates a user decryption key, etc., and stores these in the master private key storage section 103 ₁ , public parameter storage section 104 ₁ , valid key list storage section 105 ₁ , and management attribute storage section 106 ₁ .

The decryption device 110 includes a ciphertext decryption section 111 and a user decryption key storage section 112. The ciphertext decryption unit 111 decrypts the ciphertext using a decryption key in which an attribute, a user ID, and an ID related to the decryption key are defined that satisfy a conditional expression and a valid key list defined for the ciphertext to be decrypted. . The user decryption key storage unit 112 is a storage device for storing user decryption keys issued by the key issuing devices 100 ₁ to 100 _n .

The encryption device 120 includes a ciphertext creation section 121, a public parameter storage section 122, and a valid key list storage section 123. The ciphertext creation unit 121 creates a ciphertext using a public parameter with the parameter size as a constant, a valid key list, and an access condition expression by defining an index related to an attribute. The public parameter storage unit 122 is a storage device for storing public parameters with the parameter size as a constant by defining an index related to an attribute. The valid key list storage unit 123 is a storage device for storing a list of IDs related to decryption keys indicating which user decryption keys are valid among issued user decryption keys.

The configuration of the user decryption key and the authority to decrypt it are determined, for example, as follows.

Each key issuing device 100 ₁ to 100 _n embeds managed attribute information in the user decryption key as an attribute vector x. On the other hand, the encryption device 120 embeds in the ciphertext a condition vector v whose inner product is calculated to be zero with an attribute vector x that permits decryption. An example of a conditional expression is, for example, whether the value of the inner product of the attribute vector x and the condition vector v is zero. The decryption device 110 inputs the attribute vector x embedded in the issued user decryption key into the conditional expression embedded in the ciphertext, and succeeds in decryption when the value of the output inner product is zero. Note that whether or not the value of the inner product is zero is an example of a conditional expression, and the conditional expression is not necessarily limited to whether or not the value of the inner product is zero; for example, the value of the inner product with the condition vector and It is also possible to use a conditional expression that allows decoding when the condition regarding the value of the inner product and the logical expression are satisfied. When access control is performed using the inner product value and logical formula, multifaceted authentication is performed, such as determining the validity of the decryption key using only the inner product value, and using a combination of the inner product value and logical formula for access control. It will also be possible to do so.

FIG. 3 is a diagram showing an example of a binary tree used to determine the validity of a decryption key. Here, consider an example in which decryption keys ID0 to ID3 have been issued, and among these decryption keys ID0 to ID2 are valid. At this time, the encryption device 120 generates a condition vector from the public parameters and valid key list received from each key issuing device 100 ₁ to 100 _n .

is created and embedded in the ciphertext as a conditional expression used to determine a valid key. On the other hand, each key issuing device 100 ₁ to 100 _n includes a validity vector in the user decryption key of user ID 1 as a value input to a conditional expression used to determine a valid key.

Incorporate. Then, when the decryption device 110 decrypts the ciphertext, the validity vector

and condition vector

Since the inner product of is zero, the valid key determination is cleared and user ID1 successfully decrypts the ciphertext.

Note that the parameters v ₀ to v ₆ assigned to each node of the binary tree shown in FIG. 3 can be configured from public parameters generated by each of the key issuing devices 100 ₁ to 100 _n . Furthermore, it is possible to know the correspondence between valid user decryption keys and parameters v ₀ to v ₆ from the valid key list generated by each key issuing device 100 ₁ to 100 _n . Therefore, the encryption device 120 can configure a conditional expression such that the inner product becomes zero when a validity vector incorporated in a valid user decryption key is input.

In the cryptographic system described above, each of the plurality of key issuing authorities operates the key issuing devices 100 ₁ to 100 _n , so that each of the plurality of key issuing authorities can issue a user decryption key for attribute-based encryption. In addition, it is possible to determine whether the user decryption key has expired while preventing the size of the parameters to be made public from increasing. That is, the cryptographic system, key issuing devices 100 ₁ to 100 _n , key issuing method, and key issuing program described above can contribute to appropriately and efficiently handling attribute-based cryptography.

[Hardware configuration example]
FIG. 4 is a diagram showing an example of a hardware configuration of a key issuing device, a decrypting device, and an encrypting device. The information processing device (computer) employing the hardware configuration shown in FIG. 4 makes it possible to realize the functions of the key issuing devices 100 ₁ to 100 _n , the decrypting device 110, and the encrypting device 120 described above. However, _the hardware configuration example _shown in FIG _. This is not intended to limit the hardware configurations of _n , decryption device 110, and encryption device 120. The key issuing devices 100 ₁ to 100 _n , the decrypting device 110, and the encrypting device 120 may include hardware not shown in FIG. 4.

As shown in FIG. 4, a hardware configuration 40 that can be adopted by the key issuing devices 100 ₁ to 100 _n , the decrypting device 110, and the encrypting device 120 includes, for example, a CPU (Central Processing Unit) connected to each other by an internal bus. 41, a main storage device 42, an auxiliary storage device 43, and an IF (Interface) section 44.

The CPU 41 executes each command included in the program executed by the key issuing devices 100 ₁ to 100 _n , the decrypting device 110, and the encrypting device 120. The main storage device 42 is, for example, a RAM (Random Access Memory), and temporarily stores various programs executed by the key issuing devices 100 ₁ to 100 _n , the decrypting device 110, and the encrypting device 120 for processing by the CPU 41.

The auxiliary storage device 43 is, for example, an HDD (Hard Disk Drive), and stores various programs executed by the key issuing devices 100 ₁ to 100 _n , the decrypting device 110, and the encrypting device 120 on a medium- to long-term basis. is possible. Various programs can be provided as program products recorded on non-transitory computer-readable storage media. The auxiliary storage device 43 can be used for medium- to long-term storage of various programs recorded on non-temporary computer-readable recording media. The IF unit 44 provides an interface for communication between the key issuing devices 100 ₁ to 100 _n , the decrypting device 110, and the encrypting device 120.

An information processing device employing the above-described hardware configuration 40 can realize the functions of the key issuing devices 100 ₁ to 100 _n , the decrypting device 110, and the encrypting device 120.

Part or all of the above embodiments may be described as in the following additional notes, but are not limited to the following.
[Additional note 1]
Equipped with a key issuing device, decryption device, and encryption device connected via a network,
The key issuing device includes a setup unit that generates public parameters that define indexes related to attributes and a master private key;
a user decryption key generation unit that generates a user decryption key using the master private key, attributes related to the user to be issued, a user ID used throughout the system, and an ID related to the decryption key;
a master private key storage unit that stores the master private key;
a public parameter storage unit that stores the public parameters;
a valid key list storage unit that stores IDs related to decryption keys indicating which user decryption keys are valid among the issued user decryption keys as a valid key list;
and a management attribute storage unit for storing attributes to be managed;
The decryption device decrypts the ciphertext using the user decryption key in which the access condition expression specified for the ciphertext to be decrypted, the attribute that satisfies the valid key list, the user ID, and the ID related to the decryption key are specified. a ciphertext decryption unit that decrypts the
a user decryption key storage unit that stores the user decryption key;
The encryption device includes a ciphertext creation unit that creates a ciphertext using the public parameter, the valid key list, and the access condition expression;
a public parameter storage unit that stores the public parameters;
A cryptographic system, comprising: a valid key list storage unit that stores the valid key list.
[Additional note 2]
The access conditional expression takes as input the attribute vector incorporated in the user decryption key, calculates the inner product with the condition vector incorporated in the access conditional expression, and satisfies the condition and logical expression regarding the value of the inner product. The cryptographic system described in Appendix 1, which permits decryption in cases where:
[Additional note 3]
The cryptographic system according to appendix 2, wherein the value of the inner product is a criterion for determining validity of a user decryption key, and the logical expression is a criterion for access control.
[Additional note 4]
The cryptographic system according to appendix 1, wherein the valid key list allocates parameters of attribute information to each node representing attributes managed using a binary tree.
[Additional note 5]
The conditional expression for determining the validity of the user decryption key includes parameters assigned to each node of the binary tree, and the attribute vector incorporated in the user decryption key also includes a parameter assigned to each node of the binary tree. The cryptographic system according to appendix 4, comprising parameters assigned to each node.
[Additional note 6]
a setup unit that generates public parameters that define indexes related to attributes and a master private key;
a user decryption key generation unit that generates a user decryption key using the master private key, attributes related to the user to be issued, a user ID used in the entire system, and an ID related to the decryption key;
a master private key storage unit that stores the master private key;
a public parameter storage unit that stores the public parameters used to create the ciphertext;
a valid key list storage unit that stores IDs related to decryption keys indicating which user decryption keys are valid among the issued user decryption keys as a valid key list;
A key issuing device that issues a user decryption key for a decryption device to decrypt a ciphertext created by an encryption device connected via a network, and a management attribute storage unit that stores managed attributes.
[Additional note 7]
The key issuing device according to appendix 6, wherein the valid key list allocates parameters of attribute information to each node representing attributes managed using a binary tree.
[Additional note 8]
The conditional expression for determining the validity of the user decryption key includes parameters assigned to each node of the binary tree, and the attribute vector incorporated in the user decryption key also includes a parameter assigned to each node of the binary tree. The key issuing device according to appendix 7, which includes parameters assigned to each node.
[Additional note 9]
Generate public parameters and master private keys that define indexes for attributes,
Generating a user decryption key using the master private key, attributes related to the user to be issued, a user ID used throughout the system, and an ID related to the decryption key;
A key issuing method for issuing the user decryption key to a decryption device that decrypts a ciphertext created by an encryption device connected through a network.
[Additional note 10]
Generate public parameters and master private keys that define indexes for attributes,
Generating a user decryption key using the master private key, attributes related to the user to be issued, a user ID used throughout the system, and an ID related to the decryption key;
A key issuing program that issues the user decryption key to a decryption device that decrypts a ciphertext created by an encryption device connected through a network.
[Additional note 11]
A valid key list indicating which user decryption keys are valid among the user decryption keys that have been issued is provided in Appendix 10, which assigns attribute information parameters to each node of the attribute representation managed using a binary tree. The key issuing program described.

In the present invention, it is obvious that a computer is used when an algorithm, software or flowchart or automated process step is shown, and it is also obvious that the computer is equipped with a processor and a memory or storage device. It is. Therefore, even if these elements are not explicitly stated, it is understood that these elements are naturally described in the present application.

Furthermore, the disclosures of the above cited patent documents, etc. are incorporated into this book by reference. Within the scope of the entire disclosure of the present invention (including the claims), changes and adjustments to the embodiments and examples are possible based on the basic technical idea thereof. In addition, various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible within the framework of the entire disclosure of the present invention. (including partial deletion) is possible. That is, it goes without saying that the present invention includes the entire disclosure including the claims and various modifications and modifications that a person skilled in the art would be able to make in accordance with the technical idea. In particular, numerical ranges stated herein should be construed as specifically stating any numerical value or subrange within the range, even if not otherwise stated. Furthermore, each of the disclosures in the documents cited above may be used, in part or in whole, in combination with the statements in this book as part of the disclosure of the present invention, if necessary, in accordance with the spirit of the present invention. It is deemed to be included in the disclosure of this application.

100 ₁ to 100 _n Key issuing device 101 ₁ Setup section 102 ₁ User decryption key generation section 103 ₁ Master private key storage section 104 ₁ Public parameter storage section 105 ₁ Valid key list storage section 106 ₁ Management attribute storage section 110 Decryption device 111 Encryption device Text decryption unit 112 User decryption key storage unit 120 Encryption device 121 Ciphertext creation unit 122 Public parameter storage unit 123 Valid key list storage unit

Claims

Equipped with a key issuing device, decryption device, and encryption device connected via a network,
The key issuing device includes a setup unit that generates public parameters that define indexes related to attributes and a master private key;
a user decryption key generation unit that generates a user decryption key using the master private key, attributes related to the user to be issued, a user ID used throughout the system, and an ID related to the decryption key;
a master private key storage unit that stores the master private key;
a public parameter storage unit that stores the public parameters;
a valid key list storage unit that stores IDs related to decryption keys indicating which user decryption keys are valid among the issued user decryption keys as a valid key list;
and a management attribute storage unit for storing attributes to be managed;
The decryption device decrypts the ciphertext using the user decryption key in which the access condition expression specified for the ciphertext to be decrypted, the attribute that satisfies the valid key list, the user ID, and the ID related to the decryption key are specified. a ciphertext decryption unit that decrypts the
a user decryption key storage unit that stores the user decryption key;
The encryption device includes a ciphertext creation unit that creates a ciphertext using the public parameter, the valid key list, and the access condition expression;
a public parameter storage unit that stores the public parameters;
A cryptographic system, comprising: a valid key list storage unit that stores the valid key list.
The access conditional expression takes as input the attribute vector incorporated in the user decryption key, calculates an inner product with the conditional vector incorporated in the access conditional expression, and satisfies the condition regarding the value of the inner product and the logical expression. 2. The cryptographic system of claim 1, wherein the cryptographic system allows decryption if
The cryptographic system according to claim 2, wherein the value of the inner product is a criterion for determining the validity of a user decryption key, and the logical formula is a criterion for access control.
The cryptographic system according to claim 1, wherein the valid key list assigns parameters of attribute information to each node representing attributes managed using a binary tree.
The conditional expression for determining the validity of the user decryption key includes parameters assigned to each node of the binary tree, and the attribute vector incorporated in the user decryption key also includes a parameter assigned to each node of the binary tree. 5. The cryptographic system of claim 4, comprising parameters assigned to each node.
a setup unit that generates public parameters that define indexes related to attributes and a master private key;
a user decryption key generation unit that generates a user decryption key using the master private key, attributes related to the user to be issued, a user ID used throughout the system, and an ID related to the decryption key;
a master private key storage unit that stores the master private key;
a public parameter storage unit that stores the public parameters used to create the ciphertext;
a valid key list storage unit that stores IDs related to decryption keys indicating which user decryption keys are valid among the issued user decryption keys as a valid key list;
and a management attribute storage unit for storing attributes to be managed;
A key issuing device that issues a user decryption key for a decryption device to decrypt a ciphertext created by an encryption device connected via a network.
7. The key issuing device according to claim 6, wherein the valid key list assigns parameters of attribute information to each node representing attributes managed using a binary tree.
The conditional expression for determining the validity of the user decryption key includes parameters assigned to each node of the binary tree, and the attribute vector incorporated in the user decryption key also includes a parameter assigned to each node of the binary tree. The key issuing device according to claim 7, further comprising parameters assigned to each node.
Generate public parameters and master private key that define indexes for attributes,
Generating a user decryption key using the master private key, attributes related to the user to be issued, a user ID used throughout the system, and an ID related to the decryption key;
A key issuing method for issuing the user decryption key to a decryption device that decrypts a ciphertext created by an encryption device connected through a network.
Generate public parameters and master private key that define indexes for attributes,
Generating a user decryption key using the master private key, attributes related to the user to be issued, a user ID used throughout the system, and an ID related to the decryption key;
A key issuing program that issues the user decryption key to a decryption device that decrypts a ciphertext created by an encryption device connected via a network.
10. The valid key list indicating which user decryption keys are valid among the issued user decryption keys, assigns parameters of attribute information to each node of an attribute representation managed using a binary tree. The key issuing program described in .