Ciphertext conversion system, conversion key generation method and conversion key generation program

Abstract

Ciphertext conversion system (100), comprising: a conversion key generating device (600), comprising a conversion target setting unit (603) for generating an attribute-based encryption key and an attribute-based ciphertext that is encrypted with the attribute-based encryption key according to an attribute-based encryption scheme; and a conversion key generation unit (604) for generating a conversion key that converts a first common-key ciphertext into a second common-key ciphertext, which is a ciphertext that conforms to a first common-key cryptographic scheme and is different from the first common-key ciphertext, based on a first cryptographic common-key information used in generating the first common-key ciphertext, by encrypting a plaintext with a first secret key according to the first common-key cryptographic scheme, and to generate a third common-key ciphertext according to a second common-key cryptography scheme by encrypting a second secret key, which is used to decrypt the second common-key ciphertext, with the attribute-based encryption key.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to a ciphertext conversion system, a conversion key generation method, and a conversion key generation program. STATE OF THE ART

[0002] A proxy re-encryption (PRE) scheme is a system in which the decryption authority of a ciphertext is delegated to another person instead of decrypting the ciphertext. Non-Patent Literature 1 discloses a PRE (Attribute-Based PRE, ABPRE) scheme for attribute-based encryption of any scheme. The scheme disclosed in Non-Patent Literature 1 realizes proxy re-encryption between different attribute-based encryptions. Non-Patent Literature 2 discloses a method for changing a key of a common-key cryptography without decrypting a ciphertext of the common-key cryptography. Further encryption methods are disclosed in Patent Literature 1, Patent Literature 2 and Patent Literature 3. REFERENCE LISTS NON-PATENT LITERATURE Non-Patent Literature 1: Zuoxia Yu et al., “Achieving Flexibility for ABE with Outsourcing via Proxy Re-Encryption,” ASIACCS' 18, June 4-8, 2018, Session 16: Applied Crypto 2, pp. 659-672 Non-Patent Literature 2: Amril Syalim et. al, “Realizing Proxy Re-encryption in the Symmetric World,” ICIEIS (International Conference on Informatics Engineering and Information Science) 2011, Informatics Engineering and Information Science, pp. 259-274. PATENT LITERATURE Patent literature 1: JP 6867718 B1 Patent literature 2: WO 2018 / 225248 A1 Patent literature 3: US 2018 / 0254901 A1 DEMOLITION PROBLEM

[0003] A typical proxy re-encryption method such as the method disclosed in Non-Patent Literature 1 is a technique for converting a ciphertext of a certain public-key cryptography scheme into a ciphertext of another public-key cryptography scheme. The technique disclosed in Non-Patent Literature 2 is a technique for converting a ciphertext of common-key cryptography into a ciphertext of common-key cryptography.

[0004] When converting a ciphertext of a common-key cryptography scheme into a ciphertext based on a public-key cryptography scheme, the only option is to decrypt the ciphertext of the common-key cryptography scheme once to obtain a plaintext, and then encrypt the plaintext obtained by the public-key cryptography scheme. Since the plaintext is disclosed, security is low.

[0005] The objective of the present disclosure is to convert a ciphertext encrypted with a common-key cryptography scheme into a ciphertext based on a public-key cryptography scheme, rather than decrypting the ciphertext encrypted with the common-key cryptography scheme. SOLUTION TO THE PROBLEM

[0006] A ciphertext conversion system according to the present disclosure comprises: a conversion key generating device comprising a conversion target setting unit for generating an attribute-based encryption key and an attribute-based ciphertext encrypted with the attribute-based encryption key according to an attribute-based encryption scheme; and a conversion key generation unit for generating a conversion key that converts a first common-key ciphertext into a second common-key ciphertext that is a ciphertext that conforms to a first common-key cryptography scheme and that differs from the first common-key ciphertext, based on first cryptographic common-key information used in generating the first common-key ciphertext, by encrypting a plaintext with a first secret key according to the first common-key cryptography scheme, and to generate a third common-key ciphertext according to a second common-key cryptography scheme by encrypting a second secret key used to decrypt the second common-key ciphertext with the attribute-based encryption key. ADVANTAGEOUS EFFECTS OF THE INVENTION

[0007] In the present disclosure, an attribute-based ciphertext is a ciphertext of a public-key cryptography scheme. A third common-key ciphertext is a ciphertext obtained by encrypting a second secret key with an attribute-based encryption key used to generate the attribute-based ciphertext. Here, the second secret key is used to decrypt a second common-key ciphertext. Thus, the second common-key ciphertext is a ciphertext based on the public-key cryptography scheme. Further, a first common-key ciphertext is a ciphertext encrypted by a first common-key cryptography scheme, which is a common-key cryptography scheme. The second common-key ciphertext is a ciphertext obtained by converting the first common-key ciphertext using a conversion key.When converting the first common-key ciphertext into the second common-key ciphertext, it is not necessary to decrypt the first common-key ciphertext.

[0008] Therefore, according to the present disclosure, it is possible to convert a ciphertext encrypted with a common-key cryptography scheme into a ciphertext based on a public-key cryptography scheme without decrypting the ciphertext encrypted with the common-key cryptography scheme. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a diagram showing a configuration example of a ciphertext conversion system 100 according to Embodiment 1. Fig. 2 is a diagram showing a configuration example of a common key cryptography secret key generation apparatus 200 according to Embodiment 1. Fig. 3 is a diagram showing a configuration example of a parameter generation device 300. Fig. 4 is a diagram showing a configuration example of a user secret key generation apparatus 400 according to Embodiment 1. Fig. 5 is a diagram showing a configuration example of a common key ciphertext generating apparatus 500 according to Embodiment 1. Fig. 6 is a diagram showing a configuration example of a conversion key generation device 600 according to Embodiment 1. Fig. 7 is a diagram showing a configuration example of a conversion device 700 according to Embodiment 1. Fig. 8 is a diagram showing a configuration example of a decryption device 800 according to Embodiment 1. Fig. 9 is a diagram showing an example of the hardware configuration of each device with which the ciphertext conversion system 100 according to Embodiment 1 is equipped. Fig. 10 is a flowchart illustrating the operation of the common key cryptography secret key generation apparatus 200 according to Embodiment 1. Fig. 11 is a flowchart illustrating the operation of the parameter generation device 300 according to Embodiment 1. Fig. 12 is a flowchart illustrating the operation of the user secret key generation device 400 according to Embodiment 1. Fig. 13 is a flowchart illustrating the operation of the common key ciphertext generating apparatus 500 according to Embodiment 1. Fig. 14 is a flowchart illustrating the operation of the conversion key generation device 600 according to Embodiment 1. Fig. 15 is a flowchart illustrating the operation of the conversion device 700 according to Embodiment 1. Fig. 16 is a flowchart illustrating the operation of the decryption device 800 according to Embodiment 1. Fig. 17 is a diagram showing a hardware configuration diagram of each device with which a ciphertext conversion system 100 according to a modification of Embodiment 1 is equipped. DESCRIPTION OF THE EMBODIMENTS

[0009] In the description and drawings of the embodiment, identical and equivalent elements are designated by the same reference numerals. The description of elements designated by the same reference numeral will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate data flows or process sequences. Note that the term "unit" or "device" can be appropriately replaced with "circuit," "method," "stage," "procedure," "process," or "circuit." Embodiment 1.

[0010] The present embodiment will be described in detail below with reference to drawings. *** Description of configurations ***

[0011] Fig. 1 is a block diagram showing a configuration example of a ciphertext conversion system 100 according to the present embodiment.

[0012] As in Fig. 1, a ciphertext conversion system 100 is provided with a common-key cryptographic secret key generation device group 290 consisting of a plurality of common-key cryptographic secret key generation devices 200, a parameter generation device 300, a user secret key generation device group 490 consisting of a plurality of user secret key generation devices 400, a common-key ciphertext generation device 500, a conversion key generation device 600, a conversion device 700, and a decryption device 800. The devices with which the ciphertext conversion system 100 is equipped are each a computer, and a specific example of a computer is a personal computer (PC). At least two of the devices with which the ciphertext conversion system 100 is equipped may each consist of a computer.

[0013] A network 101 is a communication path for connecting the devices with which the ciphertext conversion system 100 is equipped. A specific example of a network 101 is the Internet, but it may also be another network.

[0014] The devices with which the ciphertext conversion system 100 is equipped do not have to be connected via the network 101, but can be placed in a local area network (LAN) located in a particular facility.

[0015] The common-key cryptographic secret key generation device 200 generates a common-key ciphertext secret key and transmits the generated common-key ciphertext secret key to the common-key ciphertext generation device 500 and the conversion key generation device 600.

[0016] The parameter generation device 300 is a computer that generates a common parameter for the ciphertext conversion system 100 and transmits the generated common parameter to a plurality of user secret key generation devices 400, the conversion key generation device 600, the conversion device 700, and the decryption device 800 via the network 101. Note that the common parameter may be transmitted directly by mail or the like instead of via the network 101.

[0017] The user secret key generation device 400 generates a user secret key and transmits the generated user secret key to the decryption device 800.

[0018] The common key ciphertext generating device 500 functions as a data encryption device. The common key ciphertext generating device 500 receives the secret common key cryptography key from the common key cryptography secret key generating device 200 and takes a plaintext M as input. Using the secret common key ciphertext key and the plaintext M, the common key ciphertext generating device 500 generates a common key ciphertext skC and ciphertext auxiliary information auxC, and outputs the generated common key ciphertext skC and ciphertext auxiliary information auxC.

[0019] The conversion key generation device 600 receives a public key from the parameter generation device 300, the common-key cryptographic secret key from the common-key cryptographic secret key generation device 200, and ciphertext auxiliary information from the common-key ciphertext generation device 500, and takes a decryption condition L as input. Using the public key, the common-key ciphertext secret key, and the ciphertext auxiliary information, the conversion key generation device 600 generates a conversion key ck and outputs the generated conversion key ck. The decryption condition L is a condition that expresses, with a logical formula, that a user is able to decrypt a ciphertext after conversion.

[0020] The conversion device 700 obtains the conversion key from the conversion key generation device 600 and the common key ciphertext from the common key ciphertext generation device 500. Using the conversion key and the common key ciphertext, the conversion device 700 generates a common key ciphertext after conversion skC' and a public key ciphertext after conversion pkC, and outputs the generated public key ciphertext after conversion skC' and the public key ciphertext after conversion pkC to the decryption device 800.

[0021] The decryption device 800 receives the converted common key ciphertext (skC', auxC') and the converted public key ciphertext pkC from the conversion device 700 and the user secret key from the user secret key generation device 400. The decryption device 800 decrypts the ciphertext using the received user secret key and outputs a decryption result.

[0022] A configuration of the present embodiment will be described below.

[0023] Fig. 2 is a block diagram showing a configuration example of the common key cryptography secret key generating apparatus 200.

[0024] As in Fig. 2, the common key cryptography secret key generating device 200 is provided with an input unit 201, a common key cryptography key generating unit 202, and a transmission unit 203.

[0025] Although not shown, the common key cryptography key generation device 200 is provided with a recording medium that stores data to be used in each unit of the common key cryptography key generation device 200.

[0026] The input unit 201 accepts the input of a bit length of a key used in the present system.

[0027] The common-key cryptography key generation unit 202 generates a secret common-key cryptography key, which is a calculation basis for the ciphertext conversion system 100. Although not shown, the common-key cryptography key generation unit 202 may be equipped with a random number generation function or the like to generate the secret common-key cryptography key.

[0028] The transmission unit 203 transmits the common key ciphertext secret key generated by the common key cryptography key generation unit 202 to each of the common key ciphertext generation unit 500 and the conversion key generation device 600.

[0029] Fig. 3 is a block diagram showing a configuration example of the common parameter generation device 300.

[0030] As in Fig. 3, the common parameter generating device 300 is provided with an input unit 301, a common parameter generating device 302 and a transmission unit 303.

[0031] Although not shown, the common parameter generating device 300 is provided with a recording medium that stores data to be used in the individual units of the common parameter generating device 300.

[0032] The input unit 301 accepts the input of a bit length of the key used in the ciphertext conversion system 100.

[0033] The common parameter generation device 302 generates a public key pk and a secret master key msk, respectively, which are used in the calculation performed by the ciphertext conversion system 100. Although not shown, the common parameter generation device 302 may be equipped with a random number generation function or the like to generate both the public key pk and the secret master key msk.

[0034] The transmission unit 303 transmits the public key pk generated by the common parameter generation device 302 to each of the conversion key generation device 600 and the conversion device 700. The transmission unit 303 also transmits the master secret key msk to each of the plurality of user secret key generation devices 400.

[0035] Fig. 4 is a block diagram showing a configuration example of the user secret key generation device 400. As shown in Fig. 4, the user secret key generating device 400 is equipped with an input unit 401, a key receiving unit 402, a key generating unit 403, and a key transmitting unit 404.

[0036] Although not shown, the user secret key generating device 400 is provided with a recording medium that stores data to be used in each unit of the user secret key generating device 400.

[0037] The input unit 401 accepts an attribute parameter Γ as input.

[0038] The key receiving unit 402 receives the secret master key msk.

[0039] The key generation unit 403 generates a secret user key sk Γ. Although not shown, the key generation unit 403 may be equipped with a random number generation function or the like to generate the user secret key sk Γ to generate.

[0040] The key transmission unit 404 transmits the secret user key sk generated by the key generation unit 403 Γ to the decryption device 800.

[0041] Fig. 5 is a block diagram showing a configuration example of the common key ciphertext generating device 500. As shown in Fig. 5, the common key ciphertext generating device 500 is equipped with an input unit 501, a key receiving unit 502, an encryption unit 503, and a transmission unit 504.

[0042] Although not shown, the common key ciphertext generating device 500 is provided with a recording medium that stores data to be used in each unit of the common key ciphertext generating device 500.

[0043] The input unit accepts the plain test M as input.

[0044] The key receiving unit 502 receives the secret key sk of the common key cryptography.

[0045] The encryption device 503 generates the common key ciphertext skC and the auxiliary information auxC. Although not shown, the encryption device 503 may be equipped with a random number generation function or the like to generate the common key ciphertext skC. The encryption device 503 generates a first common key ciphertext.

[0046] The transmission unit 504 forwards the common key ciphertext skC to the conversion device 700 and the auxiliary information auxC to the conversion key generation device 600.

[0047] Fig. 6 is a block diagram showing a configuration example of the conversion key generation device 600.

[0048] As in Fig. 6, the conversion key generation device 600 is provided with a key receiving unit 601, an input unit 602, a conversion target setting unit 603, a conversion key generation unit 604, and a transmission unit 605.

[0049] Although not shown, the conversion key generating device 600 is provided with a recording medium that stores data to be used in each unit of the conversion key generating device 600.

[0050] The key receiving unit 601 receives the public key pk, the secret key sk and the auxiliary information auxC, respectively.

[0051] The input unit 602 receives the decryption condition L from outside as input.

[0052] The conversion target setting unit 603 generates a public key ciphertext P, which is part of the conversion key, from the public key pk received from the key receiving unit 601 and the decryption condition L input from the input unit 602. The conversion target setting unit 603 generates an attribute-based encryption key and an attribute-based ciphertext encrypted with the attribute-based encryption key according to an attribute-based encryption scheme.

[0053] The conversion key generation unit 604 generates the conversion key part S from the secret common-key cryptographic key sk and the auxiliary information auxC received from the key receiving unit 601. The conversion key generation unit 604 generates a conversion key that converts the first common-key ciphertext into a second common-key ciphertext, which is a ciphertext that conforms to a first common-key cryptographic scheme and is different from the first common-key ciphertext, based on first cryptographic common-key information used in generating the first common-key ciphertext by encrypting a plaintext according to the first common-key cryptographic scheme with a first secret key.The conversion key generation unit 604 generates a third common-key ciphertext according to a second common-key cryptography scheme by encrypting a second secret key used to decrypt the second common-key ciphertext with the attribute-based encryption key. A specific example of the first common-key cryptography scheme is a block cipher counter-mode scheme. The first cryptographic common-key information may consist of the first secret key and first auxiliary information used in encryption according to the block cipher counter-mode scheme.The conversion key generation unit 604 may generate the conversion key using the first cryptographic common key information and the second cryptographic common key information consisting of the second secret key and the second auxiliary information used in the block cipher counter-mode encryption. The conversion key generation unit 604 may calculate, as the conversion key, an exclusive OR of a result of executing the first common key cryptography scheme using the first cryptographic common key information and a result of executing the first common key cryptography scheme using the second cryptographic common key information.

[0054] Although not shown, the conversion target setting unit 603 and the conversion key generation unit 604 may each be equipped with a random number generation function or the like to generate the conversion key.

[0055] The transmission unit 605 integrates generated conversion keys and outputs an integrated conversion key to the conversion device 700 as the conversion key ck (= (P, S)).

[0056] Fig. 7 is a block diagram showing a configuration example of the conversion device 700. As shown in Fig. 7, the conversion device 700 is equipped with a key receiving unit 701, a ciphertext receiving unit 702, a conversion unit 703 and a transmission unit 704.

[0057] Although not shown, the conversion device 700 is provided with a recording medium that stores data to be used in each unit of the conversion device 700.

[0058] The key receiving unit 701 receives the public key pk and the conversion key ck, respectively.

[0059] The ciphertext receiving unit 702 receives the common key ciphertext skC.

[0060] The conversion unit 703 converts the common key ciphertext skC using a part of the conversion key ck, thereby converting the common key ciphertext skC into the post-conversion common key ciphertext skC'. The post-conversion common key ciphertext skC' is a ciphertext to which the decryption condition regarding the public key ciphertext P holds. The conversion unit 703 also generates the post-conversion public key ciphertext pkC using a part of the conversion key ck. The conversion unit 703 calculates an exclusive OR of the first common key ciphertext and the conversion key as the second common key ciphertext.

[0061] The transmission unit 704 outputs the public key ciphertext pkC and the common key ciphertext (skC', auxC') after conversion to the decryption device 800.

[0062] Fig. 8 is a block diagram showing a configuration example of the decryption device 800. As shown in Fig. 8, the decryption device 800 is equipped with a ciphertext receiving unit 801, a key receiving unit 802, a decryption unit 803, and a result output unit 804.

[0063] The ciphertext receiving unit 801 receives the public key ciphertext after conversion pkC and the common key ciphertext after conversion (skC', auxC').

[0064] The key receiving unit 802 receives the secret user key sk Γ from the user secret key generating device 400.

[0065] The decryption unit 803 calculates the plaintext M by performing a decryption process. In a specific example of the decryption process, the decryption unit 803 first decrypts the attribute-based ciphertext using the user secret key that matches the attribute information corresponding to the attribute-based encryption key, thus obtaining the attribute-based encryption key. The decryption unit 803 then decrypts the third common-key ciphertext using the acquired attribute-based encryption key, thereby obtaining the second secret key. The decryption unit 803 then finds, as the plaintext corresponding to the acquired second common-key ciphertext, an exclusive OR of a result of encrypting the second auxiliary information with the second secret key and the second common-key ciphertext.

[0066] The result output unit 804 outputs the plaintext M.

[0067] Fig. Figure 9 is a diagram showing an example of the hardware resources of each device equipped with the ciphertext conversion system 100 according to the present embodiment. Each ciphertext conversion system 100 may be composed of a plurality of computers.

[0068] Each device of the ciphertext conversion system 100 is equipped with a processor 11 (central processing unit). The processor 11 is connected to and controls hardware devices such as a read-only memory (ROM) 13, a random access memory (RAM) 14, a communication board 15, a display 51 (display device), a keyboard 52, a mouse 53, a drive 54, and a magnetic disk device 20 via a bus 12. The drive 54 is a device that reads from and writes to a storage medium such as a flexible disk drive (FD), a compact disc (CD), and a digital versatile disc (DVD).

[0069] Processor 11 is an integrated circuit (IC) that performs computational processing. A specific example of processor 11 is a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). Each device of ciphertext conversion system 100 can be equipped with a plurality of processors that replace processor 11. The plurality of processors share the roles of processor 11.

[0070] The ROM 13, the RAM 14, the magnetic disk device 20, and the drive 54 are each an example of a storage device. The keyboard 52, the mouse 53, and the communication board 15 are each an example of an input device. The display 51 and the communication board 15 are each an example of an output device.

[0071] The communication board 15 is connected to a network such as a local area network (LAN), the Internet, or a telephone line via a cable or wirelessly. In a specific example, the communication board 15 consists of a communication chip or a network interface card (NIC).

[0072] An operating system (OS) 21, programs 22, and files 23 are stored in the magnetic disk device 20. A specific example of a magnetic disk device 20 is a hard disk drive (HDD). Alternatively, the magnetic disk device 20 may also be a flash memory or the like.

[0073] The programs 22 include programs that perform functions described as individual units in the present embodiment. A concrete example of such a program is a data search program or a data registration program. The program is read and executed by the processor 11. That is, the program causes the computer to function as a unit and causes the computer to perform a process or method of the unit. Each program described in the present specification can be recorded on a computer-readable non-volatile recording medium. A specific example of a non-volatile recording medium is an optical disk or a flash memory. Each program described in the present specification can be provided as a program product.

[0074] The files 23 contain data to be used in each unit described in the present embodiment. In a concrete example, the relevant data consists of input data, output data, a determination result, a calculation result, and a processing result. *** Description of functions ***

[0075] An operating method of the ciphertext conversion system 100 corresponds to a ciphertext conversion method. A program that implements operations of the ciphertext conversion system 100 corresponds to a ciphertext conversion program. An operating method of a device provided to the ciphertext conversion system 100 corresponds to a method that includes a name of this device provided to the ciphertext conversion system 100 in its name. In a concrete example, an operating method of the conversion key generation device 600 corresponds to a conversion key generation method. A program that implements operations of a device provided to the ciphertext conversion system 100 corresponds to a program that includes a name of this device provided to the ciphertext conversion system 100 in its name.In a concrete example, a program that implements the operations of the conversion key generating device 600 corresponds to a conversion key generating program.

[0076] Next, operations of the ciphertext conversion system 100 corresponding to a calculation method of each device according to the present embodiment will be described.

[0077] Before describing the operations of the ciphertext conversion system 100, a basic cryptographic technique used in the present embodiment and the notation used in the corresponding cryptographic technique will be described.

[0078] An attribute-based encryption method is a cryptographic technique in which decryption is only possible for a user who possesses a secret user key generated from an attribute parameter Γ that satisfies a decryption condition specified by the decryption condition L. The attribute parameter Γ is also an attribute set. The attribute-based encryption method consists of an algorithm structured as follows.

[0079] First, the setup ABESETUP, a key length, etc., are input, and the secret master key msk and the public key pk are output. Next, the user secret key generation ABEKEYGEN, the secret master key msk, and the attribute parameter Γ are input, and the user secret key sk is output. Γ, which corresponds to the attribute parameter Γ, is generated. Next, the encryption ABEENC, the public key pk, and the decryption condition L are input, and a key K for the common-key cryptography and the public-key ciphertext P, which matches the key K, are generated. Next, the decryption ABEDEC, the secret user key sk Γ and the public key ciphertext is taken as input, and if the user's secret key sk Γ If the corresponding attribute parameters Γ and the decryption condition L for generating the public key ciphertext P match, the key K with which the public key ciphertext P is encrypted is output.

[0080] Common-key cryptography is a cryptographic method for encrypting plaintext M using the common-key cryptography secret key sk and decrypting a cipher using the common-key cryptography secret key sk. If the common-key cryptography secret key sk is a random value, encryption SKEENC takes the common-key cryptography secret key sk and plaintext M as input and outputs a ciphertext C corresponding to the corresponding input. Decryption SKEDEC takes the common-key ciphertext secret sk and ciphertext C as input and outputs the plaintext M corresponding to the respective input.

[0081] In the present embodiment, common-key cryptography employs counter-mode encryption and counter-mode decryption using a block cipher. The corresponding encryption is referred to as SCTRENC, and the corresponding decryption is referred to as SCTRDEC. In counter mode, a counter value is provided as auxiliary information, and encryption and decryption are performed as follows. In this specification, + represents exclusive OR unless otherwise specified. [Encrypt] C=SCTRENC(sk,auxC)+M [Decrypt] M=SCTRDEC(sk,auxC)+C

[0082] Fig. Figure 10 is a flowchart showing an example of the generation of a secret key in common-key cryptography. The secret key generation step in common-key cryptography is explained using Fig. 10 described. (Step S201: Information input step)

[0083] The input unit 201 accepts as input a key bit length k. (Step S202: Secret key generation step)

[0084] The common key cryptography key generation unit 202 generates a k-bit random number and treats the generated random number as the secret common key cryptography key sk. (Step S203: Delivery step)

[0085] The transmission unit 203 outputs the common key cryptography key generation unit 600 to the secret common key ciphertext secret key generation device.

[0086] Fig. Figure 11 is a flowchart showing an example of a parameter generation step. The parameter generation step is described using Fig. 11 described. (Step S301: Information input step)

[0087] The input unit 301 accepts as input the bit length k of the key. (Step S302: Key generation step)

[0088] The common parameter generating device 302 carries out the attribute-based encryption setup to generate the secret master key msk and the public key pk, respectively. (Step S303: Delivery step)

[0089] The transmission unit 303 transmits the secret master key msk and the public key pk to the devices as needed.

[0090] Fig. Figure 12 is a flowchart illustrating an example of generating a user secret key. The step of generating the user secret key is described by Fig. 12 described. (Step S401: Attribute input step)

[0091] The input unit 401 accepts the attribute parameter Γ as input. (Step S402: Master key input step)

[0092] The key receiving unit 402 receives the secret master key msk. (Step S403: Step for generating the secret user key)

[0093] The key generation unit 403 performs the generation of the secret user key KeyGen of the attribute-based encryption using the attribute parameter Γ and the secret master key msk, whereby the secret user key sk Γ is generated. (Step S404: Transfer step)

[0094] The key transmission unit 404 transmits the generated secret user key sk Γ to the decryption device 800.

[0095] Fig. Figure 13 is a flowchart illustrating an example of generating a common-key ciphertext. The common-key ciphertext generation step is described using Fig. 13 described. (Step S501: Key receiving step)

[0096] The key receiving unit 502 receives the secret key sk of the common key cryptography. (Step S502: Plain text input step).

[0097] The input unit 501 accepts the plaintext M as input. (Step S503: Encryption step)

[0098] The encryption device 503 executes the block cipher counter mode to encrypt the plaintext M. When executing the counter mode, the encryption device 503 takes a counter value as auxiliary information auxC and the ciphertext as common-key ciphertext skC. A relationship between the auxiliary information auxC and the common-key ciphertext skC is described by [Formula 1]. The common-key ciphertext skC is equivalent to the first common-key ciphertext. SCTRENC is equivalent to encryption according to the first common-key cryptography scheme. The secret key sk of the common-key cryptography is equivalent to the first secret key. The auxiliary information auxC is equivalent to the first auxiliary information. The secret key sk and the auxiliary information auxC are equivalent to the first cryptographic common-key information. skC=SCTRENC(sk,auxC)+M (Step S504: Transfer step)

[0099] The transmission unit 504 transmits the common key ciphertext skC and the auxiliary information auxC to the individual devices as needed.

[0100] Fig. Figure 14 is a flowchart illustrating an example of a conversion key generation step. The conversion key generation step is described by Fig. 14 described. (Step S601: Key receiving step)

[0101] The key receiving unit 601 receives the public key pk, the secret key sk and the auxiliary information auxC, respectively. (Step S602: Input step)

[0102] The input unit 602 accepts the decryption condition L as input. (Step S603: Conversion target setting step)

[0103] The conversion target setting unit 603 executes the encryption ABEENC of the attribute-based encryption based on the public key pk and the decryption condition L, as given in [Formula 2]. Note that the public key ciphertext P is a public key ciphertext after conversion, and the key K is a key used to encrypt the public key ciphertext P. The public key ciphertext P is equivalent to the attribute-based ciphertext. The key K is synonymous with the attribute-based encryption key. (K,P)=ABEENC(pk,L) (Step S604: Common key step for generating secret keys)

[0104] The conversion key generation unit 604 selects a new common key cryptographic secret key sk'. (Step S605: Common key secret key encryption step)

[0105] The conversion key generation unit 604 takes the common-key cryptographic key sk' as the plaintext and the key K as the secret key, and performs common-key encryption according to [Formula 3]. Note that S1 corresponds to the third common-key ciphertext, SKEENC corresponds to encryption according to the second common-key cryptographic scheme, and sk' corresponds to the second secret key. S1=SKEENC(K,sk') (Step S606: Conversion key generation step)

[0106] The conversion key generation unit 604 selects a new piece of auxiliary information auxC' and performs the calculation specified in [Formula 4] using the selected new piece of auxiliary information auxC'. The auxiliary information auxC' is equivalent to the second piece of auxiliary information. The common-key cryptography secret key sk' and the auxiliary information auxC' correspond to the second piece of cryptographic common-key information. S2=SCTRENC(sk,auxC)+SCTRENC(sk',auxC') S=(S1,S2)

[0067] (Step S607: Delivery step)

[0107] The transmission unit 605 outputs the conversion key ck (= (P, S)) to the conversion device 700.

[0108] Fig. Figure 15 is a flowchart showing an example of a conversion step. The conversion step is described using Fig. 15 described. (Step S701: Key receiving step)

[0109] The key receiving unit 701 receives the public key pk and the conversion key ck (= (P, S (= (S1, S2)))). (Step S702: Input step)

[0110] The ciphertext receiving unit 702 receives the common key ciphertext skC. (Step S703: Conversion step)

[0111] The conversion unit 703 performs a calculation specified in [Formula 5] using the common key ciphertext skC and S2. The converted common key ciphertext skC' is equivalent to the second common key ciphertext. Note that S2 is generated according to the first common key cryptography scheme. Since the converted common key ciphertext skC' is an exclusive OR of the common key ciphertext skC and S2, the converted common key ciphertext skC' corresponds to the first common key cryptography scheme. skC'=skC+S2

[0112] Note that a right-hand side of [Formula 5] has a nature given by [Formula 6]. skC+S2=SCTRENC(sk,auxC)+M+SCTRENC(sk,auxC)+SCTRENC(sk',auxC')=SCTRENC(sk',auxC')+M (Step S704: Output step)

[0113] The transmission unit 704 outputs the public key ciphertext after conversion to the decryption device 800 as pkC (= (P, S1)) and the common key ciphertext after conversion to the decryption device 800 as (skC', auxC').

[0114] Fig. Figure 16 is a flowchart illustrating an example of a decryption step. The decryption step is described using Fig. 16 described. (Step S801: Ciphertext receiving step)

[0115] The ciphertext receiving unit 801 receives the public key ciphertext after conversion pkC (= (P, S1)) and the common key ciphertext after conversion (skC', auxC'). (Step S802: Input step)

[0116] The key receiving unit 802 receives the secret user key sk Γ . The secret user key sk Γcorresponds to the user secret key, which matches the attribute information corresponding to the attribute-based encryption key. (Step S803: Decryption processing step)

[0117] The decryption unit 803 performs the calculations specified in [Formula 7] sequentially from top to bottom using the received data, thus decrypting the plaintext M. In [Formula 7], decryption of the attribute-based encryption is first performed, so that the key K is decrypted. In [Formula 7], the formulas that decrypt the plaintext M are formulas derived from [Formula 5] and [Formula 6]. The plaintext M is a plaintext corresponding to the second common-key ciphertext. K=ABEDEC(skΓ,P) sk'=SKEDEC(K,S1) M=skC'+SCTRENC(sk',auxC')

[0081] (Step S804: Output step)

[0118] The result output unit 804 outputs the plaintext M. In a concrete example, the result output unit 804 outputs the plaintext M on a display available to the decryption device 800.

[0082] *** Description of the effect of embodiment 1***

[0119] As described above, according to the present embodiment, a user can only calculate a sum of inner products if a decryption key is acquired using a decryption token, even if the user has a secret user key. Therefore, the information of a vector x associated with individual ciphertexts is not easily analogous in the prior art. Therefore, the ciphertext conversion system 100 according to the present embodiment can be implemented with significantly greater security.

[0120] Furthermore, a ciphertext encrypted by the common-key cryptography scheme can be converted into a ciphertext based on the public-key cryptography scheme without decrypting the ciphertext using any scheme, such as the public-key cryptography scheme, a functional cryptography scheme that can specify an access range, and the attribute-based encryption scheme. Therefore, according to the present embodiment, for example, the conversion of a ciphertext encrypted by the common-key cryptography scheme into a ciphertext based on the public-key cryptography scheme, the transmission of the converted ciphertext, and so on can be performed using a resource-saving device that cannot perform public-key encryption calculation, resulting in improved convenience.

[0083] *** Other configurations ***< Modification 1 >

[0121] Fig. 17 shows an example of the hardware configuration of each device with which a ciphertext conversion system 100 according to the present amendment is equipped.

[0122] Each device of the ciphertext conversion system 100 is equipped with a processing circuit 18 instead of a processor 11, a processor 11 and a ROM 13, a processor 11 and a RAM 14, or a processor 11, a ROM 13, and a RAM 14.

[0123] The processing circuit 18 is hardware that implements at least some of the units with which each device of the ciphertext conversion system 100 is equipped.

[0124] The processing circuit 18 may be dedicated hardware or a processor that executes a program stored in the ROM 13 or the RAM 14.

[0125] If the processing circuit 18 is dedicated hardware, in a specific example, the processing circuit 18 is one of or a combination of a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an application specific integrated circuit (ASIC), and a field programmable gate array (FPGA).

[0126] Each device with which the ciphertext conversion system 100 is equipped may be provided with a plurality of processing circuits that replace the processing circuit 18. The plurality of processing circuits share the functions of the processing circuit 18.

[0127] In each device with which the ciphertext conversion system 100 is equipped, some functions may be implemented by special hardware, while the remaining functions may be implemented by software or firmware.

[0128] In a particular example, the processing circuit 18 is implemented by one of the following components or by a combination of hardware, software, and firmware.

[0129] The processor 11, the ROM 13, the RAM 14, and the processing circuit 18 are collectively referred to as a "processing circuit." That is, a function of each function-determining element of each device with which the ciphertext conversion system 100 is equipped is realized by a processing circuit. *** Further embodiments ***

[0130] Following the description of Embodiment 1, a plurality of parts of the present embodiment can be implemented by combination. Alternatively, the present embodiment can also be implemented in parts. Various changes can be made to the present embodiment as needed. The present embodiment can be implemented in whole or in part by any combination. Each unit described in the present specification can be implemented by one of the following components or by a combination of firmware, software, and hardware.

[0131] The embodiment described above is essentially a preferred example and is not intended to limit the present disclosure, an application product of the present disclosure, or a scope of application of the present disclosure. The methods described using flowcharts or the like may be modified as needed. LIST OF REFERENCE SYMBOLS

[0132] 11: Processor; 12: Bus; 13: ROM; 14: RAM; 15: Communication board; 18: Processing circuit; 20: Magnetic disk device; 21: Operating system; 22: Programs; 23: Files; 51: Display; 52: Keyboard; 53: Mouse; 54: Disk drive; 100: Ciphertext conversion system; 101: Network; 200: Common key cryptography secret key generation device; 201: Input unit; 202: Common key cryptography key generation unit; 203: Transmission unit; 290: Common key cryptography secret key generation device group; 300: Parameter generation device; 301: Input unit; 302: Common parameter generation device; 303: Transmission unit; 400: User secret key generation device; 401: Input unit; 402: Key reception unit; 403: Key generation unit; 404: Key transmission unit; 405: User secret key generation device group; 500: Common key ciphertext generation device; 501: Input unit; 502: Key reception unit;503: Encryption device; 504: Transmission unit; 600: Conversion key generation device; 601: Key reception unit; 602: Input unit; 603: Conversion destination setting unit; 604: Conversion key generation unit; 605: Transmission unit; 700: Conversion device; 701: Key reception unit; 702: Ciphertext reception unit; 703: Conversion unit; 704: Transmission unit; 800: Decryption device; 801: Ciphertext reception unit; 802: Key reception unit; 803: Decryption unit; 804: Result output unit; auxC, auxC': Auxiliary information; K: Key; L: Decryption condition; M: Plaintext; P: Public key ciphertext; ck: Conversion key; pk: public key; pkC: public key ciphertext after conversion; msk: master secret key; sk, sk': common key cryptographic secret key; skC: common key ciphertext; skC': common key ciphertext after conversion; sk; Γ: user secret key; Γ: attribute parameter.

Claims

[1] Ciphertext conversion system (100) comprising: a conversion key generating device (600) comprising a conversion target setting unit (603) for generating an attribute-based encryption key and an attribute-based ciphertext encrypted with the attribute-based encryption key according to an attribute-based encryption scheme; and a conversion key generation unit (604) for generating a conversion key that converts a first common-key ciphertext into a second common-key ciphertext that is a ciphertext that conforms to a first common-key cryptography scheme and that differs from the first common-key ciphertext, based on first cryptographic common-key information used in generating the first common-key ciphertext, by encrypting a plaintext with a first secret key according to the first common-key cryptography scheme, and to generate a third common-key ciphertext according to a second common-key cryptography scheme by encrypting a second secret key used to decrypt the second common-key ciphertext with the attribute-based encryption key. [2] The ciphertext conversion system (100) of claim 1, wherein the first common key cryptography scheme is a block cipher counter-mode scheme. [3] The ciphertext conversion system (100) of claim 2, wherein the first cryptographic common key information consists of the first secret key and first auxiliary information used in the encryption according to the block cipher counter-mode scheme. [4] The ciphertext conversion system (100) according to claim 3, wherein the conversion key generation unit (604) generates the conversion key using the first cryptographic common key information and the second cryptographic common key information consisting of the second secret key and the second auxiliary information used in the encryption according to the block cipher counter mode scheme. [5] The ciphertext conversion system (100) according to claim 4, wherein the conversion key generation unit (604) calculates, as the conversion key, an exclusive OR of a result of executing the first common key cryptography scheme using the first cryptographic common key information and a result of executing the first common key cryptography scheme using the second cryptographic common key information. [6] Ciphertext conversion system (100) according to claim 4 or 5, further comprising: a decryption device (800) comprising: a decryption unit (803) to decrypt the attribute-based ciphertext using a secret user key that matches the attribute information corresponding to the attribute-based encryption key, thereby obtaining the attribute-based encryption key, to decrypt the third common-key ciphertext using the acquired attribute-based encryption key, thereby obtaining the second secret key, and to find, as the plaintext, an exclusive OR of a result of the encryption of the second auxiliary information with the second secret key and the second common key ciphertext. [7] Ciphertext conversion system (100) according to one of claims 1 to 6, further comprising: a conversion device (700) comprising a conversion unit (703) for calculating, as the second common key ciphertext, an exclusive OR of the first common key ciphertext and the conversion key. [8] A method for generating a conversion key, comprising: generating, by a computer, an attribute-based encryption key and an attribute-based ciphertext encrypted with the attribute-based encryption key according to an attribute-based encryption scheme; Generating, by the computer, a conversion key that converts a first common-key ciphertext into a second common-key ciphertext that is a ciphertext that conforms to a first common-key cryptography scheme and that differs from the first common-key ciphertext, based on first cryptographic common-key information used in generating the first common-key ciphertext by encrypting a plaintext with a first secret key according to the first common-key cryptography scheme; and Generating, by the computer, a third common-key ciphertext according to a second common-key cryptography scheme by encrypting a second secret key used to decrypt the second common-key ciphertext with the attribute-based encryption key. [9] A conversion key generation program that causes a conversion key generation device (600) that is a computer to: a conversion target setting process for generating an attribute-based encryption key and an attribute-based ciphertext encrypted with the attribute-based encryption key according to an attribute-based encryption scheme; and a conversion key generation process of the Generating a conversion key that converts a first common-key ciphertext into a second common-key ciphertext that is a ciphertext that conforms to the first common-key cryptography scheme and that differs from the first common-key ciphertext, based on first cryptographic common-key information used in generating the first common-key ciphertext, by encrypting a plaintext with a first secret key according to a first common-key cryptography scheme; and Generating a third common-key ciphertext according to a second common-key cryptography scheme by encrypting a second secret key used to decrypt the second common-key ciphertext with the attribute-based encryption key.

Images