Registration device, search operation device, data management device, and computer-readable recording medium

Abstract

Provided are a registration device, a search operation device, a data management device, and a computer-readable recording medium. The registration device (500) receives a plaintext, attribute information of a user having a right to refer to the plaintext, and a registration key used when generating a user key used to generate a search query. The registration device generates aggregation information showing one or more aggregation values by aggregating a plurality of attribute values included in the attribute information. The registration device generates generalization information showing a plurality of generalization values for each aggregation value by generalizing each aggregation value included in the aggregation information. The registration device generates ciphertext data including the encrypted plaintext using the plaintext, the attribute information, the generalization information, and the registration key. The registration device registers the ciphertext data in a database.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to a searchable encryption technique. BACKGROUND

[0002] Searchable encryption is a technique of searching for encrypted data in an encrypted state.

[0003] That is, searchable encryption is a technique of searching for encrypted data without decrypting the encrypted data.

[0004] In recent years, searchable encryption has attracted attention as a security technique for protecting confidential information from eavesdropping by a server administrator in a cloud service.

[0005] That is, searchable encryption has attracted attention as a security technique for managing data in the Internet.

[0006] As a searchable encryption method, there are two types of a public key method and a public key method.

[0007] In the public key method, a common key encryption technique is used, and the registrant and the searcher are limited.

[0008] In the public key method, a public key encryption technique is used, and the searcher is limited but the registrant is not limited.

[0009] Patent Document 1 discloses a public key method of a multi-user type.

[0010] In the public key method of the multi-user type, the registrant encrypts data using the private key of each searcher. An encryption tag is attached to the registered encrypted data. In the encryption tag, a keyword and a search right can be embedded.

[0011] For example, a right that can be searched only by searcher A is embedded in the encryption tag. In addition, searcher B generates a search query using his or her own private key and a search keyword. In this case, searcher B does not have a search right, and therefore, even if the search keyword in the search query of searcher B is the same as the keyword in the encryption tag, the encrypted data is not obtained as a search result.

[0012] PRIOR ART DOCUMENT

[0013] PATENT DOCUMENT

[0014] Patent Document 1: International Publication No. 2019 / 142651 SUMMARY

[0015] PROBLEMS TO BE SOLVED BY THE INVENTION

[0016] In the public key method of the multi-user type, there is a problem of vulnerability to collusion attacks by a plurality of legitimate users.

[0017] For example, if the legitimate user X and the legitimate user Y conspire, it is possible to use both the secret key SK X of the legitimate user X and the secret key SK Y of the legitimate user Y. In this case, it is possible to generate a secret key that can search encrypted data that the legitimate user X or the legitimate user Y should not be able to search alone. Specifically, it is possible to generate a secret key of the head of the personnel section by the head of the general affairs section and the officer of the personnel section conspiring.

[0018] The present disclosure aims to improve the security of a multi-user type public key method.

[0019] Means for solving the problem

[0020] The registration device of the present disclosure includes: a reception unit that receives a plaintext, attribute information, and a registration key, the attribute information showing a plurality of attribute values that identify a plurality of attributes of a user who has a right to refer to the plaintext, the registration key being the same as a key used when generating a user key for generating a search query; a collection information generation unit that generates collection information by collecting a plurality of attribute values included in the attribute information, the collection information showing one or more collection values each composed of one or more attribute values; a generalization information generation unit that generates, for each collection value included in the collection information, a plurality of generalization values each composed of one or more wildcards that replace one or more attribute values in the collection value and the remaining attribute values in the collection value, and generates generalization information showing the plurality of generalization values for each collection value included in the collection information; a ciphertext data generation unit that generates ciphertext data including the encrypted plaintext using the plaintext, the attribute information, the generalization information, and the registration key; an encryption tag generation unit that generates an encryption tag including an encrypted keyword related to the plaintext using the keyword, the attribute information, the generalization information, and the registration key; and a registration unit that registers a group of the ciphertext data and the encryption tag in a database.

[0021] Effects of the invention

[0022] According to the present disclosure, a plurality of attribute values of a user who has a right to refer to a plaintext are collected, and ciphertext data and an encryption tag are generated based on one or more collection values.

[0023] As a result, the resistance to a conspiracy attack by a plurality of legitimate users can be improved. That is, the security of a multi-user type public key method can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 is a block diagram of the anonymous search system 100 in Embodiment 1.

[0025] Figure 2is a block diagram of the master key device 200 in Embodiment 1.

[0026] Figure 3 is a block diagram of the registration key device 300 in Embodiment 1.

[0027] Figure 4 is a block diagram of the user key device 400 in Embodiment 1.

[0028] Figure 5 is a block diagram of the registration device 500 in Embodiment 1.

[0029] Figure 6 is a block diagram of the search operation device 600 in Embodiment 1.

[0030] Figure 7 is a block diagram of the data management device 700 in Embodiment 1.

[0031] Figure 8 is a flowchart of the concealed search method in Embodiment 1.

[0032] Figure 9 is a flowchart of the master key generation (S120) in Embodiment 1.

[0033] Figure 10 is a flowchart of the registration key generation (S130) in Embodiment 1.

[0034] Figure 11 is a flowchart of the user key generation (S140) in Embodiment 1.

[0035] Figure 12 is a diagram showing an example of attribute information in Embodiment 1.

[0036] Figure 13 is a diagram showing an example of aggregation information in Embodiment 1.

[0037] Figure 14 is a flowchart of the data registration (S150) in Embodiment 1.

[0038] Figure 15 is a diagram showing the registration database 791 in Embodiment 1.

[0039] Figure 16 is a flowchart of the search operation (S160) in Embodiment 1.

[0040] Figure 17 is a flowchart of the step S163 in Embodiment 1.

[0041] Figure 18 is a flowchart of the step S166 in Embodiment 1.

[0042] Figure 19 is a flowchart of the data search (S170) in Embodiment 1.

[0043] Figure 20 is a flowchart of the data deletion (S180) in Embodiment 1.

[0044] Figure 21 is a hardware configuration diagram of the master key device 200 in Embodiment 1.

[0045] Figure 22 is a hardware configuration diagram of the registration key device 300 in Embodiment 1.

[0046] Figure 23 is a hardware configuration diagram of the user key device 400 in Embodiment 1.

[0047] Figure 24 is a hardware configuration diagram of the registration device 500 in Embodiment 1.

[0048] Figure 25 is a hardware configuration diagram of the search operation device 600 in Embodiment 1.

[0049] Figure 26 is a hardware configuration diagram of the data management device 700 in Embodiment 1. DETAILED DESCRIPTION

[0050] In the embodiments and the drawings, the same reference numerals are assigned to the same elements or corresponding elements. The explanation of elements to which the same reference numerals are assigned as already explained elements is appropriately omitted or simplified. The arrows in the drawings mainly show the flow of data or the flow of processing.

[0051] Embodiment 1.

[0052] Based on Figures 1 to 26 , a method of performing an anonymous search by a public key method of a multiuser type is explained.

[0053] Explanation of Structure

[0054] Based on Figure 1 , the structure of the anonymous search system 100 is explained.

[0055] The anonymous search system 100 has a master key device 200, a registration key device 300, a user key device 400, a registration device 500, a search operation device 600, and a data management device 700.

[0056] Each device of the anonymous search system 100 communicates with each other via a network 101.

[0057] Based onFigure 2 The structure of the master key device 200 will be described.

[0058] The master key device 200 is a computer provided with hardware such as a processor 201, a memory 202, an auxiliary storage device 203, an input / output interface 204, and a communication device 205. These hardware are connected to each other via signal lines.

[0059] The processor 201 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 201 is a CPU, a DSP, or a GPU.

[0060] IC is an abbreviation for Integrated Circuit.

[0061] CPU is an abbreviation for Central Processing Unit.

[0062] DSP is an abbreviation for Digital Signal Processor.

[0063] GPU is an abbreviation for Graphics Processing Unit.

[0064] The memory 202 is a volatile or non-volatile storage device. The memory 202 is also called a main storage device or a main memory. For example, the memory 202 is a RAM. Data stored in the memory 202 is saved in the auxiliary storage device 203 as necessary.

[0065] RAM is an abbreviation for Random Access Memory.

[0066] The auxiliary storage device 203 is a non-volatile storage device. For example, the auxiliary storage device 203 is a ROM, an HDD, or a flash memory. Data stored in the auxiliary storage device 203 is loaded into the memory 202 as necessary.

[0067] ROM is an abbreviation for Read Only Memory.

[0068] HDD is an abbreviation for Hard Disk Drive.

[0069] The input / output interface 204 is a port that connects to an input device and an output device. For example, the input / output interface 204 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display.

[0070] USB is an abbreviation for Universal Serial Bus.

[0071] The communication device 205 is a receiver and a transmitter. For example, the communication device 205 is a communication chip or a NIC.

[0072] The NIC is an abbreviation for Network Interface Card.

[0073] The master key device 200 has elements such as the reception unit 210, the generation unit 220, and the output unit 230. These elements are realized by software.

[0074] In the auxiliary storage device 203, a master key program for causing a computer to function as the reception unit 210, the generation unit 220, and the output unit 230 is stored. The master key program is loaded into the memory 202 and executed by the processor 201.

[0075] In the auxiliary storage device 203, an OS is also stored. At least a part of the OS is loaded into the memory 202 and executed by the processor 201.

[0076] The processor 201 executes the master key program while executing the OS.

[0077] The OS is an abbreviation for Operating System.

[0078] Input and output data of the master key program is stored in the storage unit 290.

[0079] The auxiliary storage device 203 functions as the storage unit 290. However, a storage device such as a register in the memory 202, the processor 201, and a cache memory in the processor 201 can function as the storage unit 290 instead of or in addition to the auxiliary storage device 203.

[0080] The master key device 200 can have a plurality of processors instead of the processor 201. The plurality of processors share the function of the processor 201.

[0081] The master key program can be recorded (stored) in a non-volatile recording medium such as an optical disk or a flash memory in a manner readable by a computer.

[0082] Based on Figure 3 The structure of the registration key device 300 will be described.

[0083] The registration key device 300 is a computer having hardware such as a processor 301, a memory 302, an auxiliary storage device 303, an input and output interface 304, and a communication device 305. These hardware are connected to each other via signal lines.

[0084] The processor 301 is an IC that performs arithmetic processing and controls other hardware. The processor 301 is, for example, a CPU, a DSP, or a GPU.

[0085] The memory 302 is a storage device that is volatile or non-volatile. The memory 302 is also referred to as a main storage device or a main memory. The memory 302 is, for example, a RAM. Data stored in the memory 302 is saved in the auxiliary storage device 303 as necessary.

[0086] The auxiliary storage device 303 is a storage device that is non-volatile. The auxiliary storage device 303 is, for example, a ROM, an HDD, or a flash memory. Data stored in the auxiliary storage device 303 is loaded into the memory 302 as necessary.

[0087] The input-output interface 304 is a port that connects with an input device and an output device. The input-output interface 304 is, for example, a USB terminal, the input device is a keyboard and a mouse, and the output device is a display.

[0088] The communication device 305 is a receiver and a transmitter. The communication device 305 is, for example, a communication chip or a NIC.

[0089] The registration key device 300 includes elements such as the reception unit 310, the generation unit 320, and the output unit 330. These elements are realized by software.

[0090] In the auxiliary storage device 303, a registration key program for causing a computer to function as the reception unit 310, the generation unit 320, and the output unit 330 is stored. The registration key program is loaded into the memory 302 and executed by the processor 301.

[0091] In the auxiliary storage device 303, an OS is also stored. At least a part of the OS is loaded into the memory 302 and executed by the processor 301.

[0092] The processor 301 executes the registration key program while executing the OS.

[0093] Input-output data of the registration key program is stored in the storage unit 390.

[0094] The auxiliary storage device 303 functions as the storage unit 390. However, a storage device such as a register in the memory 302, the processor 301, and a cache memory in the processor 301 can function as the storage unit 390 instead of or in addition to the auxiliary storage device 303.

[0095] The registration key device 300 can include a plurality of processors instead of the processor 301. The plurality of processors share the functions of the processor 301.

[0096] The registration key program can be recorded (stored) in a nonvolatile recording medium such as an optical disk or a flash memory in a computer-readable manner.

[0097] Based on Figure 4 The structure of the user key device 400 will be described.

[0098] The user key device 400 is a computer provided with hardware such as a processor 401, a memory 402, an auxiliary storage device 403, an input / output interface 404, and a communication device 405. These hardware are connected to each other via signal lines.

[0099] The processor 401 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 401 is a CPU, a DSP, or a GPU.

[0100] The memory 402 is a volatile or nonvolatile storage device. The memory 402 is also called a main storage device or a main memory. For example, the memory 402 is a RAM. Data stored in the memory 402 is saved in the auxiliary storage device 403 as needed.

[0101] The auxiliary storage device 403 is a nonvolatile storage device. For example, the auxiliary storage device 403 is a ROM, an HDD, or a flash memory. Data stored in the auxiliary storage device 403 is loaded into the memory 402 as needed.

[0102] The input / output interface 404 is a port that connects to an input device and an output device. For example, the input / output interface 404 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display.

[0103] The communication device 405 is a receiver and a transmitter. For example, the communication device 405 is a communication chip or a NIC.

[0104] The user key device 400 is provided with elements such as a reception part 410, a generation part 420, and an output part 430.

[0105] The generation part 420 is provided with elements such as a collection information generation part 421 and a user key generation part 422.

[0106] These elements are realized by software.

[0107] In the auxiliary storage device 403, a user key program for causing a computer to function as the reception part 410, the generation part 420, and the output part 430 is stored. The user key program is loaded into the memory 402 and executed by the processor 401.

[0108] In the auxiliary storage device 403, an OS is also stored. At least a part of the OS is loaded into the memory 402 and executed by the processor 401.

[0109] The processor 401 executes the OS while executing the user key program.

[0110] The input and output data of the user key program are stored in the storage section 490.

[0111] The auxiliary storage device 403 functions as the storage section 490. However, a storage device such as the memory 402, a register in the processor 401, and a cache memory in the processor 401 can function as the storage section 490 instead of or in addition to the auxiliary storage device 403.

[0112] The user key device 400 can also have a plurality of processors instead of the processor 401. The plurality of processors share the functions of the processor 401.

[0113] The user key program can be recorded (stored) in a nonvolatile recording medium such as an optical disk or a flash memory in a manner readable by a computer.

[0114] Based on Figure 5 The structure of the registration device 500 will be described.

[0115] The registration device 500 is a computer having a processor 501, a memory 502, an auxiliary storage device 503, an input and output interface 504, and a communication device 505. These hardware are connected to each other via signal lines.

[0116] The processor 501 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 501 is a CPU, a DSP, or a GPU.

[0117] The memory 502 is a volatile or nonvolatile storage device. The memory 502 is also called a main storage device or a main memory. For example, the memory 502 is a RAM. Data stored in the memory 502 is saved in the auxiliary storage device 503 as needed.

[0118] The auxiliary storage device 503 is a nonvolatile storage device. For example, the auxiliary storage device 503 is a ROM, an HDD, or a flash memory. Data stored in the auxiliary storage device 503 is loaded into the memory 502 as needed.

[0119] The input and output interface 504 is a port that connects to an input device and an output device. For example, the input and output interface 504 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display.

[0120] The communication device 505 is a receiver and a transmitter. For example, the communication device 505 is a communication chip or a NIC.

[0121] The registration device 500 includes an accepting section 510, a generating section 520, and a registration section 530.

[0122] The generating section 520 includes a random number generating section 521, a collection information generating section 522, a generalization information generating section 523, a ciphertext data generating section 524, a keyword generating section 525, and an encrypted tag generating section 526.

[0123] These elements are implemented by software.

[0124] In the auxiliary storage device 503, a registration program for causing a computer to function as the accepting section 510, the generating section 520, and the registration section 530 is stored. The registration program is loaded into the memory 502 and executed by the processor 501.

[0125] In the auxiliary storage device 503, an OS is also stored. At least a part of the OS is loaded into the memory 502 and executed by the processor 501.

[0126] The processor 501 executes the registration program while executing the OS.

[0127] Input and output data of the registration program is stored in the storage section 590.

[0128] The auxiliary storage device 503 functions as the storage section 590. However, a storage device such as the memory 502, a register in the processor 501, and a cache memory in the processor 501 can function as the storage section 590 instead of or in addition to the auxiliary storage device 503.

[0129] The registration device 500 can include a plurality of processors instead of the processor 501. The plurality of processors share the function of the processor 501.

[0130] The registration program can be recorded (stored) in a non-volatile recording medium such as an optical disk or a flash memory in a computer-readable manner.

[0131] Based on Figure 6 The structure of the search operation device 600 will be described.

[0132] The search operation device 600 is a computer including a processor 601, a memory 602, an auxiliary storage device 603, an input and output interface 604, and a communication device 605. These hardware are connected to each other via signal lines.

[0133] The processor 601 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 601 is a CPU, a DSP, or a GPU.

[0134] The memory 602 is a volatile or nonvolatile storage device. The memory 602 is also referred to as a main storage device or a main memory. For example, the memory 602 is a RAM. Data stored in the memory 602 is saved in the auxiliary storage device 603 as necessary.

[0135] The auxiliary storage device 603 is a nonvolatile storage device. For example, the auxiliary storage device 603 is a ROM, an HDD, or a flash memory. Data stored in the auxiliary storage device 603 is loaded into the memory 602 as necessary.

[0136] The input-output interface 604 is a port connected to an input device and an output device. For example, the input-output interface 604 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display.

[0137] The communication device 605 is a receiver and a transmitter. For example, the communication device 605 is a communication chip or a NIC.

[0138] The search operation device 600 includes elements such as the reception unit 610, the generation unit 620, the request unit 630, the decryption unit 640, and the output unit 650.

[0139] The generation unit 620 includes elements such as the aggregation flag generation unit 621, the position information generation unit 622, and the search query generation unit 623.

[0140] The decryption unit 640 includes elements such as the aggregation flag generation unit 641, the position information generation unit 642, and the search result decryption unit 643.

[0141] These elements are implemented by software.

[0142] In the auxiliary storage device 603, a search operation program for causing a computer to function as the reception unit 610, the generation unit 620, the request unit 630, the decryption unit 640, and the output unit 650 is stored. The search operation program is loaded into the memory 602 and executed by the processor 601.

[0143] In the auxiliary storage device 603, an OS is also stored. At least a part of the OS is loaded into the memory 602 and executed by the processor 601.

[0144] The processor 601 executes the search operation program while executing the OS.

[0145] Input-output data of the search operation program is stored in the storage unit 690.

[0146] The auxiliary storage device 603 functions as the storage section 690. However, a storage device such as the memory 602, a register in the processor 601, and a cache memory in the processor 601 can function as the storage section 690 instead of or in addition to the auxiliary storage device 603.

[0147] The search operation device 600 can also have a plurality of processors instead of the processor 601. The plurality of processors share the functions of the processor 601.

[0148] The search operation program can be recorded (stored) in a nonvolatile recording medium such as an optical disk or a flash memory in a computer-readable manner.

[0149] Based on Figure 7 The structure of the data management device 700 will be described.

[0150] The data management device 700 is a computer having a processor 701, a memory 702, an auxiliary storage device 703, an input-output interface 704, and a communication device 705. These hardware are connected to each other via signal lines.

[0151] The processor 701 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 701 is a CPU, a DSP, or a GPU.

[0152] The memory 702 is a storage device that is volatile or nonvolatile. The memory 702 is also called a main storage device or a main memory. For example, the memory 702 is a RAM. Data stored in the memory 702 is saved in the auxiliary storage device 703 as needed.

[0153] The auxiliary storage device 703 is a storage device that is nonvolatile. For example, the auxiliary storage device 703 is a ROM, an HDD, or a flash memory. Data stored in the auxiliary storage device 703 is loaded into the memory 702 as needed.

[0154] The input-output interface 704 is a port that connects to an input device and an output device. For example, the input-output interface 704 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display.

[0155] The communication device 705 is a receiver and a transmitter. For example, the communication device 705 is a communication chip or a NIC.

[0156] The data management device 700 has elements such as a reception section 710, a search section 720, an output section 730, and a management section 740.

[0157] The search section 720 has elements such as a collation section 721 and an extraction section 722.

[0158] These elements are realized by software.

[0159] In the auxiliary storage device 703, a data management program for causing the computer to function as the reception unit 710, the search unit 720, the output unit 730, and the management unit 740 is stored. The data management program is loaded into the memory 702 and executed by the processor 701.

[0160] In the auxiliary storage device 703, an OS is also stored. At least a part of the OS is loaded into the memory 702 and executed by the processor 701.

[0161] The processor 701 executes the data management program while executing the OS.

[0162] Input and output data of the data management program is stored in the storage unit 790.

[0163] The auxiliary storage device 703 functions as the storage unit 790. However, a storage device such as a register in the memory 702, the processor 701, and a cache memory in the processor 701 can function as the storage unit 790 instead of or in addition to the auxiliary storage device 703.

[0164] The data management device 700 can have a plurality of processors instead of the processor 701. The plurality of processors share the function of the processor 701.

[0165] The data management program can be recorded (stored) in a non-volatile recording medium such as an optical disk or a flash memory in a manner readable by a computer.

[0166] * * * Explanation of Actions * * *

[0167] The steps of the action of the concealed search system 100 correspond to the concealed search method.

[0168] Based on Figure 8 The outline of the concealed search method is explained.

[0169] In step S101, the master key device 200 generates a master key MK.

[0170] In step S102, the registration key device 300 generates a registration key EK using the master key MK.

[0171] In step S103, the user key device 400 generates a user key UK using the registration key EK.

[0172] In step S111, the registration device 500 generates a group of the ciphertext data C and the encryption tag CT using the registration key EK, and registers the generated group in the database.

[0173] The ciphertext data C is generated by encrypting the plaintext M.

[0174] The encryption tag CT is generated by encrypting a keyword used to search for the ciphertext data C. The keyword is not leaked from the encryption tag CT.

[0175] In the database, a plurality of groups of the ciphertext data C and the encryption tag CT are registered.

[0176] In step S112, the search operation device 600 generates the search query SQ using the user key UK.

[0177] The search query SQ is generated by using the user key UK and randomizing the specified keyword.

[0178] In step S113, the search operation device 600 requests a search by transmitting the search query SQ to the data management device 700.

[0179] The data management device 700 receives the search query SQ and searches for the encryption tag CT that matches the search query SQ by a special operation.

[0180] In the special operation, each encryption tag CT is not decrypted, and the keyword of the search query SQ is compared with the keyword of each encryption tag CT.

[0181] In step S114, the data management device 700 responds to the search result by transmitting the ciphertext data C corresponding to the encryption tag CT that matches the search query SQ to the search operation device 600.

[0182] The search operation device 600 receives the ciphertext data C and decrypts the plaintext M from the ciphertext data C using the user key UK.

[0183] Based on Figure 9 The master key generation (S120) will be described.

[0184] The master key generation (S120) is a process performed by the master key device 200.

[0185] In step S121, the reception unit 210 receives the key length BIT.

[0186] For example, the reception unit 210 receives the key length BIT input to the master key device 200 via the input / output interface 204. The reception unit 210 can also receive the key length BIT from an application program executed in the master key device 200.

[0187] The key length BIT is the bit length of the master key MK.

[0188] In step S122, the generation unit 220 generates the master key MK.

[0189] Specifically, the generation section 220 generates a random bit string having the same length as the key length BIT. The generated bit string is the master key MK.

[0190] For example, in the case where the key length BIT is 256 bits, the generation section 220 generates a 256-bit random bit string. Thereby, a 256-bit master key MK is obtained.

[0191] In step S123, the generation section 220 stores the master key MK in the storage section 290. Thereby, the master key MK is kept in the storage section 290.

[0192] In step S124, the output section 230 outputs the master key MK.

[0193] For example, the output section 230 transmits the master key MK to the registration key device 300 using the communication device 205.

[0194] Based on Figure 10 The master key generation (S120) is explained.

[0195] The master key generation (S120) is a process executed by the master key device 200.

[0196] In step S121, the reception section 210 receives the key length BIT.

[0197] For example, the reception section 210 receives the key length BIT from the registration key device 300 using the communication device 205. The reception section 210 can also receive the key length BIT input to the master key device 200 via the input / output interface 204.

[0198] In step S132, the generation section 320 generates a data key DK and a tag key TK using the master key MK.

[0199] Specifically, the generation section 320 executes the function F_1 with the master key MK as input, thereby generating two random numbers. Each random number is a random bit string.

[0200] An example of the function F_1 is a pseudo-random function.

[0201] A pseudo-random function is an encryption function that returns a random number deterministically from an input value when a key is decided.

[0202] The function F_1 can also be an encryption hash function such as SHA-1 or a function of a public key encryption scheme such as AES.

[0203] One of the two random numbers generated by the function F_1 is a data key DK. The data key DK can be expressed as follows.

[0204] DK = F_1 (MK, 1)

[0205] The other of the two random numbers generated by the function F_1 is a tag key TK. The tag key TK can be expressed as follows.

[0206] TK = F_1 (MK, 2)

[0207] The set of the data key DK and the tag key TK is called an enrollment key EK. The enrollment key EK can be expressed as follows.

[0208] EK = (DK, TK)

[0209] In step S133, the generation section 320 stores the enrollment key EK in the storage section 390. Thereby, the enrollment key EK is kept in the storage section 390.

[0210] In step S134, the output section 330 outputs the enrollment key EK.

[0211] For example, the output section 330 transmits the enrollment key EK to the user key device 400 and the enrollment device 500 respectively using the communication means 305.

[0212] Based on Figure 11 The user key generation (S140) will be described.

[0213] The user key generation (S140) is a process executed by the user key device 400.

[0214] In step S141, the reception section 410 receives the enrollment key EK.

[0215] For example, the reception section 410 receives the enrollment key EK from the enrollment key device 300 using the communication means 405. The reception section 410 can also receive the enrollment key EK input to the user key device 400 via the input / output interface 404.

[0216] Then, the reception section 410 stores the enrollment key EK in the storage section 490. Thereby, the enrollment key EK is kept in the storage section 490.

[0217] In the case where the enrollment key EK has been kept in the storage section 490, step S141 is not needed.

[0218] The enrollment key EK has a data key DK and a tag key TK.

[0219] In step S142, the reception unit 410 receives the attribute information A.

[0220] For example, the reception unit 410 receives the attribute information A input to the user key device 400 via the input / output interface 404. The reception unit 410 can also receive the attribute information A from an application program executed in the user key device 400.

[0221] The attribute information A is attribute information of a searcher.

[0222] The searcher is a user of the search operation device 600, and searches for the ciphertext C'.

[0223] The user has a plurality of attributes that form a hierarchy.

[0224] The attribute information shows a plurality of attribute values corresponding to the plurality of attributes.

[0225] Each attribute value identifies an attribute of the user in each layer.

[0226] Based on Figure 12 Examples of the attribute information are described.

[0227] The attribute information shows four attribute values corresponding to four layers.

[0228] The attribute of the first layer (first attribute) is a division.

[0229] The attribute of the second layer (second attribute) is a department.

[0230] The attribute of the third layer (third attribute) is a section.

[0231] The attribute of the fourth layer (fourth attribute) is a name.

[0232] The first attribute information is attribute information of Mr. / Ms. Ne. Mr. / Ms. Ne belongs to the Sc section of the De department of the Di division.

[0233] The second attribute information is attribute information of Mr. / Ms. Nf. Mr. / Ms. Nf belongs to the Sd section of the De department of the Di division.

[0234] The third attribute information is attribute information of a Sc section member. The Sc section member belongs to the Sc section of the De department of the Di division. The fourth attribute value is a wildcard "*" and thus the name is not limited.

[0235] The fourth attribute information is attribute information of a De department member. The De department member belongs to the De department of the Di division. The third attribute value and the fourth attribute value are wildcards "*" and thus the section and the name are not limited.

[0236] Returning to Figure 11 , the step S142 is continued.

[0237] The number of layers of the hierarchy for expressing the attributes of the user is denoted as "L". L is an integer of 2 or more.

[0238] The attribute information shows L attribute values.

[0239] The attribute information A can be expressed as follows.

[0240] A = (A_1,..., A_L)

[0241] The attribute information A is related to the permission control of the search and the decryption.

[0242] Specifically, using data based on the attribute information A, the search permission and the decryption permission are set.

[0243] The attribute information A can also be two attribute information, one for the search permission and the other for the decryption permission.

[0244] In step S143, the aggregation information generating section 421 aggregates the plurality of attribute values included in the attribute information A into one or more blocks. Thus, the aggregation information A' is generated.

[0245] The aggregation information A' is the aggregated attribute information A.

[0246] Each block of the aggregation information A' is composed of one or more attribute values.

[0247] The value shown by each block of the aggregation information A' is called an aggregation value.

[0248] Based on Figure 13 , an example of the aggregation information obtained by aggregating the attribute information (refer to Figure 12 ) is described. The "I" is a symbol indicating concatenation.

[0249] The first element of the aggregation information is an element in which the first attribute and the second attribute are concatenated.

[0250] The second element of the aggregation information is an element in which the third attribute and the fourth attribute are concatenated.

[0251] The first aggregation information is the aggregation information of Mr. / Ms. Ne.

[0252] The attribute information of Mr. / Ms. Ne (refer to Figure 12 ) is (Di, De, Sc, Ne).

[0253] The aggregation information of Mr. / Ms. Ne (refer to Figure 13 ) is (Di I De, Sc I Ne).

[0254] The first attribute value Di and the second attribute value De are aggregated into one string Di I De by concatenation.

[0255] The 3rd attribute value Sc and the 4th attribute value Ne are gathered by concatenation into one string Sc|Ne.

[0256] Other gathering information is also expressed in the same manner as the 1st gathering information.

[0257] Returning to Figure 11 , the step S143 will be continued to be explained.

[0258] The number of layers after gathering used to express the hierarchy of the attributes of the user is denoted as "k". k is an integer of 1 or more.

[0259] The gathering information shows k gathering values.

[0260] The gathering value is a value obtained by gathering 1 or more attribute values. Specifically, the gathering value is a string obtained by concatenating 1 or more attribute values.

[0261] The gathering information A' can be expressed as follows. m is an integer of 1 or more. i_1,..., i_m are positive integers.

[0262] A' = (A'_1,..., A'_k)

[0263] A'_i = A_(i_1)|A_(i_2)|...|A_(i_m)

[0264] i_1 <... < i_m, and i_1 + 1 = i_2, i_2 + 1 = i_3,..., i_(m-1) + 1 = i_m, i_m + 1 = (i+1)_1 hold.

[0265] Here, the 1st attribute information in Figure 12 is called attribute information A1.

[0266] Further, the 1st gathering information in Figure 13 is called gathering information A1'.

[0267] The gathering information A1' can be expressed as follows.

[0268] A1' = (A1'_1, A1'_2) = (A1_1|A1_2, A1_3|A1_4) = (Di|De, Sc|Ne)

[0269] There is no restriction on the gathering method. However, in the concealed search system 100, one gathering method is used. That is, the user key device 400 and other devices use the same gathering method.

[0270] In step S144, the user key generating section 422 generates a user data key UDK using the data key DK, the attribute information A, and the aggregation information A'. The data key DK is included in the registration key EK.

[0271] The user data key UDK has data attribute keys UDK_i and flag values Db_j.

[0272] i is an integer of 1 or more and k or less. j is an integer of 1 or more and L or less.

[0273] The user key generating section 422 calculates the data attribute key UDK_i as follows.

[0274] First, the user key generating section 422 concatenates the aggregation value A'_i and the number i. The value represented by the resulting bit string is called the concatenated value A'_i|i.

[0275] Then, the user key generating section 422 executes the function F_2 with the data key DK and the concatenated value A'_i|i as inputs. The resulting value is the data attribute key UDK_i.

[0276] The function F_2 is a pseudo-random function, a hash function, or a function of a public-key encryption scheme, like the function F_1.

[0277] The user key generating section 422 decides the flag value Db_j as follows.

[0278] The user key generating section 422 determines whether the attribute value A_j is the wildcard "*" or not.

[0279] In the case where the attribute value A_j is the wildcard "*", the flag value Db_j is 1.

[0280] In the case where the attribute value A_j is not the wildcard "*", the flag value Db_j is 0.

[0281] The flag value Db_j indicates whether the attribute value A_j is the wildcard "*" or not.

[0282] The user data key UDK can be expressed as follows. i is an integer of 1 or more and k or less. j is an integer of 1 or more and L or less.

[0283] UDK = (UDK_1,..., UDK_k, Db_1,..., Db_L)

[0284] In the case where A_j = *, Db_j = 1

[0285] In the case where A_j ≠ *, Db_j = 0

[0286] UDK_i = F_2(DK, A'_i|i)

[0287] In step S145, the user key generating section 422 generates a user tag key UTK using the tag key TK, the attribute information A, and the aggregation information A'. The tag key TK is included in the registration key EK.

[0288] The user tag key UTK has tag attribute keys UTK_i and flag values Tb_j.

[0289] i is an integer of 1 or more and k or less. j is an integer of 1 or more and L or less.

[0290] The user key generating section 422 calculates the tag attribute key UTK_i as follows.

[0291] First, the user key generating section 422 concatenates the aggregation value A'_i and the number i. The value represented by the resulting bit string is called the concatenated value A'_i|i.

[0292] Then, the user key generating section 422 executes the function F_2 with the tag key TK and the concatenated value A'_i|i as inputs. The resulting value is the tag attribute key UTK_i.

[0293] The user key generating section 422 decides the flag value Tb_j as follows.

[0294] The user key generating section 422 determines whether the attribute value A_j is the wildcard "*".

[0295] In the case where the attribute value A_j is the wildcard "*", the flag value Tb_j is 1.

[0296] In the case where the attribute value A_j is not the wildcard "*", the flag value Tb_j is 0.

[0297] The flag value Tb_j indicates whether the attribute value A_j is the wildcard "*".

[0298] The user tag key UTK can be expressed as follows. i is an integer of 1 or more and k or less. j is an integer of 1 or more and L or less.

[0299] UTK = (UTK_1,..., UTK_k, Tb_1,..., Tb_L)

[0300] Tb_j = 1 in the case where A_j = *

[0301] Tb_j = 0 in the case where A_j ≠ *

[0302] UTK_i = F_2(TK, A'_i|i)

[0303] A group of the user data key UDK and the user tag key UTK is referred to as a "user key UK". The user key UK can be expressed as follows.

[0304] UK = (UDK, UTK)

[0305] In step S146, the generation section 420 stores the user key UK in the storage section 490. Thereby, the user key UK is kept in the storage section 490.

[0306] In step S147, the output section 430 outputs the user key UK.

[0307] For example, the output section 430 transmits the user key UK to the search operation device 600 using the communication device 405.

[0308] Based on Figure 14 The data registration (S150) is explained.

[0309] The data registration (S150) is a process executed by the registration device 500.

[0310] In step S151, the reception section 510 receives the registration key EK.

[0311] For example, the reception section 510 receives the registration key EK from the registration key device 300 using the communication device 505. The reception section 510 can also receive the registration key EK input to the registration device 500 via the input / output interface 504.

[0312] Then, the reception section 510 stores the registration key EK in the storage section 590. Thereby, the registration key EK is kept in the storage section 590.

[0313] In a case where the registration key EK is already kept in the storage section 590, step S151 is not needed.

[0314] The registration key EK has a data key DK and a tag key TK.

[0315] In step S152, the reception section 510 receives the plaintext M and the attribute information B.

[0316] For example, the reception section 510 receives the plaintext M and the attribute information B input to the registration device 500 via the input / output interface 504. The reception section 510 can also receive the plaintext M and the attribute information B from an application program executed in the registration device 500.

[0317] The plaintext M is data that is not encrypted.

[0318] A file name File(M) is included in the plaintext M as metadata.

[0319] The attribute information B is attribute information of the authority.

[0320] The authority is a part of the user of the search operation device 600, and has the authority to refer to the plain text M.

[0321] For example, the attribute information B is attribute information shown in Figure 12

[0322] The attribute information B can be expressed as follows.

[0323] B = (B_1,..., B_L)

[0324] The attribute information B is the same as the attribute information A in terms of the authority control of search and decryption.

[0325] In step S153, the random number generation section 521 generates a data random number set r = (r_1,..., r_k, rs) and a tag random number set R = (R_1,..., R_k, RS).

[0326] The data random number set r and the tag random number set R are each composed of (k + 1) random numbers. Each random number is randomly generated uniformly.

[0327] In step S154, the aggregation information generation section 522 aggregates a plurality of attribute values included in the attribute information B into one or more blocks. Thus, the aggregation information B' is generated.

[0328] The aggregation information B' is the aggregated attribute information B.

[0329] Each block of the aggregation information B' is composed of one or more attribute values.

[0330] A value shown in each block of the aggregation information B' is called an aggregation value.

[0331] The aggregation method for the aggregation information B' is the same as the aggregation method for the aggregation information A' (refer to step S143 of Figure 11

[0332] For example, the aggregation information B' is aggregation information shown in Figure 13

[0333] The aggregation information B' can be expressed as follows. m is an integer of one or more. i_1,..., i_m are positive integers.

[0334] B' = (B'_1,..., B'_k)

[0335] B'_i = B_(i_1) | B_(i_2) |... | B_(i_m)

[0336] ​​​i_1 <... < i_m, and i_1 + 1 = i_2, i_2 + 1 = i_3,..., i_(m-1) + 1 = i_m, i_m + 1 = (i+1)_1 holds.

[0337] In step S155, the generalization information generation section 523 generalizes each aggregation value included in the aggregation information B' using a wildcard. Thus, the generalization information B^ is generated.

[0338] The generalization information B^ shows a plurality of generalization values for each aggregation value.

[0339] The generalization value is constituted by zero or more wildcards that replace zero or more attribute values in the aggregation value and the remaining attribute values in the aggregation value.

[0340] Specifically, the generalization information generation section 523 generates Ii generalization values B'_i^ for the i-th aggregation value B'_i included in the aggregation information B' as follows.

[0341] B'_i^0 = B'_i

[0342] = B_(i_1) | B_(i_2) |... | B_(i_m)

[0343] B'_i^1 = * | B_(i_2) |... | B_(i_m)

[0344] B'_i^2 = B_(i_1) | * | B_(i_3) |... | B_(i_m)

[0345] B'_i^3 = * | * | B_(i_3) |... | B_(i_m)

[0346] B'_i^4 = B_(i_1) | B_(i_2) | * | B_(i_4) |... | B_(i_m)

[0347] ...

[0348] B'_i^Ii = * | * |... | *

[0349] Ii = 2 ((i_m)-(i_1)+1)

[0350] Here, the first aggregation information in Figure 13 is referred to as the aggregation information B'.

[0351] Further, the first aggregation value included in the aggregation information B' is referred to as the aggregation value B'_1

[0352] For the aggregation value B'_1, the following four generalization values B'_1^ are generated.

[0353] B'_1^0 = B'_1 = Di | De

[0354] B'_1^1 = * | De

[0355] B'_1^2 = Di | *

[0356] B'_1^3 = * | *

[0357] Here, the second aggregation value included in the aggregation information B' is referred to as an aggregation value B'_2.

[0358] For the aggregation value B'_2, the following four generalized values B'_2^ are generated.

[0359] B'_2^0 = B'_2 = Sc | Ne

[0360] B'_2^1 = * | Ne

[0361] B'_2^2 = Sc | *

[0362] B'_2^3 = * | *

[0363] Return Figure 14 The process proceeds from step S156.

[0364] In step S156, the ciphertext data generating section 524 generates ciphertext data C using the data key DK, the plaintext M, the attribute information B, the generalized information B^, and the data random number array r. The data key DK is included in the registration key EK.

[0365] The ciphertext data C has attribute elements C_{i,h}, a random number element C_rs, and ciphertext C'.

[0366] i is an integer of 1 or greater and k or less. h is an integer of 0 or greater and 2 ((i_m)-(i_1)+1) -1 or less.

[0367] The ciphertext data generating section 524 calculates the attribute element C_{i,h} as follows.

[0368] First, the ciphertext data generating section 524 concatenates the generalized value B'_i^h included in the generalized information B^ with the number i. The value represented by the resulting bit string is referred to as a concatenated value B'_i^h|i.

[0369] Next, the ciphertext data generating section 524 executes the function F_2 with the data key DK and the concatenated value B'_i^h|i as inputs. The resulting value is referred to as a function value (DK, B'_i^h|i).

[0370] Next, the ciphertext data generating section 524 executes the function F_3 with the function value (DK, B'_i^h|i) and the random number rs included in the data random number set r as inputs. The obtained value is called a function value (DK, B'_i^h|i, rs).

[0371] The function F_3 is also a pseudo-random function, a hash function, or a function of a public-key encryption scheme like the functions F_1 and F_2.

[0372] Then, the ciphertext data generating section 524 calculates the exclusive OR of the function value (DK, B'_i^h|i, rs) and the random number r_i included in the data random number set r. The obtained value is an attribute element C_{i,j}.

[0373] The ciphertext data generating section 524 sets the random number rs included in the data random number set r as a random number element C_rs.

[0374] The ciphertext data generating section 524 calculates the ciphertext C' as follows.

[0375] First, the ciphertext data generating section 524 calculates the exclusive OR of the k random numbers (r_1,..., r_k) included in the data random number set r. The obtained value is called a random number sum r+.

[0376] Next, the ciphertext data generating section 524 executes the function F_4 with the random number sum r+ as an input. The obtained value is called a function value (r+).

[0377] The function F_4 is also a pseudo-random function, a hash function, or a function of a public-key encryption scheme like the function F_3.

[0378] Then, the ciphertext data generating section 524 calculates the exclusive OR of the function value (r+) and the plaintext M. The obtained value is the ciphertext C'.

[0379] The ciphertext C' is the encrypted plaintext M.

[0380] The ciphertext data C can be expressed as follows. However, in Embodiment 1, (+) means exclusive OR (XOR). i is an integer of 1 or more and k or less. m is an integer of 1 or more.

[0381] C = ((C_{1,0}, C_{1,1},..., C_{1,11}), (C_{2,0}, C_{2,1},..., C_{2,12}),..., (C_{k,0}, C_{k,1},..., C_{k, Ik}), C_rs, C')

[0382] C_{i,h} = F_3(F_2(DK, B'_i^h|i), rs) (+) r_i

[0383] C_rs = rs

[0384] C' = F_4(r_1(+)... (+) r_k)(+) M

[0385] Ii = 2 ((i_m)-(i_1)+1)

[0386] In step S157, the keyword generation section 525 generates a keyword related to the plaintext M.

[0387] Specifically, the keyword generation section 525 extracts a keyword from the plaintext M by performing morphological analysis or natural language processing on the plaintext M.

[0388] However, the keyword generation section 525 can also accept a keyword input to the registration device 500 via the input / output interface 504. Further, the keyword generation section 525 can also accept a keyword related to the plaintext M from an application program executed in the registration device 500.

[0389] The keyword related to the plaintext M is referred to as a "registration keyword W".

[0390] The registration keyword W can also have a plurality. In the case where the registration keyword W has a plurality, an encryption tag CT is generated for each registration keyword W.

[0391] In step S158, the encryption tag generation section 526 generates an encryption tag CT using the tag key TK, the attribute information B, the generalized information B^, the tag random number set R, and the registration keyword W. The tag key TK is included in the registration key EK.

[0392] The encryption tag CT has an attribute element CT_{i,h}, a random number element CT_RS, and a verification element CT_V.

[0393] i is an integer of 1 or more and k or less. h is an integer of 0 or more and 2 ((i_m)-(i_1)+1) -1 or less.

[0394] The encryption tag generation section 526 calculates the attribute element CT_{i,h} as follows.

[0395] First, the encryption tag generation section 526 associates the generalized value B'_i^h included in the generalized information B^ with the number i. The value represented by the obtained bit string is referred to as an association value B'_i^h|i.

[0396] Next, the encryption tag generation section 526 executes the function F_2 with the tag key TK and the association value B'_i^h|i as inputs. The obtained value is referred to as a function value (TK, B'_i^h|i).

[0397] Next, the encryption tag generating section 526 executes the function F_5 with the function value (TK, B'_i^h|i) and the registration keyword W as inputs. The obtained value is called a function value (TK, B'_i^h|i, W).

[0398] The function F_5 is also a pseudo-random function, a hash function, or a function of a public key encryption scheme like the function F_1 and the function F_2.

[0399] Next, the encryption tag generating section 526 executes the function F_6 with the function value (TK, B'_i^h|i, W) and a random number RS included in the tag random number set R as inputs. The obtained value is called a function value (TK, B'_i^h|i, W, RS).

[0400] The function F_6 is also a pseudo-random function, a hash function, or a function of a public key encryption scheme like the function F_5.

[0401] Then, the encryption tag generating section 526 calculates the exclusive OR of the function value (TK, B'_i^h|i, W, RS) and a random number R_i included in the tag random number set R. The obtained value is an attribute element CT_{i,h}.

[0402] The encryption tag generating section 526 sets a random number RS included in the tag random number set R as a random number element CT_RS.

[0403] The encryption tag generating section 526 calculates a verification element CT_V as follows.

[0404] First, the encryption tag generating section 526 calculates the exclusive OR of k random numbers (R_1,..., R_k) included in the tag random number set R. The obtained value is called a random number sum R+.

[0405] Then, the encryption tag generating section 526 executes the function F_7 with the random number sum R+ as an input. The obtained value is the verification element CT_V.

[0406] The function F_7 is also a pseudo-random function, a hash function, or a function of a public key encryption scheme like the function F_6.

[0407] The encryption tag CT can be expressed as follows. However, in Embodiment 1, (+) means the exclusive OR (XOR). i is an integer of 1 or more and k or less. m is an integer of 1 or more.

[0408] CT = ((CT1,0, CT1,1,..., CT1,11), (CT2,0, CT2,1,..., CT2,12),..., (CTk,0, CTk,1,..., CTk, Ik), CT RS, CT V)

[0409] CTi,h = F6(F5(F2(TK, Bi^h | i), W), RS)(+)Ri

[0410] CT RS = RS

[0411] CT V = F7(R1(+)... (+)Rk)

[0412] Ii = 2 ((i_m)-(i_1)+1)

[0413] In step S159, the registration section 530 registers the group of the file name File (M), the ciphertext data C, and the encryption tag CT in the registration database 791 of the data management apparatus 700.

[0414] The group of the file name File (M), the ciphertext data C, and the encryption tag CT is called "anonymized search data".

[0415] Based on Figure 15 The registration database 791 is explained.

[0416] The registration database 791 is a database for search, stored in the storage section 790 of the data management apparatus 700.

[0417] In the registration database 791, the group of the file name File (M), the ciphertext data C, and the encryption tag CT (anonymized search data) is registered.

[0418] Returning to Figure 14 , the step S159 is continued to be explained.

[0419] The anonymized search data is registered as follows.

[0420] The registration section 530 transmits the anonymized search data to the data management apparatus 700 using the communication apparatus 505. In the data management apparatus 700, the reception section 710 receives the anonymized search data, and the management section 740 registers the anonymized search data in the registration database 791.

[0421] Thus, the file name File (M), the ciphertext data C, and the encryption tag CT are stored in correspondence with each other.

[0422] Based on Figure 16 The search operation (S160) is explained.

[0423] The search operation (S160) is processing performed by the search operation device 600.

[0424] In step S161, the reception unit 610 receives the user key UK.

[0425] For example, the reception unit 610 receives the user key UK from the user key device 400 using the communication device 605. The reception unit 610 can also receive the user key UK input to the search operation device 600 via the input / output interface 604.

[0426] Then, the reception unit 610 stores the user key UK in the storage unit 690. Thereby, the user key UK is kept in the storage unit 690.

[0427] In a case where the user key UK is already kept in the storage unit 690, step S161 is not needed.

[0428] The user key UK has a user data key UDK and a user tag key UTK.

[0429] In step S162, the reception unit 610 receives the search keyword w.

[0430] For example, the reception unit 610 receives the search keyword w input to the search operation device 600 via the input / output interface 604. The reception unit 610 can also receive the search keyword w from an application program executed in the search operation device 600.

[0431] In step S163, the generation unit 620 generates a search query SQ using the user tag key UTK and the search keyword w. The user tag key UTK is included in the user key UK.

[0432] The user tag key UTK has k tag attribute keys {UTK_1,..., UTK_k} and L flag values {Tb_1,..., Tb_L} as follows.

[0433] UTK = (UTK_1,..., UTK_k, Tb_1,..., Tb_L)

[0434] The L flag values {Tb_1,..., Tb_L} are referred to as flag information Tb.

[0435] Based on Figure 17 The steps of step S163 are described.

[0436] In step S1631, the aggregation flag generation unit 621 aggregates the plurality of flag values included in the flag information Tb into one or more blocks. Thereby, an aggregated flag Tb' is generated.

[0437] The collection flag Tb' is the collection flag information Tb after collection.

[0438] Each block of the collection flag Tb' is composed of one or more flag values.

[0439] The value shown in each block of the collection flag Tb' is called a collection value.

[0440] The collection method for the collection flag Tb' is the same as the collection method for the collection information A' (refer to step S143) and the collection information B' (refer to step S154). Figure 11 Figure 14

[0441] The collection flag Tb' can be expressed as follows. m is an integer of one or more. i_1,..., i_m are positive integers.

[0442] Tb' = (Tb'_1,..., Tb'_k)

[0443] Tb'_i = (Tb_(i_1) | Tb_(i_2) |... | Tb_(i_m)

[0444] i_1 <... < i_m, and i_1 + 1 = i_2, i_2 + 1 = i_3,..., i_(m-1) + 1 = i_m, i_m + 1 = (i+1)_1 hold.

[0445] The collection flag Tb' has k collection values Tb'_i.

[0446] For example, the collection flag Tb1' corresponding to the first collection information (refer to Figure 13 ) can be expressed as follows.

[0447] Tb1' = (Tb1'_1, Tb1'_2) = (Tb1_1 | Tb1_2, Tb1_3 | Tb1_4) = (0 | 0, 0 | 0)

[0448] For example, the collection flag Tb3' corresponding to the third collection information (refer to Figure 13 ) can be expressed as follows.

[0449] Tb3' = (Tb3'_1, Tb3'_2) = (Tb3_1 | Tb3_2, Tb3_3 | Tb3_4) = (0 | 0, 0 | 1)

[0450] For example, the collection flag Tb4' corresponding to the fourth collection information (refer to Figure 13 ) can be expressed as follows.

[0451] ​​Tb4' = (Tb4'_1, Tb4'_2) = (Tb4_1|Tb4_2, Tb4_3|Tb4_4) = (0|0, 1|1)

[0452] In step S1632, the position information generating section 622 generates the search position information SP using the aggregation flag Tb'.

[0453] The search position information SP is information that specifies one or more attribute elements CT_{i,h} among the plurality of attribute elements CT_ included in the encrypted tag CT to be used at the time of search.

[0454] Specifically, the search position information SP shows one or more sets of integers (i, h).

[0455] The search position information SP can be expressed as follows.

[0456] SP = ((1, SP1),..., (k, SPk))

[0457] SP_i = Tb'_ (i_1) x 2 0 + Tb'_ (i_2) x 2 1 +... + Tb'_ (i_m) x 2 (i_m)-(i_1)+1

[0458] For example, the aggregation flag Tb1' corresponding to the first aggregation information (refer to Figure 13 ) can be expressed as follows.

[0459] Tb1' = (Tb1'_1, Tb1'_2) = (Tb1_1|Tb1_2, Tb1_3|Tb1_4) = (0|0, 0|0)

[0460] In this case, the search position information SP1 corresponding to the aggregation flag Tb1' can be expressed as follows.

[0461] SP1 = (SP1_1, SP1_2)

[0462] SP1_1 = 0 x 2 0 + 0 x 2 1 = 0

[0463] SP1_2 = 0 x 2 0 + 0 x 2 1 = 0

[0464] For example, the aggregation flag Tb3' corresponding to the third aggregation information (refer to Figure 13 ) can be expressed as follows.

[0465] Tb3' = (Tb3'_1, Tb3'_2) = (Tb3_1 | Tb3_2, Tb3_3 | Tb3_4) = (0 | 0, 0 | 1)

[0466] In this case, the search position information SP3 corresponding to the aggregation flag Tb3' can be expressed as follows.

[0467] SP3 = (SP3_1, SP3_2)

[0468] SP3_1 = 0 x 2 0 + 0 x 2 1 = 0

[0469] SP3_2 = 0 x 2 0 + 1 x 2 1 = 2

[0470] For example, the aggregation flag Tb4' corresponding to the 4th aggregation information (refer to Figure 13 ) can be expressed as follows.

[0471] Tb4' = (Tb4'_1, Tb4'_2) = (Tb4_1 | Tb4_2, Tb4_3 | Tb4_4) = (0 | 0, 1 | 1)

[0472] In this case, the search position information SP4 corresponding to the aggregation flag Tb4' can be expressed as follows.

[0473] SP4 = (SP4_1, SP4_2)

[0474] SP4_1 = 0 x 2 0 + 0 x 2 1 = 0

[0475] SP4_2 = 1 x 2 0 + 1 x 2 1 = 3

[0476] In step S1633, the search query generating section 623 generates a search query SQ using the tag attribute key UTK_i, the search keyword w, and the search position information SP.

[0477] The search query SQ has an attribute keyword element SQ_i and a search position element SQP_i.

[0478] The search query generating section 623 calculates the attribute keyword element SQ_i as follows.

[0479] The search query generating section 623 executes the function F_5 with the tag attribute key UTK_i and the search keyword w as inputs. The obtained value is the attribute keyword element SQ_i.

[0480] The attribute key element SQ_i is the encrypted search key w (encrypted key).

[0481] The search query generating section 623 calculates the search position element SQP_i as follows.

[0482] The search query generating section 623 extracts the i-th element SP_i from the search position information SP. The extracted element SP_i is the search position element SQP_i.

[0483] The search query SQ can be expressed as follows. i is an integer of 1 or more and k or less.

[0484] SQ = ((SQ_1, SQP_1),..., (SQ_k, SQP_k))

[0485] SQ_i = F_5 (UTK_i, w)

[0486] SQP_i = SP_i

[0487] Return Figure 16 The explanation continues from step S164.

[0488] In step S164, the requesting section 630 transmits the search query SQ to the data management apparatus 700 using the communication means 605.

[0489] In step S165, the requesting section 630 receives the encrypted search result {C} from the data management apparatus 700 using the communication means 605.

[0490] The encrypted search result {C} is a set of ciphertext data C that coincides with the search query SQ.

[0491] In the case where the encrypted search result {C} does not have ciphertext data C, that is, in the case where there is no matching ciphertext data C in the search using the search query SQ, step S166 is not needed.

[0492] In step S166, the decrypting section 640 decrypts the search result {M} from the encrypted search result {C} using the user data key UDK. The user data key UDK is included in the user key UK.

[0493] The search result {M} is a set of plaintext M that coincides with the search query SQ.

[0494] The user data key UDK has k data attribute keys {UDK_1,..., UDK_k} and L flag values {Db_1,..., Db_L} as follows.

[0495] UDK = (UDK_1,..., UDK_k, Db_1,..., Db_L)

[0496] The L flag values {Db_1,..., Db_L} are referred to as flag information Db.

[0497] Based on Figure 18 The order of step S166 is described.

[0498] In step S1661, the flag gathering section 641 gathers the plurality of flag values included in the flag information Db into one or more blocks. Thus, the gathered flag Db' is generated.

[0499] The gathered flag Db' is the gathered flag information Db.

[0500] Each block of the gathered flag Db' is composed of one or more flag values.

[0501] The value shown in each block of the gathered flag Db' is referred to as a gathered value.

[0502] The gathering method for the gathered flag Db' is the same as that for the gathered flag Tb' (refer to step S1631 of FIG. 16). Figure 17

[0503] The gathered flag Db' can be expressed as follows. m is an integer of one or more. i_1,..., i_m are positive integers.

[0504] Db' = (Db'_1,..., Db'_k)

[0505] Db'_i = (Db_(i_1) | Db_(i_2) |... | Db_(i_m)

[0506] i_1 <... < i_m, and i_1 + 1 = i_2, i_2 + 1 = i_3,..., i_(m-1) + 1 = i_m, i_m + 1 = (i+1)_1 hold

[0507] The gathered flag Db' has k gathered values Db'_i.

[0508] In step S1662, the position information generating section 642 generates the decryption position information DP using the gathered flag Db'.

[0509] The decryption position information DP is information that determines the attribute element C_{i,h} used at the time of decryption among the plurality of attribute elements C_ included in the ciphertext data C.

[0510] Specifically, the decryption position information DP shows one or more integers (i, h).

[0511] The decryption position information DP can be expressed as follows.

[0512] ​DP = ((1, DP_1),..., (k, DP_k))

[0513] DP_i = Db'_ (i_1) x 2 0 + Db'_ (i_2) x 2 1 +... + Db'_ (i_m) x 2 (i_m)-(i_1)+1

[0514] In step S1663, the search result decryption section 643 decrypts the search result {M} from the encrypted search result {C} using the user data key UDK and the decryption position information DP.

[0515] Specifically, the search result decryption section 643 decrypts the plaintext M from each ciphertext data C of the encrypted search result {C}.

[0516] The decryption section 640 decrypts the plaintext M from each ciphertext data C as follows.

[0517] First, the decryption section 640 executes the function F_3 using the data attribute key UDK_i included in the user data key UDK and the random number element C_rs included in the ciphertext data C as inputs. The obtained value is called a function value (UDK_i, C_rs).

[0518] Next, the decryption section 640 selects k attribute elements (C_{1, DP_1},..., C_{k, DP_k}) from the ciphertext data C. DP_i is a value included in the decryption position information DP.

[0519] Next, the decryption section 640 calculates the exclusive OR of the function value (UDK_i, C_rs) and the attribute element C_{i, DP_i}. The obtained value is called an extracted random number r_i^.

[0520] Next, the decryption section 640 calculates the exclusive OR of the k extracted random numbers (r_1^,..., r_k^). The obtained value is called a random number sum r^+.

[0521] Next, the decryption section 640 executes the function F_4 using the random number sum r^+ as an input. The obtained value is called a function value (r^+).

[0522] Then, the decryption section 640 calculates the exclusive OR of the function value (r^+) and the ciphertext C' included in the ciphertext data C. The obtained value is the plaintext M.

[0523] The plaintext M can be expressed as follows. i is an integer of 1 or more and k or less.

[0524] M = F_4(r_1^ (+)... (+) r_k^) (+) C'

[0525] r_i = F_3(UDK_i, C_rs) (+) C_{i, DP_i}

[0526] Return Figure 16 The step S167 will be described.

[0527] In the step S167, the output unit 650 outputs the search result {M}.

[0528] For example, the output unit 650 displays the search result {M} on a display via the input / output interface 604.

[0529] In a case where the step S166 is not executed because the encrypted search result {C} does not have the ciphertext data C, the search result {M} is not obtained.

[0530] In a case where the search result {M} is not obtained, the output unit 650 outputs a search error message instead of the search result {M}.

[0531] The search error message indicates that there is no hit of the plaintext M in the cloaked search.

[0532] Based on Figure 19 The data search (S170) will be described.

[0533] The data search (S170) is processing performed by the data management apparatus 700.

[0534] In the step S171, the reception unit 710 receives the search query SQ from the search operation apparatus 600 using the communication apparatus 705.

[0535] In the step S172, the collation unit 721 selects the encrypted tag CT that coincides with the search query SQ by collating the search query SQ with each encrypted tag CT.

[0536] Each encrypted tag CT that coincides with the search query SQ is referred to as a "corresponding encrypted tag CT".

[0537] Specifically, the collation unit 721 collates the search query SQ with each encrypted tag CT as follows.

[0538] First, the collation unit 721 selects k attribute elements (CT_{1, SQP_1},..., CT_{k, SQP_k}) from the encrypted tags CT. SQP_i is an element included in the search query SQ.

[0539] Next, the collation unit 721 executes the function F_6 with the attribute key element SQ_i included in the search query SQ and the random number element CT_RS included in the encrypted tag CT as inputs. The obtained value is referred to as the function value (SQ_i, CT_RS).

[0540] Next, the collating section 721 calculates the exclusive OR of the function value (SQ_i, CT_RS) and the attribute element CT_{i, SQP_i}. The obtained value is called the extracted random number R_i^.

[0541] Next, the collating section 721 calculates the exclusive OR of the k extracted random numbers (R_1^,..., R_k^). The obtained value is called the random number sum R^+.

[0542] Next, the collating section 721 executes the function F_7 with the random number sum R^+ as input. The obtained value is called the function value (R^+).

[0543] Then, the collating section 721 compares the function value (R^+) with the verification element CT_V included in the encrypted tag CT.

[0544] The coincidence of the function value (R^+) and the verification element CT_V means that the registration key W embedded in the encrypted tag CT coincides with the attribute information A, and that the search key w embedded in the search query SQ coincides with the attribute information B.

[0545] The encrypted tag CT having the verification element CT_V coinciding with the function value (R^+) is the corresponding encrypted tag CT.

[0546] The verification formula can be expressed as follows. i is an integer of 1 or more and k or less.

[0547] CT_V = F_7(R_1^ (+)... (+) R_k^)

[0548] R_i^ = F_6(SQ_i, CT_RS) (+) CT_{i, SQP_i}

[0549] In step S173, the extracting section 722 extracts the ciphertext data C corresponding to each of the respective encrypted tags CT. The extracted ciphertext data C is called the corresponding ciphertext data C.

[0550] In step S174, the output section 730 transmits the encrypted search result {C} to the search operation device 600 using the communication device 705.

[0551] The encrypted search result {C} is a set of the respective ciphertext data C.

[0552] Based on Figure 20 The data deletion (S180) is described.

[0553] The data deletion (S180) is a process executed by the registration device 500 and the data management device 700. However, the search operation device 600 can act instead of the registration device 500.

[0554] In step S181, the receiving section 510 of the registration device 500 receives a deletion file name. For example, the file name File(M) in the plaintext M obtained by the search operation (S160) is used as the deletion file name.

[0555] For example, the receiving section 510 receives the deletion file name input to the registration device 500 via the input / output interface 504. The receiving section 510 can also receive the deletion file name from an application program executed in the registration device 500.

[0556] However, the receiving section 610 of the search operation device 600 can also receive the deletion file name.

[0557] In step S182, the registration section 530 of the registration device 500 transmits the deletion file name to the data management device 700 using the communication device 505.

[0558] However, the output section 650 of the search operation device 600 can also transmit the deletion file name to the data management device 700 using the communication device 605.

[0559] In step S183, the receiving section 710 of the data management device 700 receives the deletion file name using the communication device 705.

[0560] In step S184, the management section 740 of the data management device 700 deletes the obfuscated search data corresponding to the deletion file name from the registration database 791.

[0561] The obfuscated search data corresponding to the deletion file name has the same file name File(M) as the deletion file name.

[0562] Effects of Embodiment 1

[0563] According to Embodiment 1, the following effects are exerted.

[0564] It is possible to perform keyword search without decrypting the ciphertext.

[0565] It is possible to generate different keys according to each attribute information of the user. Therefore, it is possible to configure a multi-user type public key system.

[0566] It is possible to control the decryption authority of the ciphertext using the user's key. Since it is difficult to separate the attribute information included in the key, it is possible to improve the resistance to collusion attacks against multiple legitimate users. That is, it is possible to improve the security of the multi-user type public key system.

[0567] The key is generated after the plurality of attribute values in the attribute information are gathered into several blocks. Thereby, it is possible to suppress the length of the key to be proportional to the attribute information.

[0568] By generating the search location information and the decryption location information, it is possible to make the search and decryption efficient.

[0569] According to Embodiment 1, the following effects are exerted.

[0570] The user key device 400 performs irreversible conversion on data (aggregated information, generalized information) in which attribute information is vectorized by being summarized into several parts, and generates a user key.

[0571] The registration device 500 generates ciphertext data and an encryption tag using the user key.

[0572] The search operation device 600 generates a search query using the user key.

[0573] Thus, the security of the public key system of the multi-user type is improved against a collusion attack.

[0574] **Supplement to Embodiment 1**

[0575] Based on Figure 21 The hardware structure of the master key device 200 will be described.

[0576] The master key device 200 has a processing circuit 209.

[0577] The processing circuit 209 is hardware that realizes the reception section 210, the generation section 220, and the output section 230.

[0578] The processing circuit 209 can be a dedicated hardware or a processor 201 that executes a program stored in a memory 202.

[0579] In the case where the processing circuit 209 is a dedicated hardware, the processing circuit 209 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0580] ASIC is an abbreviation for Application Specific Integrated Circuit.

[0581] FPGA is an abbreviation for Field Programmable Gate Array.

[0582] The master key device 200 can also have a plurality of processing circuits instead of the processing circuit 209. The plurality of processing circuits share the functions of the processing circuit 209.

[0583] In the processing circuit 209, a part of the functions can be realized by a dedicated hardware and the remaining functions can be realized by software or firmware.

[0584] Thus, the functions of the master key device 200 can be implemented by hardware, software, firmware, or a combination thereof.

[0585] Based on Figure 22 The hardware structure of the registration key device 300 will be described.

[0586] The registration key device 300 has a processing circuit 309.

[0587] The processing circuit 309 is hardware that implements the reception unit 310, the generation unit 320, and the output unit 330.

[0588] The processing circuit 309 can be a dedicated hardware or a processor 301 that executes a program stored in a memory 302.

[0589] In the case where the processing circuit 309 is a dedicated hardware, the processing circuit 309 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0590] The registration key device 300 can also have a plurality of processing circuits instead of the processing circuit 309. The plurality of processing circuits share the functions of the processing circuit 309.

[0591] In the processing circuit 309, a part of the functions can be implemented by a dedicated hardware and the remaining functions can be implemented by software or firmware.

[0592] Thus, the functions of the registration key device 300 can be implemented by hardware, software, firmware, or a combination thereof.

[0593] Based on Figure 23 The hardware structure of the user key device 400 will be described.

[0594] The user key device 400 has a processing circuit 409.

[0595] The processing circuit 409 is hardware that implements the reception unit 410, the generation unit 420, and the output unit 430.

[0596] The processing circuit 409 can be a dedicated hardware or a processor 401 that executes a program stored in a memory 402.

[0597] In the case where the processing circuit 409 is a dedicated hardware, the processing circuit 409 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0598] The user key device 400 can also have a plurality of processing circuits instead of the processing circuit 409. The plurality of processing circuits share the functions of the processing circuit 409.

[0599] In the processing circuit 409, a part of the functions can be implemented by a dedicated hardware, and the remaining functions can be implemented by software or firmware.

[0600] In this way, the functions of the user key device 400 can be implemented by hardware, software, firmware, or a combination thereof.

[0601] Based on Figure 24 The hardware structure of the registration device 500 will be described.

[0602] The registration device 500 has a processing circuit 509.

[0603] The processing circuit 509 is hardware that implements the reception unit 510, the generation unit 520, and the registration unit 530.

[0604] The processing circuit 509 can be a dedicated hardware, or a processor 501 that executes a program stored in a memory 502.

[0605] In the case where the processing circuit 509 is a dedicated hardware, the processing circuit 509 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0606] The registration device 500 can also have a plurality of processing circuits instead of the processing circuit 509. The plurality of processing circuits share the functions of the processing circuit 509.

[0607] In the processing circuit 509, a part of the functions can be implemented by a dedicated hardware, and the remaining functions can be implemented by software or firmware.

[0608] In this way, the functions of the registration device 500 can be implemented by hardware, software, firmware, or a combination thereof.

[0609] Based on Figure 25 The hardware structure of the search operation device 600 will be described.

[0610] The search operation device 600 has a processing circuit 609.

[0611] The processing circuit 609 is hardware that implements the reception unit 610, the generation unit 620, the request unit 630, the decryption unit 640, and the output unit 650.

[0612] The processing circuit 609 can be a dedicated hardware, or a processor 601 that executes a program stored in a memory 602.

[0613] In a case where the processing circuit 609 is a dedicated hardware, the processing circuit 609 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0614] The search operation apparatus 600 can also have a plurality of processing circuits instead of the processing circuit 609. The plurality of processing circuits share the functions of the processing circuit 609.

[0615] In the processing circuit 609, a part of the functions can also be implemented by a dedicated hardware, and the remaining functions can be implemented by software or firmware.

[0616] In this way, the functions of the search operation apparatus 600 can be implemented by hardware, software, firmware, or a combination thereof.

[0617] Based on the above, the search operation apparatus 600 can be configured to function as a search operation device. Figure 26 The hardware structure of the data management apparatus 700 will be described.

[0618] The data management apparatus 700 has a processing circuit 709.

[0619] The processing circuit 709 is a hardware that implements the reception unit 710, the search unit 720, the output unit 730, and the management unit 740.

[0620] The processing circuit 709 can be a dedicated hardware, or can be a processor 701 that executes a program stored in a memory 702.

[0621] In a case where the processing circuit 709 is a dedicated hardware, the processing circuit 709 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0622] The data management apparatus 700 can also have a plurality of processing circuits instead of the processing circuit 709. The plurality of processing circuits share the functions of the processing circuit 709.

[0623] In the processing circuit 709, a part of the functions can also be implemented by a dedicated hardware, and the remaining functions can be implemented by software or firmware.

[0624] In this way, the functions of the data management apparatus 700 can be implemented by hardware, software, firmware, or a combination thereof.

[0625] Embodiment 1 is an example of a preferred mode, and is not intended to limit the technical scope of the present disclosure. Embodiment 1 can be partially implemented, or can be implemented in combination with other modes. The steps described using flowcharts and the like can also be appropriately changed.

[0626] The "unit" of each element of the apparatus described in Embodiment 1 can also be replaced with "processing" or "step".

[0627] Reference Signs List

[0628] 100 hidden search system, 101 network, 200 master key device, 201 processor, 202 memory, 203 auxiliary storage device, 204 input / output interface, 205 communication device, 209 processing circuit, 210 reception unit, 220 generation unit, 230 output unit, 290 storage unit, 300 registration key device, 301 processor, 302 memory, 303 auxiliary storage device, 304 input / output interface, 305 communication device, 309 processing circuit, 310 reception unit, 320 generation unit, 330 output unit, 390 storage unit, 400 user key device, 401 processor, 402 memory, 403 auxiliary storage device, 404 input / output interface, 405 communication device, 409 processing circuit, 410 reception unit, 420 generation unit, 421 aggregation information generation unit, 422 user key generation unit, 430 output unit, 490 storage unit, 500 registration device, 501 processor, 502 memory, 503 auxiliary storage device, 504 input / output interface, 505 communication device, 509 processing circuit, 510 reception unit, 520 generation unit, 521 random number generation unit, 522 aggregation information generation unit, 523 generalization information generation unit, 524 ciphertext data generation unit, 525 key generation unit, 526 encrypted tag generation unit, 530 registration unit, 590 storage unit, 600 search operation device, 601 processor, 602 memory, 603 auxiliary storage device, 604 input / output interface, 605 communication device, 609 processing circuit, 610 reception unit, 620 generation unit, 621 aggregation flag generation unit, 622 position information generation unit, 623 search query generation unit, 630 request unit, 640 decryption unit, 641 aggregation flag generation unit, 642 position information generation unit, 643 search result decryption unit, 650 output unit, 690 storage unit, 700 data management device, 701 processor, 702 memory, 703 auxiliary storage device, 704 input / output interface, 705 communication device, 709 processing circuit, 710 reception unit, 720 search unit, 721 collation unit, 722 extraction unit, 730 output unit, 740 management unit, 790 storage unit, 791 registration database.

Claims

1. A registration apparatus comprising: an accepting unit that accepts a plaintext, attribute information that shows a plurality of attribute values that identify a plurality of attributes of a user having a right to refer to the plaintext, and a registration key that is the same as a key used when a user key for generating a search query is generated; a collection information generating unit that generates collection information that shows one or more collection values each of which is composed of one or more attribute values, by collecting the plurality of attribute values included in the attribute information; a generalization information generating unit that generates, for each of the collection values included in the collection information, a plurality of generalized values composed of one or more wildcards that replace zero or more attribute values in the collection value and the remaining attribute values in the collection value, and generates generalization information that shows the plurality of generalized values generated for each of the collection values included in the collection information; a ciphertext data generating unit that generates ciphertext data that includes the plaintext after encryption, using the plaintext, the attribute information, the generalization information, and the registration key; an encryption tag generating unit that generates an encryption tag that includes the keyword related to the plaintext after encryption, using the keyword related to the plaintext, the attribute information, the generalization information, and the registration key; and a registration unit that registers a group of the ciphertext data and the encryption tag in a database.

2. A search operation apparatus comprising: an accepting unit that accepts a search keyword and a user key; and a generating unit that generates a search query using a user tag key included in the search keyword and the user key, the user tag key having a plurality of flag values based on a plurality of attribute values that identify a plurality of attributes of a user and one or more tag attribute keys based on one or more first collection values each of which is generated by collecting the plurality of attribute values, the generating unit generating a collection flag for search that shows one or more second collection values each of which is composed of one or more flag values, by collecting the plurality of flag values included in the user tag key, the generating unit generating search position information that determines one or more attribute elements of a plurality of attribute elements included in an encryption tag registered in a database together with ciphertext data, which are used at the time of search, using the collection flag for search, and the generating unit generating the search query using the search keyword, the one or more tag attribute keys included in the user tag key, and the search position information.

3. The search operation apparatus according to claim 2, wherein the search operation apparatus comprises: a requesting unit that transmits the search query and receives an encrypted search result that includes ciphertext data that coincides with the search query; and a decrypting unit that decrypts a plaintext from the ciphertext data included in the encrypted search result using a user data key included in the user key. ​ The user data key has a plurality of flag values based on the plurality of attribute values, and one or more data attribute keys based on one or more first aggregate values each generated by aggregating the plurality of attribute values, The decryption section generates an aggregate flag for decryption by aggregating the plurality of flag values included in the user data key, the aggregate flag for decryption showing one or more second aggregate values each composed of one or more flag values, The decryption section generates decryption position information using the aggregate flag for decryption, the decryption position information specifying one or more attribute elements of a plurality of attribute elements included in the ciphertext data in the encrypted search result to be used at the time of decryption, The decryption section decrypts the plaintext from the ciphertext data included in the encrypted search result using the one or more data attribute keys included in the user data key and the decryption position information.

4. A data management apparatus that manages a database in which a plurality of groups of encrypted tags of a plurality of attribute elements of ciphertext data and users having authority to refer to plaintext are registered, wherein The data management apparatus includes: a reception section that receives a search query having an encrypted keyword and search position information; a comparison section that compares the search query with each encrypted tag; and an output section that transmits an encrypted search result including ciphertext data corresponding to an encrypted tag identical to the search query, the search position information is information that specifies one or more attribute elements of a plurality of attribute elements included in each encrypted tag to be used at the time of search, the comparison section selects one or more attribute elements determined by the search position information from each encrypted tag, and compares the search query with each encrypted tag using the one or more attribute elements selected from each encrypted tag and the encrypted keyword included in the search query.

5. A computer-readable recording medium that records a registration program for causing a computer to execute the following processes: a reception process that receives plaintext, attribute information showing a plurality of attribute values that identify a plurality of attributes of a user having authority to refer to the plaintext, and a registration key identical to a key used when generating a user key for generating a search query; an aggregate information generation process that generates aggregate information showing one or more aggregate values each composed of one or more attribute values by aggregating the plurality of attribute values included in the attribute information; a generalization information generation process that generates, for each aggregate value included in the aggregate information, a plurality of generalization values composed of zero or more wildcards that replace zero or more attribute values in the aggregate value and the remaining attribute values in the aggregate value, and generates generalization information showing the plurality of generalization values generated for each aggregate value included in the aggregate information; a ciphertext data generation process of generating ciphertext data including the encrypted plaintext using the plaintext, the attribute information, the generalization information, and the registration key; an encryption tag generation process of generating an encryption tag including an encrypted keyword related to the plaintext using the keyword, the attribute information, the generalization information, and the registration key; and a registration process of registering a group of the ciphertext data and the encryption tag in a database.

6. A computer-readable recording medium recording a search operation program for causing a computer to execute the following processes: a reception process of receiving a search keyword and a user key; and a generation process of generating a search query using a user tag key included in the search keyword and the user key, wherein the user tag key has a plurality of flag values based on a plurality of attribute values identifying a plurality of attributes of a user and one or more tag attribute keys based on one or more first aggregation values each generated by aggregating the plurality of attribute values, in the generation process, an aggregation flag for search is generated by aggregating the plurality of flag values included in the user tag key, the aggregation flag for search indicating one or more second aggregation values each composed of one or more flag values, a search position information is generated using the aggregation flag for search, the search position information specifying one or more attribute elements of a plurality of attribute elements included in an encryption tag registered in a database together with ciphertext data to be used at the time of search, the search query is generated using the search keyword, the one or more tag attribute keys included in the user tag key, and the search position information.

7. The recording medium according to claim 6, the search operation program for causing a computer to execute the following processes: a request process of transmitting the search query and receiving an encrypted search result including ciphertext data coinciding with the search query; and a decryption process of decrypting plaintext from the ciphertext data included in the encrypted search result using a user data key included in the user key, wherein the user data key has a plurality of flag values based on the plurality of attribute values and one or more data attribute keys based on one or more first aggregation values each generated by aggregating the plurality of attribute values, in the decryption process, an aggregation flag for decryption is generated by aggregating the plurality of flag values included in the user data key, the aggregation flag for decryption indicating one or more second aggregation values each composed of one or more flag values, a decryption position information is generated using the aggregation flag for decryption, the decryption position information specifying one or more attribute elements of a plurality of attribute elements included in the ciphertext data to be used at the time of decryption, ​ ​ ​ ​ The plaintext is decrypted from the ciphertext data included in the encrypted search result using the one or more data attribute keys included in the user data key and the decryption location information.

8. A computer-readable recording medium recording a data management program for managing a database in which a plurality of groups of encrypted tags in which ciphertext data and a plurality of attribute elements of a user having a right to refer to plaintext are registered are registered, the data management program causing a computer to execute the following processes: a reception process of receiving a search query including an encrypted keyword and search location information; a collation process of collating the search query with each encrypted tag; and an output process of transmitting an encrypted search result including ciphertext data corresponding to an encrypted tag coinciding with the search query, wherein the search location information is information for specifying one or more attribute elements of a plurality of attribute elements included in each encrypted tag to be used at the time of search, in the collation process, one or more attribute elements specified by the search location information are selected from each encrypted tag, and the search query is collated with each encrypted tag using the one or more attribute elements selected from each encrypted tag and the encrypted keyword included in the search query.

Images