Encryption system, encryption data conversion device, and conversion method

Abstract

A repetition elimination system (100) has an encryption device (400), a conversion key generation device (500), a tag conversion device (600), and a coincidence determination device (700). The encryption device (400) generates an encrypted tag (ETag) using an encryption key (ek) and a plaintext (M). The conversion key generation device (500) generates a conversion key (ck) using the encryption key (ek) and a conversion key generation key (tk). The tag conversion device (600) converts the encrypted tag (ETag) using the same plaintext (M) into an encrypted tag (T) that is the same value regardless of the value of the encryption key (ek) used in the encrypted tag (ETag) by applying the conversion key (ck) to the encrypted tag (ETag). The coincidence determination device (700) determines whether the values of two encrypted tags (T) coincide with each other.

Description

Technical Field

[0001] This invention relates to a duplicate exclusion technique for excluding one encrypted data when two encrypted data are repeated. Background Technology

[0002] An encryption system that can exclude duplicate encrypted data does not decrypt the encrypted data, and can determine whether the encrypted plaintext is consistent with each other (e.g., Patent Document 1 and Non-Patent Document 1).

[0003] The core idea of ​​the deduplicative encryption commonly used in Patent Document 1 and Non-Patent Document 1 is to convert plaintext into a fixed-length bit string using a hash function, and then use this bit string as the encryption key to perform encryption. Thus, if the plaintext is the same, the encryption keys generated from the same plaintext become identical keys; and if a deterministic encryption such as AES (Advanced Encryption Standard) is used, the same plaintext becomes ciphertext with the same value.

[0004] On the other hand, even if the plaintext differs by only 1 bit, completely different keys are generated, resulting in different ciphertext values. With such a system, users can utilize encryption that eliminates duplicates in the ciphertext without possessing the key.

[0005] In such encryption that excludes duplicates, the known ciphertext is not unrecognizable, which is a standard of security in encryption.

[0006] Furthermore, since there is no key for each user, it is impossible to distinguish the ciphertext of each user. Therefore, in encryption that does not have the aforementioned unidentifiable nature and is like the prior art, there is a risk of the plaintext information of one's own ciphertext being leaked from other users.

[0007] Existing technical documents

[0008] Patent documents

[0009] Patent Document 1: Japanese Patent Publication No. 2014-507841

[0010] Non-patent literature

[0011] Non-Patent Literature 1: Mihir Bellare, Sriram Keelveedhi, Thomas Ristenpart: “Message-Locked Encryption and Secure Deduplication”. EUROCRYPT 2013: 296-312 Summary of the Invention

[0012] The problem that the invention aims to solve

[0013] The purpose of this invention is to provide an encryption system capable of implementing the following (1)(2)(3).

[0014] (1) It can set an encryption key for each user.

[0015] (2) When the user generates the ciphertext with the encryption key, the possibility of duplicates cannot be ruled out. However, the ciphertext satisfies the requirement of being unrecognizable.

[0016] (3) With user permission, it is possible to convert ciphertext generated with the encryption key into ciphertext that excludes duplicates.

[0017] Methods for solving problems

[0018] The encryption system of the present invention comprises: an encryption unit that generates first encrypted data by encrypting the plaintext using a first key and plaintext; a third key generation unit that generates a third key using the first key and a second key; and an encrypted data conversion unit that converts the first encrypted data, which uses the same plaintext, into second encrypted data that has the same value as the first key used in the first encrypted data by applying the third key to the first encrypted data.

[0019] Invention Effects

[0020] According to the encryption system of the present invention, an encryption system capable of implementing the following (1)(2)(3) can be provided.

[0021] (1) It can set an encryption key for each user.

[0022] (2) When the user generates the ciphertext with the encryption key, the possibility of duplicates cannot be ruled out. However, the ciphertext satisfies the requirement of being unrecognizable.

[0023] (3) With user permission, it is possible to convert ciphertext generated with the encryption key into ciphertext that excludes duplicates. Attached Figure Description

[0024] Figure 1 This is a diagram of Embodiment 1, which is a block diagram showing the structure of the repeat-exclusion system 100.

[0025] Figure 2 This is a diagram of Embodiment 1, and a block diagram showing the structure of the common parameter generation device 200.

[0026] Figure 3 This is a diagram of Embodiment 1, which is a block diagram showing the structure of the user key generation device 300.

[0027] Figure 4This is a diagram of Embodiment 1, a block diagram showing the structure of the encryption device 400.

[0028] Figure 5 This is a diagram of Embodiment 1, which is a block diagram showing the structure of the conversion key generation device 500.

[0029] Figure 6 This is a diagram of Embodiment 1, which is a block diagram showing the structure of the tag switching device 600.

[0030] Figure 7 This is a diagram of Embodiment 1, and is a block diagram showing the structure of the consistency determination device 700.

[0031] Figure 8 This is a diagram of Embodiment 1, and a flowchart illustrating the operation of the common parameter generation device 200.

[0032] Figure 9 This is a diagram of Embodiment 1, and a flowchart illustrating the operation of the user key generation device 300.

[0033] Figure 10 This is a diagram of Embodiment 1, and a flowchart illustrating the operation of the encryption device 400.

[0034] Figure 11 This is a diagram of Embodiment 1, and a flowchart illustrating the operation of the conversion key generation device 500.

[0035] Figure 12 This is a diagram of Embodiment 1, and a flowchart illustrating the operation of the tag switching device 600.

[0036] Figure 13 This is a diagram of Embodiment 1, and a flowchart illustrating the operation of the consistency determination device 700.

[0037] Figure 14 This is a diagram of Implementation Method 1, illustrating the operation of the repeating exclusion system 100.

[0038] Figure 15 This is a diagram of Embodiment 2, and a flowchart illustrating the operation of the common parameter generation device 200.

[0039] Figure 16 This is a diagram of Embodiment 2, and a flowchart illustrating the operation of the user key generation device 300.

[0040] Figure 17 This is a diagram of Embodiment 2, and a flowchart illustrating the operation of the encryption device 400.

[0041] Figure 18 This is a diagram of Embodiment 2, and a flowchart illustrating the operation of the conversion key generation device 500.

[0042] Figure 19 This is a diagram of Embodiment 2, and a flowchart illustrating the operation of the tag switching device 600.

[0043] Figure 20 This is a diagram of Embodiment 2, and a flowchart illustrating the operation of the consistency determination device 700.

[0044] Figure 21 This is a diagram of implementation method 2, which illustrates the operation of the repeating exclusion system 100.

[0045] Figure 22 This is a diagram of Embodiment 2, which shows the hardware resources of each device in the repeat exclusion system 100.

[0046] Figure 23 This is a diagram of Implementation Method 2, which is a diagram of the hardware resources of each device in the supplementary duplicate exclusion system 100. Detailed Implementation

[0047] The embodiments will now be described using the accompanying drawings. Furthermore, in each drawing, the same or equivalent parts are labeled with the same reference numerals. In the description of the embodiments, descriptions of the same or equivalent parts are appropriately omitted or simplified.

[0048] Implementation Method 1

[0049] The duplicate exclusion system 100 of Implementation Method 1 will be described. The duplicate exclusion system 100 is an encryption system that excludes duplicate ciphertext.

[0050] Figure 1 This represents the system structure of the duplicate exclusion system 100.

[0051] like Figure 1 As shown, the duplicate exclusion system 100 includes a common parameter generation device 200, multiple user key generation devices 300, multiple encryption devices 400, a conversion key generation device 500, a tag conversion device 600, and a consistency determination device 700. The tag conversion device 600 converts an encrypted tag ETag into an encrypted tag T. The encrypted tag ETag is the first encrypted data, and the encrypted tag T is the second encrypted data. The encryption device 400 corresponds to the encryption unit, the conversion key generation device 500 corresponds to the third key generation unit, the tag conversion device 600 corresponds to the encrypted data conversion unit, and the consistency determination device 700 corresponds to the consistency determination unit.

[0052] The public parameter generation device 200, the multiple user key generation device 300, the multiple encryption devices 400, the conversion key generation device 500, the tag conversion device 600, and the consistency determination device 700 are all computers.

[0053] In the duplicate exclusion system 100, the common parameter generation device 200, multiple user key generation devices 300, multiple encryption devices 400, conversion key generation device 500, tag conversion device 600, and consistency determination device 700 are connected to the network 101. The network 101 can be the Internet or a LAN (Local Area Network) laid out within an enterprise.

[0054] Network 101 is a communication path connecting the public parameter generation device 200, multiple user key generation devices 300, multiple encryption devices 400, conversion key generation device 500, tag conversion device 600, and consistency determination device 700.

[0055] The public parameter generation device 200 generates public parameters used in the duplicate rejection system 100 and sends these public parameters via network 101 to multiple user key generation devices 300, multiple encryption devices 400, conversion key generation device 500, and tag conversion device 600. Alternatively, these public parameters can be sent directly to relevant personnel of the duplicate rejection system 100 via mail, without using network 101.

[0056] User key generation device 300 generates a user key and sends it to encryption device 400 and conversion key generation device 500. Encryption device 400 takes plaintext M and the user key sent from user key generation device 300 as input to generate an encrypted tag ETag and sends ETag to tag conversion device 600. Conversion key generation device 500 receives the user key from user key generation device 300 and generates a conversion key ck based on the user key. Tag conversion device 600 receives the conversion key ck from conversion key generation device 500 and receives the encrypted tag ETag from encryption device 400. Tag conversion device 600 uses conversion key ck to convert the encrypted tag ETag, which is the first encrypted data, into a duplicate-excluded encrypted tag T, which is the second encrypted data. Tag conversion device 600 sends the encrypted tag T to consistency determination device 700. Consistency determination device 700 receives multiple encrypted tags T from tag conversion device 600, determines whether the encrypted tags T are consistent with each other, and outputs the determination result.

[0057] Furthermore, any two, three, or four of the user key generation device 300, encryption device 400, conversion key generation device 500, and tag conversion device 600 can be implemented by a single computer.

[0058] Figure 2This is a block diagram showing the structure of the common parameter generation device 200. The common parameter generation device 200 includes an input unit 201, a common parameter generation unit 202, and a transmission unit 203. Although not shown, the common parameter generation device 200 has a recording medium storing data used by each unit of the common parameter generation device 200. The bit length k of the key used in the duplicate exclusion system 100 is input to the input unit 201. The common parameter generation unit 202 generates common parameters that form the basis of the operations performed by the duplicate exclusion system 100. Although not shown, the common parameter generation unit 202 may also have a random number generation function to generate the common parameters. The transmission unit 203 sends the common parameters generated by the common parameter generation unit 202 to multiple user key generation devices 300.

[0059] Figure 3 This is a block diagram showing the structure of a user key generation device 300. The user key generation device 300 includes a parameter receiving unit 301, a key generation unit 302, and a key sending unit 303. Although not shown, the user key generation device 300 has a recording medium storing data used by each unit of the user key generation device 300. The parameter receiving unit 301 receives common parameters. The key generation unit 302 generates an encryption key ek and a conversion key generation key tk. Although not shown, the key generation unit 302 may also have a random number generation function to generate these keys. The key sending unit 303 sends the encryption key ek to an encryption device 400 and sends the encryption key ek and the conversion key generation key tk to a conversion key generation device 500.

[0060] Figure 4 This is a block diagram representing the structure of the encryption device 400. For example... Figure 4 As shown, the encryption device 400 includes an input unit 401, a receiving unit 402, a tag generation unit 403, and a tag sending unit 404. Although not shown, the encryption device 400 has a recording medium storing data used by each part of the encryption device 400. Plaintext M is input to the input unit 401. The receiving unit 402 receives the encryption key ek. The tag generation unit 403 generates an encrypted tag ETag. Although not shown, the tag generation unit 403 may also have a random number generation function to generate the encrypted tag ETag. The tag sending unit 404 sends the encrypted tag ETag generated by the tag generation unit 403 to the tag conversion device 600.

[0061] Figure 5This is a block diagram showing the structure of the conversion key generation apparatus 500. The conversion key generation apparatus 500 includes a key receiving unit 501, a conversion key generation unit 502, and a transmitting unit 503. Although not shown, the conversion key generation apparatus 500 has a recording medium storing data used by each unit of the conversion key generation apparatus 500. The key receiving unit 501 receives an encryption key ek and a conversion key generation key tk. The conversion key generation unit 502 generates a conversion key ck based on the encryption key ek and the conversion key generation key tk. Although not shown, the conversion key generation unit 502 may also have a random number generation function to generate the conversion key ck. The transmitting unit 503 sends the conversion key ck to the tag conversion device 600.

[0062] Figure 6 This is a block diagram showing the structure of the tag conversion device 600. The tag conversion device 600 is an encrypted data conversion device.

[0063] The tag conversion device 600 includes a receiving unit 601, an input unit 602, a key storage unit 603, a conversion unit 604, and a transmitting unit 605. Although not shown, the tag conversion device 600 includes a recording medium for storing data used by each part of the tag conversion device 600.

[0064] The receiving unit 601 receives the conversion key ck. The input unit 602 receives the encrypted tag ETag. The key storage unit 603 stores the conversion key ck. The conversion unit 604 uses the conversion key ck stored in the key storage unit 603 to convert the encrypted tag ETag input by the input unit 602 into a duplicate-free encrypted tag T. Although not shown, the conversion unit 604 may also have a random number generation function in order to convert the encrypted tag ETag into the encrypted tag T. The sending unit 605 sends the encrypted tag T, which is the duplicate-free encrypted data, to the consistency determination device 700.

[0065] Figure 7 This is a block diagram showing the structure of the consistency determination device 700. The consistency determination device 700 includes a tag input unit 701, a determination unit 702, and a result transmission unit 703. Although not shown, the consistency determination device 700 has a recording medium storing data used by each part of the consistency determination device 700. An encrypted tag T1 and an encrypted tag T2 (with duplicates excluded) are input to the tag input unit 701. The determination unit 702 determines whether the values ​​of encrypted tag T1 and encrypted tag T2 are consistent. The result transmission unit 703 outputs the consistency determination result.

[0066] The operation of each device in the repeat rejection system 100 will be explained below.

[0067] Figure 8 This is a flowchart illustrating the operation of the common parameter generation device 200.

[0068] Figure 9 This is a flowchart illustrating the operation of the user key generation device 300.

[0069] Figure 10 This is a flowchart illustrating the operation of the encryption device 400. The encryption device 400 uses the encryption key ek and the plaintext M to generate an encrypted tag ETag obtained by encrypting the plaintext M.

[0070] Figure 11 This is a flowchart illustrating the operation of the conversion key generation device 500. The conversion key generation device 500 uses the encryption key ek and the conversion key generation key tk to generate the conversion key ck.

[0071] Figure 12 This is a flowchart illustrating the operation of the tag conversion device 600. The tag conversion device 600 converts an encrypted tag ETag using the same plaintext M into an encrypted tag T with the same value as the encryption key ek used in the encrypted tag ETag by applying the conversion key ck to the encrypted tag ETag.

[0072] Figure 13 This is a flowchart illustrating the operation of the consistency determination device 700. The consistency determination device 700 determines whether the values ​​of the two second encrypted data T are consistent with each other.

[0073] Figure 14 It is Figures 8-13 The flowchart is a diagram representing a sequence.

[0074] Reference Figure 14 The operation of each device in the repeated exclusion system 100 will be explained.

[0075] Figure 14 The operation of the duplicate-exclusion system 100 shown is summarized as follows: Encryption device 400 calculates the XOR of encryption key ek with plaintext M to obtain encryption tag ETag. Conversion key generation device 500 calculates the XOR of encryption key ek with conversion key generation key tk to generate conversion key ck. Tag conversion device 600 applies conversion key ck to encryption tag ETag, which is the first encrypted data, to convert encryption tag ETag into encryption tag T, which is the second encrypted data.

[0076] <Common parameter generation device 200>

[0077] In step S201, bit length k is input to input unit 201.

[0078] In step S202, the common parameter generation unit 202 generates a k-bit random value sk as a common parameter.

[0079] In step S203, the transmitting unit 203 sends the bit length k and common parameter sk to the user key generation device 300.

[0080] <User Key Generation Device 300>

[0081] In step S301, the parameter receiving unit 301 receives the bit length k and the common parameter sk from the common parameter generating device 200.

[0082] In step S302, the key generation unit 302 generates a k-bit random value skA as the encryption key ek. Additionally, the key generation unit 302 sets a conversion key generation key tk as the encryption key sk.

[0083] In step S303, the key sending unit 303 sends the encryption key ek to the encryption device 400, and sends the encryption key ek and the conversion key generation key tk to the conversion key generation device 500.

[0084] <Encryption Device 400>

[0085] In step S401, plaintext M is input into the input unit 401.

[0086] In step S402, the receiving unit 402 receives the encryption key ek from the user key generation device 300.

[0087] In step S403, the label generation unit 403 calculates...

[0088] ETag = Hash(M) <xor>skA (Equation 1).

[0089] Here, Hash refers to a cryptographic hash function, such as SHA256. <xor>It represents XOR.

[0090] In step S404, the tag sending unit 404 sends the encrypted tag ETag to the tag conversion device 600.

[0091] <Conversion Key Generation Device 500>

[0092] In step S501, the key receiving unit 501 receives the encryption key ek and the conversion key generation key tk from the user key generation device 300.

[0093] In step S502, the conversion key generation unit 502 calculates...

[0094] ck = ek <xor>tk=skA <xor>sk (Equation 2).

[0095] In step S503, the sending unit 503 sends the conversion key ck to the tag conversion device 600.

[0096] <Label conversion device 600>

[0097] In step S601, the receiving unit 601, which is the third key acquisition unit, acquires the conversion key ck, which is the third key generated using the encryption key ek and the conversion key generation key tk, which is the second key.

[0098] In step S602, the input unit 602, which is the acquisition unit, uses the encryption key ek, which is the first key, and the plaintext M to acquire the encryption tag ETag, which is the first encrypted data obtained by encrypting the plaintext M.

[0099] In step S603, the conversion unit 604 converts the encrypted tag ETag, which uses the same plaintext M, into a second encrypted data, namely the encrypted tag T, which has the same value as the encryption key ek used in the encrypted tag ETag but is unrelated to the value of the encryption key ek used in the encrypted tag ETag. Specifically, as follows.

[0100] In the duplicate exclusion system 100 of Implementation Method 1, the conversion key generation key tk = Sk set in step S302 is the same key for different users. Therefore, according to the following (Equation 3), the encrypted tag ETag using the same plaintext M is converted into an encrypted tag T with the same value, independent of the value of the encryption key ek used in the encrypted tag ETag. Calculation

[0101] T = ck <xor>ETag

[0102] ={I <xor>tk} <xor>{Hash(M) <xor>ek}

[0103] =tk <xor>Hash(M) (Formula 3).

[0104] In step S604, the sending unit 605, which is the sending control unit, sends the encryption tag T to the consistency determination device 700, which determines whether the values ​​of the two encryption tags T are consistent.

[0105] In step S701, two encryption tags T1 and T2 are input into the tag input unit 701.

[0106] In step S702, the determination unit 702 verifies whether the bit strings of encrypted tag T1 and encrypted tag T2 are equal. If the determination unit 702 determines that the bit strings of encrypted tag T1 and encrypted tag T2 are equal, the result sending unit 703 outputs 1 in step S703; if the determination unit determines that the bit strings of encrypted tag T1 and encrypted tag T2 are different, the result sending unit 703 outputs 0 in step S704.

[0107] ***Effects of Implementation Method 1***

[0108] In implementation 1, by using the conversion key ck, it is possible to convert the encrypted tag ETag generated using the encryption key ek, which is different for each individual, into an encrypted tag T.

[0109] While the encrypted tag ETag cannot eliminate duplicates, it possesses the security of a de facto standard for encryption. Furthermore, the encrypted tag T, converted from the encrypted tag ETag, can eliminate duplicates. Therefore, according to Embodiment 1, a highly secure encryption system can be provided without sacrificing the convenience of eliminating duplicates.

[0110] Implementation Method 2

[0111] Reference Figures 15-23 The repetition-exclusion system 100 of Embodiment 2 will be described. In Embodiment 1, in step S403, an encrypted tag ETag is generated by XORing the hash value of plaintext M with the encryption key ek. In Embodiment 2, the encrypted tag ETag is generated using a pairwise operation.

[0112] Structure and Implementation Method 1 of Repeated Exclusion System 100 Figure 1 The same. Furthermore, the structure of the public parameter generation device 200, user key generation device 300, encryption device 400, conversion key generation device 500, tag conversion device 600, and consistency determination device 700 is the same as in embodiment 1. Figures 2-7 same.

[0113] Figure 15 This is a flowchart illustrating the operation of the common parameter generation device 200.

[0114] Figure 16 This is a flowchart illustrating the operation of the user key generation device 300.

[0115] Figure 17 This is a flowchart illustrating the operation of the encryption device 400.

[0116] Figure 18 This is a flowchart illustrating the operation of the conversion key generation device 500.

[0117] Figure 19 This is a flowchart illustrating the operation of the label switching device 600.

[0118] Figure 20 This is a flowchart illustrating the operation of the consistency determination device 700.

[0119] Figure 21 It is Figures 15-20 The flowchart is a diagram representing a sequence.

[0120] Reference Figure 21 The operation of each device in the repeat rejection system 100 will be explained.

[0121] <Common parameter generation device 200>

[0122] In step S801, bit length k is input to input unit 201.

[0123] In step S802, the common parameter generation unit 202 generates elements capable of performing pairing operations based on the bit length k.

[0124] BG = (p, G, G) T ,e)(Formula 4).

[0125] Here, p represents group G and group G'. T The number of digits.

[0126] e is a property of G×G→G T A bilinear mapping of .

[0127] A bilinear mapping is a mapping that is valid for all g∈G and a, b∈Z. p ,

[0128] e(g a g b ) = e(g, g) ab ∈G T (Equation 5)

[0129] The mapping of . Operations that use 'e' are called pairing operations.

[0130] In addition, Z p It is the set of integers whose modulo is p.

[0131] Randomly select g∈G.

[0132] In step S803, the transmitting unit 203 sends the bit length k, g and element BG to the user key generation device 300.

[0133] <User Key Generation Device 300>

[0134] In step S901, the parameter receiving unit 301 receives bit lengths k, g, and BG from the common parameter generation device 200.

[0135] In step S902, the key generation unit 302 randomly selects x∈Z p Calculate y = g x .

[0136] In addition, the key generation unit 302 selects Y∈G.

[0137] Key generation unit 302 settings

[0138] Encryption key ek = (g, y, Y) (Equation 6)

[0139] as well as

[0140] The conversion key generates the key tk = x (Equation 7).

[0141] The encryption key ek, which serves as the first key, contains a first element, a second element, and a third element. In the encryption key ek, g is the first element, y is the second element, and y is the third element.

[0142] In step S903, the key sending unit 303 sends the encryption key ek to the encryption device 400 and the conversion key generation key tk to the conversion key generation device 500.

[0143] <Encryption Device 400>

[0144] In step S1001, plaintext M is input to the input unit 401.

[0145] In step S1002, the receiving unit 402 receives the encryption key ek from the user key generation device 300.

[0146] In step S1003, the label generation unit 403 calculates...

[0147] C1 = g r C2 = y r+Hash(g，M) (Equation 8)

[0148] Set ETag = (C1, C2)

[0149] =(g r y x{r+Hash(g，M)} (Equation 9)

[0150] And the encrypted tag ETag.

[0151] Here, Hash refers to a cryptographic hash function, such as SHA256.

[0152] In step S1004, the tag sending unit 404 sends the encrypted tag ETag to the tag conversion device 600.

[0153] As shown in Equation 9, the encryption device 400, which serves as the encryption unit, uses ETag to encrypt the plaintext M using the first element g and the second element y, thereby generating data obtained by encrypting the plaintext M.

[0154] <Conversion Key Generation Device 500>

[0155] In step S1101, the key receiving unit 501 receives the encryption key ek=(g,y,Y)=(g,g) from the user key generating device 300. x ,Y) and the conversion key to generate the key tk=x.

[0156] In step S1102, the conversion key generation unit 502 calculates...

[0157] ck'=Y 1 / x (Equation 10).

[0158] In step S1103, the transmitting unit 503 sends the conversion key ck = (ck', ek) to the tag conversion device 600.

[0159] As shown in Equation 10 and the formula for the conversion key ck, the conversion key generation device 500, which is the third key generation unit, applies the conversion key generation key tk, which is the second key, to the third element Y, and generates a set of the value ck' obtained by application and the encryption key ek, which is the first key, as the third key, i.e., the conversion key ck.

[0160] <Label conversion device 600>

[0161] In step S1201, the receiving unit 601 receives the conversion key ck=(ck',ek)==(Y) from the conversion key generation device 500. 1 / x g, g x Y).

[0162] In step S1202, the encrypted tag ETag = (C1, C2) = (g) is input to the input unit 602. r g x{r+Hash(g，M)} ).

[0163] In step S1203, the conversion unit 604 converts the encrypted tag ETag, which uses the same plaintext M, into a second encrypted data, namely the encrypted tag T, which has the same value as the encryption key ek used in the encrypted tag ETag but is unrelated to it. Specifically, as follows.

[0164] In the duplicate exclusion system 100 of Embodiment 2, the same value is set for different users regarding g selected in step S802 and Y selected in step S902. Therefore, according to the following (Equation 11), the encrypted tag ETag using the same plaintext M is converted into an encrypted tag T with the same value regardless of the value of the encryption key ek used in the encrypted tag ETag. The conversion unit 604 calculates...

[0165] T=e(C2, ck') / e(C1, Y) (Formula 11)=e(g x{r+Hash(g，M)} Y 1 / x ) / e(g r ,Y)=e(g,Y) x{r+Hash(g，M)}*1 / x / e(g, Y) r =e(g, Y) {r+Hash(g，M)} / e(g, Y) r =e(g, Y) Hash(g，M) .

[0166] e represents the pairing operation.

[0167] In step S1204, the sending unit 605 sends the encrypted tag T, which is converted from the encrypted tag ETag, to the consistency determination device 700.

[0168] <Conformity Determination Device 700>

[0169] In step S1301, two encryption tags T1 and T2 are input into the tag input unit 701.

[0170] In step S1302, the determination unit 702 verifies whether the bit strings of encrypted tag T1 and encrypted tag T2 are equal.

[0171] If the determination unit 702 determines in step S1302 that the bit strings of encrypted tag T1 and encrypted tag T2 are equal, the result sending unit 703 outputs 1 in step S1303. If the determination unit determines that the bit strings of encrypted tag T1 and encrypted tag T2 are different, the result sending unit 703 outputs 0 in step S1304.

[0172] ***Effects of Implementation Method 2***

[0173] According to Implementation Method 2, a public key encryption system can be configured as a highly secure encryption system without losing the convenience of eliminating duplicates.

[0174] Figure 22 This is a diagram showing the hardware structure of the common parameter generation device 200, the multiple user key generation device 300, the encryption device 400, the conversion key generation device 500, the tag conversion device 600, and the consistency determination device 700 in Embodiment 1 and Embodiment 2.

[0175] The public parameter generation device 200, the multiple user key generation device 300, the encryption device 400, the conversion key generation device 500, the tag conversion device 600, and the consistency determination device 700 are all computers. Figure 22 It is the hardware structure of the computer's common parameter generation device 200 to consistency determination device 700.

[0176] Since the hardware structures of the common parameter generation device 200 to the consistency determination device 700 are the same, the encryption device 400 will be used as an example for explanation.

[0177] exist Figure 22 In the encryption device 400, there is a CPU 1101 (Central Processing Unit).

[0178] CPU 1101 is connected to hardware devices such as ROM 1103, RAM 1104, communication board 1105, display 1111, keyboard 1112, mouse 1113, driver 1114, and disk device 1120 via bus 1102, and controls these hardware devices.

[0179] Drive 1114 is a device for reading and writing storage media such as FD (Flexible Disk Drive), CD (Compact Disc), and DVD (Digital Versatile Disc).

[0180] ROM1103, RAM1104, disk drive 1120 and drive 1114 are examples of storage devices.

[0181] Keyboard 1112, mouse 1113, and communication board 1105 are examples of input devices. Display 1111 and communication board 1105 are examples of output devices.

[0182] The communication board 1105 connects to communication networks such as LAN, Internet, and telephone lines via wired or wireless means.

[0183] The disk device 1120 stores an operating system 1121, a program group 1122, and a file group 1123.

[0184] In addition, Figure 22 In this context, operating system 1121 is referred to as OS1121.

[0185] Program group 1122 includes programs that perform the functions described as "~" in embodiments 1 and 2.

[0186] The program is read and executed by CPU1101.

[0187] That is, a program enables the computer to function as a "component," and also enables the computer to execute the "component" in a specific order or method.

[0188] File group 1123 contains various data such as input data, output data, determination results, calculation results, and processing results used in the "~part" described in embodiments 1 and 2.

[0189] In implementation methods 1 and 2, the arrows in the structure diagrams and flowcharts mainly represent the input and output of data and signals.

[0190] The processing described in Implementation Methods 1 and 2, based on flowcharts, is executed using hardware such as CPU 1101, storage device, input device, and output device.

[0191] In embodiments 1 and 2, the term "~component" can refer to "~circuit", "~device", or "~equipment". Alternatively, it can refer to "~step", "~sequence", or "~process". That is, the term "~component" can be installed by firmware, software, hardware, or any combination thereof.

[0192] <Supplement to Hardware Structure>

[0193] exist Figure 22 In the hardware structure shown, the functions of each device are implemented in software. However, the functions of each device can also be implemented in hardware.

[0194] and Figure 22 Similarly, the explanation will be based on encryption device 400.

[0195] Figure 23 This represents the structure in which the encryption device 400 is implemented in hardware. Figure 23 The electronic circuit 910 is a dedicated electronic circuit that implements the functions of the input unit 401, receiving unit 402, tag generation unit 403, and tag sending unit 404 of the encryption device 400. The electronic circuit 910 is connected to the signal line 911. Specifically, the electronic circuit 910 can be a single circuit, a composite circuit, a programmable processor, a parallel programmable processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array. The functions of the structural elements of the encryption device 400 can be implemented by a single electronic circuit or distributed across multiple electronic circuits. Alternatively, some functions of the structural elements of the encryption device 400 can be implemented by electronic circuits, while the remaining functions can be implemented by software.

[0196] CPU 1101 and electronic circuit 910 are also referred to as processing lines. In the encryption device 400, the functions of the input unit 401, receiving unit 402, tag generation unit 403, and tag sending unit 404 can also be implemented through the processing lines. Alternatively, Figures 2-7 The function of the "~" shown can also be achieved by processing the circuit.

[0197] Label Explanation

[0198] ck: Conversion key; ETag: Encryption tag; T: Encryption tag; ek: Encryption key; M: Plaintext; tk: Conversion key generation key; 100: Duplicate exclusion system; 101: Network; 200: Common parameter generation device; 201: Input unit; 202: Common parameter generation unit; 203: Transmission unit; 300: User key generation device; 301: Parameter receiving unit; 302: Key generation unit; 303: Key transmission unit; 400: Encryption device; 401: Input unit; 402: Receiver Receiver; 403: Tag generation unit; 404: Tag sending unit; 500: Conversion key generation device; 501: Key receiving unit; 502: Conversion key generation unit; 503: Sending unit; 600: Tag conversion device; 601: Receiving unit; 602: Input unit; 603: Key storage unit; 604: Conversion unit; 605: Sending unit; 700: Consistency determination device; 701: Tag input unit; 702: Determination unit; 703: Result sending unit; 910: Electronic circuit; 911: Signal line.< / xor> < / xor> < / xor> < / xor> < / xor> < / xor> < / xor> < / xor> < / xor>

Claims

1. An encryption system wherein, The encryption system has: an encryption section that generates first encrypted data obtained by encrypting a plaintext using any of a plurality of first keys and the plaintext, the first encrypted data being data having a value that is different even if the plaintext is the same as long as the value of the first key used in the encryption is different; a third key generation section that generates a third key by calculating an exclusive OR of the first key used in the encryption of the plaintext and a second key that is a random value of k bits; an encrypted data conversion section that converts the first encrypted data using the same plaintext into second encrypted data that is the same value regardless of the value of the first key used in the encryption of the first encrypted data by calculating an exclusive OR of the third key and the first encrypted data; and a coincidence determination section that determines whether the values of two of the second encrypted data coincide with each other.

2. An encryption system wherein, The encryption system has: an encryption section that generates first encrypted data obtained by encrypting a plaintext using any of a plurality of first keys containing a first element, a second element, and the plaintext, the first encrypted data being data having a value that is different even if the plaintext is the same as long as the value of the first key used in the encryption is different; The third key generation unit will be the set of integers Z belonging to mod=p. p The second key of element x is applied to the third element contained in the first key used in the encryption of the plaintext, generating a group of the value obtained by application and the first key used in the encryption of the plaintext, as the third key, where p is group G and group G T The number of bits, where group G and group G T For a bilinear mapping, the mapping G×G→G T The group in; an encrypted data conversion section that converts the first encrypted data using the same plaintext into second encrypted data that is the same value regardless of the value of the first key used in the encryption of the first encrypted data by applying the third key to the first encrypted data; and a coincidence determination section that determines whether the values of two of the second encrypted data coincide with each other.

3. An encryption data conversion apparatus, wherein, The encrypted data conversion apparatus has: an acquisition section that acquires first encrypted data obtained by encrypting a plaintext using any of a plurality of first keys and the plaintext, the first encrypted data being data having a value that is different even if the plaintext is the same as long as the value of the first key used in the encryption is different; a third key acquisition section that acquires a third key generated by calculating an exclusive OR of the first key used in the encryption of the plaintext and a second key that is a random value of k bits; a conversion section that converts the first encrypted data using the same plaintext into second encrypted data that is the same value regardless of the value of the first key used in the encryption of the first encrypted data by calculating an exclusive OR of the third key and the first encrypted data; and a transmission control section that transmits the second encrypted data to a coincidence determination apparatus that determines whether the values of two of the second encrypted data coincide with each other.

4. An encryption data conversion apparatus, wherein, The encrypted data conversion apparatus has: an acquisition unit that acquires first encrypted data obtained by encrypting a plaintext using the first element, the second element, and a first element included in any of a plurality of first keys including the first element, the second element, and the third element, the first encrypted data being data having a value that is different even if the plaintext is the same as long as a value of the first key used in the encryption is different; a third key acquisition section that acquires a third key that is generated as a group obtained by applying a second key that is an element x belonging to an integer set Z p of mod = p to a value obtained by applying the third element included in the first key used in the encryption of the plaintext to the second key, and a group of the first key used in the encryption of the plaintext, where p is the number of bits of a group G and a group G T , where the group G and the group G T are groups that a bilinear mapping has in a mapping G x G → G T ; a conversion unit that converts the first encrypted data using the same plaintext into second encrypted data that is the same value regardless of the value of the first key used in the encryption of the first encrypted data; and a transmission control unit that transmits the second encrypted data to a coincidence determination device that determines whether the values of two of the second encrypted data coincide with each other.

5. A conversion method wherein, In this conversion method, a computer executes the following steps: an acquisition step of calculating an exclusive OR using any of a plurality of first keys and a plaintext, thereby acquiring first encrypted data obtained by encrypting the plaintext, the first encrypted data being data having a value that is different even if the plaintext is the same as long as a value of the first key used in the encryption is different; a third key acquisition step of acquiring a third key generated by calculating an exclusive OR of the first key used in the encryption of the plaintext and a second key that is a random value of k bits; a conversion step of converting the first encrypted data using the same plaintext into second encrypted data that is the same value regardless of the value of the first key used in the encryption of the first encrypted data, by calculating an exclusive OR of the third key and the first encrypted data; and a transmission control step of transmitting the second encrypted data to a coincidence determination device that determines whether the values of two of the second encrypted data coincide with each other.

6. A conversion method wherein, In this conversion method, a computer executes the following steps: an acquisition step of acquiring first encrypted data obtained by encrypting a plaintext using the first element, the second element, and a first element included in any of a plurality of first keys including the first element, the second element, and the third element, the first encrypted data being data having a value that is different even if the plaintext is the same as long as a value of the first key used in the encryption is different; a third key obtaining step of obtaining a third key generated as a group obtained by applying the second key which is an element x belonging to an integer set Z p mod p to a value obtained by applying the third element included in the first key used in the encryption of the plaintext to the first key used in the encryption of the plaintext, where p is the number of bits of a group G and a group G T T is a bilinear map having a mapping G x G → G T in a group;​ a conversion step of converting the first encrypted data using the same plaintext into second encrypted data that is the same value regardless of the value of the first key used in the encryption of the first encrypted data; and a transmission control step of transmitting the second encrypted data to a coincidence determination device that determines whether the values of two of the second encrypted data coincide with each other.

Images