Re-encryption device, encryption system, re-encryption method and computer-readable storage medium

Abstract

The encryption device (30) generates a session key K generated by an encryption algorithm using attribute information S as input and a ciphertext ct obtained by encrypting the session key K. S The re-encryption key generating device (40) generates a re-encryption key rk, which contains the key to be able to encrypt the ciphertext ct S Decryption key sk Γ The converted decryption key sk is generated by setting the random number r Γ ～ , the session key K' and the ciphertext ct generated by the encryption algorithm using the attribute information S' as input S’ , and conversion information generated according to the random number r. The re-encryption device (50) generates the decryption key sk from the converted decryption key sk according to the conversion information. Γ ～ Ciphertext ct S The decrypted information K ^ obtained by decryption deletes the element related to the random number r, and outputs the encrypted element K including the set session key K'. ～ and ciphertext ct S’ The re-encrypted ciphertext rct S’ .

Description

Technical Field

[0001] The present invention relates to a proxy re-encryption (PRE) technology in functional encryption or attribute-based encryption capable of setting an access range. Background Art

[0002] PRE is a system that does not decrypt ciphertext but delegates the decryption authority of ciphertext to others.

[0003] Non-Patent Document 1 describes the Attribute-Based PRE (ABPRE) method in attribute-based encryption. Non-Patent Document 2 describes the Adaptable Attribute-Based Encryption (Ad-PRE) method, in which attributes can be arbitrarily changed by a specific user. Patent Document 1 describes a PRE method that reduces the increase in ciphertext data size during re-encryption compared to Non-Patent Documents 1 and 2.

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: International Publication No. 2015-107620

[0007] Non-patent literature

[0008] Non-Patent Literature 1: Song Luo, Jianbin Hu, and Zhong Chen "Ciphertext PolicyAttribute-Based Proxy Re-encryption"

[0009] Non-patent literature 2: Junzuo Lai and Robert H.Deng and Yanjiang Yang and JianWeng. "Adaptable Ciphertext-Policy Attribute-Based Encryption" Summary of the Invention

[0010] Problems to be solved by the invention

[0011] The PRE method described in Non-Patent Document 1 has the following problem: the ciphertext data size increases with each re-encryption. Specifically, when re-encryption is performed N times, the ciphertext data size increases by a size proportional to N. Therefore, there is a problem related to convenience: when re-encryption is performed repeatedly, the ciphertext data size may exceed the size determined by the system.

[0012] In addition, if the data is decrypted once and then re-encrypted, the added data can be deleted. However, when decrypted once, the data is returned to plain text at once, so there is a security issue.

[0013] In the PRE method described in Non-Patent Document 2, an entity with a specific high authority can freely change the access range of any ciphertext. However, since any ciphertext can be changed to any access range, there is a security issue.

[0014] The PRE method described in Patent Document 1 can suppress the increase in the data size of ciphertext during re-encryption. However, as in Non-Patent Documents 1 and 2, the data size of ciphertext increases in proportion to the number of re-encryptions.

[0015] An object of the present invention is to make the data size of ciphertext generated by re-encryption independent of the number of re-encryption times.

[0016] Means for solving problems

[0017] The re-encryption device of the present invention comprises a ciphertext acquisition unit that acquires a session key K generated by an encryption algorithm using attribute information S that determines a decryptable range as input and a ciphertext ct obtained by encrypting the session key K. S The ciphertext ct in S ; A key acquisition unit, which obtains a re-encryption key rk, the re-encryption key rk includes the ability to ct the ciphertext S Decryption key sk Γ The converted decryption key sk is generated by setting the random number r Γ ～ The session key K' generated by the encryption algorithm using the attribute information S' that determines the decryptable range as input and the ciphertext ct obtained by encrypting the session key K' S’ , and conversion information generated according to the random number r; a re-encrypted ciphertext generating unit, which generates the converted decryption key sk from the re-encryption key rk according to the conversion information Γ ～ For the ciphertext ct S The decrypted information K ^ obtained by decryption is deleted and the elements related to the random number r are generated to generate the session key K, and the encryption element K is generated based on the session key K and the session key K'. ～ ; and an output unit, the output of which contains the encryption element K ～ and the ciphertext ct S’ The re-encrypted ciphertext rct S’ .

[0018] Effects of the Invention

[0019] In the present invention, the re-encrypted ciphertext rct S’ Contains the encryption element K generated based on the session key K and the session key K' ～ And the ciphertext ct S’ . Using the decryption key sk Γ’ Ciphertext ct S’ Decryption is performed to generate the session key K', which can be obtained based on the encryption element K ～ and session key K' to generate session key K.

[0020] In the ciphertext ct S’ As the ciphertext ct S Processing to generate re-encrypted ciphertext rct S’ The same re-encrypted ciphertext rct is also output in the case of S’ , and the session key K can also be generated.

[0021] Therefore, the data size of the ciphertext generated by re-encryption can be made independent of the number of re-encryption times. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is an explanatory diagram of the matrix M^ in embodiment 1.

[0023] Figure 2 is the matrix M in embodiment 1 δ 's illustration.

[0024] Figure 3 This is an explanatory diagram of s0 in the first embodiment.

[0025] Figure 4 s of embodiment 1 →T 's illustration.

[0026] Figure 5 This is a structural diagram of the encryption system 100 according to the first embodiment.

[0027] Figure 6 This is a configuration diagram of the common parameter generating device 10 according to the first embodiment.

[0028] Figure 7 This is a diagram showing the configuration of the user secret key generation device 20 according to the first embodiment.

[0029] Figure 8 This is a structural diagram of the encryption device 30 according to the first embodiment.

[0030] Figure 9 This is a diagram showing the structure of the re-encryption key generation device 40 according to the first embodiment.

[0031] Figure 10 This is a structural diagram of the re-encryption device 50 according to the first embodiment.

[0032] Figure 11 This is a structural diagram of the decryption device 60 according to the first embodiment.

[0033] Figure 12 This is a flowchart showing the operation of the common parameter generating device 10 according to the first embodiment.

[0034] Figure 13 This is a flowchart showing the operation of the user secret key generation device 20 according to the first embodiment.

[0035] Figure 14 This is a flowchart showing the operation of the encryption device 30 according to the first embodiment.

[0036] Figure 15 This is a flowchart showing the operation of the re-encryption key generation device 40 according to the first embodiment.

[0037] Figure 16 This is a flowchart showing the operation of the re-encryption device 50 according to the first embodiment.

[0038] Figure 17 This is a diagram showing the ciphertext ct of embodiment 1. S This is a flowchart of the operation of the decryption device 60 when performing decryption.

[0039] Figure 18 This is a diagram showing the re-encrypted ciphertext rct in the first embodiment. S’ This is a flowchart of the operation of the decryption device 60 when performing decryption. DETAILED DESCRIPTION

[0040] Implementation Method 1

[0041] ***Prepare***

[0042] <Explanation of Notation>

[0043] When A is a random variable or distribution, Math 101 represents randomly selecting y from A according to the distribution of A. That is, in Math 101, y is a random number.

[0044]

Mathematical Formula 101

[0045]

[0046] When A is a set, Math 102 represents uniformly selecting y from A. That is, in Math 102, y is a uniform random number.

[0047]

Mathematical Formula 102

[0048]

[0049] Mathematical formula 103 indicates that y is a set defined by z, or y is a set into which z is substituted.

[0050]

Mathematical Formula 103

[0051] y:=z

[0052] When a is a constant, mathematical formula 104 indicates that machine (algorithm) A outputs a for input x.

[0053]

Mathematical Formula 104

[0054] A(x)→a

[0055] For example,

[0056] A(x)→1

[0057] Mathematical formula 105 is F q represents a finite body of number q.

[0058]

Mathematical Formula 105

[0059]

[0060] Mathematical formula 106 is expressed as mathematical formula 107.

[0061]

Mathematical Formula 106

[0062]

[0063]

Mathematical Formula 107

[0064]

[0065] Vector notation represents a finite body F q The vector in . That is, it is mathematical formula 108.

[0066]

Mathematical formula 108

[0067] express

[0068] X T Represents the transposed matrix of matrix X.

[0069] The elements of the vector space of mathematical formula 109 are expressed as mathematical formula 110.

[0070]

Mathematical formula 109

[0071]

[0072]

Mathematical Formula 110

[0073]

[0074] In Mathematics 111, b i ,...,b n The generated partial space is expressed as mathematical formula 112.

[0075]

Mathematical Formula 111

[0076]

[0077]

Mathematical Formula 112

[0078]

[0079] Mathematical formula 113 represents the two vectors x shown in mathematical formula 114. → With v → The inner product shown in mathematical formula 115.

[0080]

Mathematical Formula 113

[0081]

[0082]

Mathematical formula 114

[0083]

[0084]

[0085]

Mathematical Formula 115

[0086]

[0087] For the basis B and basis B shown in mathematical formula 116 * , is the mathematical formula 117.

[0088]

Mathematical formula 116

[0089]

[0090]

[0091]

Mathematical formula 117

[0092]

[0093]

[0094] e → j Represents the standard basis vectors shown in mathematical formula 118.

[0095]

Mathematical formula 118

[0096]

[0097] GL(n,F q ) represents a finite body F of dimension n q General linear systems on .

[0098] For the matrix W shown in mathematical formula 119 and the element g in the n-dimensional vector space V shown in mathematical formula 120, it is defined as mathematical formula 121.

[0099]

Mathematical formula 119

[0100]

[0101]

Mathematical Formula 120

[0102] g:=(G1, ..., G n )

[0103]

Mathematical Formula 121

[0104]

[0105] <Symmetric bilinear pairing group>

[0106] Symmetric bilinear pairing group (q,G,G T ,g,e) are prime numbers q, the additive cyclic group G of the number of digits q, and the multiplicative cyclic group G of the number of digits q T , g≠0∈G, a non-degenerate bilinear map e: G×G→G that can be computed in polynomial time T The bilinear map is e(sg,tg)=e(g,g) st , e(g,g)≠1.

[0107] In the following description, it is assumed that G bpg The algorithm is as follows: λ As input, the output sets the security parameter to 1 λ Parameters param of the symmetric bilinear pairing group G :=(q,G,G T ,g,e) values.

[0108] <Dual pairing vector space>

[0109] Dual pairing vector space (q, V, G T ,A,e) can be obtained by symmetric bilinear pairing group (param G :=(q,G,G T ,g,e)). The dual pairing vector space (q,V,GT ,A,e) is a prime number q, and F is shown in mathematical formula 122 q N-dimensional vector space V, cyclic group G of quantile q T 、The standard basis A of space V:=(a1,...,a N ), the pairing operation e shown in formula 123. Here, a i As shown in mathematical formula 124.

[0110]

Mathematical formula 122

[0111]

[0112]

Mathematical formula 123

[0113]

[0114]

Mathematical formula 124

[0115]

[0116] The pairing in space V is defined by mathematical formula 125.

[0117] It has the non-degenerate property. That is, e(sx,ty)=e(x,y) st , for all y∈V, when e(x,y)=1, x=0. In addition, for all i and j, e(a i ,a j )=e(g,g) δi,j Here, if i=j, then δ i,j =1, if i≠j, then δ i,j = 0. In addition, e(g,g)≠1∈G T .

[0118]

Mathematical formula 125

[0119]

[0120] in,

[0121]

[0122]

[0123] In the following description, G dpvs Assume the following algorithm: 1 λ (λ∈natural number), N∈natural number, parameter param of bilinear pairing group G :=(q,G,G T,g,e) as input, the output security parameter is λ and is set as the parameter param of the dual pairing vector space of N-dimensional space V V :=(q,V,G T ,A,e).

[0124] <Attribute-based encryption for non-monotonic access constructs>

[0125] Attribute-based encryption (ABE) is an encryption method that extends the functionality of public-key encryption or ID-based encryption. ABE is a public-key encryption method that sets an attribute set Γ for one of the ciphertext and the decryption key, and sets an access structure S for all attributes for the other. Decryption is possible only when the attribute set Γ satisfies the access structure S.

[0126] ABE that sets an access structure for ciphertext is called Ciphertext Policy (CP)-ABE, and ABE that sets an access structure for decryption keys is called Key Policy (KP)-ABE. Implementation 1 describes CP-ABE. However, it is easy to convert CP-ABE to KP-ABE. ABE can set conditional expressions using logical OR and logical AND as access structures. This allows for setting access rights such as "Department A and Section Head and above," making CP-ABE useful for secure file sharing within an enterprise.

[0127] <Zhangcheng scheme and non-monotonic access construction>

[0128] Reference Figure 1 The matrix M^ will be described.

[0129] {p1,...,p n} is a set of variables. M^:=(M,ρ) is a labeled matrix. Here, the matrix M is F q In addition, ρ is the label added to each row of the matrix M, corresponding to {p1,...,p n ,￢p1,...,￢p n}. In addition, the label ρ added to all rows of M i (i=1,...,L) corresponds to any text. That is, ρ:{1,...,L}→{p1,...,p n ,￢p1,...,￢p n}.

[0130] For all input columns δ∈{0,1} n Define the partial matrix M of the matrix Mδ Matrix M δ It is a submatrix consisting of the rows of the matrix M that associate the value "1" with the label ρ through the input column δ. That is, the matrix M δ is determined by δ i =1 such that p i The corresponding rows of the matrix M and δ i =0 such as ￢p i The corresponding rows of the matrix M constitute a partial matrix.

[0131] Reference Figure 2 For the matrix M δ In addition, Figure 2 In , let n = 7, L = 6, and r = 5. That is, the set of variables is {p1, ..., p7}, and the matrix M is a (6 rows × 5 columns) matrix. In addition, Figure 2 In , the label ρ is set to ρ1 corresponding to ￢p2, ρ2 corresponding to p1, ρ3 corresponding to p4, ρ4 corresponding to ￢p5, ρ5 corresponding to ￢p3, and ρ6 corresponding to p5.

[0132] Here, let the input column δ∈{0,1} 7 δ1 = 1, δ2 = 0, δ3 = 1, δ4 = 0, δ5 = 0, δ6 = 1, δ7 = 1. In this case, the partial matrix consisting of the rows of the matrix M corresponding to the text (p1, p3, p6, p7, ￢p2, ￢p4, ￢p5) surrounded by the dotted line is the matrix M δ That is, the partial matrix consisting of the first row (M1), the second row (M2), and the fourth row (M4) of the matrix M is the matrix M δ .

[0133] In other words, let the mapping γ: {1,...,L}→{0,1} be [ρ(j)=p i ]∧[δ i =1] or [ρ(j) = ￢p i ]∧[δ i =0], γ(j) = 1, and in other cases, γ(j) = 0. In this case, M δ :=(M j ) γ(j)＝1 Here, M j is the j-th row of the matrix M.

[0134] That is, in Figure 2 In , the mapping γ(j)=1(j=1,2,4), and the mapping γ(j)=0(j=3,5,6). Therefore, (M j ) γ(j)＝1 M1, M2, M4, is the matrix M δ .

[0135] That is, whether the value of the mapping γ(j) is "0" or "1" determines whether the j-th row of the matrix M is included in the matrix M. δ middle.

[0136] Only in 1 → ∈span <M δ In the case of >, the spanning solution M^ accepts the input column δ, and in other cases, rejects the input column δ. That is, only when the matrix M obtained from the matrix M^ by the input column δ δ Linear combination of the rows gives 1 → In the case of , the spanning solution M^ accepts the input sequence δ. In addition, 1 → is a row vector whose elements are all equal to "1".

[0137] For example, if it is Figure 2 For example, only the matrix M consisting of the 1st, 2nd, and 4th rows of the matrix M is δ Linearly combine the rows of → In the case of , the spanning solution M^ accepts the input sequence δ. That is, when there exists α1(M1)+α2(M2)+α4(M4)=1 → In the case of α1, α2, and α4, the spanning solution M^ accepts the input column δ.

[0138] Here, the label ρ corresponds only to the positive text {p1,...,p n}, the spanning solution is called monotone. On the other hand, when the label ρ corresponds to the text {p1,...,p n ,￢p1,...,￢p n}, the spanning scheme is called non-monotonic. Here, the spanning scheme is non-monotonic. Furthermore, an access structure (non-monotonic access structure) is constructed using the non-monotonic spanning scheme. Simply put, the access structure controls access to encryption. In other words, it controls whether ciphertext can be decrypted.

[0139] <Inner product and access construction of attribute information>

[0140] Here, the inner product of the attribute information is used to calculate the above-mentioned mapping γ(j). That is, the inner product of the attribute information is used to determine which row of the matrix M is included in the matrix M. δ middle.

[0141] is a sub-universe, a collection of attributes. t Contains the identification information of the partial full set (t) and the n-dimensional vector (v → ). That is, U t is (t,v →). Here, t∈{1,...,d}, v → ∈F q n .

[0142] Will U t :=(t,v → ) is set as the variable p in the span scheme M^:=(M,ρ). That is, p:=(t,v → ). And, set the variable (p: = (t,v → ),(t,v' → ),...), the spanning scheme M^:=(M,ρ) of is set as the access structure S.

[0143] That is, the access structure S: = (M, ρ), ρ: {1, ..., L} → {(t, v → ),(t,v' → ),...,￢(t,v → ),￢(t,v' → ),...}.

[0144] Next, let Γ be the attribute set. That is, Γ:={(t,x → t )|x → t ∈Fq n ,1≤t≤d}.

[0145] Given Γ for the access structure S, define the mapping γ for the span M^:=(M,ρ) as follows: {1,...,L}→{0,1}. For each integer i with i=1,...,L, in [ρ(i)=(t,v → i )]∧[(t,x → t )∈Γ]∧[v → i ·x → t =0] or [ρ(i) = ￢(t,v → i )]∧[(t,x → t )∈Γ]∧[v → i ·x → t ≠0], γ(j)=1, and in other cases, γ(j)=0.

[0146] That is, according to the attribute information v → with x →The inner product of is used to calculate the mapping γ. And, as mentioned above, the mapping γ is used to determine which row of the matrix M is included in the matrix M. δ That is, according to the attribute information v → with x → The inner product of determines which row of the matrix M is included in the matrix M δ In only 1 → ∈span<(M i ) γ(i)＝1 >, the access structure S:=(M,ρ) accepts Γ.

[0147] <Secret Dispersion Method>

[0148] Define secret distribution in non-monotonic access constructions (or spanning schemes).

[0149] Secret sharing methods involve dispersing secret information into meaningless distributed information. For example, secret information s is dispersed into 10 pieces, generating 10 distributed information. None of these 10 distributed information contains any information about secret information s. Therefore, even if one distributed information is obtained, no information about secret information s is obtained. On the other hand, if all 10 distributed information are obtained, secret information s can be recovered.

[0150] Furthermore, there are secret sharing schemes where, even if not all 10 pieces of shared information are available, only a portion (e.g., 8) can be used to recover secret information s. This situation where 8 out of 10 pieces of shared information can be used to recover secret information s is called 8-out-of-10. Similarly, the situation where t out of n pieces of shared information can be used to recover secret information s is called t-out-of-n. This t is called the threshold.

[0151] In addition, there is also the following secret distribution method: after generating d1,...,d 10 In the case of these 10 pieces of distributed information, if the eight pieces of distributed information are d1, ..., d8, the secret information s can be restored. However, if the eight pieces of distributed information are d3, ..., d 10 These 8 pieces of distributed information cannot restore the secret information s. In other words, there is also a secret distribution method that controls whether the secret information s can be restored not only by the number of distributed information obtained, but also by the combination of distributed information.

[0152] Reference Figure 3 Explain s0. Figure 4 to s →T Provide explanation.

[0153] Let matrix M be a matrix of (L rows × r columns). →T Let it be the column vector shown in mathematical formula 126.

[0154]

Mathematical formula 126

[0155]

[0156] Let s0 shown in Math. 127 be shared secret information.

[0157]

Mathematical formula 127

[0158]

[0159] In addition, the s shown in Mathematical Formula 128 →T Let s0 be the vector of L scattered information.

[0160]

Mathematical formula 128

[0161]

[0162] Furthermore, let the distributed information s i belongs to ρ(i).

[0163] In the case where the access structure S:=(M,ρ) accepts Γ, that is, regarding γ:{1,...,L}→{0,1}, in 1 → ∈span<(M i ) γ(i) =1>, there is The constant {α i ∈F q |i∈I}.

[0164] exist Figure 2 In the example of , it is explained that when there exists α1(M1)+α2(M2)+α4(M4)=1 → In the case of α1, α2, and α4, the spanning solution M^ accepts the input sequence δ, so this can be clearly seen. That is, when there is a solution that satisfies α1(M1)+α2(M2)+α4(M4)=1 → In the case of α1, α2, and α4, if the spanning solution M^ accepts the input sequence δ, then there exists a solution that satisfies α1(M1)+α2(M2)+α4(M4)=1 → α1, α2, and α4.

[0165] And, it is mathematical formula 129.

[0166]

Mathematical formula 129

[0167] ∑ i∈I α i s i :=s0

[0168] In addition, the constant {αi} can be computed in polynomial time in the size of the matrix M.

[0169] ***Description of the structure***

[0170] Reference Figure 5 The configuration of the encryption system 100 according to the first embodiment will be described.

[0171] The encryption system 100 includes a public parameter generation device 10 , a plurality of user secret key generation devices 20 , a plurality of encryption devices 30 , a re-encryption key generation device 40 , a re-encryption device 50 , and a decryption device 60 .

[0172] The public parameter generation device 10, each user secret key generation device 20, the re-encryption key generation device 40, each encryption device 30, the re-encryption device 50, and the decryption device 60 are connected via a transmission path 70. As a specific example, the transmission path 70 is the Internet or a LAN (Local Area Network).

[0173] Reference Figure 6 The configuration of the common parameter generating device 10 according to the first embodiment will be described.

[0174] The common parameter generating device 10 is a computer.

[0175] The common parameter generating device 10 includes hardware such as a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to the other hardware via a signal line and controls the other hardware.

[0176] The common parameter generating device 10 includes an acquisition unit 111, a parameter generating unit 112, and an output unit 113 as functional components. The functions of the functional components of the common parameter generating device 10 are implemented by software.

[0177] The memory 13 stores a program for realizing the functions of each functional component of the common parameter generating device 10. The program is read into the memory 12 by the processor 11 and executed by the processor 11. Thus, the functions of each functional component of the common parameter generating device 10 are realized.

[0178] Reference Figure 7 The configuration of the user secret key generation device 20 according to the first embodiment will be described.

[0179] The user secret key generation device 20 is a computer.

[0180] The user secret key generation device 20 includes hardware such as a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected to the other hardware via a signal line and controls the other hardware.

[0181] The user secret key generation device 20 includes, as functional components, an acquisition unit 211, a user secret key generation unit 212, and an output unit 213. The functions of the functional components of the user secret key generation device 20 are implemented by software.

[0182] The memory 23 stores a program for realizing the functions of each functional component of the user secret key generation device 20. The program is read into the memory 22 by the processor 21 and executed by the processor 21. Thus, the functions of each functional component of the user secret key generation device 20 are realized.

[0183] Reference Figure 8 The configuration of the encryption device 30 according to the first embodiment will be described.

[0184] The encryption device 30 is a computer.

[0185] The encryption device 30 includes hardware such as a processor 31, a memory 32, a storage 33, and a communication interface 34. The processor 31 is connected to the other hardware via a signal line and controls the other hardware.

[0186] The encryption device 30 includes, as functional components, an acquisition unit 311, a ciphertext generation unit 312, and an output unit 313. The functions of the functional components of the encryption device 30 are implemented by software.

[0187] The memory 33 stores a program for realizing the functions of each functional component of the encryption device 30. The program is read into the memory 32 by the processor 31 and executed by the processor 31. Thus, the functions of each functional component of the encryption device 30 are realized.

[0188] Reference Figure 9 The structure of the re-encryption key generation device 40 according to the first embodiment will be described.

[0189] The re-encryption key generating device 40 is a computer.

[0190] The re-encryption key generation device 40 includes hardware such as a processor 41, a memory 42, a storage 43, and a communication interface 44. The processor 41 is connected to the other hardware via a signal line and controls the other hardware.

[0191] The re-encryption key generation device 40 includes, as functional components, an acquisition unit 411, a re-encryption key generation unit 412, and an output unit 413. The functions of each functional component of the re-encryption key generation device 40 are implemented by software.

[0192] The memory 43 stores a program that implements the functions of each functional component of the re-encryption key generation device 40. The program is read into the memory 42 by the processor 41 and executed by the processor 41. In this way, the functions of each functional component of the re-encryption key generation device 40 are implemented.

[0193] Reference Figure 10 The structure of the re-encryption device 50 according to the first embodiment will be described.

[0194] The re-encryption device 50 is a computer.

[0195] The re-encryption device 50 includes hardware such as a processor 51, a memory 52, a storage 53, and a communication interface 54. The processor 51 is connected to the other hardware via a signal line and controls the other hardware.

[0196] The re-encryption device 50 includes an acquisition unit 511, a re-encrypted ciphertext generation unit 512, and an output unit 513 as functional components. The acquisition unit 511 includes a ciphertext acquisition unit 514 and a key acquisition unit 515. The functions of each functional component of the re-encryption device 50 are implemented by software.

[0197] The memory 53 stores a program for realizing the functions of each functional component of the re-encryption device 50. The program is read into the memory 52 by the processor 51 and executed by the processor 51. Thus, the functions of each functional component of the re-encryption device 50 are realized.

[0198] Reference Figure 11 The structure of the decryption device 60 according to the first embodiment will be described.

[0199] The decryption device 60 is a computer.

[0200] The decryption device 60 includes hardware such as a processor 61, a memory 62, a storage 63, and a communication interface 64. The processor 61 is connected to the other hardware via a signal line and controls the other hardware.

[0201] The decryption device 60 includes, as functional components, an acquisition unit 611, a decryption unit 612, and an output unit 613. The functions of the functional components of the decryption device 60 are implemented by software.

[0202] The memory 63 stores a program for realizing the functions of each functional component of the decryption device 60. The program is read into the memory 62 by the processor 61 and executed by the processor 61. Thus, the functions of each functional component of the decryption device 60 are realized.

[0203] The processors 11, 21, 31, 41, 51, and 61 are integrated circuits (ICs) that perform processing. Specific examples of the processors 11, 21, 31, 41, 51, and 61 include a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).

[0204] The memories 12, 22, 32, 42, 52, and 62 are storage devices for temporarily storing data. Specifically, the memories 12, 22, 32, 42, 52, and 62 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).

[0205] Memories 13, 23, 33, 43, 53, and 63 are storage devices for storing data. Specifically, memories 13, 23, 33, 43, 53, and 63 are HDDs (Hard Disk Drives). Alternatively, memories 13, 23, 33, 43, 53, and 63 may be removable recording media such as SD (registered trademark, Secure Digital) memory cards, CF (CompactFlash), NAND flash memory, floppy disks, optical disks, high-density disks, Blu-ray (registered trademark) disks, and DVDs (Digital Versatile Disks).

[0206] Communication interfaces 14, 24, 34, 44, 54, and 64 are interfaces for communicating with external devices. Specifically, communication interfaces 14, 24, 34, 44, 54, and 64 are ports for Ethernet (registered trademark), USB (Universal Serial Bus), or HDMI (registered trademark, High-Definition Multimedia Interface).

[0207] exist Figure 6 In FIG, only one processor 11 is shown. However, there may be multiple processors 11, and the multiple processors 11 may cooperate to execute programs that realize various functions.

[0208] Likewise, there may be multiple processors 21 , 31 , 41 , 51 , and 61 , and the multiple processors 21 , 31 , 41 , 51 , and 61 may cooperate to execute programs that implement various functions.

[0209] ***Description of the action***

[0210] Reference Figures 12 to 18 The operation of the encryption system 100 according to the first embodiment will be described.

[0211] The encryption system 100 of Embodiment 1 implements AB-PRE. Here, assuming a KEM (Key Encapsulation Mechanism)-DEM (Data Encapsulation Mechanism) framework, an example using AB-PRE as KEM will be described.

[0212] AB-PRE has the Setup algorithm, KG algorithm, RKG algorithm, Enc algorithm, REnc algorithm and Dec algorithm.

[0213] The Setup algorithm is to set the security parameter 1 λ and spatial information n → A probabilistic algorithm that takes as input a public key pk and a master secret key msk.

[0214] The KG algorithm takes the public key pk, the master secret key msk, and the attribute information Γ as input and outputs the decryption key sk Γ Probabilistic algorithm.

[0215] The Enc algorithm takes the public key pk and attribute information S as input and outputs the ciphertext ct S and a probabilistic algorithm for the session key K.

[0216] The RKG algorithm is to convert the public key pk and the decryption key sk Γ A probabilistic algorithm that takes as input the attribute information S' and outputs the re-encryption key rk.

[0217] The REnc algorithm is to use the public key pk, the re-encryption key rk and the ciphertext ct S Output the re-encrypted ciphertext rct as input S’ Probabilistic algorithm.

[0218] The Dec algorithm is to convert the public key pk and the decryption key sk Γ 、ciphertext ct S Or re-encrypt the ciphertext rct S’ A deterministic algorithm that takes as input and outputs a session key K.

[0219] In the first embodiment, the attribute information S and the attribute information S′ correspond to the above-mentioned access structure S:=(M,ρ).

[0220] Reference Figure 12 The operation of the common parameter generating device 10 according to the first embodiment will be described.

[0221] The operation steps of the common parameter generating device 10 in the first embodiment correspond to the common parameter generating method in the first embodiment. In addition, the program for realizing the operation of the common parameter generating device 10 in the first embodiment corresponds to the common parameter generating program in the first embodiment.

[0222] The common parameter generating device 10 executes the Setup algorithm.

[0223] (Step S11: Acquisition Process)

[0224] The acquisition unit 111 acquires the security parameter 1 λ and spatial information n → :=(d;n1,...,n d ).

[0225] Specifically, the acquisition unit 111 acquires the security parameter 1 input by the administrator of the encryption system 100 or the like via the communication interface 14. λ and spatial information n → The acquisition unit 111 receives the security parameter 1 λ and spatial information n → Write into memory 12. Spatial information n → It is a parameter that determines the structure such as the dimension of the dual pairing vector space used by the encryption system 100.

[0226] (Step S12: Parameter Generation Process)

[0227] The parameter generation unit 112 generates the security parameter 1 obtained in step S11. λ and spatial information n → As input, a public key pk and a master secret key msk are generated.

[0228] Specifically, the parameter generation unit 112 generates the security parameter 1 λ and spatial information n → As input, execute the algorithm G shown in mathematical formula 130 ob , generate param n Element g t and base {B t ,B * t} t＝0,...,d .

[0229]

Mathematical Formula 130

[0230]

[0231] As shown in the mathematical formula 131, the parameter generation unit 112 is based on the basis {B t ,B * t} t＝0,...,d Generate partial basis {B^ t ,B^ * t} t＝0,...,d .

[0232]

Mathematical Formula 131

[0233]

[0234]

[0235]

[0236]

[0237] As shown in mathematical formula 132, the parameter generation unit 112 generates element a, element A, and element c.

[0238]

Mathematical formula 132

[0239]

[0240]

[0241] The parameter generation unit 112 generates the security parameter 1 λ 、param n Element g t 、Partial basis {B^ t} t＝0,...,d , element A and element c are set to the public key pk. * t} t＝0,...,d , element a and basis vector b * 0,6 Set to the master secret key msk.

[0242] (Step S13: Output Processing)

[0243] The output unit 113 outputs the public key pk and the master secret key msk generated in step S12 .

[0244] Specifically, the output unit 113 transmits the public key pk to each user secret key generation device 20, each encryption device 30, the re-encryption key generation device 40, the re-encryption device 50, and the decryption device 60 via the communication interface 14. Furthermore, the output unit 113 transmits the master secret key msk to each user secret key generation device 20 via the communication interface 14. At this time, the output unit 113 encrypts the master secret key msk using an existing encryption algorithm, thereby concealing the key and transmitting the key.

[0245] Alternatively, the public key pk and the master secret key msk may be stored in a storage medium and mailed instead of being transmitted via the communication interface 14 .

[0246] That is, the common parameter generation device 10 executes the Setup algorithm shown in Mathematical Formula 133.

[0247]

Mathematical formula 133

[0248]

[0249] Reference Figure 13 The operation of the user secret key generation device 20 according to the first embodiment will be described.

[0250] The operation steps of the user secret key generation device 20 in Embodiment 1 correspond to the user secret key generation method in Embodiment 1. Furthermore, the program that realizes the operation of the user secret key generation device 20 in Embodiment 1 corresponds to the user secret key generation program in Embodiment 1.

[0251] The user secret key generation device 20 executes the KG algorithm.

[0252] (Step S21: Acquisition Process)

[0253] The acquisition unit 211 acquires the public key pk, the master secret key msk, and the attribute information Γ:={t,x → t |x → t ∈F q nt \{0 →},1≤t≤d}.

[0254] Specifically, the acquisition unit 211 receives the public key pk and the master secret key msk transmitted by the public parameter generation device 10 via the communication interface 24. The acquisition unit 211 also acquires the attribute information Γ input by a user of the user secret key generation device 20, etc., via the communication interface 14. The acquisition unit 211 writes the public key pk, the master secret key msk, and the attribute information Γ into the memory 22.

[0255] The attribute information Γ represents the decryption key sk Γ For example, the attribute type assigned to each t is set as x. → t As a specific example, the company to which the user belongs is assigned to t=1, the department to which the user belongs to t=2, the section to which the user belongs to t=3, and the position to which the user belongs to t=4. → 1Set the company to which the user belongs, and → 2 Set the department to which the user belongs, and → 3 Set the class to which the user belongs, and → 4Set the user's role.

[0256] (Step S22: User Secret Key Generation Process)

[0257] The user secret key generation unit 212 takes the public key pk, master secret key msk, and attribute information Γ obtained in step S21 as input and generates a decryption key sk Γ .

[0258] Specifically, as shown in Math. 134, the user secret key generation unit 212 generates a random number.

[0259]

Mathematical formula 134

[0260]

[0261] As shown in Mathematical Formula 135, the user secret key generation unit 212 generates the key element k * 0 and the key element k associated with each t contained in the attribute information Γ * t .

[0262]

Mathematical Formula 135

[0263]

[0264]

[0265] (Step S23: Output Processing)

[0266] The output unit 213 outputs the attribute information Γ, the key element k generated in step S22, * 0 and each key element k * t And the basis vector b * 0,6 As the decryption key sk Γ .

[0267] Specifically, the output unit 213 transmits the decryption key sk to the Γ The output unit 213 uses the existing encryption algorithm to generate the decryption key sk Γ It is sent after being encrypted to hide it.

[0268] In addition, the decryption key sk Γ Instead of being sent via the communication interface 24 , the data may be stored in a storage medium and mailed.

[0269] That is, the user secret key generation device 20 executes the KG algorithm shown in Mathematical Formula 136.

[0270]

Mathematical formula 136

[0271]

[0272] Reference Figure 14 The operation of the encryption device 30 according to the first embodiment will be described.

[0273] The operation procedure of the encryption device 30 in the first embodiment corresponds to the encryption method in the first embodiment. In addition, the program for realizing the operation of the encryption device 30 in the first embodiment corresponds to the encryption program in the first embodiment.

[0274] The encryption device 30 executes the Enc algorithm.

[0275] (Step S31: Acquisition Process)

[0276] The acquisition unit 311 acquires the public key pk and attribute information S=(M, ρ).

[0277] Specifically, the acquisition unit 311 receives the public key pk transmitted by the common parameter generation device 10 via the communication interface 34. The acquisition unit 311 acquires the attribute information S input by the user of the encryption device 30 via the communication interface 14. The acquisition unit 311 writes the public key pk and the attribute information S into the memory 32.

[0278] The attribute information S indicates that the ciphertext ct S Specifically, the attribute information S represents the range of attributes that can be decrypted by using the conditional expressions of logical OR and logical AND. S The scope of the attribute to decrypt.

[0279] (Step S32: Ciphertext Generation Process)

[0280] The ciphertext generation unit 312 takes the public key pk and attribute information S obtained in step S31 as input and generates a ciphertext ct S .

[0281] Specifically, as shown in Math 137, the ciphertext generation unit 312 generates distributed information s for each integer i where i=1, ..., L. i and secret information s0.

[0282]

Mathematical formula 137

[0283]

[0284]

[0285]

[0286] As shown in Math. 138, the ciphertext generation unit 312 generates a random number.

[0287]

Mathematical formula 138

[0288]

[0289] As shown in Math. 139, the ciphertext generation unit 312 generates the encrypted element c0.

[0290]

Mathematical formula 139

[0291]

[0292] As shown in Math. 140, the ciphertext generation unit 312 generates a session key K.

[0293]

Mathematical formula 140

[0294]

[0295] As shown in Mathematical Formula 141, the ciphertext generation unit 312 generates the encrypted element c for each integer i where i=1, ..., L. i .

[0296]

Mathematical formula 141

[0297]

[0298] (Step S33: Output Processing)

[0299] The output unit 313 outputs the encrypted element c containing the attribute information S and the encrypted element c associated with each integer i where i=0, ..., L generated in step S32. i The ciphertext ct S , and the session key K generated in step S32.

[0300] Specifically, the output unit 313 transmits the ciphertext ct to the SThe session key K is sent to the re-encryption device 50 and the decryption device 60. In addition, the output unit 313 writes the session key K into the memory 32.

[0301] That is, the encryption device 30 executes the Enc algorithm shown in Math. 142.

[0302]

Mathematical formula 142

[0303]

[0304] Reference Figure 15 The operation of the re-encryption key generation device 40 according to the first embodiment will be described.

[0305] The operation steps of the re-encryption key generation device 40 in Embodiment 1 correspond to the re-encryption key generation method in Embodiment 1. Furthermore, the program that realizes the operation of the re-encryption key generation device 40 in Embodiment 1 corresponds to the re-encryption key generation program in Embodiment 1.

[0306] The re-encryption key generating device 40 executes the RKG algorithm.

[0307] (Step S41: Acquisition Process)

[0308] The acquisition unit 411 acquires the public key pk and the decryption key sk Γ And attribute information S': = (M, ρ).

[0309] Specifically, the acquisition unit 411 receives the public key pk transmitted from the public parameter generation device 10 via the communication interface 44. The acquisition unit 411 receives the decryption key sk transmitted from the user secret key generation device 20 via the communication interface 44. Γ The acquisition unit 411 acquires attribute information S' input by a user of the re-encryption key generation device 40 via the communication interface 14. The acquisition unit 411 converts the public key pk and the decryption key sk Γ The attribute information S′ is written into the memory 42 .

[0310] Attribute information S' indicates that the ciphertext rct can be re-encrypted S’ Specifically, like the attribute information S, the attribute information S' indicates that the ciphertext rct can be re-encrypted by using the conditional expression of logical OR and logical AND. S’ The scope of the attribute to decrypt.

[0311] (Step S42: Re-encryption key generation process)

[0312] The re-encryption key generation unit 412 generates the public key pk and decryption key sk obtained in step S41. Γ and attribute information S' as input to generate the re-encryption key rk.

[0313] Specifically, as shown in Math. 143, the re-encryption key generation unit 412 generates a random number.

[0314]

Mathematical formula 143

[0315]

[0316] As shown in Mathematical Formula 144, the re-encryption key generation unit 412 generates the converted decryption key sk Γ ～ .

[0317]

Mathematical formula 144

[0318]

[0319] Thus, the converted decryption key sk Γ ～ The k contained in * 0 as shown in mathematical formula 145.

[0320]

Mathematical formula 145

[0321]

[0322] As shown in Mathematical Formula 146, the re-encryption key generation unit 412 takes the public key pk and attribute information S' as input, executes the Enc algorithm, and generates the ciphertext ct S’ and session key K'.

[0323]

Mathematical formula 146

[0324]

[0325] That is, the re-encryption key generation unit 412 takes the public key pk and the attribute information S' as input and executes Figure 14 The processing of step S32 generates the ciphertext ct S’ and session key K'.

[0326] (Step S43: Output Processing)

[0327] The output unit 413 outputs the converted decryption key sk Γ ～ , the element A obtained from the element A contained in the public key pk and the random number r r Element A obtained by multiplying the session key K' r K' and ciphertext ct S’ As the re-encryption key rk.

[0328] Specifically, the output unit 413 transmits the re-encryption key rk to the re-encryption device 50 via the communication interface 44 .

[0329] That is, the re-encryption key generation device 40 executes the RKG algorithm shown in Math. 147.

[0330]

Mathematical formula 147

[0331]

[0332] Reference Figure 16 The operation of the re-encryption device 50 according to the first embodiment will be described.

[0333] The operation steps of the re-encryption device 50 in the first embodiment correspond to the re-encryption method in the first embodiment. In addition, the program for realizing the operation of the re-encryption device 50 in the first embodiment corresponds to the re-encryption program in the first embodiment.

[0334] The re-encryption device 50 executes the REnc algorithm.

[0335] (Step S51: Ciphertext Acquisition Process)

[0336] The ciphertext acquisition unit 514 acquires the ciphertext ct S That is, the ciphertext acquisition unit 514 acquires the session key K generated by the Enc algorithm as an encryption algorithm using the attribute information S that determines the decryptable range as input and the ciphertext ct obtained by encrypting the session key K. S The ciphertext ct in S .

[0337] Specifically, the ciphertext acquisition unit 514 receives the ciphertext ct sent by the encryption device 30 via the communication interface 54. S The ciphertext acquisition unit 514 converts the ciphertext ct S Write to memory 52.

[0338] (Step S52: Key Acquisition Process)

[0339] The key acquisition unit 515 acquires the re-encryption key rk. That is, the key acquisition unit 515 acquires the re-encryption key rk, which contains the key that can be used to encrypt the ciphertext ct. S Decryption key sk Γ The converted decryption key sk is generated by setting the random number r Γ ～ The attribute information S' that determines the decryptable range is used as input and the session key K' is generated by the Enc algorithm as an encryption algorithm, and the ciphertext ct obtained by encrypting the session key K' S’ , and conversion information A generated according to the random number r rFurthermore, the key acquisition unit 515 acquires the public key pk.

[0340] Specifically, the key acquisition unit 515 receives the public key pk transmitted by the common parameter generation device 10 and the re-encryption key rk transmitted by the re-encryption key generation device 40 via the communication interface 54. The key acquisition unit 515 writes the public key pk and the re-encryption key rk into the memory 52.

[0341] (Step S53: Determination Process)

[0342] The re-encrypted ciphertext generation unit 512 determines the ciphertext ct S The access structure contained in , that is, the attribute information S, accepts the attribute information Γ contained in the re-encryption key rk.

[0343] If the result is accepted, the re-encrypted ciphertext generation unit 512 advances the process to step S54. On the other hand, if the result is not accepted, the re-encrypted ciphertext generation unit 512 sets the result to be unable to generate the re-encrypted ciphertext rct S’ , end the processing.

[0344] (Step S54: Re-encrypted ciphertext generation process)

[0345] The re-encrypted ciphertext generation unit 512 converts the ciphertext ct obtained in step S51 into S , the public key pk and re-encryption key rk obtained in step S52 are used as input to generate the re-encrypted ciphertext rct S’ .

[0346] Specifically, the re-encrypted ciphertext generation unit 512 generates the converted decryption key sk contained in the re-encryption key rk. Γ ～ Ciphertext ct S Decryption is performed to generate decrypted information K^. The re-encrypted ciphertext generation unit 512 generates decrypted information K^ according to the converted information A r Delete the elements related to the random number r from the decrypted information K^, set the session key K', and generate the encrypted element K ～ .

[0347] This will be described in more detail.

[0348] The re-encrypted ciphertext generation unit 512 calculates the index I and the complement coefficient {α i} i∈I .

[0349]

Mathematical formula 148

[0350]

[0351]

[0352] Here, M i is the i-th row of the matrix M.

[0353] As shown in Mathematical Formula 149, the re-encrypted ciphertext generation unit 512 uses the converted decryption key sk Γ ～ Ciphertext ct S Decryption is performed to generate decrypted information K^.

[0354]

Mathematical formula 149

[0355]

[0356] Then, the re-encrypted ciphertext generation unit 512 includes the conversion information A r Element A r K' deletes the element related to the random number r from the decrypted information K^, sets the session key K', and generates the encrypted element K ～ Specifically, the re-encrypted ciphertext generation unit 512 divides the decrypted information K^ by the element A r K', generates the encryption element K ～ .

[0357] (Step S55: Output Processing)

[0358] The output unit 513 outputs the ciphertext ct S’ and encryption element K ～ As the re-encrypted ciphertext rct S’ .

[0359] Specifically, the output unit 513 transmits the re-encrypted ciphertext rct via the communication interface 54. S’ Sent to the decryption device 60.

[0360] That is, the re-encryption device 50 executes the REnc algorithm shown in mathematical formula 150.

[0361]

Mathematical Formula 150

[0362]

[0363] Here, the re-encryption device 50 re-encrypts the ciphertext ct generated by the encryption device 30. S Re-encryption is performed to change the decryptable range from attribute information S to attribute information S'. However, the re-encryption device 50 can also re-encrypt the ciphertext rct S’ Re-encryption is performed to change the range that can be decrypted.

[0364] In this case, in step S51, the ciphertext acquisition unit 514 acquires the re-encrypted ciphertext rct S’ The ciphertext ct contained in S’As the ciphertext ct S The subsequent processing is the same as the ciphertext ct generated by the encryption device 30. S The same applies to re-encryption.

[0365] Reference Figure 17 and Figure 18 The operation of the decryption device 60 according to the first embodiment will be described.

[0366] The operation steps of the decryption device 60 in the first embodiment correspond to the decryption method in the first embodiment. In addition, the program for realizing the operation of the decryption device 60 in the first embodiment corresponds to the decryption program in the first embodiment.

[0367] The decryption device 60 executes the Dec algorithm.

[0368] Reference Figure 17 Explanation of the ciphertext ct in the first embodiment S Processing when decryption is performed.

[0369] (Step S61: Acquisition Process)

[0370] The acquisition unit 611 acquires the public key pk and the decryption key sk Γ and ciphertext ct S .

[0371] Specifically, the acquisition unit 611 receives the public key pk transmitted from the public parameter generation device 10 via the communication interface 64. The acquisition unit 611 receives the decryption key sk transmitted from the user secret key generation device 20 via the communication interface 64. Γ The acquisition unit 611 acquires the ciphertext ct sent by the encryption device 30 via the communication interface 64. S The acquisition unit 611 obtains the public key pk and the decryption key sk Γ and ciphertext ct S Write to memory 62.

[0372] (Step S62: Determination Process)

[0373] The decryption unit 612 determines the ciphertext ct S The access structure contained in the attribute information S is whether the decryption key sk Γ The attribute information Γ contained in .

[0374] If the decryption unit 612 accepts the request, it proceeds to step S63. On the other hand, if the request is not accepted, the decryption unit 612 sets the ciphertext ct to be inaccessible. S Decryption is performed and the processing ends.

[0375] (Step S63: Decryption Process)

[0376] The decryption unit 612 uses the decryption key sk Γ Ciphertext ct S Decrypt and generate the session key K.

[0377] Specifically, the decryption unit 612 calculates the index I and the complement coefficient {α i} i∈I .

[0378]

Mathematical formula 151

[0379]

[0380]

[0381] Here, M i is the i-th row of the matrix M.

[0382] The decryption unit 612 calculates the mathematical formula 152 and generates the session key K.

[0383]

Mathematical formula 152

[0384]

[0385] That is, the decryption device 60 executes the Dec algorithm shown in mathematical formula 153.

[0386]

Mathematical formula 153

[0387]

[0388] Reference Figure 18 Explain the re-encrypted ciphertext rct of implementation mode 1 S’ Processing when decryption is performed.

[0389] (Step S71: Acquisition Process)

[0390] The acquisition unit 611 acquires the public key pk and the decryption key sk Γ’ and re-encrypted ciphertext rct S’ Here, the attribute information accepted by the access structure of the attribute information S' is the attribute information Γ', and the decryption key generated by taking the attribute information Γ' as input is the decryption key sk Γ’ .

[0391] Specifically, the acquisition unit 611 receives the public key pk transmitted from the public parameter generation device 10 via the communication interface 64. The acquisition unit 611 receives the decryption key sk transmitted from the user secret key generation device 20 via the communication interface 64. Γ’ The acquisition unit 611 acquires the re-encrypted ciphertext rct sent by the re-encryption device 50 via the communication interface 64. S’The acquisition unit 611 obtains the public key pk and the decryption key sk Γ’ and re-encrypted ciphertext rct S’ Write to memory 62.

[0392] (Step S72: Determination Process)

[0393] The decryption unit 612 determines the re-encrypted ciphertext rct S’ The access structure contained in the attribute information S' is whether the decryption key sk Γ’ The attribute information Γ' contained in .

[0394] If the decryption unit 612 accepts the request, it proceeds to step S73. On the other hand, if the decryption unit 612 does not accept the request, it sets the decryption unit 612 to be unable to re-encrypt the ciphertext rct. S’ Decryption is performed and the processing ends.

[0395] (Step S73: Decryption Process)

[0396] The decryption unit 612 uses the decryption key sk Γ’ Re-encrypt the ciphertext rct S’ Decrypt and generate the session key K.

[0397] Specifically, the decryption unit 612 uses the decryption key sk Γ’ Re-encrypt the ciphertext rct S’ The ciphertext ct contained in S’ Decrypt and generate session key K', according to the re-encrypted ciphertext rct S’ The encryption element K contained in ～ and session key K' to generate session key K.

[0398] This will be described in more detail.

[0399] Using the decryption key sk Γ’ Re-encrypt the ciphertext rct S’ Decrypt and generate the session key K.

[0400] Specifically, the decryption unit 612 calculates the index I and the complement coefficient {α i} i∈I .

[0401]

Mathematical formula 154

[0402]

[0403]

[0404] Here, M i is the i-th row of the matrix M.

[0405] The decryption unit 612 calculates the mathematical formula 155 to generate the session key K'.

[0406]

Mathematical formula 155

[0407]

[0408] The decryption unit 612 decrypts the encrypted element K ～ Multiply by the session key K' to generate the session key K.

[0409] That is, the decryption device 60 executes the Dec algorithm shown in mathematical formula 156.

[0410]

Mathematical formula 156

[0411]

[0412] ***Effects of Implementation Method 1***

[0413] As described above, the encryption system 100 of the first embodiment generates a ciphertext containing only the ciphertext ct as a necessary element. S’ and encryption element K ～ The re-encrypted ciphertext rct S’ In the encryption system 100 of the first embodiment, the encrypted ciphertext rct S’ In the case of re-encryption, the re-encrypted ciphertext rct S’ The only required element is the ciphertext ct S’ and encryption element K ～ That is, even if re-encryption is repeated, the required elements will not increase.

[0414] Therefore, the data size of the ciphertext generated by re-encryption can be made independent of the number of re-encryption times.

[0415] ***Other structures***

[0416] <Variation 1>

[0417] In the first embodiment, each functional component is implemented by software. However, as a first modification, each functional component may be implemented by hardware. Regarding this first modification, the differences from the first embodiment will be described.

[0418] The configuration of the common parameter generating device 10 according to Modification 1 will be described.

[0419] When each functional component is implemented by hardware, the common parameter generating device 10 includes an electronic circuit 15 instead of the processor 11, memory 12, and storage 13. The electronic circuit 15 is a dedicated circuit that implements the functions of each functional component and the memory 12 and storage 13.

[0420] The configuration of the user secret key generation device 20 according to Modification 1 will be described.

[0421] When each functional component is implemented by hardware, the user secret key generation device 20 includes an electronic circuit 25 instead of the processor 21, memory 22, and storage 23. The electronic circuit 25 is a dedicated circuit that implements the functions of each functional component and the memory 22 and storage 23.

[0422] The configuration of the encryption device 30 according to the first modification will be described.

[0423] When each functional component is implemented by hardware, the encryption device 30 includes an electronic circuit 35 instead of the processor 31, memory 32, and storage 33. The electronic circuit 35 is a dedicated circuit that implements the functions of each functional component and the memory 32 and storage 33.

[0424] The structure of the re-encryption key generation device 40 according to Modification 1 will be described.

[0425] When each functional component is implemented by hardware, the re-encryption key generation device 40 includes an electronic circuit 45 instead of the processor 41, memory 42, and storage 43. The electronic circuit 45 is a dedicated circuit that implements the functions of each functional component and the memory 42 and storage 43.

[0426] The structure of the re-encryption device 50 according to Modification 1 will be described.

[0427] When each functional component is implemented by hardware, the re-encryption device 50 includes an electronic circuit 55 instead of the processor 51, memory 52, and storage 53. The electronic circuit 55 is a dedicated circuit that implements the functions of each functional component and the memory 52 and storage 53.

[0428] The structure of the decryption device 60 according to the first modification will be described.

[0429] When each functional component is implemented by hardware, the decryption device 60 includes an electronic circuit 65 instead of the processor 61, memory 62, and storage 63. The electronic circuit 65 is a dedicated circuit that implements the functions of each functional component and the memory 62 and storage 63.

[0430] As the electronic circuits 15, 25, 35, 45, 55, and 65, it is assumed that they are single circuits, complex circuits, programmed processors, parallel programmed processors, logic ICs, GAs (Gate Arrays), ASICs (Application Specific Integrated Circuits), and FPGAs (Field-Programmable Gate Arrays).

[0431] Each functional component may be implemented by one electronic circuit 15 , 25 , 35 , 45 , 55 , 65 , or may be implemented by distributing the functional components across a plurality of electronic circuits 15 , 25 , 35 , 45 , 55 , 65 .

[0432] <Variation 2>

[0433] As a second modification, some of the functional components may be implemented by hardware, and the other functional components may be implemented by software.

[0434] Processors 11, 21, 31, 41, 51, 61, memories 12, 22, 32, 42, 52, 62, storages 13, 23, 33, 43, 53, 63, and electronic circuits 15, 25, 35, 45, 55, 65 are referred to as processing circuits. That is, the functions of each functional component are realized by the processing circuits.

[0435] Label Description

[0436] 100: Encryption system; 10: Public parameter generation device; 11: Processor; 12: Memory; 13: Storage; 14: Communication interface; 15: Electronic circuit; 111: Acquisition unit; 112: Parameter generation unit; 113: Output unit; 20: User secret key generation device; 21: Processor; 22: Memory; 23: Storage; 24: Communication interface; 25: Electronic circuit; 211: Acquisition unit; 212: User secret key generation unit; 213: Output unit; 30: Encryption device; 31: Processor; 32: Memory; 33: Storage; 34: Communication interface; 35: Electronic circuit; 311: Acquisition unit; 312: Ciphertext generation unit; 313: Output unit; 40: Re-encryption key generation device; 41: processor; 42: memory; 43: storage; 44: communication interface; 45: electronic circuit; 411: acquisition unit; 412: re-encryption key generation unit; 413: output unit; 50: re-encryption device; 51: processor; 52: memory; 53: storage; 54: communication interface; 55: electronic circuit; 511: acquisition unit; 512: re-encryption ciphertext generation unit; 513: output unit; 514: ciphertext acquisition unit; 515: key acquisition unit; 60: decryption device; 61: processor; 62: memory; 63: storage; 64: communication interface; 65: electronic circuit; 611: acquisition unit; 612: decryption unit; 613: output unit.

Claims

1. A re-encryption device, comprising: The ciphertext acquisition unit acquires a session key K generated by an encryption algorithm using attribute information S as input and a ciphertext ct obtained by encrypting the session key K. S The ciphertext ct in S ; A key acquisition unit acquires a re-encryption key rk, wherein the re-encryption key rk includes a key that can be used to decrypt the ciphertext ct. S Decryption key sk Γ The converted decryption key sk is generated by setting the random number r Γ ～ The session key K' generated by the encryption algorithm using the attribute information S' as input and the ciphertext ct obtained by encrypting the session key K' S’ , and conversion information generated according to the random number r; The re-encrypted ciphertext generating unit generates a decryption key sk from the converted decryption key sk included in the re-encryption key rk according to the conversion information. Γ ～ For the ciphertext ct S The decrypted information K ' is decrypted and the elements related to the random number r are deleted to generate the encryption element K set with the session key K'. ～ ; as well as Output unit, whose output contains the encryption element K ～ and the ciphertext ct S’ The re-encrypted ciphertext rct S’ , The attribute information S indicates that the ciphertext ct S The attribute information S' indicates the range of attributes that can be decrypted for the re-encrypted ciphertext rct S’ The scope of the attribute to be decrypted, The ciphertext ct S contains the encrypted element c0 as a vector in basis B0, The decryption key sk Γ Contained as base B * The key element k of the vector in 0 * 0, The converted decryption key sk Γ ～ is the base B * 0 and set the random number r. The conversion information is to convert the random number r into the elements of the base B0 and the base B * A is obtained by multiplying the elements A obtained by pairing the elements of 0 r , The re-encrypted ciphertext generating unit generates the ciphertext ct S The encryption element c and the converted decryption key sk Γ ～ The key element k * Perform a pairing operation to generate the decrypted information K^, and divide the decrypted information K^ by A r K' to generate the encryption element K ～ .

2. The re-encryption device according to claim 1, wherein: The ciphertext acquisition unit acquires the ciphertext ct shown in Mathematical Formula 1 S , The key acquisition unit obtains the re-encryption key rk shown in Mathematical Formula 2, The re-encrypted ciphertext generation unit generates the encryption element K shown in Mathematical Formula 3 ～ , 【Mathematical formula 1】 Where M is F q The matrix of (L rows × r columns) on M; ρ is the label attached to each row of the matrix M; c i is the encryption element associated with each integer i where i=1,...,L; pk is the public key; s →T is the vector of L scattered information of s0; s0 is the shared secret information; f →T is a column vector; v → is attribute information; F q is a finite body; 【Mathematical formula 2】 Among them, A r To convert information; k * 0 is the key element; Γ is attribute information; k * t is the key element related to each t; b * 0 is the basis vector; x → t is the attribute of the category assigned to t; 【Mathematical formula 3】 Among them, M i is the i-th row of M; I is the index.

3. An encryption system, comprising: The encryption device generates a session key K generated by an encryption algorithm using attribute information S as input and a ciphertext ct obtained by encrypting the session key K. S The ciphertext ct in S ; The re-encryption key generating device generates a re-encryption key rk, wherein the re-encryption key rk includes a key that can be used to encrypt the ciphertext ct. S Decryption key sk Γ The converted decryption key sk is generated by setting the random number r Γ ～ The session key K' generated by the encryption algorithm using the attribute information S' as input and the ciphertext ct obtained by encrypting the session key K' S ', and conversion information generated according to the random number r; and A re-encryption device, which decrypts the converted decryption key sk contained in the re-encryption key rk according to the conversion information Γ ～ For the ciphertext ct S The decrypted information K ' is decrypted and the elements related to the random number r are deleted to generate the encryption element K set with the session key K'. ～ , the output contains the encrypted element K ～ and the ciphertext ct S 'The re-encrypted ciphertext rct S ', in, The attribute information S indicates that the ciphertext ct S The attribute information S' indicates the range of attributes that can be decrypted for the re-encrypted ciphertext rct S 'The scope of the attribute to be decrypted, The ciphertext ct S contains the encrypted element c0 as a vector in basis B0, The decryption key sk Γ Contained as base B * The key element k of the vector in 0 * 0, The converted decryption key sk Γ ～ is the base B * 0 and set the random number r. The conversion information is to convert the random number r into the elements of the base B0 and the base B * A is obtained by multiplying the elements A obtained by pairing the elements of 0 r , The re-encrypted ciphertext generating unit generates the ciphertext ct S The encryption element c and the converted decryption key sk Γ ～ The key element k * Perform a pairing operation to generate the decrypted information K^, and divide the decrypted information K^ by A r K' to generate the encryption element K ～ .

4. The encryption system according to claim 3, wherein: The encryption device generates the ciphertext ct shown in Mathematical Formula 4 S , The re-encryption key generation device generates the re-encryption key rk shown in Mathematical Formula 5, The re-encryption device generates the encryption element K shown in Mathematical Formula 6 ～ , 【Mathematical formula 4】 Where M is F q The matrix of (L rows × r columns) on ; ρ is the label attached to each row of the matrix M; c i is the encryption element associated with each integer i where i=1,...,L; pk is the public key; s →T is the vector of L scattered information of s0; s0 is the shared secret information; f →T is a column vector; v → is attribute information; F q is a finite body; 【Mathematical formula 5】 Among them, A r To convert information; k * 0 is the key element; Γ is attribute information; k * t is the key element related to each t; b * 0 is the basis vector; x → t is the attribute of the category assigned to t; 【Mathematical formula 6】 Among them, M i is the i-th row of M; I is the index.

5. The encryption system according to claim 4, wherein: The encryption system also has a decryption device which uses a decryption key sk Γ’ The re-encrypted ciphertext rct S 'The ciphertext ct contained in S 'Decrypt and generate the session key K', according to the re-encrypted ciphertext rct S 'The encryption element K contained in ～ and the session key K' to generate the session key K.

6. The encryption system according to claim 5, wherein: The decryption device generates the session key K shown in Mathematical Formula 7, 【Mathematical formula 7】 7. A re-encryption method, wherein: The ciphertext acquisition unit in the re-encryption device acquires a session key K generated by an encryption algorithm using the attribute information S as input and a ciphertext ct obtained by encrypting the session key K. S The ciphertext ct in S , The key acquisition unit in the re-encryption device acquires the re-encryption key rk, which contains the key that can be used to encrypt the ciphertext ct. S Decryption key sk Γ The converted decryption key sk is generated by setting the random number r Γ ～ The session key K' generated by the encryption algorithm using the attribute information S' as input and the ciphertext ct obtained by encrypting the session key K' S ', and conversion information generated according to the random number r, The re-encryption ciphertext generating unit in the re-encryption device generates the converted decryption key sk from the re-encryption key rk according to the conversion information. Γ ～ For the ciphertext ct S The decrypted information K ' is decrypted and the element related to the random number r is deleted, and the encryption element K ' in which the session key K ' is set is generated. ～ , The output unit in the re-encryption device outputs the encrypted element K ～ and the ciphertext ct S’ The re-encrypted ciphertext rct S ', The attribute information S indicates that the ciphertext ct S The attribute information S' indicates the range of attributes that can be decrypted for the re-encrypted ciphertext rct S 'The scope of the attribute to be decrypted, The ciphertext ct S contains the encrypted element c0 as a vector in basis B0, The decryption key sk Γ Contained as base B * The key element k of the vector in 0 * 0, The converted decryption key sk Γ ～ is the base B * 0 and set the random number r. The conversion information is to convert the random number r into the elements of the base B0 and the base B * A is obtained by multiplying the elements A obtained by pairing the elements of 0 r , The re-encrypted ciphertext generating unit generates the ciphertext ct S The encryption element c and the converted decryption key sk Γ ～ The key element k * Perform a pairing operation to generate the decrypted information K^, and divide the decrypted information K^ by A r K' to generate the encryption element K ～ .

8. A computer-readable storage medium storing a re-encryption program, the re-encryption program causing a computer to function as a re-encryption device that performs the following processing: Ciphertext acquisition processing, obtaining the session key K generated by the encryption algorithm using the attribute information S as input and the ciphertext ct obtained by encrypting the session key K S The ciphertext ct in S ; Key acquisition processing, obtaining the re-encryption key rk, the re-encryption key rk contains the key to be able to encrypt the ciphertext ct S Decryption key sk Γ The converted decryption key sk is generated by setting the random number r Γ ～ The session key K' generated by the encryption algorithm using the attribute information S' as input and the ciphertext ct obtained by encrypting the session key K' S ', and conversion information generated according to the random number r; Re-encryption ciphertext generation process, according to the conversion information, from the converted decryption key sk contained in the re-encryption key rk Γ ～ For the ciphertext ct S The decrypted information K ' is decrypted and the elements related to the random number r are deleted to generate the encryption element K set with the session key K'. ～ ; as well as Output processing, the output contains the encrypted element K ～ and the ciphertext ct S’ The re-encrypted ciphertext rct S’ , The attribute information S indicates that the ciphertext ct S The attribute information S' indicates the range of attributes that can be decrypted for the re-encrypted ciphertext rct S’ The scope of the attribute to be decrypted, The ciphertext ct S contains the encrypted element c0 as a vector in basis B0, The decryption key sk Γ Contained as base B * The key element k of the vector in 0 * 0, The converted decryption key sk Γ ～ is the base B * 0 and set the random number r. The conversion information is to convert the random number r into the elements of the base B0 and the base B * A is obtained by multiplying the elements A obtained by pairing the elements of 0 r , In the re-encrypted ciphertext generation process, the ciphertext ct S The encryption element c and the converted decryption key sk Γ ～ The key element k * Perform a pairing operation to generate the decrypted information K^, and divide the decrypted information K^ by A r K' to generate the encryption element K ～ .

Images