Hidden search system and hidden search method

Abstract

The registration device (400) encrypts the plaintext using the new data key to generate ciphertext data, encrypts the registration keyword using the new keyword key to generate an encrypted keyword, and registers the combination of the ciphertext data and the encrypted keyword in the registration database. The search operation device (500) restores the old data key from the new data key and the old keyword key from the new keyword key, encrypts the search keyword using the new keyword key and the old keyword key, respectively, to generate a new search query and an old search query. The data management device (600) searches the registration database for an encrypted keyword that matches either the new search query or the old search query, and outputs an encrypted search result containing the ciphertext data corresponding to the found encrypted keyword. The search operation device decrypts the plaintext from the ciphertext data contained in the encrypted search result using the new data key or the old data key.

Description

Technical Field

[0001] The present invention relates to hidden retrieval. Background Art

[0002] A secure search is a technique for searching encrypted data while it is still encrypted. In other words, a secure search is a technique for searching without decrypting the encrypted data.

[0003] In recent years, anonymous search has attracted attention as a security technology for protecting confidential information in cloud services from being eavesdropped by server administrators and malicious software. In other words, anonymous search has attracted attention as a security technology for managing data on the Internet.

[0004] There are two types of secret key search methods: a common key method and a public key method.

[0005] In the public key method, public key encryption technology is used to limit registrants and searchers.

[0006] In the public key method, public key encryption technology is used to limit searchers but not registrants.

[0007] As part of the hidden search method, during the registration process, the registrant encrypts their data and stores it on the server. During the search process, the searcher encrypts a search keyword and sends it to the server. The server then compares the search keyword with the data to determine if the search keyword matches the data, without decrypting the encrypted search keyword or the stored encrypted data.

[0008] Prior art literature

[0009] Non-patent literature

[0010] Non-patent document 1: Key update function and a common key type search and possible password display method. IEICE Technical Report ISEC2019-54. Summary of the Invention

[0011] Problems to be solved by the invention

[0012] In encryption technology, keys are sometimes updated periodically from the perspective of key leakage risk. Therefore, it is conceivable to also update the key during secret key retrieval.

[0013] If a key is simply replaced with a new one during a hidden search, data encrypted with the old key cannot be retrieved using the new key. Consequently, the old key cannot be discarded and must be kept. Furthermore, the search keyword must be encrypted using all stored keys. Alternatively, data encrypted with the old key must be re-encrypted with the new key to fully address the new key.

[0014] Non-Patent Document 1 discloses a method for performing key update using a common key system that allows specifying a user who can search for each encrypted data.

[0015] For example, a method has been disclosed in which encrypted data is assigned the attribute "Searchable if the key has been updated the i-th time or more" as a user attribute that allows searching. This allows searching with a key updated the i-th time or more. Specifically, if the key updated the i-th time is SK(i), users with SK(i+1), SK(i+2), etc. can search for the encrypted data. However, even if users with SK(i-1), SK(i-2), etc. search for the encrypted data using the matching search key, the encrypted data will not be considered to match the search key.

[0016] Therefore, in the method of Non-Patent Document 1, even if the key is updated, the key size and the encrypted search key size do not increase.

[0017] However, the method of Non-Patent Document 1 determines the key size, encryption search key size, and encrypted data size based on the maximum number of key updates. That is, as the maximum number of key updates increases, the key size, encryption search key size, and encrypted data size also increase.

[0018] An object of the present invention is to make the key size, the encrypted search key size, and the encrypted data size independent of the maximum number of key updates.

[0019] Means for solving problems

[0020] The hidden search system of the present invention comprises: a hidden search data generation unit, which uses a new data key generated by multiple encryption to encrypt plaintext to generate ciphertext data, and uses a new keyword key generated by the multiple encryption to encrypt a registration keyword to generate an encrypted keyword; a registration unit, which registers the combination of the ciphertext data and the encrypted keyword in a registration database; a restoration unit, which restores the old data key from the new data key and the old keyword key from the new keyword key based on the multiple encryption; a search query generation unit, which encrypts the search keyword using the new keyword key and the old keyword key respectively to generate a new search query and an old search query; a search unit, which searches for an encrypted keyword that matches either the new search query or the old search query from the registration database; a search result output unit, which outputs an encrypted search result containing ciphertext data corresponding to the found encrypted keyword; and a decryption unit, which uses the new data key or the old data key to decrypt plaintext from the ciphertext data contained in the encrypted search result.

[0021] Effects of the Invention

[0022] According to the present invention, the key size, the encrypted search key size, and the encrypted data size can be made independent of the maximum number of key updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a diagram showing the configuration of the encrypted content search system 100 in the first embodiment.

[0024] Figure 2 This is a diagram showing the configuration of the master key device 200 in the first embodiment.

[0025] Figure 3 This is a structural diagram of the secret key device 300 in the first embodiment.

[0026] Figure 4 This is a diagram showing the configuration of the registration device 400 in the first embodiment.

[0027] Figure 5 This is a diagram showing the configuration of the search operation device 500 in the first embodiment.

[0028] Figure 6 This is a structural diagram of the data management device 600 in the first embodiment.

[0029] Figure 7 This is a flowchart of the confidentiality search method in the first embodiment.

[0030] Figure 8 This is a flowchart of master key generation ( S110 ) in the first embodiment.

[0031] Figure 9 This is a flowchart of secret key generation ( S120 ) in the first embodiment.

[0032] Figure 10 This is a flowchart of data registration ( S140 ) in the first embodiment.

[0033] Figure 11 This is a diagram showing an example of the registration database 691 in the first embodiment.

[0034] Figure 12 This is a flowchart of the search request ( S150 ) in the first embodiment.

[0035] Figure 13 This is a flowchart of the data search (S160) in the first embodiment.

[0036] Figure 14 This is a flowchart of result decryption (S170) in the first embodiment.

[0037] Figure 15 This is a flowchart of data deletion (S180) in the first embodiment.

[0038] Figure 16 This is a flowchart of data deletion (S190) in the first embodiment.

[0039] Figure 17 This is a diagram showing the configuration of the registration device 400 in the second embodiment.

[0040] Figure 18 This is a flowchart of the confidentiality search method in the second embodiment.

[0041] Figure 19 This is a flowchart of data registration ( S240 ) in the second embodiment.

[0042] Figure 20 This is a diagram showing an example of the search result RES in the second embodiment.

[0043] Figure 21 This is a diagram showing an example of the registration database 691 in the second embodiment.

[0044] Figure 22 This is a flowchart of the search request (S250) in the second embodiment.

[0045] Figure 23 This is a flowchart of the data search (S260) in the second embodiment.

[0046] Figure 24 This is a structural diagram of the data management device 600 in the third embodiment.

[0047] Figure 25 This is a flowchart of the confidentiality search method in the third embodiment.

[0048] Figure 26 This is a flowchart of master key generation ( S310 ) in the third embodiment.

[0049] Figure 27 This is a flowchart of secret key generation (S320) in the third embodiment.

[0050] Figure 28 This is a flowchart of data registration (S340) in the third embodiment.

[0051] Figure 29 This is a flowchart of the search request (S350) in the third embodiment.

[0052] Figure 30 This is a flowchart of data search (S360) in the third embodiment.

[0053] Figure 31 This is a diagram showing the configuration of a registration device 400 in the fourth embodiment.

[0054] Figure 32 This is a structural diagram of the data management device 600 in the fourth embodiment.

[0055] Figure 33 This is a flowchart of the confidentiality search method in the fourth embodiment.

[0056] Figure 34 This is a flowchart of data registration (S440) in the fourth embodiment.

[0057] Figure 35 This is a flowchart of the data search (S460) in the fourth embodiment.

[0058] Figure 36 2 is a hardware configuration diagram of the master key device 200 in the embodiment.

[0059] Figure 37 3 is a hardware configuration diagram of the secret key device 300 in the embodiment.

[0060] Figure 38 It is a hardware configuration diagram of the registration device 400 in the embodiment.

[0061] Figure 39 It is a hardware configuration diagram of the search operation device 500 in the embodiment.

[0062] Figure 40 4 is a hardware configuration diagram of the data management device 600 in the embodiment. DETAILED DESCRIPTION

[0063] In the embodiments and drawings, the same or corresponding elements are denoted by the same reference numerals. The description of elements denoted by the same reference numerals as those already described is omitted or simplified as appropriate. The arrows in the drawings mainly represent data flows or process flows.

[0064] Implementation Method 1

[0065] according to Figures 1 to 16 The encrypted search system 100 will be described.

[0066] ***Description of the structure***

[0067] according to Figure 1 The configuration of the secret key search system 100 will be described.

[0068] The secret key search system 100 includes a master key device 200 , a secret key device 300 , a registration device 400 , a search operation device 500 , and a data management device 600 .

[0069] The devices of the secret key search system 100 communicate with each other via the network 101 .

[0070] according to Figure 2 The structure of the master key device 200 will be described.

[0071] The master key device 200 is a computer having hardware such as a processor 201, a memory 202, an auxiliary storage device 203, and an input / output interface 204. These hardware components are connected to each other via signal lines.

[0072] The processor 201 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 201 is a CPU, a DSP, or a GPU.

[0073] IC is the abbreviation of Integrated Circuit.

[0074] CPU is the abbreviation of Central Processing Unit.

[0075] DSP is the abbreviation of Digital Signal Processor.

[0076] GPU is the abbreviation of Graphics Processing Unit.

[0077] The memory 202 is a volatile or nonvolatile storage device. The memory 202 is also referred to as a main storage device or main memory. For example, the memory 202 is a RAM. The data stored in the memory 202 is stored in the auxiliary storage device 203 as needed.

[0078] RAM is the abbreviation of Random Access Memory.

[0079] The auxiliary storage device 203 is a nonvolatile storage device. For example, the auxiliary storage device 203 is a ROM, an HDD, or a flash memory. The data stored in the auxiliary storage device 203 is loaded into the memory 202 as needed.

[0080] ROM is the abbreviation of Read Only Memory.

[0081] HDD is the abbreviation of Hard Disk Drive.

[0082] The input / output interface 204 is a port for connecting input devices and output devices. For example, the input / output interface 204 is a USB terminal, the input devices are a keyboard and a mouse, and the output device is a display. The input / output of the master key device 200 is performed using the input / output interface 204.

[0083] USB is the abbreviation of Universal Serial Bus.

[0084] The communication device 205 is a receiver and a transmitter. For example, the communication device 205 is a communication chip or a NIC. The master key device 200 communicates using the communication device 205.

[0085] NIC is the abbreviation of Network Interface Card.

[0086] The master key device 200 includes elements such as a reception unit 210, a generation unit 220, and an output unit 230. These elements are implemented by software.

[0087] A master key program for causing the computer to function as the reception unit 210 , the generation unit 220 (master key generation unit), and the output unit 230 (master key output unit) is stored in the auxiliary storage device 203 . The master key program is loaded into the memory 202 and executed by the processor 201 .

[0088] The auxiliary storage device 203 also stores an OS. At least a portion of the OS is loaded into the memory 202 and executed by the processor 201.

[0089] The processor 201 executes the master key program while executing the OS.

[0090] OS is the abbreviation of Operating System.

[0091] The input and output data of the master key program is stored in the storage unit 290 .

[0092] The auxiliary storage device 203 functions as the storage unit 290 . However, storage devices such as the memory 202 , registers in the processor 201 , and cache memory in the processor 201 may function as the storage unit 290 instead of or in addition to the auxiliary storage device 203 .

[0093] The master key device 200 may include a plurality of processors instead of the processor 201. The functions of the processor 201 are shared by the plurality of processors.

[0094] The master key program can be recorded (stored) in a computer-readable form on a non-volatile recording medium such as an optical disk or a flash memory.

[0095] according to Figure 3 The structure of the secret key device 300 will be described.

[0096] The secret key device 300 is a computer having hardware such as a processor 301, a memory 302, an auxiliary storage device 303, an input / output interface 304, and a communication device 305. These hardware components are connected to each other via signal lines.

[0097] The processor 301 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 301 is a CPU, a DSP, or a GPU.

[0098] The memory 302 is a volatile or nonvolatile storage device. The memory 302 is also referred to as a primary storage device or main memory. For example, the memory 302 is a RAM. The data stored in the memory 302 is stored in the auxiliary storage device 303 as needed.

[0099] The auxiliary storage device 303 is a non-volatile storage device. For example, the auxiliary storage device 303 is a ROM, an HDD, or a flash memory. The data stored in the auxiliary storage device 303 is loaded into the memory 302 as needed.

[0100] The input / output interface 304 is a port for connecting input devices and output devices. For example, the input / output interface 304 is a USB terminal, the input devices are a keyboard and a mouse, and the output device is a display. The input and output of the secret key device 300 are performed using the input / output interface 304.

[0101] The communication device 305 is a receiver and a transmitter. For example, the communication device 305 is a communication chip or a NIC. The communication of the secret key device 300 is performed using the communication device 305.

[0102] The secret key device 300 includes elements such as a reception unit 310, a generation unit 320, and an output unit 330. These elements are implemented by software.

[0103] A secret key program for causing the computer to function as the reception unit 310 , the generation unit 320 (secret key generation unit), and the output unit 330 (secret key output unit) is stored in the auxiliary storage device 303 . The secret key program is loaded into the memory 302 and executed by the processor 301 .

[0104] The auxiliary storage device 303 also stores an OS. At least a portion of the OS is loaded into the memory 302 and executed by the processor 301.

[0105] The processor 301 executes the secret key program while executing the OS.

[0106] The input and output data of the secret key program are stored in the storage unit 390 .

[0107] The auxiliary storage device 303 functions as the storage unit 390 . However, a storage device such as the memory 302 , registers in the processor 301 , or a cache memory in the processor 301 may function as the storage unit 390 instead of or in addition to the auxiliary storage device 303 .

[0108] The secret key device 300 may include a plurality of processors instead of the processor 301. The plurality of processors may share the function of the processor 301.

[0109] The secret key program can be recorded (stored) in a computer-readable form on a non-volatile recording medium such as an optical disk or a flash memory.

[0110] according to Figure 4 The configuration of the registration device 400 will be described.

[0111] The registration device 400 is a computer having hardware such as a processor 401, a memory 402, an auxiliary storage device 403, an input / output interface 404, and a communication device 405. These hardware components are connected to each other via signal lines.

[0112] The processor 401 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 401 is a CPU, a DSP, or a GPU.

[0113] The memory 402 is a volatile or non-volatile storage device. The memory 402 is also referred to as a primary storage device or main memory. For example, the memory 402 is a RAM. The data stored in the memory 402 is stored in the auxiliary storage device 403 as needed.

[0114] The auxiliary storage device 403 is a non-volatile storage device. For example, the auxiliary storage device 403 is a ROM, an HDD, or a flash memory. The data stored in the auxiliary storage device 403 is loaded into the memory 402 as needed.

[0115] The input / output interface 404 is a port for connecting input devices and output devices. For example, the input / output interface 404 is a USB terminal, the input devices are a keyboard and a mouse, and the output device is a display. The input and output of the registration device 400 are performed using the input / output interface 404.

[0116] The communication device 405 is a receiver and a transmitter. For example, the communication device 405 is a communication chip or a NIC. The communication of the registration device 400 is performed using the communication device 405.

[0117] The registration device 400 includes elements such as a receiving unit 410, a generating unit 420 (a secure encryption search data generating unit), and a registering unit 430. These elements are implemented by software.

[0118] The generation unit 420 includes elements such as a random number generation unit 421 , a ciphertext data generation unit 422 , a keyword generation unit 423 , and an encryption label generation unit 424 .

[0119] The auxiliary storage device 403 stores a registration program for causing the computer to function as the receiving unit 410 , the generating unit 420 , and the registering unit 430 . The registration program is loaded into the memory 402 and executed by the processor 401 .

[0120] The auxiliary storage device 403 also stores an OS. At least a portion of the OS is loaded into the memory 402 and executed by the processor 401.

[0121] The processor 401 executes the registration program while executing the OS.

[0122] The input and output data of the registration program are stored in the storage unit 490 .

[0123] The auxiliary storage device 403 functions as the storage unit 490 . However, storage devices such as the memory 402 , registers within the processor 401 , and cache memory within the processor 401 may function as the storage unit 490 instead of or in addition to the auxiliary storage device 403 .

[0124] The registration device 400 may include a plurality of processors instead of the processor 401. The plurality of processors may share the function of the processor 401.

[0125] The registration program can be recorded (stored) in a computer-readable format on a non-volatile recording medium such as an optical disk or a flash memory.

[0126] according to Figure 5 The structure of the search operation device 500 will be described.

[0127] The search operation device 500 is a computer having hardware such as a processor 501, a memory 502, an auxiliary storage device 503, an input / output interface 504, and a communication device 505. These hardware components are connected to each other via signal lines.

[0128] The processor 501 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 501 is a CPU, a DSP, or a GPU.

[0129] The memory 502 is a volatile or nonvolatile storage device. The memory 502 is also referred to as a primary storage device or main memory. For example, the memory 502 is a RAM. The data stored in the memory 502 is stored in the auxiliary storage device 503 as needed.

[0130] The auxiliary storage device 503 is a non-volatile storage device. For example, the auxiliary storage device 503 is a ROM, an HDD, or a flash memory. The data stored in the auxiliary storage device 503 is loaded into the memory 502 as needed.

[0131] The input / output interface 504 is a port for connecting input devices and output devices. For example, the input / output interface 504 is a USB terminal, the input devices are a keyboard and a mouse, and the output device is a display. The input and output of the search operation device 500 are performed using the input / output interface 504.

[0132] The communication device 505 is a receiver and a transmitter. For example, the communication device 505 is a communication chip or a NIC. The communication of the search operation device 500 is performed using the communication device 505.

[0133] The search operation device 500 includes elements such as a receiving unit 510, a restoring unit 520, a generating unit 530 (search query generating unit), a requesting unit 540, a decrypting unit 550, and an output unit 560 (search result output unit). These elements are implemented by software.

[0134] The auxiliary storage device 503 stores a search operation program for causing the computer to function as the receiving unit 510, the restoring unit 520, the generating unit 530, the requesting unit 540, the decrypting unit 550, and the outputting unit 560. The search operation program is loaded into the memory 502 and executed by the processor 501.

[0135] The auxiliary storage device 503 also stores an OS. At least a portion of the OS is loaded into the memory 502 and executed by the processor 501.

[0136] The processor 501 executes the search operation program while executing the OS.

[0137] The input and output data of the search operation program are stored in the storage unit 590 .

[0138] The auxiliary storage device 503 functions as the storage unit 590 . However, storage devices such as the memory 502 , registers in the processor 501 , and cache memory in the processor 501 may function as the storage unit 590 instead of or in addition to the auxiliary storage device 503 .

[0139] The search operation device 500 may include a plurality of processors instead of the processor 501. The plurality of processors may share the function of the processor 501.

[0140] The search operation program can be recorded (stored) in a computer-readable form on a non-volatile recording medium such as an optical disk or a flash memory.

[0141] according to Figure 6 The structure of the data management device 600 will be described.

[0142] The data management device 600 is a computer having hardware such as a processor 601, a memory 602, an auxiliary storage device 603, an input / output interface 604, and a communication device 605. These hardware components are connected to each other via signal lines.

[0143] The processor 601 is an IC that performs arithmetic processing and controls other hardware. For example, the processor 601 is a CPU, a DSP, or a GPU.

[0144] The memory 602 is a volatile or non-volatile storage device. The memory 602 is also referred to as a primary storage device or main memory. For example, the memory 602 is a RAM. The data stored in the memory 602 is stored in the auxiliary storage device 603 as needed.

[0145] The auxiliary storage device 603 is a non-volatile storage device. For example, the auxiliary storage device 603 is a ROM, an HDD, or a flash memory. The data stored in the auxiliary storage device 603 is loaded into the memory 602 as needed.

[0146] The input / output interface 604 is a port for connecting input devices and output devices. For example, the input / output interface 604 is a USB terminal, the input devices are a keyboard and a mouse, and the output device is a display. The input and output of the data management device 600 are performed using the input / output interface 604.

[0147] The communication device 605 is a receiver and a transmitter. For example, the communication device 605 is a communication chip or a NIC. The communication of the data management device 600 is performed using the communication device 605.

[0148] The data management device 600 includes elements such as a reception unit 610, a search unit 620, an output unit 630 (encrypted search result output unit), and a management unit 640. These elements are implemented by software.

[0149] The search unit 620 includes elements such as a checking unit 621 and an extraction unit 622 .

[0150] The auxiliary storage device 603 stores a data management program for causing the computer to function as the receiving unit 610, the searching unit 620, the output unit 630, and the managing unit 640. The data management program is loaded into the memory 602 and executed by the processor 601.

[0151] The auxiliary storage device 603 also stores an OS. At least a portion of the OS is loaded into the memory 602 and executed by the processor 601.

[0152] The processor 601 executes the data management program while executing the OS.

[0153] The input and output data of the data management program are stored in the storage unit 690 .

[0154] The auxiliary storage device 603 functions as the storage unit 690 . However, storage devices such as the memory 602 , registers within the processor 601 , and cache memory within the processor 601 may function as the storage unit 690 instead of or in addition to the auxiliary storage device 603 .

[0155] The data management device 600 may include a plurality of processors instead of the processor 601. The plurality of processors may share the function of the processor 601.

[0156] The data management program can be recorded (stored) in a computer-readable format on a non-volatile recording medium such as an optical disk or a flash memory.

[0157] ***Description of the action***

[0158] The steps of the operation of the confidentiality search system 100 correspond to the confidentiality search method. In addition, the steps of the operation of the confidentiality search system 100 correspond to the steps of the processing based on the confidentiality search program.

[0159] according to Figure 7 The concealed information search method is described.

[0160] In step S110 , the master key device 200 generates a master key MK and public parameters PP.

[0161] according to Figure 8 The steps of master key generation ( S110 ) will be described.

[0162] Master key generation ( S110 ) is a process performed by the master key device 200 .

[0163] In step S111 , the reception unit 210 receives the key length BIT and the upper limit MAX.

[0164] The key length BIT is the length of the master key MK and is represented by a positive integer (natural number).

[0165] The upper limit MAX is the maximum number of times the secret key SK is updated, and is represented by a positive integer.

[0166] In step S112 , the generation unit 220 generates a master key MK based on the key length BIT.

[0167] Specifically, the generator 220 generates a random number R having the same bit length as the key length BIT. The generated random number R becomes the master key MK. The master key MK is represented as follows.

[0168] MK=R

[0169] Furthermore, the generator 220 generates a public parameter PP using the upper limit MAX. The public parameter PP is generated as follows.

[0170] First, the generation unit 220 selects a common key encryption method E. A specific example of the common key encryption method E is AES-CTR or AES-CBC.

[0171] Furthermore, the generation unit 220 selects an encryption function F. The encryption function F is a cryptographic hash function. Specific examples of the encryption function F are SHA-256 or SHA-512.

[0172] Then, the generator 220 generates parameters including the identifier of the public key encryption method E, the identifier of the encryption function F, and the upper limit MAX. The generated parameters become public parameters PP.

[0173] The public parameter PP is represented as follows.

[0174] PP=(E,F,MAX)

[0175] AES is the abbreviation of Advanced Encryption Standard.

[0176] CTR is the abbreviation of Counter.

[0177] CBC is the abbreviation of Cipher Block Chaining.

[0178] SHA is the abbreviation of Secure Hash Algorithm.

[0179] In step S113 , the generation unit 220 stores the master key MK and the public parameter PP in the storage unit 290 for safekeeping.

[0180] In step S114 , the output unit 230 outputs the master key MK.

[0181] For example, the output unit 230 transmits the master key MK to the secret key device 300 using the communication device 205 .

[0182] The master key MK is used to generate the secret key SK.

[0183] Furthermore, the output unit 230 outputs the public parameter PP.

[0184] For example, the output unit 230 uses the communication device 205 to transmit the public parameter PP to the secret key device 300 , the registration device 400 , the search operation device 500 , and the data management device 600 .

[0185] The public parameters PP are used for generation of the secret key SK, update of the secret key SK, registration of encrypted data C, retrieval of encrypted data C, decryption of encrypted data C, and generation of a retrieval query SQ.

[0186] return Figure 7 , and the description continues from step S120.

[0187] In step S120 , the secret key device 300 generates a secret key SK.

[0188] The secret key SK is a key of the public key system (public key).

[0189] according to Figure 9 The steps of secret key generation ( S120 ) will be described.

[0190] Secret key generation ( S120 ) is a process performed by the secret key device 300 .

[0191] In step S121 , the reception unit 310 receives the master key MK and the public parameters PP, and stores the master key MK and the public parameters PP in the storage unit 390 for safekeeping.

[0192] However, if the master key MK and the public parameters PP have already been stored, step S121 is unnecessary.

[0193] In step S122 , the reception unit 310 receives the key generation number i, and stores the key generation number i in the storage unit 390 for safekeeping.

[0194] However, when the secret key SK(i-1) is stored, the key generation number i is obtained by adding 1 to the key generation number (i-1) of the secret key SK(i-1), and therefore step S122 is unnecessary.

[0195] The key generation number i is a number that identifies the generation of the secret key SK and is represented by a positive integer.

[0196] The secret key SK(i) is a secret key SK of a generation identified by a key generation number i. When the key generation number i is not specified, the secret key is simply referred to as "SK".

[0197] In step S123 , the generation unit 320 generates a secret key SK(i) using the master key MK, the public parameter PP, and the key generation number i.

[0198] The secret key SK(i) contains the data key DK(i), the keyword key KK(i) and the key generation number i. When the key generation number i is not specified, the data key is abbreviated as "DK" and the keyword key is abbreviated as "KK".

[0199] The data key DK is a secret key for data.

[0200] The keyword key KK is a secret key for the keyword.

[0201] The secret key SK(i) is represented as follows.

[0202] SK(i)=(DK(i),KK(i),i)

[0203] The data key DK(i) and the keyword key KK(i) are represented as follows.

[0204] DK(i)=F (MAX-i+1) (R||0)

[0205] KK(i)=F (MAX-i+1) (R||1))

[0206] The identifier of the encryption function F is contained in the public parameters PP.

[0207] F n (X) means that the encryption function F is repeated n times on the input value X, which means multiple encryption. The input value X becomes the input value of the encryption function F for the first time, and the output value of the previous encryption function F becomes the input value of the next encryption function F. n (X) is represented as follows. n (X)=F(F(…(F(X))…))

[0208] The upper limit MAX is included in the public parameter PP.

[0209] “R” is equal to the master key MK.

[0210] “||” means data concatenation.

[0211] However, the data key DK(i) and the keyword key KK(i) may be the same value. For example, the data key DK(i) and the keyword key KK(i) may be expressed as follows.

[0212] DK(i)=KK(i)=F (MAX-i+1) (R)

[0213] The generation unit 320 may delete the master key MK, the public parameter PP, and the key generation number i from the storage unit 390 .

[0214] In step S124 , the generation unit 320 stores the secret key SK(i) in the storage unit 390 for safekeeping.

[0215] When the secret key SK(j) is stored in the storage unit 390, the generation unit 320 may delete the secret key SK(j) from the storage unit 390. The secret key SK(j) is a secret key of a generation earlier than the i-th generation. "j" is an integer less than (i-1).

[0216] In step S125 , the output unit 330 outputs the secret key SK(i).

[0217] For example, the output unit 330 transmits the secret key SK(i) to the registration device 400 and the search operation device 500 using the communication device 305 .

[0218] The secret key SK is used for the generation of encrypted data C, the generation of the search query SQ, and the decryption of the encrypted data C.

[0219] return Figure 7 , and the description continues from step S130.

[0220] Step S130 , step S140 , steps S150 to S170 , step S180 or step S190 are repeatedly performed.

[0221] When the secret key SK is updated, the process proceeds to step S130.

[0222] For example, the secret key device 300 periodically compares the usage period of the secret key SK with a reference period. If the usage period of the secret key SK exceeds the reference period, the process proceeds to step S130.

[0223] For example, when the administrator determines that the secret key SK has been leaked and inputs a command to update the secret key SK into the secret key device 300 , the process proceeds to step S130 .

[0224] When the encrypted data C is registered, the process proceeds to step S140.

[0225] For example, when the user inputs a registration command for the encrypted data C into the registration device 400 , the process proceeds to step S140 .

[0226] In the case where the encrypted data C is retrieved, the process proceeds to step S150.

[0227] For example, when the user inputs a search command for encrypted data C into the search operation device 500, the process proceeds to step S150.

[0228] In the case where the encrypted data C is deleted according to the file name, the process proceeds to step S180.

[0229] When the encrypted data C is deleted according to the key generation number i, the process proceeds to step S190.

[0230] In step S130, the secret key device 300 updates the secret key SK. In other words, the secret key device 300 generates a new generation of secret key SK. Specifically, if the current secret key SK is secret key SK(i), the secret key device 300 generates secret key SK(i+1).

[0231] The method of generating the secret key SK is as described in the secret key generation (S120).

[0232] In step S140 , the registration device 400 generates encrypted data C and registers the encrypted data C in the data management device 600 .

[0233] according to Figure 10 The procedure of data registration ( S140 ) will be described.

[0234] Data registration ( S140 ) is a process performed by the registration device 400 .

[0235] In step S141 , the reception unit 410 receives the secret key SK(i) and the public parameter PP, and stores the secret key SK(i) and the public parameter PP in the storage unit 490 for safekeeping.

[0236] If the secret key SK(i) and the public parameter PP are already stored, step S141 is unnecessary.

[0237] When the secret key SK(j) is stored in the storage unit 490, the reception unit 410 may delete the secret key SK(j) from the storage unit 490. The secret key SK(j) is a secret key of a generation earlier than the i-th generation. "j" is an integer less than (i-1).

[0238] In step S142 , the accepting unit 410 accepts the plaintext M.

[0239] Plaintext M is unencrypted data.

[0240] The plain text M includes the file name File(M) as metadata.

[0241] It is also possible to accept a plurality of plaintexts M. In this case, steps S143 to S146 are executed for each plaintext M.

[0242] In step S143 , the random number generation unit 421 generates a data random number CR and a key random number KR.

[0243] The data random number CR is a random number used to encrypt the plaintext M.

[0244] The keyword random number KR is a random number used to encrypt a registration keyword W described later.

[0245] Specifically, the random number generator 421 generates a random number for use in the public key encryption method E or the secret key search method. This random number is called the data random number CR. The identifier of the public key encryption method E is included in the public parameters PP. For example, if the public key encryption method E is AES-CTR, the IV is the data random number CR.

[0246] Furthermore, the random number generator 421 generates one or more random numbers used in the encrypted search method. The generated random numbers serve as keyword random numbers KR.

[0247] In S144 , the ciphertext data generation unit 422 uses the secret key SK(i), the public parameter PP, and the data random number CR to encrypt the plaintext M, thereby generating ciphertext data CT(i).

[0248] The ciphertext data CT(i) includes the ciphertext C and the key generation number i.

[0249] The ciphertext C is the encrypted plaintext M.

[0250] The ciphertext data CT(i) is represented as follows.

[0251] CT(i)=(C,i)

[0252] For example, ciphertext C is represented as follows.

[0253] C=E(DK(i),M,CR)

[0254] E(X) represents the output value of the encryption function for the input value X.

[0255] The data key DK(i) is contained in the secret key SK(i).

[0256] In step S145 , the keyword generating unit 423 generates a registration keyword W.

[0257] The registered keyword W is a keyword related to the plaintext M.

[0258] Specifically, the keyword generating unit 423 performs morphological analysis or natural language processing on the plain text M, thereby extracting keywords from the plain text M. The extracted keywords become registered keywords W.

[0259] A plurality of registered keywords W may be generated. In this case, an encrypted label described below is generated for each registered keyword W.

[0260] Instead of the keyword generating unit 423 generating the registration keyword W, the receiving unit 410 may receive the registration keyword W input to the registration device 400 via the input / output interface 404 .

[0261] In step S146 , the encrypted label generation unit 424 encrypts the registration keyword W using the secret key SK(i), the public parameter PP, and the keyword random number KR, and generates encrypted label data ET(i).

[0262] The encrypted tag data ET(i) includes the encrypted tag ET and the key generation number i.

[0263] The encryption tag ET contains the encryption keyword EW and the keyword random number KR.

[0264] The encrypted keyword EW is the registered keyword W that has been encrypted.

[0265] The key generation number i is contained in the secret key SK(i).

[0266] The encrypted tag data ET(i) is represented as follows.

[0267] ET(i)=(ET,i)

[0268] ET=(EW,KR)

[0269] For example, the encrypted keyword EW is represented as follows: In this case, the encrypted label generation unit 424 encrypts the registration keyword W using the keyword key KK(i), and encrypts the encrypted registration keyword W using the keyword random number KR. Thus, the encrypted keyword EW is generated.

[0270] EW=F(F(KK(i)||W)||KR)

[0271] The identifier of the encryption function F is contained in the public parameters PP.

[0272] The keyword key KK(i) is contained in the secret key SK(i).

[0273] When there are a plurality of registered keywords W, the encrypted tag ET includes the encrypted tag of each registered keyword W.

[0274] For example, when there are registered keywords W1 and W2, the encrypted tag ET is represented as follows.

[0275] ET=(F(F(KK(i)||W1)||KR),F(F(KK(i)||W2)||KR),KR)

[0276] In step S147 , the registration unit 430 generates the encrypted search data SE(i).

[0277] The secret search data SE(i) includes the file name File(M), the ciphertext data CT(i), the encrypted tag data ET(i) and the key generation number i.

[0278] That is, the secret search data SE(i) is a set of the file name File(M), the ciphertext data CT(i), the encrypted tag data ET(i), and the key generation number i.

[0279] The encrypted search data SE(i) is represented as follows.

[0280] SE(i)=(File(M),CT(i),ET(i),i)

[0281] In step S148 , the registration unit 430 registers the confidentiality search data SE(i) in the registration database 691 .

[0282] The registration database 691 is stored in the storage unit 690 of the data management device 600 and is kept.

[0283] Specifically, the registration unit 430 transmits the encrypted search data SE(i) to the data management device 600 using the communication device 405. In the data management device 600, the reception unit 610 receives the encrypted search data SE(i) using the communication device 605. Then, the management unit 640 registers the encrypted search data SE(i) in the registration database 691.

[0284] Figure 11 An example of the registration database 691 is shown.

[0285] exist Figure 11 In the example, one row of data corresponds to one encrypted search data SE(i).

[0286] In data of one line, a file name File(M), ciphertext data CT(i), encryption tag ET(i), and key generation number i correspond to each other.

[0287] return Figure 7 , step S150 is explained.

[0288] In step S150 , the search operation device 500 generates a search query SQ and transmits the search query SQ to the data management device 600 .

[0289] according to Figure 12 The steps of the search request (S150) will be described.

[0290] The search request ( S150 ) is a process executed by the search operation device 500 .

[0291] In step S151 , the reception unit 510 receives the secret key SK(i) and the public parameter PP, and stores the secret key SK(i) and the public parameter PP in the storage unit 290 for safekeeping.

[0292] If the secret key SK(i) and the public parameter PP are already stored, step S151 is unnecessary.

[0293] When the secret key SK(j) is stored in the storage unit 590, the reception unit 510 may delete the secret key SK(j) from the storage unit 590. The secret key SK(j) is a secret key of a generation earlier than the i-th generation. "j" is an integer less than (i-1).

[0294] In step S152 , the receiving unit 510 receives the search keyword w.

[0295] In step S153 , the restoration unit 520 restores the secret key SK(1_j) using the secret key SK(i) and the public parameter PP.

[0296] “1_j” means an integer greater than or equal to 1 and less than or equal to (i-1).

[0297] The secret key SK(1_j) is represented as follows.

[0298] SK(1_j)=(SK(1),…,SK(i-2),SK(i-1))

[0299] The secret key SK(1_j) is restored as follows.

[0300] First, the restoration unit 520 restores the data key DK(1_j).

[0301] The data key DK(1_j) is represented as follows.

[0302] DK(1_j)=(DK(1),…,DK(i-2),DK(i-1))

[0303] DK(i-1)=F(DK(i))=F(F (MAX-i+1) (R||0))

[0304] DK(i-2)=F 2 (DK(i))=F 2 (F (MAX-i+1) (R||0))

[0305] DK(1)=F (i-1) (DK(i))=F (i-1) (F (MAX-i+1) (R||0))

[0306] DK(i-3) to DK(2) are calculated in the same manner as DK(i-2).

[0307] The data key DK(i) is contained in the secret key SK(i).

[0308] The encryption function F is contained in the public parameters PP.

[0309] The upper limit MAX is included in the public parameter PP.

[0310] Furthermore, the restoration unit 520 restores the keyword key KK(1_j).

[0311] The keyword key KK(1_j) is represented as follows.

[0312] KK(1_j)=(KK(1),…,KK(i-2),KK(i-1))

[0313] KK(i-1)=F(KK(i))=F(F (MAX-i+1) (R||1))

[0314] KK(i-2)=F 2 (KK(i))=F 2 (F (MAX-i+1) (R||1))

[0315] KK(1)=F (i-1) (DK(i))=F (i-1) (F (MAX-i+1) (R||1))

[0316] KK(i-3) to KK(2) are calculated in the same manner as KK(i-2).

[0317] The keyword key KK(i) is contained in the secret key SK(i).

[0318] Then, the restoration unit 520 generates secret keys SK for each of the first to (i-1)th generations.

[0319] The secret key SK(n) is represented as follows: The secret key SK(n) is the secret key SK of the nth generation.

[0320] SK(n)=(DK(n),KK(n),n)

[0321] In step S154 , the generation unit 530 generates a search query SQ( 1_i ) using the secret key SK( 1_i ), the public parameter PP, and the search keyword w.

[0322] “1_i” means an integer greater than or equal to 1 and less than or equal to i.

[0323] Here, the secret key SK(1_i) is represented as follows.

[0324] SK(1_i)=(SK(1),…,SK(i))

[0325] The search query SQ(1_i) includes search queries SQ of each generation from the first generation to the i-th generation.

[0326] The search query SQ(1_i) is represented as follows.

[0327] SQ(1_i)=(SQ(1),…,SQ(i))

[0328] The n-th generation search query SQ is the search keyword w encrypted using the n-th generation secret key SK.

[0329] For example, the search query SQ(n) is represented as follows: The search query SQ(n) is a search query SQ of the nth generation.

[0330] SQ(n)=F(KK(n)||w)

[0331] The encryption function F is contained in the public parameters PP.

[0332] In step S155 , the request unit 540 transmits the search query SQ( 1_i ) to the data management device 600 using the communication device 505 .

[0333] return Figure 7 , step S160 is explained.

[0334] In step S160 , the data management device 600 searches for encrypted data C that matches the search query SQ.

[0335] according to Figure 13 The steps of data retrieval (S160) will be described.

[0336] The data search ( S160 ) is a process performed by the data management device 600 .

[0337] In step S161 , the receiving unit 610 receives the public parameter PP and stores the public parameter PP in the storage unit 690 for safekeeping.

[0338] However, if the public parameters PP have already been stored, step S161 is unnecessary.

[0339] In step S162 , the receiving unit 610 receives the search query SQ( 1_i ).

[0340] In step S163 , the checking unit 621 checks the search query SQ( 1_i ) with each encrypted search data SE(n) in the registration database 691 to search for the encrypted search data SE(n) that matches the search query SQ( 1_i ).

[0341] The encrypted search data SE(n) means the encrypted search data SE including the key generation number n.

[0342] The collating unit 621 collates the search query SQ(1_i) and the encrypted search data SE(n) as follows.

[0343] First, the checking unit 621 determines whether the key generation number n included in the encrypted search data SE(n) is equal to or smaller than i.

[0344] When the key generation number n is equal to or less than i, the verification unit 621 extracts the encrypted tag ET from the encrypted tag data ET(n) in the secret search data SE(n), and extracts the encryption key EW and the key random number KR from the extracted encrypted tag ET.

[0345] Next, the checking unit 621 generates a checking tag Tg(k) according to the search query SQ(k) included in the search query SQ(1_i) using the search query SQ(k) and the extracted keyword random number KR. "k" is an integer greater than or equal to 1 and less than or equal to i.

[0346] The verification tag Tg(k) is represented as follows.

[0347] Tg(k)=F(SQ(k)||KR)

[0348] Then, the checking unit 621 compares the checking tag Tg(k) with the extracted encrypted keyword EW according to the search query SQ(k) included in the search query SQ(1_i).

[0349] When any verification tag Tg(k) matches the extracted encrypted keyword EW, the encrypted search data SE(n) matches the search query SQ(1_i).

[0350] Furthermore, when there are a plurality of encrypted keywords EW, if any verification tag Tg(k) matches any encrypted keyword EW, the encrypted search data SE(n) matches the search query SQ(1_i).

[0351] The encrypted search data SE(n) that matches the search query SQ(1_i) is referred to as “corresponding encrypted search data SE(n).” The corresponding encrypted search data SE(n) includes the encrypted tag data ET(n) that matches the search query SQ(1_i).

[0352] In step S164, the extraction unit 622 extracts the ciphertext data CT(n) and the key generation number n from each corresponding secret search data SE(n).

[0353] In step S165, the output unit 630 generates data including a set of pairs of ciphertext data CT(n) and key generation number n. The generated data becomes the encrypted search result {(CT(n), n)}. {X} represents the set of data X.

[0354] In step S166 , the output unit 630 transmits the encrypted search result {(CT(n), n)} to the search operation device 500 using the communication device 605 .

[0355] return Figure 7 , step S170 is explained.

[0356] In step S170 , the search operation device 500 decrypts the plaintext M from the encrypted data C that was hit in the search.

[0357] according to Figure 14 The procedure of decrypting the result ( S170 ) will be described.

[0358] Result decryption ( S170 ) is a process performed by the search operation means 500 .

[0359] In step S171 , the request unit 540 receives the encrypted search result {(CT(n), n)} using the communication device 505 .

[0360] In step S172 , the decryption unit 550 uses the secret key SK(n) and the public parameter PP to decrypt the encrypted search result {(CT(n), n)} to obtain the search result {M}.

[0361] The retrieval result {M} is the set of plaintext M.

[0362] For example, the plain text M included in the search result {M} is represented as follows.

[0363] M=D(DK(n),CT(n))

[0364] "D" is a decryption function used in the public key encryption method E.

[0365] The identifier of the public key encryption method E is contained in the public parameters PP.

[0366] The data key DK(n) is contained in the secret key SK(n).

[0367] However, when the encrypted search result {(CT(n), n)} is an empty set, that is, when there is no (CT(n), n) hit in the search using the search query SQ, step S172 is not required.

[0368] In step S173 , the output unit 560 outputs the search result {M}.

[0369] For example, the output unit 560 displays the search result {M} on the display via the input / output interface 504 .

[0370] However, when the encrypted search result {(CT(n), n)} is an empty set, the output unit 560 outputs a search error message.

[0371] The search error message indicates that the plaintext M that was hit in the hidden search does not exist.

[0372] return Figure 7 , step S180 is explained.

[0373] In step S180, the data management device 600 deletes the encrypted data C corresponding to the deletion file name.

[0374] according to Figure 15 The procedure of data deletion (S180) will be described.

[0375] Data deletion (S180) is a process executed by the registration device 400 and the data management device 600. However, instead of the registration device 400, the search operation device 500 or other devices may be used.

[0376] In step S181 , the reception unit 410 of the registration device 400 receives a deletion file name.

[0377] For example, the receiving unit 410 receives a deletion file name input to the registration device 400 via the input / output interface 404. Alternatively, the receiving unit 410 may receive a deletion file name from an application program executed in the registration device 400.

[0378] In step S182 , the registration unit 430 of the registration device 400 transmits the deletion file name to the data management device 600 using the communication device 405 .

[0379] In step S183 , the reception unit 610 of the data management device 600 receives the deletion file name using the communication device 605 .

[0380] In step S184 , the management unit 640 of the data management device 600 deletes the encrypted search data SE corresponding to the deletion file name from the registration database 691 .

[0381] Specifically, the management unit 640 deletes the encrypted search data SE including the file name File(M) which is the same as the deletion file name.

[0382] return Figure 7 , step S190 is explained.

[0383] In step S190 , the data management device 600 deletes the encrypted data C corresponding to the deletion key generation number.

[0384] according to Figure 16 The procedure of data deletion (S190) will be described.

[0385] Data deletion (S190) is a process executed by the registration device 400 and the data management device 600. However, instead of the registration device 400, the search operation device 500 or other devices may be used.

[0386] In step S191 , the reception unit 410 of the registration device 400 receives the deletion key generation number.

[0387] For example, the receiving unit 410 receives the deletion key generation number input to the registration device 400 via the input / output interface 404. Alternatively, the receiving unit 410 may receive the deletion key generation number from an application executed in the registration device 400.

[0388] In step S192 , the registration unit 430 of the registration device 400 transmits the deletion key generation number to the data management device 600 using the communication device 405 .

[0389] In step S193 , the reception unit 610 of the data management device 600 receives the deletion key generation number using the communication device 605 .

[0390] In step S194 , the management unit 640 of the data management device 600 deletes the encrypted search data SE corresponding to the deletion key generation number from the registration database 691 .

[0391] Specifically, the management unit 640 deletes the encrypted search data SE including the same key generation number as the deleted key generation number.

[0392] ***Effects of Implementation Method 1***

[0393] In the first and subsequent embodiments, attention is paid to the public key method.

[0394] According to Embodiment 1, the encryption tag ET can be used to update the key in a public key-based secret search. Furthermore, the old secret key SK(1_j) can be restored from the new secret key SK(i), and the search query SQ(1_i) can be generated using all the secret keys SK(1_i).

[0395] According to the first embodiment, it is possible to configure the key size, the encrypted search key size, and the encrypted data size to be independent of the maximum number of key updates.

[0396] In the first embodiment, the old secret key is restored from the new secret key by multiple encryption using an encryption function such as a hash function. This allows the generation of a key and encrypted data whose size does not depend on the maximum number of key updates.

[0397] According to the first embodiment, the following effects are achieved.

[0398] Keyword search can be performed without decrypting the ciphertext.

[0399] Each time a key update is performed, a different key can be generated.

[0400] The old key can be recovered from the new key. Therefore, the old key can be discarded after the key is updated.

[0401] Encrypted data can be generated independently of the current number of key updates and the maximum number of key updates. In other words, encrypted data can be generated whose size does not depend on these numbers.

[0402] By storing the key generation number of the secret key used to generate encrypted data in association with the encrypted data, it is possible to narrow down the range of encrypted data to be searched, that is, to perform keyword searches efficiently.

[0403] Implementation Method 2

[0404] Regarding the method of using the encryption index EI instead of the encryption tag ET, according to Figures 17 to 23The differences from Implementation 1 will be mainly described.

[0405] ***Description of the structure***

[0406] The structure of the hidden code search system 100 is the same as that of the first embodiment (see Figure 1 ).

[0407] However, a part of the configuration of the registration device 400 is different from that in the first embodiment.

[0408] according to Figure 17 The configuration of the registration device 400 will be described.

[0409] The registration device 400 includes elements such as a search result generating unit 425 and an encrypted index generating unit 426 in place of the encrypted label generating unit 424 in the first embodiment.

[0410] ***Description of the action***

[0411] according to Figure 18 The concealed information search method is described.

[0412] Step S110 , step S120 , step S130 , step S170 , step S180 , and step S190 are the same as those described in the first embodiment.

[0413] Next, step S240 , step S250 , and step S260 are described.

[0414] according to Figure 19 The procedure of data registration (S240) will be described.

[0415] Data registration ( S240 ) corresponds to data registration ( S140 ) in the first embodiment.

[0416] In step S241 , the reception unit 410 receives the secret key SK(i) and the public parameter PP.

[0417] Step S241 is the same as step S141 in the first embodiment.

[0418] In step S242 , the accepting unit 410 accepts the plaintext M.

[0419] Step S242 is the same as step S142 in the first embodiment.

[0420] In step S243 , the random number generation unit 421 generates a data random number CR and a key random number KR.

[0421] Step S243 is the same as step S143 in the first embodiment.

[0422] In step S244, the ciphertext data generation unit 422 uses the secret key SK(i), the public parameter PP, and the data random number CR to encrypt the plaintext M, thereby generating ciphertext data CT(i).

[0423] Step S244 is the same as step S144 in the first embodiment.

[0424] In step S245 , the keyword generating unit 423 generates a registration keyword W.

[0425] Step S245 is the same as step S145 in the first embodiment.

[0426] Furthermore, it is assumed that one or more plaintexts M are accepted in step S242 , one or more ciphertext data CT(i) are generated in step S244 , and one or more registration keywords W are generated in step S245 .

[0427] In step S246 , the search result generating unit 425 generates a search result RES based on one or more registered keywords W.

[0428] Specifically, the search result generating unit 425 generates data including one or more file names File(M) corresponding to the registration keyword W for each registration keyword W. The generated data is the search result RES.

[0429] The search result RES is shown as follows.

[0430] RES={(kw,res)}

[0431] "kw" is a keyword, which is equivalent to the registered keyword W.

[0432] "res" is an identifier, which is equivalent to the file name File(M).

[0433] like Figure 20 As shown, the search result RES has a transposed index structure, that is, a structure capable of indexing the hit identifier in reverse order from the keyword.

[0434] Figure 20 An example of the search result RES is shown.

[0435] exist Figure 20 In the search result RES, for each keyword, the keyword and one or more file names are associated with each other.

[0436] return Figure 19 , and continue the description from step S247.

[0437] In step S247, the encrypted index generator 426 encrypts the search result RES using the secret key SK(i), the public parameter PP, and the keyword random number KR, thereby generating encrypted index data EI(i).

[0438] The encrypted index data EI(i) includes the encryption index EI and the key generation number i.

[0439] The encrypted index EI is the encrypted search result RES, and includes the encrypted keyword key and the encrypted identifier val.

[0440] The encrypted keyword key is the encrypted keyword kw. The keyword kw is encrypted using the keyword key KK(i).

[0441] The encrypted identifier val is the encrypted identifier res. The identifier res is encrypted using the encrypted keyword kw and the keyword random number KR.

[0442] For example, the encrypted index data EI(i) is represented as follows.

[0443] EI={(key,val)}

[0444] key=F(KK(i)||0||kw)

[0445] val=E(F(KK(i)||1||kw),res,KR)

[0446] In step S248 , the registration unit 430 generates the encrypted search data SE(i).

[0447] The hidden search data SE(i) includes the file name File(M), the ciphertext data CT, the encryption index data EI(i) and the key generation number i.

[0448] That is, the secret search data SE(i) is a set of the file name File(M), the ciphertext data CT, the encryption index data EI(i), and the key generation number i.

[0449] The encrypted search data SE(i) is represented as follows.

[0450] SE(i)=(File(M),CT(i),EI(i),i)

[0451] In this way, the encrypted search data EI(i) includes the encrypted index data EI(i) instead of the encrypted tag data ET(i) in the first embodiment.

[0452] In step S249 , the registration unit 430 registers the confidentiality search data SE(i) in the registration database 691 .

[0453] Step S249 is the same as step S148 in the first embodiment.

[0454] Figure 21 An example of the registration database 691 is shown.

[0455] exist Figure 21 In the example, one row of data corresponds to one encrypted search data SE(i).

[0456] In data of one line, a file name File(M), ciphertext data CT(i), encryption index data ET(i), and a key generation number i correspond to each other.

[0457] according to Figure 22 The steps of the search request (S250) will be described.

[0458] The search request ( S250 ) corresponds to the search request ( S150 ) in the first embodiment.

[0459] In step S251 , the reception unit 510 receives the secret key SK(i) and the public parameter PP.

[0460] Step S251 is the same as step S151 in the first embodiment.

[0461] In step S252 , the receiving unit 510 receives the search keyword w.

[0462] Step S252 is the same as step S252 in the first embodiment.

[0463] In step S253 , the restoration unit 520 restores the secret key SK(1_j) using the secret key SK(i) and the public parameter PP.

[0464] Step S253 is the same as step S153 in the first embodiment.

[0465] In step S254 , the generation unit 530 generates a search query SQ( 1_i ) using the secret key SK( 1_i ), the public parameter PP, and the search keyword w.

[0466] The search query SQ(1_i) includes search queries SQ of each generation from the first generation to the i-th generation.

[0467] The search query SQ(n) includes a first query SQ(n)1 and a second query SQ(n)2.

[0468] The first query SQ(n)1 and the second query SQ(n)2 are each a search keyword w encrypted using the secret key SK of the nth generation.

[0469] For example, the search query SQ(n) is represented as follows.

[0470] SQ(n)=(SQ(n)1,SQ(n)2)

[0471] SQ(n)1=F(KK(n)||w||0)

[0472] SQ(n)2=F(KK(n)||w||1)

[0473] In step S255 , the request unit 540 transmits the search query SQ( 1_i ) to the data management device 600 using the communication device 505 .

[0474] according to Figure 23 The steps of data retrieval ( S260 ) will be described.

[0475] The data search ( S260 ) corresponds to the data search ( S160 ) in the first embodiment.

[0476] In step S261 , the receiving unit 610 receives the public parameter PP.

[0477] Step S261 is the same as step S161 in the first embodiment.

[0478] In step S262 , the receiving unit 610 receives the search query SQ( 1_i ).

[0479] Step S262 is the same as step S162 in the first embodiment.

[0480] In step S263 , the checking unit 621 checks the search query SQ( 1_i ) with each encrypted search data SE(n) in the registration database 691 to search for the encrypted search data SE(n) that matches the search query SQ( 1_i ).

[0481] The collating unit 621 collates the search query SQ(1_i) and the encrypted search data SE(n) as follows.

[0482] First, the checking unit 621 determines whether the key generation number n included in the encrypted search data SE(n) is equal to or smaller than i.

[0483] When the key generation number n is equal to or less than i, the checking unit 621 extracts the encrypted index EI from the encrypted index data EI(n) in the secret search data SE(n).

[0484] Then, the checking unit 621 compares the first query SQ(k) 1 with each encrypted keyword key in the encrypted index EI according to the search query SQ(k) included in the search query SQ(1_i).

[0485] When the encrypted keyword key that matches the first query SQ(k) 1 is found, the encrypted search data SE(n) matches the search query SQ(1_i).

[0486] The encrypted search data SE(n) that matches the search query SQ(1_i) is referred to as “corresponding encrypted search data SE(n).” The corresponding encrypted search data SE(n) includes the encrypted index data EI(n) that matches the search query SQ(1_i).

[0487] The encrypted keyword key that matches the first query SQ(k)1 is referred to as the “corresponding encrypted keyword key.” Furthermore, the encrypted index data EI(n) including the corresponding encrypted keyword key is referred to as the “corresponding encrypted index data EI(n).”

[0488] The second query SQ(k)2 corresponding to the first query SQ(k)1 is referred to as a "corresponding second query SQ(k)2".

[0489] In step S264, the extraction unit 622 extracts one or more encrypted identifiers val corresponding to the corresponding encrypted keyword key from each corresponding encrypted index data EI(n).

[0490] Then, the extraction unit 622 decrypts the encrypted identifier val according to the extracted encrypted identifier val using the corresponding second query SQ(k) 2 to obtain the identifier res. The identifier res is decrypted as follows.

[0491] res=D(SQ(k)²,val)

[0492] In step S265, the extraction unit 622 extracts, from the registration database 691 according to the decrypted identifier res, a pair of ciphertext data CT and key generation number n corresponding to the file name File(M) identical to the identifier res.

[0493] In step S266, the output unit 630 generates data including a set of ciphertext data CT(n) and key generation number n. The generated data becomes the encrypted search result {(CT(n), n)}.

[0494] Step S266 is the same as step S165 in the first embodiment.

[0495] In step S267 , the output unit 630 transmits the encrypted search result {(CT(n), n)} to the search operation device 500 using the communication device 605 .

[0496] Step S267 is the same as step S166 in the first embodiment.

[0497] ***Effects of Implementation 2***

[0498] According to the second embodiment, even in a method using the encrypted index EI in a public key-based secret search, key updates can be performed. Furthermore, the old secret key SK(1_j) can be restored from the new secret key SK(i), and the search query SQ(1_i) can be generated using all the secret keys SK(1_i).

[0499] According to the second embodiment, in addition to the same effects as those of the first embodiment, the following effects are achieved.

[0500] Without decrypting the ciphertext, the identifiers hit in the search keyword can be uniformly extracted.

[0501] Implementation 3

[0502] Regarding the method of restoring the search query SQ(1_j) from the search query SQ(i), according to Figures 24 to 30 The following mainly describes the differences from Embodiment 1. "j" is an integer equal to or smaller than (i-1).

[0503] Here, the search query SQ(1_j) is represented as follows.

[0504] SQ(1_j)=(SK(1),…,SK(i-1))

[0505] ***Description of the structure***

[0506] The structure of the hidden code search system 100 is the same as that of the first embodiment (see Figure 1 ).

[0507] However, a part of the structure of the data management device 600 is different from that in the first embodiment.

[0508] according to Figure 24 The structure of the data management device 600 will be described.

[0509] The data management device 600 includes an element called a conversion unit 623 .

[0510] ***Description of the action***

[0511] according to Figure 25 The concealed information search method is described.

[0512] Step S130 , step S170 , step S180 , and step S190 are the same as those described in the first embodiment.

[0513] Next, step S310 , step S320 , step S340 , step S350 , and step S360 are described.

[0514] according to Figure 26 The steps of master key generation ( S310 ) will be described.

[0515] The master key generation ( S310 ) corresponds to the master key generation ( S110 ) in the first embodiment.

[0516] In step S311 , the reception unit 210 receives the key length BIT and the upper limit MAX.

[0517] In step S312 , the generation unit 220 generates a master key MK and a public parameter PP based on the key length BIT.

[0518] The master key MK and public parameters PP are generated as follows.

[0519] First, the generator 220 randomly selects two prime numbers (P, Q) having the same bit length as BIT / 2.

[0520] Next, the generator 220 calculates the product N (=P*Q) of the prime number P and the prime number Q.

[0521] Next, the generator 220 randomly selects an integer x from the set of integers {1, 2, . . . , N-1} that is greater than or equal to 1 and less than or equal to (N-1).

[0522] Next, the generator 220 divides the square of the integer x by the product N to calculate a remainder g (=x*x mod N). "X mod Y" means the remainder when X is divided by Y.

[0523] Here, the product obtained by calculating (P-1)*(Q-1) is expressed as "Z".

[0524] Next, the generator 220 randomly selects an integer y that is sparse relative to Z from the set of integers {1, 2, . . . , Z} that is not less than 1 and not more than Z.

[0525] Next, the generator 220 divides the square of the integer y by the product Z to calculate the remainder e (=y*y mod Z).

[0526] Next, the generator 220 selects an integer d that satisfies d*e mod Z=1 from the set of integers greater than or equal to 1 and less than or equal to Z.

[0527] Then, the generation unit 220 generates a master key MK and a public parameter PP.

[0528] The master key MK contains a prime number P, a prime number Q, a remainder g, and an integer d.

[0529] The public parameters PP include the product N, the remainder e, the identifier of the encryption function F, and the upper limit MAX.

[0530] The master key MK is represented as follows.

[0531] MK=(P,Q,g,d)

[0532] The public parameter PP is represented as follows.

[0533] PP=(N,e,E,F,MAX)

[0534] In step S313 , the generation unit 220 stores the master key MK and the public parameter PP in the storage unit 290 for safekeeping.

[0535] Step S313 is the same as step S113 in the first embodiment.

[0536] In step S314 , the output unit 230 outputs the master key MK and the public parameter PP.

[0537] Step S314 is the same as step S114 in the first embodiment.

[0538] according to Figure 27 The steps of secret key generation (S320) will be described.

[0539] The secret key generation ( S320 ) corresponds to the secret key generation ( S120 ) in the first embodiment.

[0540] In step S321 , the reception unit 310 receives the master key MK and the public parameters PP.

[0541] Step S321 is the same as step S121 in the first embodiment.

[0542] In step S322 , the reception unit 310 receives the key generation number i.

[0543] Step S322 is the same as step S122 in the first embodiment.

[0544] In step S323 , the generation unit 320 generates a secret key SK(i) using the master key MK, the public parameter PP, and the key generation number i.

[0545] The secret key SK(i) contains the data key DK(i), the keyword key KK(i) and the key generation number i.

[0546] The secret key SK(i) is represented as follows.

[0547] SK(i)=(DK(i),KK(i),i)

[0548] The data key DK(i) and the keyword key KK(i) are represented as follows: That is, the data key DK(i) and the keyword key KK(i) are generated by multiple encryption.

[0549] DK(i)=F(g ei modN)

[0550] KK(i)=g ei modN

[0551] ei=e (MAX-i+1) mod((P-1)*(Q-1))

[0552] However, F(KK(i))=DK(i) holds, so the secret key SK(i) does not have to include the data key DK(i).

[0553] The keyword key KK has the following relationship.

[0554] KK(i-1)=KK(i) e modN

[0555] Based on the above relationship, if the keyword key KK(i) and the remainder e are known, the keyword key KK(i-1) can be restored. Furthermore, by repeatedly performing the restoration, not only the keyword key KK(i-1) but also KK(i-2), ..., KK(1) can be restored from the keyword key KK(i) and the remainder e.

[0556] Similarly, DK(i-1),…,DK(1) can be restored from the data key DK(i) and the remainder e.

[0557] When the secret key SK(i-1) is stored, the generation unit 320 may generate the secret key SK(i) using the secret key SK(i-1).

[0558] In this case, the data key DK(i) and the keyword key KK(i) are represented as follows.

[0559] DK(i)=F(KK(i-1) d modN)

[0560] KK(i)=KK(i-1) d modN

[0561] In step S324 , the generation unit 320 stores the secret key SK(i) in the storage unit 390 for safekeeping.

[0562] Step S324 is the same as step S124 in the first embodiment.

[0563] In step S325 , the output unit 330 outputs the secret key SK(i).

[0564] Step S325 is the same as step S125 in the first embodiment.

[0565] according to Figure 28 The procedure of data registration (S340) will be described.

[0566] Data registration ( S340 ) corresponds to step S140 in the first embodiment.

[0567] In step S341 , the accepting unit 410 accepts the secret key SK(i) and the public parameter PP.

[0568] Step S341 is the same as S141 in the first embodiment.

[0569] In step S342 , the accepting unit 410 accepts the plaintext M.

[0570] Step S342 is the same as step S142 in the first embodiment.

[0571] In step S343 , the random number generation unit 421 generates a data random number CR and a key random number KR.

[0572] Step S343 is the same as step S143 in the first embodiment.

[0573] In step S344, the ciphertext data generation unit 422 uses the secret key SK(i), the public parameter PP, and the data random number CR to encrypt the plaintext M, thereby generating ciphertext data CT(i).

[0574] Step S344 is the same as step S144 in the first embodiment.

[0575] In step S345 , the keyword generating unit 423 generates a registration keyword W.

[0576] Step S345 is the same as step S145 in the first embodiment.

[0577] In step S346 , the encrypted label generation unit 424 encrypts the registration keyword W using the secret key SK(i), the public parameter PP, and the keyword random number KR, and generates encrypted label data ET(i).

[0578] The encrypted tag data ET(i) includes the encrypted tag ET and the key generation number i.

[0579] The encryption tag ET contains the encryption keyword EW and the keyword random number KR.

[0580] The encrypted tag data ET(i) is represented as follows.

[0581] ET(i)=(ET,i)

[0582] ET=(EW,KR)

[0583] For example, the encrypted keyword EW is represented as follows: In this case, the encrypted label generation unit 424 encrypts the registered keyword W using the keyword key KK(i) and the keyword random number KR. In this way, the encrypted keyword EW is generated.

[0584] EW=F(KR||KK(i) F(W) modN)

[0585] When there are a plurality of registered keywords W, the encrypted tag ET includes the encrypted tag of each registered keyword W.

[0586] For example, when there are registered keywords W1 and W2, the encrypted tag ET is represented as follows.

[0587] ET=(F(KR||KK(i) F(W1) modN),F(KR||KK(i) F(W2) modN),KR)

[0588] In step S347 , the registration unit 430 generates the encrypted search data SE(i).

[0589] The secret search data SE(i) includes the file name File(M), the ciphertext data CT(i), the encrypted tag data ET(i) and the key generation number i.

[0590] Step S347 is the same as step S147 in the first embodiment.

[0591] In step S348 , the registration unit 430 registers the confidentiality search data SE(i) in the registration database 691 .

[0592] Step S348 is the same as step S148 in the first embodiment.

[0593] according to Figure 29 The steps of the search request (S350) will be described.

[0594] The search request ( S350 ) corresponds to the search request ( S150 ) in the first embodiment.

[0595] In step S351 , the reception unit 510 receives the secret key SK(i) and the public parameter PP.

[0596] Step S351 is the same as step S151 in the first embodiment.

[0597] In step S352 , the receiving unit 510 receives the search keyword w.

[0598] Step S352 is the same as step S152 in the first embodiment.

[0599] In step S353, the restoration unit 520 restores the secret key SK(1_j) using the secret key SK(i) and the public parameter PP.

[0600] The secret key SK(1_j) is represented as follows.

[0601] SK(1_j)=(SK(1),…,SK(i-2),SK(i-1))

[0602] The secret key SK(1_j) is restored as follows.

[0603] First, the restoration unit 520 restores the data key DK(1_j).

[0604] The data key DK(1_j) is expressed as follows. In addition, let KK(i) = g ei modN is established.

[0605] DK(1_j)=(DK(1),…,DK(i-2),DK(i-1))

[0606] DK(i-1)=F(KK(i) e modN)

[0607] DK(i-2)=F(KK(i) e*e modN)

[0608] DK(1)=F(KK(i) e*…*e modN)

[0609] DK(i-3) to DK(2) are calculated in the same manner as DK(i-2).

[0610] Furthermore, the restoration unit 520 restores the keyword key KK(1_j).

[0611] The keyword key KK(1_j) is restored in the same manner as the data key DK(1_j).

[0612] Then, the restoration unit 520 generates secret keys SK for each of the first to (i-1)th generations.

[0613] The secret key SK(n) is represented as follows: The secret key SK(n) is the secret key SK of the nth generation.

[0614] SK(n)=(DK(n),KK(n),n)

[0615] In step S354 , the generation unit 530 generates a search query SQ(i) using the secret key SK(i), the public parameter PP, and the search keyword w.

[0616] For example, the search query SQ(i) is represented as follows.

[0617] SQ(i)=KK(i) F(w) modN

[0618] In step S355 , the request unit 540 transmits the search query SQ(i) to the data management device 600 using the communication device 505 .

[0619] according to Figure 30 The steps of data retrieval (S360) will be described.

[0620] The data search ( S360 ) corresponds to the data search ( S160 ) in the first embodiment.

[0621] In step S361 , the receiving unit 610 receives the public parameter PP.

[0622] Step S361 is the same as step S161 in the first embodiment.

[0623] In step S362 , the receiving unit 610 receives the search query SQ( 1_i ).

[0624] Step S362 is the same as step S162 in the first embodiment.

[0625] In step S363 , the conversion unit 623 converts the search query SQ(i) into a search query (1_j).

[0626] The search query SQ(1_j) is expressed as follows: Let SQ(i) = KK(i) F(w) modN is established.

[0627] SQ(1_j)=(SQ(1),…,SQ(i-2),SQ(i-1))

[0628] SQ(i-1)=SQ(i) e modN

[0629] SQ(i-2)=SQ(i-1) e modN

[0630] SQ(1)=SQ(2) e modN

[0631] SQ(i-3) to SQ(2) are calculated in the same manner as SQ(i-2).

[0632] In step S364 , the checking unit 621 checks the search query SQ( 1_i ) with each encrypted search data SE(n) in the registration database 691 to search for the encrypted search data SE(n) that matches the search query SQ( 1_i ).

[0633] The collating unit 621 collates the search query SQ(1_i) and the encrypted search data SE(n) as follows.

[0634] First, the checking unit 621 determines whether the key generation number n included in the encrypted search data SE(n) is equal to or smaller than i.

[0635] When the key generation number n is equal to or less than i, the verification unit 621 extracts the encrypted tag ET from the encrypted tag data ET(n) in the secret search data SE(n), and extracts the encryption key EW and the key random number KR from the extracted encrypted tag ET.

[0636] Next, the checking unit 621 generates a checking tag Tg(k) using the search query SQ(k) and the extracted keyword random number KR according to the search query SQ(k) included in the search query SQ(1_i).

[0637] The verification tag Tg(k) is represented as follows.

[0638] Tg(k)=F(KR||SQ(k))

[0639] Then, the checking unit 621 compares the checking tag Tg(k) with the extracted encrypted keyword EW according to the search query SQ(k) included in the search query SQ(1_i).

[0640] When any verification tag Tg(k) matches the extracted encrypted keyword EW, the encrypted search data SE(n) matches the search query SQ(1_i).

[0641] Furthermore, when there are a plurality of encrypted keywords EW, if any verification tag Tg(k) matches any encrypted keyword EW, the encrypted search data SE(n) matches the search query SQ(1_i).

[0642] The encrypted search data SE(n) that matches the search query SQ(1_i) is referred to as “corresponding encrypted search data SE(n).” The corresponding encrypted search data SE(n) includes the encrypted tag data ET(n) that matches the search query SQ(1_i).

[0643] In step S365, the extraction unit 622 extracts the ciphertext data CT(n) and the key generation number n from each corresponding secret search data SE(n).

[0644] Step S365 is the same as step S164 in the first embodiment.

[0645] In step S366, the output unit 630 generates data including a set of ciphertext data CT(n) and key generation number n. The generated data becomes the encrypted search result {(CT(n), n)}.

[0646] Step S366 is the same as step S165 in the first embodiment.

[0647] In step S367 , the output unit 630 transmits the encrypted search result {(CT(n), n)} to the search operation device 500 using the communication device 605 .

[0648] Step S367 is the same as step S166 in the first embodiment.

[0649] ***Effects of Implementation 3***

[0650] According to Embodiment 3, it is possible to perform key update using an encryption tag in a public key encrypted search. Furthermore, it is possible to restore an old search query (1_j) from a new search query (i).

[0651] According to the third embodiment, in addition to the same effects as those of the first embodiment, the following effects are achieved.

[0652] By using the public parameter PP, the search query SQ(i) generated using the new secret key SK(i) can be converted into a search query (1_j) generated using the old secret key SK(1_j). That is, the search query size can be reduced.

[0653] Implementation 4

[0654] Regarding the method of using the encrypted index EI instead of the encrypted label ET and restoring the search query SQ(1_j) from the search query SQ(i), according to Figures 31 to 35 The differences from Embodiments 1 to 3 will be mainly described.

[0655] ***Description of the structure***

[0656] The structure of the hidden code search system 100 is the same as that of the first embodiment (see Figure 1 ).

[0657] However, the configurations of the registration device 400 and the data management device 600 are partially different from those in the first embodiment.

[0658] according to Figure 31 The configuration of the registration device 400 will be described.

[0659] The registration device 400 includes elements such as a search result generating unit 425 and an encrypted index generating unit 426 in place of the encrypted label generating unit 424 in the first embodiment.

[0660] according to Figure 32 The structure of the data management device 600 will be described.

[0661] The data management device 600 includes an element called a conversion unit 623 .

[0662] ***Description of the action***

[0663] according to Figure 33 The concealed information search method is described.

[0664] Step S310 and step S320 are as described in the third embodiment.

[0665] Step S130 , step S170 , step S180 , and step S190 are the same as those described in the first embodiment.

[0666] Next, step S440 and step S460 are described.

[0667] according to Figure 34 The procedure of data registration (S440) will be described.

[0668] Data registration ( S440 ) corresponds to step S240 in the second embodiment.

[0669] In step S441 , the reception unit 410 receives the secret key SK(i) and the public parameter PP.

[0670] Step S441 is the same as step S241 in the second embodiment.

[0671] In step S442 , the accepting unit 410 accepts the plaintext M.

[0672] Step S442 is the same as step S242 in the second embodiment.

[0673] In step S443 , the random number generation unit 421 generates a data random number CR and a key random number KR.

[0674] Step S443 is the same as step S243 in the second embodiment.

[0675] In step S444, the ciphertext data generation unit 422 uses the secret key SK(i), the public parameter PP, and the data random number CR to encrypt the plaintext M, thereby generating ciphertext data CT(i).

[0676] Step S444 is the same as step S244 in the second embodiment.

[0677] In step S445 , the keyword generating unit 423 generates a registration keyword W.

[0678] Step S445 is the same as step S245 in the second embodiment.

[0679] Furthermore, it is assumed that one or more plaintexts M are accepted in step S442 , one or more ciphertext data CT(i) are generated in step S444 , and one or more registration keywords W are generated in step S445 .

[0680] In step S446 , the search result generating unit 425 generates a search result RES based on one or more registered keywords W.

[0681] Step S446 is the same as step S246 in the second embodiment.

[0682] In step S447, the encrypted index generator 426 encrypts the search result RES using the secret key SK(i), the public parameter PP, and the keyword random number KR, thereby generating encrypted index data EI(i).

[0683] The encrypted index data EI(i) includes the encryption index EI and the key generation number i.

[0684] The encrypted index EI is the encrypted search result RES, and includes the encrypted keyword key and the encrypted identifier val.

[0685] The encrypted keyword key is the encrypted registration keyword kw. The registration keyword kw is encrypted using the keyword key KK(i).

[0686] The encrypted identifier val is the encrypted identifier res. The identifier res is encrypted using the encrypted registration key kw and the key random number KR.

[0687] For example, the encrypted index data EI(i) is represented as follows.

[0688] EI={(key,val)}

[0689] key=F(0||KK(i) F(kw) modN)

[0690] val=E(F(1||KK(i) F(kw) modN),res,KR)

[0691] That is, the encryption function F is used to encrypt the key KK(i) as the base, the registration key kw as the exponent, and the product N as the modulus of the power, thereby obtaining the encrypted key key.

[0692] In addition, the encryption function F is used to encrypt the keyword key KK(i) as the base, the registration keyword kw as the exponent, and the product N as the remainder to obtain the key value, and the identifier res is encrypted using the calculated key and the keyword random number KR, thereby obtaining the encrypted identifier val.

[0693] The product N is the product of the prime number P and the prime number Q (see step S312 of embodiment 3).

[0694] In step S448 , the registration unit 430 generates the encrypted search data SE(i).

[0695] The hidden search data SE(i) includes the file name File(M), the ciphertext data CT, the encryption index data EI(i) and the key generation number i.

[0696] Step S448 is the same as step S248 in the second embodiment.

[0697] In step S449 , the registration unit 430 registers the confidentiality search data SE(i) in the registration database 691 .

[0698] Step S449 is the same as step S249 in the second embodiment.

[0699] according to Figure 35 The steps of data retrieval (S460) will be described.

[0700] The data search ( S460 ) corresponds to step S160 in the first embodiment, step S260 in the second embodiment, and step S360 in the third embodiment.

[0701] In step S461 , the receiving unit 610 receives the public parameter PP.

[0702] Step S461 is the same as step S161 in the first embodiment.

[0703] In step S462 , the receiving unit 610 receives the search query SQ( 1_i ).

[0704] Step S462 is the same as step S162 in the first embodiment.

[0705] In step S463 , the conversion unit 623 converts the search query SQ(i) into a search query SQ(1_j).

[0706] Step S463 is the same as step S363 in the third embodiment.

[0707] In step S464 , the checking unit 621 checks the search query SQ( 1_i ) with each encrypted search data SE(n) in the registration database 691 to search for the encrypted search data SE(n) that matches the search query SQ( 1_i ).

[0708] The collating unit 621 collates the search query SQ(1_i) and the encrypted search data SE(n) as follows.

[0709] First, the checking unit 621 calculates a first query SQ(k)1 and a second query SQ(k)2 according to the search query SQ(k) included in the search query SQ(1_i).

[0710] The first query SQ(k)1 and the second query SQ(k)2 are expressed as follows.

[0711] SQ(k)1=F(0||SQ(k)modN)

[0712] SQ(k)2=F(1||SQ(k)modN)

[0713] Next, the checking unit 621 determines whether the key generation number n included in the encryption search data SE(n) is equal to or less than i.

[0714] When the key generation number n is equal to or less than i, the checking unit 621 extracts the encrypted index EI from the encrypted index data EI(n) in the secret search data SE(n).

[0715] Then, the checking unit 621 compares the first query SQ(k) 1 with each encrypted keyword key in the encrypted index EI according to the search query SQ(k) included in the search query SQ(1_j).

[0716] When the encrypted keyword key that matches the first query SQ(k) 1 is found, the encrypted search data SE(n) matches the search query SQ(1_i).

[0717] The encrypted search data SE(n) that matches the search query (1_i) is referred to as “corresponding encrypted search data SE(n).” The corresponding encrypted search data SE(n) includes the encrypted index data EI(n) that matches the search query SQ(1_i).

[0718] The encrypted keyword key that matches the first query SQ(k)1 is referred to as the “corresponding encrypted keyword key.” Furthermore, the encrypted index data EI(n) including the corresponding encrypted keyword key is referred to as the “corresponding encrypted index data EI(n).”

[0719] The second query SQ(k)2 corresponding to the first query SQ(k)1 is referred to as a "corresponding second query SQ(k)2".

[0720] In step S465 , the extraction unit 622 extracts one or more encrypted identifiers val corresponding to the corresponding encrypted keyword key from each corresponding encrypted index data EI(n).

[0721] Then, the extraction unit 622 decrypts the encrypted identifier val according to the extracted encrypted identifier val using the corresponding second query SQ(k) 2 to obtain the identifier res. The identifier res is decrypted as follows.

[0722] res=D(SQ(k)²,val)

[0723] In step S466, the extraction unit 622 extracts, from the registration database 691 according to the decrypted identifier res, a pair of ciphertext data CT and key generation number n corresponding to the file name File(M) identical to the identifier res.

[0724] In step S467, the output unit 630 generates data including a set of ciphertext data CT(n) and key generation number n. The generated data becomes the encrypted search result {(CT(n), n)}.

[0725] Step S467 is the same as step S165 in the first embodiment.

[0726] In step S468 , the output unit 630 transmits the encrypted search result {(CT(n), n)} to the search operation device 500 using the communication device 605 .

[0727] Step S468 is the same as step S166 in the first embodiment.

[0728] ***Effects of Implementation 4***

[0729] According to the fourth embodiment, even in a method using the encrypted index EI in a public key encrypted search, key update is possible. In addition, the old search query (1_j) can be restored from the new search query (i).

[0730] According to the fourth embodiment, in addition to the same effects as those of the third embodiment, the following effects are achieved.

[0731] Without decrypting the ciphertext, the identifiers hit in the search keyword can be uniformly extracted.

[0732] ***Supplement to the implementation method***

[0733] according to Figure 36The hardware structure of the master key device 200 will be described.

[0734] The master key device 200 includes a processing circuit 209 .

[0735] The processing circuit 209 is hardware that realizes the receiving unit 210 , the generating unit 220 , and the output unit 230 .

[0736] The processing circuit 209 may be dedicated hardware, or may be the processor 201 that executes a program stored in the memory 202 .

[0737] In the case where the processing circuit 209 is dedicated hardware, the processing circuit 209 is, for example, a single circuit, a complex circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0738] ASIC is the abbreviation of Application Specific Integrated Circuit.

[0739] FPGA is the abbreviation of Field Programmable Gate Array.

[0740] The master key device 200 may include a plurality of processing circuits instead of the processing circuit 209 .

[0741] In the processing circuit 209 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0742] Thus, the functions of the master key device 200 can be implemented by hardware, software, firmware, or a combination thereof.

[0743] according to Figure 37 The hardware structure of the secret key device 300 will be described.

[0744] The secret key device 300 has a processing circuit 309 .

[0745] The processing circuit 309 is hardware that realizes the receiving unit 310 , the generating unit 320 , and the output unit 330 .

[0746] The processing circuit 309 may be dedicated hardware, or may be the processor 301 that executes a program stored in the memory 302 .

[0747] In the case where the processing circuit 309 is dedicated hardware, the processing circuit 309 is, for example, a single circuit, a complex circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0748] The secret key device 300 may include a plurality of processing circuits instead of the processing circuit 309 .

[0749] In the processing circuit 309 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0750] Thus, the functions of the secret key device 300 can be implemented by hardware, software, firmware, or a combination thereof.

[0751] according to Figure 38 The hardware configuration of the registration device 400 will be described.

[0752] The registration device 400 includes a processing circuit 409 .

[0753] The processing circuit 409 is hardware that realizes the accepting unit 410 , the generating unit 420 , and the registering unit 430 .

[0754] The processing circuit 409 may be dedicated hardware, or may be the processor 401 that executes a program stored in the memory 402 .

[0755] In the case where the processing circuit 409 is dedicated hardware, the processing circuit 409 is, for example, a single circuit, a complex circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0756] The registration device 400 may include a plurality of processing circuits instead of the processing circuit 409 .

[0757] In the processing circuit 409 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0758] Thus, the functions of the registration device 400 can be implemented by hardware, software, firmware, or a combination thereof.

[0759] according to Figure 39 The hardware configuration of the search operation device 500 will be described.

[0760] The search operation device 500 includes a processing circuit 509 .

[0761] The processing circuit 509 is hardware that realizes the receiving unit 510 , the restoring unit 520 , the generating unit 530 , the requesting unit 540 , the decrypting unit 550 , and the output unit 560 .

[0762] The processing circuit 509 may be dedicated hardware, or may be the processor 501 that executes a program stored in the memory 502 .

[0763] In the case where the processing circuit 509 is dedicated hardware, the processing circuit 509 is, for example, a single circuit, a complex circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0764] The search operation device 500 may include a plurality of processing circuits instead of the processing circuit 509 .

[0765] In the processing circuit 509 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0766] Thus, the functions of the search operation device 500 can be realized by hardware, software, firmware, or a combination thereof.

[0767] according to Figure 40 The hardware configuration of the data management device 600 will be described.

[0768] The data management device 600 includes a processing circuit 609 .

[0769] The processing circuit 609 is hardware that realizes the receiving unit 610 , the searching unit 620 , the output unit 630 , and the managing unit 640 .

[0770] The processing circuit 609 may be dedicated hardware, or may be the processor 601 that executes a program stored in the memory 602 .

[0771] In the case where the processing circuit 609 is dedicated hardware, the processing circuit 609 is, for example, a single circuit, a complex circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0772] The data management device 600 may include a plurality of processing circuits instead of the processing circuit 609 .

[0773] In the processing circuit 609 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0774] Thus, the functions of the data management device 600 can be implemented by hardware, software, firmware, or a combination thereof.

[0775] Each embodiment is an illustration of a preferred mode and is not intended to limit the technical scope of the present invention. Each embodiment can be implemented in part or in combination with other modes. The steps described using flowcharts, etc. can also be appropriately changed.

[0776] Each device described in the embodiment may be realized by a plurality of devices. In addition, two or more devices described in the embodiment may be realized by a single device.

[0777] The word “unit” which is an element of each device described in the embodiments may be rewritten as “processing”, “step”, “circuit” or “line”.

[0778] Description of labels

[0779] 100: Hide and retrieve system; 101: Network; 200: Master key device; 201: Processor; 202: Memory; 203: Auxiliary storage device; 204: Input / output interface; 205: Communication device; 209: Processing circuit; 210: Acceptor; 220: Generator; 230: Output unit; 290: Storage unit; 300: Secret key device; 301: Processor; 302: Memory; 303: Auxiliary storage device; 304: Input / output interface Output interface; 305: Communication device; 309: Processing circuit; 310: Accepting unit; 320: Generating unit; 330: Output unit; 390: Storage unit; 400: Registration device; 401: Processor; 402: Memory; 403: Auxiliary storage device; 404: Input / output interface; 405: Communication device; 409: Processing circuit; 410: Accepting unit; 420: Generating unit; 421: Random number generating unit; 422: Ciphertext data generating unit; 423: Keyword generation unit; 424: Encrypted tag generation unit; 425: Search result generation unit; 426: Encrypted index generation unit; 430: Registration unit; 490: Storage unit; 500: Search operation unit; 501: Processor; 502: Memory; 503: Auxiliary storage device; 504: Input / output interface; 505: Communication device; 509: Processing circuit; 510: Acceptance unit; 520: Restoration unit; 530: Generation unit; 540: Request unit; 550: : Decryption unit; 560: Output unit; 590: Storage unit; 600: Data management device; 601: Processor; 602: Memory; 603: Auxiliary storage device; 604: Input / output interface; 605: Communication device; 609: Processing circuit; 610: Acceptance unit; 620: Retrieval unit; 621: Verification unit; 622: Extraction unit; 623: Conversion unit; 630: Output unit; 640: Management unit; 690: Storage unit; 691: Registration database.

Claims

1. A hidden retrieval system, wherein: The hidden retrieval system has: a concealed search data generating unit that encrypts plain text using a new data key generated by multiple encryption to generate ciphertext data, and encrypts the registration keyword using a new keyword key generated by the multiple encryption to generate an encrypted keyword; a registration unit that registers the combination of the ciphertext data and the encryption keyword in a registration database; a restoration unit that restores the old data key from the new data key and restores the old keyword key from the new keyword key based on the multiple encryption; a search query generating unit, which encrypts the search keyword using the new keyword key and the old keyword key respectively to generate a new search query and an old search query; a search unit configured to search the registration database for an encrypted keyword that matches either the new search query or the old search query; a search result output unit that outputs an encrypted search result including ciphertext data corresponding to the found encrypted keyword; as well as A decryption unit decrypts the ciphertext data included in the encrypted search result into plaintext using the new data key or the old data key.

2. The hidden search system according to claim 1, wherein: The encrypted search data generating unit generates encrypted label data including the encrypted keyword, and generates encrypted search data including the ciphertext data and the encrypted label data. The registration unit registers the confidential search data in the registration database, The search unit searches the registration database for encrypted search data including encrypted tag data that matches either the new search query or the old search query as corresponding encrypted search data. The search result output unit outputs data including the ciphertext data included in the corresponding confidential search data as the encrypted search result.

3. The hidden search system according to claim 2, wherein: The encrypted search data generating unit generates data including the encrypted keyword and a keyword random number as the encrypted label data. The search unit generates a verification tag according to each search query of the new search query and the old search query using the search query and the keyword random number in the encrypted tag data, and searches for the hidden search data containing the encrypted tag data as the corresponding hidden search data when any verification tag is consistent with the encrypted keyword in the encrypted tag data.

4. The hidden search system according to claim 1, wherein: The hidden search system includes an extraction unit, The encrypted search data generating unit generates one or more pairs of a registration keyword and an identifier as a search result, encrypts the search result using the new keyword key, generates encrypted index data including one or more pairs of the encrypted keyword and the encrypted identifier, and generates encrypted search data including the ciphertext data, the encrypted index data, and a file name. The registration unit registers the confidential search data in the registration database, The search unit searches the registration database for encrypted index data containing an encrypted keyword that matches either the new search query or the old search query as corresponding encrypted index data. The extraction unit uses the corresponding search query, which is a search query that matches the corresponding encrypted index data, from the new search query and the old search query to decrypt each identifier from each encrypted identifier in the corresponding encrypted index data, and extracts ciphertext data corresponding to the file name identical to each identifier from the registration database. The search result output unit outputs data including each extracted ciphertext data as the encrypted search result.

5. A hidden search method, wherein: The hidden search data generating unit encrypts the plaintext using a new data key generated by multiple encryption to generate ciphertext data, and encrypts the registration keyword using a new keyword key generated by the multiple encryption to generate an encrypted keyword. The registration unit registers the combination of the ciphertext data and the encryption keyword in a registration database, The restoration unit restores the old data key from the new data key and the old keyword key from the new keyword key according to the multiple encryption. The search query generating section encrypts the search keyword using the new keyword key and the old keyword key to generate a new search query and an old search query, The search unit searches the registration database for an encrypted keyword that matches either the new search query or the old search query. The search result output unit outputs the encrypted search result including the ciphertext data corresponding to the found encrypted keyword. The decryption unit decrypts the plain text from the ciphertext data included in the encrypted search result using the new data key or the old data key.

6. A hidden retrieval system, wherein: The hidden retrieval system has: a concealed search data generating unit that encrypts plain text using a new data key generated by multiple encryption to generate ciphertext data, and encrypts the registration keyword using a new keyword key generated by the multiple encryption to generate an encrypted keyword; a registration unit that registers the combination of the ciphertext data and the encryption keyword in a registration database; a search query generating unit, which encrypts the search keyword using the new keyword key to generate a new search query; a conversion unit that converts the new search query into an old search query generated using an old keyword key corresponding to the new keyword key based on the multiple encryption; a search unit configured to search the registration database for an encrypted keyword that matches either the new search query or the old search query; a search result output unit that outputs an encrypted search result including ciphertext data corresponding to the found encrypted keyword; a restoration unit for restoring the old data key from the new data key based on the multiple encryption; as well as A decryption unit decrypts the ciphertext data included in the encrypted search result into plaintext using the new data key or the old data key.

7. The hidden retrieval system according to claim 6, wherein: The encrypted search data generating unit generates encrypted label data including the encrypted keyword, and generates encrypted search data including the ciphertext data and the encrypted label data. The registration unit registers the confidential search data in the registration database, The search unit searches the registration database for encrypted search data including encrypted tag data that matches either the new search query or the old search query as corresponding encrypted search data. The search result output unit outputs data including the ciphertext data included in the corresponding confidential search data as the encrypted search result.

8. The hidden retrieval system according to claim 7, wherein: The encrypted search data generating unit generates data including the encrypted keyword and a keyword random number as the encrypted label data. The search unit generates a verification tag according to each search query of the new search query and the old search query using the search query and the keyword random number in the encrypted tag data, and searches for the hidden search data containing the encrypted tag data as the corresponding hidden search data when any verification tag is consistent with the encrypted keyword in the encrypted tag data.

9. The hidden retrieval system according to claim 6, wherein: The hidden search system includes an extraction unit, The encrypted search data generating unit generates one or more pairs of a registration keyword and an identifier as a search result, encrypts the search result using the new keyword key, generates encrypted index data including one or more pairs of the encrypted keyword and the encrypted identifier, and generates encrypted search data including the ciphertext data, the encrypted index data, and a file name. The registration unit registers the confidential search data in the registration database, The search unit searches the registration database for encrypted index data containing an encrypted keyword that matches either the new search query or the old search query as corresponding encrypted index data. The extraction unit uses the corresponding search query, which is a search query that matches the corresponding encrypted index data, from the new search query and the old search query to decrypt each identifier from each encrypted identifier in the corresponding encrypted index data, and extracts ciphertext data corresponding to the file name identical to each identifier from the registration database. The search result output unit outputs data including each extracted ciphertext data as the encrypted search result.

10. A hidden search method, wherein: The hidden search data generating unit encrypts the plaintext using a new data key generated by multiple encryption to generate ciphertext data, and encrypts the registration keyword using a new keyword key generated by the multiple encryption to generate an encrypted keyword. The registration unit registers the combination of the ciphertext data and the encryption keyword in a registration database, The search query generating unit encrypts the search keyword using the new keyword key to generate a new search query. The conversion unit converts the new search query into an old search query generated using the old keyword key corresponding to the new keyword key based on the multiple encryption. The search unit searches the registration database for an encrypted keyword that matches either the new search query or the old search query. The search result output unit outputs the encrypted search result including the ciphertext data corresponding to the found encrypted keyword. The restoration unit restores the old data key from the new data key based on the multiple encryption. The decryption unit decrypts the plain text from the ciphertext data included in the encrypted search result using the new data key or the old data key.

Images