Cryptogram conversion system, conversion key generation method, and computer-readable recording medium

Abstract

A ciphertext conversion system (100) has a conversion key generation device (600). The conversion key generation device (600) has a conversion target setting section and a conversion key generation section. The conversion target setting section generates an attribute-based encryption key and an attribute-based ciphertext obtained by encrypting the attribute-based encryption key using an attribute-based encryption scheme. The conversion key generation section generates a conversion key for converting a first public key ciphertext into a second public key ciphertext that corresponds to the first public key encryption scheme and is different from the first public key ciphertext, based on first public key encryption information used when the first public key ciphertext is generated by encrypting a plaintext using a first secret key with a first public key encryption scheme, and generates a third public key ciphertext by encrypting a second secret key with the attribute-based encryption key using a second public key encryption scheme, where the second secret key is used to decrypt the second public key ciphertext.

Description

Technical Field

[0001] This invention relates to a ciphertext conversion system, a conversion key generation method, and a computer-readable recording medium. Background Technology

[0002] Proxy Re-Encryption (PRE) is a system that transfers decryption rights of ciphertext to another person without decrypting the ciphertext itself. Non-Patent Document 1 discloses an Attribute-Based PRE (ABPRE) method in attribute-based cryptography. By using the method disclosed in Non-Patent Document 1, proxy re-encryption between different attribute-based cryptography methods is achieved. Non-Patent Document 2 discloses a technique for changing the public key encryption key without decrypting the ciphertext encrypted with the public key.

[0003] Existing technical documents

[0004] Non-patent literature

[0005] Non-patent document 1: Zuoxia Yu et al., "Achieving Flexibility for ABE withOutsourcing via Proxy Re-Encryption", ASIACCS'18, June 4-8, 2018, Session 16: Applied Crypto 2, pp.659-672

[0006] Non-patent document 2: Amril Syalim et.al, "Realizing Proxy Re-encryption in the Symmetric World", ICIEIS (International Conference on Informatics Engineering and Information Science) 2011, Informatics Engineering and Information Science, pp. 259-274 Summary of the Invention

[0007] The problem that the invention aims to solve

[0008] The conventional proxy re-encryption method disclosed in Non-Patent Document 1 is a technique for converting ciphertext encrypted using one public key encryption method into ciphertext encrypted using another public key encryption method. Furthermore, the technique disclosed in Non-Patent Document 2 is a technique for converting ciphertext encrypted using a public key encryption method into ciphertext encrypted using a public key encryption method.

[0009] The following problem exists: when using existing technology to convert ciphertext obtained through public-key encryption into ciphertext obtained through public-key encryption, the ciphertext obtained through public-key encryption is decrypted once to obtain the plaintext. Then, the plaintext obtained through public-key encryption must be encrypted. Since the plaintext is exposed, the security is low.

[0010] The purpose of this invention is to convert ciphertext encrypted using public key encryption into ciphertext using public key encryption without decrypting it.

[0011] Methods for solving problems

[0012] The ciphertext conversion system of the present invention has a conversion key generation device, which has:

[0013] The conversion target setting unit uses an attribute-based encryption method to generate an attribute-based encryption key and attribute-based ciphertext obtained by encrypting the attribute-based encryption key; and

[0014] The conversion key generation unit generates a conversion key based on the first public key encryption information used when generating the first public key ciphertext by encrypting plaintext with the first secret key using the first public key encryption method. This conversion key converts the first public key ciphertext into a second public key ciphertext that corresponds to the first public key encryption method but is different from the first public key ciphertext. The unit then encrypts the second secret key using the attribute-based encryption key using the second public key encryption method to generate a third public key ciphertext. The second secret key is used to decrypt the second public key ciphertext.

[0015] Invention Effects

[0016] In this invention, the attribute-based ciphertext is ciphertext encrypted using public-key cryptography. The third public-key ciphertext is ciphertext obtained by encrypting the second secret key using the attribute-based encryption key used when generating the attribute-based ciphertext. Here, the second secret key is used to decrypt the second public-key ciphertext. Therefore, the second public-key ciphertext is ciphertext based on public-key cryptography. Furthermore, the first public-key ciphertext is ciphertext encrypted using public-key cryptography, i.e., the first public-key encryption method, and the second public-key ciphertext is ciphertext obtained by converting the first public-key ciphertext using a conversion key; therefore, it is not necessary to decrypt the first public-key ciphertext when converting it to the second public-key ciphertext.

[0017] Therefore, according to the present invention, it is possible to convert ciphertext encrypted by public key encryption into ciphertext based on public key encryption without decrypting it. Attached Figure Description

[0018] Figure 1 This is a diagram illustrating a structural example of the ciphertext conversion system 100 according to Embodiment 1.

[0019] Figure 2 This is a diagram illustrating a structural example of the public key encryption secret key generation device 200 according to Embodiment 1.

[0020] Figure 3 This is a diagram showing an example of the structure of the parameter generation device 300.

[0021] Figure 4 This is a diagram illustrating a structural example of the user secret key generation device 400 according to Embodiment 1.

[0022] Figure 5 This is a diagram illustrating a structural example of the public key ciphertext generation apparatus 500 according to Embodiment 1.

[0023] Figure 6 This is a diagram showing a structural example of the conversion key generation apparatus 600 according to Embodiment 1.

[0024] Figure 7 This is a diagram showing a structural example of the conversion device 700 according to Embodiment 1.

[0025] Figure 8 This is a diagram showing a structural example of the decryption device 800 according to Embodiment 1.

[0026] Figure 9 This is a diagram illustrating an example of the hardware structure of each device included in the ciphertext conversion system 100 of Embodiment 1.

[0027] Figure 10 This is a flowchart illustrating the operation of the public key encryption secret key generation device 200 according to Embodiment 1.

[0028] Figure 11 This is a flowchart illustrating the operation of the parameter generation device 300 in Embodiment 1.

[0029] Figure 12 This is a flowchart illustrating the operation of the user secret key generation device 400 in Embodiment 1.

[0030] Figure 13 This is a flowchart illustrating the operation of the public key ciphertext generation apparatus 500 according to Embodiment 1.

[0031] Figure 14This is a flowchart illustrating the operation of the conversion key generation device 600 according to Embodiment 1.

[0032] Figure 15 This is a flowchart illustrating the operation of the conversion device 700 in Embodiment 1.

[0033] Figure 16 This is a flowchart illustrating the operation of the decryption device 800 in Embodiment 1.

[0034] Figure 17 This is a diagram illustrating an example of the hardware structure of each device included in the ciphertext conversion system 100 of a modified embodiment 1. Detailed Implementation

[0035] In the description and drawings of the embodiments, the same reference numerals are used to label the same elements and corresponding elements. The descriptions of elements labeled with the same reference numerals are omitted or simplified as appropriate. The arrows in the figures mainly indicate data flow or processing flow. In addition, "part" or "apparatus" may be appropriately rewritten as "circuit", "method", "step", "process", "processing" or "line".

[0036] Implementation Method 1

[0037] Hereinafter, this embodiment will be described in detail with reference to the accompanying drawings.

[0038] ***Structure Description***

[0039] Figure 1 This is a block diagram illustrating a structural example of the ciphertext conversion system 100 of this embodiment.

[0040] like Figure 1 As shown, the ciphertext conversion system 100 includes a public key encryption secret key generation device group 290 consisting of multiple public key encryption secret key generation devices 200, a parameter generation device 300, a user secret key generation device group 490 consisting of multiple user secret key generation devices 400, a public key ciphertext generation device 500, a conversion key generation device 600, a conversion device 700, and a decryption device 800. Each device in the ciphertext conversion system 100 is a computer; for example, it is a PC (Personal Computer). At least two of the devices in the ciphertext conversion system 100 may also be composed of a single computer.

[0041] Network 101 is a communication path connecting the various devices of the ciphertext conversion system 100. As a specific example, network 101 is the Internet, but it can also be other types of networks.

[0042] The devices included in the ciphertext conversion system 100 can also be installed in a LAN (Local Area Network) laid out within a facility, instead of being connected via network 101.

[0043] The public key encryption secret key generation device 200 generates a public key encryption secret key and sends the generated public key encryption secret key to the public key ciphertext generation device 500 and the conversion key generation device 600.

[0044] The parameter generation device 300 is a computer that generates common parameters used in the ciphertext conversion system 100 and sends the generated common parameters to multiple user secret key generation devices 400, conversion key generation devices 600, conversion devices 700, and decryption devices 800 via network 101. Alternatively, the common parameters can also be sent directly via mail or other means without going through network 101.

[0045] The user secret key generation device 400 generates a user secret key and sends the generated user secret key to the decryption device 800.

[0046] The public-key ciphertext generation device 500 functions as a data encryption device. It receives the public-key encryption secret key from the public-key encryption secret key generation device 200, takes plaintext M as input, uses the public-key encryption secret key and plaintext M to generate public-key ciphertext skC and ciphertext auxiliary information auxC, and outputs the generated public-key ciphertext skC and ciphertext auxiliary information auxC.

[0047] The conversion key generation device 600 receives a public key from the parameter generation device 300, a public key encryption secret key from the public key encryption secret key generation device 200, and ciphertext auxiliary information from the public key ciphertext generation device 500, taking the decryption condition L as input. The conversion key generation device 600 uses the public key, the public key encryption secret key, and the ciphertext auxiliary information to generate a conversion key ck, and outputs the generated conversion key ck. The decryption condition L is a logical expression representing the conditions for a user to decrypt the converted ciphertext.

[0048] The conversion device 700 receives a conversion key from the conversion key generation device 600 and a public key ciphertext from the public key ciphertext generation device 500. Using the conversion key and the public key ciphertext, it generates a converted public key ciphertext skC' and a converted public key ciphertext pkC. The generated converted public key ciphertext skC' and converted public key ciphertext pkC are then output to the decryption device 800.

[0049] The decryption device 800 receives the converted public key ciphertext (skC', auxC') and the converted public key ciphertext pkC from the conversion device 700. In addition, it receives the user secret key from the user secret key generation device 400 and outputs the decryption result obtained by decrypting the ciphertext using the received user secret key.

[0050] The structure of this embodiment will be described below.

[0051] Figure 2 This is a block diagram illustrating a structural example of a public-key encryption secret key generation device 200.

[0052] like Figure 2 As shown, the public key encryption secret key generation device 200 includes an input unit 201, a public key encryption key generation unit 202, and a transmission unit 203.

[0053] Although not shown, the public key encryption secret key generation device 200 has a recording medium storing data used in each part of the public key encryption secret key generation device 200.

[0054] The input unit 201 accepts input of the bit length of the key used in this system.

[0055] The public-key encryption key generation unit 202 generates a public-key encryption secret key sk, which serves as the basis for operations used in the ciphertext conversion system 100. Although not shown, the public-key encryption key generation unit 202 may also have a random number generation function, etc., to generate the public-key encryption secret key sk.

[0056] The sending unit 203 sends the public key encryption secret key sk generated by the public key encryption key generation unit 202 to the public key ciphertext generation device 500 and the conversion key generation device 600, respectively.

[0057] Figure 3 This is a block diagram illustrating a structural example of the common parameter generation device 300.

[0058] like Figure 3 As shown, the common parameter generation device 300 includes an input unit 301, a common parameter generation unit 302, and a transmission unit 303.

[0059] Although not shown, the common parameter generation device 300 has a recording medium storing data used in each part of the common parameter generation device 300.

[0060] The input unit 301 accepts the input of the bit length of the key used in the ciphertext conversion system 100.

[0061] The public parameter generation unit 302 generates the public key pk and the master secret key msk used in the operations performed by the ciphertext conversion system 100. Although not shown, the public parameter generation unit 302 may also have a random number generation function, etc., to generate the public key pk and the master secret key msk respectively.

[0062] The sending unit 303 sends the public key pk generated by the public parameter generation unit 302 to the conversion key generation device 600 and the conversion device 700 respectively. In addition, the sending unit 303 sends the master secret key msk to each of the multiple user secret key generation devices 400.

[0063] Figure 4 This is a block diagram illustrating an example structure of a user secret key generation device 400. For example... Figure 4 As shown, the user secret key generation device 400 includes an input unit 401, a key receiving unit 402, a key generation unit 403, and a key sending unit 404.

[0064] Although not shown, the user secret key generation device 400 has a recording medium storing data used in each part of the user secret key generation device 400.

[0065] Input unit 401 accepts attribute parameter Γ as input.

[0066] The key receiving unit 402 receives the master secret key msk.

[0067] Key generation unit 403 generates user secret key sk Γ Although not shown in the figure, the key generation unit 403 may also have a random number generation function, etc., to generate the user's secret key sk. Γ .

[0068] The key sending unit 404 sends the user secret key sk generated by the key generation unit 403 to the decryption device 800. Γ .

[0069] Figure 5 This is a block diagram illustrating a structural example of a public-key ciphertext generation device 500. For example... Figure 5 As shown, the public key ciphertext generation apparatus 500 includes an input unit 501, a key receiving unit 502, an encryption unit 503, and a sending unit 504.

[0070] Although not shown, the public key ciphertext generation apparatus 500 has a recording medium storing data used in each part of the public key ciphertext generation apparatus 500.

[0071] Input unit 501 accepts plaintext M as input.

[0072] The key receiving unit 502 receives the public key and encrypts the secret key sk.

[0073] Encryption unit 503 generates public key ciphertext skC and auxiliary information auxC. Although not shown, encryption unit 503 may also have a random number generation function, etc., to generate public key ciphertext skC. Encryption unit 503 generates first public key ciphertext.

[0074] The sending unit 504 sends the public key ciphertext skC to the conversion device 700 and auxiliary information auxC to the conversion key generation device 600.

[0075] Figure 6 This is a block diagram illustrating a structural example of a conversion key generation device 600.

[0076] like Figure 6 As shown, the conversion key generation device 600 includes a key receiving unit 601, an input unit 602, a conversion target setting unit 603, a conversion key generation unit 604, and a sending unit 605.

[0077] Although not shown, the conversion key generation device 600 has a recording medium storing data used in each part of the conversion key generation device 600.

[0078] The key receiving unit 601 receives the public key pk, the public key encryption secret key sk, and the auxiliary information auxC.

[0079] Input unit 602 receives the decryption condition L from the outside as input.

[0080] The conversion target setting unit 603 generates a public key ciphertext P, which is part of the conversion key, based on the public key pk received by the key receiving unit 601 and the decryption condition L input by the input unit 602. The conversion target setting unit 603 generates an attribute-based encryption key and attribute-based ciphertext obtained by encrypting the attribute-based encryption key using an attribute-based encryption method.

[0081] The conversion key generation unit 604 generates a conversion key S as part of the conversion key based on the public key encryption secret key sk and auxiliary information auxC received by the key receiving unit 601. The conversion key generation unit 604 generates a conversion key that converts the first public key ciphertext into a second public key ciphertext, which corresponds to the first public key encryption method but is different from the first public key ciphertext, based on the first public key encryption information used when generating the first public key ciphertext by encrypting plaintext with the first secret key using the first public key encryption method. The conversion key generation unit 604 encrypts the second secret key using the second public key encryption method with an attribute-based encryption key to generate a third public key ciphertext, which is used to decrypt the second public key ciphertext. As a specific example, the first public key encryption method is a block encryption counter mode method. The first public key encryption information may also consist of the first secret key and first auxiliary information, which is used in block encryption counter mode method encryption. The conversion key generation unit 604 can also generate a conversion key using the first public key encryption information and the second public key encryption information. The second public key encryption information consists of the second secret key and second auxiliary information used in the block-based counter mode encryption. The conversion key generation unit 604 can also calculate the XOR of the result obtained by performing the first public key encryption using the first public key encryption information and the result obtained by performing the first public key encryption using the second public key encryption information, and use this XOR as the conversion key.

[0082] Although not shown in the figure, the conversion target setting unit 603 and the conversion key generation unit 604 may also have random number generation functions, etc., to generate conversion keys.

[0083] The transmitting unit 605 aggregates the generated conversion key and outputs the aggregated conversion key as the conversion key ck (=(P,S)) to the conversion device 700.

[0084] Figure 7 This is a block diagram showing an example of the structure of the conversion device 700. For example... Figure 7 As shown, the conversion device 700 includes a key receiving unit 701, a ciphertext receiving unit 702, a conversion unit 703, and a transmission unit 704.

[0085] Although not shown, the conversion device 700 has a recording medium storing data used in each part of the conversion device 700.

[0086] The key receiving unit 701 receives the public key pk and the conversion key ck respectively.

[0087] The ciphertext receiving unit 702 receives the public key ciphertext skC.

[0088] The conversion unit 703 converts the public key ciphertext skC using a portion of the conversion key ck, transforming it into a converted public key ciphertext skC'. The converted public key ciphertext skC' is ciphertext subject to the decryptability conditions set in the public key ciphertext P. Furthermore, the conversion unit 703 generates a converted public key ciphertext pkC using a portion of the conversion key ck. The conversion unit 703 calculates the XOR of the first public key ciphertext with the conversion key to obtain the second public key ciphertext.

[0089] The transmitting unit 704 outputs the converted public key ciphertext pkC and the converted public key ciphertext (skC', auxC') to the decryption device 800.

[0090] Figure 8 This is a block diagram illustrating an example of the structure of the decryption device 800. For example... Figure 8 As shown, the decryption device 800 includes a ciphertext receiving unit 801, a key receiving unit 802, a decryption unit 803, and a result output unit 804.

[0091] The ciphertext receiving unit 801 receives the converted public key ciphertext pkC and the converted public key ciphertext (skC', auxC') respectively.

[0092] The key receiving unit 802 receives the user secret key sk from the user secret key generation device 400. Γ .

[0093] The decryption unit 803 calculates the plaintext M by performing decryption processing. As a specific example of the decryption process, firstly, the decryption unit 803 decrypts the attribute-based ciphertext using the user secret key corresponding to the attribute information to obtain the attribute-based encryption key, where the attribute information corresponds to the attribute-based encryption key. Next, the decryption unit 803 decrypts the third public key ciphertext using the obtained attribute-based encryption key to obtain the second secret key. Then, the decryption unit 803 calculates the XOR of the result obtained by encrypting the second auxiliary information using the second secret key with the second public key ciphertext, and uses this result as the plaintext corresponding to the obtained second public key ciphertext.

[0094] The output section 804 outputs plaintext M.

[0095] Figure 9 This diagram illustrates an example of the hardware resources of each device included in the ciphertext conversion system 100 of this embodiment. Each device included in the ciphertext conversion system 100 may also be composed of multiple computers.

[0096] The encrypted text conversion system 100 may also include a processor 11 (Central Processing Unit). The processor 11 is connected via bus 12 to hardware devices such as ROM (Read Only Memory) 13, RAM (Random Access Memory) 14, communication port 15, display 51 (display device), keyboard 52, mouse 53, drive 54, and disk drive 20, and controls these hardware devices. The drive 54 is a device for reading and writing storage media such as FD (Flexible Disk Drive), CD (Compact Disc), or DVD (Digital Versatile Disc).

[0097] Processor 11 is an integrated circuit (IC) that performs computational processing. Specifically, it can be a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit). The various devices included in the ciphertext conversion system 100 may also have multiple processors instead of processor 11. Multiple processors share the functions of processor 11.

[0098] ROM 13, RAM 14, disk drive 20, and drive 54 are examples of storage devices. Keyboard 52, mouse 53, and communication port 15 are examples of input devices. Display 51 and communication port 15 are examples of output devices.

[0099] Communication port 15 connects to a communication network such as a LAN (Local Area Network), the Internet, or a telephone line via wired or wireless means. Specifically, communication port 15 is composed of a communication chip or a NIC (Network Interface Card).

[0100] The disk device 20 stores an OS (Operating System) 21, a program group 22, and a file group 23. As a specific example, the disk device 20 is an HDD (Hard Disk Drive). The disk device 20 could also be a flash memory, etc.

[0101] Program group 22 contains programs that perform the functions described as components in this embodiment. Specifically, the program is a data retrieval program or a data registration program, which is read and executed by processor 11. That is, the program enables the computer to function as a component, and further, causes the computer to execute the processes or methods of that component. Any program described in this specification can be recorded on a computer-readable non-volatile recording medium. Specifically, the non-volatile recording medium is an optical disc or flash memory. Any program described in this specification can be provided as a program product.

[0102] File group 23 contains the data used in the various parts described in this embodiment. As a specific example, this data consists of input data, output data, determination results, calculation results, and processing results.

[0103] ***Instructions for Action***

[0104] The operation of the ciphertext conversion system 100 is equivalent to a ciphertext conversion method. Furthermore, the program that implements the operation of the ciphertext conversion system 100 is equivalent to a ciphertext conversion program. The operation of each device included in the ciphertext conversion system 100 is equivalent to a method named after each device included in the ciphertext conversion system 100. As a specific example, the operation of the conversion key generation device 600 is equivalent to a conversion key generation method. Furthermore, the program that implements the operation of each device included in the ciphertext conversion system 100 is equivalent to a program named after each device included in the ciphertext conversion system 100. As a specific example, the program that implements the operation of the conversion key generation device 600 is equivalent to a conversion key generation program.

[0105] The operation of the ciphertext conversion system 100, which corresponds to the calculation method of each device in this embodiment, will be described below.

[0106] Before describing the operation of the ciphertext conversion system 100, the basic encryption technology used in this embodiment and the expressions used in the encryption technology will be explained.

[0107] Attribute-based encryption is an encryption technique that can only be decrypted by a user's secret key generated from attribute parameters Γ that satisfy decryption conditions set by the decryption condition L. The attribute parameters Γ are also a set of attributes. Attribute-based encryption consists of algorithms as described below.

[0108] First, taking ABESETUP and key length as input, the output is the master secret key msk and the public key pk. Next, taking the user secret key generator ABEKEYGEN, the master secret key msk, and attribute parameter Γ as input, the output is the user secret key sk corresponding to attribute parameter Γ. ΓNext, taking the encrypted ABEENC, the public key pk, and the decryption condition L as input, a public key K and the corresponding public key ciphertext P are generated for encryption. Then, the decrypted ABEDEC and user secret key sk are... Γ Using the public key ciphertext P as input, and the user's secret key sk Γ If the corresponding attribute parameter Γ matches the decryption condition L when the public key ciphertext P is generated, the output is the key K obtained by encrypting the public key ciphertext P.

[0109] Public-key cryptography is an encryption technique that encrypts plaintext M using a public-key cryptography key sk, and decrypts it using the same public-key cryptography key sk. When the public-key cryptography key sk is set to a random value, the encryption SKEENC takes the public-key cryptography key sk and the plaintext M as input and outputs the corresponding ciphertext C. The decryption SKEDEC takes the public-key cryptography key sk and the ciphertext C as input and outputs the corresponding plaintext M.

[0110] In this embodiment, encryption and decryption are performed using a counter mode that also employs block encryption in public-key encryption. The encryption is denoted as SCTRENC, and the decryption as SCTRDEC. In counter mode, a counter value is provided as auxiliary information, as shown below, for each encryption and decryption operation. Unless otherwise specified, + indicates XOR in this specification.

[0111] [encryption]

[0112] C = SCTRENC(sk, auxC) + M

[0113] [Decryption]

[0114] M = SCTRDEC(sk, auxC) + C

[0115] Figure 10 This is a flowchart illustrating an example of the steps involved in generating a public-key encryption secret key. Referring to this diagram, the steps for generating a public-key encryption secret key are explained.

[0116] (Step S201: Information Input Step)

[0117] The input unit 201 accepts the bit length k of the key as input.

[0118] (Step S202: Secret Key Generation Step)

[0119] The public key encryption key generation unit 202 generates a k-bit random number and sets the generated random number as the public key encryption secret key sk.

[0120] (Step S203: Release Steps)

[0121] The sending unit 203 outputs the public key to encrypt the secret key sk to the conversion key generation device 600.

[0122] Figure 11 This is a flowchart illustrating an example of the parameter generation steps. Refer to this diagram to explain the parameter generation steps.

[0123] (Step S301: Information Input Step)

[0124] The input unit 301 accepts the bit length k of the key as input.

[0125] (Step S302: Key generation step)

[0126] The public parameter generation unit 302 generates the master secret key msk and the public key pk by executing the attribute-based password setup.

[0127] (Step S303: Release Steps)

[0128] The transmitting unit 303 appropriately transmits the master secret key msk and the public key pk to each device respectively.

[0129] Figure 12 This is a flowchart illustrating an example of the user secret key generation steps. Refer to this diagram to explain the user secret key generation steps.

[0130] (Step S401: Attribute Input Step)

[0131] Input unit 401 accepts attribute parameter Γ as input.

[0132] (Step S402: Master Key Input Step)

[0133] The key receiving unit 402 receives the master secret key msk.

[0134] (Step S403: User secret key generation step)

[0135] The key generation unit 403 performs attribute-based cryptography user secret key generation KeyGen by using the attribute parameter Γ and the master secret key msk, and generates the user secret key sk. Γ .

[0136] (Step S404: Send step)

[0137] The key sending unit 404 sends the generated user secret key sk to the decryption device 800. Γ .

[0138] Figure 13This is a flowchart illustrating an example of the public-key ciphertext generation steps. Refer to this diagram to explain the public-key ciphertext generation steps.

[0139] (Step S501: Key Receiving Step)

[0140] The key receiving unit 502 receives the public key and encrypts the secret key sk.

[0141] (Step S502: Plaintext Input Step)

[0142] Input unit 501 accepts plaintext M as input.

[0143] (Step S503: Encryption Step)

[0144] The encryption unit 503 encrypts the plaintext M by executing the counter mode of block encryption. The encryption unit 503 sets the counter value during the execution of the counter mode as auxiliary information auxC, and sets the ciphertext as public key ciphertext skC. The relationship between auxiliary information auxC and public key ciphertext skC is denoted as [Mathematical Expression 1]. Public key ciphertext skC is equivalent to the first public key ciphertext. SCTRENC is equivalent to encryption based on the first public key encryption method. Public key encryption secret key sk is equivalent to the first secret key. Auxiliary information auxC is equivalent to the first auxiliary information. Public key encryption secret key sk and auxiliary information auxC are equivalent to the first public key encryption information.

[0145] [Mathematical Expression 1]

[0146] skC = SCTRENC(sk, auxC) + M

[0147] (Step S504: Sending Step)

[0148] The transmitting unit 504 appropriately transmits the public key ciphertext skC and auxiliary information auxC to each device respectively.

[0149] Figure 14 This is a flowchart illustrating an example of the key generation process. The key generation process is explained with reference to this diagram.

[0150] (Step S601: Key Receiving Step)

[0151] The key receiving unit 601 receives the public key pk, the public key encryption secret key sk, and the auxiliary information auxC.

[0152] (Step S602: Input steps)

[0153] Input unit 602 accepts the decryption condition L as input.

[0154] (Step S603: Target setting conversion step)

[0155] The conversion target setting unit 603 performs attribute-based cryptographic encryption ABEENC based on the public key pk and the decryption condition L, as shown in [Mathematical Formula 2]. Here, the public key ciphertext P is the converted public key ciphertext, and the key K is the key used to encrypt the public key ciphertext P. The public key ciphertext P is equivalent to the attribute-based ciphertext. The key K is equivalent to the attribute-based encryption key.

[0156] [Mathematical Expression 2]

[0157] (K, P) = ABEENC(pk, L)

[0158] (Step S604: Public Key Secret Key Generation Step)

[0159] The conversion key generation unit 604 selects a new public key to encrypt the secret key sk'.

[0160] (Step S605: Public key-secret key encryption step)

[0161] The conversion key generation unit 604 uses the public key to encrypt the secret key sk' as plaintext and the key K as the secret key, as shown in [Mathematical Formula 3], and performs public key encryption. S1 is equivalent to the third public key ciphertext. SKEENC is equivalent to encryption based on the second public key encryption method. sk' is equivalent to the second secret key.

[0162] [Mathematical Expression 3]

[0163] S1 = SKEENC(K, sk')

[0164] (Step S606: Key generation step)

[0165] The conversion key generation unit 604 selects new auxiliary information auxC' and performs the operation shown in [Mathematical Formula 4] using the selected new auxiliary information auxC'. The auxiliary information auxC' is equivalent to the second auxiliary information. The public key encryption secret key sk' and the auxiliary information auxC' are equivalent to the second public key encryption information.

[0166] [Mathematical Expression 4]

[0167] S2=SCTRENC(sk,auxC)+SCTRENC(sk',auxC')

[0168] S = (S1, S2)

[0169] (Step 607: Publish Steps)

[0170] The transmitting unit 605 outputs the conversion key ck (=(P,S)) to the conversion device 700.

[0171] Figure 15 This is a flowchart illustrating an example of the conversion steps. Refer to this diagram to explain the conversion steps.

[0172] (Step S701: Key Receiving Step)

[0173] The key receiving unit 701 receives the public key pk and the conversion key ck (=(P,S(=(S1,S2)))).

[0174] (Step S702: Input steps)

[0175] The ciphertext receiving unit 702 receives the public key ciphertext skC.

[0176] (Step S703: Conversion Step)

[0177] The conversion unit 703 uses the public key ciphertext skC and S2 to perform the calculation shown in [Mathematical Formula 5]. The converted public key ciphertext skC' is equivalent to the second public key ciphertext. Furthermore, S2 is generated using the first public key encryption method, and the converted public key ciphertext skC' is the XOR of the public key ciphertext skC and S2. Therefore, the converted public key ciphertext skC' corresponds to the first public key encryption method.

[0178] [Mathematical Expression 5]

[0179] skC'=skC+S2

[0180] Here, note that the right side of [Mathematical Expression 5] has the property shown in [Mathematical Expression 6].

[0181] [Mathematical Expression 6]

[0182] skC+S2

[0183] =SCTRENC(sk,auxC)+M+SCTRENC(sk,auxC)+SCTRENC(sk',auxC')

[0184] =SCTRENC(sk', auxC')+M

[0185] (Step S704: Output the step)

[0186] The transmitting unit 704 outputs the converted public key ciphertext as pkC (=(P,S1)) to the decryption device 800, and outputs the converted public key ciphertext as (skC',auxC') to the decryption device 800.

[0187] Figure 16 This is a flowchart illustrating an example of the decryption steps. Refer to this diagram to explain the decryption steps.

[0188] (Step S801: Ciphertext Reception Step)

[0189] The ciphertext receiving unit 801 receives the converted public key ciphertext pkC (=(P,S1)) and the converted public key ciphertext (skC',auxC').

[0190] (Step S802: Input steps)

[0191] Key receiving unit 802 receives user secret key sk Γ User secret key sk Γ This is equivalent to a user secret key corresponding to attribute information, which corresponds to an attribute-based encryption key.

[0192] (Step S803: Decryption Processing Step)

[0193] The decryption unit 803 decrypts the plaintext M by sequentially performing the calculations shown in [Mathematical Formula 7] from top to bottom using the received data. In [Mathematical Formula 7], the key K is first decrypted by performing attribute-based cryptography. The mathematical formula in [Mathematical Formula 7] for decrypting the plaintext M is a mathematical formula solved based on [Mathematical Formula 5] and [Mathematical Formula 6]. The plaintext M is the plaintext corresponding to the ciphertext of the second public key.

[0194] [Mathematical Expression 7]

[0195] K = ABEDEC(sk) Γ P)

[0196] sk' = SKEDEC(K, S1)

[0197] M = skC' + SCTRENC(sk', auxC')

[0198] (Step S804: Output the step)

[0199] The result output unit 804 outputs plaintext M. As a specific example, the result output unit 804 outputs plaintext M to the display provided by the decryption device 800.

[0200] ***Explanation of the effects of Implementation Method 1***

[0201] As described above, according to this embodiment, even if a user possesses the user's secret key, they cannot calculate the sum of inner products without obtaining the decryption key using a decryption token. Therefore, it is difficult to extrapolate the information of the vector x associated with each ciphertext in the prior art. Therefore, according to this embodiment, a more secure ciphertext conversion system 100 can be implemented.

[0202] Furthermore, according to this embodiment, ciphertext encrypted using a public-key encryption method can be converted into ciphertext based on a public-key encryption method without decryption using any method such as public-key encryption, function-based encryption with access limits, or attribute-based encryption. Therefore, according to this embodiment, convenience is improved by using a resource-saving device that cannot perform public-key encryption operations to perform the following: converting ciphertext encrypted using a public-key encryption method into ciphertext based on a public-key encryption method, and publishing the converted ciphertext.

[0203] ***Other Structures***

[0204] <Variation Example 1>

[0205] Figure 17 This illustrates an example of the hardware structure of each device included in the ciphertext conversion system 100 of this variant.

[0206] The ciphertext conversion system 100 includes processing circuits 18 in each device, which replace processor 11, processor 11 and ROM 13, processor 11 and RAM 14, or processor 11, ROM 13 and RAM 14.

[0207] The processing circuit 18 is hardware that implements at least a part of the components of each device included in the ciphertext conversion system 100.

[0208] The processing circuit 18 can be dedicated hardware, or it can be a processor that executes a program stored in ROM 13 or RAM 14.

[0209] In the case where the processing circuit 18 is dedicated hardware, as a specific example, the processing circuit 18 is a single circuit, a composite circuit, a programmable processor, a parallel programmable processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof.

[0210] The various devices included in the ciphertext conversion system 100 can also have multiple processing circuits that can replace the processing circuit 18. The multiple processing circuits share the functions of the processing circuit 18.

[0211] In the various devices included in the ciphertext conversion system 100, some functions may be implemented through dedicated hardware, while the remaining functions may be implemented through software or firmware.

[0212] As a specific example, the processing circuit 18 is implemented by hardware, software, firmware, or a combination thereof.

[0213] The processor 11, ROM 13, RAM 14, and processing circuit 18 are collectively referred to as the "processing circuit". That is, the functions of each functional structural element of each device in the ciphertext conversion system 100 are realized through the processing circuit.

[0214] ***Other Implementation Methods***

[0215] Implementation method 1 has been described, but multiple parts of this implementation method may also be combined. Alternatively, this implementation method may be implemented in part. Furthermore, this implementation method can be modified as needed, and may be implemented in any combination as a whole or in part. In addition, the various parts disclosed in this specification can be implemented by any of firmware, software, hardware, or combinations thereof.

[0216] Furthermore, the above embodiments are merely preferred embodiments and are not intended to limit the scope of the invention, its applications, or uses. The steps described using flowcharts or similar methods can also be appropriately modified.

[0217] Label Explanation

[0218] 11: Processor; 12: Bus; 13: ROM; 14: RAM; 15: Communication port; 18: Processing circuit; 20: Disk device; 21: OS; 22: Program group; 23: File group; 51: Display; 52: Keyboard; 53: Mouse; 54: Driver; 100: Ciphertext conversion system; 101: Network; 200: Public key encryption secret key generation device; 201: Input unit; 202: Public key encryption key generation unit; 203: Transmission unit; 290: Public key encryption secret key generation device group; 300: Parameter generation device; 301: Input unit; 302: Public parameter generation unit; 303: Transmission unit; 400: User secret key generation device; 401: Input unit; 402: Key receiving unit; 403: Key generation unit; 404: Key transmission unit; 490: User secret key generation device group; 500: Public key ciphertext generation device; 501: 502: Input unit; 503: Key receiving unit; 504: Encryption unit; 504: Transmission unit; 600: Conversion key generation device; 601: Key receiving unit; 602: Input unit; 603: Conversion target setting unit; 604: Conversion key generation unit; 605: Transmission unit; 700: Conversion device; 701: Key receiving unit; 702: Ciphertext receiving unit; 703: Conversion unit; 704: Transmission unit; 800: Decryption device; 801: Ciphertext receiving unit; 802: Key receiving unit; 803: Decryption unit; 804: Result output unit; auxC, auxC': Auxiliary information; K: Key; L: Decryption condition; M: Plaintext; P: Public key ciphertext; ck: Conversion key; pk: Public key; pkC: Conversion public key ciphertext; msk: Master secret key; sk, sk': Public key encryption secret key; skC: Public key ciphertext; skC': Conversion public key ciphertext; sk Γ : User secret key; Γ: Attribute parameter.

Claims

1. A ciphertext conversion system, wherein, The ciphertext conversion system has a conversion key generation device, which has the following features: The conversion target setting unit uses an attribute-based encryption method to generate an attribute-based encryption key and attribute-based ciphertext obtained by encrypting the attribute-based encryption key; as well as The conversion key generation unit generates a conversion key based on the first public key encryption information used when generating the first public key ciphertext by encrypting plaintext with the first secret key using the first public key encryption method. This conversion key converts the first public key ciphertext into a second public key ciphertext that corresponds to the first public key encryption method but is different from the first public key ciphertext. The unit then encrypts the second secret key using the attribute-based encryption key using the second public key encryption method to generate a third public key ciphertext. The second secret key is used to decrypt the second public key ciphertext.

2. The ciphertext conversion system according to claim 1, wherein, The first public key encryption method is a block encryption counter mode.

3. The ciphertext conversion system according to claim 2, wherein, The first public key encryption information consists of the first secret key and the first auxiliary information used in the block-based encryption counter mode.

4. The ciphertext conversion system according to claim 3, wherein, The conversion key generation unit generates the conversion key using the first public key encryption information and the second public key encryption information, wherein the second public key encryption information consists of a second secret key and second auxiliary information used in the counter mode encryption based on the block encryption.

5. The ciphertext conversion system according to claim 4, wherein, The conversion key generation unit calculates the XOR of the result obtained by performing the first public key encryption method using the first public key encryption information and the result obtained by performing the first public key encryption method using the second public key encryption information, and uses this result as the conversion key.

6. The ciphertext conversion system according to claim 4, wherein, The ciphertext conversion system also includes a decryption device with a decryption unit. The decryption unit decrypts the attribute-based ciphertext using a user secret key corresponding to the attribute information to obtain the attribute-based encryption key. It then decrypts the third public key ciphertext using the attribute-based encryption key to obtain the second secret key. Finally, it calculates the XOR of the result obtained by encrypting the second auxiliary information using the second secret key with the second public key ciphertext, and uses this result as the plaintext. The attribute information corresponds to the attribute-based encryption key.

7. The ciphertext conversion system according to claim 5, wherein, The ciphertext conversion system also includes a decryption device with a decryption unit. The decryption unit decrypts the attribute-based ciphertext using a user secret key corresponding to the attribute information to obtain the attribute-based encryption key. It then decrypts the third public key ciphertext using the attribute-based encryption key to obtain the second secret key. Finally, it calculates the XOR of the result obtained by encrypting the second auxiliary information using the second secret key with the second public key ciphertext, and uses this result as the plaintext. The attribute information corresponds to the attribute-based encryption key.

8. The ciphertext conversion system according to any one of claims 1 to 7, wherein, The ciphertext conversion system also includes a conversion device with a conversion unit that calculates the XOR of the first public key ciphertext with the conversion key to obtain the second public key ciphertext.

9. A method for generating a conversion key, wherein, Using an attribute-based encryption method, an attribute-based encryption key is generated, and attribute-based ciphertext is obtained by encrypting the attribute-based encryption key. Based on the first public key encryption information used when generating the first public key ciphertext by encrypting plaintext with the first secret key using the first public key encryption method, a conversion key is generated to transform the first public key ciphertext into a second public key ciphertext that corresponds to the first public key encryption method but is different from the first public key ciphertext. The second secret key is encrypted using the attribute-based encryption key through the second public key encryption method to generate the third public key ciphertext, wherein the second secret key is used to decrypt the second public key ciphertext.

10. A computer-readable recording medium containing a conversion key generation program, the conversion key generation program causing a conversion key generation device, which is a computer, to perform the following processes: The conversion target setting process uses an attribute-based encryption method to generate an attribute-based encryption key and attribute-based ciphertext obtained by encrypting the attribute-based encryption key; and The conversion key generation process involves generating a conversion key based on the first public key encryption information used when encrypting plaintext with a first secret key using a first public key encryption method to generate a first public key ciphertext. This conversion key transforms the first public key ciphertext into a second public key ciphertext, which corresponds to the first public key encryption method but is different from the first public key ciphertext. Then, the second secret key is encrypted using the attribute-based encryption key using the second public key encryption method to generate a third public key ciphertext. The second secret key is used to decrypt the ciphertext of the second public key.

Images