Secret information processing system, secret information processing method, and secret information processing program

Abstract

A secret information processing system corresponding to a quantum homomorphic encryption technique satisfying strong circuit secrecy is provided with an encryption device (400). An encryption device (400) is provided with an encryption unit (404) that generates a first ciphertext by encrypting a first plaintext using a first public parameter and a first encryption key, and generates a second ciphertext by encrypting a second plaintext using a second public parameter and a second encryption key. Each of the first public parameter and the second public parameter is a parameter generated using a safety parameter. The first encryption key is an encryption key generated using a first public parameter and a first decryption key, and the first decryption key is a decryption key generated using a security parameter. The second encryption key is an encryption key generated using a second public parameter and a second decryption key, and the second decryption key is a decryption key generated using a security parameter.

Description

Technical Field

[0001] The present disclosure relates to a hidden information processing system, a hidden information processing method, and a hidden information processing program. Background Art

[0002] Quantum homomorphic encryption is an encryption technology that can perform quantum operations on data while it is encrypted. Recently, the use of cloud services has been expanding, but due to concerns about cracking and the reliability of the cloud, it is considered to encrypt and store data in the cloud. In quantum homomorphic encryption, it is possible to perform operations on encrypted data without decrypting the encrypted data. Therefore, quantum homomorphic encryption is a technology that can use cloud services that use quantum computing without compromising security.

[0003] Quantum homomorphic encryption that satisfies circuit anonymity is an encryption technology that improves the security of quantum homomorphic encryption and achieves the security of not leaking information related to the operation processing from the result obtained by performing quantum operations in a state where the data is encrypted. In particular, in quantum homomorphic encryption that satisfies circuit anonymity, quantum homomorphic encryption that achieves the security of not leaking information related to the quantum operation from the result of quantum homomorphic operations on ciphertexts that are not generated by encryption algorithms is also quantum homomorphic encryption that satisfies strong circuit anonymity. When performing operations on encrypted data, after confirming the legitimacy of the input, the operation is performed in a state where the data is encrypted by conventional quantum homomorphic encryption that satisfies circuit anonymity, thereby achieving quantum homomorphic encryption that satisfies strong circuit anonymity. Specifically, the legitimacy of the input means that the encryption key as the input of the operation is generated by a key generation algorithm, and the ciphertext as the input of the operation is generated by an encryption algorithm. Conventional quantum homomorphic encryption that satisfies circuit anonymity is quantum homomorphic encryption in which circuit anonymity only holds for ciphertexts generated by encryption algorithms.

[0004] Non-patent document 1 discloses a structural example of quantum homomorphic encryption that satisfies strong circuit anonymity, and further discloses a structural example of quantum homomorphic encryption that satisfies strong circuit anonymity and can perform homomorphic operations on ciphertexts encrypted using different encryption keys.

[0005] Prior art literature

[0006] Non-patent literature

[0007] Non-patent literature 1: Chardouvelis, O. et al., "Rate-1 Quantum Fully Homomorphic Encryption", TCC 2021: Theory of Cryptography, pp. 149-176, 2021. Summary of the invention

[0008] Problems to be solved by the invention

[0009] The existing quantum homomorphic encryption that satisfies circuit anonymity disclosed in non-patent document 1 uses a special computational problem called the Decisional Small Polynomial Ratio (DSPR) problem as the basis for security. However, it is known that the DSPR problem can be simply interpreted by using a quantum computer. In particular, in the quantum homomorphic encryption technology disclosed in non-patent document 1, the security of the homomorphic encryption that satisfies circuit anonymity used as a structural element depends on the difficulty of the DSPR problem. Therefore, the quantum homomorphic encryption that satisfies strong circuit anonymity disclosed in non-patent document 1 is also not safe for quantum computers.

[0010] The purpose of the present disclosure is to realize the following quantum homomorphic encryption technology that satisfies strong circuit anonymity: it is safe for quantum computers and can perform homomorphic operations based on quantum computing on ciphertexts encrypted by different encryption keys.

[0011] Means for solving problems

[0012] The hidden information processing system disclosed in the present invention corresponds to the quantum homomorphic encryption technology that satisfies strong circuit anonymity, wherein the hidden information processing system has an encryption device, the encryption device has an encryption unit, the encryption unit uses the first public parameter and the first encryption key to encrypt the first plaintext, thereby generating the first ciphertext, and uses the second public parameter and the second encryption key to encrypt the second plaintext, thereby generating the second ciphertext, the first public parameter and the second public parameter are parameters generated using security parameters, respectively, the first encryption key is an encryption key generated using the first public parameter and the first decryption key, the first decryption key is a decryption key generated using the security parameter, the second encryption key is an encryption key generated using the second public parameter and the second decryption key, and the second decryption key is a decryption key generated using the security parameter.

[0013] Effects of the Invention

[0014] According to the present disclosure, it is possible to realize a quantum homomorphic encryption technology that satisfies strong circuit anonymity and is secure against quantum computers, and that can perform homomorphic operations based on quantum computing on ciphertexts encrypted with different encryption keys. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a diagram showing a configuration example of a confidential information processing system 100 according to the first embodiment.

[0016] Figure 2This is a diagram showing a configuration example of the public parameter generating device 200 according to the first embodiment.

[0017] Figure 3 This is a diagram showing a configuration example of the key generation device 300 according to the first embodiment.

[0018] Figure 4 This is a diagram showing a configuration example of an encryption device 400 according to the first embodiment.

[0019] Figure 5 This is a diagram showing a configuration example of a homomorphic operation device 500 according to Embodiment 1.

[0020] Figure 6 This is a diagram showing a configuration example of a decryption device 600 according to the first embodiment.

[0021] Figure 7 This is a diagram showing a hardware configuration example of each device according to the first embodiment.

[0022] Figure 8 This is a flowchart showing the operation of the confidential information processing system 100 according to the first embodiment.

[0023] Fig. 9 This is a flowchart showing the operation of the confidential information processing system 100 according to the first embodiment.

[0024] Fig.10 This is a flowchart showing the operation of the confidential information processing system 100 according to the first embodiment.

[0025] Fig.11 This is a diagram showing a hardware configuration example of each device according to a modified example of the first embodiment. DETAILED DESCRIPTION

[0026] In the description of the embodiments and the accompanying drawings, the same reference numerals are used to indicate the same elements and corresponding elements. The description of the elements marked with the same reference numerals is appropriately omitted or simplified. The arrows in the figures mainly indicate data flows or processing flows. In addition, "unit" can also be appropriately rewritten as "equipment", "circuit", "process", "sequence", "processing", "step" or "circuit".

[0027] Implementation Method 1

[0028] Hereinafter, this embodiment will be described in detail with reference to the drawings.

[0029] ***Description of the structure***

[0030] Figure 1 FIG. 2 shows an example of a system configuration of a confidential information processing system 100 according to the present embodiment. Figure 1As shown, the secret information processing system 100 includes a public parameter generating device 200 , a key generating device 300 , an encryption device 400 , a homomorphic operation device 500 , and a decryption device 600 .

[0031] The Internet 101 is a communication path connecting the public parameter generation device 200, the key generation device 300, the plurality of encryption devices 400, the homomorphic operation device 500, and the decryption device 600. The Internet 101 is a specific example of a network. Other types of networks may be used instead of the Internet 101.

[0032] As a specific example, the public parameter generation device 200 is a PC (Personal Computer). The public parameter generation device 200 generates public parameters for generating encryption keys, decryption keys, and ciphertexts, and sends data representing the generated public parameters to the key generation device 300, the encryption device 400, and the homomorphic operation device 500 via the Internet 101. In addition, the data representing the generated public parameters may also be directly sent by mail or the like.

[0033] As a specific example, the key generation device 300 is a PC. The key generation device 300 generates encryption keys and decryption keys used in encryption, respectively, and sends data representing the generated encryption keys to the encryption device 400 and the homomorphic operation device 500 via the Internet 101, and sends data representing the generated decryption keys to the decryption device 600. In addition, the data representing each generated key can also be directly sent by mail or the like.

[0034] The decryption key is confidential information, and therefore is stored inside each of the key generation device 300 and the decryption device 600 in a manner that prevents leakage.

[0035] As a specific example, the encryption device 400 is a PC and generates ciphertext data by encrypting plaintext data obtained from a sensor in a factory using a stored public parameter and an encryption key, and transmits the generated ciphertext data to the homomorphic computing device 500 via the Internet 101 .

[0036] As a specific example, the homomorphic computing device 500 is a computer having a large-capacity storage medium. In addition, the homomorphic computing device 500 is also called a circuit-hidden quantum homomorphic computing device.

[0037] The homomorphic computing device 500 also functions as a data storage device. That is, when there is a storage request for ciphertext data from the encryption device 400, the homomorphic computing device 500 stores the ciphertext data corresponding to the storage request.

[0038] The homomorphic computing device 500 also functions as a device for performing homomorphic computing on the stored ciphertext data, i.e., the stored ciphertext data. That is, the homomorphic computing device 500 generates ciphertext data corresponding to the computing result on the plaintext data based on the stored public parameters, the stored encryption key, and the stored ciphertext data, and sends the generated ciphertext data to the decryption device 600 via the Internet 101, and the plaintext data corresponds to the stored ciphertext data.

[0039] As a specific example, the decryption device 600 is a PC. The decryption device 600 also functions as a decryption key storage device that receives data indicating a decryption key transmitted by the key generation device 300 and stores the decryption key indicated by the received data.

[0040] The decryption device 600 is also a PC that operates as a ciphertext data decryption device that receives ciphertext data sent by the homomorphic operation device 500 and decrypts the received ciphertext data using a stored decryption key, thereby obtaining a calculation result.

[0041] In addition, at least two of the public parameter generation device 200 , the key generation device 300 , the encryption device 400 , the homomorphic operation device 500 , and the decryption device 600 may be simultaneously included in the same PC.

[0042] Next, the structure of this embodiment will be described. In addition, the number of elements produced by each device may be two or more.

[0043] Figure 2 2 is a block diagram showing a configuration example of the public parameter generating device 200. Figure 2 As shown, the public parameter generating device 200 includes an input unit 201, a public parameter generating unit 202, and a transmitting unit 203. Although not shown, the public parameter generating device 200 includes a storage medium that stores data used in each unit of the public parameter generating device 200.

[0044] The input unit 201 receives data indicating the security parameter λ, and transmits the received data indicating the security parameter λ to the public parameter generation unit 202 .

[0045] The public parameter generator 202 receives as input the security parameter λ indicated by the data received from the input unit 201 and generates the public parameter PP, which is a parameter for generating the encryption key and the decryption key. Then, the public parameter generator 202 transmits data indicating the generated public parameter PP to the transmitter 203 .

[0046] The transmission unit 203 transmits data indicating the public parameter PP generated by the public parameter generation unit 202 to the key generation device 300 , the encryption device 400 , and the homomorphic operation device 500 , respectively.

[0047] Figure 3 is a block diagram showing a configuration example of the key generation device 300. Figure 3 As shown, the key generation device 300 includes an input unit 301, a public parameter storage unit 302, a decryption key generation unit 303, an encryption key generation unit 304, and a transmission unit 305. Although not shown, the key generation device 300 includes a storage medium that stores data used in each unit of the key generation device 300.

[0048] The input unit 301 receives data indicating the public parameter PP transmitted from the public parameter generating device 200 , and transmits the public parameter PP indicated by the received data to the public parameter storage unit 302 .

[0049] Furthermore, the input unit 301 receives data indicating the security parameter λ, and transmits the received data indicating the security parameter λ to the decryption key generation unit 303 .

[0050] The public parameter storage unit 302 stores the public parameters PP indicated by the data received from the input unit 301 .

[0051] The decryption key generation unit 303 generates a decryption key SK using the security parameter λ indicated by the data received from the input unit 301 , and transmits data indicating the generated decryption key SK to the encryption key generation unit 304 and the transmission unit 305 .

[0052] The encryption key generation unit 304 receives as input the public parameter PP indicated by the data received from the public parameter storage unit 302 and the decryption key SK indicated by the data received from the decryption key generation unit 303 , generates an encryption key PK, and transmits data indicating the generated encryption key PK to the transmission unit 305 .

[0053] In addition, the encryption key generation unit 304 generates a first encryption key using the first public parameter and the first decryption key, and generates a second encryption key using the second public parameter and the second decryption key. Here, the first public parameter and the second public parameter are parameters generated using the security parameter λ, respectively. The first decryption key and the second decryption key are decryption keys generated using the security parameter λ, respectively.

[0054] The transmission unit 305 transmits data indicating the decryption key SK generated by the decryption key generation unit 303 to the decryption device 600 .

[0055] Furthermore, the transmission unit 305 transmits data indicating the encryption key PK generated by the encryption key generation unit 304 to the encryption device 400 and the homomorphic operation device 500 , respectively.

[0056] Figure 44 is a block diagram showing a configuration example of the encryption device 400. Figure 4 As shown, encryption device 400 includes input unit 401, public parameter storage unit 402, encryption key storage unit 403, encryption unit 404, and transmission unit 405. Although not shown, encryption device 400 includes a storage medium that stores data used in each unit of encryption device 400.

[0057] The input unit 401 receives data indicating the public parameter PP transmitted from the public parameter generating device 200 , and transmits the received data indicating the public parameter PP to the public parameter storage unit 402 .

[0058] Furthermore, the input unit 401 receives data indicating the encryption key PK transmitted from the key generation device 300 , and transmits the received data indicating the encryption key PK to the encryption key storage unit 403 .

[0059] Furthermore, the input unit 401 receives plaintext data m, and sends the received plaintext data m to the encryption unit 404 .

[0060] The public parameter storage unit 402 stores the public parameters PP indicated by the data received from the input unit 401 .

[0061] The encryption key storage unit 403 stores the encryption key PK indicated by the data received from the input unit 401 .

[0062] The encryption unit 404 generates ciphertext data C_PK(m) corresponding to the plaintext data m using the public parameter PP received from the public parameter storage unit 402, the encryption key PK received from the encryption key storage unit 403, and the plaintext data m received from the input unit 401, and transmits the generated ciphertext data C_PK(m) to the transmission unit 405. Hereinafter, the ciphertext data obtained by encrypting the plaintext data m using the encryption key PK is expressed as ciphertext data C_PK(m).

[0063] The encryption unit 404 generates a first ciphertext by encrypting the first plaintext using the first public parameter and the first encryption key, and generates a second ciphertext by encrypting the second plaintext using the second public parameter and the second encryption key.

[0064] The sending unit 405 receives the ciphertext data C_PK(m) from the encryption unit 404 , and sends the received ciphertext data C_PK(m) to the homomorphic operation device 500 .

[0065] Figure 5 is a block diagram showing a structural example of the homomorphic operation device 500. Figure 5As shown, the homomorphic computing device 500 includes an input unit 501, a public parameter storage unit 502, an encryption key storage unit 503, a ciphertext storage unit 504, a homomorphic computing unit 505, and a sending unit 506. In addition, although not shown, the homomorphic computing device 500 includes a storage medium for storing data used in each unit of the homomorphic computing device 500.

[0066] The input unit 501 receives data indicating the public parameter PP1 and data indicating the public parameter PP2 sent by the public parameter generation device 200, and sends the received data indicating the public parameter PP1 and data indicating the public parameter PP2 to the public parameter storage unit 502. Here, the numbers added at the end of the numbers indicating the elements are marks for distinguishing between the elements of the same type that exist in plurality. As a specific example, regarding the public parameter PP1 and the public parameter PP2, 1 or 2 is added at the end in order to distinguish between the two public parameters PP generated by the public parameter generation device 200. In addition, the public parameter PP1 is equivalent to the first public parameter. The public parameter PP2 is equivalent to the second public parameter.

[0067] In addition, the input unit 501 receives the data representing the encryption key PK1 and the data representing the encryption key PK2 sent by the key generation device 300, and sends the received data representing the encryption key PK1 and the data representing the encryption key PK2 to the encryption key storage unit 503. Here, the encryption key PK1 is equivalent to the first encryption key. The encryption key PK2 is equivalent to the second encryption key. The first encryption key is composed of the first homomorphic public key generated according to the first homomorphic decryption key and the first quantum homomorphic public key generated according to the first quantum homomorphic decryption key. The second encryption key is composed of the second homomorphic public key generated according to the second homomorphic decryption key and the second quantum homomorphic public key generated according to the second quantum homomorphic decryption key.

[0068] In addition, the input unit 501 receives the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) sent by the encryption device 400, and sends the received ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) to the ciphertext storage unit 504. Here, the plaintext data m1 corresponds to the first plaintext. The plaintext data m2 corresponds to the second plaintext. The ciphertext data C_PK(m1) corresponds to the first ciphertext. The ciphertext data C_PK(m2) corresponds to the second ciphertext. The first ciphertext is a ciphertext generated based on the first public parameter, the first one-time pad key, the first homomorphic public key, the first quantum homomorphic public key, and the first random number. The second ciphertext is a ciphertext generated based on the second public parameter, the second one-time pad key, the second homomorphic public key, the second quantum homomorphic public key, and the second random number.

[0069] Furthermore, the input unit 501 receives data representing the operation circuit f, and transmits the received data representing the operation circuit f to the homomorphic operation unit 505. The operation circuit f may also be composed of a plurality of operation circuits.

[0070] The public parameter storage unit 502 stores the public parameters PP1 and PP2 indicated by the data received from the input unit 501 .

[0071] The encryption key storage unit 503 stores the encryption key PK1 and the encryption key PK2 indicated by the data received from the input unit 501 .

[0072] The ciphertext storage unit 504 stores the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) received from the input unit 501.

[0073] The homomorphic operation unit 505 calculates ciphertext data C_PK(M) using the operation circuit f indicated by the data received from the input unit 501, the public parameters PP1 and PP2 received from the public parameter storage unit 502, the encryption key PK1 and the encryption key PK2 received from the encryption key storage unit 503, and the ciphertext data C_PK(m1) and C_PK(m2) received from the ciphertext storage unit 504, and transmits the calculated ciphertext data C_PK(M) to the transmission unit 506. Here, the ciphertext data C_PK(M) is data indicating the ciphertext corresponding to the operation result data M (=f(m1, m2)), which is data indicating the operation result obtained by applying the operation indicated by the operation circuit f to the plaintext data m1 and the plaintext data m2. In addition, f(m1, m2) indicates the result of performing the operation indicated by the operation circuit f on the two plaintext data, namely, the plaintext data m1 and the plaintext data m2 as input. Below, the homomorphic operation ciphertext data of the operation result data M related to the set {PK1, PK2} composed of the encryption key PK1 and the encryption key PK2 is represented as C_PK(M). C_PK(M) is also called the homomorphic operation ciphertext data. Here, the plaintext data m1 corresponds to the first plaintext. The plaintext data m2 corresponds to the second plaintext. C_PK(M) corresponds to the third ciphertext. In addition, by using the decryption key SK1 and the decryption key SK2 on the ciphertext data C_PK(M), the operation result data M can be decrypted. Here, the decryption key SK1 is equivalent to the first decryption key. The decryption key SK2 is equivalent to the second decryption key. The first decryption key is composed of the first homomorphic decryption key and the first quantum homomorphic decryption key. The second decryption key is composed of the second homomorphic decryption key and the second quantum homomorphic decryption key.

[0074] The homomorphic operation unit 505 performs quantum calculation using the first public parameter, the second public parameter, the first ciphertext, the second ciphertext, the first encryption key, and the second encryption key, thereby generating a third ciphertext. Here, the third ciphertext is a ciphertext generated by encrypting the operation result obtained by applying the operation shown by the operation circuit f to the first plaintext and the second plaintext. The operation circuit f may also include a part for calculating the first decryption random number and a part for calculating the second decryption random number. The first decryption random number is a random number calculated based on the security parameter, the first one-time pad key, the first one-time pad key ciphertext data, the first quantum homomorphic public key, and the first random number, and is a random number used to decrypt the third ciphertext. The second decryption random number is a random number calculated based on the security parameter, the second one-time pad key, the second one-time pad key ciphertext data, the second quantum homomorphic public key, and the second random number, and is a random number used to decrypt the third ciphertext. Furthermore, when at least one of the first encryption key, the second encryption key, the first ciphertext, and the second ciphertext has not been generated, the homomorphic operation unit 505 generates random quantum data as the third ciphertext.

[0075] The homomorphic operation unit 505 determines whether the first encryption key is generated by the encryption device according to whether the first decryption random number is generated, and determines whether the second encryption key is generated by the encryption device according to whether the second decryption random number is generated. The homomorphic operation unit 505 determines whether the first ciphertext is generated by the encryption device according to whether the first decryption random number is generated, and determines whether the second ciphertext is generated by the encryption device according to whether the second decryption random number is generated.

[0076] The sending unit 506 sends the calculated ciphertext data C_PK(M) received from the homomorphic operation unit 505 to the decryption device 600 .

[0077] Figure 6 600 is a block diagram showing a structural example of the decryption device 600. Figure 6 As shown, the decryption device 600 includes an input unit 601, a decryption key storage unit 602, a decryption processing unit 603, and a decryption result storage unit 604. Although not shown, the decryption device 600 includes a storage medium that stores data used by each unit of the decryption device 600.

[0078] The input unit 601 receives the data indicating the decryption key SK1 and the data indicating the decryption key SK2 transmitted from the key generation device 300 , and transmits the received data indicating the decryption key SK1 and the data indicating the decryption key SK2 to the decryption key storage unit 602 .

[0079] In addition, the input unit 601 receives the calculated ciphertext data C_PK(M) of the calculation result data M related to the encryption key set PK={PK1, PK2} sent by the homomorphic operation device 500, and sends the received calculated ciphertext data C_PK(M) to the decryption processing unit 603.

[0080] The decryption key storage unit 602 stores the decryption key SK1 and the decryption key SK2 indicated by the data received from the input unit 601 .

[0081] The decryption processing unit 603 receives the calculated ciphertext data C_PK(M) from the input unit 601, receives the decryption key SK1 and the decryption key SK2 from the decryption key storage unit 602, uses the received decryption key SK1 and the decryption key SK2 for the received calculated ciphertext data C_PK(M), thereby decrypting the encrypted calculation result data M, and sends the decrypted calculation result data M to the decryption result storage unit 604.

[0082] The decryption result storage unit 604 receives the calculation result data M from the decryption processing unit 603, and stores the received calculation result data M.

[0083] Figure 7 FIG. 1 is a diagram showing an example of hardware resources of each device in this embodiment. Figure 7 As shown, each device is a general computer having a processor 11 (Central Processing Unit: central processing unit).

[0084] As a specific example, the processor 11 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor) or a GPU (Graphics Processing Unit). The processor 11 is connected to hardware devices such as a ROM (Read Only Memory) 13, a RAM (Random Access Memory) 14, a communication board 15, a display 31 (display device), a keyboard 32, a mouse 33, a drive 34, and a disk device 20 via a bus 12, and controls these hardware devices. The drive 34 is a device that reads and writes storage media such as FD (Flexible Disk Drive), CD (Compact Disc), and DVD (Digital Versatile Disc).

[0085] The ROM 13 , the RAM 14 , the magnetic disk device 20 , and the drive 34 are examples of storage devices.

[0086] The keyboard 32 , the mouse 33 , and the communication board 15 are examples of input devices.

[0087] The display 31 and the communication board 15 are examples of output devices.

[0088] The communication board 15 is connected to a communication network such as a LAN (Local Area Network), the Internet, or a telephone line in a wired or wireless manner.

[0089] The magnetic disk device 20 stores an OS (Operating System) 21 , a program group 22 , and a file group 23 .

[0090] The program group 22 includes a program for executing the functions described as "units" in this embodiment. The program is read and executed by the processor 11. That is, the program causes the computer to function as a "unit" and causes the computer to execute the steps and methods of the "unit".

[0091] The file group 23 includes various data (input, output, determination result, calculation result, processing result, etc.) used in the “unit” described in this embodiment.

[0092] The processing of this embodiment described with reference to the flowchart and the like is executed using hardware such as the processor 11 , a storage device, an input device, or an output device.

[0093] The part described as “part” may be implemented by firmware, software, hardware, or a combination thereof.

[0094] Any program described in this specification may be recorded in a non-volatile recording medium that can be read by a computer. As a specific example, the non-volatile recording medium is an optical disk or a flash memory. Any program described in this specification may be provided as a program product.

[0095] ***Description of the action***

[0096] The operation steps of the confidential information processing system 100 are equivalent to the confidential information processing method. The confidential information processing method is also a general term for methods corresponding to the operation steps of each device constituting the confidential information processing system 100. In addition, the program that realizes the operation of the confidential information processing system 100 is equivalent to the confidential information processing program. The confidential information processing program is also a general term for programs that realize the operation of each device constituting the confidential information processing system 100.

[0097] Figure 8 1 is a flowchart showing an example of the generation and storage process of public parameters in the confidential information processing system 100. Figure 8 The generation and storage of public parameters are explained.

[0098] In addition, steps S701 to S703 are processes performed by the public parameter generation device 200, steps S704 to S705 are processes performed by the key generation device 300, steps S706 to S707 are processes performed by the encryption device 400, and steps S708 to S709 are processes performed by the homomorphic operation device 500.

[0099] (Step S701)

[0100] The input unit 201 receives the security parameter λ.

[0101] (Step S702)

[0102] The public parameter generation unit 202 receives the security parameter λ received by the input unit 201 in step S701 as input, and generates a public parameter PP.

[0103] (Step S703)

[0104] The transmission unit 203 receives the public parameter PP generated by the public parameter generation unit 202 in step S702, and transmits data indicating the received public parameter PP to the key generation device 300, the encryption device 400, and the homomorphic operation device 500, respectively.

[0105] (Step S704)

[0106] The input unit 301 receives the data indicating the public parameter PP transmitted by the transmission unit 203 in step S703 .

[0107] (Step S705)

[0108] The public parameter storage unit 302 stores the public parameter PP indicated by the data received by the input unit 301 in step S704 .

[0109] (Step S706)

[0110] The input unit 401 receives the data indicating the public parameter PP transmitted by the transmission unit 203 in step S703 .

[0111] (Step S707)

[0112] The public parameter storage unit 402 stores the public parameter PP indicated by the data received by the input unit 401 in step S706 .

[0113] (Step S708)

[0114] The input unit 501 receives the data indicating the public parameter PP transmitted by the transmission unit 203 in step S703 .

[0115] (Step S709)

[0116] The public parameter storage unit 502 stores the public parameter PP indicated by the data received by the input unit 501 in step S708 .

[0117] Fig. 9 1 is a flowchart showing an example of the generation and storage process of encryption keys and decryption keys in the confidential information processing system 100. Fig. 9 The generation and storage process of encryption keys and decryption keys is described.

[0118] In addition, steps S801 to S804 are processes performed by the key generation device 300, steps S805 to S806 are processes performed by the encryption device 400, steps S807 to S808 are processes performed by the homomorphic operation device 500, and steps S809 to S810 are processes performed by the decryption device 600.

[0119] (Step S801)

[0120] The input unit 301 receives data representing the safety parameter λ.

[0121] (Step S802)

[0122] The decryption key generation unit 303 receives as input the security parameter λ indicated by the data received from the input unit 301 in step S801, and generates a decryption key SK represented by [Formula 1].

[0123]

Mathematical formula 1

[0124] SK=(sk,qsk)

[0125] Here, the homomorphic decryption key sk is generated by using the homomorphic key generation algorithm described in [Reference 1] with the security parameter λ as input. In addition, the quantum homomorphic decryption key qsk is generated by using the quantum homomorphic key generation algorithm described in [Reference 2] with the security parameter λ and the random number r as input.

[0126] [Reference 1]

[0127] Ostrovsky, R.et al., "Maliciously Circuit-private FHE.", CRYPTO 2014: Advances in Cryptology-CRYPTO 2014, pp.536-553, 2014.

[0128] [Reference 2]

[0129] Agarwal, A.et al., "Post-Quantum Multi-Party Computation", EUROCRYPT2021: Advances in Cryptology-EUROCRYPT 2021, pp.435-464, 2021.

[0130] (Step S803)

[0131] The encryption key generation unit 304 receives the decryption key SK generated by the decryption key generation unit 303 in step S802 and the public parameter PP stored in the public parameter storage unit 302 as input, and generates an encryption key PK represented by [Formula 2].

[0132]

Mathematical formula 2

[0133] PK=(pk,qpk,[r])

[0134] Here, the homomorphic public key pk is generated by using the homomorphic key generation algorithm described in [Reference 1] with the homomorphic decryption key sk as input. The quantum homomorphic public key qpk is generated by using the quantum homomorphic key generation algorithm described in [Reference 2] with the public parameter PP, the quantum homomorphic decryption key qsk and the random number r as input. Furthermore, the random number ciphertext [r] is generated by using the homomorphic encryption algorithm described in [Reference 1] with the random number r and the homomorphic public key pk as input.

[0135] (Step S804)

[0136] The sending unit 305 receives data representing the decryption key SK generated by the decryption key generation unit 303 in step S802, and data representing the encryption key PK generated by the encryption key generation unit 304 in step S803, and sends the received data representing the encryption key PK to the encryption device 400 and the homomorphic operation device 500 respectively, and sends the received data representing the decryption key SK to the decryption device 600.

[0137] (Step S805)

[0138] The input unit 401 receives the data indicating the encryption key PK transmitted by the transmission unit 305 in step S804.

[0139] (Step S806)

[0140] The encryption key storage unit 403 stores the encryption key PK indicated by the data received by the input unit 401 in step S805.

[0141] (Step S807)

[0142] The input unit 501 receives the data indicating the encryption key PK transmitted by the transmission unit 305 in step S804.

[0143] (Step S808)

[0144] The encryption key storage unit 503 stores the encryption key PK indicated by the data received by the input unit 501 in step S807.

[0145] (Step S809)

[0146] The input unit 601 receives the data indicating the decryption key SK transmitted by the transmission unit 305 in step S804.

[0147] (Step S810)

[0148] The decryption key storage unit 602 stores the decryption key SK indicated by the data received by the input unit 601 in step S809.

[0149] In addition, since the decryption key SK is confidential information, the decryption key storage unit 602 needs to strictly store the decryption key SK so that the decryption key SK is not leaked to the outside.

[0150] Fig.10 is a flowchart showing an example of homomorphic operations in the hidden information processing system 100. Fig.10 Explain homomorphic operations.

[0151] In addition, steps S901 to S903 are processes executed by the encryption device 400 , steps S904 to S908 are processes executed by the homomorphic operation device 500 , and steps S909 to S911 are processes executed by the decryption device 600 .

[0152] (Step S901)

[0153] As a specific example, the input unit 401 receives plaintext data m1 and plaintext data m2 collected from a sensor or the like, and sends the received plaintext data m1 and plaintext data m2 to the encryption unit 404 .

[0154] (Step S902)

[0155] The encryption unit 404 generates ciphertext data C_PK(m1) and ciphertext data C_PK(m2) expressed in the form of [Formula 3] based on the plaintext data m1 and plaintext data m2 received by the input unit 401 in step S901, the public parameters PP1 and public parameters PP2 stored in the public parameter storage unit 402, and the encryption keys PK1 and encryption keys PK2 stored in the encryption key storage unit 403. In addition, depending on the character form that can be expressed, the symbols in the mathematical formula and the symbols in the text may be different.

[0156]

Mathematical formula 3

[0157] C PK (m1)=(c1,[[otk1]]1,[otk1,s1]1)

[0158] C PK (m2)=(c2,[[otk2]]2,[otk2,s2]2)

[0159] Here, the quantum ciphertext data c1 and the quantum ciphertext data c2 are generated by using the quantum one-time pad encryption algorithm recorded in [Reference 2] with the one-time pad key otk1 and the one-time pad key otk2 as inputs, respectively. Here, the one-time pad key otk1 is equivalent to the first one-time pad key. The one-time pad key otk2 is equivalent to the second one-time pad key. [[otk1]]_1 and [[otk2]]_2, which are one-time pad key ciphertext data, are generated by using the multiple key quantum homomorphic encryption algorithm recorded in [Reference 2] with the one-time pad key otk1 or the one-time pad key otk2, the quantum homomorphic public key qpk1 or the quantum homomorphic public key qpk2, and the random number s1 or the random number s2 as inputs, respectively. Here, the quantum homomorphic public key qpk1 is equivalent to the first quantum homomorphic public key. The quantum homomorphic public key qpk2 is equivalent to the second quantum homomorphic public key. In addition, the public parameters PP1 and the public parameters PP2 are used as inputs of the multiple key quantum homomorphic encryption algorithms, respectively. Furthermore, [otk1, s1]_1 and [otk2, s2]_2, which are the one-time pad key and random number ciphertext data, are generated using the homomorphic encryption algorithm described in [Reference 1] using the one-time pad key otk1 or the one-time pad key otk2, the homomorphic public key pk1 or the homomorphic public key pk2, and the random number s1 or the random number s2 as inputs, respectively. Here, the homomorphic public key pk1 is equivalent to the first homomorphic public key. The homomorphic public key pk2 is equivalent to the second homomorphic public key. The random number s1 is equivalent to the first random number. The random number s2 is equivalent to the second random number. The encryption unit 404 sends the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) to the sending unit 405 of the encryption device 400, respectively.

[0160] (Step S903)

[0161] The sending unit 405 receives the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) sent by the encryption unit 404 in step S902 , and sends the received ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) to the homomorphic operation device 500 .

[0162] (Step S904)

[0163] The input unit 501 receives the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) transmitted from the transmission unit 405 , and transmits the received ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) to the ciphertext storage unit 504 .

[0164] (Step S905)

[0165] The ciphertext storage unit 504 receives the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) sent from the input unit 501 in step S904, and stores the received ciphertext data C_PK(m1) and the ciphertext data C_PK(m2).

[0166] (Step S906)

[0167] The input unit 501 receives an operation circuit f input from a keyboard, a mouse, a storage device, or the like, and sends the received operation circuit f to the homomorphic operation unit 505 .

[0168] (Step S907)

[0169] The homomorphic operation unit 505 takes as input the operation circuit f received from the input unit 501, the public parameters PP1 and PP2 stored in the public parameter storage unit 502, the encryption key PK1 and encryption key PK2 stored in the encryption key storage unit 503, and the ciphertext data C_PK(m1) and ciphertext data C_PK(m2) stored in the ciphertext storage unit 504, generates a post-operation ciphertext data C_PK(M) corresponding to the operation result data M (=f(m1, m2)) corresponding to the encryption key set {PK1, PK2} expressed in the form of [Mathematical Formula 4], and sends the generated post-operation ciphertext data C_PK(M) to the sending unit 506.

[0170]

Mathematical formula 4

[0171] C PK (M)=(c′,(c1′,c2′))

[0172] Here, the ciphertext data c' after quantum homomorphic operation is generated by the method described in [Formula 5]. The partial ciphertext data c1' and c2' after quantum homomorphic operation are generated by using the homomorphic operation algorithm described in [Reference 1] using the operation circuit described in [Formula 7] or [Formula 8], the homomorphic public key pk1 or the homomorphic public key pk2, the random number ciphertext data [r1]_1 or the random number ciphertext data [r2]_2, and the one-time pad key and the random number ciphertext data [otk1, s1]_1 or [otk2, s2]_2 as inputs.

[0173]

Mathematical formula 5

[0174] c′=QOTP.Enc(otk′,c″)

[0175] Here, the algorithm QOTP.Enc is the quantum one-time pad encryption algorithm described in [Reference 2], and the one-time pad key otk' is a randomly selected bit sequence. In addition, c" is generated using the quantum homomorphic operation algorithm described in [Reference 2] using the quantum circuit G represented by [Mathematical Formula 6], the quantum homomorphic public key qpk1 and the quantum homomorphic public key qpk2, and [[otk1]]_1 and [[otk2]]_2 as the one-time pad key ciphertext data as input. In addition, the public parameters PP1 and PP2 are used as inputs of the quantum homomorphic operation algorithm.

[0176]

Mathematical formula 6

[0177] G c1，c2 (otk1,otk2)=f(QOTP.Dec(otk1,c1),QOTP.Dec(otk2,c2))

[0178] Here, the algorithm QOTP.Dec is the quantum one-time pad decryption algorithm described in [Reference 2].

[0179]

Mathematical formula 7

[0180]

[0181]

Mathematical formula 8

[0182]

[0183] Here, algorithms MKQFHE.Gen and MKQFHE.Enc are the quantum homomorphic key generation algorithm and quantum homomorphic encryption algorithm described in [Reference 2], respectively. In addition, random number ρ1 and random number ρ2 are random numbers used to decrypt ciphertext data, and are numbers that satisfy the relationship of [Formula 9] for the one-time password key otk'. Here, [Formula 7] is equivalent to the part for calculating the first decrypted random number. [Formula 8] is equivalent to the part for calculating the second decrypted random number. Random number ρ1 is equivalent to the first decrypted random number. Random number ρ2 is equivalent to the second decrypted random number.

[0184] In addition, the homomorphic operation unit 505 performs the operation shown in the operation circuit f respectively recorded in [Math 7] and [Math 8] in the state where the data is encrypted, thereby confirming whether each encryption key PK and each ciphertext data C_PK(m) are correctly generated. Here, according to the structure of the operation circuit f respectively recorded in [Math 7] and [Math 8], when the encryption key that is not generated by the key generation device 300 is used in the homomorphic operation unit 505, the random number ρ1 and the random number ρ2 cannot be obtained in the decryption device 600. In addition, when the ciphertext data that is not generated by the encryption device 400 is used in the homomorphic operation unit 505, the random number ρ1 and the random number ρ2 cannot be obtained in the decryption device 600.

[0185]

Mathematical formula 9

[0186] otk'=XOR(ρ1,ρ2)

[0187] Here, the operation circuit XOR is a circuit that calculates XOR of each bit of ρ1 and ρ2 which are inputs to the circuit.

[0188] (Step S908)

[0189] The sending unit 506 sends the calculated ciphertext data C_PK(M) sent from the homomorphic operation unit 505 in step S907 to the decryption device 600.

[0190] (Step S909)

[0191] The input unit 601 receives the calculated ciphertext data C_PK(M) transmitted from the transmission unit 506 in step S908 , and transmits the received calculated ciphertext data C_PK(M) to the decryption processing unit 603 .

[0192] (Step S910)

[0193] The decryption processing unit 603 performs decryption processing using the calculated ciphertext data C_PK(M) sent from the input unit 601 in step S909, and the decryption key SK1 and the decryption key SK2 stored in the decryption key storage unit 602, thereby obtaining a decryption result M. Here, regarding the encryption key set {PK1, PK2} corresponding to the calculated ciphertext data C_PK(M), the decryption processing unit 603 can decrypt the decryption result M (=f(m1, m2)) only when the encryption key PK1 is generated in the encryption key generation unit 304 using the decryption key SK1 as input and the encryption key PK2 is generated in the encryption key generation unit 304 using the decryption key SK2 as input.

[0194] The decryption processing unit 603 sends the decryption result M to the decryption result storage unit 604 .

[0195] (Step S911)

[0196] The decryption result storage unit 604 stores the decryption result M sent by the decryption processing unit 603 in step S910.

[0197] In addition, the ciphertext received by the decryption device 600 is the ciphertext after the homomorphic operation is applied. Therefore, in the case of decrypting the ciphertext before the homomorphic operation is applied, the homomorphic operation device 500 is required to perform a homomorphic operation that directly outputs the same value as the input, and decrypts the ciphertext obtained by performing the homomorphic operation and after the homomorphic operation is applied in the same way as the process in step S910, thereby being able to decrypt the plaintext data corresponding to the ciphertext before the homomorphic operation is applied.

[0198] Through step S911 , the homomorphic operation process of the hidden information processing system 100 ends.

[0199] ***Description of the Effects of Implementation Method 1***

[0200] As described above, in this embodiment, homomorphic encryption that satisfies circuit anonymity for quantum computer security is used internally. Here, the encryption techniques described in [Reference 1] and [Reference 2] are respectively secure for quantum computers. Therefore, the quantum homomorphic encryption method that satisfies strong circuit anonymity in this embodiment also has security for quantum computers. On the other hand, in the prior art, homomorphic encryption that satisfies circuit anonymity that is not secure for quantum computers is used internally, and therefore, it does not have security for quantum computers.

[0201] In addition, the present embodiment has security against quantum computers, and therefore, parameters can be set more efficiently to implement the encryption method. On the other hand, in the prior art, there is no security against quantum computers, and therefore, it is necessary to calculate a ciphertext with a size large enough to have security against quantum computers.

[0202] Therefore, according to the present embodiment, there is no need to generate a ciphertext that is secure against quantum computers and has a sufficiently large size, and thus efficiency is improved.

[0203] ***Other structures***

[0204] <Modification 1>

[0205] Fig.11 A hardware configuration example of each device according to this modification is shown.

[0206] Each device has a processing circuit 18 instead of the processor 11 , the processor 11 and the ROM 13 , the processor 11 and the RAM 14 , or the processor 11 , the ROM 13 , and the RAM 14 .

[0207] The processing circuit 18 is hardware that realizes at least a part of each unit included in each device.

[0208] The processing circuit 18 may be dedicated hardware, or may be a processor that executes a program stored in the RAM 14 .

[0209] When the processing circuit 18 is dedicated hardware, as a specific example, the processing circuit 18 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof.

[0210] Each device may include a plurality of processing circuits instead of the processing circuit 18. The plurality of processing circuits share the role of the processing circuit 18.

[0211] In each device, part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0212] As a specific example, the processing circuit 18 is implemented by hardware, software, firmware, or a combination thereof.

[0213] The processor 11, ROM 13, RAM 14, and processing circuit 18 are collectively referred to as a “processing circuit.” That is, the functions of each functional component of each device are realized by the processing circuit.

[0214] ***Other Implementations***

[0215] Embodiment 1 has been described, but multiple parts of this embodiment may be implemented in combination. Alternatively, this embodiment may be implemented partially. In addition, this embodiment may be modified in various ways as needed, and may be implemented as a whole or in part in any combination.

[0216] In addition, the above-described embodiments are merely preferred examples in nature and are not intended to limit the scope of the present disclosure, its applications, and uses. The steps described using flowcharts and the like may be appropriately modified.

[0217] Description of symbols

[0218] 11: processor; 12: bus; 13: ROM; 14: RAM; 15: communication board; 18: processing circuit; 20: disk device; 21: OS; 22: program group; 23: file group; 31: display; 32: keyboard; 33: mouse; 34: driver; 100: hidden information processing system; 101: Internet; 200: public parameter generation device; 201: input unit; 202: public parameter generation unit; 203: transmission unit; 300: key generation device; 301: input unit; 302: public parameter storage unit; 303: decryption key generation unit ; 304: encryption key generation unit; 305: sending unit; 400: encryption device; 401: input unit; 402: public parameter storage unit; 403: encryption key storage unit; 404: encryption unit; 405: sending unit; 500: homomorphic operation unit; 501: input unit; 502: public parameter storage unit; 503: encryption key storage unit; 504: ciphertext storage unit; 505: homomorphic operation unit; 506: sending unit; 600: decryption device; 601: input unit; 602: decryption key storage unit; 603: decryption processing unit; 604: decryption result storage unit.

Claims

1. A hidden information processing system, which corresponds to quantum homomorphic encryption technology that satisfies strong circuit anonymity, wherein: The hidden information processing system includes an encryption device, the encryption device includes an encryption unit, the encryption unit encrypts a first plaintext using a first public parameter and a first encryption key to generate a first ciphertext, and encrypts a second plaintext using a second public parameter and a second encryption key to generate a second ciphertext. The first public parameter and the second public parameter are parameters generated using security parameters, respectively. The first encryption key is an encryption key generated using the first public parameter and a first decryption key, and the first decryption key is a decryption key generated using the security parameter. The second encryption key is an encryption key generated using the second public parameter and a second decryption key, and the second decryption key is a decryption key generated using the security parameter.

2. The hidden information processing system according to claim 1, wherein: The confidential information processing system further includes a key generation device including an encryption key generation unit that generates the first encryption key using the first public parameter and the first decryption key, and generates the second encryption key using the second public parameter and the second decryption key.

3. The hidden information processing system according to claim 1 or 2, wherein: The hidden information processing system also has a homomorphic operation device, which has a homomorphic operation unit. The homomorphic operation unit uses an operation circuit, the first public parameter, the second public parameter, the first ciphertext, the second ciphertext, the first encryption key and the second encryption key to perform quantum calculations, thereby generating a third ciphertext, which is a ciphertext generated by encrypting a result of an operation obtained by applying the operation shown by the operation circuit to the first plaintext and the second plaintext.

4. The hidden information processing system according to claim 3, wherein: The homomorphic operation unit generates random quantum data as the third ciphertext when at least one of the first encryption key, the second encryption key, the first ciphertext, and the second ciphertext has not been generated.

5. The hidden information processing system according to claim 3 or 4, wherein: The first decryption key is composed of a first homomorphic decryption key and a first quantum homomorphic decryption key. The second decryption key is composed of a second homomorphic decryption key and a second quantum homomorphic decryption key. The first encryption key is composed of a first homomorphic public key generated from the first homomorphic decryption key and a first quantum homomorphic public key generated from the first quantum homomorphic decryption key. The second encryption key is composed of a second homomorphic public key generated from the second homomorphic decryption key and a second quantum homomorphic public key generated from the second quantum homomorphic decryption key. The first ciphertext is generated based on the first public parameter, the first one-time pad key, the first homomorphic public key, the first quantum homomorphic public key and the first random number, The second ciphertext is generated based on the second public parameter, a second one-time pad key, the second homomorphic public key, the second quantum homomorphic public key, and a second random number.

6. The hidden information processing system according to claim 5, wherein: The operation circuit includes the following parts: A part for calculating a random number, i.e., a first decryption random number, for decrypting the third ciphertext based on the security parameter, the first one-time pad key, the first one-time pad key ciphertext data, the first quantum homomorphic public key, and the first random number; as well as A part for calculating a random number, i.e., a second decryption random number, for decrypting the third ciphertext based on the security parameter, the second one-time pad key, the second one-time pad key ciphertext data, the second quantum homomorphic public key, and the second random number, The first one-time pad key ciphertext data is ciphertext data generated based on the first one-time pad key, the first quantum homomorphic public key and the first random number, The second one-time pad key ciphertext data is ciphertext data generated based on the second one-time pad key, the second quantum homomorphic public key and the second random number, The homomorphic operation unit determines whether the first encryption key is generated by the encryption device based on whether the first decrypted random number is generated, and determines whether the second encryption key is generated by the encryption device based on whether the second decrypted random number is generated.

7. The hidden information processing system according to claim 5, wherein: The operation circuit includes the following parts: A part for calculating a random number, i.e., a first decryption random number, for decrypting the third ciphertext based on the security parameter, the first one-time pad key, the first one-time pad key ciphertext data, the first quantum homomorphic public key, and the first random number; as well as A part for calculating a random number, i.e., a second decryption random number, for decrypting the third ciphertext based on the security parameter, the second one-time pad key, the second one-time pad key ciphertext data, the second quantum homomorphic public key, and the second random number, The first one-time pad key ciphertext data is ciphertext data generated based on the first one-time pad key, the first quantum homomorphic public key and the first random number, The second one-time pad key ciphertext data is ciphertext data generated based on the second one-time pad key, the second quantum homomorphic public key and the second random number, The homomorphic operation unit determines whether the first ciphertext is generated by the encryption device based on whether the first decrypted random number is generated, and determines whether the second ciphertext is generated by the encryption device based on whether the second decrypted random number is generated.

8. A method for processing hidden information, corresponding to quantum homomorphic encryption technology that satisfies strong circuit anonymity, wherein: The computer encrypts the first plaintext using the first public parameter and the first encryption key to generate the first ciphertext, and encrypts the second plaintext using the second public parameter and the second encryption key to generate the second ciphertext. The first public parameter and the second public parameter are parameters generated using security parameters, respectively. The first encryption key is an encryption key generated using the first public parameter and a first decryption key, and the first decryption key is a decryption key generated using the security parameter. The second encryption key is an encryption key generated using the second public parameter and a second decryption key, and the second decryption key is a decryption key generated using the security parameter.

9. A hidden information processing program, the hidden information processing program corresponds to quantum homomorphic encryption technology that satisfies strong circuit anonymity, wherein: The hidden information processing program causes the encryption device as a computer to perform the following encryption processing: encrypting a first plaintext using a first public parameter and a first encryption key to generate a first ciphertext, encrypting a second plaintext using a second public parameter and a second encryption key to generate a second ciphertext, The first public parameter and the second public parameter are parameters generated using security parameters, respectively. The first encryption key is an encryption key generated using the first public parameter and a first decryption key, and the first decryption key is a decryption key generated using the security parameter. The second encryption key is an encryption key generated using the second public parameter and a second decryption key, and the second decryption key is a decryption key generated using the security parameter.

Images