Encryption system, encryption method and encryption program

Abstract

Ciphertext conversion system (100), comprising: a conversion key generating device (600), comprising a conversion target setting unit (603) for performing encryption of a public-key encryption scheme using a public key and a first decryption release condition to produce a first converted public-key ciphertext and a key corresponding to the first converted public-key ciphertext; and a key generation unit (604) for performing encryption of a symmetric key encryption scheme using a second secret key of a symmetric key encryption as plaintext and the key corresponding to the first converted public key ciphertext as secret key to generate a first partial conversion key, and to calculate, as a second partial conversion key, an exclusive OR of a value calculated by performing encryption in a counter mode of a block cipher using a first secret key of a symmetric key encryption and a first auxiliary piece of information, and a value calculated by performing encryption in the counter mode of the block cipher using the second secret key of a symmetric key encryption and a second auxiliary piece of information; and a conversion device (700), comprising a conversion unit (704) for computation, as at least a part of a converted symmetric key ciphertext to be used for decrypting a plaintext used in generating a symmetric key ciphertext, an exclusive OR of the symmetric key ciphertext and the second part conversion key, wherein the symmetric key ciphertext is an exclusive OR of the plaintext, and a value computed by performing a block cipher counter-mode encryption using the first secret key of the symmetric key encryption and the first auxiliary information.

Description

Technical field

[0001] The present disclosure relates to a ciphertext conversion system, a ciphertext conversion method and a ciphertext conversion program. State of the art

[0002] A proxy re-encryption (PRE) system is a system that delegates the authority to decrypt a ciphertext to another person without decrypting the ciphertext itself. Nonpatent literature 1 discloses a PRE scheme in an arbitrary attribute-based encryption scheme (attribute-based PRE, ABPRE). Using the technique described in nonpatent literature 1, proxy encryption can be implemented between different attribute-based encryption schemes. Nonpatent literature 2 discloses a technique that modifies a key without decrypting a ciphertext of a symmetric-key encryption.

[0003] Patent literature 1 describes a ciphertext conversion system comprising a conversion key generation device. The conversion key generation device includes a conversion target setting unit and a conversion key generation unit. The conversion target setting unit generates an attribute-based encryption key and an attribute-based ciphertext, which is encrypted from the attribute-based encryption key according to an attribute-based encryption scheme.The conversion key generation unit generates a conversion key that transforms a first common-key ciphertext into a second common-key ciphertext. This second ciphertext conforms to a first common-key cryptographic scheme but differs from the first. It does this based on initial cryptographic common-key information used in generating the first common-key ciphertext by encrypting a plaintext with a first secret key according to a first common-key cryptographic scheme. The conversion key generation unit then generates a third common-key ciphertext according to a second common-key cryptographic scheme by encrypting a second secret key, used to decrypt the second common-key ciphertext, with the attribute-based encryption key.Patent literature 2 and 3 describe further cryptographic techniques known from the prior art. Reference list Non-patented literature Non-Patent Literature 1: Z. Yu, MH Au, R. Yang, J. Lai, Q. Xu, “Achieving Flexibility for ABE with Outsourcing via Proxy Re-Encryption,” ASIACCS' 18, June 2018 Nonpatent Literature 2: A. Syalim, T. Nishide, and K. Sakurai, “Realizing Proxy Re-encryption in the Symmetric World,” Communications in Computer and Information Science 251, November 2011 Patent literature Patent literature 1: DE 11 2021 007 337 T5 Patent literature 2: DE 699 00 178 T2 Patent literature 3: DE 600 24 739 T2 Summary of the invention: Technical problem

[0004] A typical proxy re-encryption scheme, such as the one disclosed in non-patent literature 1, is a technique that transforms a ciphertext of one public-key encryption scheme into a ciphertext of another public-key encryption scheme. The technique disclosed in non-patent literature 2 is a technique that transforms a ciphertext of one symmetric-key encryption scheme into a ciphertext of the same symmetric-key encryption scheme. That is, to transform a ciphertext of one symmetric-key encryption scheme into a ciphertext of one public-key encryption scheme using existing techniques, it is necessary to first decrypt the ciphertext of the symmetric-key encryption scheme and then encrypt the decrypted plaintext using the public-key encryption scheme.One problem with existing methods is therefore that when converting the ciphertext of the symmetric key encryption scheme into the ciphertext of the public key encryption scheme, plaintext is revealed, resulting in low security.

[0005] The aim of the present disclosure is to convert a ciphertext encrypted with a symmetric key encryption scheme into a ciphertext of a public key encryption scheme without decryption. Solution to the problem

[0006] A ciphertext conversion system according to the present disclosure comprises a conversion key generating device, comprising a conversion target setting unit for performing encryption of a public-key encryption scheme using a public key and an initial decryption release condition to generate an initial converted public-key ciphertext and a key corresponding to the initial converted public-key ciphertext; and a key generation unit for performing encryption of a symmetric key encryption scheme using a second secret key of a symmetric key encryption as plaintext and the key corresponding to the first converted public key ciphertext as secret key to generate a first partial conversion key, and to calculate, as a second partial conversion key, an exclusive OR of a value calculated by performing encryption in a counter mode of a block cipher using a first secret key of a symmetric key encryption and a first auxiliary piece of information, and a value calculated by performing encryption in the counter mode of the block cipher using the second secret key of a symmetric key encryption and a second auxiliary piece of information; and a conversion device comprising a conversion unit for computation, comprising at least a part of a converted symmetric key ciphertext to be used for decrypting a plaintext, which is used in generating a symmetric key ciphertext, an exclusive OR of the symmetric key ciphertext and the second partial conversion key, wherein the symmetric key ciphertext is an exclusive OR of the plaintext, and a value computed by performing an encryption in the counter mode of the block cipher using the first secret key of the symmetric key encryption and the first auxiliary information. Advantageous effects of the invention

[0007] According to the present disclosure, an exclusive OR of a symmetric-key ciphertext and a second partial conversion key is generated as a converted symmetric-key ciphertext. A second secret key for symmetric encryption is used in the computation of the second partial conversion key. The second secret key for symmetric encryption is decrypted by decrypting a first partial conversion key using a key corresponding to a first converted public-key ciphertext. The first converted public-key ciphertext is a ciphertext of a public-key encryption scheme. Therefore, a ciphertext encrypted with a symmetric-key encryption scheme can be converted into a ciphertext of a public-key encryption scheme without decryption. Brief description of the drawings Fig. Figure 1 is a representation, showing an example of a configuration of a ciphertext conversion system 100 according to embodiment 1; Fig. Figure 2 is a representation, showing an example of a configuration of a symmetric secret key generation device 200 according to embodiment 1; Fig. Figure 3 is a representation, showing an example of a configuration of a common parameter generating device 300 according to embodiment 1; Fig. Figure 4 is a representation, showing an example of a configuration of a user secret key generation device 400 according to embodiment 1; Fig. Figure 5 is a representation, showing an example of a configuration of a ciphertext generation device 500 according to embodiment 1; Fig. Figure 6 is a representation, showing an example of a configuration of a conversion key generating device 600 according to embodiment 1; Fig. Figure 7 is a representation, showing an example of a configuration of a conversion device 700 according to embodiment 1; Fig. Figure 8 is a representation, showing an example of a configuration of a decryption device 800 according to embodiment 1; Fig. Figure 9 is a representation, showing an example of a hardware configuration for each of the devices according to embodiment 1; Fig. Figure 10 is a flowchart illustrating the operation of the symmetric secret key generation device 200 according to embodiment 1; Fig. Figure 11 is a flowchart illustrating the operation of the common parameter generating device 300 according to embodiment 1; Fig. Figure 12 is a flowchart illustrating the operation of the user secret key generation device 400 according to embodiment 1; Fig. Figure 13 is a flowchart illustrating the operation of the ciphertext generation device 500 according to embodiment 1; Fig. Figure 14 is a flowchart illustrating an operation of the conversion key generation device 600 according to embodiment 1; Fig. Figure 15 is a flowchart illustrating the operation of the conversion device 700 according to embodiment 1; Fig. Figure 16 is a flowchart illustrating an operation of the decryption device 800 according to embodiment 1; and Fig. Figure 17 is a representation, illustrating an example of a hardware configuration of each of the devices according to embodiment 1. Description of embodiments

[0008] In the description and drawings of the embodiments, identical and corresponding elements are designated by the same reference numeral. The description of elements designated by the same reference numeral may be omitted or simplified where appropriate. Arrows in diagrams primarily indicate data flows and signals or processing flows. "Device" or "unit" may be interpreted as "equipment," "plant," "circuit," "step," "sequence," "process," or "circuit" where appropriate. Design 1.*** Configuration Description ***

[0009] In this embodiment, a ciphertext conversion system 100 is disclosed. An overview of this embodiment is described below with reference to the drawings.

[0010] Fig. Figure 1 is a block diagram showing a configuration example for the ciphertext conversion system 100 according to the present embodiment. As shown in Fig. As shown in Figure 1, the ciphertext conversion system 100 comprises a plurality of symmetric secret key generation devices 200, a common parameter generation device 300, a plurality of user secret key generation devices 400, a ciphertext generation device 500, a conversion key generation device 600, a conversion device 700 and a decryption device 800.

[0011] The devices comprising the Ciphertext Conversion System 100 can be installed on a local area network (LAN) or similar within the same company, instead of being connected to each other via the Internet 101 to enable communication. At least two of the devices comprising the Ciphertext Conversion System 100 can be configured as single units, depending on requirements.

[0012] The Internet 101 is a communication channel that connects the multiple Symmetric Secret Key Generation Devices 200, the Common Parameter Generation Device 300, the multiple User Secret Key Generation Devices 400, the Ciphertext Generation Device 500, the Conversion Key Generation Device 600, the Conversion Device 700, and the Decryption Device 800 to enable communication. The Internet 101 is a specific example of a network. Other types of networks can be used instead of the Internet 101.

[0013] The Symmetric Key Generating Device 200, as a specific example, is a personal computer (PC) and is also referred to as the Symmetric Key Encryption Secret Key Generating Device. The Symmetric Key Generating Device 200 is a computer that generates a secret key sk and transmits the generated secret key sk to the Ciphertext Generating Device 500 and the Transformation Key Generating Device 600. The secret key sk is also referred to as the secret key for the Symmetric Key Encryption.

[0014] In this specific example, the Common Parameter Generation Device 300 is a PC and is a computer that generates common parameters for use in the Ciphertext Conversion System 100 and transmits information specifying the generated common parameters via the Internet 101 to the multiple User Secret Key Generation Devices 400, the Conversion Key Generation Device 600, and the Conversion Device 700. The common parameters include a Master Secret Key (msk) and a Public Key (pk). The information specifying the common parameters can be sent directly to each device by mail or similar means instead of being transmitted via the Internet 101. The terms "data" and "information" can essentially have the same meaning.

[0015] For example, the User Secret Generator 400 is a PC. The User Secret Generator 400 is a computer that receives the master secret msk from the Common Parameter Generator 300, accepts as input information specifying an attribute parameter Γ, and generates a User Secret sk. Γ using the main secret key msk and the attribute parameter Γ, the generated user secret key sk is created. Γ transmits to the decryption device 800.

[0016] The ciphertext generator 500 is a device that functions as a data encryption device, such as a PC, and is also referred to as a symmetric key ciphertext generator. The ciphertext generator 500 receives the secret key sk from the symmetric secret key generator 200 and also accepts input information specifying a plaintext M. The ciphertext generator 500 is a computer that generates auxiliary information auxC, creates a symmetric key ciphertext Csk using the secret key sk, the plaintext M, and the auxiliary information auxC, transmits the generated symmetric key ciphertext Csk to the conversion device 700, and transmits the generated auxiliary information auxC to the conversion key generator 600. The auxiliary information auxC is also referred to as ciphertext auxiliary information.

[0017] For example, the conversion key generation device 600 is a PC. The conversion key generation device 600 is a computer that receives the public key pk from the common parameter generation device 300, receives the secret key sk from the symmetric secret key generation device 200, receives the auxiliary information auxC from the ciphertext generation device 500, accepts as input information specifying a decryption release condition L, generates auxiliary information auxC', generates a conversion key ck based on the received data, the decryption release condition L, and the generated auxiliary information auxC', and transmits the generated conversion key ck to the conversion device 700.

[0018] For example, the conversion device 700 is a PC. The conversion device 700 is a computer that receives the conversion key ck from the conversion key generation device 600, receives the symmetric key ciphertext Csk from the ciphertext generation device 500, accepts as input information specifying a decryption release condition L', generates a converted symmetric key ciphertext (Csk', auxC') and a converted public key ciphertext Cpk using the received data and the decryption release condition L', and transmits the generated converted public key ciphertext Csk' and the converted public key ciphertext Cpk to the decryption device 800.In the decryption release condition L', a logical expression is used to express a condition corresponding to a user who can decrypt the converted ciphertexts.

[0019] The decryption device 800 is, for example, a PC. The decryption device 800 is a computer that receives the converted public-key ciphertext (Csk', auxC') and the converted public-key ciphertext Cpk from the conversion device 700, as well as the user secret key sk. Γ receives from the user secret key generation device 400 and outputs a result of the decryption of the plaintext M using the received data.

[0020] The configurations of this embodiment are described below.

[0021] Fig. Figure 2 is a block diagram showing an example configuration of the Symmetric Secret Key Generating Device 200. As shown in Fig. As shown in Figure 2, the symmetric secret key generation device 200 comprises an input unit 201, a symmetric key encryption key generation unit 202, and a transmission unit 203. Although not shown, the symmetric secret key generation device 200 includes a recording medium that stores data used in each unit of the symmetric secret key generation device 200.

[0022] The input unit 201 accepts the input of information specifying a key bit length k to be used in the ciphertext conversion system 100.

[0023] The Symmetric Key Encryption Key Generation Unit 202 generates the secret key sk. The secret key sk is used as the basis for operations in the Ciphertext Conversion System 100. Although not shown, the Symmetric Key Encryption Key Generation Unit 202 may include a function for generating random numbers and the like to generate the secret key sk.

[0024] The transmission unit 203 transmits the secret key sk generated by the symmetric key encryption key generation unit 202 to the ciphertext generation device 500 and the conversion key generation device 600.

[0025] Fig. Figure 3 is a block diagram showing an example configuration of the Common Parameter Generating Device 300. As shown in Fig. As shown in Figure 3, the common parameter generating device 300 comprises an input unit 301, a common parameter generating unit 302, and a transmission unit 303. Although not shown, the common parameter generating device 300 includes a recording medium that stores data used in each unit of the common parameter generating device 300.

[0026] The input unit 301 accepts the input of information specifying the key bit length k to be used in the ciphertext conversion system 100.

[0027] The Joint Parameter Generation Unit 302 generates the public key pk and the master secret key msk. The public key pk and the master secret key msk serve as the basis for operations in the Ciphertext Conversion System 100. Although not shown, the Joint Parameter Generation Unit 302 may be equipped with a function for generating random numbers or similar to create the public key pk and the master secret key msk.

[0028] The transmission unit 303 transmits the public key pk generated by the common parameter generation unit 302 to the conversion key generation device 600 and the conversion device 700. The transmission unit 303 also transmits the master secret key msk through the common parameter generation unit 302 to each of the plurality of user secret key generation devices 400.

[0029] Fig. Figure 4 is a block diagram showing an example configuration of the User Secret Key Generation Device 400. As shown in Fig. As shown in Figure 4, the user secret key generation device 400 comprises an input unit 401, a key receiving unit 402, a key generation unit 403, and a key transmission unit 404. Although not shown, the user secret key generation device 400 includes a recording medium that stores data used in each unit of the user secret key generation device 400.

[0030] Input unit 401 accepts input of information specifying the attribute parameter Γ.

[0031] The key receiving unit 402 receives the master secret key msk.

[0032] The key generation unit 403 generates the user secret key sk Γusing the attribute parameter Γ and the primary secret key msk. Although not shown, the key generation unit 403 may contain a function for generating random numbers and the like to generate the user secret key sk.

[0033] The transmission unit 404 transmits the user secret key sk generated by the key generation unit 403. Γ to the decryption device 800.

[0034] Fig. Figure 5 is a block diagram showing an example configuration of the ciphertext generation device 500. As shown in Fig. As shown in Figure 5, the ciphertext generation device 500 comprises an input unit 501, a key receiving unit 502, an encryption unit 503, and a transmission unit 504. Although not shown, the ciphertext generation device 500 includes a recording medium that stores data used in each unit of the ciphertext generation device 500.

[0035] The input unit 501 accepts input of information specifying the plaintext M.

[0036] The key receiving unit 502 receives the secret key sk.

[0037] The encryption unit 503 generates the auxiliary information auxC, and then generates a symmetric-key ciphertext Csk using the plaintext M, the secret key sk, and the generated auxiliary information auxC. Although not shown, the encryption unit 503 may include a function for generating random numbers and the like to create the symmetric-key ciphertext Csk.

[0038] The transmission unit 504 transmits the symmetric key ciphertext Csk generated by the encryption unit 503 to the conversion device 700 and transmits the auxiliary information auxC generated by the encryption unit 503 to the conversion key generation device 600.

[0039] Fig. Figure 6 is a block diagram showing an example configuration of the Conversion Key Generation Device 600. As shown in Fig. As shown in Figure 6, the conversion key generation device 600 comprises a key receiving unit 601, an input unit 602, a conversion target setting unit 603, a key generation unit 604, and a transmission unit 605. Although not shown, the conversion key generation device 600 includes a recording medium that stores data used in each unit of the conversion key generation device 600.

[0040] The key receiving unit 601 receives the public key pk, the secret key sk and the auxiliary information auxC.

[0041] The input unit 602 accepts as input information specifying the decryption release condition L.

[0042] The conversion target setting unit 603 uses the public key pk and the decryption release condition LP, which is part of the conversion key ck. At this point, the conversion target setting unit 603 performs encryption of a public-key cipher scheme using the public key pk and an initial decryption release condition to generate an initial converted public-key ciphertext and a key corresponding to the initial converted public-key ciphertext. The public-key cipher scheme could be, for example, a functional cipher or an attribute-based cipher that allows setting an access scope.

[0043] The key generation unit 604 generates S, which is part of the conversion key ck, using the secret key sk and the auxiliary information auxC. Although not shown, the conversion target setting unit 603 and the key generation unit 604 may each be equipped with a function for generating random numbers or similar to generate part of the conversion key ck.

[0044] In particular, the key generation unit 604 first performs an encryption of a symmetric key encryption scheme, using a second symmetric key encryption ciphertext as plaintext and the key corresponding to the first converted public key ciphertext as the secret key to generate a first partial conversion key.

[0045] Next, the key generation unit 604 calculates as the second partial conversion key an exclusive OR of a value calculated by performing encryption in counter mode of a block cipher using a first secret key of a symmetric key encryption and a first auxiliary piece of information, and a value calculated by encryption in counter mode of the block cipher using the second secret key of a symmetric key encryption and a second auxiliary piece of information.

[0046] The transmission unit 605 sets up an aggregation of the part of the conversion key generated by the conversion target setting unit 603 and the part of the conversion key generated by the key generation unit 604 as conversion key ck (= (P, S)) and transmits the conversion key ck to the conversion device 700.

[0047] Fig. Figure 7 is a block diagram showing an example configuration of the conversion device 700. As shown in Fig. As shown in Figure 7, the conversion device 700 comprises a key receiving unit 701, a ciphertext receiving unit 702, an input unit 703, a conversion unit 704, and a transmission unit 705. Although not shown, the conversion device 700 includes a recording medium that stores data used in each unit of the conversion device 700.

[0048] The key receiving unit 701 receives the public key pk and the conversion key ck.

[0049] The ciphertext receiver 702 receives the symmetric key ciphertext Csk.

[0050] The input unit 703 accepts the input of information specifying the decryption release condition L'.

[0051] The conversion unit 704 converts the symmetric-key ciphertext Csk to Csk' using the conversion key ck and sets a decryption release condition in P using the public key pk and the decryption release condition L' to convert P to P'. P' is part of the converted public-key ciphertext Cpk.

[0052] The conversion unit 704 computes an exclusive OR of the symmetric key ciphertext Csk and the second sub-conversion key as at least one part of a converted symmetric key ciphertext, which is used to decrypt the plaintext M used to generate a symmetric key ciphertext. The symmetric key ciphertext Csk is an exclusive OR of the plaintext M and a value calculated by performing encryption in the counter mode of the block cipher using the first symmetric key encryption secret key and the first auxiliary information. The converted symmetric key ciphertext can be composed of at least one part of the converted key ciphertext and the second auxiliary information.

[0053] The conversion unit 704 can perform a delegation conversion of the attribute-based encryption scheme using the public key pk, the first converted public-key ciphertext, and a second decryption release condition to generate a second converted public-key ciphertext. The second decryption release condition is more restrictive than the first.

[0054] The transmission unit 705 outputs the converted public key ciphertext Cpk and the converted symmetric key ciphertext (Csk', auxC').

[0055] Fig. Figure 8 is a block diagram showing an example configuration of the 800 decryption device. As shown in Fig. As shown in Figure 8, the decryption device 800 comprises a ciphertext receiving unit 801, a key receiving unit 802, a decryption unit 803 and a result output unit 804.

[0056] The ciphertext receiver 801 receives the converted public key ciphertext Cpk and the converted symmetric key ciphertext (Csk', auxC').

[0057] The key receiving unit 802 receives the user secret key sk Γ .

[0058] The decryption unit 803 performs a decryption process using the converted public-key ciphertext (Cpk), the converted symmetric-key ciphertext (Csk', auxC') and the user secret key sk. Γ through, in order to calculate the plaintext M.

[0059] Specifically, the decryption unit 803 first performs a decryption of the attribute-based encryption using the user secret key sk. Γ , which corresponds to the decryption release condition L, and the second converted public key ciphertext, in order to decrypt the key that corresponds to the first converted public key ciphertext.

[0060] Next, the decryption unit 803 performs a decryption of the symmetric key encryption using the decrypted key corresponding to the first converted public key ciphertext and the first partial conversion key, in order to decrypt the second secret key of the symmetric key encryption.

[0061] Next, the decryption unit 803 calculates as the plaintext M an exclusive OR of at least a part of the converted symmetric key ciphertext and a value calculated by performing block cipher counter-mode encryption using the decrypted second secret key of the symmetric key encryption and the second auxiliary information.

[0062] The result output unit 804 outputs the calculated plaintext M.

[0063] Fig. Figure 9 is a diagram showing an example of the hardware resources of each of the devices according to this embodiment. As shown in Fig. As shown in Figure 9, each of the devices is a general computer containing a processor 11 (central processing unit).

[0064] As a concrete example, the processor 11 is a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The processor 11 is connected via a bus 12 to hardware devices such as a read-only memory (ROM) 13, a random access memory (RAM) 14, a communication board 15, a display 31 (display device), a keyboard 32, a mouse 33, a drive 34, and a magnetic disk device 20, and controls these hardware devices. The drive 34 is a device that reads from and writes to a storage medium such as a flexible disk drive (FD), a compact disc (CD), and a digital versatile disc (DVD).

[0065] The ROM 13, the RAM 14, the magnetic disk device 20 and the drive 34 are examples of a storage device.

[0066] The keyboard 32, the mouse 33 and the communication board 15 are examples of an input device.

[0067] The display 31 and the communication board 15 are examples of an output device.

[0068] The communication board 15 is connected to a communication network such as a LAN, the Internet or a telephone line, either wired or wirelessly.

[0069] The magnetic disk device 20 stores an operating system (OS) 21, programs 22 and files 23.

[0070] The programs 22 comprise programs that perform functions which, in this embodiment, are described as each “unit”. The programs are read and executed by the processor 11. That is, the programs cause a computer to operate as each “unit” and cause the computer to execute a sequence or procedure of each “unit”.

[0071] The files 23 contain various pieces of data (input, output, determination and processing results, etc.) that are used in each “unit” described in this embodiment.

[0072] Processes of this embodiment, which are described by means of flowcharts and the like, are carried out using hardware such as the processor 11, the storage device, the input device and the output device.

[0073] What is described as each "unit" can be implemented through firmware, software, hardware, or a combination thereof.

[0074] Any program described in this specification can be recorded on a computer-readable, non-volatile recording medium. The non-volatile recording medium is, as a concrete example, an optical disk or flash memory. Any program described in this specification can be provided as a program product. *** Description of a business ***

[0075] A sequence of operations for each of the devices that make up the Ciphertext Conversion System 100 corresponds to a Ciphertext Conversion Method. The Ciphertext Conversion Method is also a generic term for methods that are executed in each of the devices. A program that implements the operation of each of the devices that make up the Ciphertext Conversion System 100 corresponds to a Ciphertext Conversion Program. The Ciphertext Conversion Program is also a generic term for programs that are executed in each of the devices.

[0076] Before the operation of the ciphertext conversion system 100 according to this embodiment is described below, the cryptographic techniques and designations used in this embodiment will be explained.

[0077] Attribute-based encryption is an encryption method that can only be decrypted by a user who possesses a user secret key generated using a set of attributes Γ that satisfy a decryption condition set by the decryption release condition L. This embodiment employs attribute-based encryption that allows delegation; that is, it uses attribute-based encryption where a modification to a ciphertext can be made without decryption, provided the modification restricts the decryption release condition. This attribute-based encryption comprises algorithms that include the following processes. Such attribute-based encryption has been achieved in various ways and is also discussed in non-patent literature 1 et seq.

[0078] Process 1: Process that takes as input the setup ABESETUP, a key length, etc., and outputs a master secret key msk and a public key pk.

[0079] Process 2: Process that takes as input the generation of the user secret key ABEKEYGEN, the main secret key msk and the set of attributes Γ and generates a user secret key sk Γ generated, which corresponds to the set of attributes Γ.

[0080] Process 3: Process which takes as input the encryption ABEENC, the public key pk and the decryption release condition L and generates a key K for symmetric key encryption and a ciphertext P corresponding to the key K.

[0081] Process 4: Process that takes as input the delegation transformation ABEDER, the public key pk, the ciphertext P and a decryption release condition L' and outputs a ciphertext P' that corresponds to the decryption release condition L' if the decryption release condition L' specifies a condition that is more restrictive than the decryption release condition L associated with the ciphertext P.

[0082] Process 5: Process that takes as input the decryption ABEDEC, the user secret key sk Γ and accepts the ciphertext P and outputs the encrypted key K as the ciphertext P if the set of attributes Γ matches the decryption release condition L used in generating the ciphertext P.

[0083] Shared-key encryption is a technique where a plaintext M is encrypted using a secret key sk, and a ciphertext is decrypted using the same secret key sk. The secret key sk is a random value, and the encryption method SKEENC takes the secret key sk and the plaintext M as input and outputs a ciphertext. The decryption method SKEDEC takes the secret key sk and the ciphertext as input and outputs the plaintext M.

[0084] In addition to symmetric-key encryption, this embodiment employs a counter-mode encryption technique using a block cipher. Counter-mode encryption using the block cipher is designated SCTRENC, and counter-mode decryption using the block cipher is designated SCTRDEC. In counter-mode, the auxiliary information auxC is present; encryption is performed as specified in [Formula 1], and decryption is performed as specified in [Formula 2]. An operator + represents an exclusive OR. The auxiliary information is a counter value. C=SCTRENC(sk,auxC)+M M=SCTRDEC(sk,auxC)+C

[0085] Fig. Figure 10 shows an example of a symmetric secret key generation process. Based on Fig. Section 10 describes the symmetric secret key generation process. (Step S201: Information input step)

[0086] The input unit 201 accepts input of information specifying the key bit length k. (Step S202: Step to generate a secret key)

[0087] The symmetric key encryption key generation unit 202 generates a random number of k bits and sets the generated random number as the secret key sk. (Step S203: Transfer step)

[0088] The transmission unit 203 transmits the generated secret key sk to each device as needed.

[0089] Fig. Figure 11 shows an example of a process for generating a common parameter. Based on Fig. Section 11 describes the process of generating a common parameter. (Step S301: Information input step)

[0090] The input unit 301 accepts input of information specifying the key bit length k. (Step S302: Step to generate a key)

[0091] The Common Parameter Generation Unit 302 performs an attribute-based encryption setup to generate the master secret key msk and the public key pk. (Step S303: Transfer step)

[0092] The transmission unit 303 transmits the generated master secret key msk and public key to each device as needed.

[0093] Fig. Figure 12 shows an example of a user secret key generation process. Based on Fig. Section 12 describes the user secret key generation process. (Step S401: Attribute Input Step)

[0094] Input unit 401 accepts input of information specifying the attribute parameter Γ. (Step S402: Master Key Receipt Step)

[0095] The key receiving unit 402 receives the master secret key msk. (Step S403: User secret key generation step)

[0096] The key generation unit 403 performs the generation of the user secret key KeyGen of the attribute-based encryption using the attribute parameter Γ and the master secret key msk, thereby creating the user secret key sk Γ is generated. (Step S404: Transfer step)

[0097] The transmission unit 404 transmits the generated user secret key sk. Γ as needed for each device.

[0098] Fig. Figure 13 shows an example of a ciphertext generation process. Based on Fig. Section 13 describes the ciphertext generation process. (Step S501: Key Receipt Step)

[0099] The key receiving unit 502 accepts the secret key sk as input. (Step S502: Plain text input step)

[0100] The input unit 501 accepts information about the plaintext M as input. (Step S503: Encryption step)

[0101] Encryption unit 503 performs block cipher counter-mode encryption, as specified in [Formula 3], to encrypt the plaintext M. During counter-mode execution, encryption unit 503 generates a counter value as the auxiliary information auxC and sets the symmetric-key ciphertext to Csk. The secret key sk is the first secret key of the symmetric-key encryption. The auxiliary information auxC is the first auxiliary information. Csk=SCTRENC(sk,auxC)+M (Step S504: Transfer step)

[0102] The transmission unit 504 transmits the generated symmetric key ciphertext Csk and the auxiliary information auxC to each device as needed.

[0103] Fig. Figure 14 represents a conversion key generation process. Based on Fig. Section 14 describes the conversion key generation process. (Step S601: Key Receipt Step)

[0104] The key receiving unit 601 receives the public key pk, the secret key sk and the auxiliary information auxC.

[0105] (Step 602: Receive step for the decryption release condition)

[0106] Input unit 602 receives information specifying the decryption release condition L. The decryption release condition L specifies a condition that allows decryption for any user who possesses the user secret key sk. Γ was issued. The decryption release condition L is the first decryption release condition. (Step 603: Conversion Target Setting Step)

[0107] The conversion target setting unit 603 performs an ABEENC attribute-based encryption using the public key pk and the decryption release condition L, as specified in [Formula 4]. P is a converted public-key ciphertext, and K is a key generated by decrypting P. P is the first converted public-key ciphertext. K is the key corresponding to the first converted public-key ciphertext. (K,P)=ABEENC(pk,L) (Step S604: Step to generate the secret key)

[0108] The key generation unit 604 generates a new secret key sk'. (Step S605: Step to encrypt a secret key)

[0109] The key generation unit 604 performs a symmetric-key encryption, using the secret key sk' as the plaintext and K as the secret key, as specified in [Formula 5]. The secret key sk' is the second secret key of the symmetric-key encryption. S1 is the first partial conversion key. S1=SKEENC(K,sk') (Step S606: Conversion key generation step)

[0110] Key generation unit 604 generates a new auxiliary information auxC' and performs the calculation specified in [Formula 6] using the generated auxiliary information auxC'. SCTRENC(sk, auxC) is a value calculated by performing counter-mode encryption of the block cipher using the first symmetric key encryption secret key and the first auxiliary information. SCTRENC(sk', auxC') is a value calculated by performing counter-mode encryption of the block cipher using the second symmetric key encryption secret key and the second auxiliary information. S2 is the second partial conversion key. S2=SCTRENC(sk,auxC)+SCTRENC(sk',auxC')S=(S1,S2) (Step 607: Transfer step)

[0111] The transmission unit 605 transmits the conversion key ck (= (P, S)) to each device as required.

[0112] Fig. Figure 15 shows an example of a conversion process. Fig. The conversion process is described in section 15. (Step S701: Key Receipt Step)

[0113] The key receiving unit 701 receives the public key pk and the conversion key ck (= (P, S = (S1, S2))). (Step 702: Input step)

[0114] The ciphertext receiver 702 receives information specifying the symmetric key ciphertext Csk.

[0115] Input unit 703 receives information specifying the decryption enable condition L'. The decryption enable condition L' is the second decryption enable condition. (Step 703: Conversion step)

[0116] The conversion unit 704 performs the calculation given in [Formula 7] using the symmetric key ciphertext Csk and S2. Note that the right-hand side of [Formula 7] can be transformed as shown in [Formula 8]. Csk' is at least part of the transformed symmetric key ciphertext to be used for decrypting the plaintext M. The plaintext M is used in generating the symmetric key ciphertext Csk. Csk'=Csk+S2 Csk+S2=SCTRENC(sk,auxC)+M+SCTRENC(sk,auxC)+SCTRENC(sk',auxC')=SCTRENC(sk',auxC')+M

[0117] The conversion unit 704 also performs the calculation given in [Formula 9]. P' is the second converted public-key ciphertext. P'=ABEDER(pk,P,L') (Step 704: Output step)

[0118] The transmission unit 705 sets the converted public key ciphertext to Cpk (= (P', S1)), sets the converted symmetric key ciphertext to (Csk', auxC') and transmits the converted public key ciphertext Cpk and the converted symmetric key ciphertext (Csk', auxC') to the decryption device 800.

[0119] Fig. Figure 16 shows an example of a decryption process. Based on Fig. The decryption process is described in section 16. (Step S801: Ciphertext reception step)

[0120] The ciphertext receiver 801 receives the converted public key ciphertext Cpk (= (P', S1)) and the converted symmetric key ciphertext (Csk', auxC'). (Step S802: Input step)

[0121] The key receiving unit 802 receives the user secret key sk Γ . (Step 803: Step of the decryption process)

[0122] First, the decryption unit 803 performs the decryption of the attribute-based encryption as specified in [Formula 10].

[0123] Next, the decryption unit 803 performs the decryption of the symmetric key encryption as specified in [Formula 11].

[0124] The decryption unit 803 then performs the calculation specified in [Formula 12] to obtain the plaintext M. K=ABEDEC(skr,P') sk'=SKEDEC(K,S1) M=Csk'+SCTRENC(sk',auxC') (Step 804: Output step)

[0125] The result output unit 804 outputs data indicating the plaintext M received from the decryption unit 803. *** Description of the effects of embodiment 1 ***

[0126] As described above, a ciphertext of the symmetric key encryption scheme according to this embodiment can be converted into a ciphertext of the public key encryption scheme without being decrypted.

[0127] Furthermore, according to this embodiment, it is not necessary to generate a conversion key for each ciphertext to convert a ciphertext of the symmetric-key encryption scheme into a ciphertext of the public-key encryption scheme. Therefore, according to this embodiment, the cost of generating a conversion key can be reduced, and the number of calls to a secret key for generating a conversion key can also be reduced, thus improving security. Moreover, it is possible to convert a ciphertext into a public-key encryption ciphertext in a resource-efficient device that is incapable of performing public-key encryption operations, etc. *** Other configurations ***<Variante 1>

[0128] Fig.Figure 17 shows an example of a hardware configuration for each of the devices according to this variant.

[0129] Each of the devices contains a processing circuit 18 in place of the processor 11, in place of the processor 11 and the ROM 13, in place of the processor 11 and the RAM 14, or in place of the processor 11, the ROM 13 and the RAM 14.

[0130] The processing circuit 18 is a piece of hardware that implements at least some of the units contained in each of the devices.

[0131] The processing circuit 18 can be dedicated hardware or a processor that executes the programs stored in RAM 14.

[0132] If the processing circuit 18 is dedicated hardware, a specific example of the processing circuit 18 is a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination thereof.

[0133] Each of the devices can include a variety of processing circuits as an alternative to processing circuit 18. These variety of processing circuits share the role of processing circuit 18.

[0134] In each of the devices, some functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0135] In a specific example, the processing circuit 18 is implemented by hardware, software, firmware or a combination thereof.

[0136] The processor 11, the ROM 13, the RAM 14, and the processing circuit 18 are collectively referred to as the "processing circuit." This means that the functions of the functional components of each of the devices are implemented by the processing circuit. *** Other versions ***

[0137] Embodiment 1 has been described, and parts of this embodiment can be implemented in combination. Alternatively, this embodiment can be partially implemented. Alternatively, this embodiment can be modified in various ways as required and can be implemented wholly or partially in any combination.

[0138] The embodiment described above is a substantially preferred example and is not intended to limit the present disclosure or its applications and scope. The processes described in the flowcharts or similar documents may be modified as needed. Reference symbol list

[0139] 11: Processor; 12: Bus; 13: ROM; 14: RAM; 15: Communication board; 18: Processing circuit; 20: Magnetic disk device; 21: OS; 22: Programs; 23: Files; 31: Display; 32: Keyboard; 33: Mouse; 34: Drive; 100: Ciphertext conversion system; 101: Internet; 200: Symmetric secret key generation device; 201: Input unit; 202: Symmetric key encryption key generation device; 203: Transmission unit; 300: Common parameter generation device; 301: Input unit; 302: Common parameter generation device; 303: Transmission unit; 400: User secret key generation device; 401: Input unit; 402: Key receiving unit; 403: Key generating unit; 404: Transmitting unit; 500: Ciphertext generating unit; 501: Input unit; 502: Key receiving unit; 503: Encryption unit; 504: Transmitting unit; 600: Conversion key generating unit; 601: Key receiving unit; 602: Input unit;603: Conversion target setting unit; 604: Key generation unit; 605: Transmission unit; 700: Conversion device; 701: Key receiving unit; 702: Ciphertext receiving unit; 703: Input unit; 704: Conversion unit; 705: Transmission unit; 800: Decryption device; 801: Ciphertext receiving unit; 802: Key receiving unit; 803: Decryption unit; 804: Result output unit; auxC, auxC': Auxiliary information; ck: Conversion key; Csk: Symmetric key ciphertext; Cpk: Converted public key ciphertext; L, L': Decryption release condition; M: Plaintext; msk: Primary secret key; pk: Public key; sk, sk': Private key; sk; Γ : secret user key.

Images