REGISTRATION REQUEST FACILITY, SEARCH REQUEST FACILITY, DATA MANAGEMENT FACILITY, SEARCHABLE ENCRYPTION SYSTEM, REGISTRATION REQUEST METHOD, REGISTRATION REQUEST PROGRAM, SEARCH REQUEST METHOD, SEARCH REQUEST PROGRAM, DATA MANAGEMENT METHOD AND DATA MANAGEMENT PROGRAM

Abstract

A registration request device (500) generates an overall attribute condition by adding a higher-level attribute condition containing at least one of a plurality of attribute conditions that specify attributes that enable a search for a ciphertext to the plurality of attribute conditions. The registration request device (500) generates an encrypted tag that specifies a search condition in which attribute conditions included in the generated overall attribute condition are connected by a logical OR operator, and which is used to realize a search for the ciphertext. The registration request device (500) registers the encrypted tag in association with the ciphertext in a data management device (700).

Description

Technical area

[0001] The present disclosure relates to a technique of searchable encryption using common key encryption. Background to the state of the art

[0002] Searchable encryption is a technology for searching encrypted data while keeping the encrypted data encrypted. That is, searchable encryption is a technique for searching encrypted data without decrypting the encrypted data.

[0003] Recently, searchable encryption has gained traction as a security technique for protecting confidential information from interception by malicious administrators or malware in cloud services. In other words, searchable encryption has gained traction as a security technique for managing data in cloud services.

[0004] Processing in searchable encryption is described as processing by a registrant, processing by a searcher, and processing by a data management institution. The registrant is a user who registers encrypted data. The searcher is a user who searches for encrypted data.

[0005] The basic processing procedure by the registrant is as follows.

[0006] First, the registrant encrypts data to generate ciphertext. This ciphertext is used to decrypt and recover the original data. The registrant then encrypts a keyword to perform a secret search on the ciphertext. The encrypted keyword is called an encrypted tag. It is difficult to infer the keyword from the encrypted tag. Next, the registrant associates the encrypted tag with the ciphertext. The number of encrypted tags is not required to be one; multiple encrypted tags can be associated with the ciphertext. The registrant then registers the ciphertext and the encrypted tag in the data management facility.

[0007] The basic processing procedure by the viewfinder is as follows.

[0008] First, the searcher selects a keyword to search for. Next, the searcher uses the searcher's secret key to randomize the keyword. A randomized keyword is called a search query. It is difficult to infer the secret key from the search query. Next, the searcher submits the search query to the data manager to request a search from the data manager. The searcher then receives a ciphertext matching the search query from the data manager.

[0009] The basic processing procedure by the data management institution is as follows.

[0010] Multiple pairs of ciphertexts and encrypted tags are registered in the simplified data facility.

[0011] First, the data management facility receives a search request. Next, the data management facility performs a special operation on the search request and each registered encrypted tag to select an encrypted tag that matches the search request. This special operation allows the keyword of the search request to be compared with the keyword of each encrypted tag without decrypting the encrypted tag and the search request. This special operation is called searchable encryption. The data management facility then transmits a ciphertext associated with the selected encrypted tag.

[0012] There are two types of searchable encryption: a shared-key scheme and a public-key scheme.

[0013] The shared key scheme uses a shared encryption key technique and limits registrants and searchers.

[0014] The public key scheme uses public key encryption technique and has a limit on searchers, but an unlimited number of registrants.

[0015] In many shared-key schemes, a registrant and a searcher share the same secret key.

[0016] In Patent Literature 1, a registrant and a searcher each have different secret keys, and the registrant can specify a searcher who is authorized to perform decryption and search on a ciphertext and an encrypted tag, respectively. Such a shared key scheme is called a multi-user shared key scheme. That is, the multi-user shared key scheme is equipped with an access control function.

[0017] In a typical shared-key scheme, a registrant and a searcher share the same secret key. Therefore, the searcher can perform searches and decryptions on all ciphertexts and encrypted tags.

[0018] On the other hand, in the multi-user shared-key scheme, a registrant and a searcher have different secret keys, and each searcher has a different secret key. Even a searcher who possesses a secret key cannot perform decryption and search if the conditions specified for a searcher in the ciphertext and the encrypted tag are not met.

[0019] Furthermore, with the multi-user shared-key scheme, it is difficult for a malicious attacker to change the searcher specified in the ciphertext and the encrypted tag to another searcher without permission. Thus, the multi-user shared-key scheme achieves higher security than the typical shared-key scheme. Reference listPatent literature Patent Literature 1: JP 6910477 B Patent Literature 2: JP 6384149 B Summary of the inventionTechnical problem

[0020] Patent Literature 1 describes a multi-user shared key scheme in which a searcher authorized to perform decryption and search can be efficiently specified by using a wildcard, taking into account a hierarchical structure. For example, if a general employee in a company is specified as a searcher for a ciphertext and an encrypted tag using this scheme, it is possible to efficiently specify that a superior of the general employee, such as a section manager or department head, is also authorized to perform decryption and search.

[0021] However, if multiple searchers are to be specified without a hierarchical structure in this scheme, the data sizes of a ciphertext and an encrypted tag become large, which incurs search processing costs, or each searcher ultimately owns multiple secret keys, which incurs operating costs. For example, if it is to be specified that a general employee A and a general employee B in the same department, along with their supervisors, are allowed to perform decryption and search, the above-mentioned cost issues arise.

[0022] Patent Literature 2 describes an encryption scheme in which the data size does not increase even if the conditions for a searcher become complex by a logical operator such as OR.

[0023] However, this scheme only allows the specification of a searcher that can decrypt a ciphertext and lacks the function to generate an encrypted tag for performing searchable encryption, making support for searchable encryption challenging. Furthermore, since this scheme is based on public key encryption, processing speed becomes a concern even if the above problem is solved.

[0024] The present disclosure aims to realize a multi-user type shared key scheme that allows specifying a searcher that may perform decryption and searching using a logical operator OR, and at the same time achieves efficient searching performance even when such a specification is made. Solution to the problem

[0025] A registration request device according to the present disclosure comprises: an overall condition generation unit for generating an overall attribute condition by adding a parent attribute condition including at least one of a plurality of attribute conditions that specify attributes that enable a search for a ciphertext to the plurality of attribute conditions; and an encrypted tag generation unit for generating an encrypted tag indicating a search condition in which attribute conditions included in the overall attribute condition generated by the overall condition generation unit are connected by a logical operator OR, the encrypted tag being used to realize a search for the ciphertext. Advantageous effects of the invention

[0026] In the present disclosure, an encrypted tag is generated that specifies a search condition in which a plurality of attribute conditions specifying attributes that enable a search for a ciphertext and a parent attribute condition including at least one of the plurality of attribute conditions are connected by a logical OR operator. Consequently, it is possible to implement a multi-user shared key scheme in which a searcher permitted to perform decryption and search can be specified using a logical OR operator, and high search efficiency can be achieved even with such a specification. Brief description of the drawings Fig. 1 is a configuration diagram of a searchable encryption system 100 according to Embodiment 1. Fig. 2 is a configuration diagram of a master key generation device 200 according to Embodiment 1. Fig. 3 is a configuration diagram of a registration key generation device 300 according to Embodiment 1. Fig. 4 is a configuration diagram of a user key generation device 400 according to Embodiment 1. Fig. 5 is a configuration diagram of a registration request device 500 according to Embodiment 1. Fig. 6 is a configuration diagram of a generation unit 520 according to Embodiment 1. Fig. 7 is a configuration diagram of a search request device 600 according to Embodiment 1. Fig. 8 is a configuration diagram of a data management device 700 according to Embodiment 1. Fig. 9 is a flowchart of overall processing by the searchable encryption system 100 according to Embodiment 1. Fig. 10 is a flowchart of a master key generation process according to Embodiment 1. Fig. 11 is a flowchart of a registration key generation process according to Embodiment 1. Fig. 12 is a flowchart of a user key generation process according to Embodiment 1. Fig. 13 is a diagram illustrating an example of attribute information according to Embodiment 1. Fig. 14 is a flowchart of a registration request generation process according to Embodiment 1. Fig. 15 is a flowchart of a ciphertext generation process according to Embodiment 1. Fig. 16 is an explanatory diagram of information stored in a storage unit 790 according to Embodiment 1. Fig. 17 is a flowchart of a search request generation process according to Embodiment 1. Fig. 18 is a flowchart of a search operation process according to Embodiment 1. Fig. 19 is a flowchart of a decryption operation process according to Embodiment 1. Fig. 20 is a flowchart of a deletion operation process according to Embodiment 1. Fig. 21 is a configuration diagram of the registration request device 500 according to Embodiment 2. Fig. 22 is a configuration diagram of a generation unit 520A according to Embodiment 2. Fig. 23 is a configuration diagram of the search request device 600 according to Embodiment 2. Fig. 24 is a configuration diagram of the data management device 700 according to Embodiment 2. Fig. 25 is a flowchart of overall processing by the searchable encryption system 100 according to Embodiment 2. Fig. 26 is a flowchart of the registration request process according to Embodiment 2. Fig. 27 is a flowchart of the search request process according to Embodiment 2. Fig. 28 is a flowchart of the search operation process according to Embodiment 2. Fig. 29 is a flowchart of the decryption operation process according to Embodiment 2. Fig. 30 is a configuration diagram of the master key generation device 200 according to variant 1. Fig. 31 is a configuration diagram of the registration key generation device 300 according to variant 1. Fig. 32 is a configuration diagram of the user key generation device 400 according to variant 1. Fig. 33 is a configuration diagram of the registration request device 500 according to variant 1. Fig. 34 is a configuration diagram of the search request device 600 according to variant 1. Fig. 35 is a configuration diagram of the data management device 700 according to variant 1. Description of embodiments

[0027] In the embodiments and the drawings, identical or corresponding elements are assigned the same reference numerals. The description of elements bearing the same reference numeral is omitted or simplified accordingly. Arrows in illustrations primarily indicate data flows or processing sequences. Embodiment 1.

[0028] Based on the Fig. 1 to 20, an embodiment is described in which searchable encryption is performed with a logical operator OR for a searcher who is allowed to decrypt and search a ciphertext. *** Description of the configuration ***

[0029] With reference to Fig. 1, a configuration of a searchable encryption system 100 according to Embodiment 1 will be described.

[0030] The searchable encryption system 100 includes a master key generation device 200, a registration key generation device 300, a user key generation device 400, a registration request device 500, a search request device 600, and a data management device 700.

[0031] The devices of the searchable encryption system 100 communicate with each other via a network 101.

[0032] With reference to Fig. 2, a configuration of the master key generation device 200 according to Embodiment 1 will be described.

[0033] The master key generation device 200 is a computer. The master key generation device 200 includes hardware such as a processor 201, a main memory 202, an auxiliary storage device 203, an input / output interface 204, and a communication device 205. These hardware components are interconnected via signal lines.

[0034] The master key generation device 200 comprises elements such as an acceptance unit 210, a generation unit 220, and an output unit 230. These elements are implemented by software.

[0035] The auxiliary storage device 203 stores a master key generation program for causing a computer to function as the accepting unit 210, the generating unit 220, and the issuing unit 230. The master key program is loaded into the main memory 202 and executed by the processor 201.

[0036] In addition, the auxiliary storage device 203 stores an operating system. At least a portion of the OS is loaded into the main memory 202 and executed by the processor 201. OS stands for operating system. The processor 201 executes the master key generation program while the OS is running.

[0037] Data obtained during execution of the master key generation program is stored in storage devices such as the main memory 202, the auxiliary storage device 203, registers in the processor 201, or a cache memory in the processor 201.

[0038] The auxiliary storage device 203 operates as a storage unit 290. Alternatively, other storage devices may operate as the storage unit 290 instead of the auxiliary storage device 203 or together with the auxiliary storage device 203.

[0039] The master key generation program may be recorded (stored) in a computer-readable format on a non-volatile recording medium such as an optical disk or flash memory.

[0040] With reference to Fig. 3, a configuration of the registration key generation device 300 according to Embodiment 1 will be described.

[0041] The registration key generation device 300 is a computer. The registration key generation device 300 includes hardware such as a processor 301, a main memory 302, an auxiliary storage device 303, an input / output interface 304, and a communication device 305. These hardware components are interconnected via signal lines.

[0042] The registration key generation device 300 comprises elements such as an acceptance unit 310, a generation unit 320, and an output unit 330. These elements are implemented by software.

[0043] The auxiliary storage device 303 stores a registration key generation program for causing a computer to function as the accepting unit 310, the generating unit 320, and the issuing unit 330. The registration key generation program is loaded into the main memory 302 and executed by the processor 301.

[0044] In addition, the auxiliary storage device 303 stores an operating system. At least a portion of the operating system is loaded into the main memory 302 and executed by the processor 301. That is, the processor 301 executes the registration key generation program while executing the OS. Data obtained during the execution of the registration key generation program is stored in storage devices such as the main memory 302, the auxiliary storage device 303, registers in the processor 301, or a cache memory in the processor 301.

[0045] The additional storage device 303 operates as a storage unit 390. However, other storage devices may operate as the storage unit 390 instead of the additional storage device 303 or together with the additional storage device 303.

[0046] The registration key program may be recorded (stored) in a computer-readable format on a non-volatile recording medium such as an optical disk or flash memory.

[0047] With reference to Fig. 4, a configuration of a user key generation device 400 according to Embodiment 1 will be described.

[0048] The user key generation device 400 is a computer. The user key generation device 400 includes hardware such as a processor 401, a main memory 402, an additional storage device 403, an input / output interface 404, and a communication device 405. These hardware components are interconnected via signal lines.

[0049] The user key generation device 400 comprises elements such as an acceptance unit 410, a generation unit 420, and an output unit 430. These elements are implemented by software.

[0050] The auxiliary storage device 403 stores a user key generation program for causing a computer to function as the accepting unit 410, the generating unit 420, and the issuing unit 430. The user key generation program is loaded into the main memory 402 and executed by the processor 401.

[0051] In addition, the auxiliary storage device 403 stores an operating system. At least a portion of the operating system is loaded into the main memory 402 and executed by the processor 401. That is, the processor 401 executes the user key generation program while executing the operating system.

[0052] Data obtained during execution of the user key generation program is stored in storage devices such as the main memory 402, the auxiliary storage device 403, registers in the processor 401, or a cache memory in the processor 401.

[0053] The additional storage device 403 operates as a storage unit 490. However, other storage devices may operate as the storage unit 490 instead of the additional storage device 403 or together with the additional storage device 403.

[0054] The user key generation program may be recorded (stored) in a computer-readable format in a non-volatile recording medium such as an optical disk or flash memory.

[0055] With reference to the Fig. 5 and Fig. 6, a configuration of a registration request device 500 according to Embodiment 1 will be described.

[0056] The registration request device 500 is a computer. The registration request device 500 includes hardware such as a processor 501, a memory 502, an additional storage device 503, an input / output interface 504, and a communication device 505. These hardware components are interconnected via signal lines.

[0057] The registration request device 500 includes elements such as an acceptance unit 510, a generation unit 520, and an output unit 530. The generation unit 520 includes a total condition generation unit 521, a random number generation unit 522, a ciphertext generation unit 523, a keyword generation unit 524, and an encrypted tag generation unit 525. These elements are implemented by software.

[0058] The auxiliary storage device 503 stores a registration request program for causing a computer to operate as the acceptance unit 510, the generation unit 520, and the request unit 530. The registration request program is loaded into the main memory 502 and executed by the processor 501.

[0059] In addition, the auxiliary storage device 503 stores an operating system. At least a portion of the operating system is loaded into the main memory 502 and executed by the processor 501. That is, the processor 501 executes the registration request program while executing the operating system.

[0060] Data obtained during execution of the registration request program is stored in storage devices such as the main memory 502, the auxiliary storage device 503, registers in the processor 501, or a cache memory in the processor 501.

[0061] The additional storage device 503 functions as a storage unit 590. However, other storage devices may also operate as the storage unit 590 instead of the additional storage device 503 or together with the additional storage device 503.

[0062] The registration request program may be recorded (stored) in a computer-readable format on a non-volatile recording medium such as an optical disk or flash memory.

[0063] With reference to Fig. 7, a configuration of the search request device 600 according to Embodiment 1 will be described.

[0064] The search request device 600 is a computer. The search request device 600 includes hardware such as a processor 601, a main memory 602, an additional storage device 603, an input / output interface 604, and a communication device 605. These hardware components are interconnected via signal lines.

[0065] The search request device 600 comprises elements such as an acceptance unit 610, a generation unit 620, a request unit 630, a decryption unit 640, and an output unit 650. These elements are implemented by software.

[0066] The auxiliary storage device 603 stores a search request program for causing a computer to operate as the acceptance unit 610, the generation unit 620, the request unit 630, the decryption unit 640, and the output unit 650. The search request program is loaded into the main memory 602 and executed by the processor 601.

[0067] Additionally, the auxiliary storage device 603 stores an operating system. At least a portion of the operating system is loaded into the main memory 602 and executed by the processor 601. The processor 601 executes the search request program while executing the operating system.

[0068] Data obtained during execution of the search request program is stored in storage devices such as the main memory 602, the auxiliary storage device 603, registers in the processor 601, or a cache memory in the processor 601.

[0069] The additional storage device 603 functions as a storage unit 690. However, other storage devices may also operate as the storage unit 690 instead of the additional storage device 603 or together with the additional storage device 603.

[0070] The search request program may be recorded (stored) in a computer-readable format in a non-volatile recording medium such as an optical disk or a flash memory.

[0071] With reference to Fig. 8, a configuration of the data management device 700 according to Embodiment 1 will be described.

[0072] The data management device 700 is a computer. The data management device 700 includes hardware such as a processor 701, a main memory 702, an additional storage device 703, an input / output interface 704, and a communication device 705. These hardware components are interconnected via signal lines.

[0073] The data management device 700 comprises elements such as an acceptance unit 710, a registration unit 720, a search unit 730, and an output unit 740. These elements are implemented by software.

[0074] The auxiliary storage device 703 stores a data management program for causing a computer to operate as the acceptance unit 710, the registration unit 720, the search unit 730, and the output unit 740. The data management program is loaded into the main memory 702 and executed by the processor 701.

[0075] In addition, the auxiliary storage device 703 stores an operating system. At least a portion of the operating system is loaded into the main memory 702 and executed by the processor 701. That is, the processor 701 executes the data management program while executing the OS.

[0076] Data obtained during execution of the data management program is stored in storage devices such as the main memory 702, the auxiliary storage device 703, registers in the processor 701, or a cache memory in the processor 701.

[0077] The additional storage device 703 operates as a storage unit 790. However, other storage devices may operate as the storage unit 790 instead of the additional storage device 703 or together with the additional storage device 703.

[0078] The data management program may be recorded (stored) in a computer-readable format in a non-volatile recording medium such as an optical disk or flash memory.

[0079] Each of the processors 201, 301, 401, 501, 601, and 701 is an integrated circuit (IC) that performs arithmetic processing and controls other hardware components. IC stands for integrated circuit. Each of the processors 201, 301, 401, 501, 601, and 701 is, for example, a CPU, a DSP, or a GPU. CPU stands for central processing unit. DSP stands for digital signal processor. GPU stands for graphics processing unit.

[0080] Each of the memory devices 202, 302, 402, 502, 602, and 702 is a volatile storage device. Each of the memory devices 202, 302, 402, 502, 602, and 702 is also referred to as a main mass storage or main working memory. For example, each of the memory devices 202, 302, 402, 502, 602, and 702 is a RAM. RAM stands for Random Access Memory. The data stored in the memory devices 202, 302, 402, 502, 602, and 702 is stored in the auxiliary storage devices 203, 303, 403, 503, 603, and 703 as needed.

[0081] Each of the auxiliary storage devices 203, 303, 403, 503, 603, and 703 is a non-volatile memory device. For example, each of the auxiliary storage devices 203, 303, 403, 503, 603, and 703 is a ROM, an HDD, or a flash memory. ROM stands for read-only memory. HDD stands for hard disk drive. The data stored in the auxiliary storage devices 203, 303, 403, 503, 603, and 703 is loaded into the main memories 202, 302, 402, 502, 602, and 702 as needed.

[0082] Each of the input / output interfaces 204, 304, 404, 504, 604, and 704 is a port to which input and output devices are connected. For example, each of the input / output interfaces 204, 304, 404, 504, 604, and 704 is a USB port; the input devices are a keyboard and mouse, and the output device is a display. USB stands for Universal Serial Bus.

[0083] Each of the communication devices 205, 305, 405, 505, 605, and 705 is a receiver and a transmitter. For example, each of the communication devices 205, 305, 405, 505, 605, and 705 is a communication chip, or NIC. NIC stands for Network Interface Card.

[0084] The master key generation device 200 may comprise a plurality of processors as an alternative to the processor 201. The plurality of processors share the role of the processor 201. The registration key generation device 300 may similarly comprise a plurality of processors as an alternative to the processor 301. The plurality of processors share the role of the processor 301. The user key generation device 400 may similarly comprise a plurality of processors as an alternative to the processor 401. The plurality of processors share the role of the processor 401. The registration request device 500 may similarly comprise a plurality of processors as an alternative to the processor 501. The plurality of processors share the role of the processor 501. The search request device 600 may similarly comprise a plurality of processors as an alternative to the processor 601.The plurality of processors share the role of processor 601. Data management device 700 may similarly comprise a plurality of processors as an alternative to processor 701. The plurality of processors share the role of processor 701. *** Description of a function***

[0085] Referring to the Fig. 9 to 20, the operation of the searchable encryption system 100 according to Embodiment 1 will be described.

[0086] A flow of operation of the searchable encryption system 100 according to Embodiment 1 is equivalent to a searchable encryption system according to Embodiment 1. A program that realizes the operation of the searchable encryption system 100 according to Embodiment 1 is equivalent to a program of the searchable encryption according to Embodiment 1.

[0087] With reference to Fig. 9, an overall processing by the searchable encryption system 100 according to Embodiment 1 will be described. (Step S110 in Figure 9: Master key generation process)

[0088] The master key generation device 200 generates a master key MK. The master key MK is used to generate a registration key EK.

[0089] With reference to Fig. 10, the master key generation process according to Embodiment 1 (step S110 in Fig. 9) described.

[0090] The master key generation process is performed by the master key generation device 200.

[0091] A flow of operation of the master key generation device 200 according to Embodiment 1 is equivalent to a master key generation method according to Embodiment 1. A program that realizes the operation of the master key generation device 200 according to Embodiment 1 is equivalent to the master key generation program according to Embodiment 1. (Step S111 in Figure 10: Acceptance process)

[0092] The acceptance unit 210 accepts a key length BIT.

[0093] Specifically, the acceptance unit 210 accepts the key length BIT input to the master key generation device 200 via the input / output interface 204. However, the acceptance unit 210 may accept the key length BIT from an application program. The key length BIT is a bit length of the master key MK. (Step S112 in Figure 10: Generation process)

[0094] The generation unit 220 generates the master key MK.

[0095] In particular, the generation unit 220 generates a random bit sequence with the same length as the key length BIT. The generated bit sequence is the master key MK. For example, if the key length BIT is 256 bits, the generation unit 220 generates a random bit sequence of 256 bits. This results in the 256-bit master key MK. (Step S113 in Figure 10: Storage process)

[0096] The generation unit 220 stores the master key MK in the storage unit 290. (Step S114 in Figure 10: Output process)

[0097] The output unit 230 outputs the master key MK.

[0098] For example, the output unit 230 uses the communication device 205 to transmit the master key MK to the registration key generation device 300. (Step S120 in Figure 9: Registration key generation process)

[0099] The registration key generation device 300 uses the master key MK to generate the registration key EK. The registration key EK is used to encrypt data and a keyword related to the data. The registration key MK is further used to generate a user key UK.

[0100] With reference to Fig. 11, the registration key generation process according to Embodiment 1 (step S120 in Fig. 9) described.

[0101] The registration key generation process is executed by the registration key generation device 300.

[0102] A flow of the operation of the registration key generation device 300 according to Embodiment 1 is equivalent to a registration key generation method according to Embodiment 1. A program that realizes the operation of the registration key generation device 300 according to Embodiment 1 is equivalent to a registration key generation program according to Embodiment 1. (Step S121 in Figure 11: Acceptance process)

[0103] The acceptance unit 310 accepts the master key MK.

[0104] For example, the acceptance unit 310 uses the communication device 305 to receive the master key MK from the master key generation device 200. However, the acceptance unit 310 can also accept the master key MK input into the registration key generation device 300 via the input / output interface 304. (Step S122 in Figure 11: Generation process)

[0105] The generation unit 320 uses the master key MK to generate the registration key EK.

[0106] Specifically, the generation unit 320 executes a function F_EK using the master key as input. The value obtained by executing the function F_EK is the registration key.

[0107] An example of the F_EK function is a one-way function. A one-way function is a function where it is difficult to calculate an input value from the function's output value. For example, a cryptographic hash function such as SHA256 or a function of an encryption scheme such as AES is used as the F_EK function. AES stands for Advanced Encryption Standard.

[0108] The registry key EK can be expressed as follows. EK=F_EK(MK)

[0109] If the previously generated registration key EK needs to be updated to a new registration key EK' due to a compromise of the registration key EK or the function F_EK, the new registration key EK' can be generated by adding a value, such as a generation number i, to the input of the function F_EK. The generation number i is, for example, information such as a serial number or date and time. The generation number i can be accepted by the acceptance unit 310 together with the master key MK.

[0110] The registration key EK' generated considering the generation number i can be expressed as follows. EK'=F_EK(MK‖i)

[0111] For data x and data y, “x | | y” represents the concatenation of x and y. (Step S123 in Figure 11: Storage process)

[0112] The generation unit 320 stores the registration key EK in the storage unit 390. (Step S124 in Figure 11: Output process)

[0113] The output unit 330 outputs the registration key EK.

[0114] For example, the output unit 330 uses the communication device 305 to transmit the registration key EK to both the user key generation device 400 and the registration request device 500. (Step S130 in Figure 9: User key generation process)

[0115] The user key generation device 400 uses the registration key EK to generate the user key UK. The user key UK is used to encrypt a search keyword. The user key UK is also used to decrypt a ciphertext and restore the original data.

[0116] With reference to Fig. 12, the user key generation process (step S130 in Fig. 9) according to embodiment 1.

[0117] The master key generation process is performed by the user key generation device 400.

[0118] A flow of operation of the user key generation device 400 according to Embodiment 1 is equivalent to a user key generation method according to Embodiment 1. A program that realizes the operation of the user key generation device 400 according to Embodiment 1 is equivalent to the user key generation program according to Embodiment 1. (Step S131 in Figure 12: Acceptance process)

[0119] The acceptance unit 410 accepts the registration key EK. The acceptance unit 410 then stores the registration key EK in the storage unit 490.

[0120] For example, the acceptance unit 410 uses the communication device 405 to receive the registration key EK from the registration key generation device 300. However, the acceptance unit 410 can also accept the registration key EK input into the user key generation device 400 via the input / output interface 404.

[0121] If the registration key EK is already stored in the storage unit 490, receiving the registration key EK is not necessary. However, if the registration key EK is updated, a new registration key EK is added.

[0122] In addition, the acceptance unit 410 accepts the attribute information A.

[0123] Specifically, the acceptance unit 410 accepts the attribute information A input to the user key generation device 400 via the input / output interface 404. However, the acceptance unit 410 may accept the attribute information A from an application program.

[0124] The attribute information A is attribute information of searchers. The attribute information A relates to the control of decryption and search permissions. A searcher is a user who performs searches. That is, the searcher is a user of the search request device 600. The attributes of users form a hierarchy. The attribute information indicates the attribute values ​​of users through each level. That is, the attribute information A indicates the attribute values ​​of searchers at each level.

[0125] Referring to Fig. 13, an example of attribute information according to Embodiment 1 is explained.

[0126] The attributes of users form a hierarchy. In Fig. 13, user attributes form three levels. A first-level attribute (first attribute) specifies a department. A second-level attribute (second attribute) specifies a section. A third-level attribute (third attribute) specifies a name.

[0127] In embodiment 1, a wildcard "*" can be used for the attributes of each level. The wildcard "*" represents any character string. In other words, it is a special symbol that matches any character string.

[0128] The attribute information of the number 1 is attribute information with a name N1. N1 belongs to a Di1 section of a De1 department.

[0129] The attribute information of the number 2 is attribute information with a name N2. N2 belongs to the Di1 section of the De1 department.

[0130] The attribute information of the number 3 is attribute information with a name N3. N3 belongs to the Di1 section of the De1 department.

[0131] The attribute information of number 4 is the attribute information of a person belonging to the Di1 section of the De1 department, whose name is a wildcard "*". This attribute information represents all people belonging to the Di1 section of the De1 department, because the name is a wildcard "*". That is, this attribute information includes the first attribute information of N1 and the second attribute information of N2. In other words, this attribute information includes the attribute information of N1 and the attribute information of N2, and is attribute information that is located at a higher level in the hierarchy than these individual attribute information.

[0132] For example, the head of the De1 section of the De1 department, who is the superior of N1 and N2, corresponds with this attribute information.

[0133] The attribute information with the number 5 is the attribute information of a person belonging to the De1 department, whose section name and name are wildcards "*". This attribute information represents all people belonging to the De1 department. That is, this attribute information includes the attribute information of number 1 of N1, the attribute information of number 2 of N2, the attribute information of number 3 of N3, and also the attribute information of number 4 of the head of the Di1 section. In other words, this attribute information includes the attribute information of N1, the attribute information of N2, the attribute information of N3, and also the attribute information of number 4 of the head of the Di1 section, and is attribute information that is located at a higher level in the hierarchy than these individual attribute information.

[0134] For example, the head of the De1 department corresponds with this attribute information.

[0135] In Embodiment 1, user attributes form L levels, and the attribute information has L attribute values. L is an integer of 1 or more. That is, each level is assigned an attribute value.

[0136] Furthermore, in Embodiment 1, if a wildcard "*" is set for the i-th attribute value representing an i-th level attribute, wildcard "*" is also set for all i+1 and subsequent attribute values. Note that i can be an integer from 1 to List.

[0137] In this case, the attribute information A can be represented as follows. A=(A_1,...,A_L) A_1, ..., A_L are attribute values. If A_I is a wildcard "*", A_I + 1 to A_L are all wildcards "*". (Step S132 in Figure 12: Generation process)

[0138] The generation unit 420 uses the registration key EK and the attribute information A to generate the user key UK. Specifically, the generation unit 420 calculates the user key UK as follows.

[0139] First, the generation unit 420 concatenates all A_1 to A_L for the attribute information A = (A_1, ..., A_L). The value represented by the resulting bit string is referred to as a concatenated value A&. That is, the concatenated value A& can be expressed as follows. A&=A_1‖...‖A_L

[0140] Next, the generation unit 420 executes a function F_UK using the registration key EK and the concatenated value A& as input. The resulting value is referred to as the user key element uk. The function F_UK is a one-way function such as a hash function or a common key encryption scheme. The user key element uk can be expressed as follows. uk=F_UK(EK‖A&)=F_UK(EK‖A_1‖...‖A_L)

[0141] Next, the generation unit 420 executes a function F_UKA using the registration key EK and the concatenated value A& as input. The resulting value is referred to as the user key attribute uka. The F_UKA function is a one-way function such as a hash function or a common key encryption scheme. Note that the F_UKA function is not the same as the F_UK function. If the F_UK function is used as the F_UKA function, it is necessary to concatenate a constant value such as 0 with input values ​​of the F_UK function to generate the user key attribute uka, which is different from the user key element uk. The user key attribute uka can be expressed as follows. uka=F_UKA(EK‖A_1‖...‖A_L)=F_UKA(EK‖A&)

[0142] Then, the generation unit 420 defines a pair of the user key element uk and the user key attribute uka as the user key UK. The user key UK can be expressed as follows. UK=(uk,uka) (Step S133 in Figure 12: Storage process)

[0143] The generation unit 420 stores the user key UK in the storage unit 490. (Step S134 in Figure 12: Output process)

[0144] The output unit 430 outputs the user key UK.

[0145] For example, the output unit 430 uses the communication device 405 to transmit the user key UK to the search request device 600.

[0146] After the user key generation process (step S130 in Fig. 9), the operation shifts to the step corresponding to the execution content. Specifically, if data registration is to be performed, the operation shifts to the process of step S140. If data search is to be performed, the operation shifts to the process of step S160. If data deletion is to be performed, the operation shifts to the process of step S190. (Step S140 in Figure 9: Registration request process)

[0147] The registration request device 500 uses the registration key EK to generate encrypted data. The encrypted data includes a ciphertext CT and an encrypted tag set ETS. The encrypted tag set ETS contains one or more encrypted tags ET.

[0148] The ciphertext CT is used to recover the plaintext data D contained in the ciphertext CT using the user key UK.

[0149] A keyword is specified in the encrypted tag ET. The encrypted tag ET is used to determine whether there is a match between the specified keyword and a search keyword contained in a search query. The search query is generated by encrypting the search keyword with the user key UK. The match is determined while maintaining the encrypted state.

[0150] With reference to Fig. 14, the registration request process (step S140 in Fig. 9) according to embodiment 1.

[0151] The registration request process is executed by the registration request device 500.

[0152] A flow of the operation of the registration request device 500 according to Embodiment 1 is equivalent to a registration request method according to Embodiment 1. A program that realizes the operation of the registration request device 500 according to Embodiment 1 is equivalent to the registration request program according to Embodiment 1. (Step S141 in Figure 14: Acceptance process)

[0153] The acceptance unit 510 accepts the registration key EK. The acceptance unit 510 then stores the registration key EK in the storage unit 590.

[0154] For example, the acceptance unit 510 uses the communication device 505 to receive the registration key EK from the registration key generation device 300. However, the acceptance unit 510 can also accept the registration key EK input into the registration request device 500 via the input / output interface 504.

[0155] If the registration key EK is already stored in the storage unit 590, receiving the registration key EK is not necessary. However, if the registration key EK is updated, a new registration key EK is added.

[0156] The acceptance unit 510 also accepts the plaintext data D and an attribute condition expression Σ.

[0157] Specifically, the acceptance unit 510 accepts the plaintext data D and the attribute information expression Σ, the attribute information A input to the registration request device 500, via the input / output interface 504. However, the acceptance unit 510 may accept the plaintext data D and the attribute information expression Σ from an application program.

[0158] The plaintext data D is data that has not been encrypted. The plaintext data D contains a unique identifier ID(D) as metadata that identifies it.

[0159] The attribute condition expression Σ is information related to attributes, where each attribute condition X is connected by a logical operator OR. The attribute condition X is information that specifies the attribute information of a searcher who is authorized to decrypt a ciphertext or perform a secret search for an encrypted tag. The attribute condition X has a similar structure to the attribute information A used to generate the user key UK. That is, the attribute condition X is information related to controlling the permissions for decryption and searches and can be expressed as follows. X=(X_1,...,X_L)

[0160] For example, it is assumed that the Fig. 13, the attribute information of the number 1 (De1, Di1, N1) specifies the attribute information related to N1 as the attribute condition X. That is, it is assumed that X = (De1, Di1, N1) is specified.

[0161] In this case, a searcher in possession of a user key UK generated from one of the attribute information of the number 1 relating to N and the attribute information of the numbers 4 or 5 corresponding to the superior of N1 can decrypt a ciphertext and search for an encrypted tag for which the attribute condition X is specified.

[0162] Furthermore, the attribute condition expression Σ is data composed of a plurality of attribute conditions X. That is, it can be expressed using M or more attribute conditions X, as shown below. M is an integer of 1 or more. S=(X1,...,XM)

[0163] For example, it is assumed that the attribute condition expression Σ consists of an attribute condition X1 and an attribute condition X2. That is, it is assumed that M = 2. It is assumed that the Fig. 13, the attribute information of number 1 (De1, Di1, N1), which is the attribute information related to N1, is specified as the attribute condition X1, and the attribute information of number 2 (De1, Di1, N2), which is the attribute information related to N2, is specified as the attribute condition X2. That is, it is assumed that X1 = (De1, Di1, N1) and X2 = (De1, Di1, N2), and Σ = (X1, X2).

[0164] In this case, a searcher in possession of a user key UK generated from any one of the attribute information of number 1 related to N1, the attribute information of number 2 related to N2, and the attribute information of number 4 or 5 corresponding to the superior of N1 and N2 can decrypt a ciphertext and search for an encrypted tag for which the attribute condition expression Σ is specified.

[0165] That is, using the logical operator OR, the attribute condition expression Σ = (X1, ..., XM) can be considered as a logical expression as follows. ∑=X1 OR...OR XM (Step S142 in Figure 14: Overall condition generation process)

[0166] The overall condition generation unit 521 generates an overall attribute condition σ from the attribute condition expression Σ. The overall attribute condition σ for the attribute condition expression Σ includes a plurality of attribute conditions Y obtained by adding one or more parent attribute conditions X' containing at least one of the plurality of attribute conditions X included in the attribute condition expression Σ to the plurality of attribute conditions X. That is, the attribute conditions Y include the plurality of attribute conditions X and one or more parent attribute conditions X'.

[0167] That is, the overall attribute condition σ is information that specifies the attribute information of searchers that are allowed to decrypt a ciphertext or search for an encrypted tag, and is a condition that specifies the same searchers as those specified by the attribute condition expression Σ. The overall attribute condition σ can be expressed by J attribute conditions Y as shown below. Note that J is an integer of 1 or more. S=(Y1,...,YJ)

[0168] It should be noted that higher levels in the hierarchy do not overlap. For example, any attribute information can also contain attribute information where all placeholders "*" (*, ..., *) represent a higher level in the hierarchy. However, the overall attribute condition σ must not contain multiple attribute conditions X' that redundantly specify the attribute information (*, ..., *). In other words, all attribute conditions Y1 to YJ are different attribute conditions.

[0169] For example, it is assumed that the attribute condition expression Σ is composed of the attribute conditions X1, X2, and X3. That is, it is assumed that J = 3. Using the Fig. 13, it is assumed that the attribute condition X1 is (De1, Di1, N1), the attribute condition X2 is (De1, Di1, N2), and the attribute condition X3 is (De1, Di2, N3).

[0170] In this case, the attribute conditions that include a higher level or levels in the hierarchy that match the attribute condition X1 are as follows: (De1, Di1, *) (De1, *, *) (*, *, *)

[0171] The attribute conditions that include a higher level or levels in the hierarchy that match the attribute condition X2 are as follows: (De1, Di1, *) (De1, *, *) (*, *, *)

[0172] The attribute conditions that include a higher level or levels in the hierarchy that match attribute condition X3 are as follows: (De1, Di2, *) (De1, *, *) (*, *, *)

[0173] Therefore, the total attribute condition σ in this case consists of the following seven attribute conditions Yj. Note that i is an integer from 1 to 7. Y1=(De1,Di1,N1) Y2=(De1,Di1,N2) Y3=(De1,Di1,*) Y4=(De1,Di3,N3) Y5=(Di1,Di2,*) Y6=(De1,*,*) Y7=(*,*,*) (Step S143 in Figure 14: Ciphertext random number generation process)

[0174] The random number generation unit 522 generates a random number s and a random number r. The random number generation unit 522 sets these two random numbers as a ciphertext random number CR. That is, the ciphertext random number CR can be expressed as follows. CR=(s,r) (Step S144 in Fig. 14: Ciphertext generation process)

[0175] The ciphertext generation unit 523 uses the registration key EK, the plaintext data D, the overall attribute condition σ and the ciphertext random number CR to generate the ciphertext CT.

[0176] The ciphertext CT contains J ciphertext elements CT_j, a ciphertext random number s, a ciphertext verification value CTV, and a ciphertext payload CTP. The j of the ciphertext element CT_j is an integer from 1 to J, and J is the number of attribute constraints Y included in the total attribute constraint σ. The ciphertext random number s is the random number s contained in the ciphertext random number CR. The ciphertext CT also contains the unique identifier ID(D) of the plaintext data as metadata. This unique identifier ID(D) can be encrypted.

[0177] The ciphertext generation unit 523 calculates the ciphertext element C_j for each integer of j = 1, ..., J as follows.

[0178] First, the cipher generation unit 523 concatenates the registration key EK and Yj included in the overall attribute condition σ. The value represented by the resulting bit string is referred to as a concatenated value Yj'. Next, the generation unit 523 executes the function F_UK using the concatenated value Yj' as input. The resulting value is referred to as a function value Yj''. Next, the generation unit 523 concatenates the function value Yj'' and the ciphertext random number s. The value represented by the resulting bit string is referred to as a concatenated value Yjs'. Next, the generation unit 523 executes the function F_CT using the concatenated value Yjs' as input. The resulting value is referred to as a function value Yjs''.Then, the ciphertext generation unit 523 calculates the exclusive OR of the function value Yjs'' and the random number r. The resulting value is the ciphertext element C_j.

[0179] The function F_UK is the one-way function used in the process of step S132 in Fig. 12 is used. The F_CT function is a one-way function such as a hash function or a shared-key encryption scheme.

[0180] In the ciphertext element C_j, the attribute condition Yj, which is included in the overall attribute condition σ, is specified as a decryption condition. Consequently, the decryption condition specified in the ciphertext CT is such that the attribute conditions Yj, which are included in the overall attribute condition σ, are connected by the logical operator OR.

[0181] The ciphertext generation unit 523 calculates the ciphertext verification value CTV as follows.

[0182] The ciphertext generation unit 523 executes a function F_CTV using the random number r as input. The resulting value is the ciphertext verification value CTV. The function F_UK is a one-way function such as a hash function or a common-key encryption scheme.

[0183] The ciphertext generation unit 523 calculates the ciphertext payload CPT as follows.

[0184] The ciphertext generation unit 523 executes an ENC function on the plaintext data D using the random number r as a key. The resulting value is the ciphertext payload CTP. The ENC function is a common-key encryption scheme such as AES, which can recover the original plaintext data from encrypted data.

[0185] A function that recovers the original plaintext data from the output of the ENC function and the key used to calculate it is called a DEC function. That is, the DEC function is DEC(KEY, ENC(KEY, D)) = D for a given key KEY.

[0186] The ciphertext CT can be expressed as follows. Note that "+" represents an exclusive-or (XOR) in Embodiment 1. CT=(CT_1,...,CT_J,s,CTV,CTP) CT_j=F_CT(F_UK(EK‖Yj)‖s)+r CTV=F_CTV(r) CTP=F_CTP(r,D) (Step S145 in Figure 14: Keyword generation process)

[0187] The keyword generation unit 524 generates a keyword group related to the plaintext data D. The keyword group is composed of one or more keywords.

[0188] Specifically, the keyword generation unit 524 generates the keyword group from the plaintext data D by performing morphological analysis, natural language processing, or the like on the plaintext data D. However, the acceptance unit 524 may also accept the keyword group input to the registration request device 500 via the input / output interface 504. Furthermore, the keyword generation unit 524 may accept the keyword group from an application program.

[0189] The generated keyword set is called the registration keyword set W.

[0190] Furthermore, in Embodiment 1, it is assumed that the registration keyword set W is composed of I registration words. I is an integer of 1 or more. The registration keyword set W can be expressed as follows. W=(W_1,...,W_I) (Step S146 in Figure 14: Tag random number generation process)

[0191] The random number generation unit 522 generates a random number S and a random number R. The random number generation unit 522 sets these two random numbers as an encrypted tag random number TR. That is, the encrypted tag random number TR can be expressed as follows. TR=(S,R) (Step S147 in Figure 14: Encrypted tag generation process)

[0192] The encrypted tag generation unit 525 uses the registration key EK, the registration keyword set W, the overall attribute condition σ, and the encrypted tag random number TR to generate the encrypted tag set ETS.

[0193] The encrypted tag set ETS contains I encrypted tags ETi. The i of the encrypted tag ETi is an integer from 1 to I, and I is the number of keywords contained in the keyword set W.

[0194] The encrypted tag ETi contains J tag elements ETi_j, an encrypted tag random number S, and an encrypted tag verification value ETV. The j of the tag element ETi_j is an integer from 1 to J, and J is the number of attribute conditions Y included in the total attribute condition σ. The encrypted tag random number S is the random number S included in the encrypted tag random number TR.

[0195] The encrypted tag generation unit 525 calculates the tag element ETi_j for each integer i and integer j, where i = 1, ..., I and j = 1, ..., J, as follows.

[0196] First, the encrypted tag generation unit 525 concatenates the registration key EK and Yj included in the overall attribute condition σ. The value represented by the resulting bit string is referred to as a concatenated value Yj^. Next, the encrypted tag generation unit 525 executes the function F_UK using the concatenated value Yj^ as input. The resulting value is referred to as a function value Yj^^. Next, the encrypted tag generation unit 525 concatenates the function value Yj^^ and the keyword W_i. The value represented by the resulting bit string is referred to as a concatenated value YjW^. Next, the encrypted tag generation unit 525 executes a function F_ET1 using the concatenated value YjW^ as input. The resulting value is referred to as a function value YjW^^.Next, the encrypted tag generation unit 525 concatenates the function value YjW^^ and the encrypted tag random number S. The value represented by the resulting bit string is referred to as a concatenated value YjWS^. Next, the encrypted tag generation unit 525 executes a function F_ET2 using the concatenated value YjWS^ as input. The resulting value is referred to as a function value YjWS^^. Then, the encrypted tag generation unit 525 calculates the exclusive OR of the function value YjWS^^ and the random number R. The resulting value is the tag element Eti_j.

[0197] The function F_UK is the one-way function used in the process of step S132 in Fig. 12 and in the process of step S144 in Fig. 14 is used. The functions F_ET1 and F_ET2 are each a one-way function such as a hash function or a shared-key encryption scheme.

[0198] In the tag element ETi_j, Yj, which is included in the overall attribute condition, is specified as a search condition. Consequently, the search condition specified in the encrypted tag ETi is such that the attribute conditions Yj, which are included in the overall attribute condition σ, are connected by the logical operator OR.

[0199] The encrypted tag generation unit 525 calculates the encrypted tag verification value ETV as follows.

[0200] The encrypted tag generation unit 525 executes a function F_ETV using the random number R as an input. The resulting value is the encrypted tag verification value ETV. The function F_ETV is a one-way function such as a hash function or a shared-key encryption scheme.

[0201] The encrypted tag set ETS can be expressed as follows. ETS=(ET1,...,ETK,S,ETV) ETi=(ETi_1,...,ETi_K) ETi_j=F_ET2(F_ET1(F_UK(EK‖Yj)‖W_i)‖S)+R ETV=F_ETV(R) (Step S148 in Figure 14: Registration request process)

[0202] The request unit 530 requests the data management device 700 to register encrypted data which is a combination of the ciphertext CT and the encrypted tag set ETS. (Step S150 in Figure 9: Registration operation process)

[0203] The data management device 700 registers the encrypted data. The encrypted data includes a ciphertext CT and the encrypted tag set ETS. The encrypted tag set ETS contains one or more encrypted tags ET.

[0204] With reference to Fig. 15, the second operation process according to Embodiment 1 (step S150 in Fig. 9) described.

[0205] The registration operation process is executed by the data management device 700.

[0206] A flow of the operation of the data management device 700 according to Embodiment 1 is equivalent to a data management method according to Embodiment 1. A program that realizes the operation of the data management device 700 according to Embodiment 1 is equivalent to the data management program according to Embodiment 1. (Step S151 in Figure 15: Acceptance process)

[0207] The acceptance unit 710 accepts the ciphertext Ct and the encrypted tag set ETS.

[0208] For example, the acceptance unit 710 uses the communication device 705 to receive the ciphertext CT and the encrypted tag set ETS from the registration request device 500. However, the acceptance unit 710 can also accept the ciphertext CT and the encrypted tag set ETS input to the data management device 700 via the input / output interface 704. (Step S152 in Figure 15: Registration process)

[0209] The registration unit 720 stores the ciphertext CT and the encrypted tag set ETS in the storage unit 790.

[0210] As in Fig. 16, the storage unit 790 stores the unique identifier ID(D), the ciphertext CT and the encrypted tag set ETS in a state in which they are associated with each other. (Step S160 in Figure 9: Search request process)

[0211] The search request device 600 uses the user key UK to generate a search query SQ. The search query SQ is used to perform a secret search for an encrypted tag ET.

[0212] With reference to Fig. 17, the search request process according to embodiment 1 (step S150 in Fig. 9) described.

[0213] The search request process is executed by the search request device 600.

[0214] A flow of the operation of the search request device 600 according to Embodiment 1 is equivalent to a search request method according to Embodiment 1. A program that realizes the operation of the search request device 600 according to Embodiment 1 is equivalent to the search request program according to Embodiment 1. (Step S161 in Figure 17: Acceptance process)

[0215] The acceptance unit 610 accepts the user key UK. The acceptance unit 610 then stores the user key UK in the storage unit 690.

[0216] For example, the acceptance unit 610 uses the communication device 605 to receive the user key UK from the user key generation device 400. However, the acceptance unit 610 can also accept the user key UK input into the search request device 600 via the input / output interface 604. If the user key UK is already stored in the storage unit 690, receiving the user key UK is not necessary. However, if the user key UK is updated, a new user key UK is added.

[0217] In addition, the acceptance unit 610 accepts a search keyword w.

[0218] Specifically, the acceptance unit 610 accepts the search keyword w input to the search request device 600 via the input / output interface 604. However, the acceptance unit 610 may accept the search keyword w from an application program. (Step S162 in Figure 17: Generation process)

[0219] The generation unit 620 uses the user key UK and the search keyword w to generate a search query SQ. Specifically, the generation unit 620 calculates the search query SQ UK as follows.

[0220] First, the generation unit 620 extracts the user key element uk from the user key UK. Next, the generation unit 620A concatenates the user key element uk and the search keyword w. The value represented by the resulting bit string is referred to as a concatenated value UKw^. Then, the generation unit 620 executes the function F_ET1 using the concatenated value UKw^ as input. The resulting value is the search query SQ.

[0221] The function F_ET1 is the one-way function used in the process of step S147 in Fig. 14 is used.

[0222] The search query SQ can be expressed as follows. SQ=F_ET1(uk‖w) (Step S163 in Figure 17: Request process)

[0223] The request unit 630 uses the communication device 605 to transmit the search request SQ to the data management device 700. (Step S170 in Figure 9: Search operation process)

[0224] The data management device 700 searches for encrypted data. The encrypted data includes a ciphertext CT and an encrypted tag set ETS. The encrypted tag set ETS contains one or more encrypted tags ET.

[0225] The data management device 700 performs a secret search on each encrypted tag ET using the search query SQ. As a result, the data management device 700 determines whether the keyword contained in each encrypted tag ET matches the search keyword contained in the search query SQ. If they match, the data management device 700 extracts the ciphertext CT stored in association with the encrypted tag ET.

[0226] With reference to Fig. 18, the search operation process according to Embodiment 1 (step S170 in Fig. 9) described.

[0227] The search operation process is executed by the data management device 700. (Step S171 in Figure 18: Acceptance process)

[0228] The acceptance unit 710 accepts the search request SQ.

[0229] For example, the acceptance unit 710 uses the communication device 705 to receive the search request SQ from the search request device 600. However, the acceptance unit 610 can also accept the search request SQ input into the data management device 700 via the input / output interface 704. (Step S172 in Figure 18: Search process)

[0230] The search unit 730 uses the search query SQ to perform a secret search on each of the J tag elements ETi_j of each of the I encrypted tags ETi included in the encrypted tag set ETS. Consequently, the search unit 730 selects the encrypted tag set ETS that matches the search query SQ.

[0231] The i of the encrypted tag ETi is an integer between 1 and 1, and I is the number of encrypted tags ETi contained in the encrypted tag set W. The j of the tag element ETi_j is an integer between 1 and J, and J is the number of tag elements ETi_j contained in the encrypted tag ETi.

[0232] Specifically, the search unit 730 processes each tag element ETi_j of each encrypted tag ETi in the encrypted tag set ETS as follows.

[0233] First, the search unit 730 concatenates the search request SQ and the encrypted tag random number S contained in the encrypted tag set ETS. The value represented by the resulting bit sequence is referred to as a concatenated value SQ^. Next, the search unit 730 executes the function F_ET2 using the concatenated value SQ^ as input. The resulting value is referred to as a function value SQ^^. Next, the search unit 730 calculates the exclusive OR of the function value SQ^^ and the encrypted tag ETi_j. The resulting value is referred to as a calculated value Rij. Next, the search unit 730 executes the function F_ETV using the calculated value Rij as input. The resulting value is referred to as a function value Vij.The search unit 730 then checks whether the function value Vij matches the encrypted tag verification value ETV contained in the encrypted tag set ETS.

[0234] If the values ​​match, the unique identifier ID corresponding to the encrypted tag ETi_j is extracted.

[0235] The functions F_ET2 and F_ETV are those defined in step S147 in Fig. 14 one-way functions used.

[0236] The function value SQ^^ and the calculated value Rij obtained by the above processing can be expressed as follows. SQ=F_ET2(SQ‖S)=F_ET2(F_ET1(F_UK(EK‖A&)‖w)‖s) Rij=SQ+ETi_j=F_ET2(F_ET1(F_UK(EK‖A&)‖w)‖s)+F_ET2(F_ET1(F_UK(EK‖Yj)‖W_i)‖s)+R

[0237] If “A& = Yj” and “w = W_i”, that is, if “the attribute information A contained in the user key UK is equal to the attribute condition Yj contained in the encrypted tag ETi” and “the search keyword w is equal to the registration keyword W_i”, then “Rij = R”.

[0238] Therefore, in this case “Vij = F_ETV(Rij) = F_ETV(R) = ETV”.

[0239] A set of extracted unique identifiers ID is called a corresponding unique identifier set IDS. (Step S173 in Figure 18: Ciphertext extraction process)

[0240] The search unit 730 extracts from the storage unit 790 the ciphertext CT corresponding to each unique identifier ID contained in the corresponding unique identifier set IDS. A set of extracted ciphertexts CT is referred to as an encrypted search result ERES.

[0241] If the corresponding unique identifier set IDS is an empty set, this step is omitted. (Step S174 in Figure 18: Output process)

[0242] The output unit 740 transmits the encrypted search result ERES to the search request device 600. (Step S180 in Figure 9: Decryption operation process)

[0243] The search request device 600 uses the user key UK to decrypt the encrypted data. The encrypted data is each ciphertext CT contained in the encrypted search result ERES.

[0244] With reference to Fig. 19, the decryption operation process according to Embodiment 1 (step S180 in Fig. 9) described.

[0245] The decryption operation process is executed by the search request device 600. (Step S181 in Figure 19: Acceptance process)

[0246] The acceptance unit 610 accepts the encrypted search result E-RES.

[0247] For example, the acceptance unit 610 uses the communication device 605 to receive the encrypted search result ERES from the data management device 700. However, the acceptance unit 610 can also accept the encrypted search result ERES input into the search request device 600 via the input / output interface 604. (Step S182 in Figure 19: Decryption process)

[0248] The decryption unit 640 uses the user key UK to decrypt each ciphertext CT contained in the encrypted search result ERES to generate plaintext data D.

[0249] If the encrypted search result ERES is an empty sentence, this step is omitted.

[0250] Specifically, the decryption unit 640 sets each ciphertext CT included in the encrypted search result ERES as a target ciphertext CT. The decryption unit 640 performs the following processing on the ciphertext element CT_j in the target ciphertext CT for each integer J of j = 1, ..., J to perform decryption. Note that j is an integer between 1 and J, and J is the number of ciphertext elements CT_j included in the ciphertext CT.

[0251] First, the decryption unit 640 concatenates the user key element uk contained in the user key UK and the ciphertext random number s contained in the ciphertext CT. The value represented by the resulting bit sequence is referred to as a concatenated value uk'^. Next, the decryption unit 640 executes the function F_CT using the concatenated value uk' as input. The resulting value is referred to as a function value uk''. Next, the decryption unit 640 calculates the exclusive OR of the function value uk'' and the ciphertext element CT_j. The resulting value is referred to as a calculated value rj. Next, the decryption unit 640 executes the function F_CTV using the calculated value rj as input. The resulting value is referred to as a function value vj.Next, the decryption unit 640 checks whether the function value vj matches the ciphertext verification value CTV contained in the ciphertext CT.

[0252] Then, if the function value vj matches the ciphertext verification value CTV, the decryption unit 640 executes the function DEC on the ciphertext payload CTP and uses the calculated value rj as a key. The resulting value is the plaintext data D.

[0253] The functions F_CT and F_CTV are those defined in step S144 in Fig. 14 one-way functions used.

[0254] The function value uk'' and the calculated value rj obtained by the above processing can be expressed as follows. uk''=F_CT(uk‖s)=F_CT(F_UK(EK‖A&)‖s) rj=uk''+CT_j=F_CT(F_UK(EK‖A&)‖s)+F_CT(F_UK(EK‖Yj)‖s)+r

[0255] If "A& = Yj," that is, if "the attribute information A contained in the user key UK is equal to the attribute condition Yj contained in the ciphertext CT," then "rj = r." Therefore, in this case, "vj = F_CTV(rj) = F_CTV(r) = CTV."

[0256] A set of pieces of plaintext data D obtained in this way is called a search result RES. (Step S183 in Figure 19: Output process)

[0257] The output unit 650 outputs all pieces of plaintext data D contained in the search result RES.

[0258] Specifically, the output unit 650 displays all pieces of plaintext data D on a display via the input / output interface 604. If the search result RES is an empty set, that is, if no encrypted tag ET was found as a match during the search, the output unit 650 displays a message indicating that no plaintext data D was found as a match during the search. (Step S190 in Figure 9: Deletion operation process)

[0259] The data management device 700 deletes encrypted data. The encrypted data consists of a ciphertext CT and an encrypted tag set ETS that corresponds to the ciphertext CT.

[0260] With reference to Fig. 20, the deletion operation process according to Embodiment 1 (step S190 in Fig. 9) described.

[0261] The deletion operation process is executed by the data management device 700. (Step S191 in Figure 20: Acceptance process)

[0262] The acceptance unit 710 accepts a unique identifier ID(D).

[0263] In particular, the acceptance unit 710 accepts the unique identifier ID(D) input into the data management device 700 via the input / output interface 704. However, the acceptance unit 710 may accept the unique identifier ID(D) from an application program. For example, the acceptance unit 710 may use the communication device 705 to receive the unique identifier ID(D) from the registration request device 500 or the search request device 600.

[0264] The unique identifier ID(D) is generated as a result of the search request process (step S160 in Fig. 9), the search operation process (step S170 in Fig. 9) or the decryption operation process (step S180 in Fig. 9) received. (Step S192 in Figure 20: Deletion process)

[0265] The acceptance unit 710 deletes the ciphertext CT and the encrypted tag set ETS corresponding to the unique identifier ID(D) from the storage unit 790. *** Effects of Embodiment 1 ***

[0266] As described above, the searchable encryption system 100 according to Embodiment 1 can implement a multi-user searchable encryption scheme using only a shared key encryption technique. In other words, a multi-user searchable encryption scheme can be implemented without using a public key encryption technique. This enables high-speed data registration and searches.

[0267] The searchable encryption system 100 according to Embodiment 1 can specify multiple attribute conditions for a ciphertext and an encrypted tag simultaneously using the logical operator OR. Consequently, a searcher authorized to perform decryption and search can be easily specified even with attribute conditions using the logical operator OR. Furthermore, by specifying attribute conditions using the logical operator OR, not only can the data sizes of a ciphertext and an encrypted tag be reduced, but decryption and searches can also be performed efficiently compared to a conventional multi-user shared key scheme. Furthermore, since it is not necessary to distribute multiple user secret keys to a searcher, an increase in the operation load can be prevented.

[0268] The searchable encryption system 100 according to Embodiment 1 generates an overall attribute condition σ by adding a higher-level attribute condition X' that includes at least one of the specified attribute conditions to the specified attribute conditions X. Then, the searchable encryption system 100 sets a search condition in which the attribute conditions Y (= attribute conditions X and X') included in the overall attribute condition σ are connected by the logical operator OR in a ciphertext and an encrypted tag.

[0269] This makes it possible to efficiently specify a multi-user shared key scheme in which searchers capable of performing decryption and searching can be specified using wildcards, taking into account a hierarchical structure. Embodiment 2.

[0270] Embodiment 2 differs from Embodiment 1 in that the decryption of a ciphertext CT and a search for an encrypted tag ET are efficiently performed by first using encrypted attribute information to filter ciphertexts CT that can be searched for. In Embodiment 2, this difference is described, and the description of the same aspects is omitted. *** Description of the configuration ***

[0271] The configuration of the registration request device 500, the configuration of the search request device 600, and the configuration of the data management device 700 are partly different from those in Embodiment 1.

[0272] With reference to the Fig. 21 and Fig. 22, the configuration of the registration request device 500 according to Embodiment 2 will be described.

[0273] The registration request device 500 comprises a generation device 520A instead of the generation unit 520 in Embodiment 1. In particular, the generation unit 520A comprises, as in Fig. 22, a ciphertext generation unit 523A instead of the ciphertext generation unit 523, an encrypted tag generation unit 525A instead of the encrypted tag generation unit 525, and additionally an attribute element generation unit 526.

[0274] With reference to Fig. 23, a configuration of the search request device 600 according to Embodiment 2 will be described.

[0275] The search request device 600 includes a generation unit 620A instead of the generation unit 620 in Embodiment 1, a decryption unit 640A instead of the decryption unit 640, and further additionally includes a filter unit 660.

[0276] With reference to Fig. 24, the configuration of the data management device 700 according to Embodiment 2 will be described.

[0277] The data management device 700 includes a search unit 730A instead of the search unit 730 in Embodiment 1, and further additionally includes a filter unit 750. *** Description of a function***

[0278] In the Fig. 25 to 29, the operation of the searchable encryption system 100 according to Embodiment 2 will be described.

[0279] A flow of operation of the searchable encryption system 100 according to Embodiment 2 is equivalent to the searchable encryption method according to Embodiment 2. A program that realizes the operation of the searchable encryption system 100 according to Embodiment 2 is equivalent to the searchable encryption program according to Embodiment 2.

[0280] With reference to Fig. 25, the overall processing by the searchable encryption system 100 according to Embodiment 2 will be described.

[0281] The processes of step S110, step S120, step S130, step S150, and step S190 are the same as in Embodiment 1.

[0282] With reference to Fig. 26, the registration request process according to embodiment 2 (step S140A in Fig. 25).

[0283] The process of step S140A corresponds to step S140 in Fig. 9. The processes of step S141, step S142, step S143, step S145, step S146, and step S148 are the same as in Embodiment 1. (Step S142A in Figure 26: Attribute element generation process)

[0284] The attribute element generation unit 526 uses the overall attribute condition σ to generate an encrypted overall attribute condition Eσ.

[0285] Specifically, the attribute element generation unit 526 calculates the encrypted overall attribute condition Eσ as follows. The encrypted overall attribute condition Eσ includes J encrypted attribute conditions Eσ_j. Note that j is an integer between 1 and J, and J is the number of attribute conditions Y included in the overall attribute condition σ.

[0286] First, the attribute element generation unit 526 concatenates the registration key EK and Yj included in the overall attribute condition σ for each integer j of j = 1, ..., J. The value represented by the resulting bit string is referred to as a concatenated value Yj'. Then, the ciphertext generation unit 523 executes the function F_UKA using the concatenated value Yj' as input. The resulting value is Eσ_j.

[0287] The function F_UKA is the one-way function that is called in step S132 in Fig. 12 is used.

[0288] The encrypted total attribute condition Eσ can be expressed as follows. Eσ=(Eσ1,...,Eσj) Eσj=F_UKA(EK‖Yj) (Step S144A in Figure 26: Ciphertext generation process)

[0289] The ciphertext generation unit 523 uses the registration key EK, the plaintext data D, the total attribute condition σ, the encrypted total attribute condition Eσ and the ciphertext random number CR to generate the ciphertext CT.

[0290] The ciphertext CT contains J ciphertext elements CT_j, J ciphertext attributes CTA_j, a ciphertext random number s, a ciphertext verification value CTV, and a ciphertext payload CTP. Note that j is an integer between 1 and J, and J is the number of attribute constraints Y included in the total attribute constraint σ. The ciphertext CT also contains the unique identifier ID(D) of the plaintext data as metadata of the plaintext data D. This unique identifier ID(D) can be encrypted.

[0291] The ciphertext element CT_j, the ciphertext random number s, the ciphertext verification value CTV, and the ciphertext payload CTP are the same as those in Embodiment 1.

[0292] The ciphertext generation unit 523 sets the ciphertext attribute CTA_j as follows.

[0293] The ciphertext generation unit 523A sets the encrypted attribute condition Eσj included in the encrypted total attribute condition Eσ as the ciphertext attribute CTA_j for each j of j = 1, ..., J.

[0294] The ciphertext CT can be expressed as follows. Note that "+" in Embodiment 2 represents an exclusive-or (XOR). CT=(CT_1,...,CT_J,CTA_1,...,CTA_J,s,CTV,CTP) CT_j=F_CT(F_UK(EK‖Yj‖s)+r CTA_j=Eσj =F_UKA(EK‖Yj) CTV=F_CTV(r) CTP=F_CTP(r,D) (Step S147A in Figure 26: Encrypted tag generation process)

[0295] The encrypted tag generation unit 525 uses the registration key EK, the registration keyword set W, the overall attribute condition σ, the encrypted overall attribute condition Eσ, and the encrypted tag random number TR to generate the encrypted tag set ETS.

[0296] The encrypted tag set ETS contains I encrypted tags ETi and J encrypted tag attributes ETA_j. The i of the encrypted tag ETi is an integer between 1 and I, and I is the number of keywords included in the keyword set W. The j of the encrypted tag attribute ETA_j is an integer between 1 and J, and J is the number of attribute constraints included in the total attribute constraint σ.

[0297] The encrypted tag ETi is the same as in embodiment 1.

[0298] The encrypted tag generation unit 525A calculates the encrypted tag attribute ETA_j as follows.

[0299] The encrypted tag generation unit 525A sets the encrypted attribute condition Eσj included in the encrypted overall attribute condition Eσ as the encrypted tag attribute ETA_j for each integer j of j = 1, ..., J.

[0300] The encrypted tag set ETS can be expressed as follows. ETS=(ET1,...,ETI,ETA_1,...,ETA_J,S,ETV) ETi=(ETi_1,...,ETi_J) ETi_j=F_ET2(F_ET1(F_UK(EK‖Yj‖W_i)‖S)+R ETA_j=Eσj =F_UKA(EK‖Yj) ETV=F_ETV(R)

[0301] With reference to Fig. 27, the search request process according to embodiment 2 (step S160A in Fig. 25).

[0302] The process of step S160A corresponds to step S160 in Fig. 9. Step S161 and step S163 are the same as those in Embodiment 1. (Step S162A in Figure 27: Generation process)

[0303] The generation unit 620 uses the user key UK and the search keyword w to generate a search query SQ. The search query SQ contains a search query element sq and a search query attribute sqa.

[0304] The generation unit 620 calculates the search query element sq as follows.

[0305] First, the generation unit 620A extracts the user key element uk from the user key UK. Next, the generation unit 620A concatenates the user key element uk and the search keyword w. The value represented by the resulting bit string is referred to as a concatenated value w^. Then, the generation unit 620A executes the function F_ET1 using the concatenated value w^ as input. The resulting value is the search query element sq.

[0306] The generation unit 620A sets the user key attribute uka of the user key UK as the search query attribute sqa.

[0307] The search query SQ can be expressed as follows. SQ=(sq,sqa) sq=F_ET1(uk‖w)=F_ET1(F_UK(EK‖A&)‖w) sqa=uka=F_UKA(EK‖A&)

[0308] With reference to Fig. 28, the search operation process according to Embodiment 2 (step S170A in Fig. 25).

[0309] The process of step S170A corresponds to step S170 in Fig. 9.

[0310] Step S171, step S173, and step S174 are the same as those in Embodiment 1. (Step S172A in Figure 28: Filtering process)

[0311] The filter unit 750 uses the search query attribute sqa contained in the search query SQ to filter the encrypted tag set ETS.

[0312] Specifically, the filtering unit 750 searches for each encrypted tag attribute ETA_j in the encrypted tag set ETS that matches the query attribute sqa. The filtering unit 750 extracts the unique identifier ID(D), included as metadata, and the integer j representing the index of ETA_j, from each matching encrypted tag attribute ETA_j in the encrypted tag set ETS. A set of pairs of the extracted unique identifier ID(D) and the integer j is referred to as a filtered encrypted tag set ETSID.

[0313] The filtered encrypted tag set ETSID can be expressed as follows. Note that K is an integer of 1 or more, and the number of extracted integers is j. Further, note that j_1 to j_K are integers from 1 to J, representing the extracted integers j. ETSID={(ID(D1),j_1),...,(ID(DK),j_K)}

[0314] That is, (ID(Dk), j_k) contained in the filtered encrypted tag set ETSID indicates that only a special operation with the search query SQ needs to be performed on the tag elements ET1_(j_k) to ETI_(j_k) of the encrypted tag set ETS that correspond to the unique identifier ID(Dk). This means that the target of the special operation is filtered only on the encrypted tag set ETS that corresponds to the unique identifier ID(Dk) in the encrypted tag set ETS. Furthermore, the target of the special operation is filtered only on the tag element ETi_(j_k), which is specified by the integer j_k among the J tag elements ETi_j for each of the I encrypted tags ETi in the filtered encrypted tag set ETS.

[0315] In other words, this step extracts the encrypted tag attribute ETA_(j_k), which is used in the composition of the tag elements ET1_(j_k) to ETI_(j_k) and matches the query attribute sqa. The next step then performs processing to check whether each of the keywords W_1 to W_I contained in the tag elements ET1_(j_k) to ETI_(j_k) matches the search keyword w contained in the query element sq.

[0316] The tag element ETi_(j_k), the query element sq, the encrypted tag attribute ETA_(j_k) and the query attribute sqa can be expressed as follows. ETi_(j_k)=F_ET2(F_ET1(F_UK(EK‖Yj_k‖w_i)‖S)+R sq=F_ET1(F_UK(EK‖A&‖w)) ETA_(j_k)=F_UKA(EK‖Yj_k) sqa=F_UKA(EK‖A&)

[0317] More specifically, if the encrypted tag attribute ETA_(j_k) and the query attribute sqa are equal, this means that the attribute condition Yj_k contained in the tag element ETi_(j_k) and the concatenated value A& of the attribute information contained in the query element sq are equal. (Step S172B in Figure 28: Search process)

[0318] The search unit 730 uses the search query SQ to perform a secret search on each tag element ETi_(j_k) of the encrypted tag set ETS that corresponds to the filtered encrypted tag set ETSID. Consequently, the search unit 730A selects the encrypted tag set ETS that matches the search query SQ.

[0319] The i of the encrypted tag ETi is an integer between 1 and 1, and I is the number of encrypted tags ETi contained in the encrypted tag set ETS. The j_k of the tag element ETi_(j_k) is an integer between 1 and J and is a value contained in the filtered encrypted tag set ETSID.

[0320] Specifically, the search unit 730A sets each (ID(Dk), j_k) included in the filtered encrypted tag set ETSID as a target (ID(Dk), j_k). The search unit 730A sets each encrypted tag set ETS corresponding to the unique identifier ID(Dk) in the target (ID(Dk), j_k) as a target encrypted tag set ETS. For each of the I encrypted tags ETi included in the target encrypted tag set ETS, the search unit 730A sets the tag element ETi_(j_k) indicated by the integer j_k among the J tag elements ETi_j as a target tag element ETi_(j_k). Then, the search unit 730A performs the following processing on the target tag element ETi_(j_k).

[0321] First, the search unit 730A concatenates the search query element sq contained in the search query SQ and the encrypted tag random number S contained in the encrypted tag set ETS corresponding to the unique identifier ID(Dk). The value represented by the resulting bit sequence is referred to as a concatenated value sq^. Next, the search unit 730A executes the function F_ET2 using the concatenated value sq^ as input. The resulting value is referred to as a function value sq^^. Next, the search unit 730A calculates the exclusive-or of the function value sq^^ and the encrypted tag ETi_(j_k). The resulting value is referred to as a calculated value Rijk. Next, the search unit 730A executes the function F_ETV using the calculated value Rijk as input. The resulting value is referred to as a function value Vijk.

[0322] Then, the search unit 730A checks whether the function value Vijk matches the encrypted tag verification value ETV contained in the encrypted tag set ETS. If the values ​​match, the unique identifier ID corresponding to this tag element ETi_(j_k) is extracted.

[0323] The function value sq^^ and the calculated value Rijk obtained by the above processing can be expressed as follows. sq=F_ET2(sq‖S)=F_ET2(F_ET1(F_UK(EK‖A&‖w)‖S) Rijm=sq+ETi_(j_k)=F_ET2(F_ET1(F_UK(EK‖A&‖w)‖S)+ F_ET2(F_ET1(F_UK(EK‖Yj_k‖W_i)‖S)+ r

[0324] If “A& = Yj_k” and “w = W_i”, that is, if “the attribute information A contained in the user key UK is equal to the attribute condition Yj_k contained in the encrypted tag ETi” and “the search keyword w is equal to the registration keyword W_i”, then “Rij = R”.

[0325] Therefore, in this case “Vijk = F_ETV(Rijk) = F_ETV(R) = ETV”.

[0326] A set of extracted unique identifiers ID is called a corresponding unique identifier set IDS.

[0327] With reference to Fig. 29, the decryption operation process according to Embodiment 2 (step S180A in Fig. 25).

[0328] The process of step S180A corresponds to step S180 in Fig. 9. Step S181 and step S183 are the same as those in Embodiment 1. (Step S182A in Figure 29: Filtering process)

[0329] The filter unit 660 uses the user key UK to generate a filtered result ERES' by converting each ciphertext CT contained in the encrypted search result ERES into a filtered ciphertext CT'.

[0330] If the encrypted search result ERES is an empty sentence, this step is omitted.

[0331] Specifically, the filtering unit 660 generates the filtered ciphertext CT' by performing the following processing on each ciphertext CT included in the encrypted search result ERES.

[0332] First, the filtering unit 660 searches for a ciphertext attribute CTA_j included in the ciphertext CT that matches the user key attribute uka included in the user key UK. Note that j is an integer between 1 and J, and J is the number of ciphertext elements CT_j included in the ciphertext CT. Next, the ciphertext element CT_j corresponding to the ciphertext attribute CTA_j that matches the user key attribute uka, the ciphertext random number s, and the ciphertext verification value CTV are extracted. Then, the filtering unit 660 combines the extracted ciphertext attribute CTA_j, the ciphertext element CT_j, the ciphertext random number s, and the ciphertext verification value CTV to set them as the filtered ciphertext CT'. This filtered ciphertext CT' is added to the filtered result ERES'.

[0333] In this case, the filtered ciphertext CT' can be expressed as follows. CT'=(CTA_j,CT_j,s,CTV)

[0334] The ciphertext element CT_j, the user key element uk, the ciphertext attribute CTA_j and the user key attribute uka can be expressed as follows. CT_j=F_CT(F_UK(EK‖Yj_k)‖s)+r uk=F_UK(EK‖A&) CTA_j=F_UKA(EK‖Yj_k) uka=F_UKA(EK‖A&)

[0335] In other words, if the ciphertext attribute CTA_j and the user key attribute uka are equal, it means that the attribute condition Yj_k contained in the ciphertext element CT_j and the attribute information A& contained in the user key element uk are equal. Therefore, it is sufficient to perform searchable encryption processing only on the ciphertext element CT_j corresponding to the ciphertext attribute CTA_j that matches the user key attribute uka, without performing searchable encryption processing on all ciphertext elements CT_j. (Step S182B in Figure 29: Decryption process)

[0336] The decryption unit 640 uses the user key UK to decrypt the plaintext data D from each filtered ciphertext CT' contained in the filtered result ERES'.

[0337] If the filtered result ERES is an empty set, this step is omitted.

[0338] Specifically, the decryption unit 640A processes each filtered ciphertext CT' in the filtered result ERES' as follows to perform decryption.

[0339] First, the decryption unit 640 concatenates the user key element uk contained in the user key UK and the ciphertext random number s contained in the filtered ciphertext CT'. The value represented by the resulting bit sequence is referred to as a concatenated value uk^. Next, the decryption unit 640 executes the function F_CT using the concatenated value uk^ as input. The resulting value is referred to as a function value uk^^. Next, the decryption unit 640 calculates the exclusive OR of the function value uk^^ and the ciphertext element CT_j contained in the filtered ciphertext CT'. The resulting value is referred to as a calculated value rj. Next, the decryption unit 640 executes the function F_CTV using the calculated value rj as input. The resulting value is referred to as a function value vj.Next, the decryption unit 640A checks whether the function value vj matches the ciphertext verification value CTV contained in the ciphertext CT.

[0340] Then, if the function value vj matches the ciphertext verification value CTV, the decryption unit 640A executes the function DEC on the ciphertext payload CTP and uses the calculated value rj as a key. The resulting value is the plaintext data D.

[0341] The function value uk^^ and the calculated value rj obtained by the above processing can be expressed as follows. uk=F_CT(uk‖s) =F_CT(F_UK(EK‖A&)‖s) rj=uk+CT_j =F_CT(F_UK(EK‖A&)‖s) +F_CT(F_UK(EK‖Yj)‖s)+r

[0342] If “A& = Yj”, that is, if “the attribute information A contained in the user key UK is equal to the attribute condition Yj contained in the ciphertext CT”, then “rj = r”.

[0343] Therefore, in this case “vj = F_CTV(rj) = F_CTV(r) = CTV”.

[0344] Since the integer j is filtered in step S182A such that “the attribute information A contained in the user key UK is equal to the attribute condition Yj contained in the ciphertext CT,” the decryption process can be performed at high speed, unlike Embodiment 1. *** Effects of Embodiment 2 ***

[0345] As described above, in the searchable encryption system 100 according to Embodiment 2, the encrypted tag attribute ETA_j including the encrypted attribute condition Eσj in which an attribute condition is specified and encrypted is included in the encrypted tag set ETS without specifying a keyword. This allows ciphertexts CT in which attribute conditions that enable searches are specified to be efficiently filtered. That is, the data on which search processing is to be performed can be filtered. As a result, searches can be performed at a higher speed than in Embodiment 1.

[0346] Similarly, in the searchable encryption system 100 according to Embodiment 2, the ciphertext attribute CTA_j containing the encrypted attribute condition Eσj is included in the ciphertext CT. This allows ciphertexts CT in which attribute conditions that enable searches are specified to be efficiently filtered. That is, the data to be decrypted can be filtered. As a result, decryption can be performed at a higher speed than in Embodiment 1. *** Other configurations ***<Variante 1>

[0347] In embodiments 1 and 2, each functional component is implemented in software. However, in variant 1, the functional components can also be implemented in hardware. The differences from embodiments 1 and 2 with respect to this variant 1 are explained below.

[0348] With reference to Fig. 30 describes a configuration of the master key generation device 200 according to variant 1.

[0349] When each functional component is realized by hardware, the master key generating device 200 includes an electronic circuit 206 instead of the process 201, the working memory 202, and the auxiliary storage device 203. The electronic circuit 206 is a dedicated circuit that realizes the functions of each functional component of the master key generating device 200 and the functions of the working memory 202 and the auxiliary storage device 203.

[0350] With reference to Fig. 31 describes a configuration of the registration key generation device 300 according to variant 1.

[0351] When each functional component is realized by hardware, the registration key generation device 300 includes an electronic circuit 306 instead of the process 301, the working memory 302, and the auxiliary storage device 303. The electronic circuit 306 is a dedicated circuit that realizes the functions of each functional component of the registration key generation device 300 and the functions of the working memory 302 and the auxiliary storage device 303.

[0352] With reference to Fig. 32 describes a configuration of the user key generation device 400 according to variant 1.

[0353] When each functional component is realized by hardware, the user key generation device 400 includes an electronic circuit 406 instead of the process 401, the working memory 402, and the auxiliary storage device 403. The electronic circuit 406 is a dedicated circuit that realizes the functions of each functional component of the user key generation device 400 and the functions of the working memory 402 and the auxiliary storage device 403.

[0354] With reference to Fig. 33 describes a configuration of the registration request device 500 according to variant 1.

[0355] When each functional component is realized by hardware, the registration request device 500 includes an electronic circuit 506 instead of the process 501, the working memory 502, and the auxiliary storage device 503. The electronic circuit 506 is a dedicated circuit that realizes the functions of each functional component of the registration request device 500 and the functions of the working memory 502 and the auxiliary storage device 503.

[0356] With reference to Fig. 34 describes a configuration of the search request device 600 according to variant 1.

[0357] When each functional component is realized by hardware, the search request device 600 includes an electronic circuit 606 instead of the process 601, the working memory 602, and the auxiliary storage device 603. The electronic circuit 606 is a dedicated circuit that realizes the functions of each functional component of the search request device 600 and the functions of the working memory 602 and the auxiliary storage device 603.

[0358] With reference to Fig. 35 describes a configuration of the data management device 700 according to variant 1.

[0359] When each functional component is realized by hardware, the data management device 700 includes an electronic circuit 706 instead of the process 701, the main memory 702, and the auxiliary storage device 703. The electronic circuit 706 is a dedicated circuit that realizes the functions of each functional component of the data management device 700 and the functions of the main memory 702 and the auxiliary storage device 703.

[0360] Each of the electronic circuits 206, 306, 406, 506, 606, and 706 is assumed to be a single-chip circuit, a multi-chip circuit, a programmed processor, a parallel-programmed processor, a logic integrated circuit, a GA, an ASIC, or an FPGA. GA stands for gate array. ASIC stands for application-specific integrated circuit. FPGA stands for field-programmable gate array.

[0361] Each functional component may be implemented by a single electronic circuit 206, 306, 406, 506, 606, or 706, or each functional component may be distributed across and implemented by a plurality of electronic circuits 206, 306, 406, 506, 606, or 706. <Variante 2>

[0362] In variant 2, part of the functional components can be realized by hardware, and the rest of the functional components can be realized by software.

[0363] The processors 201, 301, 401, 501, 601, 701, the memory 202, 302, 402, 502, 602, 702, and the electronic circuits 206, 306, 406, 506, 606, 706 are referred to as a processing circuit. That is, the functions of each functional component are realized by the processing circuit.

[0364] The term “unit” in the above description may be replaced by “circuit”, “step”, “sequence”, “process” or “processing circuit”.

[0365] The embodiments and variants of the present disclosure have been described above. Two or more of these embodiments and variants may also be implemented in combination. One or two or more of them may be partially implemented. The present disclosure is not limited to the above-mentioned embodiments and variants, and various changes may be made as needed. List of reference symbols

[0366] 100: Searchable encryption system, 101: Network, 200: Master key generation device, 201: Processor, 202: Memory, 203: Auxiliary storage device, 204: Input / output interface, 205: Communication device, 210: Acceptance unit; 220: Generation unit; 230: Output unit; 290: Storage unit, 300: Registration key generation unit; 301: Processor, 302: Memory, 303: Auxiliary storage device, 304: Input / output interface, 305: Communication device; 310: Acceptance unit; 320: Generation unit; 330: Output unit; 390: Storage unit; 400: User key generation device; 401: Processor, 402: Memory, 403: Additional storage device, 404: Input / output interface, 405: Communication device; 410: Acceptance unit; 420: Generation unit; 430: Output unit; 490: Storage unit; 500: Registration request device; 501: Processor; 502: Memory;503: Auxiliary storage device; 504: Input / output interface; 505: Communication device; 510: Acceptance unit; 520: Generation unit; 520A: Generation unit; 521: Total condition generation unit; 522: Random number generation unit; 523: Ciphertext generation unit; 523A: Ciphertext generation unit; 524: Keyword generation unit; 525: Encrypted tag generation unit; 525A: Encrypted tag generation unit; 526: Attribute element generation unit; 530: Query unit; 590: Storage unit; 600: Search request device; 601: Processor, 602: Main memory, 603: Additional storage device, 604: Input / output interface, 605: Communication device, 610: Acceptance unit, 620: Generation unit; 620A: Generation unit; 630: Request unit; 640: Decryption unit; 640A: Decryption unit; 650: Output unit; 660: Filter unit; 690: Storage unit; 700: Data management device;701: Processor; 702: Memory; 703: Additional storage device; 704: Input / output interface; 705: Communication device; 710: Acceptance unit; 720: Registration unit; 730: Search unit; 740: Output unit; 750: Filter unit; 790: Storage unit. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] JP 6910477 B

[0019] JP 6384149 B

[0019]

Claims

[1] Registration request facility, comprising: an overall condition generation unit for generating an overall attribute condition by adding a parent attribute condition including at least one of a plurality of attribute conditions that specify attributes that enable a search for a ciphertext to the plurality of attribute conditions; and an encrypted tag generation unit for generating an encrypted tag indicating a search condition in which attribute conditions included in the overall attribute condition generated by the overall condition generation unit are connected by a logical operator OR, the encrypted tag being used to realize a search for the ciphertext. [2] The registration request device according to claim 1, wherein the encrypted tag generation unit sets each attribute condition included in the overall attribute condition as a target attribute condition, sets each of one or more keywords for searching the ciphertext as a target keyword, and generates the encrypted tag including a tag element in which the target attribute condition and the target keyword are set and encrypted. [3] The registration request device according to claim 2, wherein the encrypted tag generation unit generates the encrypted tag including an exclusive OR of a bit string in which the target attribute condition and the target keyword are set and encrypted, and a random number R. [4] The registration request device according to claim 3, wherein the encrypted tag generation unit generates the encrypted tag including a tag verification value obtained by executing a one-way function using the random number R as input. [5] The registration request device according to any one of claims 2 to 4, wherein the encrypted tag generation unit sets each attribute condition included in the overall attribute condition as a target attribute condition, and generates an encrypted tag attribute including an encrypted attribute condition in which the target attribute condition is set and encrypted, without setting the keyword. [6] Registration request device according to one of claims 1 to 5, further comprising: a ciphertext generation unit to generate the ciphertext by setting a decryption condition in which attribute conditions included in the overall attribute condition are connected to plaintext data by a logical operator OR, and then the plaintext data is encrypted. [7] A search request device for requesting a search from a data management device that stores an encrypted tag in association with a target ciphertext, the target ciphertext being any one of a plurality of ciphertexts, the encrypted tag specifying a search condition in which each of a plurality of attribute conditions specifying attributes that enable a search for the target ciphertext and a parent attribute condition containing at least one of the plurality of attribute conditions are connected by a logical operator OR, and which is used to realize a search for the ciphertext, the search request device comprising: a request unit for transmitting a search request in which attribute information indicating an attribute of a searcher is set and encrypted to the data management device, and requesting a ciphertext whose associated encrypted tag indicates the search condition satisfied by the attribute information among the plurality of ciphertexts. [8] Data management facility comprising: an acceptance unit for accepting a search request in which attribute information indicating an attribute of a searcher is specified and encrypted; and a search unit for searching for a ciphertext whose associated encrypted tag indicates a search condition satisfied by the attribute information specified in the search request accepted by the acceptance unit from a storage device that stores an encrypted tag in association with a target ciphertext, the target ciphertext being any one of a plurality of ciphertexts, the encrypted tag indicating a search condition in which each of a plurality of attribute conditions indicating attributes enabling a search for the target ciphertext and a parent attribute condition including at least one of the plurality of attribute conditions are connected by a logical operator OR, and which is used to realize a search for the ciphertext. [9] A searchable encryption system comprising a registration request device, a search request device and a data management device, the registration request device comprising: an overall condition generation unit for generating an overall attribute condition by adding a parent attribute condition including at least one of a plurality of attribute conditions that specify attributes that enable a search for a target ciphertext to the plurality of attribute conditions, wherein the target ciphertext is any one of a plurality of ciphertexts; and an encrypted tag generation unit for generating an encrypted tag specifying a search condition in which attribute conditions included in the overall attribute condition generated by the overall condition generation unit are connected by a logical operator OR, whereby the encrypted tag is used to realize a search for the ciphertext, wherein the search request device comprises: a request unit for transmitting a search request in which attribute information indicating an attribute of a searcher is specified and encrypted to the data management device, and requesting a ciphertext whose associated encrypted tag indicates the search condition satisfied by the attribute information among the plurality of ciphertexts, the data management facility comprises: an acceptance unit to accept a search request submitted by the request unit; and a search unit for searching for a ciphertext whose associated encrypted tag indicates the search condition satisfied by the attribute information specified in the search request accepted by the acceptance unit from a storage device that stores the encrypted tag generated by the encrypted tag generation unit for the target ciphertext in association with the target ciphertext. [10] Registration request procedure, comprising: Generating an overall attribute condition by adding, by a computer, a parent attribute condition that includes at least one of a plurality of attribute conditions that specify attributes that enable a search for a ciphertext to the plurality of attribute conditions; and Generating an encrypted tag specifying a search condition in which attribute conditions included in the overall attribute condition are connected by a logical operator OR, wherein the encrypted tag is used to realize a search for the ciphertext by the computer. [11] Registration request program that causes a computer to act as a registration request device to perform: an overall condition generation process of generating an overall attribute condition by adding a parent attribute condition including at least one of a plurality of attribute conditions that specify attributes that enable a search for a ciphertext to the plurality of attribute conditions; and an encrypted tag generation process of generating an encrypted tag indicating a search condition in which attribute conditions included in the overall attribute condition generated in the overall condition generation process are connected by a logical operator OR, the encrypted tag being used to realize a search for the ciphertext. [12] A search request method for requesting a search from a data management device that stores an encrypted tag in association with a target ciphertext, the target ciphertext being any one of a plurality of ciphertexts, the encrypted tag specifying a search condition in which each of a plurality of attribute conditions specifying attributes that enable a search for the target ciphertext and a parent attribute condition containing at least one of the plurality of attribute conditions are connected by a logical operator OR, and which is used to realize a search for the ciphertext, the search request method comprising: Transmitting a search request in which attribute information indicating an attribute of a searcher is set and encrypted to the data management device, and requesting, by a computer, a ciphertext whose associated encrypted tag indicates the search condition satisfied by the attribute information among the plurality of ciphertexts. [13] A search request program for requesting a search from a data management device that stores an encrypted tag in association with a target ciphertext, the target ciphertext being any one of a plurality of ciphertexts, the encrypted tag specifying a search condition in which each of a plurality of attribute conditions specifying attributes that enable a search for the target ciphertext and a parent attribute condition containing at least one of the plurality of attribute conditions are connected by a logical operator OR, and which is used to realize a search for the ciphertext, the search request program causing a computer to operate as a search request device to perform: a request process of transmitting a search request in which attribute information indicating an attribute of a searcher is set and encrypted to the data management device, and requesting a ciphertext whose associated encrypted tag indicates the search condition satisfied by the attribute information among the plurality of ciphertexts. [14] Data management procedures, including: Accepting, by a computer, a search request in which attribute information specifying an attribute of a searcher is specified and encrypted; and Searching for a ciphertext whose associated encrypted tag indicates a search condition satisfied by the attribute information specified in the search request by a storage device that stores an encrypted tag in association with a target ciphertext, the target ciphertext being any one of a plurality of ciphertexts, the encrypted tag indicating a search condition in which each of a plurality of attribute conditions indicating attributes enabling a search for the target ciphertext and a parent attribute condition including at least one of the plurality of attribute conditions are connected by a logical operator OR, and which is used to realize a search for the ciphertext by the computer. [15] Data management program that causes a computer to act as a data management device to perform: an acceptance process of accepting a search request in which attribute information indicating an attribute of a searcher is specified and encrypted; and a search process of searching for a ciphertext whose associated encrypted tag indicates a search condition satisfied by the attribute information specified in the search request accepted by the accepting unit from a storage device that stores an encrypted tag in association with a target ciphertext, the target ciphertext being any one of a plurality of ciphertexts, the encrypted tag indicating a search condition in which each of a plurality of attribute conditions indicating attributes enabling a search for the target ciphertext and a parent attribute condition including at least one of the plurality of attribute conditions are connected by a logical operator OR, and which is used to realize a search for the ciphertext.

Images