Span program adjustment device, encryption device, decryption device, key generation device, span program adjustment method and span program adjustment program

Abstract

To enable computation of α with fewer non-zero components, with Gaussian elimination.SOLUTION: A span program acquisition unit 22 acquires a span program having a matrix M in which a row is associated with each of a plurality of attributes for constituting a decryption condition of a ciphertext. The span program adjustment unit 23 generates a matrix M' by replacing the rows of the matrix M of the span program generated by the span program acquisition unit 22 so that a row associated with an attribute that requires fewer attributes to satisfy the decryption condition is more likely to be selected as a pivot in Gaussian elimination.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a technology for increasing the speed of decryption processing in a functional encryption method using a span program. [Background technology]

[0002] Functional cryptography is a type of cryptography that allows you to set conditions under which ciphertext can be decrypted. Functional cryptography includes ciphertext policy functional cryptography, in which decryption conditions are set in the ciphertext, and key policy functional cryptography, in which the conditions are set in the private key. Ciphertext policy functional cryptography can be applied to confidential information management systems on cloud servers, for example. Ciphertext policy functional cryptography allows you to set users who can decrypt data during encryption using a Boolean expression for attributes such as affiliation and job title, making it suitable for secure storage of highly confidential data. For example, suppose a ciphertext is generated with the decryption condition set to "Human Resources Department and Section Manager or Department Manager." In this case, the section manager of the Human Resources Department can decrypt the ciphertext with his / her private key that has the attributes of "Human Resources Department" and "Section Manager." On the other hand, the section manager of the General Affairs Department cannot decrypt the ciphertext because he / she does not possess a private key that meets the decryption condition.

[0003] As a specific method for realizing a functional encryption method, Patent Document 1 and Non-Patent Document 1 disclose a method for controlling decryption using a span program. The span program is composed of a matrix M with L rows and r columns and a label ρ. Each row of the matrix M corresponds to each attribute included in the conditional expression of a user who can decrypt it, and the label ρ indicates which row corresponds to which attribute. For simplicity, a monotone span program and a decryption procedure using it will be described below.

[0004] A span program expresses the decryption condition under which a ciphertext can be decrypted. When a set of attributes Γ is given, a span program is used to determine whether the set of attributes Γ satisfies the decryption condition. A matrix M is a matrix obtained by extracting the rows of a matrix M whose corresponding attributes are included in the set of attributes Γ. δ In this case, for the set of attributes Γ, the decoding condition is 1→ ∈span <M δ If it is >, it is accepted, otherwise it is rejected. Here, span <M δ > is M δ It is the entire linear combination of each row of . → is an r-dimensional row vector whose components are all 1.

[0005] In the decryption process, for the span program (M, ρ) included in the ciphertext (or private key) and the set of attributes Γ included in the private key (or ciphertext), → If such an α exists, i.e., if it satisfies the decoding condition, the non-zero component α of α is calculated. i For the ciphertext vector and the private key vector corresponding to i The multiplication is performed and the plaintext is obtained by multiplication. On the other hand, if such an α does not exist, it is found that the decryption condition is not met.

[0006] Patent Document 2 describes a method for generating a span program so that the components of a matrix M are 0 or 1. When a span program generated by the method described in Patent Document 2 is used, the component α of α i There exists a case where each component α i is required for the corresponding attribute to be true (α i =1) or unnecessary (α i =0). Therefore, most of the execution time of the decryption process is taken up by the pairing operation. The pairing operation is performed by the non-zero component α i Since the number of times is proportional to the number of non-zero components in α, the decoding can be performed faster. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2011-232475 A [Patent Document 2] International Publication No. 2016 / 002020 [Non-patent literature]

[0008] [Non-Patent Document 1] T. Okamoto, K. Takashima, “Fully Secure Functional Encryption with General Relations from the Decisional Linear Assumption,” CRYPTO 2010, 191-208. Summary of the Invention [Problem to be solved by the invention]

[0009] matrix M δ Gaussian elimination is a method for calculating α for α. However, when there are multiple α, the calculation of α by Gaussian elimination does not necessarily result in an α with fewer non-zero components. Furthermore, Patent Document 1 and Patent Document 2 do not mention a method for calculating α with fewer non-zero components. For example, for the decoding condition prd=((A and B) or C) or D, the set of attributes is Γ={A, B, C, E}. In this case, the matrix M δ is a 3×2 matrix, with each row corresponding to the attributes A, B, and C. In this case, there are two possibilities for α, whose components are 0 or 1: (1,1,0) and (0,0,1), which indicate a combination of attributes that satisfies the decoding condition. In other words, the former means that the decoding condition is true due to the attributes A,B∈Γ, and the latter means that the decoding condition is true due to the attribute C∈Γ. Here, in order to execute decoding faster, α=(0,0,1), which has fewer non-zero components than α=(1,1,0), should be adopted. Even if α=(1,1,0) is obtained, the matrix M δ By adding the kernel basis (-1,-1,1) of α, we can obtain α = (0,0,1), but as the number of bases increases, it becomes more difficult to find an α with few non-zero components.

[0010] The present disclosure aims to make it possible to calculate α with fewer non-zero components by using Gaussian elimination. [Means for solving the problem]

[0011] The span program adjustment device according to the present disclosure comprises: a span program acquisition unit that acquires a span program having a matrix M in which rows correspond to a plurality of attributes for configuring a decryption condition of a ciphertext; a span program adjustment unit that generates a matrix M' by replacing rows of the matrix M included in the span program generated by the span program acquisition unit so that a row associated with an attribute that requires fewer attributes to satisfy the decoding condition is more likely to be selected as a pivot in Gaussian elimination; Equipped with. Effect of the Invention

[0012] In the present disclosure, a matrix M' is generated by permuting the rows of the matrix M so that a row associated with an attribute that requires fewer attributes to satisfy a decoding condition is more likely to be selected as a pivot in Gaussian elimination. By calculating α from this matrix M' using Gaussian elimination, it is possible to calculate α with fewer non-zero components. As a result, the decoding process can be made more efficient. [Brief description of the drawings]

[0013] [Figure 1] FIG. 2 is a functional configuration diagram of an encryption device 10 according to the first embodiment. [Diagram 2] 4 is a flowchart showing the overall operation of the encryption device 10 according to the first embodiment. [Diagram 3] 4 is a flowchart of a span program generation process according to the first embodiment. [Figure 4] 4 is a flowchart of a span program acquisition process according to the first embodiment and a span program adjustment process according to the first embodiment. [Diagram 5] FIG. 2 is an explanatory diagram of a tree structuring process according to the first embodiment. [Figure 6] FIG. 3 is an explanatory diagram of an alignment process according to the first embodiment. [Figure 7] FIG. 4 is an explanatory diagram of a replacement process according to the first embodiment. [Figure 8] 4 is a flowchart of an encryption process according to the first embodiment. [Figure 9] FIG. 4 is an explanatory diagram of the effect of the first embodiment. [Figure 10] FIG. 11 is a functional configuration diagram of a decoding device 30 according to a second embodiment. [Figure 11] 11 is a flowchart showing the overall operation of the decoding device 30 according to the second embodiment. [Figure 12] 13 is a flowchart of a decoding process according to the second embodiment. [Figure 13] 11 is a flowchart of the overall operation of the decoding device 30 according to the first modification. [Figure 14] FIG. 11 is a functional configuration diagram of a key generating device 50 according to a third embodiment. [Figure 15] 11 is a flowchart showing the overall operation of a key generating device 50 according to the third embodiment. [Figure 16] 13 is a flowchart of a key generation process according to the third embodiment. [Figure 17] FIG. 1 is a hardware configuration diagram of an encryption device 10 according to a first embodiment, a decryption device 30 according to a second embodiment, and a key generation device 50 according to a third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Embodiment 1 In the first embodiment, an example will be described in which an encryption device 10 in ciphertext policy function encryption includes a span program adjustment device 100.

[0015] ***Configuration Description*** The functional configuration of an encryption device 10 according to the first embodiment will be described with reference to FIG. Encryption device 10 includes, as functional components, a span program generation unit 21, a span program acquisition unit 22, a span program adjustment unit 23, and an encryption unit 24. Span program adjustment unit 23 includes a tree structuring unit 231, an alignment unit 232, and a replacement unit 233. The functions of the functional components of encryption device 10 are realized by software. The functions of the span program acquisition unit 22 and the span program adjustment unit 23 correspond to the span program adjustment device 100 .

[0016] ***Explanation of Operation*** The operation of the encryption device 10 according to the first embodiment will be described with reference to FIGS. The operation procedure of the encryption device 10 according to the embodiment 1 corresponds to the encryption method according to the embodiment 1. Moreover, the program that realizes the operation of the encryption device 10 according to the embodiment 1 corresponds to the encryption program according to the embodiment 1. An operation procedure of the span program adjustment device 100 in the encryption device 10 according to the embodiment 1 corresponds to the span program adjustment method in the embodiment 1. Also, it corresponds to the span program adjustment program of the span program adjustment device 100 in the encryption device 10 according to the embodiment 1.

[0017] The overall operation of the encryption device 10 according to the first embodiment will be described with reference to FIG. (Step S11: Span program generation process) The span program generation unit 21 receives an input of a decryption condition prd, which is a condition under which the ciphertext can be decrypted. The span program generation unit 21 generates a span program S based on the decryption condition prd. The span program S has a matrix M and a label ρ.

[0018] (Step S12: Span program acquisition process) The span program acquisition unit 22 acquires the span program S generated in step S11, The decryption condition prd accepted in step S11 is obtained.

[0019] (Step S13: Span program adjustment process) The span program adjustment unit 23 adjusts the matrix M and the label ρ of the span program S acquired in step S12 to generate a span program S' having a matrix M' and a label ρ'. Specifically, span program adjustment unit 23 generates matrix M' by permuting rows of matrix M so that rows associated with attributes that require fewer attributes to satisfy the decoding condition are more likely to be selected as pivots in Gaussian elimination. Span program adjustment unit 23 converts label ρ to generate label ρ' in accordance with the permutation of rows of matrix M. As a result, span program S' is generated that has matrix M' and label ρ' that can calculate α with few non-zero components.

[0020] (Step S14: Encryption process) The encryption unit 24 obtains the public key pk, the plaintext m, and the span program S' generated in step S13. The encryption unit 24 generates a ciphertext CT including the cryptographic component c generated from the public key pk and the plaintext m, and the span program S' having the matrix M' and the label ρ'.

[0021] The span program generation process (step S11 in FIG. 2) according to the first embodiment will be described with reference to FIG. (Step S21: Conditions acceptance process) The span program generating unit 21 receives an input of the decoding condition prd. The decryption conditions prd are input by a user of the encryption device 10. Alternatively, the decryption conditions prd are input from an external device via the communication interface 14.

[0022] (Step S22: Generation process) The span program generating unit 21 generates the span program S based on the decoding condition prd acquired in step S111. Specifically, the span program generating unit 21 generates the span program S according to the method described in Patent Document 2 or the like. The span program S has a matrix M and a label ρ. The matrix M is a matrix with L rows and r columns, with each row corresponding to a plurality of attributes for configuring a decoding condition. The label ρ indicates which row of the matrix M corresponds to which attribute among the plurality of attributes.

[0023] (Step S23: Transmission process) The span program generating unit 21 transmits the span program S=(M, ρ) and the decoding condition prd to the span program adjustment device 100.

[0024] The span program acquisition process (step S12 in FIG. 2) and the span program adjustment process (step S13 in FIG. 2) according to the first embodiment will be described with reference to Fig. 4. That is, the process of the span program adjustment device 100 according to the first embodiment will be described with reference to Fig. 4. The process of step S31 corresponds to the process of step S12 in Fig. 2. Moreover, the processes from step S32 to step S35 correspond to the process of step S13 in Fig. 2.

[0025] (Step S31: Acquisition process) The span program acquisition unit 22 acquires the span program S=(M, ρ) and the decoding condition prd transmitted in step S23.

[0026] (Step S32: Tree structuring process) As shown in FIG. 5, the tree structuring unit 231 converts the decryption condition prd obtained in step S31 into is represented by a multi-tree 201. A more specific description will be given. The decryption condition prd is expressed by a logical condition in which a plurality of attributes are combined using one or more and operators and one or more or operators. The tree structuring unit 231 sets each of the plurality of attributes, one or more and operators, and one or more or operators constituting the decryption condition prd to a node 202. The tree structuring unit 231 sets each of the plurality of attributes as a leaf 203, and sets each of the one or more and operators and one or more or operators as a node 202 other than the leaf 203. The tree structuring unit 231 then connects the nodes 202 according to the connection relationships in the decryption condition prd, thereby expressing the decryption condition prd as a multi-level tree 201.

[0027] In FIG. 5, the decoding condition prd=(A and B and C) or (D and E) or F. Therefore, each of the attributes A, B, C, D, E, and F, each of the three and operators, and each of the two or operators are set to the node 202. Of these, each of the attributes A, B, C, D, E, and F is set to the leaf 203. Each of the remaining three and operators and each of the two or operators are set to the node 202 that is not a leaf 203. Attributes A, B, and C are connected with an and operator. Therefore, leaves 203 corresponding to attributes A, B, and C are connected to node 202X corresponding to the and operator. Also, attributes D and E are connected with an and operator. Therefore, leaves 203 corresponding to attributes D and E are connected to node 202Y corresponding to the and operator. Attributes A, B, and C connected with the and operator, attributes D and E connected with the and operator, and attribute F are connected with an or operator. Therefore, node 202X corresponding to the and operator to which leaves 203 corresponding to attributes A, B, and C are connected, node 202Y corresponding to the and operator to which leaves 203 corresponding to attributes D and E are connected, and leaf 203 corresponding to attribute F are connected to node 202Z corresponding to the or operator.

[0028] (Step S33: Alignment process) The sorting unit 232 sorts the child nodes 202 in ascending order of the number of leaves 203 associated with each of the one or more OR operator nodes in the multiple-choice tree 201 expressed in step S32. Specifically, the alignment unit 232 sets each of one or more or-operator nodes 202 to the target or-operator node 202. The alignment unit 232 counts the number of leaves 203 associated with each of the multiple child nodes 202 connected to the target or-operator node 202. The alignment unit 232 aligns the multiple child nodes 202 connected to the target or-operator in ascending order of the number of counted leaves 203.

[0029] 5, there is a node 202Z as the node 202 of the or operator. Node 202Z has, as child nodes 202, a node 202X, a node 202Y, and a leaf 203 corresponding to attribute F. Three leaves 203 are linked to node 202X. Two leaves 203 are linked to node 202Y. The leaf 203 corresponding to attribute F is its own leaf 203. Therefore, as shown in Fig. 6, the leaf 203 corresponding to the attribute F, the node 202Y, and the node 202X are sorted in this order. In Fig. 6, the left side is sorted first.

[0030] (Step S34: Replacement process) The replacement unit 233 generates a matrix M' by replacing rows of the matrix M included in the span program S acquired in step S31 based on the multiple-order tree 201 sorted in step S33. Furthermore, the replacement unit 233 converts the label ρ to generate a label ρ' in accordance with the replacement of the rows of the matrix M. In this way, the replacement unit 233 generates the span program S'=(M', ρ'). Specifically, the substitution unit 233 follows the multi-way tree 201 from the root in the order sorted in step S33. The substitution unit 233 substitutes the rows of the matrix M so that the row corresponding to the attribute indicated by the leaf 203 reached first is more likely to be selected as a pivot in Gaussian elimination. In this way, the substitution unit 233 generates a matrix M'. Then, the substitution unit 233 converts the label ρ to indicate the replaced row, and generates a label ρ'.

[0031] In Fig. 6, the root node 202 is node 202Z. Then, the multi-way tree 201 is traversed in the order sorted from node 202Z. As described above, in Fig. 6, the left side is sorted first, so the multi-way tree 201 is traversed in order from the left side. Therefore, the leaves 203 corresponding to the attributes F, D, E, A, B, and C are reached in this order. Then, the rows of the matrix M are permuted in the order of the attributes F, D, E, A, B, and C so that the corresponding rows are more likely to be selected as pivots in Gaussian elimination. Here, when the decoding condition prd=(A and B and C) or (D and E) or F, for example, a 6-row, 4-column matrix M is generated as shown in FIG. 7. In matrix M, the attributes A, B, C, D, E, and F correspond to each other in order from the first row. Here, it is assumed that the smaller the row number, the more likely it is to be selected as a pivot in Gaussian elimination. Then, the rows of matrix M are permuted in the order of attributes F, D, E, A, B, and C to generate matrix M'. At this time, in response to the permutation of the rows of matrix M, label ρ is converted to generate label ρ'.

[0032] (Step S35: Transmission process) The substitution unit 233 transmits the span program S' having the matrix M' and the label ρ' generated in step S34 to the encryption unit 24.

[0033] The encryption process (step S14 in FIG. 2) according to the first embodiment will be described with reference to FIG. (Step S41: Acquisition process) The encryption unit 24 obtains the public key pk, the plaintext m, and the span program S'=(M', ρ') transmitted in step S35.

[0034] (Step S42: Cryptographic component generation process) The encryption unit 24 generates cryptographic element c from the public key pk and plaintext m acquired in step S41. The method of generating cryptographic element c is a method according to the functional cryptography employed. For example, the method of generating cryptographic element c is a method in the functional cryptography described in Patent Document 1 or Non-Patent Document 1.

[0035] (Step S43: Transmission process) The encryption unit 24 transmits, to the destination, the ciphertext CT including the cryptographic element c generated in step S42 and the span program S'=(M', ρ') acquired in step S41.

[0036] ***Advantages of the First Embodiment*** As described above, the span program adjustment device 100 according to the first embodiment replaces the rows of the matrix M so that the row associated with the attribute that requires fewer attributes to satisfy the decryption condition is more likely to be selected as a pivot in Gaussian elimination. This generates the matrix M'. Then, the encryption device 10 according to the first embodiment generates the ciphertext CT including this matrix M'. By calculating α from this matrix M' using Gaussian elimination, it is possible to calculate α with fewer non-zero components. As a result, the decryption process of the ciphertext CT can be made more efficient.

[0037] The effects of the first embodiment will be described with reference to FIG. Here, the set of attributes used during decryption is assumed to be Γ=(A, D, E, F). In the decryption process, the rows of the matrix M whose corresponding attributes are included in the set of attributes Γ are extracted to obtain the matrix M δ Therefore, the matrix M generated from the matrix M δ and matrix M' generated from matrix M' δ This is shown in FIG. matrix M δEach row of the matrix M is associated with attributes A, D, E, and F, starting from the first row. δ Matrix T is the result of performing Gaussian elimination on the transpose of matrix T with an additional column whose elements are all -1. From the fifth column of matrix T, α = (0,1,1,0) is obtained, and from the other columns, the basis (0,-1,-1,1) is obtained. From α, D and E are adopted as attributes that satisfy the decoding condition prd, and the number of non-zero elements of α is 2. matrix M' δ Each row of the matrix M' is associated with attributes F, D, E, and A, starting from the first row. δ The result of Gaussian elimination on the transpose of T and adding a column with all elements of -1 is the matrix T'. From the fifth column of matrix T', α = (1,0,0,0) is obtained, and from the other columns, the basis (-1,1,1,0) is obtained. From α, F is adopted as the attribute that satisfies the decoding condition prd, and the number of non-zero elements of α is 1. In this way, by using the span program S'=(M',ρ'), attributes that require fewer attributes to satisfy the decoding condition prd are preferentially used as pivot columns. Therefore, the number of non-zero components of α can be reduced. As a result, the number of pairing operations in decoding can be reduced, and the decoding process can be made more efficient.

[0038] Embodiment 2 The second embodiment differs from the first embodiment in that the span program S is adjusted by the decoding device 30. In the second embodiment, this difference will be described, and a description of the same points will be omitted.

[0039] ***Configuration Description*** The functional configuration of the decoding device 30 according to the second embodiment will be described with reference to FIG. Decryption device 30 includes, as functional components, a ciphertext acquisition unit 41, a span program acquisition unit 42, a span program adjustment unit 43, and a decryption unit 44. Span program adjustment unit 43 includes a tree structuring unit 431, an alignment unit 432, and a substitution unit 433. The functions of the functional components of decryption device 30 are realized by software. The functions of the span program acquisition unit 42 and the span program adjustment unit 43 correspond to the span program adjustment device 100 .

[0040] ***Explanation of Operation*** The operation of the decoding device 30 according to the second embodiment will be described with reference to FIGS. An operation procedure of the decoding device 30 according to the second embodiment corresponds to a decoding method according to the second embodiment. Moreover, a program for realizing the operation of the decoding device 30 according to the second embodiment corresponds to a decoding program according to the second embodiment.

[0041] The overall operation of the decoding device 30 according to the second embodiment will be described with reference to FIG. (Step S51: Ciphertext acquisition process) The ciphertext acquisition unit 41 acquires a public key pk, a ciphertext CT, and a private key SK. The ciphertext CT includes a cryptographic component c, a span program S=(M, ρ), and a decryption condition prd. That is, in the second embodiment, the ciphertext CT includes not the span program S'=(M', ρ') but the span program S=(M, ρ) and the decryption condition prd. The private key SK includes a key element k and a set of attributes Γ.

[0042] (Step S52: Span program acquisition process) The span program acquisition unit 42 acquires the span program S and the decryption condition prd contained in the ciphertext CT acquired in step S51.

[0043] (Step S53: Span program adjustment process) The span program adjustment unit 43 adjusts the matrix M and the label ρ of the span program S acquired in step S52 to generate a span program S' having a matrix M' and a label ρ'. The method of generating the span program S' from the span program S is the same as in the first embodiment.

[0044] (Step S54: Decryption process) The decryption unit 44 decrypts the ciphertext CT using the matrix M' included in the span program S' generated in step S53, the public key pk, and the secret key SK.

[0045] The decoding process (step S54 in FIG. 11) according to the second embodiment will be described with reference to FIG. (Step S61: Acquisition process) The decryption unit 44 obtains the public key pk, the cryptographic component c included in the ciphertext CT obtained in step S51, the span program S'=(M', ρ') generated in step S53, and the private key SK.

[0046] (Step S62: Matrix M δ Generation process) The decryption unit 44 derives the matrix M' from the span program S'=(M', ρ') acquired in step S61 and the set of attributes Γ included in the private key SK. δ That is, the decoding unit 44 extracts rows of the matrix M' whose attributes are included in the attribute set Γ to generate the matrix M' δ Generate.

[0047] (Step S63: Attribute identification process) The decoding unit 44 converts the matrix M' δ A column in which all components are -1 is added to the transpose of the matrix, and Gaussian elimination is performed on the matrix to generate a matrix T'. The decoding unit 44 identifies attributes required for decoding using the matrix T'.

[0048] (Step S64: Pairing calculation process) The decryption unit 44 performs a pairing operation or the like on the element of the encryption component c corresponding to the attribute identified in step S63 and the element of the key component k, thereby decrypting the ciphertext CT.

[0049] ***Effects of the second embodiment*** As described above, the span program adjustment device 100 according to the second embodiment permutes the rows of the matrix M so that the row associated with the attribute that requires fewer attributes to satisfy the decryption condition is more likely to be selected as a pivot in the Gaussian elimination method. This generates the matrix M'. The decryption device 30 according to the second embodiment then decrypts the ciphertext CT using this matrix M'. As in the first embodiment, by calculating α from this matrix M′ by Gaussian elimination, it is possible to calculate α with fewer non-zero components, which results in more efficient decryption of the ciphertext CT.

[0050] ***Other configurations*** <Variation 1> In the second embodiment, matrix M is permuted to generate matrix M', and matrix M' is converted to matrix M'. δ However, matrix M is replaced by matrix M δ A matrix M δ Substituting M' into the matrix δ In this case, the same effect as in the second embodiment can be obtained.

[0051] The overall operation of the decoding device 30 according to the first modification will be described with reference to FIG. The process of step S71 is the same as step S51 in FIG.

[0052] (Step S72: Matrix M δ Generation process) The decryption unit 44 derives a matrix M from the span program S=(M, ρ) acquired in step S71 and the set of attributes Γ included in the private key SK. δ That is, the decoding unit 44 extracts rows of the matrix M whose attributes are included in the attribute set Γ to generate the matrix M δ In addition, the decoding unit 44 generates a matrix M δ The labels corresponding to each row of are extracted as labels ρ δ Generate.

[0053] (Step S73: Span program acquisition process) The span program acquisition unit 42 uses the decoding condition prd acquired in step S71 and the matrix M generated in step S72. δ and label ρ δ and get.

[0054] (Step S74: Span program adjustment process) The span program adjustment unit 43 calculates the matrix M obtained in step S73. δ Adjust the matrix M' δ Generate the matrix M δ The adjusted matrix M' δ The method for generating matrix M′ is the same as the method for generating matrix M′ from matrix M in the first embodiment.

[0055] (Step S75: Decryption process) The decoding unit 44 converts the matrix M' generated in step S74 into δ The decryption unit 44 decrypts the ciphertext CT using the public key pk and the secret key SK. Specifically, the decryption unit 44 executes the processes of steps S63 and S64 in FIG.

[0056] Embodiment 3 The third embodiment differs from the first and second embodiments in that the speed of the decryption process is increased in the case of key policy function encryption. In the third embodiment, this difference will be explained, and explanations of the same points will be omitted.

[0057] In the first and second embodiments, ciphertext policy function type encryption is assumed, and therefore the span program S is included in the ciphertext CT. However, in the case of key policy function type encryption, the span program S is included in the private key SK generated by the key generating device 50. Therefore, in the third embodiment, the key generating device 50 adjusts the span program S to generate the span program S', and sets the span program S' in the private key SK.

[0058] ***Configuration Description*** The functional configuration of the key generating device 50 according to the third embodiment will be described with reference to FIG. Key generation device 50 includes, as functional components, a span program generation unit 61, a span program acquisition unit 62, a span program adjustment unit 63, and a key generation unit 64. Span program adjustment unit 63 includes a tree structuring unit 631, an alignment unit 632, and a replacement unit 633. The functions of the functional components of key generation device 50 are realized by software. The functions of the span program acquisition unit 62 and the span program adjustment unit 63 correspond to the span program adjustment device 100 .

[0059] The operation of the key generating device 50 according to the third embodiment will be described with reference to FIGS. An operation procedure of the key generating device 50 according to the embodiment 3 corresponds to a key generating method according to the embodiment 3. Moreover, a program for realizing the operation of the key generating device 50 according to the embodiment 3 corresponds to a key generating program according to the embodiment 3.

[0060] The overall operation of the key generating device 50 according to the third embodiment will be described with reference to FIG. (Step S81: Span program generation process) The span program generating unit 61 receives an input of a decryption condition prd, which is a condition for decryption using a private key, and generates a span program S based on the decryption condition prd.

[0061] The processes in steps S82 and S83 are the same as those in steps S12 and S13 in FIG.

[0062] (Step S84: Key generation process) The key generation unit 64 obtains the public key pk, the private key sk, the set of attributes Γ, and the span program S' generated in step S83. The key generation unit 64 generates a private key SK including a key component k generated from the public key pk, the private key sk, and the set of attributes Γ, the set of attributes Γ, and the span program S' having a matrix M' and a label ρ'.

[0063] The key generation process (step S84 in FIG. 15) according to the third embodiment will be described with reference to FIG. (Step S91: Acquisition process) The key generation unit 64 obtains the public key pk, the private key sk, the set of attributes Γ, and the span program S'=(M', ρ') generated in step S83.

[0064] (Step S92: Key component generation process) The encryption unit 24 generates a key component k from the public key pk and private key sk acquired in step S91 and the set of attributes Γ. The method of generating the key component k is a method according to the functional cryptography employed. For example, the method of generating the key component k is a method in the functional cryptography described in Patent Document 1 or Non-Patent Document 1.

[0065] (Step S93: Transmission process) The key generation unit 64 transmits to the destination a secret key SK including the key component k generated in step S92, and the set of attributes Γ and span program S'=(M', ρ') acquired in step S91.

[0066] ***Effects of the Third Embodiment*** As described above, the span program adjustment device 100 according to the third embodiment permutes the rows of the matrix M so that the row associated with the attribute that requires fewer attributes to satisfy the decryption condition is more likely to be selected as a pivot in Gaussian elimination. This generates the matrix M'. The key generation device 50 according to the third embodiment then generates the secret key SK using this matrix M'. As in the first embodiment, by calculating α from this matrix M′ by Gaussian elimination, it is possible to calculate α with fewer non-zero components, which results in more efficient decryption of the ciphertext CT.

[0067] With reference to FIG. 17, the hardware configurations of the encryption device 10 according to the first embodiment, the decryption device 30 according to the second embodiment, and the key generation device 50 according to the third embodiment will be described. The encryption device 10 is a computer. The encryption device 10 includes the following hardware components: a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware components via signal lines and controls these other hardware components.

[0068] The decoding device 30 is a computer. The decoding device 30 includes a processor 31, a memory 32, a storage 33, and a communication interface. The processor 31 is connected to other hardware via signal lines and controls the other hardware.

[0069] The key generating device 50 is a computer. The key generation device 50 includes the following hardware components: a processor 51, a memory 52, a storage 53, and a communication interface 54. The processor 51 is connected to other hardware components via signal lines and controls the other hardware components.

[0070] The processors 11, 31, and 51 are ICs that perform processing. IC stands for Integrated Circuit. Specific examples of the processors 11, 31, and 51 include a CPU, a DSP, and a GPU. A CPU is a central processing unit (Central Processing DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0071] The memories 12, 32, and 52 are storage devices that temporarily store data. Specific examples of the memories 12, 32, and 52 include SRAM and DRAM. SRAM stands for Static RAM. DRAM is an abbreviation for Random Access Memory. It stands for Random Access Memory.

[0072] The storages 13, 33, and 53 are storage devices that store data. A specific example of the storages 13, 33, and 53 is an HDD. HDD stands for Hard Disk Drive. The storages 13, 33, and 53 may also be portable recording media such as an SD (registered trademark) memory card, CompactFlash (registered trademark), NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. SD stands for Secure Digital. DVD stands for Digital Versatile Disk.

[0073] The communication interfaces 14, 34, and 54 are interfaces for communicating with external devices. Specific examples of the communication interfaces 14, 34, and 54 are ports for Ethernet (registered trademark), USB, and HDMI (registered trademark). USB is an abbreviation for Universal Serial Bus. HDMI is an abbreviation for High-Definition It is an abbreviation for Multimedia Interface. The storage 13 stores a program that realizes the function of each functional component of the encryption device 10. The program is loaded into the memory 12 by the processor 11 and executed by the processor 11. In this way, the function of each functional component of the encryption device 10 is realized.

[0074] 17 shows only one processor 11, 31, 51. However, there may be a plurality of processors 11, 31, 51, and the plurality of processors 11, 31, 51 may cooperate to execute a program for realizing each function.

[0075] In the first to third embodiments, each functional component is realized by software. However, each functional component may be realized by hardware. In this case, the differences from the first embodiment will be described.

[0076] When each functional component is realized by hardware, the encryption device 10 includes an electronic circuit instead of the processor 11, the memory 12, and the storage 13. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 12, and the storage 13.

[0077] When each functional component is realized by hardware, the decoding device 30 includes an electronic circuit instead of the processor 31, the memory 32, and the storage 33. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 32, and the storage 33.

[0078] When each functional component is realized by hardware, the key generation device 50 includes an electronic circuit instead of the processor 51, the memory 52, and the storage 53. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 52, and the storage 53.

[0079] The electronic circuits include single circuits, composite circuits, programmed processors, parallel programmed processors, logic ICs, GAs, ASICs, and FPGAs. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array. Each functional component may be realized by one electronic circuit, or each functional component may be realized by distributing it among a plurality of electronic circuits.

[0080] <Variation 2> As a second modification, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0081] The processors 11, 31, and 51, the memories 12, 32, and 52, the storages 13, 33, and 53, and the electronic circuits are collectively referred to as a processing circuit. In other words, the functions of the functional components are realized by the processing circuit.

[0082] Furthermore, the term "part" in the above description may be read as a "circuit," "step," "procedure," "processing," or "processing circuit."

[0083] Various aspects of the present disclosure are summarized below as appendices. (Appendix 1) a span program acquisition unit that acquires a span program having a matrix M in which rows correspond to a plurality of attributes for configuring a decryption condition of a ciphertext; a span program adjustment unit that generates a matrix M' by replacing rows of the matrix M included in the span program generated by the span program acquisition unit so that a row associated with an attribute that requires fewer attributes to satisfy the decoding condition is more likely to be selected as a pivot in Gaussian elimination; A span program adjustment device comprising: (Appendix 2) the decoding condition is expressed by a logical condition combining the multiple attributes using one or more and operators and one or more or operators, The span program adjustment unit includes: a tree structuring unit that represents the decoding condition by a multi-tree in which each of the plurality of attributes, each of the one or more and operators, and each of the one or more or operators are nodes, the multi-tree having each of the plurality of attributes as a leaf and each of the one or more and operators and each of the one or more or operators as a node other than a leaf; an alignment unit that aligns child nodes of the one or more OR operator nodes in the multiple-tree represented by the tree structuring unit in order of the number of leaves associated therewith; a permutation unit that generates a matrix M' by permuting rows of the matrix M so that a row corresponding to an attribute indicated by a leaf reached by tracing the multi-tree sorted by the sorting unit from the root is more likely to be selected as the pivot in the Gaussian elimination method; 2. The span program adjustment device according to claim 1, comprising: (Appendix 3) A span program adjustment device according to claim 1 or 2; an encryption unit that generates a ciphertext including the matrix M′ generated by the span program adjustment unit; An encryption device comprising: (Appendix 4) A span program adjustment device according to claim 1 or 2; a decryption unit that decrypts the ciphertext using the matrix M′ generated by the span program adjustment unit; A decoding device comprising: (Appendix 5) The span program adjustment unit extracts rows of the matrix M corresponding to attributes included in the set Γ of attributes from the matrix M. δ is used as the matrix M. 5. A decoding device as claimed in claim 4. (Appendix 6) A span program adjustment device according to claim 1 or 2; a key generation unit that generates a decryption key using the matrix M' generated by the span program adjustment unit; A key generating device comprising: (Appendix 7) A computer obtains a span program having a matrix M in which a row corresponds to each of a plurality of attributes for forming a decryption condition of a ciphertext; A span program adjustment method in which a computer generates a matrix M' by permuting rows of the matrix M contained in the span program so that rows associated with attributes that require fewer attributes to satisfy the decoding condition are more likely to be selected as pivots in Gaussian elimination. (Appendix 8) A span program acquisition process for acquiring a span program having a matrix M in which rows correspond to each of a plurality of attributes for configuring a decryption condition of a ciphertext; a span program adjustment process for generating a matrix M' by replacing rows of the matrix M contained in the span program generated by the span program acquisition process so that a row associated with an attribute that requires fewer attributes to satisfy the decoding condition is more likely to be selected as a pivot in Gaussian elimination; A span program adjustment program that causes a computer to function as a span program adjustment device that performs the above.

[0084] The above describes the embodiments and modifications of the present disclosure. Some of these embodiments and modifications may be combined and implemented. Also, one or some of them may be partially implemented. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as necessary. [Explanation of symbols]

[0085] 100 span program adjustment device, 10 encryption device, 11 processor, 12 memory, 13 storage, 14 communication interface, 21 span program generation unit, 22 span program acquisition unit, 23 span program adjustment unit, 231 tree structure unit, 232 alignment unit, 233 substitution unit, 24 encryption unit, 30 decryption device, 31 processor, 32 memory, 33 storage, 34 communication interface, 41 ciphertext acquisition unit, 42 span program acquisition unit, 43 span program adjustment unit, 431 tree structure unit, 432 alignment unit, 433 substitution unit, 44 decryption unit, 50 key generation device, 51 processor, 52 memory, 53 storage, 54 communication interface, 61 span program program generation unit, 62 span program acquisition unit, 63 span program adjustment unit, 631 tree structuring unit, 632 alignment unit, 633 substitution unit, 64 key generation unit, 201 multiple tree, 202 Nodes, 203 leaves.

Claims

1. a span program acquisition unit that acquires a span program having a matrix M in which rows correspond to a plurality of attributes for configuring a decryption condition of a ciphertext; a span program adjustment unit that generates a matrix M' by replacing rows of the matrix M included in the span program generated by the span program acquisition unit so that a row associated with an attribute that requires fewer attributes to satisfy the decoding condition is more likely to be selected as a pivot in Gaussian elimination; A span program adjustment device comprising:

2. the decoding condition is expressed by a logical condition combining the multiple attributes using one or more and operators and one or more or operators, The span program adjustment unit includes: a tree structuring unit that represents the decoding condition by a multi-tree in which each of the plurality of attributes, each of the one or more and operators, and each of the one or more or operators are nodes, each of the plurality of attributes being a leaf and each of the one or more and operators being a node other than a leaf; an alignment unit that aligns child nodes of the one or more OR operators in the multiple-tree represented by the tree structuring unit in ascending order of the number of leaves associated therewith; a permutation unit that generates a matrix M' by permuting the rows of the matrix M so that a row corresponding to an attribute indicated by a leaf reached by tracing the multi-tree sorted by the sorting unit from the root is more likely to be selected as the pivot in the Gaussian elimination method; The span program adjustment device according to claim 1 , comprising:

3. The span program adjustment device according to claim 1 ; an encryption unit that generates a ciphertext including the matrix M′ generated by the span program adjustment unit; An encryption device comprising:

4. The span program adjustment device according to claim 1 ; a decryption unit that decrypts the ciphertext using the matrix M′ generated by the span program adjustment unit; A decoding device comprising:

5. The span program adjustment unit extracts rows of the matrix M corresponding to attributes included in the set Γ of attributes. δ is used as the matrix M. The decoding device according to claim 4.

6. The span program adjustment device according to claim 1 ; a key generation unit that generates a decryption key using the matrix M′ generated by the span program adjustment unit; A key generating device comprising:

7. A computer obtains a span program having a matrix M in which a row corresponds to each of a plurality of attributes for forming a decryption condition of a ciphertext; A span program adjustment method in which a computer generates a matrix M' by permuting rows of the matrix M contained in the span program so that rows associated with attributes that require fewer attributes to satisfy the decoding condition are more likely to be selected as pivots in Gaussian elimination.

8. A span program acquisition process for acquiring a span program having a matrix M in which rows correspond to a plurality of attributes for configuring a decryption condition of a ciphertext; a span program adjustment process for generating a matrix M' by replacing rows of the matrix M contained in the span program generated by the span program acquisition process so that rows associated with attributes that require fewer attributes to satisfy the decoding condition are more likely to be selected as pivots in Gaussian elimination; A span program adjustment program that causes a computer to function as a span program adjustment device that performs the above.

Images