Broadcast-type search possible code system and method for broadcast-type search possible code

Abstract

To provide a broadcast-type search possible code system which satisfies the anonymity of a receiver and has a short code sentence.SOLUTION: A broadcast-type search possible code system 1 includes: a key generation device 2 for generating a master public key and a secret key by executing a BEKS.Setup algorithm; a code sentence generation device 3 for generating a code sentence of a content by executing a BEKS.Enc algorithm; a reception device 4 for generating a trap door by executing a BEKS.Trapdoor algorithm; and a search device 5 for decoding a content by executing the BEKS.Test algorithm and sending the content to the reception device 4.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to broadcast searchable encryption. [Background technology]

[0002] Encryption is an effective measure to prevent information leaks when storing data on a cloud server, etc. While encryption prevents information about the data from leaking to the cloud server, it has the disadvantage of impairing usability because data cannot be searched.

[0003] Public key encryption with keyword search (PEKS) is known as a method that enables keyword searches of encrypted data. In PEKS, the ciphertext of the content and the ciphertext of keywords related to the content are stored on a cloud server or the like. The recipient specifies the keyword and sends the corresponding trapdoor to the cloud server. The cloud server replies to the recipient with the ciphertext of the content including the keyword, without knowing the keyword. PEKS can safely store data in cloud storage while supporting search functions, making it an important technology from the perspective of safe data utilization.

[0004] Broadcast Encryption with Keyword Search (BEKS) has been proposed as a searchable version of Broadcast Encryption (BE), an encryption method that takes multiple receivers into account (Non-Patent Documents 1 and 2). Furthermore, Broadcast Authenticated Encryption with Keyword Search (BAEKS), an extension of BEKS, has also been proposed (Non-Patent Documents 3 and 4). [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Nuttapong Attrapadung, Jun Furukawa, Hideki Imai: Forward-Secure and Searchable Broadcast Encryption with Short Ciphertexts and Private Keys. ASIACRYPT 2006: 161-177 [Non-Patent Document 2] Sanjit Chatterjee, Sayantan Mukherjee: Keyword Search Meets Membership Testing:Adaptive Security from SXDH. INDOCRYPT 2018: 21-43 [Non-Patent Document 3] Xueqiao Liu, Kai He, Guomin Yang, Willy Susilo, Joseph Tonien, Qiong Huang: Broadcast Authenticated Encryption with Keyword Search. ACISP 2021: 193-213 [Non-Patent Document 4] Keita Emura: Generic Construction of Broadcast Authenticated Encryption with Keyword Search. Cryptology ePrint Archive, Paper 2023 / 401 Summary of the Invention [Problem to be solved by the invention]

[0006] From the viewpoint of privacy protection, it is desirable to satisfy recipient anonymity so that information about who the recipient is is not leaked from the ciphertext. However, in conventional BEKS, there is a problem that recipient anonymity is not satisfied because the search algorithm takes the set of recipients as input. In addition, while recipient anonymity is considered in conventional BAEKS, the ciphertext length is linear in size with respect to the number of recipients, which is inefficient.

[0007] An object of the present invention is to provide a broadcast-type searchable encryption system and method that satisfies receiver anonymity and has a short ciphertext length. [Means for solving the problem]

[0008] In order to solve the above problems, the present invention provides a broadcast-based searchable encryption system that uses a two-level hierarchical anonymous IBE and CS algorithms with weak robustness, and includes a key generation device including a key generation means that receives a predetermined security parameter as an input and executes a BEKS.Setup algorithm including a HIBE.Setup algorithm and a HIBE.KeyGen algorithm to generate a master public key and a private key unique to each recipient, and an encryption means that receives the master public key as an input and executes a BEKS.Enc algorithm including a HIBE.Enc algorithm with parameters of a node of the CS algorithm and a keyword candidate, to generate a ciphertext of a content to which the keyword candidate and a set of recipients are related. a receiving device having a trapdoor generation means that takes as input the master public key and the private key and executes a BEKS.Trapdoor algorithm including a HIBE.KeyDer algorithm to generate a trapdoor including the recipient set and a search keyword; and a search device that takes as input the master public key and the trapdoor, executes a BEKS.Test algorithm including a HIBE.Dec algorithm, and determines whether the search keyword and the keyword candidate match based on whether the execution result becomes a predetermined value, and when the search keyword and the keyword candidate match and the recipient is included in the recipient set, transmits an encrypted text of the content to the receiving device.

[0009] According to this broadcast searchable encryption system, in a two-level hierarchical anonymous IBE method with weak robustness, the HIBE.Enc algorithm for encryption is executed with two-level parameters, namely, nodes and keyword candidates. Furthermore, the broadcast searchable encryption system satisfies receiver anonymity and can shorten the ciphertext length, which is a linear size in the number of receivers, to a logarithmic size in the number of receivers.

[0010] In order to solve the above-mentioned problems, the present invention provides a broadcast-based searchable encryption method using a two-level hierarchical anonymous IBE and CS algorithms having weak robustness, comprising the steps of: a key generation device taking predetermined security parameters as input and executing a BEKS.Setup algorithm including a HIBE.Setup algorithm and a HIBE.KeyGen algorithm to generate a master public key and a private key unique to each recipient; and a ciphertext generation device taking the master public key as input and executing a BEKS.Enc algorithm including a HIBE.Enc algorithm having the nodes of the CS algorithm and keyword candidates as parameters to generate a ciphertext of a content to which the keyword candidates and a set of recipients are related. the receiving device takes as input the master public key and the private key and executes a BEKS.Trapdoor algorithm including a HIBE.KeyDer algorithm to generate a trapdoor including the recipient set and a search keyword; the search device takes as input the master public key and the trapdoor and executes a BEKS.Test algorithm including a HIBE.Dec algorithm, determining whether the search keyword and the keyword candidate match based on whether the execution result becomes a predetermined value, and when the search keyword and the keyword candidate match and the recipient is included in the recipient set, transmitting the content to the receiving device.

[0011] According to this broadcast searchable encryption method, in a two-level hierarchical anonymous IBE method with weak robustness, the HIBE.Enc algorithm for encryption is executed with two-level parameters, namely, nodes and keyword candidates. Furthermore, the broadcast searchable encryption method satisfies recipient anonymity and can shorten the ciphertext length, which is a linear size in the number of recipients, to a logarithmic size in the number of recipients. Effect of the Invention

[0012] According to the present invention, it is possible to satisfy receiver anonymity and shorten the ciphertext length. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a block diagram showing a configuration of a broadcast-type searchable encryption system according to an embodiment. [Diagram 2] 1 is a flowchart showing an operation of a broadcast-type searchable encryption system according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, each embodiment described below is intended to embody the technical idea of ​​the present invention, and unless otherwise specified, the present invention is not limited to the following. In addition, the same symbols are used for the same means, and descriptions thereof may be omitted.

[0015] As the premise of a broadcast-type searchable encryption system 1 according to the embodiment, two-level hierarchical anonymous identity-based encryption (HIBE) having weak robustness, a complete subtree (CS) scheme, and BEKS will be described.

[0016] <Anonymous Two-Level HIBE with Weak Robustness> The HIBE method consists of five algorithms defined below (HIBE.Setup, HIBE.KeyGen, HIBE.KeyDer, HIBE.Enc, HIBE.Dec).

[0017] Here, M is the plain text content, and ID is the identification information of each recipient. space is the plaintext space, ID space is the ID space. Let (ID, ID´)∈ID be the hierarchical ID. space ×ID space and handles only two-dimensional IDs. The HIBE.KeyGen algorithm takes the first-level ID as input, and the HIBE.Enc algorithm takes the hierarchical ID (ID, ID´) as input.

[0018] HIBE.Setup: The setup algorithm takes a security parameter λ as input and generates a master public key MPK and a master private key MSK. The security parameter λ is a measure of the security of a cryptosystem and is related to the key size, etc.

[0019] HIBE.KeyGen: The key generation algorithm is based on a master public key MPK, a master private key MSK, and ID∈ID. space is input, and the private key sk ID Generate.

[0020] HIBE.KeyDer: The key derivation algorithm is based on a master public key MPK and a private key sk. ID , and ID ´∈ ID space is input, and the private key sk ID,ID´ Generate.

[0021] HIBE.Enc: The encryption algorithm is a master public key MPK, a hierarchical ID (ID, ID´)∈ID space ×ID space , and plaintext M∈M space The input is the ciphertext ct HIBE Generate.

[0022] HIBE.Dec: The decryption algorithm uses the master public key MPK and the ciphertext ct HIBE , and the private key sk ID,ID´ It takes input and outputs plaintext M or ⊥, where ⊥ represents an error.

[0023] The anonymity of the HIBE method is that the information about the hierarchical ID (ID, ID´) is encrypted in the ciphertext ct HIBE ←This refers to the security that guarantees that there will be no leakage from HIBE.Enc(MPK,(ID,ID´),M). In the following, only Chosen Plaintext Attack (CPA) will be considered. Note that ← indicates the output result of the algorithm.

[0024] In all probabilistic polynomial-time (PPT) cases, the following formula (1) is defined for an attacker A. Note that formula (1) represents the definition of anonymity in the hierarchical IBE method.

[0025]

number

[0026] The key extraction oracle HIBE.KeyGen for one-level IDs is space is input, and the private key sk ID ←Return HIBE.KeyGen(MSK,ID) and update V1 ← V1 ∪ {ID}.

[0027] The key extraction oracle HIBE.KeyGen for two-level IDs is (ID, ID´)∈ID. space ×ID space is input, and the private key sk ID ← Calculate HIBE.KeyGen(MSK,ID), private key sk ID,ID ←HIBE.KeyGen(MSK,sk ID ,ID´) and update V2 ← V2 ∪ {(ID,ID´)}.

[0028] If the gain expressed by the following equation (2) is negligible with respect to the security parameter λ, the HIBE scheme is Anon-CPA secure.

[0029]

number

[0030] We will explain the weak robustness of the HIBE method. Robustness is the security that guarantees that when a ciphertext generated with a certain ID is decrypted with a secret key corresponding to a different ID, it outputs ⊥. For example, the ciphertext ct HIBE ←HIBE.Enc(MPK,(ID,ID´),M), private key sk ID ←HIBE.KeyGen(MPK,MSK,ID￣), private key sk ID￣,ID￣´ ←HIBE.KeyDer(MPK,sk ID￣ , ID￣´), (ID,ID´) ≠ (ID￣,ID￣´), then, in the HIBE.Dec algorithm, the ciphertext ct HIBE The private key sk ID￣,ID´ When decrypted, it outputs ⊥.

[0031] Weak robustness means that robustness is guaranteed when the ciphertext is generated honestly according to the algorithm. For all PPT attackers A, the following formula (3) is defined. Note that this formula (3) represents the definition of weak robustness in the hierarchical IBE method.

[0032]

number

[0033] The key extraction oracle HIBE.KeyGen is space is input, and the private key sk ID ←HIBE.KeyGen(MSK, ID) is returned, and V is updated as V ← V ∪ {(ID)}. If the gain defined in the following equation (4) is negligible with respect to the security parameter λ, the HIBE scheme satisfies weak robustness.

[0034]

Number

[0035] <CS method> Let BT (Binary Tree) be a binary tree with N leaves. For leaf node i, let Path(i) be the set of nodes from the leaf node to the root node. Let RSet be the set of removed leaf nodes. For a node x that is not a leaf node, let x left be the left child node and x right be the right child node. Then, in the CS method, the following steps 1 to 5 are executed (Reference 1).

[0036] Step 1: Initialize x and cover to 0. Step 2: For all i ∈ RSet, add Path(i) to X. Step 3: For all x ∈ X, if x left is not an element of X, then add x left to cover. If x right is not an element of X, then add x right to cover. Step 4: If |RSet| = 0, then add the root node root to cover. Step 5: Output cover.

[0037] It can be expressed as cover ← CompSubTree(BT, Rset). Here, |cover| is evaluated as 0(Rlog(N / R)).

[0038] Reference 1: Dalit Naor, Moni Naor, and Jeffery Lotspiech. Revocation and tracing schemes for stateless receivers. In CRYPTO, pages 41 - 62, 2001.

[0039] <beks> The BEKS method consists of four algorithms defined below (BEKS.Setup, BEKS.Enc, BEKS.Trapdoor, BEKS.TEST). Let N be the maximum number of recipients, and U={i} i∈[1,N] Let be the set of all receivers, and KW space Let be the keyword space.

[0040] BEKS.Setup: The setup algorithm takes a security parameter λ and the maximum number of recipients N as input, and creates a master public key MPK and a private key {sk R[i] } i∈[1,N] Generate.

[0041] BEKS.Enc: The keyword encryption algorithm is a method for encrypting a set of recipients S ⊆ U (|S|=N´≦N) and a keyword kw ∈ KW. space The input is the ciphertext ct BEKS Generate.

[0042] BEKS.Trapdoor: The trapdoor generation algorithm is based on a master public key MPK and a private key sk. R , and keyword kw ´∈KW space Input is trapdoor td R,kw´ Generate.

[0043] BEKS.Test: The test algorithm uses the master public key MPK and the ciphertext ct BEKS , and Trapdoor td R,kw´ It takes input as input and outputs 1 or 0. Note that 1 indicates normal and 0 indicates abnormal.

[0044] We explain external anonymity. An attacker A can obtain V∩(S * 0∪S * We can obtain the private keys of external recipients belonging to the set V for which 1)=0. We can also obtain the trapdoor for keyword kw for all recipients i∈[1,N] via the trapdoor oracle. Here, for i∈S * 0∪S * In the case of 1, the keyword kw is {kw * 0,kw * 1} element. Here, (kw * 0,kw * 1) is the challenge keyword. For all PPT attackers A, the following formula (5) is defined. Note that formula (5) represents the definition of external anonymity in broadcast searchable encryption.

[0045]

number

[0046] The trapdoor oracle BEKS.Trapdoor is a trapdoor for i∈[1,N] and kw=KW space With input and, trapdoor td R,k ←BEKS.Trapdoor(MPK,sk R[i] ,kw} and update V´←V´∪{i}. After the challenge phase, i∈S * 0∪S * 1, and kw∈{kw * 0,kw * 1}, output ⊥. Corrupt oracle takes i ∈ [1,N] as input and sk R[i] After the challenge phase, we return V′←V′∪{i}. * 0∪S * If 1, it outputs ⊥. If the gain defined in the following equation (6) is negligible with respect to the security parameter λ, the BEKS scheme can be said to have external anonymity.

[0047]

number

[0048] [Construction of a broadcast searchable encryption system] The configuration of a broadcast searchable encryption system 1 according to an embodiment will be described with reference to FIG. As shown in FIG. 1, the broadcast-type searchable encryption system 1 uses a two-level hierarchical anonymous IBE and CS scheme, and includes a key generating device 2, a ciphertext generating device 3, a receiving device 4, and a search device 5.

[0049] For example, in a broadcast-type searchable encryption system 1, a key generation device 2, a ciphertext generation device 3, a receiving device 4, and a search device 5 are connected to each other via a wired or wireless communication line.

[0050] The key generation device 2 includes a key generation means 20 that executes a BEKS.Setup algorithm described later to generate a master public key MPK and a private key unique to each recipient. For example, the key generation device 2 is managed by a trusted third party.

[0051] The master public key MPK is a public key common to the broadcast searchable encryption system 1, and is distributed in advance to each device in the broadcast searchable encryption system 1. The private key is a private key unique to each receiver, and is distributed in advance to each receiving device 4. The method of distributing the master public key and the private key is not particularly limited and may be via a network, data broadcasting, offline, or the like.

[0052] The ciphertext generation device 3 includes an encryption means 30 that executes a BEKS.Enc algorithm described later to generate ciphertext for content related to keyword candidates and a set of recipients. For example, one or more ciphertext generation devices 3 may be provided since the content creator manages the content. Furthermore, examples of the content include programs watched by each recipient, and the content is not particularly limited. The ciphertext generation device 3 then outputs the generated ciphertext for the content to the search device 5.

[0053] The receiving device 4 includes a trapdoor generating means 40 that generates a trapdoor including a set of receivers and a search keyword by executing the BEKS.Trapdoor algorithm described later. The search keyword is a keyword designated by the receiver to search for content. For example, the receiving device 4 is a broadcast receiving device installed in the viewer's home, and one or more receiving devices are provided. The receiving device 4 outputs the generated trapdoor to the searching device 5. Furthermore, the receiving device 4 decrypts the encrypted content received from the retrieval device 5 using a private key unique to each recipient.

[0054] The search device 5 includes a search means 50 that executes a BEKS.Test algorithm described later. For example, the search device 5 is a cloud server. When the search keyword and the keyword candidate match and the recipient is included in the recipient set, the search means 50 transmits the encrypted text of the content to the receiving device 4. Note that the keyword candidate is a keyword to be searched for, and is set in advance by, for example, the creator of the content.

[0055] [BEKS implemented in a broadcast searchable encryption system] As explained below, each algorithm of the BEKS method includes the five algorithms of the HIBE method and the CS method. Specifically, the first layer is a general configuration of broadcast encryption from the IBE method described in Reference 2, and the second layer is HIBE, which is a general configuration of PEKS from the IBE method described in Reference 3.

[0056] Reference 2: Nelly Fazio and Irippuge Milinda Perera. Outsider-anonymous broadcast encryption with sublinear ciphertexts. In Public Key Cryptography, pages 225-242, 2012. Reference 3: Dan Boneh, Giovanni Di Crescenzo, Rafail Ostrovsky, and Giuseppe Persiano. Public key encryption with keyword search. In EUROCRYPT,pages 506-522, 2004.

[0057] Since the security of broadcast search encryption cannot be guaranteed by simply combining the techniques in References 2 and 3, the broadcast searchable encryption system 1 uses a hierarchical IBE method instead of the IBE method. Specifically, the broadcast searchable encryption system 1 executes the HIBE.Enc algorithm with two-layer parameters, namely, nodes and keyword candidates. Each algorithm of BEKS executed by the broadcast searchable encryption system 1 will be described in detail below.

[0058] <BEKS.Setupアルゴリズム> The key generation means 20 receives predetermined security parameters as input and executes the BEKS.Setup algorithm, which includes the HIBE.Setup algorithm and the HIBE.KeyGen algorithm, to generate a master public key and a private key. The BEKS.Setup algorithm executed by the key generation means 20 is as follows.

[0059] BEKS.Setup(1 λ ,N):(MPK´,MSK)←HIBE.Setup(1 λ ) for j = 1, … N, Path(j) = {x´1, …, x´ h } where h is the depth of the Binary Tree (BT) and x1=root.

[0060] For k=1,…,h, the secret key sk (j) k ←HIBE.KeyGen(MSK,x´ k ) is executed. The master public key MPK = (MPK´, N) and the private key {sk R[j] } j∈[1,N] Here, sk R[j] ={sk (j) k } k=[1,h] And K.W. space =ID space Let us assume that.

[0061] <BEKS.Encアルゴリズム> The encryption means 30 takes the master public key as input and executes the BEKS.Enc algorithm, which includes the HIBE.Enc algorithm, which uses the nodes and keyword candidates of the CS algorithm as parameters, to generate ciphertext of content related to the keyword candidates and the set of receivers. At this time, the encryption means 30 arranges the receiving devices 4 as nodes in a binary tree (BT) using the CS algorithm. The BEKS.Enc algorithm executed by the encryption means 30 is as follows:

[0062] BEKS.Enc(MPK,S,kw): Expand the master public key MPK = (MPK',N). Specify RSet defined by the following formula (7) and execute cover←CompSubTree(BT,Rset). Here, cover={x1,...,x l }Far away.

[0063]

number

[0064] For j=1,…,l, the ciphertext ct HIBE,j ←HIBE.Enc(MPK´,(x j ,kw),0 λ ) in this way. In the HIBE.Enc algorithm, j and keyword (keyword candidate) kw, which are two-level parameters (x j ,kw) is used to achieve weak robustness. For j=l+1,…,L, M~← $ {0,1} λ Select and press ct HIBE,j ←Execute HIBE.Enc(MPK´,(dummy,dummy´),M~). Ciphertext ct BEKS ={ct HIBE,π(j) } j∈[1,L] where π:{1,…,L}→{1,…,L} is a random permutation.

[0065] <BEKS.Trapdoorアルゴリズム> The trapdoor generation means 40 receives the master public key and private key as input, and executes the BEKS.Trapdoor algorithm, which includes the HIBE.KeyDer algorithm, to generate a trapdoor including a set of recipients and a search keyword. The BEKS.Trapdoor algorithm executed by the trapdoor generation means 40 is as follows.

[0066] BEKS.Trapdoor(MPK,sk R ,kw´): Master public key MPK = (MPK´,N). kw´ represents the search keyword. Assume that the receiver is assigned to leaf node i, and sk R =sk R[i] Let the private key sk R[i] ={sk [i] k } k∈[1,h] For k=1,…,h, the private key sk [i] k,kw´ ←HIBE.KeyDer(MPK´,sk [i] k ,kw´) Trapdoor td R,kw´ ={sk [i] k } k∈[1,h] Generate.

[0067] <BEKS.Testアルゴリズム> The search means 50 receives the master public key and the trapdoor, and executes the BEKS.Test algorithm including the HIBE.Dec algorithm. The search means 50 judges whether the search keyword and the keyword candidate match based on whether the execution result is a preset value. For example, the execution result of the BEKS.Test algorithm is 1, which indicates normal, and 0, which indicates abnormal. In this case, if the execution result is 1, the search means 50 judges that the search keyword and the keyword candidate match, and if the execution result is 0, it judges that the search keyword and the keyword candidate do not match. Furthermore, if the search keyword and the keyword candidate match and the recipient is included in the recipient set, the search means 50 transmits the encrypted text of the content to the receiving device 4. The BEKS.Test algorithm executed by the search means 50 is as follows:

[0068] BEKS.Test(MPK,ct BEKS ,td R,kw´ ): Master public key MPK=(MPK´,N), ciphertext ct BEKS ={ct HIBE,j } j∈[1,L], Trapdoor td R,kw´ ={sk k , kw´ } k∈[1,h] Then, the following loop is executed.

[0069] For k=1 to h,For j=1 to L M←HIBE.Dec(MPK´,ct HIBE,j ,sk k , kw´ ) to run If M=0 λ If j=L, output 1. If j=L, end the loop. Otherwise, set j←j+1. If k=h, output 0. Otherwise, set k←k+1. The two For statements indicate that loop processing is nested.

[0070] Note that if the content is encrypted and the content differs depending on j, then 0 λ ←HIBE.Dec(MPK´,ct HIBE,j ,sk k , kw´ In some cases, we need to find the unique j that satisfies 0 with two or more ciphertexts. λ If this is output, simply output 0 with BEKS.Test.

[0071] As explained below, when the HIBE scheme is anon-CPA secure, the BEKS scheme has external anonymity. * 0,kw * 1,S * Let S1, S2) be the challenge keyword and the set of recipients declared by the attacker. * Let R be the number of deleted users in the challenge ciphertext, i.e., * =N - |S * b Let us define b as |(b∈{0,1}). Also, L * is defined by the following equation (8).

[0072]

number

[0073] For b∈{0,1}, the above formula (7) and cover b ←CompSubTree(BT,Rset b ) cover b cover b ={x (b) 1,…,x (b) lb }. The rest of this paper is basically the same as the Fazio-Perera security proof. For each HIBE ciphertext, we prove that ct HIBE,j ←HIBE.Enc(MPK´,(x (0) j ,kw * 0),0 λ ) of (x (0) j ,kw * 0) with (x (1) j , kw * By replacing it with 1), kw * 0 and S * The ciphertext generated using 0 and kw * 1 and S * It suffices to show that the ciphertext generated using 1 is indistinguishable.

[0074] <Weak Robustness in HIBE> The key generation means 20 sets the size of the random value K included in the master public key MPK to 6.3 times the security parameter λ.

[0075] For IBE, a random value K is selected, included in the master public key MPK, M||K is encrypted during encryption of the plaintext M, ⊥ is output when K cannot be obtained during decryption, and the plaintext M is output when K can be obtained during decryption, thereby satisfying weak robustness. At this time, it is required that the size of the random value K is sufficiently larger than the size of the ID. Specifically, the following equation (9) holds. Here, B is the attacker of the Anon-CPA security, and t is the operation time of the attacker A of the weak robustness.

[0076]

Equation

[0077] As specific parameters, assuming |ID| = 256 and t ≤ 2128, when |K| = 768 is set, the following equation (10) is considered to hold, so K = 6λ is set.

[0078]

Equation

[0079] In the context of searchable encryption, the keyword space can be assumed to be small, so the ID space in the second layer can be made small. For example, the number of words in the "Oxford English Dictionary (the second edition of the 20-volume)" is 171,476. If we assume that keywords are selected from this dictionary, then 18 = 262,144 is sufficient. So, |KW space Therefore, |K| can be evaluated as (4+2 / 7+1+1)λ≈6.3λ. Therefore, the key generation means 20 should set the size of the random value K to be included in the master public key MPK to 6.3 times the security parameter λ.

[0080] [Operation of broadcast searchable encryption system] The operation of the broadcast searchable encryption system 1 will be described with reference to FIG. As shown in FIG. 2, in step S1, the key generation device 2 executes the BEKS.Setup algorithm to generate a master public key and a private key.

[0081] In step S 2 , the key generation device 2 distributes the master public key to the ciphertext generation device 3 . In step S 3 , the key generation device 2 distributes the master public key to the retrieval device 5 . In step S 4 , the key generation device 2 distributes the master public key and private key to the receiving device 4 .

[0082] In step S5, the ciphertext generation device 3 executes the BEKS.Enc algorithm to generate ciphertext of the keyword candidates kw and the content. In step S 6 , the ciphertext generating device 3 transmits the generated ciphertext to the retrieval device 5 .

[0083] In step S7, the receiving device 4 generates a trapdoor by executing the BEKS.Trapdoor algorithm. In step S8, the receiving device 4 transmits the generated trapdoor to the retrieval device 5.

[0084] In step S9, the search device 5 executes the BEKS.Test algorithm. In step S10, the search device 5 judges whether the search keyword and the keyword candidate match based on whether the execution result of step S9 is a preset value. Then, when the search keyword and the keyword candidate match and the recipient is included in the recipient set, the search device 5 transmits the encrypted text of the decrypted content to the receiving device 4.

[0085] [effect] Since the security of the broadcast search encryption cannot be guaranteed by simply combining the techniques of References 2 and 3, the broadcast searchable encryption system 1 uses a hierarchical IBE method instead of the IBE method. Specifically, the broadcast searchable encryption system 1 executes the HIBE.Enc algorithm with two-layer parameters, namely, nodes and keyword candidates. As a result, the broadcast searchable encryption system 1 satisfies receiver anonymity and can protect the receiver's privacy. Furthermore, the broadcast searchable encryption system 1 can shorten the ciphertext length, which is a linear size of the number of receivers, to a logarithmic size of the number of receivers, thereby reducing the amount of data. In this way, the broadcast searchable encryption system 1 safely manages encrypted content (e.g., programs) while enabling receivers to watch programs according to their preferences.

[0086] Although the embodiment has been described in detail above, the present invention is not limited to the above-described embodiment, and includes design modifications and the like within the scope of the present invention. For example, in the above embodiment, the key generation device and the ciphertext generation device are described as separate devices, but the key generation device and the ciphertext generation device may be integrated. [Explanation of symbols]

[0087] 1 Broadcast Searchable Encryption System 2 Key generation device 3 Ciphertext generation device 4. Receiving device 5 Search device 20 Key generation means 30 Encryption methods 40 Trapdoor Creation Method 50 Search methods< / beks>

Claims

1. A broadcast searchable encryption system using a two-level hierarchical anonymous IBE and CS method with weak robustness, A key generation device including a key generation unit that receives a predetermined security parameter as an input and executes a BEKS.Setup algorithm including a HIBE.Setup algorithm and a HIBE.KeyGen algorithm to generate a master public key and a private key unique to each recipient; A ciphertext generating device including an encryption means for executing a BEKS.Enc algorithm including a HIBE.Enc algorithm with the master public key as an input and the CS method node and keyword candidates as parameters to generate a ciphertext of a content to which the keyword candidates and a set of recipients are related; A receiving device including a trapdoor generating means for generating a trapdoor including the set of recipients and a search keyword by executing a BEKS.Trapdoor algorithm including a HIBE.KeyDer algorithm using the master public key and the private key as input; a search device including a search means for receiving the master public key and the trapdoor, executing a BEKS.Test algorithm including a HIBE.Dec algorithm, and judging whether the search keyword and the keyword candidate match based on whether the execution result is a preset value, and transmitting an encrypted text of the content to the receiving device when the search keyword and the keyword candidate match and the recipient is included in the recipient set; A broadcast searchable encryption system comprising:

2. 2. The broadcast-type searchable encryption system according to claim 1, wherein said encryption means arranges said receiving devices as said nodes in a binary tree according to said CS algorithm.

3. 2. The broadcast searchable encryption system according to claim 1, wherein the key generation means sets a size of the random value to be included in the master public key to 6.3 times the security parameter.

4. A broadcast searchable encryption method using a two-level hierarchical anonymous IBE and CS method with weak robustness, comprising: A key generating device generates a master public key and a private key unique to each recipient by executing a BEKS.Setup algorithm, which includes a HIBE.Setup algorithm and a HIBE.KeyGen algorithm, using a predetermined security parameter as input; A ciphertext generating device executes a BEKS.Enc algorithm including a HIBE.Enc algorithm using the master public key as an input and the CS method nodes and keyword candidates as parameters to generate a ciphertext of the content to which the keyword candidates and the set of recipients are related; A receiving device executes a BEKS.Trapdoor algorithm including a HIBE.KeyDer algorithm using the master public key and the private key as input to generate a trapdoor including the set of recipients and a search keyword; a search device receives the master public key and the trapdoor, executes a BEKS.Test algorithm including a HIBE.Dec algorithm, and determines whether the search keyword and the keyword candidate match based on whether the execution result is a preset value, and when the search keyword and the keyword candidate match and the recipient is included in the recipient set, transmits an encrypted text of the content to the receiving device; A broadcast searchable encryption method, comprising the steps of:

Images