Data management system

Abstract

To verify that encrypted data has been correctly re-encrypted.SOLUTION: A data management system 1 comprises: a key generation device 10 for generating a master public parameter and a master secret key; a data holder device 20 for storing encrypted data in association with an index in an index database 32; a cloud server 30 for re-encrypting the encrypted data and transmitting it to a service provider device 40; and the service provider device 40 for verifying the encrypted data and providing a desired service.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a data management system using identity-based verifiable proxy re-encryption and hash values. [Background technology]

[0002] In recent years, systems that manage and provide personal information, such as personal data stores (PDSs) and data trading markets, have been attracting attention (for example, Non-Patent Document 1). For example, in a PDS, the user manages personal information, such as the location information of their smartphone and their online shopping purchase history, in a data management device (for example, the cloud) on a network. In addition, in a PDS, the user can provide data of their own volition to third parties such as service providers, and the user can enjoy services based on the data provided. Note that a system that utilizes a PDS and other systems to manage and provide data on behalf of the user is called an information bank.

[0003] Also, ID-based proxy re-encryption has been proposed as a mechanism for managing and providing various data (for example, Non-Patent Document 2). This ID-based proxy re-encryption uses an arbitrary ID (for example, an email address) as the public key of each user, and generates a private key for each user using a master private key and the ID obtained from a trusted institution called a key generation center (PKG).

[0004] Also, ID-based verifiable proxy re-encryption (IB-VPRE) has been proposed as an extension of ID-based proxy re-encryption (for example, Non-Patent Document 3). This IB-VPRE generates a re-encrypted verification key when generating a re-encryption key, and verifies the re-encrypted data using the re-encrypted verification key. At this time, a pair of the original encrypted data and the re-encrypted data is also required to verify the re-encryption. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] "How Personal Data Store (PDS) works | Explaining the benefits and differences with information banks", [online], [Retrieved August 29, 2022], Internet<URL:https: / / privtech.co.jp / blog / data / pds_merit_structure.html> [Non-Patent Document 2] Green, Matthew, and Ateniese, Giuseppe. "Identity-based proxy re-encryption." International Conference on Applied Cryptography and Network Security. Springer, Berlin, Heidelberg, 2007. [Non-Patent Document 3] Li-qiang, W. , Xiao-yuan, Y. , Min-qing, Z. , and Xu-an, W. "IB-VPRE: adaptively secure identity-based proxy re-encryption scheme from LWE with re-encryption verifiability. " Journal of Ambient Intelligence and Humanized Computing, 1-14. 2021. Summary of the Invention [Problem to be solved by the invention]

[0006] When a user or an information bank manages data, a data management device such as a cloud is often used from the viewpoint of convenience. Sensitive data such as location information and purchase history are managed on the data management device, so the data needs to be encrypted so that the user's privacy can be appropriately protected even if the data is leaked. However, in data encryption using a common key encryption method such as AES, the user who is the data holder and the service provider to which the data is provided need to have the same key. Therefore, when a user provides data to multiple service providers, the user and all the service providers must share the same key. Therefore, if a key is leaked from a certain service provider, there is a risk that all of the user's data, including the encrypted data managed in the data management device, will be leaked. For this reason, the application of a common key encryption method is not practical.

[0007] When selecting data to be handed over to each service provider, the encrypted data managed by the data management device must be decrypted once and then re-encrypted. If the data management device is illegally accessed at this time, there is a risk that the decrypted data may be leaked. For this reason, it is preferable to re-encrypt the encrypted data managed by the data management device without ever decrypting it.

[0008] Therefore, we consider whether this problem can be solved by applying IB-VPRE to the data management device.However, simply applying IB-VPRE to the data management device makes it difficult for the service provider to detect attacks such as re-encrypting differently encrypted data or not performing correct re-encryption in the cloud.

[0009] SUMMARY OF THE PRESENT EMBODIMENTS An object of the present invention is to provide a data management system that can verify that encrypted data has been correctly re-encrypted. [Means for solving the problem]

[0010] In order to solve the above problems, the data management system of the present invention is a data management system that encrypts each of multiple data held by a data holder using ID-based verifiable proxy re-encryption and provides it to each service provider, and is configured to include a key generation device, a data holder device, a data management device, and a service provider device.

[0011] The key generation device includes a setup means for generating master public parameters and a master private key using a Setup algorithm based on predetermined security parameters as input, and a decryption key generation means for generating decryption keys for the data holder and the service provider using a KeyGen algorithm based on the master public parameters, the master private key, and the IDs of the data holder and the service provider as input.

[0012] The data holder device comprises encryption means that takes as input master public parameters, the data holder's ID, and data, generates encrypted data using the Encrypt algorithm, calculates a hash value of the encrypted data, and generates a table linked to an index of the data, re-encryption key generation means that takes as input master public parameters, the data holder's decryption key, and the IDs of the data holder and the service provider, generates a re-encryption key and a re-encryption verification key using the RKGen algorithm, and data output means that references the table and outputs a hash value corresponding to the encrypted data.

[0013] The data management device includes a re-encryption means that receives as input the master public parameters, the re-encryption key, and the encrypted data linked to the index, and generates re-encrypted data by re-encrypting the encrypted data using a ReEncrypt algorithm.

[0014] The service provider device includes a hash value verification means for calculating a hash value from the encrypted data of the data management device and verifying whether the calculated hash value matches the hash value received from the data holder device, a re-encryption verification means for verifying whether the re-encrypted data has been re-encrypted from the encrypted data using a ReEncVer algorithm, using as inputs the master public parameters, a re-encryption verification key, the encrypted data, and the re-encrypted data, and a decryption means for decrypting data using a Decrypt algorithm, using as inputs the master public parameters, the service provider's decryption key, and the re-encrypted data.

[0015] With this configuration, the data management system can use the IB-VPRE and hash value to maintain the data in an encrypted state on the data management device without decrypting it, and can verify that the encrypted data has been correctly re-encrypted when providing the data to a service provider. Effect of the Invention

[0016] According to the present invention, it is possible to verify that encrypted data has been re-encrypted correctly. [Brief description of the drawings]

[0017] [Figure 1] FIG. 1 is a schematic diagram of a conventional IB-VPRE. [Diagram 2] 1 is a schematic diagram of a data management system according to an embodiment. [Diagram 3] FIG. 3 is a block diagram showing the configuration of the data management system shown in FIG. 2. [Figure 4-1] 3 is a sequence diagram showing the operation of the data management system of FIG. 2. [Figure 4-2] 3 is a sequence diagram showing the operation of the data management system of FIG. 2. [Figure 4-3] 3 is a sequence diagram showing the operation of the data management system of FIG. 2. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, each embodiment described below is intended to embody the technical idea of ​​the present invention, and unless otherwise specified, the present invention is not limited to the following. In addition, the same symbols are used for the same means, and descriptions thereof may be omitted.

[0019] With reference to FIG. 1, a conventional ID-based verifiable proxy re-encryption will be described as a premise for a data management system 1 (FIG. 3) according to an embodiment.

[0020] [IB-VPRE] IB-VPRE is an ID encryption method that performs encryption and re-encryption based on an ID (identifier) ​​and can verify whether the re-encryption has been performed correctly. As shown in Fig. 1, IB-VPRE is composed of seven algorithms S1 to S7 (see Non-Patent Document 2).

[0021] The setup algorithm S1 uses a security parameter k (precisely, 1 k ) is used as input to generate master public parameters params and a master private key msk. The security parameter k is a measure of the security of the encryption and is related to the key size, etc. The master public parameters params are parameters that are required to execute each algorithm of ID-based verifiable proxy re-encryption and are made public to all users.

[0022] The KeyGen algorithm S2 uses master public parameters params, a master private key msk, and each ID (id, id´) ∈ {0, 1} * The decryption key (sk id ,sk id´ ) is generated. Note that ID (id, id´) represents the IDs assigned to the two entities (details will be described later).

[0023] Encrypt algorithm S3 uses master public parameters params, ID(id)∈{0,1} *And data m ∈ M is used as input, and encrypted data c based on ID(id) is id Here, M is an integer of 2 or more.

[0024] The RKGen algorithm S4 uses the master public parameters params and the decryption key sk id and ID(id,id´) as input, re-encryption key rk id→id´ and the re-encrypted verification key vk id→id´ Generate.

[0025] The ReEncrypt algorithm S5 uses the master public parameters params and the re-encryption key rk id→id´ and encrypted data c id Take as input the encrypted data c id Re-encrypted data c id´ Generate.

[0026] The ReEncVer algorithm S6 uses the master public parameters params and the re-encryption verification key vk id→id´、 Encrypted data id and re-encrypted data c id´ The re-encryption verification is performed using the input. The verification result of the re-encryption is id´ is the original encrypted data c id If the data is correctly re-encrypted, the verification is successful and the re-encrypted data c id´ is the original encrypted data c id If the data is not correctly re-encrypted, the verification will fail with a value of "0".

[0027] The decryption algorithm S7 uses the master public parameters params and the decryption key sk id´ and re-encrypted data c id´ Using the above as input, the data m is decrypted.

[0028] [Data Management System Overview] An overview of a data management system 1 according to an embodiment will be described with reference to FIG. The data management system 1 encrypts each of a plurality of data m held by a data holder DO using ID-based verifiable proxy re-encryption and provides it to each service provider SP. As shown in Fig. 2, the data management system 1 is composed of four entities (organizations): a key generation center PKG, a data holder DO, a service provider SP, and a cloud CL, and is implemented as a device corresponding to each entity.

[0029] The key generation center PKG is a trusted third party that generates decryption keys (sk) for each ID of the data owner DO and the service provider SP. id ,sk id´ That is, the key generation center PKG generates a decryption key sk for each data owner DO. id and generates a decryption key sk for each service provider SP. id´ Generate.

[0030] The data owner DO owns various data and provides the data m to the service provider SP via the cloud CL. Here, the data owner DO encrypts the data m when providing the data to the service provider SP. For example, the data m may include personal information such as television program viewing history, smartphone location information, online shopping purchase history, and hospital visit history.

[0031] The service provider SP uses the data m of the data owner DO to provide a desired service. Note that the content of the service is not particularly limited and is arbitrary, and is not directly related to the present invention, so the above description will be omitted.

[0032] The cloud CL provides data m held by a data owner DO to a service provider SP. In other words, the cloud CL receives encrypted data c id and manages the encrypted data c based on the ID of the service provider SP. id Re-encrypt the data c id´ is provided to the service provider SP.

[0033] In this embodiment, as an example, it is assumed that there is one data holder DO and one service provider SP, each having a unique ID. Here, the ID of the data holder DO is id, and the ID of the service provider SP is id'. For example, an email address or an IP (Internet Protocol) address can be used as the ID. It is to be noted that there may be multiple data holders DO and service providers SP, and in this case, each has a unique ID.

[0034] As mentioned above, simply applying IB-VPRE does not allow the cloud CL to read the original encrypted data c id and re-encrypt data c id´ If a different pair is intentionally selected, this cannot be detected. Therefore, the data owner DO encrypts the data c id The hash value H(c id ) and calculate the hash value H(c id ) is sent to the service provider SP. The service provider SP sends the encrypted data c id From the hash value H(c id ) and calculates the hash value H(c id ) is verified by checking whether it matches the encrypted data c id There is no need to store the index j and the hash value H(c id ) can be stored in a table, which can significantly reduce the storage capacity.

[0035] An overview of the processing in the data management system 1 will now be described. The key generation center PKG notifies the data holder DO, the service provider SP, and the cloud CL of the hash function to be used (e.g., SHA-256, SHA-512). The key generation center PKG generates master public parameters params and a master private key msk by a Setup algorithm S1 (step S10 in FIG. 2). Then, the key generation center PKG transmits the master public parameters params to the data holder DO, the service provider SP, and the cloud CL. Note that the master private key msk is managed as a secret by the key generation center PKG.

[0036] The data owner DO transmits its own ID, id, to the key generation center PKG. The service provider SP also transmits its own ID, id', to the key generation center PKG. The key generation center PKG then generates the decryption key sk of the data owner DO by the KeyGen algorithm S2. id and the decryption key sk of the service provider SP id´ (Step S11 in FIG. 2). That is, the decryption key sk id is the decryption key associated with the ID of the data owner DO, and the decryption key sk id´ is a decryption key associated with the service provider SP's id'. Furthermore, the key generation center PKG generates the decryption key sk id Send the decryption key sk to the data owner DO id´ is sent to the service provider SP.

[0037] A data owner DO has n pieces of data m1,…,m n (n≧2). The data owner DO also encrypts data m1,…,m n Encrypt based on ID, and encrypt data c 1,id ,…,c n,id (Step S12 in FIG. 2). Then, the data owner DO generates the encrypted data c 1,id ,…,c n,id Let m1,…,m nFor example, the data owner DO stores the encrypted data c in consecutive addresses 1, ..., j, ... n in the index DB 32. 1,id ,…,c j,id ,…,c n,id are stored in order, the address of the index DB 32 can be used as an index (where 1≦j≦n).

[0038] The service provider SP shares its own ID, id', with the data owner DO. This ID sharing method is arbitrary. For example, if an email address is used as the ID, the email address of the service provider SP can be registered in the data owner DO. The data owner DO generates a re-encryption key rk for each service provider SP using the RKGen algorithm S4. id→id´ and the re-encrypted verification key vk id→id´ (Step S13 in FIG. 2). That is, this re-encryption key rk id→id´ and the re-encrypted verification key vk id→id´ is a key corresponding to the combination of the data owner DO and the service provider SP.

[0039] The data owner DO provides the data m j and sends the index j to the cloud CL (1≦j≦n). j,id is the input of the hash function H, and the resulting hash value H(c j,id ) to the service provider SP (step S14 in FIG. 2). The cloud CL transmits the encrypted data c j,id from the index DB32. Also, the cloud CL selects the re-encryption key rk by the ReEncrypt algorithm S5. id→id´ Encrypt data c using j,id (Step S15 in FIG. 2). Then, the cloud CL re-encrypts the re-encrypted data c j,id´ The information is stored in the service provider DB33.

[0040] The service provider SP receives the encrypted data c from the cloud CL. j,id and re-encrypted data c j,id´ The service provider SP also receives the encrypted data c j,id From the hash value H(c j,id ) received from the data owner DO. j,id ) and the calculated hash value H(c j,id ) matches (step S16 in FIG. 2).

[0041] Cloud CL uses the re-encrypted data stored in the service provider DB33. j,id´ The service provider SP transmits the re-encryption verification key vk id→id´ Re-encrypt data c j,id´ is the original encrypted data c j,id Then, it is verified whether the data has been correctly re-encrypted (step S17 in FIG. 2).

[0042] The service provider SP generates the decryption key sk by the Decrypt algorithm S7. id´ Re-encrypt data c using j,id´ Decrypt the data m j (Step S18 in FIG. 2). After that, the service provider SP acquires the acquired data m j to provide the desired service.

[0043] In addition, the service provider SP uses the hash value H(c j,id If both the hash value H(c) and the ReEncVer algorithm S6 are verified, the Decrypt algorithm S7 is executed. j,id ) or the ReEncVer algorithm S6 can be verified, an error is output and the Decrypt algorithm S7 is not executed.

[0044] [Data management system configuration] The configuration of the data management system 1 will be described with reference to FIG. 3, the data management system 1 includes a key generating device 10, a data holder device 20, a cloud server (data management device) 30, and a service provider device 40. In the data management system 1, each device is connected via a network such as the Internet.

[0045] The key generation device 10 has the functions of the key generation center PKG in FIG. The setup means 11 executes a Setup algorithm S1. The decryption key generating means 12 executes the KeyGen algorithm S2.

[0046] The data holder device 20 has the functions of the data holder DO in FIG. 2, and includes encryption means 21, re-encryption key generation means 22, table storage means 23, and data transmission means (data output means) 24.

[0047] The encryption means 21 executes the Encrypt algorithm S3 and generates the encrypted data c 1,id ,…,c n,id The hash value H(c 1,id ),…,H(c n,id ) is calculated. The re-encryption key generating means 22 executes the RKGen algorithm S4. The table storage means 23 stores the encrypted data c j,id The hash value H(c j,id ) to index j.

[0048] The data transmission means 24 transmits the data m selected by the data holder DO. j The index j of data m provided to the service provider SP j The data transmission means 24 transmits (outputs) the index j of the re-encrypted verification key vkid→id´ , and encrypted data c j,id The hash value H(c j,id ) is transmitted (output) to the service provider device 40.

[0049] The cloud server 30 has the functions of the cloud CL in FIG. 2, and includes a re-encryption means 31, an index DB (index database) 32, and a service provider DB (service provider database) 33.

[0050] The re-encryption means 31 executes the ReEncrypt algorithm S5. Index DB32 is the encrypted data c associated with index n. n,id It is a database that accumulates The service provider DB33 re-encrypts the encrypted data c n,id´ The service provider DB 33 is provided for each service provider SP, and there is one in the example of FIG.

[0051] 2, and includes hash value verification means 41, re-encryption verification means 42, decryption means 43, and parameter transmission means 44. Note that in the service provider device 40, the explanation and illustration of the means for providing a desired service are omitted, since they are not directly related to the present invention.

[0052] The hash value verification means 41 verifies the re-encrypted data c j,id´ is the encrypted data c j,id It verifies that the data is correctly re-encrypted from the The re-encryption verification means 42 executes the ReEncVer algorithm S6.

[0053] The decryption means 43 executes the Decrypt algorithm S7. Here, if the hash value verification means 41 can verify that the hash values ​​match and the re-encryption verification means 42 can verify that the re-encrypted data has been re-encrypted from the encrypted data, the decryption means 43 decrypts the data by the Decrypt algorithm S7. On the other hand, if the hash value verification means 41 cannot verify that the hash values ​​match or the re-encryption verification means 42 cannot verify that the re-encrypted data has been re-encrypted from the encrypted data, the decryption means 43 does not decrypt the data. The parameter sending means 44 sends parameters such as the id′ to the key generating device 10 .

[0054] [Data Management System Operation] The operation of the data management system 1 will be described with reference to FIGS. 4-1 to 4-3. As shown in FIG. 4-1, in step S20, the setup means 11 of the key generation device 10 receives the security parameter k as an input and generates master public parameters params and a master private key msk by a Setup algorithm S1.

[0055] In step S21, the setup means 11 transmits the master public parameters params to the data holder device 20. In step S22, the setup means 11 transmits the master public parameters params to the service provider device 40. In step S23, the setup means 11 transmits the master public parameters params to the cloud server 30.

[0056] In step S24, the data transmitting means 24 of the data holder device 20 transmits the id, which is the ID of the data holder DO, to the key generating device 10. In step S25, the parameter sending means 44 of the service provider device 40 sends the id′ which is the ID of the service provider SP to the key generating device 10.

[0057] In step S26, the decryption key generation means 12 of the key generation device 10 receives the master public parameters params, the master private key msk, and the IDs (id, id') of the data holder DO and the service provider SP as input, and generates the decryption keys (sk id ,sk id´ )

[0058] In step S27, the decryption key generating means 12 generates the decryption key sk of the data holder DO. id to the data holder device 20. In step S28, the decryption key generating means 12 generates the decryption key sk of the service provider SP. id´ to the service provider device 40.

[0059] In step S29, the encryption means 21 of the data holder device 20 encrypts the master public parameters params, the data holder's ID (id), and the data m1, . . . , m n Using the Encrypt algorithm S3, data m1,…,m n Encrypted data of c 1,id ,…,c n,id Generate.

[0060] In step S30, the encryption means 21 encrypts the encrypted data c 1,id ,…,c n,id The hash value H(c 1,id ),…,H(c n,id ) is calculated. In step S31, the encryption means 21 encrypts the encrypted data c j,id The hash value H(c j,id ) to the index j, and stores the table in the table storage means 23. In step S32, the encryption means 21 encrypts the encrypted data c 1,id ,…,c n,id to the cloud server 30.

[0061] As shown in FIG. 4-2, in step S33, the cloud server 30 1,id ,…,c n,id are associated with indexes 1, ..., n and stored in index DB32. In step S34, the re-encryption key generating means 22 of the data holder device 20 generates the decryption key sk of the data holder DO. id The IDs (id, id´) of the data owner DO and the service provider SP are input, and the re-encryption key rk is generated by the RKGen algorithm S4. id→id´ and the re-encrypted verification key vk id→id´ Generate.

[0062] In step S35, the re-encryption key generating means 22 generates the re-encryption key rk id→id´ to the cloud server 30. In step S36, the data transmission means 24 also transmits the re-encrypted verification key vk id→id´ , and the hash value H(c j,id ) to the service provider device 40.

[0063] In step S37, the data transmission means 24 transmits the data m provided by the data holder DO to the service provider SP. j Select . In step S38, the data transmission means 24 transmits the data m selected by the data holder DO. j The index j of the node 10 is transmitted to the cloud server 30.

[0064] In step S39, the re-encryption means 31 of the cloud server 30 re-encrypts the encrypted data c corresponding to the index j. j,id Select from index DB32. In step S40, the re-encryption means 31 receives the master public parameters params and the re-encryption key rk id→id´ and the encrypted data c associated with index j j,id Using the ReEncrypt algorithm S5, the encrypted data c j,id Re-encrypt the

[0065] In step S41, the re-encryption means 31 generates the re-encrypted data c j,id´ The information is stored in the service provider DB33. In step S42, the re-encryption means 31 re-encrypts the encrypted data c j,id and re-encrypted data c j,id´ to the service provider device 40.

[0066] As shown in FIG. 4-3, in step S43, the hash value verification means 41 verifies the encrypted data c id From the hash value H(c j,id ) and calculate the calculated hash value H(c j,id ) and the hash value H(c j,id ) is matched.

[0067] In step S44, the re-encryption verification means 42 receives the master public parameters params, the re-encryption verification key vk id→id´、 Encrypted data j,id and re-encrypted data c j,id´ Using the above as input, the re-encryption is verified by the ReEncVer algorithm S6.

[0068] In step S45, the decryption means 43 receives the master public parameters params and the decryption key sk of the service provider SP. id´ and re-encrypt data c j,id´ Using the input, the Decrypt algorithm S7 converts the data m j Decrypt the If the verification fails in step S43 or step S44, the service provider device 40 determines that fraud may have occurred in the cloud server 30, and the decryption means 43 decrypts the data m j The process ends without decoding the data.

[0069] [Actions and Effects] As described above, the data management system 1 can use the IB-VPRE and hash value to maintain data in an encrypted state on the cloud server 30 without decrypting it, and can verify that the encrypted data has been correctly re-encrypted when providing the data to the service provider SP.

[0070] Re-encrypt data c j,id´ Only the service provider SP with the ID specified by the data owner DO can decrypt the encrypted data c j,id This eliminates the need to store the information, and can greatly reduce the storage capacity of the data holder device 20. In this way, the data management system 1 can achieve both high security and service stability.

[0071] Although the embodiment has been described in detail above, the present invention is not limited to the above-described embodiment, and includes design modifications and the like within the scope of the present invention. In the above embodiment, the data management device is described as a cloud server, but is not limited to this. For example, the data management device may be a general server equipped with a database.

[0072] In the above embodiment, it has been explained that there is one data owner DO and one service provider SP, but there may be more than one. Here, the number of data holders DO is num, and the number of service providers SP is num'. In this case, the decryption key generation means 12 generates the decryption key sk of the data holder DO. id num, and the service provider SP's decryption key sk id´ In addition, the re-encryption key generating means 22 generates num×num re-encryption keys rk id→id´ In addition, the service provider DB 33 may have the same number of decryption keys skid' of the service providers SP as the number num' of the service providers SP. [Explanation of symbols]

[0073] 1 Data Management System 10 Key generator 11 Setup Method 12 Decryption key generation method 20 Data holder device 21 Encryption methods 22 Re-encryption key generation means 23 Table storage means 24 Data transmission means (data output means) 30 Cloud server (data management device) 31 Re-encryption method 32 Index DB (Index Database) 33 Service provider DB (service provider database) 40 Service provider equipment 41 Hash value verification method 42 Re-encryption verification method 43 Decryption Method 44 Parameter transmission means CL Cloud DO Data holder PKG Key Generation Center SP service provider

Claims

1. A data management system in which a data owner encrypts each of a plurality of data held by the data owner using ID-based verifiable proxy re-encryption and provides the encrypted data to each service provider, A setup means for generating master public parameters and a master private key by a Setup algorithm using predetermined security parameters as input; a key generation device including: a decryption key generation means for generating decryption keys for the data holder and the service provider using a KeyGen algorithm based on the master public parameters, the master private key, and IDs of the data holder and the service provider; an encryption means for generating encrypted data using an Encrypt algorithm based on the master public parameters, the ID of the data holder, and the data, and for generating a table linked to an index of the data by calculating a hash value of the encrypted data; a re-encryption key generating means for generating a re-encryption key and a re-encryption verification key by using the master public parameters, the decryption key of the data holder, and IDs of the data holder and the service provider as inputs, using an RKGen algorithm; a data holder device including a data output means for referring to the table and outputting a hash value corresponding to the encrypted data; a data management device including a re-encryption means for generating re-encrypted data by re-encrypting the encrypted data using a ReEncrypt algorithm, the re-encryption means receiving the master public parameters, the re-encryption key, and the encrypted data associated with the index as input; a hash value verification means for calculating a hash value from the encrypted data of the data management device and verifying whether the calculated hash value matches a hash value received from the data owner device; re-encryption verification means for verifying, using the master public parameters, the re-encryption verification key, the encrypted data, and the re-encrypted data as inputs, whether or not the re-encrypted data has been re-encrypted from the encrypted data by a ReEncVer algorithm; a service provider device including a decryption means for decrypting the data using the master public parameters, the decryption key of the service provider, and the re-encrypted data as inputs, by a Decrypt algorithm; A data management system comprising:

2. 2. The data management system according to claim 1, wherein the decryption means decrypts the data using the Decrypt algorithm when the hash value verification means verifies that the hash values ​​match and the re-encryption verification means verifies that the re-encrypted data has been re-encrypted from the encrypted data.

3. The encryption means calculates a hash value from the encrypted data generated by the Encrypt algorithm using a preset hash function, 2. The data management system according to claim 1, wherein the hash value verification means calculates a hash value from the encrypted data of the data management device using the same hash function as that used by the encryption means.

4. The data management device includes: an index database that stores encrypted data associated with the index; 2. The data management system according to claim 1, further comprising a service provider database that stores the re-encrypted data.

5. The data management system according to claim 1 or 2, wherein the data management device is a cloud server.

Images