Encryption device, re-encryption device, and decoder, and programs therefor

Abstract

To provide a data management system that, when a data owner provides, through a cloud, data requested from a service provider, can provide the requested data to the service provider without exposing the data to the cloud.SOLUTION: A data management system 100 comprises: an encryption device 2 of a data owner, the encryption device encrypting a plurality of data and storing the plurality of encrypted data to a storage device 3 of a cloud CL and generating a re-encryption key and a compaction key from a collection of data classes requested from a service provider and an identifier of the service provider; a re-encryption device 4 of the cloud for re-encrypting encrypted data of the data owner by using the re-encryption key and the compaction key; and a decoder 5 of the service provider, the decoder transmitting the collection of data classes and the identifier of the service provider to the encryption device 2 to decrypt the re-encrypted data received from the re-encryption devise 4.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an encryption device, a re-encryption device, a decryption device, and programs therefor. [Background technology]

[0002] In recent years, systems such as personal data stores (PDS) and data trading markets that allow users to manage and provide personal information based on their own will have attracted attention. In a PDS, data owners themselves manage their personal information, such as smartphone location information and online shopping purchase history, and provide the data to third parties such as service providers of their own volition. This enables data owners to enjoy services based on the data they have provided.

[0003] When data owners manage their own data, they often use cloud computing from the viewpoint of convenience. When managing data on the cloud, data must be encrypted and stored from the viewpoint of privacy protection. One of the system requirements of PDS is the ability to select data to be provided according to multiple service providers. When selecting and encrypting data to be provided to each service provider, encrypted data stored and managed in the cloud generally needs to be decrypted once and then re-encrypted.

[0004] However, if a database on the cloud is illegally accessed, there is a risk that the decrypted data may be leaked. Therefore, it is desirable for all data on the cloud to be re-encrypted without ever being decrypted.

[0005] In recent years, therefore, Identity-Based Proxy Re-Encryption (IB-PRE) has been proposed, which introduces an ID-based encryption mechanism into Proxy Re-Encryption (PRE), an encryption method that allows data to be re-encrypted while remaining encrypted on a proxy server (cloud) (Non-Patent Document 1). IB-PRE can use a unique identifier (ID) such as an email address or phone number as the public key of the data owner, which reduces the burden of managing and distributing the public key.

[0006] Furthermore, a key-aggregate proxy re-encryption scheme (KA-PRE) that incorporates key-aggregate cryptosystem (KAC) technology that can aggregate multiple keys into the proxy re-encryption scheme (PRE) has been proposed (Non-Patent Document 2). KA-PRE enables data owners to safely and efficiently transfer access rights to their data to other users by using an aggregate key. [Prior art documents] [Non-patent literature]

[0007] [Non-Patent Document 1] Matthew Green, and Giuseppe Ateniese. “Identity-Based Proxy Re-Encryption.” International Conference on Applied Cryptography and Network Security. Springer, Berlin, Heidelberg, (2007). [Non-Patent Document 2] Gaurav Pareek, and Purushothama BR “KAPRE: Key-aggregate proxy re-encryption for secure and flexible data sharing in cloud storage.” Journal of Information Security and Applications, 63, 103009, (2021). Summary of the Invention [Problem to be solved by the invention]

[0008] However, the conventional method has a problem in that when re-encrypting encrypted data, the cloud side can find out which encrypted data the data owner selected. Therefore, with conventional methods, there is a risk that a third party may learn, for example, that certain data is re-encrypted frequently. Even if the content of the data cannot be known, it is possible to infer that it is highly important, and attacks are anticipated that aim to degrade service by intentionally corrupting the data.

[0009] Therefore, an object of the present invention is to provide an encryption device, a re-encryption device, and a decryption device, as well as programs for these devices, that enable a data owner to provide requested data to a data user such as a service provider via the cloud without explicitly indicating the requested data to the cloud. [Means for solving the problem]

[0010] In order to solve the above problems, the encryption device of the present invention is an encryption device for a data owner in a data management system in which the data owner provides data to data users via the cloud, and is configured to include a data encryption unit, an encrypted data transmission unit, a data class receiving unit, a re-encryption key generation unit, and a re-encryption key transmission unit.

[0011] In such a configuration, the encryption device uses a data encryption unit to encrypt multiple pieces of data associated with a data class, which is an index of the data, using public parameters, the data owner's private key, and the data owner's identifier to generate multiple encrypted data. Then, the encryption device transmits the plurality of encrypted data to the cloud storage device by the encrypted data transmission unit.

[0012] Furthermore, the encryption device receives, via the data class receiving unit, from the decryption device of the data user, a set of data classes of the data requested by the data user and an identifier of the data user. Then, the encryption device generates, by a re-encryption key generation unit, an aggregate key, which is a public key corresponding to a collection of data classes, and a re-encryption key for re-encrypting multiple encrypted data, using the public parameters, the data owner's private key, and the respective identifiers of the data owner and the data user. Then, the encryption device transmits the aggregate key and the re-encryption key to the cloud re-encryption device in association with the identifier of the data owner and the identifier of the data user by means of the re-encryption key transmission unit.

[0013] This aggregate key is not a key specific to a data class, so it is possible to keep secret from the cloud which encrypted data a data user has requested. The encryption device can be operated by a program that causes a computer to function as each of the above-mentioned units.

[0014] In addition, in order to solve the above-mentioned problems, the re-encryption device of the present invention is a cloud re-encryption device in a data management system in which a data owner provides data to a data user via the cloud, and is configured to include a re-encryption key receiving unit, an encrypted data acquisition unit, a data re-encryption unit, and a re-encrypted data transmission unit.

[0015] In such a configuration, the re-encryption device receives, via the re-encryption key receiving unit, from the data owner's encryption device, an aggregate key, which is a public key corresponding to a set of data classes, and a re-encryption key for re-encrypting multiple encrypted data from the data owner to the data user, in correspondence with the data owner's identifier and the data user's identifier. Then, the re-encryption device causes the encrypted data acquisition unit to acquire a plurality of encrypted data items corresponding to the identifier of the data owner from the cloud storage device. Then, the re-encryption device re-encrypts, by means of the data re-encryption unit, each of the multiple encrypted data corresponding to the identifier of the data owner using the public parameters, the aggregate key, and the re-encryption key, to generate multiple re-encrypted data corresponding to the identifier of the data user. Then, the re-encryption device transmits the plurality of re-encrypted data to the decryption device of the data user by means of the re-encrypted data transmission section.

[0016] In this way, since the aggregate key is not a key specific to a data class, the re-encryption device can generate re-encrypted data without knowing which encrypted data the data user has requested. The re-encryption device can be operated by a program that causes a computer to function as each of the above-mentioned units.

[0017] In addition, in order to solve the above-mentioned problems, the decryption device of the present invention is a decryption device for a data user in a data management system in which a data owner provides data to a data user via a cloud, and is configured to include a data class transmitting unit, a re-encrypted data receiving unit, and a re-encrypted data decryption unit.

[0018] In such a configuration, the decryption device transmits, via the data class transmission section, a set of data classes of data requested by the data user and an identifier of the data user to the encryption device of the data owner. Then, the decryption device receives, via the re-encrypted data receiving unit, from the cloud re-encryption device, multiple re-encrypted data corresponding to the identifier of the data owner that has been re-encrypted using the aggregate key, which is a public key corresponding to a set of public parameters and data classes, and the re-encryption key for re-encrypting multiple encrypted data from the data owner to the data user. Then, the decryption device decrypts, by the re-encrypted data decryption unit, the re-encrypted data corresponding to the set of data classes among the multiple re-encrypted data using the public parameters, the data user's private key, the data user's identifier, and the aggregate key.

[0019] In this way, the decryption device can obtain and decrypt the data requested by the data user as re-encrypted data that cannot be recognized by the cloud. The decoding device can be operated by a program that causes a computer to function as each of the above-mentioned units. Effect of the Invention

[0020] According to the present invention, when a data owner provides data requested by a data user via the cloud, the requested data can be provided to the data user without being explicitly stated to the cloud. [Brief description of the drawings]

[0021] [Figure 1] 1 is an explanatory diagram for explaining an overview of a key-aggregation type ID-based proxy re-encryption scheme used in the data management system of the present invention. [Diagram 2] 1 is a schematic diagram illustrating a configuration of a data management system according to an embodiment of the present invention. [Diagram 3] FIG. 2 is a block diagram showing a configuration of a key generating device of the data management system. [Figure 4] FIG. 2 is a block diagram showing a configuration of an encryption device of the data management system. [Diagram 5] FIG. 1 is a block diagram showing a configuration of a re-encryption device in a data management system. [Figure 6] FIG. 2 is a block diagram showing the configuration of a decoding device of the data management system. [Figure 7] FIG. 4 is a sequence diagram showing an operation (data storage operation) of the data management system according to the embodiment of the present invention. [Figure 8] FIG. 4 is a sequence diagram showing an operation (data acquisition operation) of the data management system according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [Key-aggregated ID-based proxy re-encryption scheme overview] First, with reference to FIG. 1, an overview of the key-aggregation type ID-based proxy re-encryption scheme used in the data management system 100 (FIG. 2) of the present invention will be described. The key-aggregation ID-based proxy re-encryption method is an encryption method that aggregates keys for re-encrypting multiple pieces of data corresponding to an ID (identifier) ​​and performs encryption while keeping the target ID secret during re-encryption on the cloud CL. As shown in Fig. 1, the key-aggregation ID-based proxy re-encryption scheme is composed of seven algorithms A1 to A7. Here, only the outline of the algorithms will be described, and details will be provided in the description of the configuration of the data management system 100 (Fig. 2).

[0023] Setup algorithm A1 uses a security parameter λ (precisely, 1 λ ) and the maximum number of data classes n, and outputs public parameters params and a master private key msk. The security parameter λ is a numerical value (for example, a key length) indicating a level of security predetermined by the data management system 100. The data class is an identifier (index) for identifying a plurality of data, and its maximum number n indicates the maximum number of data.

[0024] KeyGen (key generation) algorithm A2 inputs public parameters params, a master private key msk, and an identifier id of a user (data owner, service provider [data user]), and generates an individual private key (individual private key) sk for each identifier id. id This is an algorithm that outputs

[0025] The Encrypt algorithm A3 inputs data M, a data owner's identifier id1, and public parameters params, and generates encrypted data C id1 This is an algorithm that outputs Decryption algorithm A4 uses the individual private key sk of a data owner. id1 , public parameters params, encrypted data C id1 This is an algorithm that inputs and outputs the decoded data M.

[0026] The ExReKeyGen (re-encryption key generation) algorithm A5 is a set of data classes S B , public parameters params, and an individual private key sk of a data owner id1 , input the data owner's identifier id1 and a service provider's identifier id2, and generate a re-encryption key rk id1→id2 and the aggregate key K SB This is an algorithm that outputs re-encryption key rk id1→id2 is an encryption key for re-encrypting encrypted data of a certain data owner (identifier id1) for a certain service provider (identifier id2). Aggregation key K SB is a set of data classes S B The key is a collection of all the B ⊆{1,…,n}.

[0027] ReEncrypt algorithm A6 uses the reencryption key rk id1→id2 , encrypted data C id1 , public parameters params, aggregate key K SB , and the encrypted data C id1Enter the data owner identifier id1 corresponding to the re-encrypted data C id2 This is an algorithm that outputs Decrypt R (Re-encryption) Algorithm A7 uses an individual private key sk of a service provider. id2 , public parameters params, re-encrypted data C id2 ′, aggregate key K SB , a set of data classes S B , and an individual private key sk id2 This is an algorithm that inputs the identifier id2 of the service provider corresponding to and outputs the decrypted data M.

[0028] [Data management system configuration] Next, the configuration of the data management system 100 according to the embodiment of the present invention will be described with reference to FIG.

[0029] The data management system 100 is a system in which a data owner DO provides data to a data user (hereinafter, referred to as a service provider SP) via a cloud CL using a key-aggregation type ID-based proxy re-encryption method. The data management system 100 encrypts a plurality of data M held by a data owner DO using a key-aggregation type ID-based proxy re-encryption scheme and provides the encrypted data to a service provider SP. The data management system 100 includes a key generation device 1, an encryption device 2, a storage device 3, a re-encryption device 4, and a decryption device 5. These are connected via a communication line (not shown).

[0030] The key generation device 1 is placed in a key generation center KGC, which is a trusted third party. The key generating device 1 generates an individual secret key (individual secret key) sk for each of the public parameters params, which are public information, the identifier id1 of the data owner DO, and the identifier id2 of the service provider SP. id1 ,sk id2 This generates:

[0031] The encryption device 2 is a device owned by the data owner DO, such as a smartphone or a tablet terminal. The encryption device 2 receives the public parameters params and the individual private key sk id1 Using the data M (M1, ..., M n ) to the encrypted data C id1 (C id1 (1) ,…,C id1 (n) ) is generated. Data M1,…,M n The encrypted data C generated every id1 (1) ,…,C id1 (n) is stored in the storage device 3 of the cloud CL. Furthermore, the encryption device 2 receives an identifier id2 of the service provider SP and a set S of data classes. B By notifying the public parameters params and the individual private key sk id1 Using the re-encryption key rk corresponding to the data class, id1→id2 and the aggregate key K SB It also generates the following: re-encryption key rk id1→id2 and the aggregate key K SB is transmitted to the re-encryption device 4 of the cloud CL.

[0032] The storage device 3 is disposed in the cloud CL and stores a database. The storage device 3 stores encrypted data C encrypted by the data owner DO via the encryption device 2 as a database. id1 (C id1 (1) ,…,C id1 (n) ) is stored in association with the identifier id1 of the data owner DO.

[0033] The re-encryption device 4 is disposed in the cloud CL, and re-encrypts the encrypted data stored in the storage device 3. The re-encryption device 4 receives the re-encryption key rk from the encryption device 2. id1→id2 and the aggregate key KSB Receive and encrypt data C using public parameters params id1 (C id1 (1) ,…,C id1 (n) ) and re-encrypt the entire At this time, the re-encryption device 4 does not know the data class that the service provider SP has requested from the data owner DO. id1 (C id1 (1) ,…,C id1 (n) ) will remain confidential. The re-encryption device 4 encrypts the encrypted data C id1 Re-encrypted data C, which is the entire data re-encrypted id2 ' to the decryption device 5 of the service provider SP.

[0034] The decryption device 5 is a device owned by a data user who uses the data, and in this case, is a device owned by a service provider SP that provides a service according to the data. The decryption device 5 receives the re-encrypted data C from the re-encryption device 4. id2 ' and decrypts it. The decryption device 5 transmits to the encryption device 2 of the data owner DO an identifier id2 of the service provider SP and a set S of data classes. B The data to be acquired is requested by notifying the Then, the decryption device 5 obtains a re-encryption key rk corresponding to the data class. id1→id2 and the aggregate key K SB Re-encrypted data C encrypted with id2 ′ and obtain the public parameters params and the individual private key sk id2 Using this, re-encrypt the data C id2 The re-encrypted data corresponding to the data class of the data set ' is decrypted. The service provider SP uses the decrypted data to provide a service to the data owner DO. Note that the content of the service is not particularly limited and is arbitrary, and is not directly related to the present invention, so further explanation will be omitted.

[0035] In this way, the data management system 100 allows the service provider SP to acquire the data of the data owner DO while keeping the data class secret from the cloud CL. The following describes each device that configures the data management system 100. Note that the storage device 3 is a general device that stores a database, and therefore a description thereof will be omitted.

[0036] [Configuration of the Key Generation Device] First, the configuration of a key generation device 1 according to an embodiment of the present invention will be described with reference to Fig. 3. The key generation device 1 includes a setup unit 10, a public parameter distribution unit 11, an individual private key distribution unit 12, an individual private key generation unit 13, and a key information storage unit 14.

[0037] The setup unit 10 receives a security parameter λ and a maximum number n of data classes, and generates public parameters params and a master private key msk. The setup unit 10 executes a Setup algorithm A1 in FIG.

[0038] Specifically, the setup unit 10 selects a prime number p whose size (bit length) is specified by the security parameter λ, and selects cyclic groups G1 and G2 whose order is the prime number p. Then, the setup unit 10 selects a bilinear map e for the cyclic groups G1 and G2 such that e(G1, G1)→G2. For example, the setup unit 10 selects parameters of an elliptic curve based on general "Weil Pairing" or "Tate Pairing" as the bilinear map e for e(G1, G1)→G2. Here, the bilinear map e is a map having two arguments and is represented by e(·,·). Furthermore, the setup unit 10 selects one generator g (g∈G1) from the cyclic group G1. The setup unit 10 also randomly selects a random number α (α←Z p )do. Then, the setup unit 10 performs the calculation of the following formula (1) for any i ∈ {1, 2, ..., 2n} to obtain {g1, g2, ..., g 2n}.

[0039]

number

[0040] Furthermore, the setup unit 10 selects hash functions H1, . . . , H6 of the following equation (2) from among a plurality of hash functions prepared in advance.

[0041]

number

[0042] H1 is a function that has one argument (H1(·)) and returns a bit string of length λ when given a value that belongs to the cyclic group G2. H2 is a function that has five arguments (H2(·,·,·,·,·)) and returns a value belonging to cyclic group G1 when given a value belonging to cyclic group G1 as the first and second arguments, a value belonging to cyclic group G2 as the third argument, a value belonging to cyclic group G1 as the fourth argument, and the value of a bit string of length λ as the fifth argument. H3 is a function that takes two arguments (H3(·,·)) and returns the value of any integer less than or equal to a prime number p when the first argument is a bit string of length λ and the second argument is a value belonging to the cyclic group G2. H4 is a function that has one argument (H4(·)) and, when given a bit string value of length λ, returns a value that belongs to the cyclic group G1. H5 is a function that has one argument (H5(·)) and returns a value belonging to the cyclic group G1 when given a value belonging to the cyclic group G2. Then, the setup unit 10 generates the public parameters params and the master private key msk shown in the following equation (3).

[0043]

number

[0044] The setup unit 10 stores the generated public parameters params and master private key msk in the key information storage unit 14.

[0045] The public parameter distribution unit 11 distributes public parameters, which are public information of the entire data management system 100 . After generating the public parameters params, the public parameter distribution unit 11 distributes the public parameters params stored in the key information memory unit 14 based on requests from the encryption device 2, the re-encryption device 4, and the decryption device 5 that constitute the data management system 100.

[0046] The individual private key delivery unit 12 delivers individual private keys (individual private keys) to the encryption device 2 and the decryption device 5. The individual private key distribution unit 12 outputs the identifiers id (id1, id2) notified from the encryption device 2 and the decryption device 5, respectively, to the individual private key generation unit 13. Then, the individual private key distribution unit 12 outputs the individual private key sk generated by the individual private key generation unit 13. id (sk id1 ,sk id2 ) is distributed to the encryption device 2 and the decryption device 5, respectively.

[0047] The individual private key generation unit 13 generates an individual private key corresponding to the identifier input from the individual private key distribution unit 12. The individual private key generation unit 13 executes the KeyGen (key generation) algorithm A2 in FIG. Specifically, the individual private key generation unit 13 performs the calculation of the following formula (4) using a hash function H4 and a master private key msk=α, and generates an arbitrary input bit string, an identifier id∈{0,1} * The individual private key sk corresponding to id Generate.

[0048]

number

[0049] The individual private key generation unit 13 generates the individual private key sk id to the individual private key distribution unit 12. The key information storage unit 14 stores the public parameters params and the master private key msk generated by the setup unit 10. The key information storage unit 14 can be configured with a general storage medium such as a semiconductor memory. With the above-described configuration, the key generating device 1 generates the public parameters params and the individual secret key sk used in the data management system 100. id can be generated. This key generating device 1 can be operated by a program that causes a computer (not shown) to function as each of the above-mentioned units.

[0050] [Configuration of the encryption device] Next, the configuration of the encryption device 2 according to the embodiment of the present invention will be described with reference to Fig. 4. The encryption device 2 includes a public parameter acquisition unit 20, an individual private key acquisition unit 21, a data encryption unit 22, an encrypted data transmission unit 23, a data class reception unit 24, a re-encryption key generation unit 25, a re-encryption key transmission unit 26, an encrypted data acquisition unit 27, a data decryption unit 28, and a key information storage unit 29.

[0051] The public parameter acquisition unit 20 acquires public parameters params, which are public information of the entire data management system 100 . The public parameter acquisition unit 20 acquires the public parameters params by requesting public information from the key generation device 1. The public parameter acquisition unit 20 stores the acquired public parameters params in the key information storage unit 29.

[0052] The individual private key acquisition unit 21 acquires, from the key generation device 1, an individual private key that corresponds to the identifier of the data owner DO. The individual private key acquisition unit 21 notifies the key generation device 1 of the identifier id1 (e.g., email address, etc.) of the data owner DO, and receives the individual private key sk corresponding to the identifier id1 from the key generation device 1. id1 Get the. The individual private key acquisition unit 21 acquires the individual private key sk id1 is stored in the key information storage unit 29.

[0053] The data encryption unit 22 encrypts a plurality of pieces of data M associated with a data class using the public parameters params, the private key of the data owner DO, and the identifier of the service provider SP to generate a plurality of pieces of encrypted data. Data M is a set of multiple data M1, ..., M n The data M is a set of data corresponding to a data class i (i=1,...,n), such as a TV program viewing history, a smartphone location information, an online shopping purchase history, a medical visit history, etc. i ∈{0,1} λ It is also assumed that data M is input from the outside, and λ is a security parameter determined in advance in the data management system 100.

[0054] The data encryption unit 22 executes the Encrypt algorithm A3 in FIG. Specifically, the data encryption unit 22 randomly selects a generator R from the cyclic group G2 (R←G2). Then, the data encryption unit 22 encrypts the hash function H3 and the data M i Using the generator R, t is calculated according to the following formula (5).

[0055]

number

[0056] Then, the data encryption unit 22 encrypts the data M i By performing the operation of the following formula (6) on the encrypted data C id1 (i)"xor" indicates exclusive OR (same below).

[0057]

number

[0058] The data encryption unit 22 encrypts n pieces of data M i (i=1,…,n) at the same time, and data M i When (i=1,…,n) is updated, the updated data M i Only the . The data encryption unit 22 encrypts the generated encrypted data C id1 (C id1 (1) ,…,C id1 (n) ) to the encrypted data transmission unit 23.

[0059] The encrypted data transmission unit 23 transmits the encrypted data C encrypted by the data encryption unit 22. id1 This is sent to Cloud CL and stored (uploaded). The encrypted data transmission unit 23 receives the encrypted data C id1 (C id1 (1) ,…,C id1 (n) ) together with the identifier id1 to the cloud CL. In the cloud CL, encrypted data C is associated with the identifier id1. id1 (C id1 (1) ,…,C id1 (n) ) will be stored in the storage device 3.

[0060] The data class receiving unit 24 receives an identifier id2 of the service provider SP and a set S of data classes that identify data requested by the service provider SP. B (S B ⊆{1,…,n}) and Here, the data class receiving unit 24 receives an identifier id2 and a set of data classes S from the decryption device 5 of the service provider SP. B and receive. The data class receiver 24 receives the identifier id2 and the data class set S B and outputs the result to re-encryption key generating unit 25.

[0061] The re-encryption key generation unit 25 generates the public parameters params and the individual private key sk of the data owner DO. id1 A set of data classes S is defined by the identifiers id1 and id2 of the data owner DO and the service provider SP, respectively. B The public key K corresponding to SB and a re-encryption key rk for re-encrypting multiple encrypted data. id1→id2 and generate the following.

[0062] This re-encryption key generation unit 25 executes the ExReKeyGen (re-encryption key generation) algorithm A5 in FIG. Specifically, the re-encryption key generating unit 25 randomly selects a random number s from a set of integers equal to or smaller than a prime number p (s←Z p ). The re-encryption key generation unit 25 then randomly selects a generator R' from the cyclic group G2 (R'←G2). The re-encryption key generation unit 25 also generates a random number σ', which is a bit string of length λ (σ'←{0,1} λ )do. Then, the re-encryption key generating unit 25 uses the hash function H3, the random number σ′, and the generator R′ to calculate r according to the following formula (7).

[0063]

number

[0064] Then, the re-encryption key generating unit 25 performs the calculation of the following equation (8) to obtain the set S of data classes. B Aggregation key K for SB Generate.

[0065]

number

[0066] In addition, the re-encryption key generation unit 25 performs the calculation of the following formula (9) to generate a re-encryption key rk from the data owner DO with the identifier id1 to the service provider SP with the identifier id2. id1→id2 Generate.

[0067]

number

[0068] The re-encryption key generating unit 25 generates the aggregate key K SB and the re-encryption key rk id1→id2 to the re-encryption key transmitting unit 26.

[0069] The re-encryption key transmission unit 26 transmits the aggregate key K generated by the re-encryption key generation unit 25. SB and the re-encryption key rk id1→id2 is transmitted to the re-encryption device 4. The re-encryption key transmission unit 26 transmits an aggregate key K SB and the re-encryption key rk id1→id2 to the re-encryption device 4.

[0070] The encrypted data acquisition unit 27 acquires the encrypted data C id1 It is to obtain (download) the following. The encrypted data acquisition unit 27 receives a data class from an external device and acquires the corresponding encrypted data C id1 (C id1 (1) ,…,C id1 (n) ) is obtained from the storage device 3 of the cloud CL. The encrypted data acquisition unit 27 acquires the encrypted data C id1 (C id1 (1) ,…,C id1(n) ) to the data decoding unit 28.

[0071] The data decryption unit 28 decrypts the encrypted data C acquired by the encrypted data acquisition unit 27. id1 This is to decrypt the The data decryption unit 28 executes the Decrypt (encryption and decryption) algorithm A4 in FIG. Specifically, the data decoding unit 28 performs the following calculation process. First, the data decryption unit 28 decrypts the encrypted data C id1 (i) = (C1, C2, C3, C4, C5, C6, C7) (i = 1, ..., n), it is verified whether the data has been correctly encrypted by checking whether the following equations (10) to (12) are true, and if they are not true, the processing is terminated.

[0072]

number

number

number

[0073] Equation (10), as shown in the following equation (13), verifies whether the left and right sides of equation (10) match based on equation (6) and the properties of the bilinear mapping e.

[0074]

number

[0075] Equation (11), as shown in the following equation (14), verifies whether the left and right sides of equation (11) match based on equation (6) and the properties of the bilinear mapping e.

[0076]

number

[0077] Equation (12), as shown in the following equation (15), verifies whether the left and right sides of equation (12) match based on equation (6) and the properties of the bilinear mapping e.

[0078]

number

[0079] When the above-mentioned formulas (10) to (12) are satisfied, the data decryption unit 28 calculates R according to the following formula (16). This R is the generator R used in the data encryption unit 22 (see the above-mentioned formula (5)).

[0080]

number

[0081] Then, the data decoding unit 28 derives the original data M from R calculated by the above formula (16) by the following formula (17): i Calculate.

[0082]

number

[0083] R can be calculated by formula (16) as shown in the following transformation of formula (18). C1, C2, and C3 are shown in formula (6) above, and sk id1 =H4(id1) α It is.

[0084]

number

[0085] The key information storage unit 29 stores the public parameters params and the individual private key sk generated by the key generation device 1. id1 The above information is stored in the memory. The key information storage unit 29 can be configured with a general storage medium such as a semiconductor memory.

[0086] With the above-described configuration, the encryption device 2 can encrypt the data of the data owner DO for each data class. Also, the encryption device 2 can generate keys (re-encryption key and aggregate key) for re-encrypting the encrypted data in the re-encryption device 4 of the cloud CL, corresponding to a set of data classes indicating data requested by the service provider SP (decryption device 5). This encryption device 2 can be operated by a program that causes a computer (not shown) to function as each of the above-mentioned units.

[0087] The encrypted data acquisition unit 27 is intended to acquire data that is not stored by the data owner DO and exists only in the cloud CL, and is not directly related to the service provider SP. Therefore, the encrypted data acquisition unit 27 and the data decryption unit 28 may be omitted from the configuration of the encryption device 2.

[0088] [Configuration of the re-encryption device] Next, the configuration of the re-encryption device 4 according to the embodiment of the present invention will be described with reference to Fig. 5. The re-encryption device 4 includes a public parameter acquisition unit 40, a re-encryption key reception unit 41, an encrypted data acquisition unit 42, a data re-encryption unit 43, a re-encrypted data transmission unit 44, and a key information storage unit 45.

[0089] The public parameter acquisition unit 40 acquires public parameters params, which are public information of the entire data management system 100 . The public parameter acquisition unit 40 acquires the public parameters params by requesting public information from the key generation device 1. The public parameter acquisition unit 40 stores the acquired public parameters params in the key information storage unit 45.

[0090] The re-encryption key receiving unit 41 receives an aggregate key K, which is a public key corresponding to a set of data classes. SBand a re-encryption key rk for re-encrypting a plurality of encrypted data from the data owner DO to the service provider SP. id1→id2 The data owner DO identifier id1 and the service provider SP identifier id2 are associated with each other and received from the encryption device 2. In addition, the aggregate key K SB This information is not decipherable by the re-encryption device 4 and indicates which data class the keys correspond to. The re-encryption key receiving unit 41 receives the aggregate key K SB and the re-encryption key rk id1→id2 together with the identifiers id1 and id2 to the data re-encryption unit 43, and notifies the encrypted data acquisition unit 42 that it has received the re-encryption key from the data owner DO (encryption device 2) with the identifier id1.

[0091] The encrypted data acquisition unit 42 is notified by the re-encryption key receiving unit 41 that it has received a re-encryption key from the data owner DO (encryption device 2) with the identifier id1, and then acquires the encrypted data C corresponding to the identifier id1. id1 (C id1 (1) ,…,C id1 (n) ) is obtained from the storage device 3. The encrypted data acquisition unit 42 acquires the encrypted data C id1 (C id1 (1) ,…,C id1 (n) ) to the data re-encryption unit 43.

[0092] The data re-encryption unit 43 encrypts the public parameters params and the aggregate key K SB and the re-encryption key rk id1→id2 By this, the encrypted data C of the data owner DO corresponding to the identifier id1 is id1 (C id1 (1) ,…,C id1 (n) ) into the re-encrypted data C id2 ′(C id2 ' (1),…,C id2 ' (n) ) and then re-encrypting it. This data re-encryption unit 43 executes the ReEncrypt algorithm A6 in FIG. Specifically, the data re-encryption unit 43 performs the calculation of the following equation (19) to obtain the encrypted data C id1 (i) , (i=1,…,n) are re-encrypted and the re-encrypted data C id2 ' (i) Generate.

[0093]

number

[0094] In addition, K SB is the aggregate key, C1,…,C4,C6 are the encrypted data C id1 (i) (see formula (6) above), rk0, ..., rk6 are the re-encryption keys rk id1→id2 (see formula (9) above). The rest are public parameters params stored in the key information storage unit 45. The data re-encryption unit 43 generates re-encrypted data C from the generated identifier id1 to the identifier id2. id2 ′(C id2 ' (1) ,…,C id2 ' (n) ) to the re-encrypted data transmission unit 44.

[0095] The re-encrypted data transmission unit 44 transmits the re-encrypted data C generated by the data re-encryption unit 43. id2 ′(C id2 ' (1) ,…,C id2 ' (n) ) and the aggregate key K SB and is transmitted to the service provider SP (decryption device 5) with identifier id2.

[0096] The key information storage unit 45 stores the public parameters params generated by the key generation device 1. The key information storage unit 45 can be configured with a general storage medium such as a semiconductor memory.

[0097] With the above-described configuration, the re-encryption device 4 can re-encrypt the encrypted data of the data owner DO without recognizing the data class. This re-encryption device 4 can be operated by a program that causes a computer (not shown) to function as each of the above-mentioned units.

[0098] [Configuration of the Decoding Device] Next, the configuration of the decryption device 5 according to the embodiment of the present invention will be described with reference to Fig. 6. The decryption device 5 includes a public parameter acquisition unit 50, an individual private key acquisition unit 51, a data class transmission unit 52, a re-encrypted data reception unit 53, a re-encrypted data decryption unit 54, and a key information storage unit 55.

[0099] The public parameter acquisition unit 50 acquires public parameters params, which are public information of the entire data management system 100 . The public parameter acquisition unit 50 acquires the public parameters params by making a request to the key generation device 1. The public parameter acquisition unit 50 stores the acquired public parameters params in the key information storage unit 55.

[0100] The individual private key acquisition unit 51 acquires an individual private key sk corresponding to the identifier of the service provider SP. id2 is obtained from the key generating device 1. The individual private key acquisition unit 51 notifies the key generation device 1 of the identifier id2 (e.g., an email address, etc.) of the service provider SP, and acquires the individual private key sk corresponding to the identifier id2 from the key generation device 1. id2 Get the. The individual private key acquisition unit 51 acquires the individual private key sk id2 is stored in the key information storage unit 55.

[0101] The data class sending unit 52 receives an identifier id2 of the service provider SP and a set S of data classes that identify the data that the service provider SP wants to acquire. B (S B ⊆{1, ..., n}) to the encryption device 2 of the data owner DO. A set of data classes S B is set by the service provider SP. A set of data classes S B is sent to the encryption device 2, and the encryption device 2 is B The re-encryption device 4 generates a re-encryption key and an aggregate key corresponding to the data owner DO, and the re-encryption device 4 re-encrypts the encrypted data of the data owner DO using the re-encryption key and the aggregate key. After that, the re-encrypted data C id2 ' is transmitted from the re-encryption device 4 to the decryption device 5.

[0102] The re-encrypted data receiving unit 53 receives the set S of data classes requested by the data class transmitting unit 52. B Re-encrypted data C corresponding to id2 ′(C id2 ' (1) ,…,C id2 ' (n) ) and the aggregate key K SB The re-encryption device 4 receives the above. The re-encrypted data receiving unit 53 receives the re-encrypted data C id2 ′(C id2 ' (1) ,…,C id2 ' (n) ) and the aggregate key K SB and output it to the re-encrypted data decryption unit 54.

[0103] The re-encrypted data decryption unit 54 receives the public parameters params and the individual private key sk of the service provider SP. id2 and the service provider SP's identifier id2 and aggregation key K SB By this, multiple re-encrypted data C id2 ' (1) ,…,C id2 ' (n) Among them, the set of data classes SB The re-encrypted data corresponding to the above is decrypted.

[0104] This re-encrypted data decryption unit 54 is the Decrypt R (Re-encryption / decryption) Algorithm A7 is executed. Specifically, the re-encrypted data decryption unit 54 performs the following calculation process. First, the re-encrypted data decryption unit 54 decrypts the re-encrypted data C id2 ' (i) For i=1,...,n, it is verified whether the data has been correctly re-encrypted by checking whether the following equations (20) and (21) hold. If they do not hold, the process is terminated.

[0105]

number

number

[0106] Equation (20), as shown in the following equation (22), verifies whether the left and right sides of equation (20) are consistent based on equations (8), (9), and (19) and the properties of the bilinear mapping e.

[0107]

number

[0108] Equation (21), as shown in the following equation (23), is used to verify whether the left and right sides of equation (21) match based on equations (9), (19), and the properties of the bilinear mapping e.

number

[0109] When the above-mentioned formulas (20) and (21) are satisfied, the re-encrypted data decryption unit 54 BIn this case, R' is calculated by the following formula (24). This R' is the generator R' used in the re-encryption key generating unit 25 of the encryption device 2 (see formula (7) above).

[0110]

number

[0111] R' can be calculated by formula (24) as shown in the following transformations of formulas (25) to (27). C1', C2', and C3' are shown in formulas (8), (9), and (19), respectively, and sk id2 =H4(id2) α It is.

[0112]

number

[0113] Here, from the above formula (1) and the properties of the bilinear mapping e, the following formula (26) holds.

[0114]

number

[0115] Therefore, equation (25) calculates R' as shown in the following equation (27).

[0116]

number

[0117] Then, the re-encrypted data decryption unit 54 uses the calculated R' to calculate σ' according to the following equation (28). This σ' is the random number σ' used by the re-encryption key generation unit 25 of the encryption device 2 (see equation (7) above).

[0118]

number

[0119] Since C5' is calculated by C5'=σ' xor H1(R') as shown in equations (9) and (19), σ' can be calculated by equation (28). Furthermore, the re-encrypted data decryption unit 54 uses the calculated σ′ to obtain g s Calculate.

[0120]

number

[0121] This g s is the value used to generate C6′ (C6′=g s H4(σ′)), so by equation (29), g s can be calculated. Then, the re-encrypted data decryption unit 54 calculates r from the calculated R' and σ' using the above formula (7) (r = H3 (σ', R')), and s Using this, R is calculated using the following equation (30).

[0122]

number

[0123] Note that R can be calculated from equation (30), as shown in the modification of equation (31) below (see equations (6), (8), (9), and (19) for the modification).

[0124]

number

[0125] Then, the re-encrypted data decryption unit 54 uses the calculated R to obtain the data M i Decrypt the

[0126]

number

[0127] As shown in formulas (6) and (19), C7′=M i xor H1(R), so according to equation (32), M i can be calculated. In this way, the re-encrypted data decryption unit 54 decrypts the re-encrypted data C id2 ' (i) (C id2 ' (1) ,…,C id2 ' (n) ) in the set S B A data class i ∈ S belongs to B Re-encrypted data C id2 ' (i) Limited to Data M i can be decoded into

[0128] The key information storage unit 55 stores the public parameters params and the individual private key sk generated by the key generation device 1. id2 The above information is stored in the memory. The key information storage unit 55 can be configured with a general storage medium such as a semiconductor memory.

[0129] With the above-described configuration, the decryption device 5 can obtain the data re-encrypted by the re-encryption device 4 in the cloud CL and decrypt the data of a desired data class. This decoding device 5 can be operated by a program that causes a computer (not shown) to function as each of the above-mentioned units.

[0130] In this way, the data management system 100 (FIG. 2) can delegate the access right to the data on the cloud CL to the service provider SP by using the key aggregation function. In this case, the data management system 100 does not need to manage public keys in an ID-based manner, and therefore key management becomes easier. Furthermore, when re-encrypting encrypted data on the cloud CL, the data management system 100 does not need to inform the cloud CL of which data the service provider SP is requesting. This allows the data management system 100 to guarantee high security.

[0131] [Data Management System Operation] Next, the operation of the data management system 100 according to the embodiment of the present invention will be described with reference to FIGS. Here, the operation will be explained separately: the operation up to when the data owner DO stores the data in the cloud CL as encrypted data (data storage operation), and the operation up to when the service provider SP obtains the data (re-encrypted data) stored by the data owner DO from the cloud CL and decrypts it (data acquisition operation).

[0132] [Data Storage Operation] First, with reference to FIG. 7 (for the configuration, see FIGS. 2 to 6), an operation in which the data owner DO stores data in the cloud CL as encrypted data will be described. In step S10, the setup unit 10 of the key generation device 1 inputs the security parameter λ and the maximum number n of data classes, and executes the Setup algorithm A1 to generate public parameters params and a master private key msk, and stores them in the key information storage unit 14. In step S11, in response to a request from the public parameter acquisition unit 20 of the encryption device 2, the public parameter distribution unit 11 of the key generation device 1 transmits the public parameters params to the encryption device 2. The public parameter acquisition unit 20 of the encryption device 2 receives the public parameters params and stores them in the key information storage unit 29.

[0133] In step S12, in response to a request from the public parameter acquisition unit 40 of the re-encryption device 4, the public parameter distribution unit 11 of the key generation device 1 transmits the public parameters params to the re-encryption device 4. The public parameter acquisition unit 40 of the re-encryption device 4 receives the public parameters params and stores them in the key information storage unit 45.

[0134] In step S13, in response to a request from the public parameter acquisition unit 50 of the decryption device 5, the public parameter distribution unit 11 of the key generation device 1 transmits the public parameters params to the decryption device 5. The public parameter acquisition unit 50 of the decryption device 5 receives the public parameters params and stores them in the key information storage unit 55.

[0135] In step S14, the individual private key acquisition unit 21 of the encryption device 2 transmits to the key generation device 1 the identifier (ID) id1 of the data owner DO. In step S15, the individual private key distribution unit 12 of the key generation device 1 receives the identifier (ID) id1, and the individual private key generation unit 13 executes the KeyGen algorithm A2 to generate the individual private key sk of the data owner DO. id1 Generate. In step S16, the individual private key distribution unit 12 of the key generation device 1 distributes the individual private key sk id1 The individual private key acquisition unit 21 of the encryption device 2 transmits the individual private key sk id1 and stores it in the key information storage unit 29.

[0136] In step S17, the individual private key acquisition unit 51 of the decryption device 5 transmits to the key generation device 1 the identifier (ID) id2 of the service provider SP. In step S18, the individual private key distribution unit 12 of the key generation device 1 receives the identifier (ID) id2, and the individual private key generation unit 13 executes the KeyGen algorithm A2 to generate the individual private key sk of the service provider SP. id2 Generate. In step S19, the individual private key distribution unit 12 of the key generation device 1 distributes the individual private key sk id2 The individual private key acquisition unit 51 of the decryption device 5 transmits the individual private key sk id2 and stores it in the key information storage unit 55.

[0137] In step S20, the data encryption unit 22 of the encryption device 2 encrypts the data M (M1, . . . , M n), and the public parameters params and the individual private key sk stored in the key information storage unit 29 are input. id1 By executing the Encrypt algorithm A3 using id1 (C id1 (1) ,…,C id1 (n) )

[0138] In step S21, the encrypted data transmission unit 23 of the encryption device 2 transmits the encrypted data C id1 (C id1 (1) ,…,C id1 (n) ) is sent to the storage device 3 of the cloud CL and stored (uploaded). Through the above operations, encrypted data corresponding to a plurality of data classes (indexes) is stored for each data owner DO in the storage device 3 of the cloud CL.

[0139] [Data acquisition operation] Next, with reference to FIG. 8 (for the configuration, see FIGS. 2 to 6), an operation in which the service provider SP obtains the data (re-encrypted data) stored by the data owner DO from the cloud CL and decrypts it will be described.

[0140] In step S30, the data class transmission unit 52 of the decryption device 5 receives an identifier id2 of the service provider SP and a set S of data classes that identify the data that the service provider SP wants to acquire. B (S B ⊆{1, ..., n}) to the encryption device 2 of the data owner DO of the identifier id1 that owns the data. Then, the data class receiving unit 24 of the encryption device 2 receives the identifier id2 and the set S of data classes. B and receive.

[0141] In step S31, the re-encryption key generating unit 25 of the encryption device 2 receives the identifier id2 and the set S of data classes. BBy executing the ExReKeyGen algorithm A5 using B Aggregation key K for SB and a re-encryption key rk from a data owner DO with identifier id1 to a service provider SP with identifier id2. id1→id2 and generate. In step S32, the re-encryption key transmission unit 26 of the encryption device 2 transmits the aggregate key K SB and the re-encryption key rk id1→id2 to the re-encryption device 4.

[0142] In step S33, the encrypted data acquisition unit 42 of the re-encryption device 4 receives the aggregate key K SB and the re-encryption key rk id1→id2 The encrypted data C corresponding to the identifier id1 of the data owner DO that sent id1 (C id1 (1) ,…,C id1 (n) ) is obtained from storage device 3. In step S34, the data re-encryption unit 43 of the re-encryption device 4 generates a re-encryption key rk id1→id2 and the aggregate key K SB By executing the ReEncrypt algorithm A6 using id1 (C id1 (1) ,…,C id1 (n) ) into the re-encrypted data C corresponding to the identifier id2 id2 ′(C id2 ' (1) ,…,C id2 ' (n) ) and re-encrypt it.

[0143] In step S35, the re-encrypted data transmission unit 44 of the re-encryption device 4 transmits the re-encrypted data C id2 ′(C id2 ' (1) ,…,C id2 ' (n) ) to the decryption device 5 of the service provider SP with the identifier id2. Then, the re-encrypted data receiving unit 53 of the decryption device 5 transmits the re-encrypted data Cid2 ' is received. In step S36, the re-encrypted data decryption unit 54 of the decryption device 5 R By executing algorithm A7, the re-encrypted data C id2 ′(C id2 ' (1) ,…,C id2 ' (n) ) to the set of data classes S B A data class i ∈ S belongs to B Re-encrypted data C id2 ' (i) Data M i Decrypt it to:

[0144] Through the above operations, the decryption device 5 can obtain the encrypted data of the data class of the data owner DO that is stored on the cloud CL and that is desired by the service provider SP, while keeping it secret in the cloud CL.

[0145] Although not a required function for the data management system 100, the following operations may be performed. That is, in step S40, the encrypted data acquisition unit 27 of the encryption device 2 acquires from the storage device 3 the encrypted data C id1 Obtain (download). In step S41, the data decryption unit 28 of the encryption device 2 executes the Decrypt algorithm A4 to obtain the encrypted data C id1 Decode to the original data M. This allows the data owner DO to store data on the cloud and have it backed up as needed.

[0146] Although an embodiment of the present invention has been described above, the present invention is not limited to this embodiment, and includes design modifications and the like that do not depart from the gist of the present invention. For example, although the encryption device 2 and the decryption device 5 are configured as one each here, a configuration including a plurality of each may be used. Furthermore, the data owners DO and the encryption devices 2 do not need to correspond one-to-one, and the same encryption device 2 may be shared by a plurality of data owners DO having different identifiers ID. Similarly, the service provider SP and the decryption device 5 do not need to correspond one-to-one, and the same decryption device 5 may be shared by a plurality of service providers SP having different identifiers ID. [Explanation of symbols]

[0147] 100 Data Management System 1 Key generation device 10 Setup section 11 Public Parameter Distribution Section 12 Individual private key distribution unit 13 Individual private key generation unit 14 Key information storage unit 2 Encryption device 20 Public Parameter Acquisition Section 21 Individual private key acquisition unit 22 Data Encryption Section 23 Encrypted data transmission unit 24 Data Class Receiver 25 Re-encryption key generation section 26 Re-encryption key transmission part 27 Encrypted Data Acquisition Section 28 Data Decoding Section 29 Key information storage unit 3 Storage device 4 Re-encryption device 40 Public Parameter Acquisition Section 41 Re-encryption key receiving section 42 Encrypted data acquisition unit 43 Data re-encryption unit 44 Re-encrypted data transmission section 45 Key information storage unit 5 Decryption device 50 Public Parameter Acquisition Section 51 Individual private key acquisition unit 52 Data Class Transmitter 53 Re-encrypted data receiving unit 54 Re-encrypted data decryption section 55 Key information storage unit KGC Key Generation Center DO Data Owner SP Service provider (data user) CL Cloud

Claims

1. 1. An encryption device of a data owner in a data management system in which a data owner provides data to a data user via a cloud using a key-aggregation type ID-based proxy re-encryption method, comprising: a data encryption unit that encrypts each of a plurality of pieces of data associated with a data class using public parameters, a private key of the data owner, and an identifier of the data owner to generate a plurality of pieces of encrypted data; an encrypted data transmission unit that transmits the plurality of encrypted data to a storage device of the cloud; a data class receiving unit that receives a set of data classes of data requested by the data user and an identifier of the data user from the decryption device of the data user; a re-encryption key generation unit that generates an aggregate key, which is a public key corresponding to the set of data classes, and a re-encryption key for re-encrypting the plurality of encrypted data items, using the public parameters, the private key of the data owner, and respective identifiers of the data owner and the data user; a re-encryption key transmission unit that transmits the aggregate key and the re-encryption key to a re-encryption device of the cloud in association with an identifier of the data owner and an identifier of the data user; An encryption device comprising:

2. an encrypted data acquisition unit that acquires the encrypted data from a storage device of the cloud; a data decryption unit that decrypts the obtained encrypted data using the public parameters and the private key and identifier of the data owner; The encryption device of claim 1 further comprising:

3. A program for causing a computer to function as the encryption device according to claim 1 or 2.

4. A re-encryption device of a cloud in a data management system in which a data owner provides data to a data user via the cloud by using a key-aggregation type ID-based proxy re-encryption method, comprising: a re-encryption key receiving unit that receives, from the encryption device of the data owner, an aggregate key which is a public key corresponding to a set of data classes and a re-encryption key for re-encrypting a plurality of encrypted data from the data owner to the data user, in association with an identifier of the data owner and an identifier of the data user; an encrypted data acquisition unit that acquires the plurality of encrypted data corresponding to the identifier of the data owner from a storage device of the cloud; a data re-encryption unit that re-encrypts each of the plurality of encrypted data corresponding to the identifier of the data owner using public parameters, the aggregate key, and the re-encryption key to generate a plurality of re-encrypted data corresponding to the identifier of the data user; a re-encrypted data transmission unit that transmits the plurality of re-encrypted data to a decryption device of the data user; A re-encryption device comprising:

5. A program for causing a computer to function as the re-encryption device according to claim 4.

6. 1. A decryption device of a data user in a data management system in which a data owner provides data to a data user via a cloud using a key-aggregation type ID-based proxy re-encryption method, comprising: a data class sending unit that sends a set of data classes of data requested by the data user and an identifier of the data user to the encryption device of the data owner; a re-encrypted data receiving unit that receives, from the re-encryption device of the cloud, a public parameter, an aggregate key that is a public key corresponding to the set of data classes, and a plurality of re-encrypted data corresponding to an identifier of the data owner that has been re-encrypted using the re-encryption key for re-encrypting a plurality of encrypted data from the data owner to the data user, and the aggregate key; a re-encrypted data decryption unit that decrypts the re-encrypted data corresponding to the set of data classes among the plurality of re-encrypted data using the public parameters, the private key of the data user, the identifier of the data user, and the aggregate key; A decoding device comprising:

7. A program for causing a computer to function as the decoding device according to claim 6.

Images