Cryptographic system, encryption method, and program recording medium

Abstract

To allow an outsourcer not to need to manage a private key in proxy re-encryption, etc.SOLUTION: A cryptographic system includes a delegation source device that acquires first biometric information and generates a first biometric-based shared key, a delegation source destination device that receives the first biometric-based shared key from the delegation source device and stores it in a memory unit, and a key distribution generation device that acquires second biometric information, generates a second biometric-based shared key, and transmits it to the delegation source destination device, and the delegation source destination device generates a key-based shared key from the difference between the first biometric-based shared key and the second biometric-based shared key using the delegation source's public key and transmits it to the key distribution generation device, and the key distribution generation device generates a re-encryption key from the key-based shared key.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present disclosure relates to a cryptographic system, an encryption method, and a program recording medium. [Background technology]

[0002] Proxy re-encryption is known as a technology that can change who can decrypt encrypted data without decrypting the encrypted data. In proxy re-encryption (PRE), as shown in Fig. 1, for example, a third party P called a proxy (agent) uses a re-encryption key to transform a ciphertext (a ciphertext that can only be decrypted by A) encrypted with the private key of A (the trustor) into a form that can be decrypted with only the private key of B (the trustee), without knowing A's private key or plaintext information. An example of a general procedure for proxy re-encryption will be described below.

[0003] In a setup process (setup) not shown, public parameters pp are generated based on the security parameter λ. The public parameters pp can be referenced by each of processes 10 to 50 connected to the node that executes the setup algorithm. Each of processes 10 to 50 may be implemented in a communication node. pp←Setup(1 λ ) …(1)

[0004] In the key generation process (10) (KeyGen), a key pair of a public key pk and a private key sk is output based on the public parameters pp. (sk, pk)←KeyGen(pp) …(2) The trustor generates a key pair of public key pkA and private key skA. The trustee generates a key pair of public key pkB and private key skB. The public keys pkA and pkB may be stored in a key server (public key database) or the like.

[0005] In the re-encryption key generation process (20) (ReKeyGen), the private key skA of A (the trustor) and the public key pkB (A≠B) of B (the trustee) are input, and the re-encryption key rk_AtoB from A to B is output. rk_AtoB←ReKeyGen(skA, pkB) …(3)

[0006] In the encryption process (30) (Encryption), a public key pkA and a message m are input and a ciphertext ctA is output. ctA←Encrypt(pkA, m) …(4)

[0007] In the re-encryption process (40) (ReEncryption) by P (proxy), a re-encryption key rk_AtoB from A to B and ciphertext ctA are input, and ciphertext ctB is output. ctB←ReEncrypt(rk_AtoB, ctA) …(5)

[0008] In the decryption process (50), a message m is output from B (the trustee)'s private key skB and the ciphertext CtB. m←Decrypt(skB, ctB) …(6) [Prior art documents] [Non-patent literature]

[0009] [Non-Patent Document 1] Giuseppe Ateniese, Kevin Fu, Matthew Green, and Susan Hohenberger. 2006, "Improved proxy re-encryption schemes with applications to secure distributed storage", ACM Transaction on Information and System Security, 9, 1 (February 2006), 1-30. Summary of the Invention [Problem to be solved by the invention]

[0010] To generate the re-encryption key rk_AtoB, A (the trustor)'s private key skA is required. If this private key falls into the hands of a third party, the encrypted data may be decrypted without A's (the trustor's) permission, or may be transformed into a form that can be decrypted with another key. Furthermore, if A (the trustor) loses its own private key, even A, the trustor, will no longer be able to decrypt or transform the encrypted data.

[0011] The present disclosure has been devised in view of the above-mentioned problems, and aims to provide an encryption system, an encryption method, and a program that eliminate the need for the entrusting party to manage private keys in proxy re-encryption and the like. [Means for solving the problem]

[0012] According to one aspect of the present disclosure, a cryptographic system includes a delegator device that acquires first biometric information and generates a first biometric shared key; a delegator destination device that receives the first biometric shared key from the delegator device and stores it in a memory unit; and a key distribution generation device that acquires second biometric information, generates a second biometric shared key, and transmits it to the delegator destination device, wherein the delegator destination device generates a key-based shared key using the first biometric shared key, the second biometric shared key, and the delegator's public key and transmits it to the key distribution generation device, and the key distribution generation device generates a re-encryption key from the delegator to the delegator using the key-based shared key.

[0013] According to an encryption method of one aspect of the present disclosure, a trustor acquires first biometric information and generates a first biometric shared key, a trustor distributed node receives the first biometric shared key from the trustor's processing and stores it in a memory unit, a key distribution generation node acquires second biometric information and generates a second biometric shared key and sends it to the trustor distributed node, the trustor distributed node generates a key-based shared key using the first biometric shared key, the second biometric shared key, and the trustee's public key and sends it to the key distribution generation node, and the key distribution generation node generates a re-encryption key from the trustor to the trustee using the key-based shared key.

[0014] According to one aspect of the present disclosure, a recording medium includes a process in which a trust source device acquires first biometric information and generates a first biometric-utilizable shared key; a process in which the entrust-source distribution destination device receives the first biometric shared key from the entrust-source device and stores it in a storage unit; a process in which a key sharing generation device acquires second biometric information, generates a second biometric-based shared key, and transmits the second biometric-based shared key to the entrust-source sharing destination device; a process in which the delegation source distribution destination device generates a key-use shared key using the first biometric shared key, the second biometric shared key, and a public key of the delegation destination, and transmits the key-use shared key to the key distribution generation device; The key sharing generation device generates a re-encryption key from the trustor to the trustee using the key-use shared key. [Effects of the Invention]

[0015] According to the present disclosure, it is possible to realize proxy re-encryption that does not require the outsourcing party to manage measures against loss of the private key. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 illustrates an example of a typical proxy re-encryption process. [Figure 2] FIG. 1 is a diagram illustrating an example of a system configuration according to the present disclosure. [Figure 3] FIG. 1 is a diagram illustrating an example (embodiment) of a system configuration of the present disclosure. [Figure 4] FIG. 10 is a diagram illustrating a comparative example. [Figure 5] FIG. 10 is a diagram illustrating an example of processing of the system of the present disclosure. [Figure 6] FIG. 10 is a diagram illustrating an example of processing of the system of the present disclosure. [Figure 7] 1A and 1B are diagrams illustrating an implementation example of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0017] An embodiment of the present disclosure will be described. As described above, if a person has the private key of the trustor A, even if he or she is not A, there is a possibility that encrypted data can be decrypted without A's permission or transformed into a form that can be decrypted with another key. Furthermore, if the trustor A loses his or her key, even A himself or herself will be unable to decrypt or transform the encrypted data. Furthermore, in order to prevent collusion between the proxy and the trustee, the trustor secretly distributes a re-encryption key and distributes the distributed re-encryption key to multiple proxies, each of which generates a distributed ciphertext through a re-encryption process, and the trustee restores the converted ciphertext from the distributed ciphertext equal to or greater than a threshold (see, for example, Reference 1, etc.), the trustor must manage the private key.

[0018] While the above problem is merely an example, this disclosure proposes a completely new proxy re-encryption method that eliminates the need to manage private keys by combining proxy re-encryption using a shared private key with biometric sharing technology.

[0019] According to the cryptographic system of the present disclosure, the entruster device (110) acquires first biometric information (w) and generates a first biometric-based shared key (s). The entruster distribution destination device (130) receives the first biometric-based shared key (s) from the entruster device (110) and stores it in a memory unit. The key sharing generation device (120) acquires second biometric information (w') and generates a second biometric-based shared key (s') and transmits it to the entruster distribution destination device (130). The entruster distribution destination device (130) generates a key-based shared key (rk2) using the first biometric-based shared key (s), the second biometric-based shared key (s'), and the public key of the entrustee and transmits it to the key sharing generation device (120). The key sharing generation device (120) uses the key-based shared key (rk2) to generate a re-encryption key (rk_AtoB) from the entruster (A) to the entrustee (B). The proxy (P) encrypts plaintext (message, data) using the public key of the client (A) and converts it into ciphertext (i.e., without decrypting it) using a re-encryption key (rk_AtoB) into ciphertext that can only be decrypted with the private key of the client (B).

[0020] The entrustment source device (110) may use, as the first biometric shared key (s), a sketch generated by combining the first biometric information (w) and an encoding key (ENC(x)) obtained by encoding the private key (x) generated by the entrustment source device (110).

[0021] The key sharing generation device (120) may use, as the second biometric shared key (s'), a sketch generated by combining the second biometric information (w') and an encoding key (ENC(Δ)) obtained by encoding the temporary private key (Δ) generated by the key sharing generation device (120).

[0022] According to the present disclosure, it is suitable for a pairing-based proxy re-encryption scheme.

[0023] Fig. 2 is a diagram illustrating an example (one embodiment) of the proxy re-encryption system 100. Referring to Fig. 2, the entrustment source device 110 acquires first biometric information w and generates a first biometric-utilizing shared key s. Furthermore, the entrustment source device 110 may use the first biometric information w to generate a decryption key s2 (also referred to as a "first biometric-utilizing shared decryption key") for decrypting the ciphertext encrypted by the encryption device 140 on the entrustment source side.

[0024] The entrustment source distribution destination apparatus 130 receives the first biometric shared key s from the entrustment source apparatus 110 and stores it in a storage unit (not shown).

[0025] The key sharing generation device 120 acquires the second biometric information w' and generates a second biometric shared key s'. The key sharing generation device 120 communicates (interacts) with the entrustment-source distribution destination device 130 to generate a re-encrypted key rk_AtoB. For example, the key sharing generation device 120 transmits the second biometric shared key s' to the entrustment-source distribution destination device 130.

[0026] The entrusted distribution destination device 130 generates a key-utilizing distributed key (rk2) by calculating (for example, the difference) between the first biometric distributed key s stored in a memory unit not shown and the second biometric distributed key s' sent from the key distribution generation device 120, and sends the key-utilizing distributed key (rk2) to the key distribution generation device 120.

[0027] The key-based shared key (rk2) may be, for example, a value (g^(x'b2)) obtained by calculating the decryption result (x') of the calculation (difference) of the first biometric shared key s and the second biometric shared key s' using the trustee's public key (pkB=(Z^b1, g^b2)) (^ is the exponentiation operator). Note that Z=e(g, g) is a two-input, one-output function (pairing) (e: G1 × G1 → G2) described later.

[0028] The key share generation device 120 generates a re-encryption key (rk_AtoB) from the trustee's public key (pkB=(Z^b1, g^b2)) and the key use share (g^(x'b2)).

[0029] The encryption device 140 encrypts the message m using the trustor's public key pkA and outputs the ciphertext ctA.

[0030] The proxy device 150 converts (re-encrypts) the ciphertext ctA into ciphertext ctB that can be decrypted with the trustee's private key skB using the re-encryption key rk_AtoB generated by the key distribution generation device 120, and sends it to the trustee device 160.

[0031] The entrustment destination device 160 decrypts the ciphertext ctB using the entrustment destination's private key skB.

[0032] The key distribution generation device 120 and the delegation source distribution destination device 130 may interactively generate and distribute keys using, for example, a sketch (secure sketch).

[0033] The encryption algorithm used in the encryption device 140 corresponds to a proxy re-encryption method that can generate a re-encrypted key while keeping the private key distributed, and for example, a pairing-based proxy re-encryption method is used.

[0034] A secure sketch is a sketch based on code-offset construction (see, for example, Reference 2). Data x is encoded (c = ENC(x)) using an encoding function ENC, and a sketch is generated by adding, for example, a code word c and biometric information w. s = ENC(x) + w …(7)

[0035] In addition, in equation (7), the operation between w and ENC(x) may be subtraction. For example, if the sketch s is in a metric space (a space where distance is defined), M=F n (When F is in the field of F=Z / 2Z={0,1}), addition and subtraction are equivalent. Alternatively, the operation between w and ENC(x) may be a logical operation such as bitwise exclusive or (xor). Note that in the secure sketch of Reference 2, the encoding function ENC is an error-correcting code (not necessarily linear) with a code bit length of n, a number of information bits of k, and capable of correcting at least t errors. However, in this disclosure, the encoding function ENC and the decoding function DEC are assumed to be linear. In this case, the secure sketch using a linear code is also referred to as a linear sketch.

[0036] Linearity: ENC(m1) + ENC(m2) …(8) is the codeword ENC(m1+m2) of m1+m2, m1 + m2 = DEC(ENC(m1) + ENC(m2)) …(9) In equation (9), the "+" on the left and right sides do not have to be the same operation.

[0037] For encoding, for example, an error-correcting code (Hamming code, Bose-Chaudhuri-Hocquenghem (BCH) code, Reed-Solomon (RS) code, low-density parity-check (LDPC) code, etc.) may be used. Alternatively, for example, lattice coding may be used. More specifically, methods using integer lattices, methods using triangular lattices, and methods using more complex lattices are known (see, for example, Reference 3). In this disclosure, the sketch encoding function is assumed to be linear.

[0038] Fig. 3 is a diagram schematically illustrating an example of the configuration of each device in the proxy re-encryption system 100 of Fig. 2. Referring to Fig. 3, the entrusting source device 110 includes a biometric information acquiring unit 111 that acquires biometric information w, a biometric shared key generating unit 112 that generates a public key and generates a first biometric shared key s as a private key, an entrusting source decryption unit 113 that generates a decryption key s2 (biometric shared decryption key) at the entrusting source, and a communication unit 114. The communication unit 114 transmits the first biometric shared key s and the decryption key s2 (biometric shared decryption key) to the entrusting source distribution destination device 130.

[0039] The key distribution generation device 120 includes a re-encryption key generation unit 121 that uses the public key of the entrustee to communicate with the entrust-source distribution destination device 130 to generate a re-encryption key, a decryption key generation unit 122 that generates the entruster's decryption key, and a communication unit 123. The communication unit 123 communicates with the entrust-source distribution destination device 130 and also transmits the re-encryption key to the proxy device 150.

[0040] The entrusting source device 130 includes a key-based shared key generation unit 131 that generates a key-based shared key, a biometrics-based shared key storage unit 132 that stores the first biometrics-based shared key s and the decryption key s2 (biometrics-based shared decryption key) generated by the entrusting source device 110, and a communication unit 133. The communication unit 133 communicates with the key share generation device 120.

[0041] The encryption device 140 includes a client encryption unit 141 that outputs a ciphertext obtained by encrypting a message using the client's public key, a client public key storage unit 142 that stores the client's public key, and a communication unit 143 that transmits the ciphertext to the proxy device 150.

[0042] The proxy device 150 includes a re-encryption unit 151 that re-encrypts ciphertext using a re-encryption key, a re-encryption key storage unit 152 that stores the re-encryption key, and a communication unit 153 that transmits the re-encrypted ciphertext to the entrustment destination device 160. The communication unit 153 receives the ciphertext from the encryption device 140 and receives the re-encryption key from the key distribution generation device 120.

[0043] The entrustment destination device 160 includes an entrustment destination key generation unit 161, an entrustment destination decryption unit 162, an entrustment destination decryption key storage unit 163, and a communication unit 164. The entrustment destination key generation unit 161 generates a public key and a private key of the entrustment destination, and stores the private key in the entrustment destination decryption key storage unit 163. The entrustment destination decryption unit 162 decrypts the re-encrypted ciphertext received by the communication unit 164 from the proxy device 150, using the entrustment destination decryption key (private key) stored in the entrustment destination decryption key storage unit 163.

[0044] 3 illustrates a configuration in which the devices 110 to 160 are connected to the network 170 as network nodes (communication devices) for the sake of convenience, but the network 170 is not limited to a bus type. The network 170 may include any one or a combination of a LAN (Local Area Network), a WAN (Wide Area Network) such as the Internet, a wireless LAN with security measures, a mobile communication network, etc. The proxy device 150 and the entrusted device 160 may have any configuration as long as they have at least the above configuration and functions.

[0045] Here, we will consider the applicability of the biometric key sharing scheme to the pairing-based proxy re-encryption scheme (PRE) (Non-Patent Document 1) as an example of a measure against loss of a private key. Below, as a comparative example, we will consider a biometric key sharing scheme using a pairing scheme between P1 and P2 on the entrusting side, with reference to Figure 4.

[0046] A pairing is a two-input, one-output function, and is a bilinear function (mapping). Let G1 and G2 be multiplicative groups of order p (a prime number), and let g be a generator of the multiplicative group G1. Mapping e: G1×G1→G2 …(10) For , the pairing map satisfies

[0047] Bilinear: e(g^a, g^b)=e(g, g)^ab for all a, b ∈Z * p …(11) ^ is the exponentiation operator, Z * p is the set of integers that are Zp and relatively prime to p (Zp is the set of integers between 0 and p) Non-degenerate: e(g, g) ≠ 1 G2 …(12) (1 G2 is the identity element of G2).

[0048] The trustee P1 generates the key (KeyGen), Step 1: Uniformly randomly generate the secret key: sk1 = (x11, x12) …(13) Select.

[0049] Step 2: P1 generates a public key pk1. pk1 = (Z^x11, g^x12) …(14)

[0050] Step 3: P1 sends P1's public key pk1 to P2.

[0051] Step 4: P1 receives pk2 from P2.

[0052] Step 5: P1 calculates pk from pk1 and pk2. pk = pk1*pk2 = (Z^x11, g^x12)*(Z^x21, g^x22) =(Z^(x11+x21), g^(x12+x22))=(Z^x1, g^x2)…(15)

[0053] however, Z = e(g, g) …(16) x1 = x11 + x21 x2 = x12 + x22 …(17)

[0054] On the other hand, P2 generates the key (KeyGen) as follows: Step 1: Uniformly randomly generate a secret key: sk2 = (x21, x22) …(18) Select.

[0055] Step 2: P2 generates a public key pk2. pk2 = (Z^x21, g^x22) …(19)

[0056] Step 3: P2 receives pk1 from P1.

[0057] Step 4: P2 sends pk2 to pk1.

[0058] Step 5: P2 calculates pk from pk1 and pk2. pk = pk1*pk2 = (Z^x1, g^x2) …(20)

[0059] Here, the private key skB of the trustee is skB = (b1, b2) …(21) Let pkB be the public key of the trustee. pkB =(Z^b1, g^b2) …(22) Let's say.

[0060] In the re-encryption key generation (ReKeyGen), P2: Step 1: Calculate rk2 using g^b2 and x21 and send it to P1. rk2= (g^b2)^x21 …(23)

[0061] In generating the re-encryption key, P1 Step 1: Calculate rk1 using g^b2 and x11. rk1= (g^b2)^x11 …(24)

[0062] Step 2: P1 receives rk2 from P2.

[0063] Step 3: P1 calculates the re-encryption key rk_AtoB (∈G1) from rk1 and rk2. rk_AtoB = rk1*rk2 =(g^b2)^x11*(g^b2)^x21 =(g^b2)^(x11 + x21) =(g^b2)^x1 =g^(x1*b2) …(25)

[0064] In encryption (Encryption(m)), the message m∈G2 is encrypted using the public key pk1 (generating the ciphertext of the trustor).

[0065] Step 1: Choose k uniformly at random (k is a positive integer).

[0066] Step 2: First-level encryption uses the first-level cipher text: ctA1=(Z^(x1*k), mZ^k) …(26) and Second-level encryption uses the second-level cipher text: ctA2 = (g^k, mZ^(x1*k)) …(27) Output.

[0067] The decryption of the ciphertext at the trustee P1 is performed using the first level ciphertext ctA1 of the trustee. m=β / α^(1 / x1) …(28) It is held at. however, α = Z^(x1*k) …(29) β = mZ^k …(30)

[0068] From equation (28), the trustor needs information of 1 / x1 to decrypt the ciphertext of the trustor, but it is difficult for the trustors P1 and P2 to generate this value without revealing each other's private keys. We have examined the applicability of the secret key sharing scheme to the pairing-based proxy re-encryption scheme (PRE) (Non-Patent Document 1), and it has become clear that the secret key sharing scheme cannot be applied because P1 cannot decrypt the ciphertext created by the trustor without P1 and P2 revealing each other's private keys.

[0069] For reference, the re-encryption process by the proxy (P) and the decryption process at the outsourcee according to the pairing-based proxy re-encryption method (PRE) (Non-Patent Document 1) will be described below.

[0070] At the proxy (P), the re-encryption key rk_AtoB(= g^(x1*b2)) …(31) The second-level ciphertext ctA2 of the trustor is converted into the first-level ciphertext ctB1 of the trustee using the above. That is, the second-level ciphertext of the trustor: ctA2 = (g^k, mZ^(x1*k)) …(32) Then, using the re-encryption key g^(x1*b2), e(g^k, g^(x1*b2))=Z^(k*x1*b2)=Z^(b2*x1*k)…(33) Calculate the first-level ciphertext ctB1 of the trustee: ctB1 = (Z^(b2*x1*k), mZ^(x1*k))=(Z^(b2*k'), mZ^k') (k'=x1*k) …(34) Ask for.

[0071] In the decryption process of the ciphertext, the first level ciphertext re-encrypted by the proxy (P) from the client to the client is: ctB1=(Z^(b2*k'), mZ^k') …(35) Then, the message m is decrypted using the trustee's private key b2∈skB (=(b1, b2)). m=β' / α'^(1 / b2) …(36) however, α'=Z^(b2*k') …(37) β'=mZ^k' …(38)

[0072] As described above, the pairing method of Non-Patent Document 1 has a problem in that the ciphertext created by the trustor cannot be decrypted by the trustor itself. In contrast, the method of the present disclosure, an example of which will be described below, allows the trustor to decrypt the ciphertext created by the trustor without disclosing 1 / x1 between P1 and P2, while keeping the private key distributed.

[0073] Fig. 5 is a diagram showing an example of the processing of the present disclosure described with reference to Fig. 2 and Fig. 3. As in the comparative example of Fig. 4, a pairing-based method using bilinearity is used.

[0074] In the entrusting device 110, in key generation (KeyGen), Step 1: Obtain the first biometric information w.

[0075] Step 2: Uniformly random x = (x1, x2) …(39) (Generate a private key) (x1, x2 are positive integers, for example).

[0076] Step 3: Generate the public key pk. pk = (Z^x1, g^x2) …(40) however, Z = e(g, g) …(41)

[0077] Step 4: The first sketch s is generated by combining the encoding key ENC(x) obtained by encoding the private key x with the first biometric information w. s = ENC(x) + w …(42) As mentioned above, in equation (42), the addition on the right side can be a subtraction, and bitwise exclusive OR can also be performed.

[0078] Step 5: A sketch s2 for decryption is generated from the encoding key ENC(1 / x1) obtained by encoding the inverse element of x1 of the private key x and the first biometric information w (for example, the private key x1 is generated in a field F p (={0,1, 2,…,p-1}, and the inverse element of x1, 1 / x1, can also be an integer (1 / x1∈Fp). s2 = ENC(1 / x1) + w …(43) In addition, in equation (43), the addition on the right side can be a subtraction, and bitwise exclusive OR can also be performed.

[0079] The key distribution generation device 120 executes a re-encryption key generation process (ReKeyGen(pkB)). In ReKeyGen(pkB), the trustee's public key pkB is input. pkB = (Z^b1, g^b2) …(44) The private key skB of the trustee is skB = (b1, b2) …(45) is.

[0080] In the key sharing generation device 120, Step 1: Obtain second biometric information w'.

[0081] Step 2: Uniformly randomly, Δ=(Δ1, Δ2) …(46) (Δ1 and Δ2 are, for example, positive integers). Δ=(Δ1, Δ2) may be called a temporary private key.

[0082] Step 3: A second sketch is generated from the encoding key ENC(Δ) obtained by encoding Δ and the second biometric information w′. s' = ENC(Δ) + w' …(47) In addition, in equation (47), the addition on the right side can be a subtraction, and bitwise exclusive OR can also be performed.

[0083] Step 4: The second sketch s′ is sent to the entrusting-source distribution destination node 130 .

[0084] Step 5: rk1= (g^b2)^Δ …(48) Calculate. where g^b2∈pkB =(Z^b1, g^b2) …(49)

[0085] Step 6: rk2 is received from the entrust-source distribution destination node 130.

[0086] Step 7: Calculate the re-encryption key rk. rk_AtoB = rk1 * rk2 = {(g^b2)^Δ} * {(g^b2)^x'} = (g^b2)^{(x-x') + x'} =g^(x*b2) …(50)

[0087] In the entrust-source distribution destination device 130, Step 1: The first sketch s transmitted from the entrusting device 110 is stored in the storage unit 132.

[0088] Step 2: Receive the second sketch s′ sent from the key distribution generating device 120.

[0089] Step 3: Using the first sketch s and the second sketch s' transmitted from the entrusting device 110 and stored in the memory unit 132, the difference s-s' is decrypted using the decryption function DEC to obtain the differential key x'. x'←DEC(s - s') ...(51)

[0090] In equation (51), DEC(s - s') = DEC(ENC(x) + w -(ENC(Δ) + w')) = DEC(ENC(x)-ENC(Δ) + (w -w')) = DEC(ENC(x -Δ)+(w-w')) If the distance between the first biometric information w and the second biometric information w' is within the error correction range of the decoding, DEC(s - s') = DEC(ENC(x -Δ)) = x -Δ=x' …(52) That is, the output x' of the decryption function DEC in equation (51) is the key difference x-Δ between the key x and Δ.

[0091] Step 4: Using g^b2 (∈ trustee's public key pkB = (Z^b1, g^b2)) and key difference x' (= x - Δ) rk2 = (g^b2)^x' = g^(x'*b2) …(53) Calculate.

[0092] Step 5: Send rk2 to the key distribution generation device 120.

[0093] In the process in the encryption device 140, a message mεG2 is encrypted with a public key pk, as in FIG. Step 1: Choose k uniformly at random (k is a positive integer).

[0094] Step 2: First-level Encryption: First-level cipher text: ctA1=(Z^(x1*k), mZ^k) (= (α,β)) …(54) Generate Second-level encryption uses the second-level cipher text: ctA2 = (g^k, mZ^(x1*k)) …(55) Generate.

[0095] The first level ciphertext ctA1 of the entrusting source may be transmitted from the encryption device 140 to the key distribution generation device 120 or the entrusting source distribution destination device 130. The encryption device 140 transmits the second level ciphertext ctA2 of the entrusting source to the proxy device 150.

[0096] Next, a case where P1 decrypts the ciphertext created on the P1 side will be described. In the comparative example described with reference to Fig. 4, P1 and P2 could not decrypt the ciphertext without disclosing each other's private keys. Fig. 6 is a diagram illustrating an example of a process for decrypting the ciphertext created on the entrusting party P1 side in the example of the present disclosure in Fig. 3.

[0097] At the entrusting party P1, the key distribution generation device 120: Step 1: Obtain second biometric information w'. This is the same processing step as step 1 of the re-encryption key generation in Fig. 5, and the second biometric information w' is the same as the second biometric information w' in step 1 in Fig. 5.

[0098] Step 2: Uniformly random Δ=(Δ1, Δ2) …(56) (Δ1, Δ2 are, for example, positive integers). Step 2 in FIG. 6 may be the same as Step 2 in FIG. 5. That is, Δ=(Δ1, Δ2) in Step 2 in FIG. 6 is the same as Δ=(Δ1, Δ2) in Step 2 in FIG. 5.

[0099] Step 3: A sketch (second biometric shared decryption key) s2' is generated from the encoding key ENC(Δ1) obtained by encoding Δ1 and the second biometric information w'. s2' = ENC(Δ1) + w' …(57)

[0100] Step 4: The sketch s2' is sent to the outsourcing distribution destination node 130 on the outsourcing side, P2.

[0101] Step 5: α^x' is received from the entrusting source distribution destination device 130. Here, α is Z^(x1*k) of the first level ciphertext ctA1 of the entrusting source. α = Z^(x1*k) …(58) (∵ ctA1=(Z^(x1*k), mZ^k)=(α, β))

[0102] Step 6: From α̂Δ1 and α̂x', calculate the following using the operation Δ1 + x' (=1 / x1: equation (62) described later) of Δ1 and x'. α^Δ1* α^x' =α^(Δ1 + x') = α^(1 / x1) = {Z^(x1*k)}^(1 / x1) =Z^{(x1*k)*(1 / x1)} =Z^k …(59)

[0103] Step 7: Decrypt message m from α^Δ1*α^x' (=Z^k) and β (=mZ^k) of the first-level ciphertext ctA1 of the trustor. β / (α^Δ1* α^x')= mZ^k / Z^k = m …(60)

[0104] The entrust-source distribution destination apparatus 130 has already received the sketch s2 (equation (43)) transmitted from the entrust-source apparatus 110 and stored it in the storage unit 132.

[0105] The entrust-source distribution destination node 130 performs the following processing. Step 1: The sketch s2′ (equation (57)) created by the decryption key generation unit 122 of the key distribution generation device 120 is received.

[0106] Step 2: Using the sketch s2 stored in the storage unit 132 and the sketch s2' transmitted from the key share generation device 120, the difference between them is decrypted using the decryption function DEC to obtain the differential key x'. x'←DEC(s2 - s2') ...(61)

[0107] where: DEC(s2 - s2')=DEC(ENC(1 / x1)+w -(ENC(Δ1)+w')) =DEC(ENC(1 / x1)- ENC(Δ1)+ (w -w')) =DEC(ENC(1 / x1- Δ) + (w-w')) If the distance between the first biometric information w and the second biometric information w' is within the error correction range of the decoding, DEC(s2 - s2') = DEC(ENC(1 / x1- Δ1)) = 1 / x1 - Δ1=x' …(62) Therefore, x' in equation (62) is the key difference between 1 / x1 and Δ1.

[0108] Step 3: Calculate α^x', where α is Z^(x1*k) of the first-level ciphertext ctA1 of the trustor. α = Z^(x1*k) …(63) The delegating source distribution destination device 130 receives the first level ciphertext of the delegating source generated by the encryption device 140: ctA1=(Z^(x1*k), mZ^k) (= (α,β)) …(64) It is assumed that the following has been obtained.

[0109] Step 4: Send α̂x′ to the key share generation device 120.

[0110] The key sharing generation device 120 is configured to communicate with the encryption device 140 and acquire the first-level ciphertext ctA1(=(Z^(x1*k), mZ^k) (=(α, β)) generated by the encryption device 140. In Figure 6, the processing unit that performs the decryption process of the ciphertext may be implemented as a unit separate from the decryption key generation unit 122 of the key sharing generation device 120, or may be configured as a device separate from the key sharing generation device 120.

[0111] In addition, after the entrust-source apparatus 110 has handed over the sketch s2 to the entrust-source distribution destination apparatus 130, x1 and 1 / x1 may be deleted.

[0112] As shown in FIG. 6, on the P1 side, since x1 is known from key generation (KeyGen) in the entrusting device 110, 1 / x1 can be generated.

[0113] The proxy device 150 converts the second-level ciphertext ctA2 of the entrustor encrypted by the encryption device 140 into the first-level ciphertext ctB1 of the entrustee, using the re-encryption key rk_AtoB (equation (50)) output from the key distribution generation device 120. That is, the second-level ciphertext of the entrustor: ctA2 = (g^k, mZ^(x1*k)) …(65) From the above, using g^(x1*b2) as the re-encryption key rk_AtoB, the bilinear mapping: e(g^k, g^(x1*b2))=Z^(k*x1*b2)=Z^(b2*x1*k)…(66) Calculate the first level ciphertext ctB of the trustee using Z^(b2*x1*k) and mZ^(x1*k): ctB1 = (Z^(b2*x1*k), mZ^(x1*k))=(Z^(b2*k'), mZ^k') (k'=x1*k) …(67) and transmits the first level ciphertext ctB1 of the trustee to the trustee device 160.

[0114] The trustee device 160 receives the first-level ciphertext of the trustee sent from the proxy device 150: ctB1 = (Z^(b2*k'), mZ^k')=(α', β') …(68) , and decrypts the message m from ctB1 using the trustee's private key b2∈skB (=(b1, b2)) using the following formula. m=β' / α'^(1 / b2) …(69)

[0115] According to the present disclosure, the entrusting device 110 acquires biometric information and generates a biometric shared key (first sketch s), which is stored in the entrusting-source distribution destination device 130, and the key sharing generation device 120 generates a re-encryption key (rk_AtoB) or a decryption key (1 / x1) from the biometric information w' and the key-use shared key of the entrusting-source distribution destination device 130. By providing the entrusting-source user's biometric information, it becomes possible to decrypt and transform encrypted data without holding the private key.

[0116] In equation (42), since the private key x=(x1, x2) consists of two elements, the first sketch s may be calculated as follows: s = ENC((x1, x2)) + (w, w)=(ENC(x1) + w, ENC(x2) + w) …(70)

[0117] Similarly, the second sketch s' of equation (47) may be calculated as follows: s' = ENC(Δ) + w' =ENC((Δ1, Δ2) + (w', w')=(ENC(Δ1) + w', ENC(Δ2) + w')…(71)

[0118] In this case, the argument s-s' in the decoding function DEC(s-s') of equation (51) can be expressed as follows: s- s'= (ENC(x1) + w, ENC(x2) + w) - (ENC(Δ1) + w', ENC(Δ2) + w') =(ENC(x1)-ENC(Δ1) + w-w', ENC(x2)-ENC(Δ2) + w - w') =(ENC(x1 - Δ1) + w-w', ENC(x2 - Δ2) + w-w') …(72)

[0119] In equation (72), when the distance between the first biometric information w and the second biometric information w′ is within the error correction range of decoding, x'←DEC(s- s')=DEC[(ENC(x1 - Δ1) +(w-w'), ENC(x2-Δ2) + (w-w'))] =(DEC(ENC(x1 - Δ1))+DEC(w-w'), DEC(ENC(x2 - Δ2))+DEC(w-w')) =(DEC(ENC(x1 - Δ1)), DEC(ENC(x2- Δ2))) =(x1-Δ1, x2-Δ2) =(x1, x2)-(Δ1, Δ2) =x -Δ …(73) Equation (73) corresponds to equation (52).

[0120] In generating the sketches s2 and s2' in Equation (43) and Equation (57), if the first and second biometric information w and w' are, for example, real-valued n-dimensional vectors, a non-limiting example of encoding will be outlined, for example, in an example of applying encoding using a square lattice as disclosed in Reference 4 (this disclosure is not limited to the following). Sketches s2 and s2' will be described below.

[0121] The first biometric information w and the second biometric information w' are assumed to be n-dimensional real vectors. w= (w1, …, w n ), w'= (w'1,…, w' n ) …(74)

[0122] The distance between the first biometric information w and the second biometric information w' is, for example, L ∞ Distance (L ∞ The norm (maximum norm) is expressed as follows: d (n) ∞ (w, w') = max {|w i - w' i |, i=1,…,n} …(75) Distance d (n) ∞ (w, w') is a given threshold t h Below(d (n) ∞ (w, w')≦t h ) then it is considered a match (same organism).

[0123] The lattice point set L is defined as follows: L={Y=(y1,…,y n )| y i is a non-negative integer, 0≦y i ≦K} …(76) where K is t h Ya|w i | is a predetermined positive integer that is sufficiently larger than

[0124] The function int() that associates one integer z with an n-dimensional integer vector Y∈L is defined as follows: z←int(Y)=Σ[i=1, n]y i (2K) i-1 …(77) Inverse function int -1 () is a function that maps an integer z to an n-dimensional integer vector Y. Y ← int -1 (z) …(78)

[0125] 1 / x1 (positive integer: x1∈Fp) is the inverse function int -1 When input into (), we get an n-dimensional integer vector A. A=(a1,…, a n )←int -1 (1 / x1) …(79)

[0126] Here, the encoding function ENC() is h *int -1 (), the encoding key c that encodes 1 / x1 is an n-dimensional vector and is given by: c=(c1,…,c n )←ENC(1 / x1)=2t h *int -1 (1 / x1)=2t h *(a1,…, a n ) …(80)

[0127] Therefore, the sketch (first biometric shared decryption key) s2 of equation (43) is expressed as follows: s2 = ENC(1 / x1) + w = ​​2t h *(a1,…, a n )+(w1,…, w n ) =(2t h *a1+w1,…,2t h *a n +w n ) …(81)

[0128] Regarding the sketch (second biometrics-based shared decryption key) s2' in equation (57), when a square lattice is used for encoding in the same way as the first biometrics-based shared decryption key s2, c'=(c'1,...,c'n )←ENC(Δ1)=2t h *int -1 (Δ1)=2t h *(a'1,…, a' n ) …(82) Therefore, the sketch s2 is an n-dimensional real-valued vector. s2' = 2t h *int -1 (Δ1) + w' = 2t h *(a'1,…, a' n )+(w'1,…,w' n ) =(2t h *a'1+ w'1,…,2t h *a' n + w' n ) …(83)

[0129] In equation (62), x'←DEC(s2 - s2') In this case, the encoding function ENC() is 2t h *int -1 When () is used, the decoding function DEC is DEC(c) = int(c / 2t h ) …(84) It may also be possible to use the following.

[0130] In this case, the argument s2 - s2' of the decoding function DEC(s2 - s2') can be expressed as follows: s2 - s2' = (w1,…, w n ) + ENC(1 / x1) - {(w'1,…, w' n ) + ENC(Δ1)} = (w1,…, w n ) - (w'1,…, w' n ) + ENC(1 / x1) - ENC(Δ1)…(85)

[0131] Since 1 / x1 and Δ1 are integer values ​​and the coding function is linear, int -1 (1 / x1)-int -1 (Δ1)=int -1(1 / x1 - Δ1) …(86) Therefore, DEC(s2-s2') = int[(1 / 2t h ){(w1,…, w n )+2t h *int -1 (1 / x1)-(w'1,…, w' n )-2t h *int -1 (Δ1)}] = int(1 / 2t h ){((w1,…, w n ) - (w'1,…, w' n )) + int{int -1 (1 / x1-Δ1)} …(87) is given by

[0132] Regarding the first biometric information w and the second biometric information w', d (n) ∞ (w, w') = max { |w i - w' i |, i=1,…,n} ≦t h …(88) Then, in equation (87), the n-dimensional vector (w-w') / 2t h Each component of is less than ±1 / 2. Therefore, the value x' of DEC(s2 - s2') is x'=DEC(s2 - s2') = int{int -1 (1 / x1-Δ1)}= 1 / x1 - Δ1 …(89) This becomes: Therefore, 1 / x1 = Δ1+x' …(90) Equation (90) corresponds to equation (62).

[0133] Regarding x = (x1, x2) in equation (39), when the first and second biometric information w and w' are, for example, real-valued n-dimensional vectors, the first sketch s in equation (42) may be encoded using the above-mentioned square lattice. s = ENC((x1, x2)) + (w, w)=(ENC(x1) + w, ENC(x2) + w) In this case, ENC(x1) and ENC(x2) are converted into ENC() by the above 2t h *int -1 (), and the decoding function DEC(c) is int(c / 2t h )to can also be used.

[0134] in this case, (c1,…,c n )←ENC(x1)=2t h *int -1 (x1)=2t h *(a1,…, a n ) …(91) (c n+1 ,…,c 2n )←ENC(x2)=2t h *int -1 (x2)=2t h *(a n+1 ,…, a 2n ) …(92) s = [(ENC(x1) + w), (ENC(x2) + w)] =[(2t h *a1+w1,…,2t h *a n +w n ), (2t h *a n+1 +w1,…,2t h *a 2n +w n )]…(93)

[0135] Similarly, the second sketch s' of equation (71) is (c1,…, c n ) ← ENC(Δ1) = 2t h *int -1 (Δ1)=2t h *(a'1,…, a' n ) …(94) (c n+1 ,…, c 2n )← ENC(Δ2)= 2t h *int-1 (Δ2)=2th*(a n+1 ',..., a 2n ') ...(95) s' = [(ENC(Δ1) + w'), (ENC(Δ2) + w')] =[(2t h *a1'+w1',…, 2t h *a n '+w n '), (2th*a n+1 '+w1',…,2t h *a 2n '+w n ')] …(96)

[0136] In the decoding function DEC(s - s'), the argument s - s' can be expressed as follows: s - s'=[{((ENC(x1) + w) - (ENC(Δ1) + w')}, {(ENC(x2) + w) - (ENC(Δ2) + w')} =[{ENC(x1)-ENC(Δ1) + (w1,…, w n ) - (w'1,…, w' n )}, {ENC(x2)-ENC(Δ2) + (w1,…, w n ) - (w'1,…, w' n )} =[{ENC(x1-Δ1) + (w1-w'1…, w n - w' n )}, {ENC(x2-Δ2) + + (w1-w'1…, w n - w' n )} …(97)

[0137] therefore, DEC(s - s')=DEC[{ENC(x1-Δ1) + (w1-w'1…, w n - w' n )}, {ENC(x2-Δ2) +(w1-w'1…, w n - w' n )} =[{int{int -1 (x1-Δ1)+int(1 / 2t h)(w1-w'1..., w n - w' n )}, {int{int -1 (x2-Δ2)+int(1 / 2t h )(w1-w'1..., w n - w' n )}] …(98)

[0138] Regarding the first biometric information w and the second biometric information w′, d (n) ∞ (w, w') = max { |w i - w' i |, i=1,…,n} ≦t h …(99) Then, in equation (98), the n-dimensional vector (w-w') / 2t h Each component of is less than ±1 / 2, and the value x' of DEC(s2 - s2') is x'←DEC(s - s') = (int{int -1 (x1-Δ1), int{int -1 (x2-Δ2)) =(x1-Δ1, x2-Δ2)=x - Δ …(100) Equation (100) corresponds to equation (52).

[0139] The first biometric information w and the second biometric information w' may be binary coded into binary data. · Number of bits in the codeword: n, Allowable number of error bits (error correction range): D.

[0140] In deriving the sketch (first biometric shared decryption key) s2 of equation (43), 1 / x1 is input to an error correction coding algorithm (ENC) and executed to obtain an n-bit coding key c. c=[c1,…,cn] ← ENC(1 / x1) …(101)

[0141] The bitwise exclusive OR (xor) of the first biometric information w (n bits) and the encoding key c is calculated and output as a sketch s2 (n bits). s2=ENC(1 / x1) xor w …(102) Sketch s2 can be expressed in bits as follows: s2 = w xor c = [w1xor c1,…, w n xor c n ] …(103)

[0142] Sketch s2' of equation (57) s2'=ENC(Δ1) xor w' …(104) Sketch s2' can be expressed in bits as follows: s2'= w' xor c' = [w'1xor c'1, w'2xor c'2,…, w' n xor c' n ] …(105)

[0143] DEC(s2-s2') in equation (62) can be expressed as x'=DEC(s2 xor s2'). s2 xor s2'= [w1xor c1, …, w n xor c n ] xor [w'1xor c'1,…, w' n xor c' n ] = [(w1xor c1) xor (w'1xor c'1), …, (w n xor c n ) xor (w' n xor c' n )] = [w1xor w'1, …, w n xor w' n ] xor [c1xor c'1, …, c n xor c' n ] = (w xor w') xor (ENC(1 / x1) xor ENC(Δ1)) = (w xor w') xor (ENC(1 / x1 xor Δ1)) …(106)

[0144] If the distance between the first biometric information w and the second biometric information w′ is equal to or smaller than the error correction range D, DEC( (s2 xor s2') is DEC(ENC(1 / x1 xor Δ1))=1 / x1 xor Δ1 and x' is the difference between 1 / x1 and Δ1. The same can be done for equations (70) and (71).

[0145] FIG. 7 is a schematic diagram illustrating an example in which the devices (110 to 160) of the system 100 described above are implemented by computers equipped with communication functions and communicatively connectable to one another via a network. In FIG. 7(A), each device (110 to 160) includes a processor 201, a storage device 202, an input / output device 203, and a communication interface 204. The storage device 202 may include semiconductor storage such as RAM (Random Access Memory), ROM (Read Only Memory), or EEPROM (Electrically Erasable and Programmable ROM), an HDD (Hard Disk Drive), CD (Compact Disc), DVD (Digital Versatile Disc), etc. The processor 201 executes a program (not shown) stored in the storage device 202 to realize the processing and functions of each device. The input / output device 203 may include a keyboard and a display. In the entrusting device 110 and the re-encryption key generation unit 121 of the key sharing generation device 120 that acquire biometric information, the input device / output device 203 may be configured to include a sensor for acquiring biometric information. In this case, the sensor may be an image sensor (camera) or the like when the biometric information is a face, iris, or the like. In the case of a fingerprint, the sensor may be a fingerprint sensor, or in the case of finger veins, it may be, for example, a light-emitting diode (LED) that emits near-infrared light and a near-infrared camera that captures the light transmitted through the finger. The sensor may be a removable sensor, for example, a universal serial bus (USB) device. The communication interface 204 may be configured to include a network interface card, a transceiver, or the like, and to communicate with each other via a local area network (LAN), a wide area network (WAN) such as the Internet, a secure wireless LAN, a mobile communication network, or the like. The communication interface 204 may also be configured to include an interface that communicates with an external sensor (e.g., a Bluetooth (registered trademark)-connected sensor) and receives biometric information acquired by the external sensor.

[0146] FIG. 7(B) is a diagram illustrating an example in which the devices (110 to 160) of the system 100 described above are implemented as virtual machines using server virtualization technology. Multiple virtual machines VM run on a virtualization platform 302, such as a hypervisor, implemented on a physical machine 301 of the server. One or more of the devices (110 to 160) of the system 100 may be implemented as virtual machines VM. Although there is one physical server, a virtual server environment in which multiple servers run is provided. Each virtual machine VM is preferably configured to operate in an isolated environment in memory space. In this case, in the virtual machine VM, a program that realizes the processing of any one of the devices (110 to 160) runs on the virtual OS (Operating System) of the virtual machine. A virtual machine VM that virtually realizes one of the devices (110 to 160) may be configured to communicate with other virtual machines via a virtual network, or may be configured to communicate with other devices among the devices (110 to 160) via a physical interface (communication interface) of the physical machine 301 via a LAN, a WAN such as the Internet, etc.

[0147] Although the example of using a square lattice for encoding has been described as a non-limiting example, it goes without saying that error correction codes such as RS codes, BCH codes, etc. may also be used as linear codes. Furthermore, biometric information is not limited to real number vectors, and it goes without saying that integer vectors may also be used.

[0148] [References 1] Xi Chen1, Yun Liu, Yong Li, and Changlu Lin, "Threshold Proxy Re-encryption and Its Application in Blockchain" In: Sun, X., Pan, Z., Bertino, E. (eds) Cloud Computing and Security. ICCCS 2018. Lecture Notes in Computer Science(), vol 11066. Springer, Cham [Reference 2] Yevgeniy Dodis, et al., "Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data", SIAM Journal on Computing, 38(1):97-139, 2008 [Reference 3] JP 2021-087167 A [Reference document 4] Patent No. 5707311

[0149] The above-described embodiment may be supplemented with the following, for example (but not limited to):

[0150] (Supplementary Note 1) A cryptographic system includes an entrusting device that acquires first biometric information and generates a first biometric-based shared key, an entrusting device that receives the first biometric-based shared key from the entrusting device and stores it in a memory unit, and a key distribution generation device that acquires second biometric information, generates a second biometric-based shared key, and transmits it to the entrusting device. The entrusting device generates a key-based shared key using the first biometric-based shared key, the second biometric-based shared key, and a public key of an entrustee, and transmits it to the key distribution generation device, and the key distribution generation device generates a re-encryption key from the entrusting device to the entrustee using the key-based shared key.

[0151] (Supplementary Note 2) The cryptosystem of Supplementary Note 1 further comprises an encryption device that encrypts a message using the public key of the delegator and outputs a ciphertext. The delegator device generates a first biometric-based shared decryption key using the first biometric information and transmits it to the delegator-source destination device, the delegator-source destination device stores the first biometric-based shared decryption key in the storage unit, the key distribution generation device generates a second biometric-based shared decryption key using the second biometric information and transmits it to the delegator-source destination device, the delegator-source destination device transmits information generated using at least the first biometric-based shared decryption key and the second biometric-based shared decryption key to the key distribution generation device, the key distribution generation device restores a decryption key based on the second biometric-based shared decryption key and the information generated by the delegator-source destination device, and decrypts the message using the decryption key for the ciphertext output from the encryption device.

[0152] (Supplementary Note 3) In the cryptographic system of Supplementary Note 1 or 2, the entrusting device generates a private key and the public key of the entrusting device, and generates the first biometric-based shared key by combining a first encoding key obtained by encoding the private key with the first biometric information; the key distribution generation device generates a temporary private key and generates the second biometric-based shared key by combining a second encoding key obtained by encoding the temporary private key with the second biometric information; the entrusting device decrypts the difference between the first biometric-based shared key and the second biometric-based shared key to obtain a first differential key which is the difference between the private key and the temporary private key, and generates the key-based shared key using the first differential key and the public key of the entrustee; and the key distribution generation device generates the re-encryption key using the public key of the entrustee, the temporary private key, and the key-based shared key.

[0153] (Supplementary Note 4) In any of the cryptographic systems of Supplements 1 to 3, the delegation source device generates the first biometric-based shared decryption key by combining a third encoding key obtained by encoding an inverse element of the private key with the first biometric information, the key distribution generation device generates the second biometric-based shared decryption key by combining a fourth encoding key obtained by encoding an element of the temporary private key with the second biometric information, the delegation source distribution destination device decrypts the difference between the first biometric-based shared decryption key and the second biometric-based shared decryption key to obtain a second differential key which is the difference between the inverse element of the private key element and the element of the temporary private key, and transmits information generated using the second differential key and the ciphertext to the key distribution generation device, and the key distribution generation device decrypts the message from the ciphertext using the element of the temporary private key and information generated using the second differential key and the ciphertext.

[0154] (Appendix 5) In any one of the cryptographic systems of Appendices 1 to 4, the system includes a proxy device that uses the re-encryption key to re-encrypt the ciphertext output from the encryption device into a ciphertext of a trustee and outputs the re-encrypted ciphertext, and a trustee device that decrypts the ciphertext of the trustee using the private key of the trustee device.

[0155] (Appendix 6) In any of the cryptosystems of Appendices 1 to 5, a pairing-based proxy re-encryption method is used.

[0156] (Supplementary Note 7) The encryption method includes the steps of: a trustor acquires first biometric information and generates a first biometric-based shared key; the entruster node receives the first biometric shared key from the entruster process and stores it in a storage unit; the key sharing generation node acquires the second biometric information, generates a second biometric-based key share, and transmits the second biometric-based key share to the delegation source node; the delegator destination node generates a key-based shared key using the first biometric shared key, the second biometric shared key, and the delegator's public key, and transmits the key-based shared key to the key sharing generation node; The key share generation node generates a re-encryption key from the entrustor to the entrustee using the key-use share.

[0157] (Appendix 8) The encryption method of appendix 7, further comprising an encryption step of encrypting a message using the trustor's public key to generate a ciphertext; the entruster generates a first biometric-based shared decryption key using the first biometric information and transmits the first biometric-based shared decryption key to the entruster distributed node; the delegation source shared destination node stores the first biometric shared decryption key in the storage unit, the key sharing generation node generates a second biometric-based shared decryption key using the second biometric information and transmits the second biometric-based shared decryption key to the delegation source node; the delegation source node transmits information generated using at least the first biometric shared decryption key and the second biometric shared decryption key to the key sharing generation node; the key sharing generation node restores the decryption key based on the second biometric shared decryption key and the information generated by the delegation source distribution destination node, The message is decrypted using the decryption key for the ciphertext generated in the encryption process.

[0158] (Appendix 9) In the encryption method of appendix 7 or 8, the trustor generates a private key and the public key of the trustor, and generates the first biometric-usable shared key by combining a first encoding key obtained by encoding the private key with the first biometric information; the key share generation node generates a temporary private key, and generates the second biometric-based key share by combining a second encoding key obtained by encoding the temporary private key with the second biometric information; the delegation-source destination node decrypts the difference between the first biometric shared key and the second biometric shared key to obtain a first differential key which is the difference between the private key and the temporary private key; generating the key-use shared key using the first differential key and the public key of the trustee; The key share generating node generates the re-encryption key using the public key of the trustee, the temporary private key, and the key utilization share.

[0159] (Appendix 10) In any of the encryption methods of Appendices 7 to 9, the trustor generates the first biometric-utilizing shared decryption key by combining a third encoding key obtained by encoding an inverse element of an element of the private key and the first biometric information; the key share generation node generates the second biometric-based shared decryption key by combining a fourth encoding key obtained by encoding an element of the temporary private key with the second biometric information; the delegation-source distribution destination node decrypts the difference between the first biometric-based shared decryption key and the second biometric-based shared decryption key to obtain a second differential key which is the difference between the inverse element of the private key element and the element of the temporary private key; transmitting information generated using the second differential key and the ciphertext to the key sharing generation node; The key share generation node decrypts the message from the ciphertext using information generated using the elements of the temporary private key, the second differential key, and the ciphertext.

[0160] (Appendix 11) In any of the encryption methods of Appendices 7 to 10, the proxy re-encrypts the ciphertext generated by the encryption process into the ciphertext of the entrusted party using the re-encryption key, and outputs the re-encrypted ciphertext; The trustee decrypts the ciphertext of the trustee using the private key of the trustee.

[0161] (Appendix 12) A process in which the entrusting device acquires first biometric information and generates a first biometric-utilizing shared key; a process in which the entrust-source distribution destination device receives the first biometric shared key from the entrust-source device and stores it in a storage unit; a process in which a key sharing generation device acquires second biometric information, generates a second biometric-based shared key, and transmits the second biometric-based shared key to the entrust-source sharing destination device; a process in which the delegation source distribution destination device generates a key-use shared key using the first biometric shared key, the second biometric shared key, and the public key of the delegation destination, and transmits the key-use shared key to the key distribution generation device; a process in which the key sharing generation device generates a re-encryption key from the trustor to the trustee using the key-use shared key; A recording medium storing a program for causing each of the above devices to execute the above.

[0162] The disclosures of Non-Patent Document 1 and References 1 to 3 are incorporated herein by reference. Modifications, adjustments, and combinations of the embodiments and examples are possible within the scope of the disclosure of this application (including the scope of the claims), and further based on the basic technical ideas thereof. Furthermore, various combinations and selections of the various disclosed elements (including each element of each appendix, each element of each example, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. In other words, this disclosure naturally includes various modifications and alterations that a person skilled in the art would be able to make in accordance with the entire disclosure, including the scope of the claims, and the technical ideas thereof. [Explanation of symbols]

[0163] 100 Proxy Re-encryption System 110 Outsourcing equipment 111 Biometric information acquisition unit 112 Biometric Shared Key Generation Unit 113 Delegated Decryption Unit 114 Communications Department 120 Key distribution generator 121 Re-encryption key generation section 122 Decryption key generation unit 123 Communications Department 130 Delegator distributed destination device 131 Key-based distributed key generation unit 132 Memory unit (biometric shared key memory unit) 133 Communications Department 140 Encryption device 141 Entrustor Encryption Department 142 Trustee public key storage unit 143 Communications Department 150 Proxy Device 151 Re-encryption section 152 Re-encryption key storage unit 153 Communications Department 160 Outsourced equipment 161 Entrustee key generation unit 162 Decryption Unit 163 Entrustee decryption key storage unit 164 Communications Department 170 Network 200 computers 201 processor 202 Storage device 203 Input / Output Devices 204 Communication Interface 300 servers 301 Physical Machine 302 Virtualization Platform 303 Virtual Machines

Claims

1. a trustor device that acquires first biometric information and generates a first biometric-utilizing shared key; a delegation-source distribution destination device that receives the first biometric shared key from the delegation-source device and stores it in a storage unit; a key sharing generation device that acquires second biometric information, generates a second biometric-based shared key, and transmits the second biometric-based shared key to the delegation-source sharing destination device; Equipped with the delegation source distribution destination device generates a key-based shared key using the first biometric shared key, the second biometric shared key, and the delegation destination public key, and transmits the key-based shared key to the key distribution generation device; The key sharing generation device generates a re-encryption key from the trustor to the trustee using the key-use shared key.

2. an encryption device that encrypts a message using the public key of the client and outputs a ciphertext; the entrusting source device generates a first biometric-utilizing shared decryption key using the first biometric information and transmits the generated key to the entrusting source shared decryption destination device; the delegation source distribution destination device stores the first biometric-utilizing shared decryption key in the storage unit, the key sharing generation device generates a second biometric-based shared decryption key using the second biometric information and transmits the second biometric-based shared decryption key to the delegation-source distribution destination device; the delegation source distribution destination device transmits information generated using at least the first biometric shared decryption key and the second biometric shared decryption key to the key distribution generation device; the key sharing generation device restores the decryption key based on the second biometric shared decryption key and the information generated by the delegation source sharing destination device, 2. The encryption system according to claim 1, wherein the message is decrypted using the decryption key for the ciphertext output from the encryption device.

3. the entrusting device generates a private key and the public key of the entrusting device, and generates the first biometric-utilizing shared key by combining a first encoding key obtained by encoding the private key with the first biometric information; the key share generation device generates a temporary private key, and generates the second biometric-based key share by combining a second coded key obtained by coding the temporary private key with the second biometric information; the delegation-source distribution destination device decrypts the difference between the first biometric shared key and the second biometric shared key to obtain a first differential key which is the difference between the private key and the temporary private key; generating the key-use key share using the first differential key and the public key of the trustee; The cryptographic system according to claim 2 , wherein the key distribution generation device generates the re-encryption key using the public key of the trustee, the temporary private key, and the key utilization key distribution.

4. the entrusting device generates the first biometric-utilizing shared decryption key by combining a third encoding key obtained by encoding an inverse element of an element of the private key and the first biometric information; the key share generation device generates the second biometric-based shared decryption key by combining a fourth encoding key obtained by encoding elements of the temporary private key with the second biometric information; the delegation-source distribution destination device decrypts the difference between the first biometric-based shared decryption key and the second biometric-based shared decryption key to obtain a second differential key which is the difference between the inverse element of the element of the private key and the element of the temporary private key; transmitting information generated using the second differential key and the ciphertext to the key sharing generation device; 4. The cryptographic system according to claim 3, wherein the key share generation device decrypts the message from the ciphertext using information generated using the elements of the temporary private key, the second differential key, and the ciphertext.

5. a proxy device that re-encrypts the ciphertext output from the encryption device into a ciphertext of the entrusted party using the re-encryption key and outputs the re-encrypted ciphertext; a trustee device that receives the ciphertext of the trustee from the proxy device and decrypts the ciphertext of the trustee using a private key of the trustee; 3. The cryptographic system of claim 2, comprising:

6. The cryptographic system of claim 1 , wherein the cryptographic system uses a pairing-based proxy re-encryption scheme.

7. The trustor acquires first biometric information and generates a first biometric-based shared key; the delegator node receives the first biometric shared key from the delegator process and stores it in a storage unit; the key sharing generating node acquires the second biometric information, generates a second biometric-based key share, and transmits the second biometric-based key share to the delegation source node; the delegator destination node generates a key-based shared key using the first biometric shared key, the second biometric shared key, and the delegator's public key, and transmits the key-based shared key to the key sharing generation node; The key sharing generation node generates a re-encryption key from the delegator to the delegator using the key-use shared key.

8. an encryption process for encrypting a message using the public key of the client and outputting a ciphertext; the entrusting source generates a first biometric-based shared decryption key using the first biometric information and transmits the first biometric-based shared decryption key to the entrusting source distributed node; the delegation source shared destination node stores the first biometric shared decryption key in the storage unit, the key sharing generation node generates a second biometric-based shared decryption key using the second biometric information and transmits the second biometric-based shared decryption key to the delegation-source distribution destination node; the delegation source node transmits information generated using at least the first biometric shared decryption key and the second biometric shared decryption key to the key sharing generation node; the key sharing generation node restores the decryption key based on the second biometric shared decryption key and the information generated by the delegation source distribution destination node, The encryption method according to claim 7 , further comprising the step of: decrypting the message using the decryption key for the ciphertext generated in the encryption process.

9. the trustor generates a private key and the public key of the trustor, and generates the first biometric-utilizing shared key by combining a first encoding key obtained by encoding the private key with the first biometric information; the key share generation node generates a temporary private key, and generates the second biometric-based key share by combining a second encoded key obtained by encoding the temporary private key with the second biometric information; the delegation-source shared destination node decrypts the difference between the first biometric shared key and the second biometric shared key to obtain a first differential key which is the difference between the private key and the temporary private key; generating the key-use key share using the first differential key and the public key of the trustee; The encryption method according to claim 8 , wherein the key share generating node generates the re-encryption key using the public key of the trustee, the temporary private key, and the key utilization key share.

10. the entrusting source generates the first biometric-utilizing shared decryption key by combining a third encoding key obtained by encoding an inverse element of an element of the private key and the first biometric information; the key share generation node generates the second biometric-based shared decryption key by combining a fourth encoding key obtained by encoding an element of the temporary private key with the second biometric information; the delegation-source distribution destination node decrypts the difference between the first biometric-based shared decryption key and the second biometric-based shared decryption key to obtain a second differential key which is the difference between the inverse element of the element of the private key and the element of the temporary private key; transmitting information generated using the second differential key and the ciphertext to the key sharing generation node; The encryption method according to claim 9 , wherein the key share generation node decrypts the message from the ciphertext using information generated using the element of the temporary private key, the second differential key, and the ciphertext.

11. the proxy re-encrypts the ciphertext output from the encryption process using the re-encryption key into the ciphertext of the entrusted party and outputs the re-encrypted ciphertext; The encryption method according to claim 8 , wherein the trustee receives the ciphertext of the trustee from the proxy and decrypts the ciphertext of the trustee using a private key of the trustee.

12. A process in which the delegating node acquires first biometric information and generates a first biometric-based shared key; a process in which a delegator-source distributed destination node receives the first biometric shared key from the delegator node and stores it in a storage unit; a process in which a key sharing generation node acquires second biometric information, generates a second biometric-based key share, and transmits the second biometric-based key share to the delegation-source node; a process in which the delegator destination node generates a key-utilized shared key using the first biometric shared key, the second biometric shared key, and a public key of the delegator, and transmits the key-utilized shared key to the key distribution generation node; a process in which the key sharing generation node generates a re-encryption key from the entrustor to the entrustee using the key-use shared key; A recording medium storing a program for causing each of the nodes to execute the above.

Images