Confidential search system, method, program, and storage medium

Abstract

Improve the processing speed and probabilistic security of the private search system. In a secure search system, a terminal that transmits an encrypted search keyword encrypts the plaintext search keyword into the encrypted search keyword using probabilistic encryption. A first example of the encryption uses at least a pseudorandom function that outputs a matrix and a matrix operation. A second example of the encryption uses at least an asymmetric pairing function.

Description

[Technical Field]

[0001] The present invention relates to a confidential search system, method, program, and storage medium for searching data while keeping the data encrypted. [Background technology]

[0002] In recent years, big data analysis, which extracts unknown yet useful knowledge from massive amounts of data, has been attracting attention. Companies are increasingly recognizing the importance of various types of information analysis, such as collecting data from outside the company as well as from their own, and using it for marketing and business efficiency. Meanwhile, there have been frequent incidents and accidents involving the leaking of information, including personal customer information, which has become a social problem.

[0003] Recently, therefore, research has been focused on technologies that use highly secure encryption technology while still allowing some processing of encrypted data. One such technology is a private search technology that can determine whether plaintext matches without decryption.

[0004] The technology disclosed in Non-Patent Document 1 discloses an LWE (Learning With Errors) algorithm as a secure search technology, and an algorithm called a Pairing algorithm that focuses on probabilistic encryption of search keywords. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Q. Li and X. Boyen, 'Public-key authenticated encryption with keyword search made easy,' IACR Communications in Cryptology, vol. 1, no. 2, 2024. Summary of the Invention [Problem to be solved by the invention]

[0006] There is room for improvement in the processing speed of both the LWE algorithm and the pairing algorithm disclosed in Non-Patent Document 1. Furthermore, there is room for improvement in the probabilistic security of search keywords for the pairing algorithm. Therefore, one aspect of the present invention realizes an improvement in the processing speed of a secure search system or a computer that is a part of the system. Furthermore, another aspect of the present invention realizes an improvement in the probabilistic security of search keywords for the secure search system in addition to an improvement in processing speed. [Means for solving the problem]

[0007] In order to solve the above problems, one aspect of the present invention employs the following configuration. A confidential search system having a data management server and one or more data user terminals, As a pre-processing step, a processor of any one of the one or more data user terminals: Obtain the public parameters and the private key K, Sending the public parameters to the data management server; As a data registration process, a processor of one of the one or more data user terminals: Acquire a registration keyword, which is data to be registered in the data management server; Encrypting the registered keyword into an encrypted registered keyword using the public parameters, a private key K, and a probabilistic encryption; transmitting the encrypted registration keyword to the data management server as a data registration request; As a data retrieval process, a processor of any one of the one or more data user terminals: Get the search keywords, encrypting the search keyword into an encrypted search keyword using the public parameters, a private key K, and a probabilistic cipher; Transmitting the encrypted search keyword to the data management server as a data search request or a search-related data processing request; As the data retrieval process, the processor of the data management server: searching for the encrypted registered keyword stored in a memory resource of the data management server using the encrypted search keyword and the public parameters; generating search result data based on the results of the search; The search result data is transmitted.

[0008] In a first example, to obtain the public parameters and the private key in the pre-processing, a processor of any one of the one or more data user terminals: Randomly generate a private key K, The public parameters are obtained as elements of q, n, α, and β, where q, n, α, and β are all positive integers; In the data registration process, the processor of any one of the one or more data user terminals encrypts the registration keyword by: a value Sr is obtained by calculating a pseudorandom function using a private key K and the registered keyword, wherein the pseudorandom function is a function that outputs an n×n matrix, each element of which is an integer between 0 and q−1; By doing the following one or more times, (a i ,b i ) is calculated as follows: n-dimensional vector a i Generate n-dimensional vector x i Generate n-dimensional vector b i = Sr × a i +x i Calculate 1 or more (a i ,b i ) is the encrypted registered keyword, In the data search process, as the encryption of the search keyword, a processor of any one of the one or more data user terminals: Calculating the pseudorandom function using a secret key K and the registered keyword to obtain a value Ss; By doing the following one or more times, (cj ,d j ) is calculated as follows: n-dimensional vector c j Generate n-dimensional vector y j Generate n-dimensional vector d j =Ss T ×c j +y j Calculate 1 or more (c j ,d j ) as the encrypted search keyword, In the data search process, the processor of the data management server searches for the encrypted registered keyword by: selecting at least one encrypted registered keyword from a population, wherein the population is all or a portion of the one or more encrypted registered keywords stored in a memory resource of the data management server; For each of the selected encrypted registration keywords: 1 or more (a i ,b i ), One or more (c j ,d j ), The selected (a i ,b i ) and one or more selected from the encrypted search keywords (c j ,d j ) and a i ·d j -b i ·c j Determine whether it is within a predetermined range, If the determination is outside the range, it is determined that the registered keyword corresponding to the selected encrypted registered keyword and the search keyword corresponding to the encrypted search keyword do not match.

[0009] In a second example, to obtain the public parameters and the private key in the pre-processing, a processor of any one of the one or more data user terminals: The elements of the public parameters are p, G0, G1, G T ,g0,g1,e, where: p is a prime number, G0, G1, G T is a cyclic group of order p, g0 is the generator of G0, g1 is the generator of G1, e has a domain of G0×G1 and a range of G T Asymmetric pairing function, and In the data registration process, as encryption of the registration keyword, any processor of the one or more data user terminals: calculating a pseudorandom function using the private key and the registered keyword to obtain a value s; Randomly select an integer a between 0 and p-1, c=g0 a and d=c s Calculate (c, d) are the encrypted registered keywords, In the data search process, as the encryption of the search keyword, a processor of any one of the one or more data user terminals: Randomly select an integer b between 0 and p-1, t=g1 b and u=t s Calculate (t, u) is the encrypted search keyword, In the data search process, the processor of the data management server searches for the encrypted registered keyword by: selecting at least one encrypted registered keyword from a population, wherein the population is all or a portion of the one or more encrypted registered keywords stored in a memory resource of the data management server; For each of the selected encrypted registration keywords: Calculating e(c,u) and e(d,t) for (c,d) of the selected encrypted registered keyword and (t,u) of the encrypted search keyword; If e(c, u) and e(d, t) match, it is determined that the registered keyword corresponding to the selected encrypted registered keyword matches the search keyword corresponding to the encrypted search keyword. [Effects of the Invention]

[0010] According to one aspect of the present invention, it is possible to improve the processing speed of a secure search system and method, and according to another aspect of the present invention, it is possible to improve the probabilistic security of search keywords and registered keywords of a secure search system.

[0011] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a block diagram showing an example of the configuration of a secure search system according to an embodiment; [Figure 2] FIG. 2 is a block diagram illustrating an example of the configuration of a data management server according to the embodiment. [Figure 3] FIG. 2 is a block diagram showing an example of the configuration of a data user terminal in an embodiment. [Figure 4] 10A to 10C are sequence diagrams illustrating an example of a pre-processing, a data registration process, and a data search process in the embodiment. [Figure 5] 10 is a flowchart showing details of step S104 in procedure example 1. [Figure 6] 10 is a flowchart showing details of step S104 in procedure example 1. [Figure 7] 10 is a flowchart showing details of step S107 in procedure example 1. [Figure 8] 10 is a flowchart showing details of step S110 in procedure example 1. [Figure 9] 10 is a flowchart showing details of step S101 in procedure example 2. [Figure 10] 10 is a flowchart showing details of step S104 in procedure example 2. [Figure 11] 10 is a flowchart showing details of step S107 in procedure example 2. [Figure 12] 10 is a flowchart showing details of step S110 in procedure example 2. DETAILED DESCRIPTION OF THE INVENTION

[0013] The present embodiment will be described in more detail below with reference to the accompanying drawings. In the embodiments, the same components are generally designated by the same reference numerals, and repeated description will be omitted.

[0014] <Common system configuration, function configuration, hardware configuration> <<System-wide>> Figure 1 is a block diagram showing an example of the configuration of a confidential search system. The confidential search system is a system that encrypts collected data, performs searches without decrypting the encrypted data, and uses the data that is found in the search.

[0015] The confidential search system includes, for example, a data management server 100 installed in a data center or the like, and a data user terminal 200 used by a data user, which are connected via a network 300 such as the Internet and are in a state where they can communicate with each other. Note that there may be multiple data user terminals 200. For example, the data user terminals 200 may be separated into a data user terminal 200 for registration and a data user terminal 200 for search.

[0016] <<Data management server>> 2 is a block diagram showing an example of the configuration of the data management server 100. The data management server 100 is configured by a computer having a CPU (Central Processing Unit) 110, a memory 150, an auxiliary storage device 120, an input device 101, an output device 102, and a communication device 103.

[0017] The CPU 110 is an example of a processor, and executes programs stored in the memory 150. The memory 150 includes a ROM (Read Only Memory), which is a nonvolatile storage element, and a RAM (Random Access Memory), which is a volatile storage element. The ROM stores unchanging programs (e.g., a BIOS (Basic Input / Output System)). The RAM is a high-speed, volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by the CPU 110 and data used when the programs are executed. The memory 150 may also include a rewritable nonvolatile memory such as a PRAM (Phase-change Random Access Memory) or an MRAM (Magnetoresistive Random Access Memory).

[0018] The auxiliary storage device 120 is a large-capacity, non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or a flash memory (SSD (Solid State Drive)), and stores programs executed by the CPU 110 and data used when the programs are executed. That is, the programs are read from the auxiliary storage device 120, loaded into the memory 150, and executed by the CPU 110. Note that in this specification, memory and / or auxiliary storage devices, which are broadly regarded as a memory hierarchy, may be more broadly referred to as memory resources.

[0019] The input device 101 is a device such as a keyboard or mouse that receives input from an operator. The output device 102 is a device such as a display device or printer that outputs the results of program execution in a format that can be viewed by the operator. The input device 101 and / or the output device 102 are sometimes broadly referred to as user interface devices.

[0020] The communication device 103 is a network interface device that controls communication with an external device according to a predetermined protocol. The communication device 103 may also include a serial interface such as a USB (Universal Serial Bus). The communication device 103 may also be a NIC (Network Interface Card) or a communication circuit.

[0021] Some or all of the programs executed by CPU 110 may be provided to the data management server 100 via a network from removable media (CD-ROM, flash memory, etc.), which are non-transitory storage media, or from an external computer equipped with a non-transitory storage device, and stored in non-volatile auxiliary storage device 120, which is also a non-transitory storage medium. For this reason, the data management server 100 should preferably have an interface for reading data from removable media. The same applies to the data user terminal 200. Note that the programs executed by CPU 110 and CPU 210 may be stored together in a common non-transitory storage medium. Conversely, each program may be stored in a separate non-transitory storage medium.

[0022] The data management server 100 is a computer system that is configured on one physical computer or on multiple logically or physically configured computers, and may run on separate threads on the same computer, or on a virtual computer built on multiple physical computer resources. The same applies to the data user terminal 200.

[0023] The CPU 110 includes, for example, a server-side confidential search unit 111S, which is a functional unit. The server-side confidential search unit 111S performs processing necessary for a confidential search, such as a search targeting the encrypted registered keywords 131. For example, the CPU 110 functions as the server-side confidential search unit 111S by operating in accordance with a server-side search processing program loaded into the memory 150 (that is, the server-side confidential search unit 111S does not need to be physically included in the CPU 110).

[0024] Note that some or all of the functions of the functional units included in the CPU 110 and the CPU 210 of the data user terminal 200 may be realized by hardware such as a GPU (Graphics Processing Unit) (an example of a processor), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array). In other words, a process that has a functional unit realized by a CPU as its subject may have the CPU (processor) as its subject, or may have the data user terminal 200 or data management server 100 that includes the CPU as its subject.

[0025] The auxiliary storage device 120 includes, for example, a ciphertext storage unit 130 and a public parameter storage unit 140, both of which are areas for storing data. The ciphertext storage unit 130 stores encrypted registered keywords 131 collected from the data user terminals 200. The public parameter storage unit 140 stores public parameters 141 required for processing by the server-side confidential search unit 111S.

[0026] In addition, some or all of the information stored in the auxiliary storage device 120 and the auxiliary storage device 220 of the data user terminal 200, which will be described later, may be stored in memory 150 and memory 250, respectively, or may be stored in an external database or external auxiliary storage device connected to the server or terminal.

[0027] <<Data User Terminal 200>> 3 is a block diagram showing an example of the configuration of the data user terminal 200. The data user terminal 200 is configured by a computer having a CPU 210, memory 250, auxiliary storage device 220, input device 201, output device 202, and communication device 203, for example.

[0028] The hardware description of the CPU 210, memory 250, auxiliary storage device 220, input device 201, output device 202, and communication device 203 is omitted here because it is the same as the hardware description of the CPU 110, memory 150, auxiliary storage device 120, input device 101, output device 102, and communication device 103. As partially explained above, other computer features of the data user terminal 200 may also be the same as the features of the data management server 100.

[0029] The CPU 210 includes a terminal-side confidential search unit 111T, which is a functional unit. The terminal-side confidential search unit 111T includes, for example, a data search unit 211, a data registration unit 212, and a pre-processing unit 213, which are all functional units. The data registration unit 212 is responsible for data user terminal-side processing related to data registration during the confidential search process. One example of this is generating an encrypted registration keyword 242 corresponding to a registration keyword 241. The data search unit 211 is responsible for data user terminal-side processing related to data search during the confidential search process. One example of this is generating an encrypted search keyword 244 corresponding to a search keyword 243 input via the input device 201. The pre-processing unit 213 is responsible for terminal-side pre-processing before data registration during the confidential search process. One example of this is generating a public parameter 231 and a private key 232. The data management server 100-side processing corresponding to these processes is handled by the server-side confidential search unit 111S described above.

[0030] The processing allocation among the components within the terminal-side secure search unit 111T is merely an example, and other components may share the processing. The CPU 210 functions as the terminal-side secure search unit 111T by operating in accordance with a terminal-side secure search program loaded into the memory 250 (i.e., the terminal-side secure search unit 111T does not need to be physically included in the CPU 210). The terminal-side secure search program may be divided into subprograms corresponding to the allocation of the corresponding functional components. That is, the data search unit 211 may be realized by the CPU 210 executing a terminal-side secure search (data search) program loaded into memory. Similarly, the data registration unit 212 may be realized by the CPU 210 executing a terminal-side secure search (data registration) program loaded into memory. Similarly, the pre-processing unit 213 may be realized by the CPU 210 executing a terminal-side secure search (pre-processing) program loaded into memory.

[0031] The auxiliary storage device 220 includes a key storage unit 230 and a data storage unit 240, both of which are areas for storing data. The key storage unit 230 stores public parameters 231 and a private key 232 generated by the pre-processing unit 213. The data storage unit 240 stores registered keywords 241, encrypted registered keywords 242 generated by the data registration unit 212, search keywords 243, and encrypted search keywords 244 generated by the data search unit 211. Note that the data described above as being included in the data storage unit 240 can also be considered as temporarily generated data, and therefore may be stored in memory 250 instead of the auxiliary storage device 220. The storage destination of the public parameters 231 and the private key 232 may be changed to memory 250 (for example, when the use of other security technologies makes it unnecessary to store these data in the auxiliary storage device).

[0032] <Overview: From pre-processing to data registration and search processing> Figure 4 is a sequence diagram showing an example of the process of generating and distributing public parameters and private keys by the data user terminal 200 (steps S101 to S103, hereinafter collectively referred to as pre-processing), the process of encrypting and transmitting registered keywords by the data user terminal 200 (steps S104 to S106, hereinafter collectively referred to as data registration processing), the process of generating and transmitting encrypted search keywords by the data user terminal 200, and the confidential search processing by the data management server 100 (steps S107 to S112, hereinafter collectively referred to as data search processing).

[0033] The data registration process and data search process can be executed at any time after the pre-processing is completed, and can be executed any number of times. For example, in a use case where data registration is performed continuously while searching as needed, the data registration process is executed multiple times. In addition, the data search process is executed in parallel with the data registration.

[0034] Pre-processing may be performed at a time other than the initial timing of the confidential search system (i.e., system initialization). For example, this may be the case when it becomes necessary to update the private key or public parameters. In another example, if there are multiple user groups that wish to perform confidential searches, pre-processing for each group can be performed by the data user terminal 200(s) and data management server 100 used by each group. Therefore, when viewed as a confidential search system, pre-processing may be performed multiple times.

[0035] For simplicity, the following explanation will be given assuming that one data user terminal 200 is responsible for both data registration and data search. However, this embodiment can also be applied to cases where the data user terminal 200 responsible for data registration and the data user terminal 200 responsible for data search are separate terminals. This case may be referred to hereinafter as "multiple terminal use." When multiple terminals are used, the public parameters and private key described below must be shared between the terminals.

[0036] <<Pre-processing>> The pre-processing unit 213 of the data user terminal 200 generates public parameters and a private key, stores the generated public parameters as public parameters 231 in the key storage unit 230, and stores the generated private key as private key 232 in the key storage unit 230 (S101). Details of the process of generating the public parameters and private key in step S101 will be described later using Figures 5 and 9.

[0037] 4, the data user terminal 200 generates the public parameters, but the public parameters may be generated by the data management server 100 or a device external to the confidential search system (e.g., a computer). Therefore, the data user terminal 200 can also be interpreted as acquiring the public parameters. Furthermore, in the case of the "multiple terminals used" described above, instead of generating a private key, the data user terminal 200 may receive a private key generated by another data user terminal 200.

[0038] The pre-processing unit 213 transmits the public parameters generated in step S101 to the data management server 100 (S102). The server-side secure search unit 111S of the data management server 100 receives the public parameters from the data user terminal 200 and stores the received public parameters as public parameters 141 in the public parameter storage unit 140 (S103). In the case of the aforementioned "multiple terminal use," only the representative terminal of the multiple terminals needs to perform the transmission in step S102. In the following description, a request (including at least the public parameters) to store the public parameters in the data management server 100 may be referred to as a pre-processing request. Note that pre-processing may be executed as part of other processing (for example, initialization of a database management system or table creation), and may include pre-processing other than the secure search processing described above.

[0039] <<Data registration process>> The data registration unit 212 of the data user terminal 200 encrypts the registered keyword 241 stored in the data storage unit 240 using the public parameters 231 and the private key 232 to generate an encrypted registered keyword 242 (S104). This generation uses probabilistic encryption. Details of the process of generating the encrypted registered keyword 242 in step S104 will be described later using Figures 6 and 10. It is assumed that, before step S104, the CPU 210 of the data user terminal 200 acquires the registered keyword (including the meaning of being generated by the CPU 210 or received via the input device 201) and stores it in the data storage unit 240 as the registered keyword 241.

[0040] The data registration unit 212 of the data user terminal 200 transmits the encrypted registration keyword 242 generated in step S104 to the data management server 100 (S105).

[0041] The server-side confidential search unit 111S of the data management server 100 receives the encrypted registration keywords from the data user terminal 200 and stores the received encrypted registration keywords in the ciphertext storage unit 130 as encrypted registration keywords 131 (S106). In the following description, a request (including at least one or more encrypted registration keywords) to store the encrypted registration keywords in the data management server 100 may be referred to as a data registration request. The data registration process may be executed as part of another process (for example, a data registration command (INSERT) in a database management system), or may include additional processing associated with registration as part of the process, or may include processing other than the confidential search processing described above.

[0042] <<Data search processing>> The data search unit 211 of the data user terminal 200 acquires the search keywords, which are keywords to be searched, and stores them in the data storage unit 240 as search keywords 243 (S107). Examples of "acquiring" include receiving a user input via the input device 201 and generating a search keyword through processing within the data user terminal 200.

[0043] Next, the data search unit 211 generates an encrypted search keyword 244 corresponding to the search keyword 107 acquired in step S107 (S108) and transmits it to the data management server 100 (S109). Probabilistic encryption is used for this generation. Details of the encrypted search keyword generation process in step S108 will be described later using FIGS. 7 and 11. In the following description, a request (including at least one or more encrypted search keywords) that causes the data management server 100 to perform a search using the encrypted search keywords may be referred to as a data search request.

[0044] The server-side confidential search unit 111S of the data management server 100 searches the encrypted registered keywords 131 stored in the ciphertext storage unit 130 using the encrypted search keyword and public parameters 141 received from the data user terminal 200. The server-side confidential search unit 111S then generates search result data based on the search results (S110). Next, the server-side confidential search unit 111S transmits the search result data to the data user terminal 200 (S111). An example of the search result data is the number of encrypted registered keywords that match the encrypted search keyword. Details of the search process in step S110 will be described later using FIGS. 8 and 12.

[0045] The data search unit 211 of the data user terminal 200 receives the search result data from the data management server 100 and uses the search result data (S112). One example of such use is to display the number of hits to the user via the output device 202. Note that the data search process may be executed as part of another process (for example, a data entry command (INSERT) in a database management system), or may include additional processes associated with the search as part of the process, and may include processes other than the confidential search processes described above.

[0046] This concludes the explanation of Figure 4. In the following explanation, two example procedures will be explained as details of the processing in Figure 4. Although not explained further below, the values ​​that temporarily exist during the processing of steps S101, S104, S108, and S110 are values ​​that exist in the middle of the processing, that is, intermediate values. These intermediate values ​​may typically be deleted after each step is completed, but may not need to be deleted if they have other uses. Note that a set of multiple values ​​may be expressed using "(" and ")".

[0047] <Procedure Example 1> 5 to 8 are flowcharts showing an example of specific procedures in steps S101, S104, S108, and S110.

[0048] <<Details of Step S101>> 5 is a flowchart showing the details of the procedure (S101) in which the pre-processing unit 213 of the data user terminal 200 generates the public parameters 231 and the private key 232. Each step will be explained below.

[0049] The pre-processing unit 213 generates a random bit string K (S201). The length of K is determined based on a predetermined security level.

[0050] The pre-processing unit 213 calculates public parameters p, G0, G1, G2, G3 according to the required security level. T , g0, g1, and e are determined or calculated (collectively referred to as "obtain") (S202), where: p is a prime number, G0, G1, G T is a cyclic group of order p, g0 is the generator of G0, g1 is the generator of G1, e has a domain of G0×G1 and a range of G T Asymmetric pairing function, Let's say.

[0051] The pre-processing unit 213 calculates the public parameters (p, G0, G1, GT , g0, g1, e) and the private key K are stored in the key storage unit 230 (S203).

[0052] <<Details of Step S104>> 6 is a flowchart showing the details of the procedure (S104) in which the data registration unit 212 of the data user terminal 200 encrypts the registered keywords using the public parameters 231 and the private key 232 with the confidential search technology. Each step will be explained below.

[0053] The data registration unit 212 calculates the value s=F(K, w) of a predetermined pseudorandom function F using the registered keyword w and the secret key K (S301), where the range of F is an integer between 0 and p-1.

[0054] The data registration unit 212 randomly extracts an integer a between 0 and p-1 (S302), and a and d=c s is calculated (S303).

[0055] The data registration unit 212 stores (c, d) as an encrypted registered keyword in the data storage unit 240 (S304). Note that the encrypted registered keyword does not necessarily have to be permanently stored in the data storage unit 240. The encrypted registered keyword may also be stored in the memory 250 instead of the data storage unit 240. In other words, the encrypted registered keyword may be stored in a memory resource.

[0056] <<Details of Step S107>> 7 is a flowchart showing the details of the procedure (S107) in which the data search unit 211 of the data user terminal 200 creates an encrypted search keyword from a search keyword using the public parameters 231 and the private key 232. Each step will be explained below.

[0057] The data search unit 211 calculates the value s=F(K, w) of a predetermined pseudorandom function F using a search keyword w and a secret key K (S401).

[0058] The data search unit 211 randomly extracts an integer b between 0 and p-1 (S402), and b and u=t s is calculated (S403).

[0059] The data search unit 211 stores (t, u) as an encrypted search keyword in the data storage unit 240 (S404).

[0060] <<Details of Step S110>> 8 is a flowchart showing the details of the procedure (S110) in which the server-side confidential search unit 111S of the data management server 100 searches one or more encrypted registered keywords 131 stored in the ciphertext storage unit 130 using the public parameters 141 and the encrypted search keyword received from the data user terminal 200. Each step will be explained below.

[0061] The server-side confidential search unit 111S executes the processes of steps S502 to S504 for each encrypted registered keyword 131 stored in the ciphertext storage unit 130 (S501).

[0062] The server-side confidential search unit 111S calculates e(c, u) and e(d, t) for the encrypted registration keyword (c, d) and the encrypted search keyword (t, u) (S502).

[0063] If the server-side confidential search unit 111S determines that e(c,u) and e(d,t) match (S503: YES), it determines that the keywords match (S503) and adds the corresponding encrypted registered keyword to the hit data (S504). More precisely, "keyword match" refers to a match between a registered keyword corresponding to the encrypted registered keyword and a search keyword corresponding to the encrypted search keyword. An example of adding hit data is adding an ID assigned within the data management server 100 to the encrypted registered keyword with a matching keyword to the hit data. If the number of hits is used as the search result, the current number of hits may be stored in the hit data. The "hit" in procedure example 1 refers to the aforementioned "keyword match."

[0064] If the server-side confidential search unit 111S determines that e(c, u) and e(d, t) do not match (S503: NO), it determines that the keywords do not match, and does not execute the processing of step S504.

[0065] The server-side confidential search unit 111S performs the processes of steps S502 to S504 for all encrypted registered keywords 131 (S505), and then generates search results based on the hit data (S506). An example of generating search results is counting the number of hits.

[0066] <<Effect of Procedure Example 1>> Below, we will explain how procedure example 1 is superior in processing speed to conventional techniques and also ensures the probabilistic safety of search keywords.

[0067] For the purposes of this explanation, it is assumed that the encrypted registered keyword (c, d) is generated from the registered keyword w, and the encrypted search keyword (t, u) is generated from the search keyword w'. F(K, w) is written as s, and F(K, w') is written as s'.

[0068] In the process of step S503, if w and w' are the same, e(c, u)=e(g0 a ,g1bs ) and e(d,t)=e(g0 as ,g1 b )

[0069] The asymmetric pairing function is e(g0 x ,g1 y )=e(g0,g1) xy Therefore, e(g0 a ,g1 bs )=e(g0,g1) abs =e(g0 as ,g1 b ) holds. That is, the server-side secure search unit 111S makes a correct determination (S503: YES).

[0070] If w and w' are different, e(c,u)=e(g0,g1) abs and e(d,t)=e(g0,g1) abs' Since s and s' are different values, e(c, u) and e(d, t) are also different. Therefore, the server-side confidential search unit 111S makes a correct determination (S503: NO).

[0071] In the pairing-based method described in Non-Patent Document 1, when two encrypted search keywords are given, it is possible to determine whether the two were generated from the same search keyword, which reduces probabilistic security. The method of Procedure Example 1 cannot make such a determination, and therefore has higher probabilistic security than the method of Non-Patent Document 1.

[0072] Furthermore, in Procedure Example 1, the size of the encrypted registered keyword is more compact than in Non-Patent Document 1. In the method of Non-Patent Document 1, the encrypted registered keyword is a set of three group elements, whereas in Procedure Example 1, the encrypted registered keyword is a set of two group elements, which improves processing speed.

[0073] <Procedure Example 2> Next, a description will be given of Procedure Example 2. Figures 9 to 12 are flowcharts showing an example of specific procedures in steps S101, S104, S108, and S110.

[0074] <<Details of Step S101>> 9 is a flowchart showing the details of the procedure (S101) in which the pre-processing unit 213 of the data user terminal 200 generates the public parameters 231 and the private key 232. Each step will be explained below.

[0075] The pre-processing unit 213 generates a random bit string K (S601). The length of K is determined based on a predetermined security level.

[0076] The pre-processing unit 213 determines or calculates (collectively referred to as "obtain") public parameters q, n, α, and β according to the required security level (S602), where q, n, α, and β are all positive integers.

[0077] The pre-processing unit 213 outputs the public parameters (q, n, α, β) and the private key K (S603).

[0078] <<Details of Step S104>> 10 is a flowchart showing the details of the procedure (S104) in which the data registration unit 212 of the data user terminal 200 encrypts the registered keywords using the public parameters 231 and the private key 232 with the confidential search technology. Each step will be explained below.

[0079] The data registration unit 212 calculates the value S=F(K, w) of a predetermined pseudorandom function F using the registered keyword w and the secret key K (S701). Note that the range of F is assumed to be included in the entire n×n matrix in which each component is an integer between 0 and p-1.

[0080] The data registration unit 212 performs the processes from step S703 to step S705 for i=1, . . . , α in order (S702).

[0081] The data registration unit 212 stores a short n-dimensional vector a i are randomly extracted so that each component is either 0 or 1 (S703).

[0082] The data registration unit 212 stores a short n-dimensional vector x i is randomly sampled from, for example, a discrete Gaussian distribution (S704).

[0083] The data registration unit 212 registers an n-dimensional vector b i =Sa i +x i is calculated (S705).

[0084] The data registration unit 212 performs the processes from step S702 to step S705 for all i (S706), and then i ,b i ) i=1,…,α is output as an encrypted registered keyword (S707).

[0085] <<Details of Step S107>> FIG. 11 is a flowchart showing the details of the procedure (S108) in which the data search unit 211 of the data user terminal 200 uses the public parameters 231 and the private key 232 to create an encrypted search keyword from the search keyword.

[0086] The data search unit 211 calculates the value S=F(K, w) of a predetermined pseudorandom function F using a search keyword w and a secret key K (S801).

[0087] The data search unit 211 performs the processes from step S803 to step S805 for j=1, . . . , β in order (S802).

[0088] The data search unit 211 searches for an n-dimensional vector c j are randomly extracted so that each component is either 0 or 1 (S803). jIn this embodiment, the "vector with a small norm" is, for example, a vector whose absolute value of each component is √q.

[0089] The data search unit 211 searches for a short n-dimensional vector y j is randomly sampled from, for example, a discrete Gaussian distribution (S804).

[0090] The data search unit 211 searches for an n-dimensional vector d j =S T c j +y j is calculated (S805).

[0091] The data search unit 211 performs the processes from step S802 to step S805 for all j (S806), and then j ,d j ) j=1,…,β is stored as an encrypted search keyword in the data storage unit 240 (S807).

[0092] <<Details of Step S110>> 12 is a flowchart showing the details of the procedure (S110) in which the server-side confidential search unit 111S of the data management server 100 searches one or more encrypted registered keywords 131 stored in the ciphertext storage unit 130 using the public parameters 141 and the encrypted search keyword received from the data user terminal 200. Each step will be explained below.

[0093] The server-side confidential search unit 111S executes the processes of steps S902 to S906 for each encrypted registered keyword 131 stored in the ciphertext storage unit 130 (S901).

[0094] The server-side confidential search unit 111S executes the processes of steps S903 and S904 for each pair of i=1, . . . , α and j=1, .

[0095] The server-side confidential search unit 111S i ·d j -bi ·c j (S903) and determines whether it is within a predetermined range. The predetermined range may be, for example, a range of -q / 4 to q / 4.

[0096] If the server-side confidential search unit 111S determines that the next (i, j) is within the predetermined range (S904: YES), the process proceeds to step S903 for the next (i, j). If the next (i, j) does not exist, the process proceeds to step S905.

[0097] If the server-side secure search unit 111S determines that the value is not within the predetermined range (S904: NO), it exits from Loop 2 and proceeds to the next step without performing the process of step S906.

[0098] If the result of the branch at step S904 is YES for all (i, j), the server-side confidential search unit 111S ends loop 2 (S905) and adds the corresponding encrypted registered keyword to the hit data (S906). An example of adding hit data is adding an ID assigned to the corresponding encrypted registered keyword to the hit data. If the number of hits is used as the search result, the current number of hits may be stored in the hit data.

[0099] Here, "hit" in procedure example 2 means that "the registered keyword corresponding to the encrypted registered keyword and the search keyword corresponding to the encrypted search keyword were not determined to be inconsistent."

[0100] The server-side confidential search unit 111S performs the processes of steps S902 to S906 for all encrypted registered keywords 131 (S907), and then generates search results based on the hit data (S908). An example of generating search results is counting the number of hits.

[0101] <<Effect of Procedure Example 2>> Below, we will explain how procedure example 2 is superior in processing speed to conventional techniques and also ensures the probabilistic safety of search keywords.

[0102] For the purposes of this explanation, it is assumed that the encrypted registered keyword (c, d) is generated from the registered keyword w, and the encrypted search keyword (t, u) is generated from the search keyword w'. F(K, w) is written as S, and F(K, w') is written as S'.

[0103] In step S904, if w and w' are the same, a i ·d j -b i ·c j =a i ·(S T c j +y j )-(Sa i +x i )·c j =a i ·y j -x i ·c j It becomes. a i ,y j ,x i ,c j are vectors with small norms, so a i ·y j -x i ·c j When is regarded as an integer in the range from -q / 2 to q / 2, its absolute value is close to 0. Therefore, the server-side confidential search unit 111S makes a correct determination (S904: YES).

[0104] In step S904, if w and w' are different, i ·d j -b i ·c j takes an almost random value. Therefore, for example, if the determination range is (-q / 4, q / 4), the branch in step S904 proceeds to YES with a 1 / 2 probability and to NO with a 1 / 2 probability. Therefore, the server-side confidential search unit 111S can make a correct determination (S904: NO) by going through the process of step S904 for a sufficient number of (i, j).

[0105] In the method of procedure example 2, as in procedure example 1, it is not possible to determine whether the encrypted search keywords match, and therefore probabilistic security is high.

[0106] Furthermore, Procedure Example 2 does not use the complex sampling algorithm used in the lattice-based method of Non-Patent Document 1, but is composed of only simple vector and matrix operations. Therefore, Procedure Example 2 has improved processing speed compared to the lattice-based method of Non-Patent Document 1.

[0107] <Variation of Step 2> The above describes procedure example 2, but the following variations of procedure example 2 are possible.

[0108] For one search keyword w, the encrypted search keyword (c j ,d j ) does not need to be generated multiple times. Also, for one registered keyword w, i ,b i ) does not need to be generated multiple times. The reason for generating multiple pieces of these two pieces of information is to reduce the possibility of false match judgments, which mistakenly judge that the encrypted keyword and the registered keyword match, as described above (note that procedure example 2 does not perform false mismatch judgments). When procedure example 2 is used as a pre-check for another secure search technology (more preferably a secure search technology that maintains the probabilistic security of the search keyword, for example procedure example 1), the number of encrypted search keywords (c j ,d j ) and encrypted registration keywords (a i ,b i ) may be generated, or may be generated as 1. Also, if the possibility of false matches can be reduced to an acceptable level by combining it with other theories, the number of generated numbers may be reduced to 1.

[0109] Encryption registration keyword (a i ,b i ) and encrypted search keywords (c j ,dj ) can be polynomials with integer coefficients instead of simple integers. For example, we can consider each component as a polynomial in the remainder ring Z q [X] / (X N +1) can be taken as an element of a i and c j Each component of is a polynomial with small coefficients. In this case, a i ·d j -b i ·c j is Z q [X] / (X N +1), and by making a judgment on N coefficients, the possibility of a false match can be sufficiently reduced even if the number of generated coefficients is 1.

[0110] <Variations common to Procedure Example 1 and Procedure Example 2> The following variations of Procedure Example 1 and Procedure Example 2 are possible.

[0111] <<Introducing a data object containing encrypted registration keywords>> The data management server 100 may store the encrypted registered keyword 131 as a set with other values ​​(for convenience, referred to as a data object). The "other values" may be encrypted (one example is a non-private search technology such as AES (Advanced Encryption Standard) if they are not subject to search conditions), or may be in plain text. An example of a data object is a record in a database management system, which is a data object expressed in a key-value format such as a JSON (JavaScript (registered trademark) Object Notation) file.

[0112] <<Data search request other than the number of hits>> The search result data, which is a response to a data search request, may contain the following data in addition to the number of hits: *Hit or not. *Statistics, including hit counts. *The hit encrypted registration keyword itself.

[0113] <<Search accompanying data processing request>> The data search process shown in Figure 4 can be applied not only to pure data searches, but also to requests for specific processing that accompanies a data search (referred to as a search-accompanying data processing request in this description). An example of a search-accompanying data processing request is as follows: * Delete the hit encrypted registered keyword, delete request with search criteria attached, *A move request with search criteria attached to move the encrypted registered keywords that were hit.

[0114] An example of such a migration is when the data management server 100 includes multiple auxiliary storage devices 120 (which differ in performance and cost) and data is migrated between the auxiliary storage devices 120 to optimize cost and performance. Another example of migration is load leveling by migrating data between multiple computers included in the data management server 100.

[0115] <<Search accompanying data processing request accompanied by record introduction, etc.>> When introducing the aforementioned data objects (records, JSON data objects, etc.), the following examples are possible for the search accompanying data processing request and the processing by the data management server 100. Note that the "data object" described below is a data object that includes the hit encrypted registered keyword: * The "other values" included in the data object are sent to the data user terminal 200 as search result data. *Insert, update, or delete "other values" contained in the data object. *Update and delete the data object itself. * The statistical values ​​calculated for the "other values" included in the data object are sent to the data user terminal 200 as search result data.

[0116] <<Data search processing request accompanied by the introduction of records, etc.>> When introducing the aforementioned data objects (records, JSON data objects, etc.), a condition of "other values" may be specified in addition to the encrypted search keywords in the data search processing request. As a preliminary step to the data search processing described above, the data management server 100 can use the condition of "other values" to narrow down the encrypted registered keywords 131 that form the population for looping in step S501 of Fig. 8 and step S901 of Fig. 12.

[0117] <<Reducing the number of loops in step S501 of FIG. 8 and step S901 of FIG. 12>> In addition to the above-mentioned "other values" condition, it is also possible to reduce the number of loops in step S501 of Fig. 8 and step S901 of Fig. 12 (meaning that the number of loops is made less than the number of encrypted registered keywords stored in the auxiliary storage device 120 of the data management server 100) depending on the type of search result data to be returned. For example, if the above-mentioned "presence or absence of a hit" is to be included in the search result data, the loop in step S501 may be ended the first time that the conditional branch in step S503 of Fig. 8 returns "Yes." Similarly, the loop in step S901 may be ended the first time that step S906 of Fig. 12 is reached.

[0118] <Summary> The above description has explained the following:

[0119] <<Viewpoint 1>> A confidential search system having a data management server and one or more data user terminals, As a pre-processing step, a processor of any one of the one or more data user terminals: Obtain the public parameters and the private key K, Sending the public parameters to the data management server; As a data registration process, a processor of one of the one or more data user terminals: Acquire a registration keyword, which is data to be registered in the data management server; Encrypting the registered keyword into an encrypted registered keyword using the public parameters, a private key K, and a probabilistic encryption; transmitting the encrypted registration keyword to the data management server as a data registration request; As a data retrieval process, a processor of any one of the one or more data user terminals: Get the search keywords, encrypting the search keyword into an encrypted search keyword using the public parameters, a private key K, and a probabilistic cipher; Transmitting the encrypted search keyword to the data management server as a data search request or a search-related data processing request; As the data retrieval process, the processor of the data management server: searching for the encrypted registered keyword stored in a memory resource of the data management server using the encrypted search keyword and the public parameters; generating search result data based on the results of the search; The search result data is transmitted.

[0120] where: To obtain the public parameters and the private key in the pre-processing, a processor of any one of the one or more data user terminals: Randomly generate a private key K, The public parameters are obtained as elements of q, n, α, and β, where q, n, α, and β are all positive integers; In the data registration process, the processor of any one of the one or more data user terminals encrypts the registration keyword by: a value Sr is obtained by calculating a pseudorandom function using a private key K and the registered keyword, wherein the pseudorandom function is a function that outputs an n×n matrix, each element of which is an integer between 0 and q−1; By doing the following one or more times, (a i ,b i ) is calculated as follows: n-dimensional vector a i Generate n-dimensional vector x i Generate n-dimensional vector b i = Sr × a i +x i Calculate 1 or more (a i ,b i ) is the encrypted registered keyword.

[0121] In the data search process, as the encryption of the search keyword, a processor of any one of the one or more data user terminals: Calculating the pseudorandom function using a secret key K and the registered keyword to obtain a value Ss; By doing the following one or more times, (c j ,d j ) is calculated as follows: n-dimensional vector c j Generate n-dimensional vector y j Generate n-dimensional vector d j =Ss T ×c j +y j Calculate 1 or more (c j ,d j ) as the encrypted search keyword, In the data search process, the processor of the data management server searches for the encrypted registered keyword by: selecting at least one encrypted registered keyword from a population, wherein the population is all or a portion of the one or more encrypted registered keywords stored in a memory resource of the data management server; For each of the selected encrypted registration keywords: 1 or more (a i ,b i ), One or more (c j ,d j ), The selected (a i ,b i) and one or more selected from the encrypted search keywords (c j ,d j ) and a i ·d j -b i ·c j Determine whether it is within a predetermined range, If the determination is outside the range, it is determined that the registered keyword corresponding to the selected encrypted registered keyword and the search keyword corresponding to the encrypted search keyword do not match.

[0122] <<Perspective 2>> The confidential search system may be: The data search request or the search-associated data processing request is a request that causes the data management server to perform at least one of the following: transmitting statistics regarding the number of hits generated based on the mismatch determination; Based on the mismatch determination, the corresponding encrypted registered keyword is deleted or moved.

[0123] <<Perspective 3>> The confidential search system may be: As a data registration process, the processor of the data management server: storing the received encrypted registration keyword together with other values ​​as a data object in a memory resource of the data management server; The processor of the data management server that receives the data search request or the search-associated data processing request: selecting one or more data objects from a memory resource of the data management server based on the inconsistency determination; For the selected data object, do at least one of the following: inserting, updating, or deleting the other values ​​contained in the selected data object; updating or deleting the selected data object; A statistical value is calculated for the other values ​​contained in the selected data object.

[0124] <<Perspective 4>> The confidential search system may be: The data objects are records in a database management system or objects of key-value type.

[0125] <<Perspective 5>> A confidential search method in a confidential search system having a data management server and one or more data user terminals, As a pre-processing step, a processor of any one of the one or more data user terminals: Obtain the public parameters and the private key K, Sending the public parameters to the data management server; As a data registration process, a processor of one of the one or more data user terminals: Acquire a registration keyword, which is data to be registered in the data management server; Encrypting the registered keyword into an encrypted registered keyword using the public parameters, a private key K, and a probabilistic encryption; transmitting the encrypted registration keyword to the data management server as a data registration request; As a data retrieval process, a processor of any one of the one or more data user terminals: Get the search keywords, encrypting the search keyword into an encrypted search keyword using the public parameters, a private key K, and a probabilistic cipher; Transmitting the encrypted search keyword to the data management server as a data search request or a search-related data processing request; As the data retrieval process, the processor of the data management server: searching for the encrypted registered keyword stored in a memory resource of the data management server using the encrypted search keyword and the public parameters; generating search result data based on the results of the search; The search result data is transmitted. To obtain the public parameters and the private key in the pre-processing, a processor of any one of the one or more data user terminals: The elements of the public parameters are p, G0, G1, G T ,g0,g1,e, where: p is a prime number, G0, G1, G T is a cyclic group of order p, g0 is the generator of G0, g1 is the generator of G1, e has a domain of G0×G1 and a range of G T Asymmetric pairing function, and In the data registration process, as encryption of the registration keyword, any processor of the one or more data user terminals: calculating a pseudorandom function using the private key and the registered keyword to obtain a value s; Randomly select an integer a between 0 and p-1, c=g0 a and d=c s Calculate (c, d) are the encrypted registered keywords, In the data search process, as the encryption of the search keyword, a processor of any one of the one or more data user terminals: Randomly select an integer b between 0 and p-1, t=g1 b and u=t s Calculate (t, u) is the encrypted search keyword,

[0126] In the data search process, the processor of the data management server searches for the encrypted registered keyword by: selecting at least one encrypted registered keyword from a population, wherein the population is all or a portion of the one or more encrypted registered keywords stored in a memory resource of the data management server; For each of the selected encrypted registration keywords: Calculating e(c,u) and e(d,t) for (c,d) of the selected encrypted registered keyword and (t,u) of the encrypted search keyword; If e(c, u) and e(d, t) match, it is determined that the registered keyword corresponding to the selected encrypted registered keyword matches the search keyword corresponding to the encrypted search keyword. Confidential search method.

[0127] <<Viewpoint 6>> The confidential search method may be as follows. The data search request or the search-associated data processing request is a request that causes the data management server to perform at least one of the following: transmitting statistics regarding the number of hits generated based on the mismatch determination; Based on the mismatch determination, the corresponding encrypted registered keyword is deleted or moved.

[0128] <<Viewpoint 7>> The confidential search method may be as follows. As a data registration process, the processor of the data management server: storing the received encrypted registration keyword together with other values ​​as a data object in a memory resource of the data management server; The processor of the data management server that receives the data search request or the search-associated data processing request: selecting one or more data objects from a memory resource of the data management server based on the inconsistency determination; For the selected data object, do at least one of the following: inserting, updating, or deleting the other values ​​contained in the selected data object; updating or deleting the selected data object; A statistical value is calculated for the other values ​​contained in the selected data object.

[0129] <<Viewpoint 8>> The confidential search method may be as follows. The data objects are records in a database management system or objects of key-value type.

[0130] Each viewpoint has been explained above, but viewpoints 1 to 4 can be understood as not only systems but also methods, servers, terminals, programs that run on each device, and computer-readable storage media on which the programs are stored. Similarly, viewpoints 5 to 8 can be understood as not only methods but also systems, servers, terminals, programs that run on each device, and computer-readable storage media on which the programs are stored. [Explanation of symbols]

[0131] 100 data management server, 110 CPU, 111 search processing unit, 131 encrypted registered keyword, 141 public parameter, 150 memory, 200 data user terminal, 210 CPU, 211 terminal side search processing unit, 212 keyword encryption processing unit, 213 parameter generation processing unit, 231 public parameter, 232 private key, 241 registered keyword, 242 encrypted registered keyword, 243 search keyword, 244 encrypted search keyword, 250 memory

Claims

1. A secure search system comprising a data management server and one or more data user terminals, As a preprocessing step, the processor of any of the one or more data user terminals mentioned above shall: Obtain the public parameters and the private key K, The aforementioned public parameters are sent to the data management server. As part of the data registration process, the processor of any of the one or more data user terminals shall: The registration keyword, which is the data to be registered to the aforementioned data management server, is obtained. Using the aforementioned public parameters, the secret key K, and probabilistic cryptography, the registration keyword is encrypted into an encrypted registration keyword. As a data registration request, the encrypted registration keyword is sent to the data management server. As part of the data retrieval process, the processor of any of the one or more data user terminals is: Get search keywords, Using the aforementioned public parameters, the secret key K, and probabilistic encryption, the search keyword is encrypted into an encrypted search keyword. The encrypted search keyword is sent to the data management server as a data search request or a search-related data processing request. As part of the data retrieval process, the processor of the data management server performs the following: Using the aforementioned encrypted search keyword and the aforementioned public parameters, the encrypted registration keyword stored in the memory resources of the data management server is searched. Based on the results of the search, search result data is generated. The aforementioned search result data is transmitted, Here, In obtaining the public parameters and the private key in the aforementioned preprocessing, the processor of any of the one or more data user terminals shall: A private key K is randomly generated, The elements of the aforementioned public parameters are obtained as q, n, α, and β, where q, n, α, and β are all positive integers. As encryption of the registration keyword in the data registration process, the processor of any of the one or more data user terminals shall: The value Sr is obtained by calculating a pseudorandom function using the secret key K and the registered keyword, where the pseudorandom function is a function that outputs an n×n matrix in which each component is an integer between 0 and q-1, By performing the following one or more times, (a i ,b i Calculate 1 or more: n-dimensional vector a i Generate, n-dimensional vector x i Generate, n-dimensional vector b i =Sr×a i +x i To calculate One or more of (a i , b i ) are used as the encrypted registration keyword, As encryption of the search keyword in the data retrieval process, the processor of any of the one or more data user terminals shall: By calculating the pseudo-random function using the secret key K and the registered keyword, the value Ss is obtained. By performing the following at least once, (c j d j Calculate 1 or more: n-dimensional vector c j Generate, n-dimensional vector y j Generate, n-dimensional PED j =Ss T ×c j +y j To calculate 1 or more (c j d j ) is used as the encryption search keyword, In the data retrieval process, the processor of the data management server searches for the encrypted registration keyword: Select at least one encryption registration keyword from the population, where the population is all or part of one or more encryption registration keywords stored in the memory resources of the data management server. For each of the selected encryption registration keywords: 1 or more (a i ,b i Select ) and One or more (c) from the aforementioned encrypted search keywords j d j Select ) and The selected (a i ,b i ) and one or more selected from the above-mentioned encrypted search keywords (c j d j ) and a i ・d j -b i ・c j Determine whether it falls within the specified range. If the determination is outside the range, a mismatch determination is performed in which the registered keyword corresponding to the selected encryption registration keyword and the search keyword corresponding to the encryption search keyword are determined to be mismatched. A secure search system.

2. The confidential search system according to Claim 1, The aforementioned data search request or the aforementioned search-related data processing request is a request that causes the data management server to perform at least one of the following: The statistical values ​​regarding the number of hits generated based on the aforementioned mismatch determination are to be transmitted. Based on the aforementioned mismatch determination, delete or move the corresponding encryption registration keyword. A secure search system.

3. The confidential search system according to Claim 1, As part of the data registration process, the processor of the data management server performs the following: The received encrypted registration keyword is stored as a data object in the memory resources of the data management server along with other values. Upon receiving the aforementioned data search request or the aforementioned search-related data processing request, the processor of the data management server: Based on the aforementioned mismatch determination, one or more data objects are selected from the memory resources of the data management server. For the selected data object, do at least one of the following: Insert, update, or delete the other values ​​included in the selected data object. Update or delete the selected data object. Calculate statistical values ​​for the other values ​​included in the selected data object. A secure search system.

4. The confidential search system according to claim 3, The aforementioned data object is a record in a database management system, or an object in key-value format. A secure search system.

5. A secure search method in a secure search system having a data management server and one or more data user terminals, As a preprocessing step, the processor of any of the one or more data user terminals mentioned above shall: Obtain the public parameters and the private key K, The aforementioned public parameters are sent to the data management server. As part of the data registration process, the processor of any of the one or more data user terminals shall: The registration keyword, which is the data to be registered to the aforementioned data management server, is obtained. Using the aforementioned public parameters, the secret key K, and probabilistic cryptography, the registration keyword is encrypted into an encrypted registration keyword. As a data registration request, the encrypted registration keyword is sent to the data management server. As part of the data retrieval process, the processor of any of the one or more data user terminals is: Get search keywords, Using the aforementioned public parameters, the secret key K, and probabilistic encryption, the search keyword is encrypted into an encrypted search keyword. The encrypted search keyword is sent to the data management server as a data search request or a search-related data processing request. As part of the data retrieval process, the processor of the data management server performs the following: Using the aforementioned encrypted search keyword and the aforementioned public parameters, the encrypted registration keyword stored in the memory resources of the data management server is searched. Based on the results of the search, search result data is generated. The aforementioned search result data is transmitted, Here, In obtaining the public parameters and the private key in the aforementioned preprocessing, the processor of any of the one or more data user terminals shall: The elements of the aforementioned public parameters are p, G 0 ,G 1 ,G T ,g 0 ,g 1 , obtain e, here: p is a prime number. G 0 ,G 1 ,G T is a cyclic group of order p, g 0 is G 0 The source of generation, g 1 is G 1 The source of generation, e has a domain of G 0 ×G 1 The range of values ​​is G T Asymmetric pairing function, And, As encryption of the registration keyword in the data registration process, any of the processors of the one or more data user terminals shall: By calculating a pseudorandom function using the aforementioned secret key and the aforementioned registered keyword, a value s is obtained. Randomly select an integer a between 0 and p-1, c=g 0 a and d=c s Calculate, (c,d) are the encryption registration keywords, As encryption of the search keyword in the data retrieval process, the processor of any of the one or more data user terminals shall: Randomly select an integer b between 0 and p-1, t=g 1 b and u=t s Calculate, (t,u) is the encryption search keyword, In the data retrieval process, the processor of the data management server searches for the encrypted registration keyword: Select at least one encryption registration keyword from the population, where the population is all or part of one or more encryption registration keywords stored in the memory resources of the data management server. For each of the selected encryption registration keywords: For the selected encryption registration keyword (c,d) and the encryption search keyword (t,u), calculate e(c,u) and e(d,t). If e(c,u) and e(d,t) match, a matching check is performed to determine that the registration keyword corresponding to the selected encryption registration keyword and the search keyword corresponding to the encryption search keyword match. Confidential search methods.

6. The confidential search method according to Claim 5, The aforementioned data search request or the aforementioned search-related data processing request is a request that causes the data management server to perform at least one of the following: The statistical values ​​regarding the number of hits generated based on the aforementioned matching determination are to be transmitted. Based on the aforementioned matching determination, delete or move the corresponding encryption registration keyword. Confidential search methods.

7. The confidential search method according to Claim 5, As part of the data registration process, the processor of the data management server performs the following: The received encrypted registration keyword is stored as a data object in the memory resources of the data management server along with other values. Upon receiving the aforementioned data search request or the aforementioned search-related data processing request, the processor of the data management server: Based on the matching determination, one or more data objects are selected from the memory resources of the data management server. For the selected data object, do at least one of the following: Insert, update, or delete the other values ​​included in the selected data object. Update or delete the selected data object. Calculate statistical values ​​for the other values ​​included in the selected data object. Confidential search methods.

8. A confidential search method according to claim 7, The aforementioned data object is a record in a database management system, or an object in key-value format. Confidential search methods.

9. One or more programs that cause one or more computers to perform the confidential search method described in any one of claims 5 to 8.

10. A secure search system comprising a data management server and one or more data user terminals, As a preprocessing step, the processor of any of the one or more data user terminals mentioned above shall: Obtain the public parameters and the private key K, The aforementioned public parameters are sent to the data management server. As part of the data registration process, the processor of any of the one or more data user terminals shall: The registration keyword, which is the data to be registered to the aforementioned data management server, is obtained. Using the aforementioned public parameters, the secret key K, and probabilistic cryptography, the registration keyword is encrypted into an encrypted registration keyword. As a data registration request, the encrypted registration keyword is sent to the data management server. As part of the data retrieval process, the processor of any of the one or more data user terminals is: Get search keywords, Using the aforementioned public parameters, the secret key K, and probabilistic encryption, the search keyword is encrypted into an encrypted search keyword. The encrypted search keyword is sent to the data management server as a data search request or a search-related data processing request. As part of the data retrieval process, the processor of the data management server performs the following: Using the aforementioned encrypted search keyword and the aforementioned public parameters, the encrypted registration keyword stored in the memory resources of the data management server is searched. Based on the results of the search, search result data is generated. The aforementioned search result data is transmitted, Here, In obtaining the public parameters and the private key in the aforementioned preprocessing, the processor of any of the one or more data user terminals shall: As elements of the aforementioned public parameters, we obtain p, G 0, G 1, GT, g 0, g 1, e, where: p is a prime number. G0, G1, GT are cyclic groups of order p. g0 is the generator of G0. g1 is a generator of G1. e is an asymmetric pairing function with domain G 0 × G 1 and range GT. And, As encryption of the registration keyword in the data registration process, any of the processors of the one or more data user terminals shall: By calculating a pseudorandom function using the aforementioned secret key and the aforementioned registered keyword, a value s is obtained. Randomly select an integer a between 0 and p-1, Calculate c=g 0 a and d=cs, (c,d) are the encryption registration keywords, As encryption of the search keyword in the data retrieval process, the processor of any of the one or more data user terminals shall: Randomly select an integer b between 0 and p-1, Calculate t=g 1 b and u=ts, (t,u) is the encryption search keyword, In the data retrieval process, the processor of the data management server searches for the encrypted registration keyword: Select at least one encryption registration keyword from the population, where the population is all or part of one or more encryption registration keywords stored in the memory resources of the data management server. For each of the selected encryption registration keywords: For the selected encryption registration keyword (c,d) and the encryption search keyword (t,u), calculate e(c,u) and e(d,t). If e(c,u) and e(d,t) match, a matching check is performed to determine that the registration keyword corresponding to the selected encryption registration keyword and the search keyword corresponding to the encryption search keyword match. A secure search system.

11. The confidential search system according to claim 10, The aforementioned data search request or the aforementioned search-related data processing request is a request that causes the data management server to perform at least one of the following: The statistical values ​​regarding the number of hits generated based on the aforementioned matching determination are to be transmitted. Based on the aforementioned matching determination, delete or move the corresponding encryption registration keyword. A secure search system.

12. The confidential search system according to claim 10, As part of the data registration process, the processor of the data management server performs the following: The received encrypted registration keyword is stored as a data object in the memory resources of the data management server along with other values. Upon receiving the aforementioned data search request or the aforementioned search-related data processing request, the processor of the data management server: Based on the matching determination, one or more data objects are selected from the memory resources of the data management server. For the selected data object, do at least one of the following: Insert, update, or delete the other values ​​included in the selected data object. Update or delete the selected data object. Calculate statistical values ​​for the other values ​​included in the selected data object. A secure search system.

13. The confidential search system according to claim 12, The aforementioned data object is a record in a database management system, or an object in key-value format. A secure search system.

14. A data management server, Equipped with a processor and memory resources, Each is connected to one or more data user terminals, each having a processor and memory resources. As a preprocessing step, the processor of any of the one or more data user terminals mentioned above performs the following: The public parameters and private key K are obtained. The aforementioned public parameters are sent to the data management server. As part of the data registration process, the processor of one or more of the aforementioned data user terminals performs the following: The registration keyword, which is the data to be registered to the aforementioned data management server, is obtained. Using the aforementioned public parameters, the secret key K, and probabilistic cryptography, the registration keyword is encrypted into an encrypted registration keyword. As a data registration request, the encrypted registration keyword is sent to the data management server. As part of the data retrieval process, the processor of any of the one or more data user terminals mentioned above performs the following: Search keywords are retrieved, Using the aforementioned public parameters, the secret key K, and probabilistic cryptography, the search keyword is encrypted into an encrypted search keyword. The encrypted search keyword is sent to the data management server as a data search request or a search-related data processing request. As part of the data retrieval process, the processor of the data management server performs the following: Using the aforementioned encrypted search keyword and the aforementioned public parameters, the encrypted registration keyword stored in the memory resources of the data management server is searched. Based on the results of the search, search result data is generated. The aforementioned search result data is transmitted, Here, In the aforementioned preprocessing, the public parameters and the private key are obtained by the processor of any of the one or more data user terminals: The elements of the aforementioned public parameters are obtained as p, G 0, G 1, GT, g 0, g 1, e, where: p is a prime number. G0, G1, GT are cyclic groups of order p. g0 is the generator of G0. g1 is a generator of G1. e is an asymmetric pairing function with domain G 0 × G 1 and range GT. And, As encryption of the registration keyword in the data registration process, by the processor of one or more of the data user terminals: A pseudo-random function is calculated using the aforementioned secret key and the aforementioned registration keyword to obtain the value s. An integer a between 0 and p-1 (inclusive) is randomly selected. c=g 0 a and d=cs are calculated, (c,d) are the encryption registration keywords, As encryption of the search keyword in the data retrieval process, the processor of any of the one or more data user terminals performs the following: An integer b between 0 and p-1 (inclusive) is randomly selected. t=g 1 b and u=ts are calculated, (t,u) is the aforementioned encrypted search keyword, In the data retrieval process, the processor of the data management server searches for the encrypted registration keyword: Select at least one encryption registration keyword from the population, where the population is all or part of one or more encryption registration keywords stored in the memory resources of the data management server. For each of the selected encryption registration keywords: For the selected encryption registration keyword (c,d) and the encryption search keyword (t,u), calculate e(c,u) and e(d,t). If e(c,u) and e(d,t) match, a matching check is performed to determine that the registration keyword corresponding to the selected encryption registration keyword and the search keyword corresponding to the encryption search keyword match. Data management server.

15. A data management server according to claim 14, The aforementioned data search request or the aforementioned search-related data processing request is a request that causes the data management server to perform at least one of the following: The statistical values ​​regarding the number of hits generated based on the aforementioned matching determination are to be transmitted. Based on the aforementioned matching determination, delete or move the corresponding encryption registration keyword. Data management server.

16. A data management server according to claim 14, As part of the data registration process, the processor of the data management server performs the following: The received encrypted registration keyword is stored as a data object in the memory resources of the data management server along with other values. Upon receiving the aforementioned data search request or the aforementioned search-related data processing request, the processor of the data management server: Based on the matching determination, one or more data objects are selected from the memory resources of the data management server. For the selected data object, do at least one of the following: Insert, update, or delete the other values ​​included in the selected data object. Update or delete the selected data object. Calculate statistical values ​​for the other values ​​included in the selected data object. Data management server.

17. A data management server according to claim 16, The aforementioned data object is a record in a database management system, or an object in key-value format. Data management server.

18. A data management server, Equipped with a processor and memory resources, Each is connected to one or more data user terminals, each having a processor and memory resources. As a preprocessing step, the processor of any of the one or more data user terminals mentioned above performs the following: The public parameters and private key K are obtained. The aforementioned public parameters are sent to the data management server. As part of the data registration process, the processor of one or more of the aforementioned data user terminals performs the following: The registration keyword, which is the data to be registered to the aforementioned data management server, is obtained. Using the aforementioned public parameters, the secret key K, and probabilistic cryptography, the registration keyword is encrypted into an encrypted registration keyword. As a data registration request, the encrypted registration keyword is sent to the data management server. As part of the data retrieval process, the processor of any of the one or more data user terminals mentioned above performs the following: Search keywords are retrieved, Using the aforementioned public parameters, the secret key K, and probabilistic cryptography, the search keyword is encrypted into an encrypted search keyword. The encrypted search keyword is sent to the data management server as a data search request or a search-related data processing request. As part of the data retrieval process, the processor of the data management server performs the following: Using the aforementioned encrypted search keyword and the aforementioned public parameters, the encrypted registration keyword stored in the memory resources of the data management server is searched. Based on the results of the search, search result data is generated. The aforementioned search result data is transmitted, Here, In the aforementioned preprocessing, the public parameters and the private key are obtained by the processor of any of the one or more data user terminals: A private key K is randomly generated, The elements q, n, α, and β are obtained as the public parameters, where q, n, α, and β are all positive integers. As encryption of the registration keyword in the data registration process, by the processor of any of the one or more data user terminals: A pseudorandom function is calculated using the secret key K and the registered keyword to obtain the value Sr, where the pseudorandom function is a function that outputs an n×n matrix in which each component is an integer between 0 and q-1 (inclusive). The following occurs at least once, resulting in a value of 1 or more for (ai,bi): An n-dimensional vector ai is generated, An n-dimensional vector xi is generated, The n-dimensional vector bi = Sr × ai + xi is calculated, One or more (ai,bi) are used as the encryption registration keyword. As encryption of the search keyword in the data retrieval process, the processor of any of the one or more data user terminals performs the following: The pseudo-random function is calculated using the secret key K and the registered keyword, thereby obtaining the value Ss. The following occurs at least once, resulting in a value of 1 or more for (cj, dj): An n-dimensional vector cj is generated, An n-dimensional vector yj is generated, The n-dimensional vector dj = Ss T × cj + yj is calculated, One or more (cj,dj) are used as the encryption search keyword. In the data retrieval process, the processor of the data management server searches for the encrypted registration keyword: Select at least one encryption registration keyword from the population, where the population is all or part of one or more encryption registration keywords stored in the memory resources of the data management server. For each of the selected encryption registration keywords: Select one or more (ai,bi), Select one or more (cj,dj) from the aforementioned encrypted search keywords, For the selected (ai, bi) and the one or more selected (cj, dj) from the encryption search keywords, determine whether ai, dj -bi, and cj fall within a predetermined range. If the determination is outside the range, a mismatch determination is performed in which the registered keyword corresponding to the selected encryption registration keyword and the search keyword corresponding to the encryption search keyword are determined to be mismatched. Data management server.

19. A data management server according to claim 18, The aforementioned data search request or the aforementioned search-related data processing request is a request that causes the data management server to perform at least one of the following: The statistical values ​​regarding the number of hits generated based on the aforementioned mismatch determination are to be transmitted. Based on the aforementioned mismatch determination, delete or move the corresponding encryption registration keyword. Data management server.

20. A data management server according to claim 18, As part of the data registration process, the processor of the data management server performs the following: The received encrypted registration keyword is stored as a data object in the memory resources of the data management server along with other values. Upon receiving the aforementioned data search request or the aforementioned search-related data processing request, the processor of the data management server: Based on the aforementioned mismatch determination, one or more data objects are selected from the memory resources of the data management server. For the selected data object, do at least one of the following: Insert, update, or delete the other values ​​included in the selected data object. Update or delete the selected data object. Calculate statistical values ​​for the other values ​​included in the selected data object. Data management server.

21. A data management server according to claim 20, The aforementioned data object is a record in a database management system, or an object in key-value format. Data management server.

22. A secure search method in a secure search system having a data management server and one or more data user terminals, As a preprocessing step, the processor of any of the one or more data user terminals mentioned above shall: Obtain the public parameters and the private key K, The aforementioned public parameters are sent to the data management server. As part of the data registration process, the processor of any of the one or more data user terminals shall: The registration keyword, which is the data to be registered to the aforementioned data management server, is obtained. Using the aforementioned public parameters, the secret key K, and probabilistic cryptography, the registration keyword is encrypted into an encrypted registration keyword. As a data registration request, the encrypted registration keyword is sent to the data management server. As part of the data retrieval process, the processor of any of the one or more data user terminals is: Get search keywords, Using the aforementioned public parameters, the secret key K, and probabilistic encryption, the search keyword is encrypted into an encrypted search keyword. The encrypted search keyword is sent to the data management server as a data search request or a search-related data processing request. As part of the data retrieval process, the processor of the data management server performs the following: Using the aforementioned encrypted search keyword and the aforementioned public parameters, the encrypted registration keyword stored in the memory resources of the data management server is searched. Based on the results of the search, search result data is generated. The aforementioned search result data is transmitted, Here, In obtaining the public parameters and the private key in the aforementioned preprocessing, the processor of any of the one or more data user terminals shall: A private key K is randomly generated, The elements of the aforementioned public parameters are obtained as q, n, α, and β, where q, n, α, and β are all positive integers. As encryption of the registration keyword in the data registration process, the processor of any of the one or more data user terminals shall: The value Sr is obtained by calculating a pseudorandom function using the secret key K and the registered keyword, where the pseudorandom function is a function that outputs an n×n matrix in which each component is an integer between 0 and q-1, Perform the following at least once to calculate (ai, bi) to be 1 or greater: Generate an n-dimensional vector ai, Generate an n-dimensional vector xi, We calculate the n-dimensional vector bi = Sr × ai + xi. One or more (ai,bi) are used as the encryption registration keywords. As encryption of the search keyword in the data retrieval process, the processor of any of the one or more data user terminals shall: By calculating the pseudo-random function using the secret key K and the registered keyword, the value Ss is obtained. Perform the following at least once to calculate (cj, dj) to be 1 or greater: Generate an n-dimensional vector cj, Generate an n-dimensional vector yj, We calculate the n-dimensional vector dj = Ss T × cj + yj. One or more (cj,dj) are used as the encryption search keywords. In the data retrieval process, the processor of the data management server searches for the encrypted registration keyword: Select at least one encryption registration keyword from the population, where the population is all or part of one or more encryption registration keywords stored in the memory resources of the data management server. For each of the selected encryption registration keywords: Select one or more (ai,bi), Select one or more (cj,dj) from the aforementioned encrypted search keywords, For the selected (ai, bi) and the one or more selected (cj, dj) from the encryption search keywords, determine whether ai, dj -bi, and cj fall within a predetermined range. If the determination is outside the range, a mismatch determination is performed in which the registered keyword corresponding to the selected encryption registration keyword and the search keyword corresponding to the encryption search keyword are determined to be mismatched. Confidential search methods.

23. The confidential search method according to claim 22, The aforementioned data search request or the aforementioned search-related data processing request is a request that causes the data management server to perform at least one of the following: The statistical values ​​regarding the number of hits generated based on the aforementioned mismatch determination are to be transmitted. Based on the aforementioned mismatch determination, delete or move the corresponding encryption registration keyword. Confidential search methods.

24. The confidential search method according to claim 22, As part of the data registration process, the processor of the data management server performs the following: The received encrypted registration keyword is stored as a data object in the memory resources of the data management server along with other values. Upon receiving the aforementioned data search request or the aforementioned search-related data processing request, the processor of the data management server: Based on the aforementioned mismatch determination, one or more data objects are selected from the memory resources of the data management server. For the selected data object, do at least one of the following: Insert, update, or delete the other values ​​included in the selected data object. Update or delete the selected data object. Calculate statistical values ​​for the other values ​​included in the selected data object. Confidential search methods.

25. The confidential search method according to claim 24, The aforementioned data object is a record in a database management system, or an object in key-value format. Confidential search methods.

26. One or more programs that cause one or more computers to perform the confidential search method described in any one of Claims 22 to 25.

Images