Data distribution system, data distribution method, and data distribution program

Abstract

The workload on the data transmission device is reduced. [Solution] A data distribution system that distributes encrypted data from a transmitting device to a receiving device via a relay device with the support of a key issuing device, wherein the key issuing device is configured to generate public parameters for ElGamal encryption and a private key for attribute-based encryption, transmit the public parameters to the transmitting device, and retain the private key, and the transmitting device is configured to encrypt data using the public parameters, create a user-defined policy for each data ID, attach the policy defined for the corresponding data ID to the encrypted data, and transmit the encrypted data together with the user-defined policy to the relay device.

Description

[Technical Field]

[0001] The present invention relates to a data distribution system, a data distribution method, and a data distribution program. [Background technology]

[0002] Proxy re-encryption (PRE) is a public key cryptography method that allows a third party to convert ciphertext that can be decrypted by user A into ciphertext that can be decrypted by user B. A data distribution system that performs disclosure control using attribute-based PRE is known. For example, Patent Document 1 discloses a data distribution system that uses attribute-based PRE. In a distribution system that uses attribute-based PRE, a re-encryption key converts data into decodable ciphertext using a specific attribute that specifies an access policy. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2011 / 045723 Summary of the Invention [Problem to be solved by the invention]

[0004] The disclosures of the above prior art documents are incorporated herein by reference.The following analysis was carried out by the inventors.

[0005] In conventional distribution systems using attribute-based PRE, the data owner generates and manages the re-encryption key (see Patent Document 1 for an example). Conventional distribution systems using attribute-based PRE have the problem that the computational costs of attribute-based PRE and revocation are high, making them unsuitable for users with large databases, users who frequently share data, IoT devices, etc. For lightweight IoT devices, the computational costs become very high.

[0006] In view of the above problems, it is an object of the present invention to provide a data distribution system, a data distribution method, and a data distribution program that contribute to reducing the workload on a data transmission device. [Means for solving the problem]

[0007] According to a first aspect of the present invention, there is provided a data distribution system in which encrypted data is distributed from a transmitting device to a receiving device via a relay device with support of a key issuing device, the system comprising: the key issuing device is configured to generate public parameters for ElGamal encryption and a private key for attribute-based encryption, transmit the public parameters to the sending device, and retain the private key; the sending device is configured to encrypt data using the public parameters, create a user-defined policy for each data ID, attach the policy defined for the corresponding data ID to the encrypted data, and send the encrypted data together with the user-defined policy to the relay device; the relay device is configured to separate the user-defined policy from the encrypted data and provide the user-defined policy to the key issuing device; the key issuing device is configured to generate a re-encryption key with encryption using the private key for the corresponding data ID and the user-defined policy, generate a decryption key for decrypting the re-encrypted data by a receiving device that satisfies the user-defined policy, transmit the re-encryption key with encryption to the relay device, and transmit the decryption key to the receiving device that satisfies the user-defined policy; the relay device is configured to re-encrypt the encrypted data of the data ID using the encrypted re-encryption key and transmit the re-encrypted data to the receiving device; A data distribution system is provided in which the receiving device is configured to decrypt the re-encrypted data using the decryption key.

[0008] According to a second aspect of the present invention, there is provided a data distribution method for distributing encrypted data from a transmitting device to a receiving device via a relay device with support from a key issuing device, the method comprising: the key issuing device generates public parameters for ElGamal encryption and a private key for attribute-based encryption, transmits the public parameters to the transmitting device, and holds the private key; the sending device encrypts data using the public parameters, creates a user-defined policy for each data ID, attaches the policy defined for the corresponding data ID to the encrypted data, and sends the encrypted data together with the user-defined policy to the relay device, and the relay device separates the user-defined policy from the encrypted data and provides the user-defined policy to the key issuing device; the key issuing device generates a re-encryption key with encryption using the private key for the corresponding data ID and the user-defined policy, generates a decryption key for decrypting the re-encrypted data by a receiving device that satisfies the user-defined policy, transmits the re-encryption key with encryption to the relay device, and transmits the decryption key to the receiving device that satisfies the user-defined policy; the relay device re-encrypts the encrypted data of the data ID using the encrypted re-encryption key, and transmits the re-encrypted data to the receiving device; A data distribution method is provided in which the receiving device decrypts the re-encrypted data using the decryption key.

[0009] According to a third aspect of the present invention, there is provided a data distribution program for distributing encrypted data from a transmitting device to a receiving device via a relay device with support of a key issuing device, the program comprising: generating public parameters for ElGamal encryption and a private key for attribute-based encryption in the key issuing device, transmitting the public parameters to the transmitting device, and causing the transmitting device to hold the private key; causing the transmitting device to encrypt data using the public parameters, create a user-defined policy for each data ID, attach the policy defined for the corresponding data ID to the encrypted data, and transmit the encrypted data together with the user-defined policy to the relay device; causing the relay device to separate the user-defined policy from the encrypted data and provide the user-defined policy to the key issuing device; causing the key issuing device to generate a re-encryption key with encryption using the private key for the corresponding data ID and the user-defined policy, generate a decryption key for decrypting the re-encrypted data by a receiving device that satisfies the user-defined policy, transmit the re-encryption key with encryption to the relay device, and cause the receiving device that satisfies the user-defined policy to transmit the decryption key; causing the relay device to re-encrypt the encrypted data of the data ID using the encrypted re-encryption key and transmit the re-encrypted data to the receiving device; A data distribution program is provided that causes the receiving device to decrypt the re-encrypted data using the decryption key. [Effects of the Invention]

[0010] According to each aspect of the present invention, it is possible to provide a data distribution system, a data distribution method, and a data distribution program that contribute to reducing the workload on a data transmission device. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a schematic diagram illustrating a data distribution system. [Figure 2] FIG. 2 illustrates the first step in the data distribution process. [Figure 3] Figure 3 shows the second step in the data distribution process. [Figure 4] Figure 4 shows the third step in the data distribution process. [Figure 5]FIG. 5 illustrates the fourth step in the data distribution process. [Figure 6] FIG. 6 illustrates the fifth and sixth steps of the data distribution process. [Figure 7] FIG. 7 illustrates the seventh and eighth steps of the data distribution process. [Figure 8] FIG. 8 is a system diagram of a data distribution method at the encryption and re-encryption stages. [Figure 9] FIG. 9 is a system diagram of the data distribution method at the decoding stage. [Figure 10] FIG. 10 shows the process of the encryption stage. [Figure 11] FIG. 11 is a diagram showing the process of the re-encryption key generation stage. [Figure 12] FIG. 12 illustrates the process of the re-encryption stage. [Figure 13] FIG. 13 is a diagram illustrating the process of the decoding stage. [Figure 14] FIG. 14 is a flowchart of the data distribution method. [Figure 15] FIG. 15 is a diagram illustrating an example of the hardware configuration of the transmitting device, the receiving device, the relay device, and the key issuing device. DETAILED DESCRIPTION OF THE INVENTION

[0012] Fig. 1 is a schematic diagram illustrating a data distribution system. As shown in Fig. 1, the data distribution system 100 includes a transmitting device 10, a receiving device 20, a relay device 30, and a key issuing device 40. For example, the transmitting device 10 is operated by a data provider, the receiving device 20 is operated by a data user, the relay device 30 is operated by an information bank, and the key issuing device 40 is operated by a trusted institution. With the support of the key issuing device 40, the data distribution system 100 distributes encrypted data from the transmitting device 10 to the receiving device 20 via the relay device 30.

[0013] The key issuing device 40 is configured to output a pair of a public key and a private key, transmit the public key to a transmitting device, and hold the private key. The public key is an encryption key for encrypting data. The private key is a decryption key for decrypting data encrypted with the public key.

[0014] The transmitting device 10 is configured to encrypt data using a public key, create a user-defined policy for each data ID, attach the definition policy for the data ID corresponding to the encrypted data, and transmit the encrypted data with the user-defined policy attached to the relay device 30. The user-defined policy defines permission for decrypting the encrypted data. For example, an attribute for allowing decryption of the encrypted data is defined.

[0015] The relay device 30 is configured to separate the user-defined policy from the encrypted data and provide the user-defined policy to the key issuing device 40. The encrypted data includes the user-defined policy, and the relay device 30 separates the user-defined policy from the encrypted data.

[0016] The key issuing device 40 is configured to generate a re-encryption key using the private key and a user-defined policy for the corresponding data ID, generate a decryption key for decrypting data re-encrypted by the receiving device 20 that satisfies the user-defined policy, transmit the re-encryption key to the relay device 30, and transmit the decryption key to the receiving device 20 that satisfies the user-defined policy. The re-encryption key converts encrypted data that can be decrypted using the private key into different encrypted data that can be decrypted using a decryption key that conforms to the user-defined policy. The key issuing device generates the re-encryption key using the private key and the user-defined policy.

[0017] The relay device 30 is configured to re-encrypt the encrypted data of the data ID using the re-encryption key and transmit the re-encrypted data to the receiving device 20. The re-encrypted data can only be decrypted using the decryption key of the user-defined policy.

[0018] The receiving device 20 is configured to decrypt the re-encrypted data using the decryption key. The key issuing device 40 transmits the decryption key to the receiving device 20 that satisfies a user-defined policy. The re-encrypted data can only be decrypted if the receiving device 20 satisfies the user-defined policy.

[0019] As described above, in a conventional data distribution system using attribute-based PRE, the data owner (data transmission device) generates a re-encryption key, which results in high computational costs. In contrast, the transmission device 10 in the above embodiment does not generate a re-encryption key. Therefore, the data distribution system in the above embodiment can reduce the workload of the data transmission device 10.

[0020] Figure 2 shows the first step of the data distribution process. As shown in Figure 2, (a) the data owner requests the data provider (transmitter) to register data 1, 2, ..., N, (b) creates a policy for the data, and (c) selects and trusts a key generation center (KGC) (key issuing device). Meanwhile, (d) the key generation center (KGC) (key issuing device) transmits a public key to the data provider (transmitter) and keeps the private key for itself.

[0021] Figure 3 shows the second step of the data distribution process. As shown in Figure 3, (a) the data provider (transmitter) encrypts data 1, 2, ..., N with the KGC public key, (b) attaches policies P1, P2, ..., PN to the encrypted data 1, 2, ..., N, and (c) attaches policies P1, P2, ..., PN to the encrypted data 1, 2, ..., N and transmits them to the information bank (relay device).

[0022] Figure 4 shows the third step of the data distribution process. As shown in Figure 4, (a) the information bank (relay device) analyzes the policy included in the encrypted data 1, 2, ..., N, (b) may add additional attributes to the policy, (c) sends only the policy to the key generation center (KGC) (key issuing device), and (d) the key generation center (KGC) (key issuing device) generates an (AB)PRE key from the private key and the policy.

[0023] Figure 5 illustrates the fourth step of the data distribution process. As shown in Figure 5, the information bank (relay device) re-encrypts the encrypted data 1, 2, ..., N. The re-encrypted data can only be decrypted with the correct set of attributes.

[0024] FIG. 6 shows the fifth and sixth steps of the data distribution process. As shown in FIG. 6, a data user sends attributes to a key generation center (KGC) (key issuing device) to obtain a decryption key. The key generation center (KGC) (key issuing device) generates a decryption key using the attributes and a private key. In this case, attribute A1 of data user X satisfies policy P1, but attribute A2 of data user Y does not satisfy policy P1. Therefore, the decryption key of data user X satisfies policy P1, but the decryption key of data user Y does not satisfy policy P1.

[0025] FIG. 7 shows the seventh and eighth steps of the data distribution process. As shown in FIG. 7, the information bank (relay device) transmits the re-encrypted data to the data users who have requested it. The key generation center (KGC) (key issuing device) transmits decryption keys to each data user. Data user X can decrypt the re-encrypted data because the decryption key for data user X complies with policy P1, but data user Y cannot decrypt the re-encrypted data because the decryption key for data user Y does not comply with policy P1. In this way, the data is protected by the above data distribution so that only data users who satisfy policy P1 can decrypt the re-encrypted data 1.

[0026] 8 is a system configuration diagram of a data distribution method in the encryption and re-encryption stages. As illustrated in FIG. 8, the data distribution method in the encryption and re-encryption stages is performed by a transmitting device 10, a key issuing device 40, and a relay device 30. The transmitting device 10 provides a data ID for data distribution to the key issuing device 40. The key issuing device 40 generates a pair of a public key and a private key (step S11), transmits the public key to the transmitting device 10, and retains the private key. The transmitting device 10 encrypts initial data with the public key (step S12), creates a policy for the data ID (step S13), and transmits the encrypted data with the policy to the relay device 30.

[0027] The relay device 30 analyzes the policy in the encrypted data (step 14) and provides it to the key issuing device 40. The key issuing device 40 generates a re-encryption key using the private key and the policy for the data ID (step 15) and transmits the re-encryption key to the relay device 30. The relay device 30 re-encrypts the encrypted data using the re-encryption key (step 16). The transmitting device 10 in the above data distribution method does not generate a re-encryption key. Therefore, the data distribution system in the above data distribution method can reduce the workload on the data transmitting device 10.

[0028] FIG. 9 is a system configuration diagram of the data distribution method in the decryption stage. As shown in FIG. 9, the data distribution method in the decryption stage is performed by the receiving device 20, the key issuing device 40, and the relay device 30. The receiving device 20 provides its attributes to the key issuing device 40. The key issuing device 40 generates a decryption key using the private key and the attributes (step S21) and transmits the decryption key to the receiving device 20. The receiving device 20 requests data access from the relay device 30, and the relay device 30 transmits the re-encrypted data to the receiving device 20. The receiving device 20 decrypts the re-encrypted data with the decryption key (step S22). Because the decryption key is generated based on the attributes of the receiving device 20, the receiving device 20 can decrypt the data only if the attributes of the receiving device 20 satisfy the policy of the data ID. In this way, the above data distribution method protects the data so that only receiving devices 20 that satisfy the policy of the data ID can decrypt the re-encrypted data.

[0029] Here, an embodiment of the present invention will be described using an example of a process for re-encrypting ElGamal encrypted data into ABE (Attribute Based Encryption) data. FIG. 10 is a diagram showing the process of the encryption stage. As shown in FIG. 10, the key issuing device 40 executes Setup(k). Setup(k) includes the selection of a random generator, pairing and random selection, public parameters (pp), a master secret key (msk), a private key (for ElGamal), and public parameters (ElGamal pp ElG The key issuing device 40 includes the public parameters (pp.pp ElG ) to the transmitting device 10.

[0030] The transmitting device 10 receives public parameters (pp.pp ElG ) and receives the public parameters (pp.pp ElG ) to perform public-key ElGamal encryption of the message M. The sending device 10 selects a random x and sets the public parameters (pp.pp ElG ) to encrypt the message M. The sending device 10 calculates the ciphertext: CT=(C 1ElG ,C 2ElG ,C 3ElG ). [Number 1] TIFF2026044418000002.tif6150

[0031] As described above, the transmitting device 10 sets the public parameters (pp.pp ElG ) from the key issuing device 40, the sending device 10 does not need to calculate the public parameters. Furthermore, the sending device 10 encrypts the data using the public parameters raised to the power of a secret exponent that is easy to calculate. This reduces the workload on the data sending device.

[0032] Ciphertext:CT=(C 1ElG ,C 2ElG ,C 3ElG ) can be decrypted using the private key γ or the master private key gα. [Number 2] TIFF2026044418000003.tif11150 or Use TIFF2026044418000004.tif11150.

[0033] 11 is a diagram showing the process in the re-encryption key generation stage. As shown in FIG. 11, the sending device 10 generates a policy P for the ciphertext: CT=(C 1ElG ,C 2ElG ,C 3ElG ) and connects the ciphertext CT to the policy P. Send TIFF2026044418000005.tif1622:CT||P to relay device 30.

[0034] The relay device 30 receives the payload from the transmitter 10. Received TIFF2026044418000006.tif1622 and received the payload Parse TIFF2026044418000007.tif1622 to find policy parameters (Pol):(P,C 2ElG ,C 3ElG The relay device 30 transmits the policy parameters (Pol) to the key issuing device 40.

[0035] The key issuing device 40 generates a re-encryption key using a policy parameter (Pol) and a master secret key (msk). The key issuing device 40 selects random numbers r and r′ for each message and a secret s for each message, and generates a re-encryption key Σ i λ i w i = swhere λ i =v i M,v i =(s,y1,y2,...,y n ) The key issuing device 40 uses h1, h2, ..., h Uwhere U is the total number of attributes in the system. The key issuing device 40 sets r" = r' + r, where r' is selected randomly for each access. The re-encryption key (rk0, rk1) and the encryption C are defined as follows. The key issuing device 40 generates the re-encryption key (rk0, rk1) and the encryption C = (c1, c i ,d i ) to the relay device 30. [Number 3] Re-encryption key: TIFF2026044418000008.tif11150 Cipher: TIFF2026044418000009.tif7150

[0036] 12 is a diagram showing the process of the re-encryption stage. As shown in FIG. 12, the relay device 30 generates an ABE cipher C=(c1, c i ,d i ) and re-encryption key (rk0,rk1): CT = (C 1ElG ,C 2ElG ,C 3ElG The relay device 30 calculates the re-encrypted ciphertexts (C'1, C'2, C'3, C'4) as follows, and transmits the re-encrypted ciphertexts (C'1, C'2, C'3, C'4) to the receiving device 20. [Number 4] TIFF2026044418000010.tif6150, TIFF2026044418000011.tif6150, TIFF2026044418000012.tif6150, TIFF2026044418000013.tif6150

[0037] The receiving device 20 receives the re-encrypted ciphertext (C'1, C'2, C'3, C'4) and transmits the attribute set S'={attr} to the key issuing device 40, which has the attribute set S'={attr}.

[0038] Fig. 13 is a diagram showing the process in the decryption stage. As shown in Fig. 13, the key issuing device 40 generates a decryption key from an attribute set S'. The key issuing device 40 also uses the master secret key (msk) and randomness r, r' in the re-encryption key generation stage. The key issuing device 40 generates a random r for each attribute of S'. i The key issuing device 40 generates the decryption key sk=(d0, d1, d2, d3) as follows, and transmits the decryption key sk to the receiving device 20. [Number 5] TIFF2026044418000014.tif6150

[0039] The receiving device 20 uses the decryption key sk=(d0,d1,d2,d3) to decrypt the re-encrypted ciphertext (C'1,C'2,C'3,C'4). The receiving device 20 calculates d as follows and then calculates C'1 / d. If S=S', the calculation reveals the message M; otherwise, false ⊥ is returned. [Number 6] TIFF2026044418000015.tif12150

[0040] The correctness of the above re-encryption can be verified by the following calculation. [Number 7] First, let S'=S TIFF2026044418000016.tif6150 Calculate. TIFF2026044418000017.tif7150 TIFF2026044418000018.tif6150 If not (S'=S), then ⊥ next Calculate TIFF2026044418000019.tif12150. therefore, TIFF2026044418000020.tif12150 Finally TIFF2026044418000021.tif18156 Calculate.

[0041] FIG. 14 is a flowchart of a data distribution method. As shown in FIG. 14, the transmitting device 10 generates data and a data access policy (step 31). The transmitting device 10 acquires ElGamal public parameters from the key issuing device 40, encrypts the data, attaches an access policy, and transmits the encrypted data and policy to the relay device 30 (step 32). The relay device 30 analyzes the policy and public parameters from the ciphertext and transmits them to the key issuing device 40 (step 33). The key issuing device 40 generates ABE (attribute-based encryption) encryption parameters and a proxy re-encryption key and transmits them to the relay device 30 (step 34). The relay device 30 performs re-encryption to convert the ElGamal ciphertext into ABE ciphertext and transmits the ABE ciphertext to the receiving device 20 upon request (step 35). The key issuing device 40 acquires attributes from the receiving device 20, generates an ABE decryption key corresponding to the attributes, and transmits it to the receiving device 20 (step 36). The receiving device 20 decrypts the ABE ciphertext. Decryption is successful only if the attributes satisfy the access policy set by the sending device 10 (step 37).

[0042] [Hardware configuration] FIG. 15 is a diagram illustrating an example of the hardware configuration of a transmitting device, a receiving device, a relay device, and a key issuing device. The transmitting device 10, the receiving device 20, the relay device 30, and the key issuing device 40 described above can be configured as an information processing device (computer) 200 having the hardware configuration shown in FIG. 15. Note that the hardware configuration shown in FIG. 15 is merely an example of a hardware configuration that realizes the functions of the transmitting device 10, the receiving device 20, the relay device 30, and the key issuing device 40, and is not intended to limit the hardware configurations of the transmitting device 10, the receiving device 20, the relay device 30, and the key issuing device 40. The transmitting device 10, the receiving device 20, the relay device 30, and the key issuing device 40 may include hardware not shown in FIG. 15.

[0043] 15, a computer 200 includes a CPU (Central Processing Unit) 210, a main memory device 220, an auxiliary memory device 230, and a communication interface, a NIC (Network Interface Card) 240. These elements are connected to each other by, for example, an internal bus.

[0044] The CPU 210 executes the access control program. The main storage device 220 is, for example, a RAM (Random Access Memory), and temporarily stores the access control program executed by the computer 200 so that the CPU 210 can process it.

[0045] The auxiliary storage device 230 is, for example, a hard disk drive (HDD) and can store the data distribution program on a medium- to long-term basis. The access control program may be provided as a computer program stored in a non-transitory computer-readable storage medium. The auxiliary storage device 230 can be used to store the access control program stored in the non-transitory computer-readable storage medium on a medium- to long-term basis.

[0046] The NIC 240 provides an interface with external terminals over a network and is used to receive or transmit traffic communications.

[0047] When the above-described computer 200 executes the data distribution program, the computer 200 functions as the sending device 10, the receiving device 20, the relay device 30, and the key issuing device 40, and executes the data distribution method shown in FIGS.

[0048] The above-exemplified embodiments can be partially or entirely described as the following supplementary notes, but are not limited thereto. [Appendix 1] A data distribution system in which encrypted data is distributed from a transmitting device to a receiving device via a relay device with support of a key issuing device, comprising: the key issuing device is configured to generate public parameters for ElGamal encryption and a private key for attribute-based encryption, transmit the public parameters to the sending device, and retain the private key; the sending device is configured to encrypt data using the public parameters, create a user-defined policy for each data ID, attach the policy defined for the corresponding data ID to the encrypted data, and send the encrypted data together with the user-defined policy to the relay device; the relay device is configured to separate the user-defined policy from the encrypted data and provide the user-defined policy to the key issuing device; the key issuing device is configured to generate a re-encryption key with encryption using the private key for the corresponding data ID and the user-defined policy, generate a decryption key for decrypting the re-encrypted data by a receiving device that satisfies the user-defined policy, transmit the re-encryption key with encryption to the relay device, and transmit the decryption key to the receiving device that satisfies the user-defined policy; the relay device is configured to re-encrypt the encrypted data of the data ID using the encrypted re-encryption key and transmit the re-encrypted data to the receiving device; The receiving device is configured to decrypt the re-encrypted data using the decryption key. [Appendix 2] 2. The data distribution system according to claim 1, wherein the transmitting device encrypts the data using a value obtained by multiplying the public parameter by a private exponent. [Appendix 3] 3. The data distribution system of claim 1 or 2, wherein the re-encryption key has two components, a first component including a first secret from ElGamal encryption and a second component including a second secret from attribute-based encryption. [Appendix 4] A data distribution system described in any of Appendices 1 to 3, wherein the key issuing device uses random numbers, a first random number is used for each message to be encrypted, and a second random number is used for access requests from the receiving device. [Appendix 5] A data distribution method for distributing encrypted data from a transmitting device to a receiving device via a relay device with support from a key issuing device, comprising: the key issuing device generates public parameters for ElGamal encryption and a private key for attribute-based encryption, transmits the public key to the sending device, and holds the private key; the sending device encrypts data using the public parameters, creates a user-defined policy for each data ID, attaches the policy defined for the corresponding data ID to the encrypted data, and sends the encrypted data together with the user-defined policy to the relay device, and the relay device separates the user-defined policy from the encrypted data and provides the user-defined policy to the key issuing device; the key issuing device generates a re-encryption key with encryption using the private key for the corresponding data ID and the user-defined policy, generates a decryption key for decrypting the re-encrypted data by a receiving device that satisfies the user-defined policy, transmits the re-encryption key with encryption to the relay device, and transmits the decryption key to the receiving device that satisfies the user-defined policy; the relay device re-encrypts the encrypted data of the data ID using the encrypted re-encryption key, and transmits the re-encrypted data to the receiving device; The data distribution method, wherein the receiving device decrypts the re-encrypted data using the decryption key. [Appendix 6] 6. The data distribution method according to claim 5, wherein the sending device encrypts the data using a value obtained by multiplying the public parameter by a private exponent. [Appendix 7] 7. The data distribution method of claim 5 or 6, wherein the re-encryption key has two components, a first component including a first secret from ElGamal encryption and a second component including a second secret from attribute-based encryption. [Appendix 8] A data distribution method described in any of Appendices 5 to 7, wherein the key issuing device uses random numbers, a first random number is used for each message to be encrypted, and a second random number is used for access requests from the receiving device. [Appendix 9] A data distribution program for distributing encrypted data from a transmitting device to a receiving device via a relay device with support of a key issuing device, generating public parameters for ElGamal encryption and a private key for attribute-based encryption in the key issuing device, transmitting the public parameters to the transmitting device, and causing the transmitting device to hold the private key; causing the transmitting device to encrypt data using the public parameters, create a user-defined policy for each data ID, attach the policy defined for the corresponding data ID to the encrypted data, and transmit the encrypted data together with the user-defined policy to the relay device; causing the relay device to separate the user-defined policy from the encrypted data and provide the user-defined policy to the key issuing device; causing the key issuing device to generate a re-encryption key with encryption using the private key for the corresponding data ID and the user-defined policy, generate a decryption key for decrypting the re-encrypted data by a receiving device that satisfies the user-defined policy, transmit the re-encryption key with encryption to the relay device, and cause the receiving device that satisfies the user-defined policy to transmit the decryption key; causing the relay device to re-encrypt the encrypted data of the data ID using the encrypted re-encryption key and transmit the re-encrypted data to the receiving device; a data distribution program that causes the receiving device to decrypt the re-encrypted data using the decryption key; [Appendix 10] 10. The data distribution program according to claim 9, wherein the sending device encrypts the data using a value obtained by multiplying the public parameter by a private exponent. [Appendix 11] 11. The data distribution program of claim 9 or 10, wherein the re-encryption key has two components, a first component including a first secret from ElGamal encryption and a second component including a second secret from attribute-based encryption. [Appendix 12] A data distribution program described in any of Appendices 9 to 11, wherein the key issuing device uses random numbers, a first random number is used for each message to be encrypted, and a second random number is used for each access request from the receiving device.

[0049] Although each exemplary embodiment of the present invention has been described, it should be noted that the exemplary embodiments or examples may be modified or adjusted based on the basic technical concept within the entire disclosure of the present invention (including the claims). Furthermore, within the scope of the entire disclosure of the present invention, various disclosed elements (including individual elements of individual claims, individual elements of individual exemplary embodiments or examples, and individual elements of individual figures) may be combined or selected (at least partially deleted) in various ways. In other words, it is obvious that the present invention encompasses all kinds of variations and modifications made by those skilled in the art in accordance with the entire disclosure, including the claims and the technical concept of the present invention. In particular, numerical ranges disclosed in this specification should be construed as specifically disclosing any intermediate value or subrange included in the disclosed range, even if not explicitly stated. Furthermore, the disclosures of the above-cited patent documents are incorporated herein by reference in their entirety. [Explanation of symbols]

[0050] 100 Data Distribution System 10 Transmitting device 20 Receiving device 30 Relay Device 40 Key issuing device 200 Information processing equipment (computer) 210 CPU (Central Processing Unit) 220 Main Memory Device 230 Subsidized Memory Device 240 NIC (Network Interface Card)

Claims

1. A data distribution system in which encrypted data is distributed from a transmitting device to a receiving device via a relay device with support of a key issuing device, comprising: the key issuing device is configured to generate public parameters for ElGamal encryption and a private key for attribute-based encryption, transmit the public parameters to the sending device, and retain the private key; the sending device is configured to encrypt data using the public parameters, create a user-defined policy for each data ID, attach the policy defined for the corresponding data ID to the encrypted data, and send the encrypted data together with the user-defined policy to the relay device, and the relay device is configured to separate the user-defined policy from the encrypted data and provide the user-defined policy to the key issuing device; the key issuing device is configured to generate a re-encryption key with encryption using the private key for the corresponding data ID and the user-defined policy, generate a decryption key for decrypting the re-encrypted data by a receiving device that satisfies the user-defined policy, transmit the re-encryption key with encryption to the relay device, and transmit the decryption key to the receiving device that satisfies the user-defined policy; the relay device is configured to re-encrypt the encrypted data of the data ID using the encrypted re-encryption key and transmit the re-encrypted data to the receiving device; The receiving device is configured to decrypt the re-encrypted data using the decryption key.

2. 2. The data distribution system according to claim 1, wherein the transmitting device encrypts the data using a value obtained by multiplying the public parameter by a private exponent.

3. 2. The data distribution system of claim 1, wherein the re-encryption key has two components, a first component including a first secret from ElGamal encryption and a second component including a second secret from attribute-based encryption.

4. 2. The data distribution system according to claim 1, wherein the key issuing device uses random numbers, a first random number being used for each message to be encrypted, and a second random number being used for each access request from the receiving device.

5. A data distribution method for distributing encrypted data from a transmitting device to a receiving device via a relay device with support from a key issuing device, comprising: the key issuing device generates public parameters for ElGamal encryption and a private key for attribute-based encryption, transmits the public key to the sending device, and holds the private key; the sending device encrypts data using the public parameters, creates a user-defined policy for each data ID, attaches the policy defined for the corresponding data ID to the encrypted data, and sends the encrypted data together with the user-defined policy to the relay device, and the relay device separates the user-defined policy from the encrypted data and provides the user-defined policy to the key issuing device; the key issuing device generates a re-encryption key with encryption using the private key for the corresponding data ID and the user-defined policy, generates a decryption key for decrypting the re-encrypted data by a receiving device that satisfies the user-defined policy, transmits the re-encryption key with encryption to the relay device, and transmits the decryption key to the receiving device that satisfies the user-defined policy; the relay device re-encrypts the encrypted data of the data ID using the encrypted re-encryption key, and transmits the re-encrypted data to the receiving device; The data distribution method, wherein the receiving device decrypts the re-encrypted data using the decryption key.

6. 6. The data distribution method according to claim 5, wherein the sending device encrypts the data using a value obtained by multiplying the public parameter by a private exponent.

7. 6. The data distribution method of claim 5, wherein the re-encryption key has two components, a first component including a first secret from ElGamal encryption and a second component including a second secret from attribute-based encryption.

8. 6. The data distribution method according to claim 5, wherein the key issuing device uses random numbers, a first random number is used for each message to be encrypted, and a second random number is used for each access request from the receiving device.

9. A data distribution program for distributing encrypted data from a transmitting device to a receiving device via a relay device with support of a key issuing device, generating public parameters for ElGamal encryption and a private key for attribute-based encryption in the key issuing device, transmitting the public parameters to the transmitting device, and causing the transmitting device to hold the private key; causing the transmitting device to encrypt data using the public parameters, create a user-defined policy for each data ID, attach the policy defined for the corresponding data ID to the encrypted data, and transmit the encrypted data together with the user-defined policy to the relay device; causing the relay device to separate the user-defined policy from the encrypted data and provide the user-defined policy to the key issuing device; causing the key issuing device to generate a re-encryption key with encryption using the private key for the corresponding data ID and the user-defined policy, generate a decryption key for decrypting the re-encrypted data by a receiving device that satisfies the user-defined policy, transmit the re-encryption key with encryption to the relay device, and cause the receiving device that satisfies the user-defined policy to transmit the decryption key; causing the relay device to re-encrypt the encrypted data of the data ID using the encrypted re-encryption key and transmit the re-encrypted data to the receiving device; a data distribution program that causes the receiving device to decrypt the re-encrypted data using the decryption key;

10. 10. The data distribution program according to claim 9, wherein the sending device encrypts the data using a value obtained by multiplying the public parameter by a private exponent.

11. 10. The data distribution program of claim 9, wherein the re-encryption key has two components, a first component including a first secret from ElGamal encryption and a second component including a second secret from attribute-based encryption.

12. 10. The data distribution program according to claim 9, wherein the key issuing device uses random numbers, a first random number is used for each message to be encrypted, and a second random number is used for each access request from the receiving device.

Images