CONFIDENTIAL INFORMATION PROCESSING SYSTEM, CONFIDENTIAL INFORMATION PROCESSING METHOD, AND CONFIDENTIAL INFORMATION PROCESSING PROGRAM

Abstract

The key generation device (200) generates an encryption key PK, a decryption key SK, and a homomorphic operation key EVK. The encryption device (300) generates encrypted data C by encrypting plaintext data m with the encryption key PK. DPK The repudiation random number generator (400) generates the encryption key PK and the ciphertext data C DPK (m) and repudiation random number data r for repudiating disclosure of plaintext data m are input. * The homomorphic arithmetic device (500) generates homomorphically-operated ciphertext data C by homomorphically operating the result of the calculation of the plaintext data using the homomorphic operation key EVK. MPK The decryption device (600) generates the homomorphic operation ciphertext data C MPK Decrypt (M).

Description

[Technical field]

[0001] The present disclosure relates to a secret information processing system, a secret information processing method, and a secret information processing program. [Background technology]

[0002] Homomorphic encryption is an encryption technology that allows data to be analyzed while remaining encrypted. Recently, the use of cloud services has become widespread, but due to concerns about cracking and the reliability of cloud services, it is considered to encrypt data before storing it on the cloud. Homomorphic encryption is a technology that allows operations to be performed on encrypted data without decrypting it, making it possible to use cloud services without compromising security.

[0003] In order to improve the security of homomorphic encryption, deniability is a function that prevents the forced disclosure of data encrypted in the ciphertext by a privileged user, such as a government. An encryption algorithm in a general public key cryptography technique uses public key data and random number data to encrypt plaintext data. Since the public key data is public information, once the plaintext data and the random number data are determined, the ciphertext data is uniquely determined. Repudiability is a property that allows random number data to be generated for encrypting data different from the plaintext data actually encrypted into certain ciphertext data. This property allows a user to generate random number data for encrypting false data into ciphertext data stored by the user in order to entrust analysis processing to a cloud service. This makes it possible to avoid forced disclosure of plaintext data when the user is forced to disclose the data by a privileged user.

[0004] Non-Patent Document 1 describes the first example of a homomorphic encryption scheme that satisfies denial. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Shweta Agrawal, Shafi Goldwasser, and Saleet Mossel. Deniable Fully Homomorphic Encryption from LWE. In CRYPTO, pages 641-670, 2021. [Non-Patent Document 2] Adriana Lopez-Alt, Eran Tromer, and Vinod Vaikuntanathan. On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption. In STOC, pages 1219-1234, 2012. Summary of the Invention [Problem to be solved by the invention]

[0006] The homomorphic encryption with repudiation described in Non-Patent Document 1 can perform analysis processing only on ciphertext data encrypted under the same key. Therefore, when performing analysis processing using data of various users in a cloud service using the homomorphic encryption with repudiation described in Non-Patent Document 1, the users need to share the key with each other, and the confidentiality of the data between the users is not guaranteed.

[0007] The present disclosure aims to realize deniable homomorphic encryption, which allows each user to encrypt data using a different key. [Means for solving the problem]

[0008] The secret information processing system according to the present disclosure includes: a key generating device that generates an encryption key PK, a decryption key SK, and a homomorphic operation key EVK; The encrypted data C is obtained by encrypting the plaintext data m with the encryption key PK. DPK (m), and The encryption key PK and the ciphertext data C DPK (m) and repudiation random number data r for repudiating disclosure of plaintext data m are input. * A denial random number generator that generates a random number The homomorphic operation key EVK is used to perform homomorphic operation on the plaintext data to obtain homomorphic operation ciphertext data C. MPK A homomorphic arithmetic unit that generates (M); and a decryption device that decrypts the ciphertext data after the homomorphic operation. Effect of the Invention

[0009] In the secret information processing system according to the present disclosure, continuous secret information processing can be realized unconsciously by the subject, thereby making it possible to detect replacement or impersonation of the subject. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing an example of a system configuration of a secret information processing system according to a first embodiment. [Diagram 2] 1 is a block diagram showing a configuration of a key generating device according to a first embodiment. [Diagram 3] 1 is a block diagram showing a configuration of an encryption device according to a first embodiment. [Figure 4] 1 is a block diagram showing a configuration of a denial random number generation device according to a first embodiment. [Diagram 5] 1 is a block diagram showing a configuration of a homomorphic arithmetic device according to a first embodiment. [Figure 6] FIG. 1 is a block diagram showing a configuration of a decoding device according to a first embodiment. [Figure 7] 4 is a flowchart showing the operation of each device in the secret information processing system according to the first embodiment. [Figure 8] 4 is a flowchart showing a homomorphic operation of the secret information processing system according to the first embodiment. [Figure 9] 4 is a flowchart showing a homomorphic operation of the secret information processing system according to the first embodiment. [Figure 10]2 is a diagram showing an example of the hardware configuration of each device in the secret information processing system according to the first embodiment. [Figure 11] FIG. 13 is a diagram showing an example of the hardware configuration of each device in the secret information processing system according to a modification of the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] The present embodiment will be described below with reference to the drawings. In each drawing, the same or corresponding parts are given the same reference numerals. In the description of the embodiment, the description of the same or corresponding parts will be omitted or simplified as appropriate. The arrows in the drawings mainly indicate the flow of data or the flow of processing.

[0012] Embodiment 1 ***Configuration Description*** FIG. 1 is a diagram showing an example of a system configuration of a secret information processing system 100 according to the present embodiment. The secret information processing system 100 includes a key generation device 200, an encryption device 300, a repudiation random number generation device 400, a homomorphic arithmetic device 500, and a decryption device 600. The Internet 101 is a communication path that connects the key generation device 200, the multiple encryption devices 300, the denial random number generation device 400, the homomorphic arithmetic device 500, and the decryption device 600. The Internet 101 is an example of a network. Other types of networks may be used instead of the Internet 101.

[0013] The key generating device 200 is, for example, a PC. PC is an abbreviation for Personal Computer. The key generation device 200 creates an encryption key used for encryption, a homomorphic computation key used for homomorphic computation, and a decryption key used for decrypting ciphertext data. The key generation device 200 transmits the encryption key to the encryption device 300 and the repudiation random number generation device 400, the homomorphic computation key to the homomorphic computation device 500, and the decryption key to the decryption device 600 via the Internet 101. These keys may be transmitted directly by mail or the like. Since the decryption key is confidential information, it is stored inside the key generation device 200 and the decryption device 600 to prevent leakage.

[0014] The encryption device 300 generates encrypted data by encrypting plaintext data with an encryption key. The encryption device 300 generates encrypted data by encrypting plaintext data with a single encryption key. The encryption device 300 is, for example, a PC. The encryption device 300 generates ciphertext data by encrypting plaintext data obtained from a sensor in a factory or the like with a stored encryption key. The encryption device 300 transmits the ciphertext data to the homomorphic arithmetic device 500.

[0015] The repudiation random number generation device 400 receives an encryption key and ciphertext data as input, and generates repudiation random number data for denying disclosure of plaintext data. The repudiation random number generation device 400 is, for example, a PC. The repudiation random number generation device 400 also functions as an encryption key storage device that receives the encryption key sent from the key generation device 200 and stores the encryption key. The repudiation random number generation device 400 generates repudiation random number data from the ciphertext data, plaintext data, and random number data sent from the encryption device 300, and stores the generated data.

[0016] The homomorphic arithmetic device 500 receives a homomorphic arithmetic key and encrypted data as input, and generates post-homomorphic-arithmetic ciphertext data by performing homomorphic arithmetic on the result of calculation of plaintext data. The homomorphic arithmetic device 500 is, for example, a computer having a large-capacity storage medium. The homomorphic arithmetic device 500 also functions as a data storage device. That is, when a storage request for ciphertext data is received from the encryption device 300, the homomorphic arithmetic device 500 stores the ciphertext data. The homomorphic arithmetic device 500 also functions as a device that performs homomorphic operations on the stored ciphertext data. That is, the homomorphic arithmetic device 500 generates ciphertext data (ciphertext data after homomorphic operation) that is the result of an operation on the plaintext data of the ciphertext data from the stored homomorphic operation key and the stored ciphertext data, and transmits it to the decryption device 600. The stored homomorphic operation key is a homomorphic operation key stored in the homomorphic arithmetic device 500. The stored ciphertext data is ciphertext data stored in the homomorphic arithmetic device 500.

[0017] The decryption device 600 decrypts the ciphertext data after the homomorphic computation. The decryption device 600 is, for example, a PC. The decryption device 600 receives the decryption key sent from the key generation device 200 and also functions as a decryption key storage device that stores the decryption key. The decryption device 600 is also a PC that operates as a ciphertext data decryption device that receives ciphertext data (ciphertext data after homomorphic operation) sent from the homomorphic operation device 500 and obtains the operation result by decrypting it with a stored decryption key.

[0018] Note that any of the key generation device 200, the encryption device 300, the denial random number generation device 400, the homomorphic arithmetic device 500, and the decryption device 600 may be included in the same PC at the same time.

[0019] The configuration of this embodiment will be described below. 1, the secret information processing system 100 includes a key generation device 200, an encryption device 300, a repudiation random number generation device 400, a homomorphic arithmetic device 500, and a decryption device 600. The configurations of the key generation device 200, the encryption device 300, the repudiation random number generation device 400, the homomorphic arithmetic device 500, and the decryption device 600 will be described below in that order.

[0020] FIG. 2 is a block diagram showing a configuration of a key generating device 200 according to this embodiment. As shown in FIG. 2, the key generation device 200 includes, as functional elements, an input unit 201, a denialable decryption key generation unit 202, a denialable encryption key generation unit 203, a multi-key homomorphic decryption key generation unit 204, a multi-key homomorphic encryption key generation unit 205, a homomorphic computation key generation unit 206, and a transmission unit 207. Although not shown, the key generation device 200 also includes a storage unit that stores data used by each unit of the key generation device 200.

[0021] An input unit 201 receives a security parameter λ, and sends the security parameter λ to a repudiable decryption key generation unit 202 and a multi-key homomorphic decryption key generation unit 204 . The denialable decryption key generation unit 202 generates a denialable decryption key DSK using the security parameter λ received from the input unit 201 as an input. Furthermore, the denialable decryption key generation unit 202 transmits the denialable decryption key DSK to the denialable encryption key generation unit 203, the homomorphic operation key generation unit 206, and the transmission unit 207. The denialable encryption key generation unit 203 generates a denialable encryption key DPK using the denialable decryption key DSK received from the denialable decryption key generation unit 202 as an input. Furthermore, the denialable encryption key generation unit 203 transmits the denialable encryption key DPK to the transmission unit 207.

[0022] The multi-key homomorphic decryption key generation unit 204 generates a multi-key homomorphic decryption key MSK using the security parameter λ received from the input unit 201 as an input. Furthermore, the multi-key homomorphic decryption key generation unit 204 transmits the multi-key homomorphic decryption key MSK to the multi-key homomorphic encryption key generation unit 205 and the transmission unit 207. The multi-key homomorphic encryption key generation unit 205 generates a multi-key homomorphic encryption key MPK using the multi-key homomorphic decryption key MSK received from the multi-key homomorphic decryption key generation unit 204 as an input. Furthermore, the multi-key homomorphic encryption key generation unit 205 transmits the multi-key homomorphic encryption key MPK to the homomorphic computation key generation unit 206 and the transmission unit 207.

[0023] The homomorphic operation key generation unit 206 generates a homomorphic operation key EVK using the denial-proof decryption key DSK received from the denial-proof decryption key generation unit 202 and the multi-key homomorphic encryption key MPK received from the multi-key homomorphic encryption key generation unit 205 as input. Furthermore, the homomorphic operation key generation unit 206 transmits the homomorphic operation key EVK to the transmission unit 207.

[0024] The transmission unit 207 generates a decryption key SK=(DSK, MSK) from the denialable decryption key DSK generated by the denialable decryption key generation unit 202 and the multi-key homomorphic decryption key MSK generated by the multi-key homomorphic decryption key generation unit 204, and transmits the decryption key SK=(DSK, MSK) to the decryption device 600. Alternatively, the transmission unit 207 generates an encryption key PK from the denialable encryption key DPK generated by the denialable encryption key generation unit 203 and the multi-key homomorphic encryption key MPK generated by the multi-key homomorphic encryption key generation unit 205, and transmits the encryption key PK to the encryption device 300 and the denial random number generation device 400. Alternatively, the transmission unit 207 transmits the homomorphic computation key EVK generated by the homomorphic computation key generation unit 206 to the homomorphic computation device 500.

[0025] FIG. 3 is a block diagram showing a configuration of an encryption device 300 according to this embodiment. As shown in FIG. 3, the encryption device 300 includes, as functional elements, an input unit 301, an encryption key storage unit 302, a plaintext storage unit 303, a random number generation unit 304, an encryption unit 305, a random number storage unit 306, and a transmission unit 307. Although not shown, the encryption device 300 also includes a storage unit that stores data used by each unit of the encryption device 300 .

[0026] The input unit 301 receives the encryption key PK transmitted from the key generating device 200, and transmits it to the encryption key storage unit 302. Alternatively, the input unit 301 receives plaintext data m, and transmits the plaintext data m to the plaintext storage unit 303. The encryption key storage unit 302 stores the encryption key PK received from the input unit 301 . The plaintext storage unit 303 stores the plaintext data m received from the input unit 301 . The random number generation unit 304 generates random number data r from the encryption key PK stored in the encryption key storage unit 302 , and transmits the data r to the encryption unit 305 and the random number storage unit 306 .

[0027] The encryption unit 305 receives the encryption key PK sent from the encryption key storage unit 302, the plaintext data m sent from the plaintext storage unit 303, and the random number data r from the random number generation unit 304, and generates ciphertext data C of the plaintext data m. PK Then, the encryption unit 305 generates the ciphertext data C PK (m) is transmitted to the transmitting unit 307. PK (m) represents ciphertext data obtained by encrypting plaintext data m with encryption key PK. The random number storage unit 306 stores the random number data r received from the random number generation unit 304 . The transmission unit 307 receives the ciphertext data C PK (m) and transmits it to the repudiation random number generation device 400 and the homomorphic arithmetic device 500.

[0028] FIG. 4 is a block diagram showing a configuration of a denial random number generation device 400 according to this embodiment. As shown in FIG. 4, the repudiation random number generation device 400 includes, as functional elements, an input unit 401, an encryption key storage unit 402, a repudiation random number generation unit 403, and a repudiation random number storage unit 404. In addition, although not shown, the denial random number generation device 400 includes a storage unit that stores data used in each unit of the denial random number generation device 400 .

[0029] The input unit 401 receives the encryption key PK transmitted from the key generating device 200 and sends it to the encryption key storage unit 402. Alternatively, the encrypted text data C transmitted from the encryption device 300 PK The random number data r is received as (m) and sent to the denial random number generation unit 403 . The encryption key storage unit 402 stores the encryption key PK received from the input unit 401 of the repudiation random number generation device 400 . The repudiation random number generator 403 receives the ciphertext data C PK(m), the random number data r, and the encryption key PK stored in the encryption key storage unit 402 to obtain the denial random number data r * and sends it to the negation random number storage unit 404. The negation random number storage unit 404 stores the negation random number data r received from the negation random number generation unit 403. * Store the.

[0030] FIG. 5 is a block diagram showing a configuration of a homomorphic arithmetic device 500 according to this embodiment. As shown in FIG. 5, the homomorphic arithmetic device 500 includes, as functional elements, an input unit 501, a homomorphic arithmetic key storage unit 502, a ciphertext storage unit 503, a arithmetic processing configuration unit 504, a homomorphic arithmetic unit 505, and a transmission unit 506. Although not shown, the homomorphic arithmetic device 500 also includes a storage unit that stores data used in each unit of the homomorphic arithmetic device 500 .

[0031] The input unit 501 receives the homomorphic operation keys EVK1 and EVK2 transmitted from the key generating device 200, and sends them to the homomorphic operation key storage unit 502. Alternatively, the encrypted data C PK1 (m1) and C PK2 The unit 504 receives (m2) and sends it to the ciphertext storage unit 503. Alternatively, the unit 504 receives the arithmetic circuit f and sends it to the arithmetic processing configuration unit 504.

[0032] The homomorphic operation key storage unit 502 stores the homomorphic operation keys EVK1 and EVK2 received from the input unit 501. The ciphertext storage unit 503 receives the ciphertext data C PK1 (m1) and ciphertext data C PK2 Store (m2). The arithmetic processing configuration unit 504 receives an arithmetic circuit f from the input unit 501 and ciphertext data C from the ciphertext storage unit 503. PK1 (m1) and C PK2 Using (m2) as input, a homomorphic arithmetic circuit C is generated.

[0033] The homomorphic arithmetic unit 505 receives the homomorphic arithmetic keys EVK1 and EVK2 from the homomorphic arithmetic key storage unit 502 and the homomorphic arithmetic circuit C from the arithmetic processing configuration unit 504, and generates ciphertext data C related to the arithmetic result data M=f(m1, m2) obtained by applying the arithmetic circuit f to the plaintext data m1 and the plaintext data m2. PK (M) and transmits it to the transmission unit 506. Here, f(m1, m2) represents the result of calculation of the arithmetic circuit f using two plaintext data m1 and m2 as input, and PK represents the set {PK1, PK2} consisting of the encryption keys PK1 and PK2. In the following, C PK (M) represents the ciphertext data after homomorphic operation of the operation result data M for the encryption key set PK={PK1, PK2}. PK From (M), the operation result data M can be decrypted by using the decryption keys SK1 and SK2. The transmission unit 506 receives the homomorphic computation-completed ciphertext data C PK (M) is transmitted to the decoding device 600.

[0034] FIG. 6 is a block diagram showing a configuration of a decoding device 600 according to this embodiment. As shown in FIG. 6, the decryption device 600 includes, as functional elements, an input unit 601, a decryption key storage unit 602, a decryption processing unit 603, and a decryption result storage unit 604. Although not shown, the decoding device 600 also includes a storage unit that stores data used in each unit of the decoding device 600 .

[0035] The input unit 601 receives the decryption keys SK1 and SK2 transmitted from the key generating device 200. Alternatively, the input unit 601 receives the ciphertext data C after homomorphic computation of the computation result data M on the set of encryption keys PK={PK1, PK2} transmitted from the homomorphic computation device 500. PK Receive (M). The decryption key storage unit 602 stores the decryption keys SK1 and SK2 received from the input unit 601. The decryption processing unit 603 receives the homomorphic operation ciphertext data C from the input unit 601. PKThe decryption processing unit 603 receives the decryption keys SK1 and SK2 from the decryption key storage unit 602. PK The encrypted operation result data M is decrypted using the decryption keys SK1 and SK2, and sent to the decryption result storage unit 604. The decryption result storage unit 604 receives the computation result data M from the decryption processing unit 603 and stores it.

[0036] ***Explanation of Operation*** Next, an operation of the secret information processing system 100 according to the present embodiment will be described. The operation procedure of the secret information processing system 100 corresponds to a secret information processing method. Also, a program for realizing the operation of the secret information processing system 100 corresponds to a secret information processing program.

[0037] FIG. 7 is a flowchart showing the operation of each device in the secret information processing system 100 according to this embodiment. The flowchart in FIG. 7 shows the generation and storage process of encryption keys, decryption keys, and homomorphic computation keys.

[0038] Steps S701 to S713 in FIG. 7 are processes executed by the key generation device 200, the encryption device 300, the repudiation random number generation device 400, the homomorphic arithmetic device 500, and the decryption device 600. Steps S701 to S705 are executed by the key generating device 200. Steps S706 to S707 are executed by the encryption device 300. Steps S708 to S709 are executed by the repudiation random number generator 400. Steps S710 to S711 are executed by the homomorphic arithmetic device 500. Steps S712 and S713 are executed by the decoding device 600.

[0039] In step S701, the input unit 201 of the key generating device 200 receives the security parameter λ. In step S702, the denialable decryption key generation unit 202 of the key generation device 200 uses as an input the security parameter λ received by the input unit 201 of the key generation device 200 in step S701 to generate a denialable decryption key DSK. Furthermore, the multi-key homomorphic decryption key generation unit 204 of the key generation device 200 uses as an input the security parameter λ received by the input unit 201 of the key generation device 200 in step S701 to generate a multi-key homomorphic decryption key MSK. Here, the denialable decryption key DSK is generated using the key generation algorithm described in Non-Patent Document 1. Moreover, the multi-key homomorphic decryption key MSK is generated using the key generation algorithm described in Non-Patent Document 2.

[0040] In step S703, the denial-encryption key generation unit 203 of the key generation device 200 receives the denial-decryption key DSK as an input and generates a denial-encryption key DPK. Furthermore, the multi-key homomorphic encryption key generation unit 205 of the key generation device 200 receives the multi-key homomorphic decryption key MSK as an input and generates a multi-key homomorphic encryption key MPK. Here, the denial-encryption key DPK is generated using the key generation algorithm described in Non-Patent Document 1. Moreover, the multi-key homomorphic encryption key MPK is generated using the key generation algorithm described in Non-Patent Document 2.

[0041] In step S704, the homomorphic operation key generation unit 206 of the key generation device 200 outputs a multi-key homomorphic ciphertext obtained by encrypting the denial decryption key DSK with the multi-key homomorphic encryption as the homomorphic operation key EVK. Specifically, the homomorphic operation key generation unit 206 receives the denial decryption key DSK and the multi-key homomorphic encryption key MPK as input, and generates the homomorphic operation key EVK in the format of the following (Equation 1).

[0042] EVK=Enc(MPK,DSK) (Equation 1) Here, the algorithm Enc is the encryption algorithm described in Non-Patent Document 2.

[0043] In step S705, the transmission unit 207 of the key generation device 200 generates a decryption key SK expressed in the format of the following (Equation 2) from the denializable decryption key DSK and the multi-key homomorphic decryption key MSK. Furthermore, the transmission unit 207 of the key generation device 200 generates an encryption key PK expressed in the format of the following (Equation 3) from the denializable encryption key DPK and the multi-key homomorphic encryption key MPK.

[0044] SK=(DSK,MSK) (Equation 2) PK=(DPK,MPK) (Equation 3)

[0045] The transmission unit 207 of the key generation device 200 transmits the encryption key PK to the encryption device 300 and the repudiation random number generation device 400. In addition, the transmission unit 207 of the key generation device 200 transmits the homomorphic operation key EVK generated by the homomorphic operation key generation unit 206 of the key generation device 200 to the homomorphic operation device 500. In addition, the transmission unit 207 of the key generation device 200 transmits the decryption key SK to the decryption device 600.

[0046] In step S706, the input unit 301 of the encryption device 300 receives the encryption key PK transmitted by the transmission unit 207 of the key generation device 200 in step S705. In step S707, the encryption key storage unit 302 of the encryption device 300 stores the encryption key PK received by the input unit 301 of the encryption device 300 in step S706.

[0047] In step S708, the input unit 401 of the repudiation random number generation device 400 receives the encryption key PK transmitted by the transmission unit 207 of the key generation device 200 in step S705. In step S709, the encryption key storage unit 402 of the repudiation random number generation device 400 stores the encryption key PK received by the input unit 401 of the repudiation random number generation device 400 in step S708.

[0048] In step S710, the input unit 501 of the homomorphic arithmetic device 500 receives the homomorphic arithmetic key EVK transmitted by the transmission unit 207 of the key generation device 200 in step S705. In step S711, the homomorphic computation key storage unit 502 of the homomorphic computation device 500 stores the homomorphic computation key EVK received by the input unit 501 of the homomorphic computation device 500 in step S710.

[0049] In step S712, the input unit 601 of the decryption device 600 receives the decryption key SK transmitted by the transmission unit 207 of the key generation device 200 in step S705. In step S713, the decryption key storage unit 602 of the decryption device 600 stores the decryption key SK received by the input unit 601 of the decryption device 600 in step S712.

[0050] FIG. 8 is a flowchart showing homomorphic operations of the secret information processing system 100 according to this embodiment. Steps S801 to S815 in FIG. 8 are processes executed by the encryption device 300, the homomorphic arithmetic device 500, and the decryption device 600. Steps S801 to S806 are processes executed by the encryption device 300. Steps S807 to S812 are processes executed by the homomorphic arithmetic device 500. Steps S807 to S815 are processes executed by the decoding device 600.

[0051] In step S801, the input unit 301 of the encryption device 300 receives plaintext data m1 and m2 collected from, for example, a sensor, and sends the plaintext data m1 and m2 to the plaintext storage unit 303. In step S802, the plaintext storage unit 303 of the encryption device 300 stores the plaintext data m1 and m2 received from the input unit 301 of the encryption device 300. In step S 803 , the random number generation unit 304 of the encryption device 300 generates random number data r 1 and r 2 , and sends them to the random number storage unit 306 of the encryption device 300 . In step S804, the random number storage unit 306 of the encryption device 300 stores the random number data r1 and r2 received from the random number generation unit 304 of the encryption device 300.

[0052] In step S805, the encryption unit 305 of the encryption device 300 generates ciphertext data C from the denial-proof encryption key DPK1 stored in the encryption key storage unit 302 of the encryption device 300, the random number data r1 stored in the random number storage unit 306, and the plaintext data m1 stored in the plaintext storage unit 303. DPK1 Furthermore, the encryption unit 305 of the encryption device 300 generates ciphertext data C (m1) from the denial-proof encryption key DPK2 stored in the encryption key storage unit 302 of the encryption device 300, the random number data r2 stored in the random number storage unit 306, and the plaintext data m2 stored in the plaintext storage unit 303. DPK2 (m2) is generated. DPK1 (m1) and C DPK2 (m2) is sent to the transmitting unit 307 of the encryption device 300. In step S806, the transmission unit 307 of the encryption device 300 transmits the ciphertext data C DPK1 (m1) and C DPK2 (m2) and transmits it to the homomorphic arithmetic device 500.

[0053] In step S807, the input unit 501 of the homomorphic arithmetic device 500 receives the ciphertext data C DPK1 (m1) and C DPK2 (m2) and sends it to the ciphertext storage unit 503. In step S808, the ciphertext storage unit 503 of the homomorphic arithmetic device 500 receives the ciphertext data C DPK1 (m1) and C DPK2 Receive and store (m2). In step S 809 , the input unit 501 of the homomorphic arithmetic device 500 receives the arithmetic circuit f input from a keyboard, a mouse, a storage device, or the like, and sends it to the arithmetic processing configuration unit 504 . In step S810, the arithmetic processing configuration unit 504 of the homomorphic arithmetic device 500 converts the ciphertext data C DPK1 (m1) and C DPK2 Using (m2) and the arithmetic circuit f sent from the input unit 501 of the homomorphic arithmetic device 500 in step S809 as input, a homomorphic arithmetic processing circuit F expressed in the form of the following (Equation 4) is generated. The homomorphic arithmetic processing circuit F is sent to the homomorphic arithmetic unit 505 of the homomorphic arithmetic device 500.

[0054] F(DSK1,DSK2)=f(Dec(DSK1,C DPK1 (m1)),Dec(DSK2,C DPK2 (m2))) (number 4) Here, the algorithm Dec is the decoding algorithm described in Non-Patent Document 1. In the homomorphic computing device 500, during homomorphic computation, the decryption process of the denial-proof homomorphic encryption is calculated while keeping the data encrypted, thereby converting the encrypted data from the denial-proof ciphertext to the multi-key homomorphic ciphertext.

[0055] In step S811, the homomorphic arithmetic unit 505 of the homomorphic arithmetic device 500 receives the homomorphic arithmetic key EVK and the homomorphic arithmetic processing circuit F as input, and generates homomorphic arithmetic-completed ciphertext data C by using the homomorphic arithmetic algorithm described in Non-Patent Document 2. MPK (M) is generated, and the ciphertext data C after homomorphic operation is generated. MPK (M) is sent to the transmitting unit 506. In step S812, the transmission unit 506 of the homomorphic arithmetic device 500 transmits the homomorphic ciphertext data C MPK (M) is sent to the decoding device 600.

[0056] In step S813, the input unit 601 of the decryption device 600 receives the homomorphic-operation-completed ciphertext data C MPK (M) and sends it to the decoding processing unit 603. In step S814, the decryption processing unit 603 of the decryption device 600 receives the homomorphic operation ciphertext data C MPK The decryption process is performed using (M) and the decryption keys MSK1 and MSK2 stored in the decryption key storage unit 602 of the decryption device 600, and the decryption result M is obtained. Here, the homomorphic operation ciphertext data C MPK For the encryption key set MPK={MPK1, MPK2} of (M), the decryption result M=f(m1, m2) can be decrypted only when the multi-key homomorphic encryption key MPK1 has been generated by the multi-key homomorphic encryption key generation unit 205 using the multi-key homomorphic decryption key MSK1 as input, and the multi-key homomorphic encryption key MPK2 has been generated by the multi-key homomorphic encryption key generation unit 205 using the multi-key homomorphic decryption key MSK2 as input. The decryption processing unit 603 sends the decryption result M to the decryption result storage unit 604.

[0057] In step S815, the decryption result storage unit 604 of the decryption device 600 stores the decryption result M sent from the decryption processing unit 603 of the decryption device 600 in step S814. Note that the decryption device 600 only accepts the homomorphic-operation-after-ciphertext as input. However, when decrypting the homomorphic-operation-before-ciphertext, the decryption device 600 requests the homomorphic arithmetic device 500 to perform a homomorphic operation for an operation that outputs the same value as the input, and decrypts the obtained homomorphic-operation-after-ciphertext in the same manner as in step S814, thereby making it possible to decrypt the plaintext data of the homomorphic-operation-before-ciphertext. With step S815, the homomorphic computation process of the secret information processing system 100 ends.

[0058] FIG. 9 is a flowchart showing homomorphic operations of the secret information processing system 100 according to this embodiment. Steps S901 to S904 in FIG. 9 are processes executed by the encryption device 300 and the repudiation random number generation device 400. Step S 901 is a process executed by the encryption device 300 . Steps S902 to S904 are processes executed by the repudiation random number generation device 400.

[0059] In step S901, the transmission unit 307 of the encryption device 300 transmits the plaintext data m1 and m2 stored in the plaintext storage unit 303 of the encryption device 300, and the random number data r1 and r2 stored in the random number storage unit 306 of the encryption device 300 to the repudiation random number generation device 400.

[0060] In step S902, the input unit 401 of the repudiation random number generation device 400 receives the plaintext data m1 and m2 and the random number data r1 and r2 sent from the transmission unit 307 of the encryption device 300 in step S901, and sends them to the repudiation random number generation unit 403 of the repudiation random number generation device 400. In step S903, the repudiation random number generation unit 403 of the repudiation random number generation device 400 receives the plaintext data m1 and the random number data r1 received from the input unit 401 of the repudiation random number generation device 400 in step S902, and * Furthermore, the repudiation random number generation unit 403 of the repudiation random number generation device 400 receives the plaintext data m2 and the random number data r2 from the input unit 401 of the repudiation random number generation device 400 in step S902, and generates the repudiation random number data r2. * Generate the negation random data r1 * and r2 * is sent to the denial random number storage unit 404 of the denial random number generation device 400. In step S904, the denial random number storage unit 404 of the denial random number generation device 400 stores the denial random number data r1 received from the denial random number generation unit 403 of the denial random number generation device 400 in S903. * and r2 * Store the.

[0061] In this embodiment, the following secret information processing system 100 has been described. The key generating device 200 generates a first deniable encryption key and a first deniable decryption key, and a second deniable encryption key and a second deniable decryption key, which are used for deniable encryption. Each pair of the first deniable encryption key and the first deniable decryption key, and the second deniable encryption key and the second deniable decryption key are individual keys generated by different users. The key generating device 200 also generates a first multiple-key homomorphic encryption key and a first multiple-key homomorphic decryption key, and a second multiple-key homomorphic encryption key and a second multiple-key homomorphic decryption key, which are used for the multiple-key homomorphic encryption. The key generating device 200 also generates a first homomorphic operation key from the first deniable decryption key and the first multiple-key homomorphic encryption key. The key generating device 200 also generates a second homomorphic operation key from the second deniable decryption key and the second multiple-key homomorphic encryption key. The encryption device 300 encrypts the first plaintext data with the first deniable encryption key to obtain first encrypted data, and also encrypts the second plaintext data with the second deniable encryption key to obtain second encrypted data. The repudiation random number generation device 400 receives the first repudiable encryption key and the first ciphertext data as input, and generates first repudiation random number data for repudiating the disclosure of the first plaintext data. The repudiation random number generation device 400 receives the second repudiable encryption key and the second ciphertext data as input, and generates second repudiation random number data for repudiating the disclosure of the second plaintext data. The homomorphic computation device 500 receives as input a first homomorphic computation key, a second homomorphic computation key, and the first encrypted data and the second encrypted data, and generates post-homomorphic computation ciphertext data by performing a homomorphic computation on the computation result of the first plaintext data and the second plaintext data. The decryption device 600 decrypts the post-homomorphic-operation ciphertext data using the first denial-proof decryption key and the second denial-proof decryption key.

[0062] ***Hardware Configuration Description*** FIG. 10 is a diagram showing an example of the hardware configuration of each device of the secret information processing system 100 according to the present embodiment. In the following, the key generation device 200, the encryption device 300, the repudiation random number generation device 400, the homomorphic arithmetic device 500, and the decryption device 600 may be referred to as each device of the secret information processing system 100.

[0063] Each device in the secret information processing system 100 is a computer. Each device in the secret information processing system 100 includes a processor 910 and other hardware such as a memory 921, an auxiliary storage device 922, an input interface 930, an output interface 940, and a communication device 950. The processor 910 is connected to the other hardware via a signal line and controls the other hardware.

[0064] As described with reference to FIGS. 2 to 6, each device of the secret information processing system 100 has functional elements. The functional elements of each device in the secret information processing system 100 are realized by software. Moreover, a storage unit of each device in the secret information processing system 100 is provided in a memory 921. The storage unit may be provided in an auxiliary storage device 922, or may be provided separately in the memory 921 and the auxiliary storage device 922.

[0065] The processor 910 is a device that executes a secret information processing program. The secret information processing program is a program that realizes the functional elements of each device of the secret information processing system 100. The processor 910 is an IC that performs arithmetic processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0066] The memory 921 is a storage device that temporarily stores data. Specific examples of the memory 921 are SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory. The auxiliary storage device 922 is a storage device that stores data. A specific example of the auxiliary storage device 922 is a HDD. The auxiliary storage device 922 may also be a portable storage medium such as an SD (registered trademark) memory card, CF, NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. Note that HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.

[0067] The input interface 930 is a port connected to an input device such as a mouse, a keyboard, or a touch panel. Specifically, the input interface 930 is a USB terminal. The input interface 930 may be a port connected to a LAN. USB is an abbreviation for Universal Serial Bus. LAN is an abbreviation for Local Area Network.

[0068] The output interface 940 is a port to which a cable of an output device such as a display is connected. Specifically, the output interface 940 is a USB terminal or an HDMI (registered trademark) terminal. Specifically, the display is an LCD. The output interface 940 is also called a display interface. HDMI (registered trademark) is an abbreviation for High Definition Multimedia Interface. LCD is an abbreviation for Liquid Crystal Display.

[0069] The communication device 950 has a receiver and a transmitter. The communication device 950 is connected to a communication network such as a LAN, the Internet, a telephone line, or Wi-Fi (registered trademark). Specifically, the communication device 950 is a communication chip or a NIC. NIC is an abbreviation for Network Interface Card.

[0070] The secret information processing program is executed in the secret information processing system 100. The secret information processing program is read into the processor 910 and executed by the processor 910. In addition to the secret information processing program, an OS is also stored in the memory 921. The OS is an abbreviation for Operating System. The processor 910 executes the secret information processing program while executing the OS. The secret information processing program and the OS may be stored in an auxiliary storage device 922. The secret information processing program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Note that a part or all of the secret information processing program may be incorporated into the OS.

[0071] The secret information processing system 100 may include a plurality of processors that replace the processor 910. These plurality of processors share the task of executing the secret information processing program. Each of the processors is a device that executes the secret information processing program, similar to the processor 910.

[0072] The data, information, signal values ​​and variable values ​​used, processed or output by the confidential information processing program are stored in the memory 921, the auxiliary storage device 922, or a register or cache memory within the processor 910.

[0073] The "parts" of the functional elements of each device of the secret information processing system 100 may be read as "circuits," "steps," "procedures," "processing," or "circuitry." The secret information processing program causes a computer to execute processing in which the "parts" of the functional elements of each device of the secret information processing system 100 are read as "processing." The "parts" of the functional elements of each device of the secret information processing system 100 may be read as "programs," "program products," "computer-readable storage media storing a program," or "computer-readable recording media recording a program." The secret information processing method is a method performed by the secret information processing system 100 executing the secret information processing program. The secret information processing program may be provided in a state stored in a computer-readable recording medium. Also, the secret information processing program may be provided as a program product.

[0074] ***Other configurations*** In this embodiment, the functional elements of each device in the secret information processing system 100 are realized by software. As a modification, the functional elements of each device in the secret information processing system 100 may be realized by hardware. Specifically, each device of the secret information processing system 100 includes an electronic circuit 909 instead of a processor 910 .

[0075] FIG. 11 is a diagram showing an example of the hardware configuration of each device of the secret information processing system 100 according to a modified example of the present embodiment. The electronic circuit 909 is a dedicated electronic circuit that realizes the functional elements of each device of the secret information processing system 100. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0076] The functional elements of each device of the secret information processing system 100 may be realized by one electronic circuit, or may be realized by being distributed among multiple electronic circuits.

[0077] As another modification, some of the functions of the functional elements of each device in the secret information processing system 100 may be realized by electronic circuits, and the remaining functions may be realized by software. Also, some or all of the functions of the functional elements of each device in the secret information processing system 100 may be realized by firmware.

[0078] Each of the processor and the electronic circuit is also called a processing circuitry. In other words, the functional elements of each device in the secret information processing system 100 are realized by the processing circuitry.

[0079] ***Explanation of the Effects of the Present Embodiment*** The secret information processing system according to this embodiment provides the following advantages, for example. Typically, when considering outsourcing analytical processing to a cloud using homomorphic encryption, it is sufficient for deniability to be true for the ciphertext before the analytical processing, and the ciphertext after the analytical processing does not need to be a homomorphic encryption ciphertext with deniability. In the secret information processing system of this embodiment, by combining homomorphic encryption with repudiation with multi-key homomorphic encryption, the system is endowed with the functionality to analyze and process data encrypted with different keys while ensuring repudiation. In the secret information processing system of this embodiment, in order to combine homomorphic encryption with denialibility and multi-key homomorphic encryption, a special analysis processing circuit is designed that performs analysis processing while converting the ciphertext of homomorphic encryption with denialibility into the ciphertext of multi-key homomorphic encryption, thereby making it possible to perform analysis processing between data encrypted with different keys while maintaining denialibility. This provides homomorphic encryption that allows analysis of data encrypted with different keys. In addition, encrypted data only needs to be encrypted with the key of the encrypted data generator, which contributes to improving efficiency.

[0080] Normally, since plaintext data is encrypted using homomorphic encryption, which can perform homomorphic operations only on data encrypted with the same internal key, homomorphic operations cannot be performed on data encrypted with different keys. According to the secret information processing system of the present embodiment, homomorphic operations can be performed on ciphertext data generated with different encryption keys.

[0081] In addition, according to the secret information processing system of the present embodiment, homomorphic operations can be performed between ciphertext data generated under different encryption keys, so that analysis processing can be entrusted to a cloud server with smaller ciphertext data size. Normally, homomorphic operations can only be performed between data encrypted under the same key, so that the ciphertext data creator needs to encrypt his / her own plaintext data under the key of another ciphertext data generator, and the size of the ciphertext data is very large. According to the secret information processing system of the present embodiment, there is no need to generate ciphertext data under the key of such another ciphertext data generator, which has the effect of contributing to improved efficiency.

[0082] As described above, the secret information processing system according to the present embodiment can provide homomorphic encryption that can analyze data encrypted with different keys by effectively combining two types of encryption techniques, namely, denializable encryption and multi-key homomorphic encryption. In addition, it is sufficient to encrypt the encrypted data with only the key of the encrypted data generator, which also contributes to improving efficiency.

[0083] In the above-mentioned first embodiment, each unit of each device of the secret information processing system has been described as an independent functional block. However, the configuration of each device of the secret information processing system does not have to be the configuration as in the above-mentioned embodiment. The functional block of each device of the secret information processing system may have any configuration as long as it can realize the functions described in the above-mentioned embodiment. Furthermore, each device of the secret information processing system may be a system composed of multiple devices, rather than a single device. In addition, a plurality of parts of the first embodiment may be combined and implemented. Alternatively, only one part of this embodiment may be implemented. In addition, this embodiment may be combined in any manner as a whole or in part and implemented. That is, in the first embodiment, the embodiments can be freely combined, or any of the components in each embodiment can be modified, or any of the components in each embodiment can be omitted.

[0084] The above-described embodiment is essentially a preferred example, and is not intended to limit the scope of the present disclosure, the scope of application of the present disclosure, and the scope of use of the present disclosure. The above-described embodiment can be modified in various ways as necessary. For example, the procedure described using a flow chart or sequence chart may be modified as appropriate. [Explanation of symbols]

[0085] 100 Secret information processing system, 101 Internet, 200 Key generation device, 201, 301, 401, 501, 601 Input unit, 202 Repudiable decryption key generation unit, 203 Repudiable encryption key generation unit, 204 Multiple key homomorphic decryption key generation unit, 205 Multiple key homomorphic encryption key generation unit, 206 Homomorphic operation key generation unit, 207, 307, 506 Transmission unit, 300 Encryption device, 302, 402 Encryption key storage unit, 303 Plaintext storage unit, 304 Random number generation unit, 305 Encryption unit, 306 Random number storage unit, 400 Repudiation random number generation device, 403 Repudiation random number generation unit, 404 Repudiation random number storage unit, 500 Homomorphic operation device, 502 Homomorphic operation key storage unit, 503 Ciphertext storage unit, 504 arithmetic processing configuration unit, 505 homomorphic calculation unit, 600 decryption device, 602 decryption key storage unit, 603 decryption processing unit, 604 decryption result storage unit, 909 electronic circuit, 910 processor, 921 memory, 922 auxiliary storage device, 930 input interface, 940 output interface, 950 communication device.

Claims

1. a key generation device for generating an encryption key, a decryption key, and a homomorphic computation key; an encryption device that generates encrypted data by encrypting plaintext data with an encryption key; a repudiation random number generation device that receives an encryption key and ciphertext data as input and generates repudiation random number data for repudiating disclosure of plaintext data; a homomorphic computation device that receives a homomorphic computation key and encrypted data as input, and generates homomorphically computed ciphertext data by performing a homomorphic computation on a computation result of plaintext data; a decryption device that decrypts the ciphertext data after the homomorphic operation; A confidential information processing system comprising:

2. The key generating device includes:

2. The secret information processing system according to claim 1, wherein a denial encryption key used for denial encryption and a multi-key homomorphic encryption key used for multi-key homomorphic encryption are output as the encryption keys.

3. The key generating device includes:

3. The secret information processing system according to claim 2, wherein a denial decryption key used for denial encryption and a multi-key homomorphic decryption key used for multi-key homomorphic encryption are output as the decryption keys.

4. The key generating device includes: The secret information processing system according to claim 3 , wherein a multi-key homomorphic ciphertext obtained by encrypting the denial-proof decryption key with a multi-key homomorphic encryption is output as the homomorphic operation key.

5. The homomorphic computing device includes: The secret information processing system according to claim 4 , wherein during homomorphic calculation, the encrypted data is converted from a denial-proof ciphertext to a multi-key homomorphic ciphertext by calculating a decryption process of the denial-proof homomorphic encryption while keeping the data encrypted.

6. A key generating device generates an encryption key, a decryption key, and a homomorphic computation key; an encryption device generates encrypted data by encrypting plaintext data with an encryption key; a repudiation random number generation device receives an encryption key and ciphertext data as input, and generates repudiation random number data for repudiating disclosure of plaintext data; a homomorphic computing device receives the homomorphic computation key and the encrypted data as input, and generates homomorphically computed ciphertext data by homomorphically computing a computation result of the plaintext data; A secret information processing method used in a secret information processing system in which a decryption device decrypts ciphertext data after a homomorphic operation.

7. A key generation process for generating an encryption key, a decryption key, and a homomorphic computation key; an encryption process for generating encrypted data by encrypting plaintext data with an encryption key; a repudiation random number generation process for generating repudiation random number data for repudiating disclosure of the plaintext data using an encryption key and ciphertext data as input; a homomorphic computation process for generating homomorphically computed ciphertext data by performing a homomorphic computation on a result of the computation on the plaintext data using a homomorphic computation key and encrypted data as input; A decryption process for decrypting the encrypted data after the homomorphic operation. A confidential information processing program that causes a computer to execute the above.

Images