Information processing program, information processing method, and information processing device

Abstract

A service provider (C) accepts gm, the digital signature and a zero-knowledge proof statement (Π) of the digital signature from a job-seeker (A). The gm is encrypted data obtained by encrypting attribute information (m) by exponentiation using the key (g) of the job-seeker (A). The service provider (C) accepts h1 / n from a company (B). The h1 / n is encrypted data obtained by encrypting requirement information (n) by exponentiation using the key (h) of the company (B). The service provider (C) receives information (pairing e, arithmetic result eAB (g,h)) related to pairing arithmetic from a key management server (202). When the validity of the digital signature is verified by use of the zero-knowledge proof statement (Π), the service provider (C) utilizes the bi-homomorphism of the pairing to perform a matching without decrypting the encrypted data into a plain text.

Description

[Technical field]

[0001] The present invention relates to an information processing program, an information processing method, and an information processing device. [Background technology]

[0002] A matching system is a service that connects demand and supply. Matching systems are deployed in various forms, such as job matching, resource matching, flea markets, and matching apps. In a matching system, for example, users are matched by matching attribute information submitted by a user with interests in attributes submitted by another user.

[0003] Prior art includes, for example, aggregating medical records in a manner that protects the identity of patients. Another technology generates anonymized media information in which at least some of the characteristics of a visitor are anonymized, and compares the anonymized media information with accumulated registered anonymized media information while keeping the anonymized media information anonymized to generate a comparison result. Registered anonymized media information is media information in which unspecified persons are recorded, with at least some of the characteristics of the person anonymized. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] US Patent Application Publication No. 2015 / 0149208 [Patent Document 2] JP 2016-71639 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, with conventional technology, it is difficult to guarantee the authenticity of the data about users to be matched while keeping the contents of the data confidential from third parties.

[0006] In one aspect, the present invention aims to ensure the authenticity of data while keeping the contents of the data secret from third parties. [Means for solving the problem]

[0007] In one embodiment, an information processing program is provided that receives first encrypted data obtained by encrypting first data by indexing using a first key, an electronic signature assigned to the first data, and certification information for proving that the electronic signature is information capable of verifying authenticity of original data of the first encrypted data, receives second encrypted data obtained by encrypting second data by indexing using a second key, verifies the validity of the electronic signature using the certification information, obtains a first calculation result calculated from the first key and the second key using a predetermined function from a management device that manages the first key and the second key, and compares the obtained first calculation result with a second calculation result calculated from the first encrypted data and the second encrypted data using the predetermined function. Effect of the Invention

[0008] Advantageous Effects of Invention According to one aspect of the present invention, it is possible to ensure the authenticity of data while keeping the contents of the data confidential from third parties. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of an information processing method according to the first embodiment. [Diagram 2] FIG. 2 is an explanatory diagram showing an example of a system configuration of an information processing system 200. As shown in FIG. [Diagram 3] FIG. 3 is a block diagram showing an example of the hardware configuration of the matching device 201 and the like. [Figure 4] FIG. 4 is an explanatory diagram showing an example of the contents stored in the key storage DB 220. As shown in FIG. [Diagram 5] FIG. 5 is a block diagram showing an example of the functional configuration of the key management server 202. As shown in FIG. [Figure 6]FIG. 6 is a block diagram showing an example of the functional configuration of the client terminal Ci. [Figure 7] FIG. 7 is a block diagram showing an example of the functional configuration of the matching device 201. As shown in FIG. [Figure 8] FIG. 8 is an explanatory diagram showing an example of the matching process of the matching device 201. As shown in FIG. [Figure 9] FIG. 9 is an explanatory diagram illustrating an example of the operation of the information processing system 200 according to the first embodiment. [Figure 10] FIG. 10 is a flowchart showing an example of a setup process procedure of the key management server 202. [Figure 11] FIG. 11 is a flowchart showing an example of a key generation / update processing procedure of the client terminal Ci. [Figure 12] FIG. 12 is a flowchart showing an example of a key registration process procedure of the key management server 202. [Figure 13] FIG. 13 is a sequence diagram (part 1) showing the procedure of the matching process of the information processing system 200. [Figure 14] FIG. 14 is a sequence diagram (part 2) showing the procedure of the matching process of the information processing system 200. [Figure 15] FIG. 15 is a flowchart showing an example of a specific procedure of the proof generation process of the client terminal Ci. [Figure 16] FIG. 16 is a flowchart showing an example of a specific processing procedure of the proof verification processing by the matching device 201. [Figure 17] FIG. 17 is a flowchart showing an example of a specific processing procedure of the matching process of the matching device 201. [Figure 18] FIG. 18 is an explanatory diagram showing an embodiment of an information processing system 200. As shown in FIG. [Figure 19] FIG. 19 is an explanatory diagram illustrating an example of the operation of the information processing system 200 according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an information processing program, an information processing method, and an information processing device according to embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0011] (Embodiment) Fig. 1 is an explanatory diagram showing an example of an information processing method according to the first embodiment. In Fig. 1, an information processing device 101 is a computer that compares encrypted data with each other. The comparison of encrypted data with each other means, for example, comparing encrypted data with each other to determine whether or not they match.

[0012] The original plaintext (original data) of the encrypted data is data about the user to be matched, such as attribute information and requirement information. Attribute information is information indicating the attributes of the user. Requirement information is information indicating conditions (interests, etc.) for the attributes required by the user.

[0013] In the matching system, matching between users is performed, for example, by matching attribute information submitted by a user with interests in attributes submitted by other users. Taking job matching as an example, matching is performed by matching attribute information submitted by students (age, academic background, work history, etc.) with employment conditions submitted by companies (age, academic background, work history, etc.).

[0014] However, existing matching systems do not strictly require the accuracy of the attribute information submitted by users, or even if they do, the accuracy check is not automated, making it difficult to guarantee the authenticity of the attribute information. For example, in job matching, students submit their academic records and grades, but proof of their accuracy is often not required, and there is often no mechanism for automatically checking the accuracy.

[0015] In addition, in matching systems, users may submit their own personal data to the operators of the matching systems without processing it. In such cases, a large amount of personal data will be accumulated by the operators, causing users to have concerns about privacy and operators to consider the risk of information leaks.

[0016] Regarding the issue of authenticity of attribute information, it is possible to verify the authenticity by having a trusted third party sign the attribute information submitted by the user using various existing digital signature methods. However, the issue of privacy cannot be resolved by the digital signature method alone.

[0017] On the other hand, regarding the issue of privacy, by using existing technologies such as Relational Hash (Non-Patent Document 1), it is possible to have a third party match the attribute information and interest in attributes submitted by the user while keeping them secret. However, the Relational Hash method alone cannot solve the issue of authenticity of attribute information.

[0018] Relational hashing is a method of hashing two plaintexts that satisfy a certain relationship (for example, equality) using a certain key, and is a technology that allows a third party who knows the key to know whether the two plaintexts satisfy the relationship without knowing the original plaintexts. For more information on relational hashing, see, for example, Non-Patent Document 1 below.

[0019] Non-patent document 1: Mandal, Avradip, and Arnab Roy. “Relational hash: probabilistic hash for verifying relations, secure against forgery and more.” Annual Cryptology Conference. Springer, Berlin, Heidelberg, 2015.

[0020] Here, we will explain the issue of authenticity of attribute information by taking the example of applying the Relational Hash method to job matching. First, a trusted third party prepares a key, which is shared among users. Students use the hash function Hash1 to hash the attribute information (educational background) they submit. Companies use the hash function Hash2 to hash the job requirements (educational background), which are their interest in attributes.

[0021] The matching operator then uses the same key provided by a trusted third party to match the hashed values ​​without knowing the original plaintext. In this case, the matching operator can detect whether the two strings (hash values) are hashes of the same plaintext or different plaintexts, but cannot learn the contents of the original plaintext. Therefore, the privacy of students' academic records is protected.

[0022] In this way, while the relational hash method solves the issue of privacy, it cannot solve the issue of authenticity of attribute information. In addition, although digital signature technology is available as a technology for guaranteeing the accuracy of attribute information, a signature on plain text is not a signature on a hash value, so it cannot be applied as is.

[0023] For example, when the Relational Hash method is applied to job matching, a digital signature is added to the student's attribute information (educational history), and the authenticity of the attribute information (educational history) is guaranteed. However, since the digital signature is not valid for the hash value of the attribute information (educational history), the authenticity cannot be guaranteed.

[0024] It is also possible to use existing digital signature technology to request a re-signature on the hash value of the attribute information (educational history). For example, suppose the attribute information (educational history) is the name of the university the student graduated from, and the digital signature attached to the attribute information is a signature from that university. In this case, it is possible to have the signature of the graduated university attached to the hash value of the attribute information (educational history).

[0025] However, in this method, the university issues a signature for the hash value. Therefore, the university needs to understand which plaintext the hash value is the hash value of. However, the hashing in Relational Hash is a probabilistic algorithm.

[0026] For this reason, even if the university is presented with, for example, plaintext m, hash value H, and hash function Hash1, it is difficult for the university to verify that "the hash value H is the plaintext m hashed with the hash function Hash1." Furthermore, this method requires the university that issues the signature to develop a new application, which may increase the operating costs of the matching system.

[0027] In this embodiment, an information processing method for ensuring the authenticity of data while concealing the contents of the data about a user to be matched from a third party will be described. Hereinafter, a processing example (below (1) to (5)) of the information processing device 101 will be described.

[0028] (1) The information processing device 101 accepts first encrypted data 111, a digital signature 112, and proof information 113. Here, the first encrypted data 111 is information (ciphertext) obtained by encrypting first data 110 by exponentiation using a first key k1. The first data 110 is data about a first user 103 to be matched, and is, for example, attribute information indicating attributes of the first user 103.

[0029] The first key k1 is a key used for encryption, generated by the first user 103, and managed in the management device 102. The digital signature 112 is a signature given to the first data 110, and is information that allows the authenticity of the first data 110 to be verified using, for example, the signer's public key.

[0030] The proof information 113 is information for proving that the digital signature 112 is information capable of verifying the authenticity of the original data of the first encrypted data 111. The proof information 113 includes, for example, a zero-knowledge proof statement for proving that the digital signature 112 is information capable of verifying the authenticity of the original data of the first encrypted data 111 by using the signer's public key. The zero-knowledge proof is a method for proving the fact that one knows secret information to a verifier without disclosing the secret information itself.

[0031] (2) The information processing device 101 accepts the second encrypted data 121. Here, the second encrypted data 121 is information (ciphertext) obtained by encrypting the second data 120 by indexing using the second key k2. The second data 120 is data about the second user 104 to be matched, and is, for example, requirement information indicating conditions for attributes required by the second user 104. The second key k2 is a key used for encryption, generated by the second user 104, and managed in the management device 102.

[0032] (3) The information processing device 101 verifies the validity of the digital signature 112 by using the certification information 113. By verifying the validity of the digital signature 112 by using the certification information 113, the information processing device 101 ensures the authenticity of the first encrypted data 111, and therefore ensures the authenticity of the original data (first data 110) of the first encrypted data 111.

[0033] Specifically, for example, the information processing device 101 verifies the validity of the electronic signature 112 by proving a zero-knowledge proof text included in the proof information 113 using the public key, the electronic signature 112, and the first encrypted data 111. The public key may be included in the proof information 113, for example, or may be obtained from the signer of the electronic signature 112.

[0034] (4) The information processing device 101 acquires the first calculation result 130 from the management device 102. The first calculation result 130 is a calculation result calculated from the first key k1 and the second key k2 using a predetermined function F. The predetermined function F is, for example, a pairing function that performs a bihomocytic calculation. The management device 102 is an example of a trusted third party, and manages the first key k1 and the second key k2 so as not to disclose them to the outside.

[0035] (5) The information processing device 101 compares the acquired first operation result 130 with the second operation result 140 calculated from the first encrypted data 111 and the second encrypted data 121 using a predetermined function F. Specifically, for example, the information processing device 101 uses the bihomology of the predetermined function F to determine whether the first operation result 130 and the second operation result 140 match, thereby determining whether the original data (the first data 110, the second data 120) are equal.

[0036] In this way, according to the information processing device 101, it is possible to guarantee the authenticity of the data while concealing the contents of the data about the users to be matched from third parties. For example, by using encryption by exponentiation to conceal the first data 110, it is possible to simplify the first encrypted data 111 and generate proof information 113 such as a zero-knowledge proof text, and it is possible to guarantee the authenticity of the signed first data 110. Furthermore, since the approach of signing the first encrypted data 111 is not taken, it is not necessary to take a procedure such as requesting a signer to issue an additional signature. Also, for example, by using encryption by exponentiation and bihomogenity of pairing, it is possible to match users with each other while concealing the contents of the first data 110 and the second data 120 about the first user 103 and the second user 104 from third parties (for example, a matching business operator).

[0037] (System configuration example of information processing system 200) Next, a system configuration example of the information processing system 200 according to the first embodiment will be described. The information processing system 200 is applied to a matching system such as job matching, resource matching, a flea market, and a matching app.

[0038] In the following description, an example will be given in which the information processing device 101 shown in Fig. 1 is applied to a matching device 201 in an information processing system 200. Also, an example will be given in which the management device 102 shown in Fig. 1 is applied to a key management server 202 in the information processing system 200.

[0039] Fig. 2 is an explanatory diagram showing an example of a system configuration of an information processing system 200. In Fig. 2, the information processing system 200 includes a matching device 201, a key management server 202, and client terminals C1 to Cn (n: a natural number equal to or greater than 2). In the information processing system 200, the matching device 201, the key management server 202, and the client terminals C1 to Cn are connected via a wired or wireless network 210. The network 210 is, for example, a local area network (LAN), a wide area network (WAN), the Internet, or the like.

[0040] Here, the matching device 201 is a computer that performs matching between encrypted data. The matching device 201 is, for example, a server of a business entity (matching business entity) that provides a matching system.

[0041] The key management server 202 is a computer that has a key storage DB (Database) 220 and manages keys for encrypting data. The keys are generated, for example, in the client terminals C1 to Cn. The key management server 202 is, for example, a server of a trusted third party other than the parties involved in matching (users, matching business operators).

[0042] The contents stored in the key storage DB 220 will be described later with reference to FIG.

[0043] The client terminals C1 to Cn are computers used by users of the information processing system 200. The client terminals C1 to Cn are, for example, personal computers (PCs), tablet PCs, smartphones, etc. The first user 103 and the second user 104 shown in FIG. 1 correspond to, for example, users of the information processing system 200.

[0044] In the following description, any one of the client terminals C1 to Cn may be referred to as a "client terminal Ci" (i=1, 2, . . . , n).

[0045] (Example of hardware configuration of matching device 201, etc.) Next, an example of the hardware configuration of the matching device 201, the key management server 202, and the client terminal Ci will be described with reference to Fig. 3. Here, the matching device 201, the key management server 202, and the client terminal Ci will be referred to as "the matching device 201, etc."

[0046] Fig. 3 is a block diagram showing an example of a hardware configuration of the matching device 201, etc. In Fig. 3, the matching device 201, etc. includes a CPU (Central Processing Unit) 301, a memory 302, a disk drive 303, a disk 304, a communication I / F (Interface) 305, a portable recording medium I / F 306, and a portable recording medium 307. In addition, each component is connected to each other by a bus 300.

[0047] Here, the CPU 301 is responsible for the overall control of the matching device 201, etc. The CPU 301 may have multiple cores. The memory 302 has, for example, a read only memory (ROM), a random access memory (RAM), and a flash ROM. Specifically, for example, the flash ROM stores an OS program, the ROM stores an application program, and the RAM is used as a work area for the CPU 301. The programs stored in the memory 302 are loaded into the CPU 301 to cause the CPU 301 to execute the coded process.

[0048] The disk drive 303 controls reading / writing of data from / to the disk 304 under the control of the CPU 301. The disk 304 stores data written under the control of the disk drive 303. Examples of the disk 304 include a magnetic disk and an optical disk.

[0049] The communication I / F 305 is connected to the network 210 through a communication line, and is connected to an external computer via the network 210. The communication I / F 305 manages the interface between the network 210 and the inside of the device, and controls input and output of data from the external computer. For example, a modem or a LAN adapter can be used as the communication I / F 305.

[0050] The portable recording medium I / F 306 controls reading / writing of data from / to the portable recording medium 307 under the control of the CPU 301. The portable recording medium 307 stores data written under the control of the portable recording medium I / F 306. Examples of the portable recording medium 307 include a CD (Compact Disc)-ROM, a DVD (Digital Versatile Disk), and a USB (Universal Serial Bus) memory.

[0051] In addition to the above-mentioned components, the matching device 201, etc. may have, for example, an input device, a display, etc. Also, the matching device 201, etc. may not have, for example, the portable recording medium I / F 306 and the portable recording medium 307 among the above-mentioned components.

[0052] (Storage contents of key storage DB220) Next, a description will be given of the contents stored in the key storage DB 220 of the key management server 202. The key storage DB 220 is realized by, for example, a storage device such as the memory 302 or disk 304 of the key management server 202 shown in FIG.

[0053] Fig. 4 is an explanatory diagram showing an example of the contents stored in the key storage DB 220. In Fig. 4, the key storage DB 220 has fields for IDs and keys, and stores key management information (for example, key management information 400-1, 400-2) as records by setting information in each field.

[0054] Here, the ID is an identifier that uniquely identifies a user. The key is a key corresponding to a user. The key is generated in the client terminal Ci and managed in the key management server 202. For example, the key management information 400-1 indicates a key Key1 of a user U1.

[0055] (Example of Functional Configuration of Information Processing System 200) Next, an example of the functional configuration of the information processing system 200 will be described with reference to Fig. 5 to Fig. 7. First, an example of the functional configuration of the key management server 202 will be described with reference to Fig. 5.

[0056] Fig. 5 is a block diagram showing an example of a functional configuration of the key management server 202. In Fig. 5, the key management server 202 includes a setup processing unit 501, a reception unit 502, a registration unit 503, and a pairing calculation unit 504. The setup processing unit 501 to the pairing calculation unit 504 are functions that become a control unit, and specifically, the functions are realized by causing the CPU 301 to execute a program stored in a storage device such as the memory 302, the disk 304, or the portable recording medium 307 of the key management server 202 shown in Fig. 3, or by the communication I / F 305. The processing results of each functional unit are stored in a storage device such as the memory 302 or the disk 304 of the key management server 202.

[0057] The setup processing unit 501 sets information related to key generation. The key is a key for encrypting data. Specifically, for example, the setup processing unit 501 sets a prime number p. The setup processing unit 501 also sets a set U of domains, and sets a TABLE (dictionary type correspondence TABLE).

[0058] Here, the domain refers to, for example, the space and range of possible attributes provided by a user and interests in attributes. The dictionary-type correspondence TABLE uses elements of the domain set U as keys and elements of the set [p] = {0, ..., p-1} as values. However, when this TABLE is identified with a mapping, it is designed so that TABLE:U → [p] is injective.

[0059] Furthermore, the setup processing unit 501 sets information related to the pairing operation. Specifically, for example, the setup processing unit 501 sets a group G of prime order q and a group H of prime order p (q>p). The setup processing unit 501 also sets a pairing e. Here, the pairing e is a pairing function that performs a bihomocytic operation.

[0060] Here, the pairing e is "e:G×G→H". The pairing e:G×G→H is a mapping such that e(g1g2,h1)=e(g1,h1)e(g2,h1) and e(g1,h1h2)=e(g1,h1)e(g1,h2) for any g1,g2∈G,h1,h2∈H (bihomomorphism).

[0061] The setup processing unit 501 publishes the set U of domains, the TABLE, and the group G of prime order q to the entire information processing system 200.

[0062] The reception unit 502 receives a key registration request from the client terminal Ci. Here, the key registration request is a request to register a key. The key registration request includes, for example, an ID and a key. The ID is an identifier that uniquely identifies a user. The key is a key generated in the client terminal Ci. Specifically, for example, the reception unit 502 receives a key registration request from the client terminal Ci, thereby accepting the received key registration request.

[0063] The registration unit 503 registers a key in association with a user. Specifically, for example, when the registration unit 503 receives a key registration request, the registration unit 503 registers the key included in the key registration request in the key storage DB 220 shown in Fig. 4 in association with the ID included in the key registration request. Note that, if a key corresponding to the ID included in the key registration request has already been registered, the registration unit 503 may overwrite it with the key included in the key registration request.

[0064] The reception unit 502 also receives a pairing calculation request from the matching device 201. Here, the pairing calculation request is a request for a result of the pairing calculation. The pairing calculation request includes, for example, a combination of IDs of two users to be paired (for example, U1 and U2).

[0065] The pairing calculation unit 504 performs pairing calculation. Specifically, for example, when the pairing calculation unit 504 receives a pairing calculation request, the pairing calculation unit 504 acquires keys corresponding to each ID included in the pairing calculation request from the key storage DB 220. Next, the pairing calculation unit 504 inputs the keys corresponding to each acquired ID into pairing e and performs calculation to acquire a calculation result of pairing e.

[0066] Then, the pairing calculation unit 504 transmits the calculation result of the pairing e to the matching device 201. At this time, the pairing calculation unit 504 transmits the pairing e together with the calculation result of the pairing e to the matching device 201. However, the pairing e may have been shared in advance with the pairing business operator (matching device 201).

[0067] Next, an example of the functional configuration of the client terminal Ci will be described with reference to FIG.

[0068] Fig. 6 is a block diagram showing an example of a functional configuration of the client terminal Ci. In Fig. 6, the client terminal Ci includes a key generating unit 601, an encryption unit 602, a proof generating unit 603, and a communication unit 604. The key generating unit 601 to the communication unit 604 are functions that become a control unit, and specifically, the functions are realized by making the CPU 301 execute a program stored in a storage device such as the memory 302, the disk 304, or the portable recording medium 307 of the client terminal Ci shown in Fig. 3, or by the communication I / F 305. The processing results of each functional unit are stored in a storage device such as the memory 302 or the disk 304 of the client terminal Ci, for example.

[0069] The key generation unit 601 generates a key. Specifically, for example, the key generation unit 601 generates a key by selecting one element of a group G of prime order q published by the key management server 202. Then, the key generation unit 601 transmits a key registration request including an ID corresponding to the own terminal and the generated key to the key management server 202. The ID corresponding to the own terminal is the ID of the user who uses the client terminal Ci.

[0070] This allows the user of the client terminal Ci to generate his or her own key and upload (register) it to the key management server 202.

[0071] The encryption unit 602 encrypts the data to be matched using the generated key. The data to be matched is, for example, attribute information and requirement information. The attribute information is information indicating the attributes of the user. The attributes of the user are, for example, age, educational background, work history, sex, achievements, etc.

[0072] The requirement information is information indicating conditions for the attributes of other users that a user requires. The conditions for the attributes of other users correspond to an interest in the attributes of other users. For example, the conditions for the attributes of other users are employment conditions (age, educational background, work history, gender, achievements, etc.) that a company (user) requires of a job seeker (other user).

[0073] In the following description, one of the data to be matched may be written as "attribute information m" and the other as "requirement information n". In addition, the key of the user (attribute information provider) who provides the attribute information m may be written as "g", and the key of the user (requirement information provider) who provides the requirement information n may be written as "h".

[0074] Specifically, for example, the encryption unit 602 encrypts the attribute information m by exponentiation using the key g. More specifically, for example, the encryption unit 602 creates an attribute value m by encoding the attribute information m using a TABLE published by the key management server 202. Then, the encryption unit 602 generates encrypted data m' by raising the key g to the power m. The encrypted data m' is expressed as "m'=g m "

[0075] The encryption unit 602 also encrypts the requirement information n by exponentiation using the key h. To explain in more detail, for example, the encryption unit 602 creates a requirement value n by encoding the requirement information n using a TABLE published by the key management server 202. The encryption unit 602 then generates encrypted data n' by raising the key h to the power of (1 / n). The encrypted data n' is expressed as "n'=h 1 / n "

[0076] Here, m → g m And the conversion from n to h 1 / n This m→g m When encrypting plaintext m that is encoded as a number, we fix a finite cyclic group G and its generator g, and define m as m'=g m As an example of the conversion, let p be a (large) prime number, g∈{1,...,p-1}, and the message be encoded as m∈{0,...,p-1}. Then, m is converted to m'=g m (mod p) is one way to convert it.

[0077] The reason why this conversion is called encryption is that the plaintext m is converted into m'=g m It is well known that it is difficult to efficiently calculate "m" from the information "g and m'" when g is converted into m, so even if g and m' are made public, it is difficult to derive the original plaintext m. This conversion satisfies the properties of encryption, but is simpler than the conventional hashing using Relational Hash. This simplification makes it possible to generate a ZKP for the digital signature σ, which will be described later.

[0078] If a digital signature σ is attached to the data to be matched, the proof generating unit 603 generates proof information. Here, the digital signature σ is information that enables the authenticity of the data to be verified using the signer's public key pk. The digital signature σ is issued by a trusted third party. For example, if the attribute information m indicates the "name of university from which the student graduated," the digital signature σ is issued by that university.

[0079] The electronic signature σ is added to, for example, the attribute information m. In the following description, it is assumed that the electronic signature σ is added to the attribute information m.

[0080] The proof information is information for proving that the digital signature σ is information capable of verifying the authenticity of the original data of the encrypted data m' (the attribute information m, which is the original plaintext). Specifically, for example, the proof information includes a zero-knowledge proof text Π for proving that the digital signature σ is information capable of verifying the authenticity of the original data of the encrypted data m' using the signer's public key pk.

[0081] The zero-knowledge proof statement Π shows that when an attribute value m is encrypted to m', and a digital signature σ that can be verified with a third party's public key pk is given to the original attribute value m (attribute information m), "σ is a signature of the original plaintext of m' that can be verified with pk." To explain in more detail, the zero-knowledge proof statement Π is information for zero-knowledge proof of knowledge of "m such that m'=g^m, and σ is a signature that can be verified with the public key pk for m."

[0082] The zero-knowledge proof statement Π does not disclose attribute information m, but discloses m'=g^m, σ, pk, making it possible to prove that "m'=g^m, and σ is a signature of m that can be verified with the public key pk for m." Note that the method of generating the zero-knowledge proof statement Π can vary depending on, for example, the signature format.

[0083] In the following explanation, the zero-knowledge proof text Π may be written as “ZKP (Zero-Knowledge Proof) of the digital signature σ”.

[0084] The communication unit 604 transmits a matching request including the encrypted data to the matching device 201. Here, the matching request is a request for matching using the encrypted data. The encrypted data is data to be matched that has been encrypted.

[0085] For example, suppose that the data to be matched is "attribute information m" and that a digital signature σ is attached to the attribute information m. In this case, the communication unit 604 transmits a matching request including the encrypted data m', the public key pk, the digital signature σ, and the zero-knowledge proof text Π (ZKP of the digital signature σ) to the matching device 201. However, the public key pk may be obtained by the matching device 201 from the signer of the digital signature σ, for example.

[0086] Also, the data to be matched is assumed to be “requirement information n.” In this case, the communication unit 604 transmits to the matching device 201 a matching request including the encrypted data n′.

[0087] The communication unit 604 may also receive a matching result from the matching device 201. The matching result is a response to the matching request. The matching result may be, for example, information indicating a successful matching or a failed matching. In the case of a successful matching, the matching result may include information identifying a matching partner.

[0088] Next, an example of the functional configuration of the matching device 201 will be described with reference to FIG.

[0089] FIG. 7 is a block diagram showing an example of a functional configuration of the matching device 201. In FIG. 7, the matching device 201 includes a reception unit 701, a verification unit 702, an acquisition unit 703, a collation unit 704, and an output unit 705. The reception unit 701 to the output unit 705 are functions that become a control unit, and specifically, the functions are realized by making the CPU 301 execute a program stored in a storage device such as the memory 302, the disk 304, or the portable recording medium 307 of the matching device 201 shown in FIG. 3, or by the communication I / F 305. The processing results of each functional unit are stored in a storage device such as the memory 302 or the disk 304 of the matching device 201.

[0090] In the following description, a client terminal used by a user (attribute information provider) who provides attribute information m may be referred to as a "client terminal Ci." Also, a client terminal used by a user (requirement information provider) who provides requirement information n may be referred to as a "client terminal Cj" (j ≠ i, j = 1, 2, ..., n).

[0091] The reception unit 701 receives a first matching request from the client terminal Ci. Specifically, for example, the reception unit 701 receives the first matching request from the client terminal Ci, thereby receiving the received first matching request. Here, the first matching request includes, for example, encrypted data m', a public key pk, a digital signature σ, and a zero-knowledge proof document Π (ZKP of the digital signature σ).

[0092] The encrypted data m' is information obtained by encrypting the attribute information m (first data) to be matched by exponentiation using a key g (first key) of a user (attribute information provider), and "m'=g m The public key pk is the public key of the signer of the electronic signature σ. The matching device 201 may obtain the public key pk directly from the signer of the electronic signature σ.

[0093] The digital signature σ is a signature given to the attribute information m, and is information that allows the authenticity of the attribute information m to be verified using the public key pk. The zero-knowledge proof Π is the ZKP of the digital signature σ, and is proof information for proving that the digital signature σ is information that allows the authenticity of the original data of the encrypted data m' (the original plaintext, which is the attribute information m) to be verified.

[0094] In addition, the reception unit 701 receives a second matching request from the client terminal Cj. Specifically, for example, the reception unit 701 receives the second matching request from the client terminal Cj, thereby receiving the received second matching request.

[0095] Here, the second matching request includes, for example, encrypted data n'. The encrypted data n' is information obtained by encrypting the requirement information n (second data) to be matched by indexing it using a key h (second key) of a user (requirement information provider), and is expressed as "n'=h 1 / n "

[0096] When the first matching request includes the digital signature σ, the verification unit 702 verifies the validity of the digital signature σ by using the proof information included in the first matching request. Specifically, for example, the verification unit 702 verifies the validity of the digital signature σ by proving the zero-knowledge proof text Π (ZKP of the digital signature σ) by using the public key pk, the digital signature σ, and the encrypted data m'.

[0097] When the validity of the digital signature σ is verified using the zero-knowledge proof text Π, the authenticity of the encrypted data m' is guaranteed, and in turn, the authenticity of the original data (attribute information m) of the encrypted data m' is guaranteed. Note that the method of proving the zero-knowledge proof text Π using pk, σ, and m' may vary depending on the signature format.

[0098] The acquiring unit 703 acquires a first operation result calculated from the key g (first key) and the key h (second key) using a predetermined function from the key management server 202. Here, the predetermined function is, for example, a pairing function (pairing e) that performs a bihomocytic operation.

[0099] Specifically, for example, when the acquiring unit 703 accepts the first matching request and the second matching request, the acquiring unit 703 transmits a pairing calculation request to the key management server 202. The pairing calculation request includes the ID of the user (attribute information provider) and the ID of the user (requirement information provider).

[0100] Then, the acquiring unit 703 acquires the computation result e(g,h) by receiving the pairing e and the computation result e(g,h) from the key management server 202. The computation result e(g,h) is a computation result (first computation result) of the pairing e obtained by inputting the keys g and h into the pairing e. The key g is a key corresponding to the ID of the user (attribute information provider). The key h is a key corresponding to the ID of the user (requirement information provider). However, the acquiring unit 703 may acquire the pairing e from the key management server 202 in advance.

[0101] When the authenticity of the digital signature σ is verified using the certification information, the comparison unit 704 compares the acquired first calculation result with a second calculation result calculated from the encrypted data m' and the encrypted data n' using a predetermined function. The predetermined function is, for example, a pairing function (pairing e) provided by the key management server 202.

[0102] Specifically, for example, the matching unit 704 inputs the encrypted data m', n' to the pairing e to obtain the calculation result e(g m ,h 1 / n ) is calculated. The result e(g m ,h 1 / n ) corresponds to the second calculation result. Then, the collation unit 704 compares the calculation result e(g,h) and the calculation result e(g m ,h 1 / n ).

[0103] Here, the calculation result e(g,h) and the calculation result e(g m ,h 1 / n ) is the same, attribute information m and requirement information n are considered to be equal. This matching is done by using the bihomology of pairing e, m This is achieved by using a pairing map to make it possible to check the match of the original message transformed by "m → g m " and the other conversion is "n→h 1 / n "The result of the pairing e is "e(g m ,h 1 / n )=e(g,h) m / n" It is possible to check whether attribute information m and requirement information n are equal by using this fact.

[0104] The output unit 705 outputs the result of the comparison. The output form of the output unit 705 may be, for example, storage in a storage device such as the memory 302 or disk 304 of the matching device 201, transmission to another computer (for example, client terminals Ci and Cj) via the communication I / F 305, display on a display (not shown), or printout on a printer (not shown).

[0105] Specifically, for example, when the comparison result is "match", the output unit 705 may transmit a matching result indicating successful matching to the client terminals Ci and Cj. This matching result may include, for example, information for identifying the users of the client terminals Ci and Cj. Furthermore, when the comparison result is "mismatch", the output unit 705 may transmit a matching result indicating unsuccessful matching to the client terminals Ci and Cj.

[0106] Furthermore, when the validity of the digital signature σ is not verified, the output unit 705 may output a verification result indicating that verification of the authenticity of the encrypted data m' has failed. Specifically, for example, the output unit 705 transmits to the client terminal Ci a matching result including a verification result indicating that verification of the authenticity of the encrypted data m' has failed. In this case, the output unit 705 may transmit to the client terminal Cj a matching result indicating that matching has failed.

[0107] Note that, when the validity of the digital signature σ is verified using the certification information, the acquiring unit 703 may acquire the first calculation result from the key management server 202. This makes it possible to prevent the first calculation result from being acquired from the key management server 202 even if the validity of the digital signature σ is not verified and the first calculation result is not compared with the second calculation result.

[0108] The comparison unit 704 may compare the first calculation result with the second calculation result regardless of the result of verifying the validity of the digital signature σ using the proof information. In this case, the output unit 705 may output the result of comparing the first calculation result with the second calculation result together with the result of verifying the validity of the digital signature σ.

[0109] (Example of matching process of matching device 201) Here, an example of the matching process of the matching device 201 will be described with reference to FIG.

[0110] FIG. 8 is an explanatory diagram showing an example of the matching process of the matching device 201. In FIG. 8, an operator 801 represents a matching operator and corresponds to the matching device 201. A job seeker 802 represents a user (attribute information provider) who provides attribute information m and corresponds to a client terminal Ci. A company 803 represents a user (requirements information provider) who provides requirement information n and corresponds to a client terminal Cj. In FIG. 8, the electronic signature σ is written as "signature σ".

[0111] The business operator 801 (matching device 201) receives a job request from a job seeker 802 (client terminal Ci). m and the zero-knowledge proof text Π. m is encrypted data m' obtained by encrypting attribute value m (attribute information m) using key g of job seeker 802. Zero-knowledge proof text Π is a ZKP of electronic signature σ. Electronic signature σ is valid for attribute value m (attribute information m). Zero-knowledge proof text Π is g m It is effective against.

[0112] In addition, the business operator 801 (matching device 201) receives a request from a company 803 (client terminal Cj). 1 / n Accepts. h 1 / n is encrypted data n' obtained by encrypting requirement value n (requirement information n) using key h of company 803. Requirement information n represents a job requirement.

[0113] The business entity 801 (matching device 201) verifies the validity of the electronic signature σ using the zero-knowledge proof text Π. When the validity of the electronic signature σ is verified using the zero-knowledge proof text Π, g m The authenticity of (encrypted data m') is guaranteed, and thus g m The authenticity of the original data (attribute value m) is guaranteed.

[0114] It is also possible to generate a ZKP for a signature for an existing Relational Hash. However, because the hash function is complex, it is not possible to directly apply the conventional techniques for generating zero-knowledge proofs. To explain in more detail, it is difficult to write the hash function used in Relational Hash using an arithmetic circuit that is independent of the input, so the existing framework of ZK-SNARKs cannot be applied when generating zero-knowledge proofs. Therefore, in order to conceal attribute information m, m An effective approach would be to simplify the encrypted data using exponential encryption such as

[0115] When the validity of the digital signature σ is verified using the zero-knowledge proof document Π, the business entity 801 (matching device 201) performs matching by utilizing the bihomology of the pairing e without using the keys g and h. m ,h 1 / n )=e(g,h) m / n It is determined whether "e(g,h)" matches "e(g,h)". e(g,h) is the first calculation result of the pairing e obtained from the key management server 202. m ,h 1 / n ) is pairing e to g m ,h 1 / n This is the second calculation result obtained by inputting:

[0116] This allows the operator 801 (matching device 201) to apply the concept of pairing mapping to determine whether the attribute value m (attribute information m) and the requirement value n (requirement information n) match without decrypting the attribute information m and the requirement information n.

[0117] (Example of operation of information processing system 200) Next, an example of the operation of the information processing system 200 according to the first embodiment will be described with reference to Fig. 9. Here, a case where an entity C matches a job seeker A with a company B in job matching will be described as an example.

[0118] Fig. 9 is an explanatory diagram showing an example of the operation of the information processing system 200 according to the first embodiment. In Fig. 9, an entity C represents a matching entity and corresponds to the matching device 201. A job seeker A represents a user (attribute information provider) and corresponds to a client terminal Ci. A company B represents a user (requirements information provider) and corresponds to a client terminal Cj. In Fig. 9, the electronic signature σ is written as "signature".

[0119] First, job seeker A (client terminal Ci) generates key g and registers it in the key management server 202. Also, company B (client terminal Cj) generates key h and registers it in the key management server 202. Keys g and h are not disclosed to anyone other than the key management server 202. The key management server 202 prepares a pairing mapping.

[0120] Job seeker A (client terminal Ci) uses key g to convert attribute information m to g m and sends it to business entity C (matching device 201). m can be regarded as a ciphertext of attribute information m. Here, attribute information m is “educational background: X University graduate (= m)” and attribute information m is “educational background: F32R3 (= g m )" is converted into encrypted data.

[0121] Furthermore, if a digital signature σ from a third party (University X) is added to the attribute information m, the job seeker A (client terminal Ci) checks whether the digital signature σ is encrypted data g m The job seeker A (client terminal Ci) generates a zero-knowledge proof Π that proves that the encrypted data g submitted to the business C is valid for the plain text m and sends it to the business C (matching device 201). m guarantee the authenticity of the

[0122] On the other hand, company B (client terminal Cj) uses key h to send requirement information n to 1 / n and sends it to business entity C (matching device 201). 1 / n can be regarded as the ciphertext of the requirement information n. Unlike the job seeker's side, the company side can take the reciprocal power when encrypting with the key h, which makes it easier to perform the match determination by pairing later.

[0123] Here, the requirement information n is "required educational background: X University graduate, Y University graduate, ... (= n1, n2, ...)" and the requirement information n is "required educational background: 4n4Gg, a3QCs, ... (= h 1 / n1 ,h 1 / n2 Assume that the encrypted data is converted to ",…"

[0124] The business entity C (matching device 201) receives encrypted data g from the job seeker A (client terminal Ci). m , and accepts the zero-knowledge proof text Π. In addition, the business entity C (matching device 201) receives encrypted data h 1 / n This allows the job seeker A to send encrypted data g of attribute information m. m The business entity C is given a zero-knowledge proof Π regarding the validity of the digital signature σ attached to the attribute information m. In addition, the business entity B sends encrypted data h 1 / n is awarded to operator C.

[0125] The business entity C (matching device 201) receives, from the key management server 202, not the keys g and h of the job seeker A and the company B, but various information related to the pairing calculation (pairing e, calculation result e AB If the validity of the digital signature σ is verified using the zero-knowledge proof text Π, the business entity C (matching device 201) receives the encrypted data g m ,h 1 / n Matching is performed using the bihomomorphism of the pairing e without decrypting the plaintext.

[0126] Here, the business entity C (matching device 201) AB It checks whether it matches e(”F32R3”,”4n4Gg”), e(”F32R3”,”a3QCs”), …, and if the equality is established, it is determined that the requirement is matched (matching is successful).

[0127] Note that e(”F32R3”, “4n4Gg”) is pairing e with “F32R3(=g m )" and "4n4Gg(=h 1 / n1 )" is the result of the calculation. Also, e("F32R3", "a3QCs") is the result of the calculation of "F32R3 (=g m )" and "a3QCs (=h 1 / n2 )" is the calculation result obtained.

[0128] In this way, the information processing system 200 can perform matching while protecting privacy by encrypting the data (m, n) to be matched and determining whether the original data is equal without decrypting the ciphertext. Furthermore, the information processing system 200 can verify the authenticity of the attribute information m submitted by job seeker A by verifying the zero-knowledge proof text Π without decrypting the plaintext from the ciphertext. Note that the requirement information n indicates an interest in the attributes of company B, and its authenticity does not need to be guaranteed. For this reason, a signature is not affixed to the requirement information n.

[0129] (Various processing procedures of the information processing system 200) Next, various processing procedures of the information processing system 200 will be described with reference to FIGS.

[0130] - Setup procedure for the key management server 202 First, the setup process of the key management server 202 will be described.

[0131] Fig. 10 is a flowchart showing an example of a setup processing procedure of the key management server 202. In the flowchart of Fig. 10, first, the key management server 202 sets a set U of domains (step S1001). Next, the key management server 202 sets a prime number p (step S1002).

[0132] Then, the key management server 202 creates a TABLE in which the elements of the domain set U are keys and the elements of the set [p]={0,...,p-1} are values ​​(step S1003). Next, the key management server 202 sets a group G of prime order q and a group H of prime order p (q>p) (step S1004).

[0133] Next, the key management server 202 sets the pairing e "e: G×G→H" (step S1005). Then, the key management server 202 publishes the set U of domains, the TABLE, and the group G of prime order q to the entire information processing system 200 (step S1006), and ends the series of processes according to this flowchart.

[0134] This allows the key management server 202 to prepare information related to key generation and information related to pairing calculation.

[0135] Key generation / update processing procedure for client terminal Ci Next, the key generation / update processing procedure of the client terminal Ci will be described.

[0136] Fig. 11 is a flowchart showing an example of a key generation / update processing procedure of the client terminal Ci. In the flowchart of Fig. 11, first, the client terminal Ci generates a key by selecting one element of the group G of prime order q published by the key management server 202 (step S1101).

[0137] Then, the client terminal Ci transmits a key registration request including the ID corresponding to the terminal itself and the generated key to the key management server 202 (step S1102), and ends the series of processes according to this flowchart.

[0138] This enables the client terminal Ci to generate a key for the user of the terminal itself and upload (register) it to the key management server 202.

[0139] Key management server 202 key registration process Next, the key registration process of the key management server 202 will be described.

[0140] Fig. 12 is a flowchart showing an example of a key registration process procedure of the key management server 202. In the flowchart of Fig. 12, first, the key management server 202 determines whether or not a key registration request has been received from the client terminal Ci (step S1201). Here, the key management server 202 waits to receive a key registration request from the client terminal Ci (step S1201: No).

[0141] Then, when the key management server 202 receives a key registration request from the client terminal Ci (step S1201: Yes), it registers the key included in the key registration request in the key storage DB 220 in association with the ID included in the key registration request (step S1202), and terminates the series of processes according to this flowchart.

[0142] This allows the key management server 202 to register and manage the keys of each user generated in the client terminal Ci in the key storage DB 220. Note that in step S1202, if a key corresponding to the ID included in the key registration request has already been registered, the key management server 202 overwrites it with the key included in the key registration request.

[0143] Next, a description will be given of a matching process procedure of the information processing system 200. Note that the client terminal of the user (attribute information provider) is referred to as a "client terminal Ci" and the client terminal of the user (requirement information provider) is referred to as a "client terminal Cj."

[0144] 13 and 14 are sequence diagrams showing the procedure of the matching process of the information processing system 200. In the sequence diagram of Fig. 13, first, the client terminal Ci converts the attribute information m into an attribute value m by encoding the attribute information m using a TABLE made public by the key management server 202 (step S1301).

[0145] Then, the client terminal Ci uses the key g to convert the attribute value m to g m By encrypting it as m ) (step S1302). Next, the client terminal Ci executes a proof generation process (step S1303). Note that a specific processing procedure of the proof generation process will be described later with reference to FIG.

[0146] Here, it is assumed that a zero-knowledge proof text Π of the electronic signature σ assigned to the attribute information m (attribute value m) is generated. Then, the client terminal Ci transmits a matching request including the encrypted data m′, the public key pk, the electronic signature σ, and the zero-knowledge proof text Π to the matching device 201 (step S1304).

[0147] When the matching device 201 receives a matching request from the client terminal Ci (step S1305), it executes a proof verification process for the zero-knowledge proof text Π included in the matching request (step S1306). Note that the specific processing procedure of the proof verification process will be described later with reference to FIG.

[0148] The client terminal Cj converts the requirement information n into a requirement value n by encoding it using the TABLE published by the key management server 202 (step S1307). Next, the client terminal Cj converts the requirement value n into h using the key h. 1 / n By encrypting it as 1 / n ) is generated (step S1308).

[0149] Then, the client terminal Cj transmits a matching request including the encrypted data n' to the matching device 201 (step S1309). Note that the processes of steps S1307 to S1309 may be executed before the processes of steps S1301 to S1304, or may be executed in parallel with the processes of steps S1301 to S1304.

[0150] 14, first, when the matching device 201 receives a matching request from the client terminal Cj (step S1401), it transmits a pairing calculation request to the key management server 202 (step S1402). The pairing calculation request includes the ID of the user (attribute information provider) of the client terminal Ci and the ID of the user (requirement information provider) of the client terminal Cj.

[0151] When the key management server 202 receives the pairing calculation request from the matching device 201, the key management server 202 acquires the keys g and h corresponding to each ID included in the pairing calculation request from the key storage DB 220 (step S1403). Next, the key management server 202 inputs the acquired keys g and h into the pairing e to calculate the calculation result e(g, h) of the pairing e (step S1404).

[0152] Then, the key management server 202 transmits the pairing e and the calculation result e(g,h) of the pairing e to the matching device 201 (step S1405). Upon receiving the pairing e and the calculation result e(g,h) of the pairing e, the matching device 201 executes a matching process (step S1406). Note that a specific processing procedure of the matching process will be described later with reference to FIG. 17.

[0153] Then, the matching device 201 transmits a matching result according to the collation result to the client terminals Ci and Cj (step S1407), and ends the series of processes according to this sequence diagram.

[0154] Next, a specific procedure of the proof generation process of the client terminal Ci in step S1303 shown in FIG. 13 will be described with reference to FIG.

[0155] Fig. 15 is a flowchart showing an example of a specific processing procedure of a proof generation process of the client terminal Ci. In the flowchart of Fig. 15, first, the client terminal Ci determines whether or not a digital signature σ is added to the attribute information m (step S1501).

[0156] If the electronic signature σ is not attached to the attribute information m (step S1501: No), the client terminal Ci returns to the step where the proof generation process was called. On the other hand, if the electronic signature σ is attached to the attribute information m (step S1501: Yes), the client terminal Ci generates a zero-knowledge proof text Π for the electronic signature σ (step S1502) and returns to the step where the proof generation process was called.

[0157] This allows the client terminal Ci to generate proof information for proving that the electronic signature σ is information capable of verifying the authenticity of the original data of the encrypted data m′ using the signer's public key pk.

[0158] Next, a specific procedure of the proof verification process by the matching device 201 in step S1306 shown in FIG. 13 will be described with reference to FIG.

[0159] Fig. 16 is a flowchart showing an example of a specific processing procedure of the proof verification processing of the matching device 201. In the flowchart of Fig. 16, first, the matching device 201 verifies the validity of the electronic signature σ by proving the zero-knowledge proof text Π (ZKP of the electronic signature σ) using the public key pk, the electronic signature σ, and the encrypted data m' (step S1601).

[0160] Then, the matching device 201 judges whether or not the verification of the validity of the electronic signature σ has been successful (step S1602). If the verification of the validity of the electronic signature σ has been successful (step S1602: Yes), the matching device 201 returns to the step that called the proof verification process.

[0161] On the other hand, if the verification of the authenticity of the electronic signature σ fails (step S1602: No), the matching device 201 transmits a verification result indicating that the verification of the authenticity of the encrypted data m' has failed to the client terminal Ci (step S1603), and terminates the series of processes according to this flowchart.

[0162] In this way, the matching device 201 verifies the validity of the digital signature σ using the zero-knowledge proof text Π, and obtains g m (Encrypted data m') is guaranteed to be authentic, and g m The authenticity of the original data (attribute information m) can be guaranteed.

[0163] Next, a specific processing procedure of the matching process by the matching device 201 in step S1406 shown in FIG. 14 will be described with reference to FIG.

[0164] 17 is a flowchart showing an example of a specific processing procedure of the matching process of the matching device 201. In the flowchart of FIG. 17, first, when the matching device 201 receives pairing e and the calculation result e(g, h) of the pairing e from the key management server 202 (step S1701), the matching device 201 calculates the calculation result e(g, h) from the encrypted data m', n' using the pairing e.m ,h 1 / n ) is calculated (step S1702).

[0165] Next, the matching device 201 uses the bihomogenity of the pairing e to compare the operation result e(g,h) received from the key management server 202 with the operation result e(g m ,h 1 / n ) matches (step S1703).

[0166] Here, the calculation result e(g,h) and the calculation result e(g m ,h 1 / n ) match (step S1703: Yes), the matching device 201 determines that the matching is successful (step S1704) and returns to the step that called the collation process.

[0167] On the other hand, the calculation result e(g,h) and the calculation result e(g m ,h 1 / n ) do not match (step S1703: No), the matching device 201 determines that matching has failed (step S1705), and returns to the step that called the collation process.

[0168] In this way, the matching device 201 can check whether the attribute information m and the requirement information n are equal by utilizing the bihomology of the pairing e.

[0169] As described above, the matching device 201 according to the first embodiment can accept encrypted data m' (first encrypted data) obtained by encrypting attribute information m (first data) by exponentiation using a key g (first key), electronic signature σ assigned to the attribute information m, and certification information. The certification information is information for proving that the electronic signature σ is information capable of verifying the authenticity of the original data (original plain text) of the encrypted data m'. The matching device 201 can verify the validity of the electronic signature σ by using the certification information. The matching device 201 can also accept encrypted data n' (second encrypted data) obtained by encrypting requirement information n (second data) by exponentiation using a key h (second key). The matching device 201 can also obtain, from the key management server 202, a calculation result e(g,h) calculated from the key g and the key h by using the pairing e. The pairing e is a pairing function that performs a bihomomorphic calculation. Then, according to the matching device 201, the obtained calculation result e(g,h) and the calculation result (g) calculated from the encrypted data m' and the encrypted data n' using the pairing e are m ,h 1 / n ) can be matched.

[0170] In this way, the matching device 201 can guarantee the authenticity of the data while concealing the contents of the data on the users (attribute information providers, requirement information providers) to be matched from third parties (matching businesses). For example, the concealment of attribute information m can be achieved by m By using exponentiation encryption in the form of ", it is possible to simplify the encrypted data m' and generate proof information, and the authenticity of the signed attribute information m can be guaranteed. Furthermore, by using exponentiation encryption and the bihomomorphism of pairing e, it is possible to match users while keeping the contents of the attribute information m and requirement information n for each user secret from third parties. For example, in job matching, it is possible to match job seekers with companies by comparing the attributes (age, educational background, etc.) of job seekers (individuals) with the interests (age, educational background, etc.) of companies (corporations) in attributes.

[0171] Furthermore, according to the matching device 201, when the validity of the electronic signature σ is verified, the calculation result e(g,h) and the calculation result (g m ,h 1 / n ) can be matched.

[0172] In this way, when the authenticity of the attribute information m is guaranteed, the matching device 201 can compare the calculation result e(g,h) with the calculation result (g m ,h 1 / n ) to match users with each other.

[0173] Furthermore, the matching device 201 can accept, as proof information, a zero-knowledge proof text Π (ZKP of the electronic signature σ) for proving that the electronic signature σ is information capable of verifying the authenticity of the original data of the encrypted data m' using the signer's public key pk. Then, the matching device 201 can verify the validity of the electronic signature σ by proving the zero-knowledge proof text Π using the public key pk, the electronic signature σ, and the encrypted data m'.

[0174] In this way, the matching device 201 can ensure the authenticity of the encrypted data m' by verifying the validity of the digital signature σ using the zero-knowledge proof, and can therefore ensure the authenticity of the attribute information m, which is the original plaintext. For example, if a zero-knowledge proof that is also valid for the ciphertext (encrypted data m') and that can be verified with the public key pk that was originally used for verification can be prepared, the matching business operator can confirm that the ciphertext is also approved by a third party.

[0175] Furthermore, the matching device 201 can output the matching results.

[0176] This allows the matching device 201 to notify the users (attribute information providers, requirement information providers) who are the target of matching and the matching business operator of the success or failure of matching.

[0177] Furthermore, according to the matching device 201, when the validity of the electronic signature σ is verified using proof information (zero-knowledge proof text Π), the calculation result e(g, h) can be obtained from the key management server 202.

[0178] As a result, the matching device 201 can reduce the processing load by not performing the process of obtaining the calculation result e(g, h) from the key management server 202, for example, when the validity of the electronic signature σ is not verified and the calculation result is not compared.

[0179] In addition, according to the matching device 201, if the validity of the electronic signature σ is not verified using the proof information (zero-knowledge proof text Π), a verification result indicating that verification of the authenticity of the encrypted data m' has failed can be output.

[0180] As a result, the matching device 201 can notify the users (attribute information providers, requirement information providers) to be matched and the matching business operator that matching is not possible because the authenticity of the attribute information m, which is the original plaintext of the encrypted data m', cannot be guaranteed.

[0181] (Example) Next, an example in which the information processing system 200 according to the first embodiment is applied to a job matching system that matches a plurality of job seekers with a plurality of companies will be described.

[0182] FIG. 18 is an explanatory diagram showing an embodiment of the information processing system 200. In FIG. 18, multiple job seekers are A1, A2, ..., A n There are several companies, B1, B2, …, B m Assume that A1, A2, …, A n ,B1,B2,…,B m Let represent the user's ID.

[0183] First, the key management server 202 executes a setup process (see, for example, FIG. 10). The pairing e: G×G→H prepared at the time of setup is non-trivial. G is a group of prime order q, and H is order p. The pairing e: G×G→H is a mapping that satisfies the conditions "e(g1*g2,h)=e(g1,h)*e(g2,h)" and "e(g,h1*h2)=e(g,h1)*e(g,h2)".

[0184] Next, each job seeker A i (Client terminal Ci) executes key generation / update processing (see, for example, FIG. 11). j (Client terminal Cj) executes key generation / update processing (see, for example, FIG. 11). i Key i is generated and transmitted to the key management server 202. j Key j is generated and transmitted to the key management server 202.

[0185] Here, each job seeker A i is a set of multiple attribute values ​​X i Each company B j is an interest in multiple attributes, i.e., multiple requirement values ​​Y j However, if the attribute value X i ,Requirement value Y j is a value encoded by TABLE. j is the number of requirements that job seekers want to meet, and the threshold s j is transmitted to business operator C (matching device 201).

[0186] Below, job seeker A i and Company B j An example of the operation when matching with the above will be described.

[0187] First, Job Seeker A i (Client terminal Ci) receives key g i Using EX i :=Exp(g i ,Xi ):={g i m |m∈X i} and the attribute value, and transmits it to business entity C (matching device 201). j (Client terminal Cj) is FY j :=Exp -1 (h j ,Y j ):={h j ^(d n )|n∈Y j} and the attribute value, and the threshold s j The same is transmitted to the business entity C (matching device 201) together with d n =n (p-2) ≡1 / n(mod p).

[0188] Furthermore, in response to a pairing calculation request from the business entity C (matching device 201), the key management server 202 ij =e(g i ,h j ) to the business operator C (matching device 201). Then, the business operator C (matching device 201) transmits I(ε ij ,EX i ,FY j ):=#{(a,b)∈EX i ×FY j Calculate |e(a,b)=e(g,h)}.

[0189] Here, for x,y∈{0,…,p-1}, d y =y (p-2) When ≡1 / y, e(g x ,h^(d y ))=e(g,h) and x=y are equivalent. To prove this, by the bimorphism of e:G×G→H, e(g x ,h^(d y ))=e(g,h)^(xd y ) Since the order of H is p, e(g,h)^(xd y )=e(g,h) and xd y ≡1(mod p) is equivalent, and furthermore, xd y ≡1(mod p) and x=y are equivalent. This completes the proof.

[0190] This allows I(ε ij ,EX i ,FY j ) is Job Seeker A i The attribute value submitted by X i And Company B j The submitted requirement value Y j Here, this value is the number of matches with the threshold s j If greater than or equal to c ij = 1, and the threshold s j If less than c ij = 0. ij If =1, Company B j Job Seeker A i This means that the condition is satisfied (matching is successful).

[0191] For example, the business entity C (matching device 201) ij If =1, Job Seeker A i (Client terminal Ci) Company B j (Client terminal Cj) is referred to as Company B j (Client terminal Cj) Job seeker A i (Client terminal Ci). This notifies job seeker A i and Company B j Since it is difficult to calculate the inverse image of pairing, business operator C and job seeker A are matched. i Attribute value X i It is difficult to pinpoint the

[0192] In addition, each job seeker A i Desired condition Z i and the number t that you want to satisfy that condition. i Each company B j Information W j In this case, A i and B j Swap the roles of X i W j , Y j A to Z i , s j A iThe information processing system 200 may execute the matching process by changing the above. i Desired conditions and Company B j The number of matches of the submitted company information is the threshold t j If it is greater than or equal to d ij = 1, and the threshold t j If less than d ij = 0. d ij If =1, Job Seeker A i Company B j This means that c ij *d ij If =1, then Job Seeker A i and Company B j Since this means that both parties' requirements are met, the business entity C (matching device 201) may regard the matching as successful.

[0193] Also, Job Seeker A i (Client terminal Ci) is job seeker A i If a digital signature σ is attached to an attribute value m belonging to the attribute value m, a ZKP for the digital signature σ may be generated. Here, we assume that a CL signature is attached. The ZKP for the digital signature σ can be generated by referring to, for example, Non-Patent Document 2 below.

[0194] Non-patent document 2: Camenisch, Jan, and Anna Lysyanskaya. “A signature scheme with efficient protocols.” International Conference on Security in Communication Networks. Springer, Berlin, Heidelberg, 2002.

[0195] First, in CL signature, the private key is p and the public key is (n, a, b, c). Here, n=pq is the RSA modulus, that is, p and q are prime numbers with the same number of bits. Also, a, b, and c are quadratic residues modulo n, that is, there exist x, y, and z such that x 2 =a,y 2 =b,z 2= c(mod n).

[0196] Furthermore, the digital signature σ for the plaintext m is σ=(s,e,v), where (s,e,v) is the sum of v e =a m b s A set of numbers that satisfies c. Job Seeker A i To generate the ZKP for the digital signature σ, the client terminal Ci takes the quadratic remainder h modulo n, and then calculates the subcyclic group Z / n generated by h. <h>Take the element g of .

[0197] And Job Seeker A i (Client terminal Ci) creates the following information (commitment, etc.):

[0198] Random number r m and m's commitment C m :=g m h^(r m )∈Z / n

[0199] Random number s m and s's commitment C s :=g s h^(r s )∈Z / n

[0200] Random number r e and e's commitment C e ;=g e h^(r e )∈Z / n

[0201] Random number w and mask C for v v :=vg w ∈Z / n

[0202] Random number r w and w's commitment C w =g w h^(r w )∈Z / n

[0203] z:=ew∈Z

[0204] Random number r z and z's commitment C z =g z h^(r z )∈Z / n

[0205] C:=(C v ) e h r ∈Z / n

[0206] Ciphertext of attribute value m m'=g i m

[0207] Job seeker A i (Client terminal Ci) is c,C m ,C s ,C e ,C v ,C w ,C z , C,m' to the business operator C (matching device 201), and then μ, σ, ε, ω, ζ, ρ that satisfy the following conditions m ,ρ s ,ρ e ,ρ w ,ρ z , generate a zero-knowledge proof statement Π that proves knowledge of ρ.

[0208] C=C v εhρ C e =gεh^(ρ e ) C / c=aμbσgζhρ C m =gμh^(ρ m ) C s =gσh^(ρ s ) C z =gζh^(ρ z ) C w =gωh^(ρ w ) C z =C w εh^(ρ z -ερ w ) m'=g i μ

[0209] Job seeker A i (Client terminal Ci) uses c,C as the ZKP of the digital signature σ. m ,C s ,C e ,C v ,C w ,C z , C, m', Π to the business entity C (matching device 201). Then, the business entity C (matching device 201) transmits c, C m ,C s ,C e ,C v ,C w ,C z ,Verify,C,m',Π.

[0210] In addition, Company B j If the user submits an attribute value and it is signed by a CL, the enterprise may generate a ZKP for that signature in a similar manner.

[0211] (Embodiment 2) Next, an information processing system 200 according to the second embodiment will be described. In the second embodiment, the security of the attribute information m and the requirement information n is improved by using random numbers provided by a reliable third party to encrypt the attribute information m of a user (attribute information provider) and the requirement information n of a user (requirement information provider). Note that the same reference numerals are used to denote the same parts as those in the information processing system 200 according to the first embodiment, and illustrations and descriptions thereof will be omitted.

[0212] An example of the operation of the information processing system 200 according to the second embodiment will now be described with reference to Fig. 19. Here, an example will be described in which a business entity C matches a job seeker A with a company B in a job vacancy matching process. Furthermore, the job seeker A (client terminal Ci) generates a key g and has registered it in the key management server 202. Furthermore, the company B (client terminal Cj) generates a key h and has registered it in the key management server 202.

[0213] Fig. 19 is an explanatory diagram showing an example of the operation of the information processing system 200 according to the second embodiment. In Fig. 19, an entity C represents a matching entity and corresponds to the matching device 201. A job seeker A represents a user (attribute information provider) and corresponds to a client terminal Ci. A company B represents a user (requirements information provider) and corresponds to a client terminal Cj. In Fig. 19, the electronic signature σ is written as "signature".

[0214] First, when matching job seeker A with company B, business operator C (matching device 201) transmits a request to that effect to the key management server 202. Upon receiving the request from business operator C (matching device 201), the key management server 202 generates a random number r and transmits the random number r to both job seeker A (client terminal Ci) and company B (client terminal Cj). The key management server 202 is an example of a trusted third party. The random number r is, for example, a random number with a bit length similar to that of keys g and h.

[0215] Job seeker A (client terminal Ci) generates key g and registers it in the key management server 202. Also, company B (client terminal Cj) generates key h and registers it in the key management server 202. Keys g and h are not disclosed to anyone other than the key management server 202. The key management server 202 prepares a pairing mapping.

[0216] Job seeker A (client terminal Ci) uses key g and random number r to convert attribute value m (value obtained by encoding attribute information m using TABLE) to g m^r In the first embodiment, the attribute value m is converted to g m Here, we convert the attribute value m to g m^r Convert to.

[0217] Furthermore, if a digital signature σ is attached to the attribute information m, the job seeker A (client terminal Ci) verifies that the digital signature σ is included in the encrypted data g m^r The job seeker A (client terminal Ci) generates a zero-knowledge proof Π that proves that the encrypted data g submitted to the business C is valid for the plain text m and sends it to the business C (matching device 201). m^r guarantee the authenticity of the

[0218] On the other hand, company B (client terminal Cj) uses key h and random number r to encode requirement value n (requirement information n encoded by TABLE) into h 1 / n^r In the first embodiment, the requirement value n is converted into h 1 / n Here, the requirement value n is converted to h 1 / n^r Convert to.

[0219] The business entity C (matching device 201) receives encrypted data g from the job seeker A (client terminal Ci). m^r , and accepts the zero-knowledge proof text Π. In addition, the business entity C (matching device 201) receives encrypted data h 1 / n^r This allows the job seeker A to send encrypted data g of attribute information m. m^r The business entity C is given a zero-knowledge proof Π regarding the validity of the digital signature σ attached to the attribute information m. In addition, the business entity B sends encrypted data h 1 / n^r is awarded to operator C.

[0220] The business entity C (matching device 201) receives various information related to the pairing operation (pairing e, operation result e(g, h)) instead of the keys g and h of the job seeker A and the company B from the key management server 202. Then, when the validity of the digital signature σ is verified using the zero-knowledge proof text Π (verification successful), the business entity C (matching device 201) performs matching by utilizing the bihomobiology of the pairing e without decrypting the plaintext from the encrypted data.

[0221] Specifically, the business entity C (matching device 201) encrypts the data g m^r , zero-knowledge proof text Π, encrypted data h 1 / n^r Using the pairing e and the operation result e(g,h), e(g,h) and e(g m^r ,h 1 / n^r If the calculation results show a match, the business entity C (matching device 201) determines that the matching is successful.

[0222] On the other hand, if the calculation results do not match, the business entity C (matching device 201) determines that matching has failed. Note that if the validity of the electronic signature σ has not been verified (verification has failed), the business entity C (matching device 201) m^r Reject.

[0223] As described above, according to the information processing system 200 of the second embodiment, when encrypting the attribute information m and the requirement information n, a mask using a random number r can be applied. As a result, compared to the information processing system 200 described in the first embodiment, the amount of transmission between devices increases, but the security of the attribute information m and the requirement information n can be further improved. For example, by raising m and n to the power r, the ratio of m to n (m / n) can be made difficult to understand, thereby further improving security.

[0224] For these reasons, according to the matching device 201 of this embodiment, a safe and secure matching system can be provided by guaranteeing the authenticity of the data (e.g., attribute information m, requirement information n) of the user to be matched while keeping the contents of the data (e.g., attribute information m) confidential from the matching operator.

[0225] The information processing method described in the present embodiment can be realized by executing a prepared program on a computer such as a personal computer or a workstation. The information processing program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, a DVD, or a USB memory, and is executed by being read from the recording medium by the computer. The information processing program may also be distributed via a network such as the Internet.

[0226] In addition, the information processing device 101 (matching device 201) described in this embodiment can also be realized by an application-specific IC such as a standard cell or a structured ASIC (Application Specific Integrated Circuit) or a PLD (Programmable Logic Device) such as an FPGA.

[0227] The following supplementary notes are further disclosed regarding the above-described embodiment.

[0228] (Supplementary Note 1) A method for receiving first encrypted data obtained by encrypting first data by indexing using a first key, a digital signature assigned to the first data, and certification information for proving that the digital signature is information capable of verifying authenticity of original data of the first encrypted data, receiving second encrypted data obtained by encrypting the second data by indexing using the second key; Verifying the authenticity of the electronic signature using the certification information; obtaining a first calculation result calculated from the first key and the second key using a predetermined function from a management device that manages the first key and the second key; comparing the acquired first operation result with a second operation result calculated from the first encrypted data and the second encrypted data using the predetermined function; An information processing program that causes a computer to execute a process.

[0229] (Appendix 2) The matching process is 2. The information processing program according to claim 1, further comprising: comparing the first calculation result with the second calculation result when the authenticity of the electronic signature is verified.

[0230] (Supplementary Note 3) The proof information includes a zero-knowledge proof statement for proving that the electronic signature is information capable of verifying authenticity of the original data of the first encrypted data by using a signer's public key, The process of verifying includes: verifying the validity of the electronic signature by proving the zero-knowledge proof text using the public key, the electronic signature, and the first encrypted data; 2. The information processing program according to claim 1,

[0231] (Supplementary Note 4) The information processing program according to Supplementary Note 1, wherein the predetermined function is a pairing function that performs a bihomogenous operation.

[0232] (Additional Note 5) The first data is attribute information indicating an attribute of the first user, The second data is requirement information indicating a condition for an attribute required by a second user different from the first user. 2. The information processing program according to claim 1,

[0233] (Supplementary Note 6) The first data is data of a first user, the second data is data of a second user different from the first user; the first encrypted data is obtained by encrypting the first data by exponentiation using the first key and a random number issued from the management device to the first user; the second encrypted data is obtained by encrypting the second data by exponentiation using the second key and the random number issued from the management device to the second user; 2. The information processing program according to claim 1,

[0234] (Appendix 7) Output the matched result. 3. The information processing program according to claim 2, characterized in that the information processing program causes the computer to execute a process.

[0235] (Appendix 8) The process of acquiring the information is as follows: 2. The information processing program according to claim 1, further comprising obtaining the first calculation result from the management device when the authenticity of the electronic signature is verified.

[0236] (Appendix 9) If the authenticity of the electronic signature is not verified, a verification result indicating that the authenticity of the first encrypted data has failed is output. 2. The information processing program according to claim 1, characterized in that the information processing program causes the computer to execute a process.

[0237] (Appendix 10) A method for receiving first encrypted data obtained by encrypting first data by indexing using a first key, a digital signature added to the first data, and certification information for proving that the digital signature is information capable of verifying authenticity of original data of the first encrypted data, receiving second encrypted data obtained by encrypting the second data by indexing using the second key; Verifying the authenticity of the electronic signature using the certification information; obtaining a first calculation result calculated from the first key and the second key using a predetermined function from a management device that manages the first key and the second key; comparing the acquired first operation result with a second operation result calculated from the first encrypted data and the second encrypted data using the predetermined function; An information processing method characterized in that the processing is executed by a computer.

[0238] (Appendix 11) A method for receiving first encrypted data obtained by encrypting first data by indexing using a first key, a digital signature added to the first data, and certification information for proving that the digital signature is information capable of verifying authenticity of original data of the first encrypted data, receiving second encrypted data obtained by encrypting the second data by indexing using the second key; Verifying the authenticity of the electronic signature using the certification information; obtaining a first calculation result calculated from the first key and the second key using a predetermined function from a management device that manages the first key and the second key; comparing the acquired first operation result with a second operation result calculated from the first encrypted data and the second encrypted data using the predetermined function; An information processing device comprising a control unit. [Explanation of symbols]

[0239] 101 Information processing device 102 Management device 103 First User 104 Second User 110 First Data 111 1st encryption data 112 Electronic Signature 113 Certification Information 120 Second Data 121 Second encryption data 130 First calculation result 140 Second operation result 200 Information Processing Systems 201 Matching device 202 Key Management Server 210 Network 220 Key storage DB 300 Bus 301 CPU 302 Memory 303 Disk Drive 304 Disk 305 Communication I / F 306 Portable Recording Media I / F 307 Portable recording media 501 Setup processing section 502,701 Reception 503 Registration Department 504 Pairing Calculation Unit 601 Key generation section 602 Encryption section 603 Proof Generation Unit 604 Communications Department 702 Verification Department 703 Acquisition Department 704 Matching section 705 Output section< / h>

Claims

1. receiving first encrypted data obtained by encrypting first data by indexing using a first key, a digital signature added to the first data, and certification information for proving that the digital signature is information capable of verifying authenticity of original data of the first encrypted data; receiving second encrypted data obtained by encrypting the second data by indexing using the second key; Verifying the authenticity of the electronic signature using the certification information; obtaining a first calculation result calculated from the first key and the second key using a predetermined function from a management device that manages the first key and the second key; comparing the acquired first operation result with a second operation result calculated from the first encrypted data and the second encrypted data using the predetermined function; An information processing program that causes a computer to execute a process.

2. The matching process includes:

2. The information processing program according to claim 1, further comprising: comparing the first calculation result with the second calculation result when the authenticity of the electronic signature is verified.

3. the certification information includes a zero-knowledge proof statement for proving that the electronic signature is information capable of verifying authenticity of original data of the first encrypted data by using a signer's public key, The process of verifying includes: verifying the validity of the electronic signature by proving the zero-knowledge proof text using the public key, the electronic signature, and the first encrypted data; 2. The information processing program according to claim 1,

4. 2. The information processing program according to claim 1, wherein the predetermined function is a pairing function that performs a bihomogenous operation.

5. The first data is attribute information indicating an attribute of a first user, The second data is requirement information indicating a condition for an attribute required by a second user different from the first user.

2. The information processing program according to claim 1,

6. the first data being data of a first user; the second data is data of a second user different from the first user; the first encrypted data is obtained by encrypting the first data by exponentiation using the first key and a random number issued from the management device to the first user, the second encrypted data is obtained by encrypting the second data by exponentiation using the second key and the random number issued from the management device to the second user; 2. The information processing program according to claim 1,

7. Output the matched result.

3. The information processing program according to claim 2, which causes the computer to execute a process.

8. receiving first encrypted data obtained by encrypting first data by indexing using a first key, a digital signature added to the first data, and certification information for proving that the digital signature is information capable of verifying authenticity of original data of the first encrypted data; receiving second encrypted data obtained by encrypting the second data by indexing using the second key; Verifying the authenticity of the electronic signature using the certification information; obtaining a first calculation result calculated from the first key and the second key using a predetermined function from a management device that manages the first key and the second key; comparing the acquired first operation result with a second operation result calculated from the first encrypted data and the second encrypted data using the predetermined function; An information processing method characterized in that the processing is executed by a computer.

9. receiving first encrypted data obtained by encrypting first data by indexing using a first key, a digital signature added to the first data, and certification information for proving that the digital signature is information capable of verifying authenticity of original data of the first encrypted data; receiving second encrypted data obtained by encrypting the second data by indexing using the second key; Verifying the authenticity of the electronic signature using the certification information; obtaining a first calculation result calculated from the first key and the second key using a predetermined function from a management device that manages the first key and the second key; comparing the acquired first operation result with a second operation result calculated from the first encrypted data and the second encrypted data using the predetermined function; An information processing device comprising a control unit.

Images