Cryptographic system, terminal, and method

Abstract

To provide a cipher system which realizes an ID-based cipher capable of controlling a decryption possibility of a device, a terminal, a method and a program.SOLUTION: A cipher system 1 consists of: a private key generation center which generates a disclosure parameter of a hierarchical ID-based cipher and a master private key and uses an identifier of a representative terminal, the master private key and the disclosure parameter to generate a user private key of the representative terminal; one or more representative terminals each of which stores a device list consisting of identifiers of one or more slave terminals utilized by the representative terminal, uses a user private key corresponding to its own identifier, a device update time representing an update time of the device list and the disclosure parameter to generate a device private key for decrypting an enciphered sentence transmitted from a transmitter terminal and transmits the device private key to the slave terminals on the device list; and the transmitter terminal which uses the identifiers of the representative terminals and the device update time to generate the enciphered sentence, for which a message is enciphered, and transmits the enciphered sentence to the representative terminals or the slave terminals.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a cryptographic system, a terminal, and direction By law Regarding. [Background technology]

[0002] Identity-Based Encryption (IBE) technology is a type of public key encryption technology, and is an encryption method that allows a user's email address, name, IP (Internet Protocol) address, etc. to be specified as a public key (for example, Non-Patent Document 1).

[0003] A system that realizes encryption and decryption using ID-based encryption technology consists of a private key generation center (PKG: private key generator), a user (receiver) terminal, and a sender terminal, and performs the following process. First, the private key generation center generates public parameters and a master private key as system setup and publishes the public parameters to the user terminals and sender terminals belonging to the system. The user terminal requests the private key generation center to generate a private key for a certain identifier ID. Upon receiving the identifier ID from the user terminal, the private key generation center generates a private key corresponding to that identifier ID from the identifier ID, public parameters, and master private key, and sends this private key to the user terminal. The sender terminal encrypts the message it wishes to send to the user terminal using the public parameters and the identifier ID of the user terminal, and then sends the ciphertext obtained by this encryption to the user terminal. The user terminal that receives the ciphertext decrypts it using the public parameters and the private key corresponding to its own identifier ID. This completes encryption and decryption.

[0004] Recently, advances in cloud computing have increased the number of opportunities to access the same service from multiple devices. For example, with webmail services, the same email address can be used on a variety of devices, such as desktop PCs, tablet PCs, and smartphones.

[0005] In light of this situation, similar scenarios must be considered in systems that implement encryption and decryption using ID-based encryption technology. Specifically, for example, a scenario must be considered in which a cloud service account is used as an identifier (ID), and the private key corresponding to the user's identifier is stored and operated on multiple devices, and data encrypted using that identifier is decrypted and used on those devices. However, in this case, it is not guaranteed that the same device will continue to be used in the future; devices may be added or discarded. It is also possible that a user's account may be suspended or deleted. Therefore, for example, if a device is discarded, a mechanism is needed to prevent the private key used on other devices from being obtained from the discarded device. Furthermore, if a user's account is suspended or deleted, a mechanism is also needed to prevent data from being decrypted on any devices that have the private key corresponding to that account. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] Ryuichi SAKAI, Masao KASAHARA, "ID based Cryptosystems with Pairing on Elliptic Curve" Summary of the Invention [Problem to be solved by the invention]

[0007] However, with existing ID-based encryption technologies such as those described in Non-Patent Document 1, it is difficult to say that private keys can be properly deleted from devices when the devices are disposed of or when accounts are suspended or deleted.

[0008] In existing ID-based encryption technology, if there is a device that has a private key corresponding to an identifier ID, it can decrypt ciphertext encrypted with that identifier ID at any time. Therefore, for example, if a private key corresponding to an identifier ID is obtained from a discarded device, it will be possible to read messages encrypted with that identifier ID even after the device has been discarded.

[0009] An embodiment of the present invention has been made in view of the above points, and aims to realize ID-based encryption that allows control over whether a device is allowed to decrypt. [Means for solving the problem]

[0010] In order to achieve the above object, an encryption system according to one embodiment includes a private key generation center, one or more representative terminals, one or more child terminals used by the same user as the representative terminal, and one or more sending terminals, wherein the private key generation center has a setup unit that generates public parameters of hierarchical ID-based encryption and a master private key, and a first user private key generation unit that generates a user private key for the representative terminal using an identifier of the representative terminal, the master private key, and the public parameters, and the representative terminal is a device configured with an identifier of a child terminal used by the same user as the user who uses the representative terminal. a storage unit that stores the list; a device private key generation unit that generates a device private key for decrypting an encrypted text sent from the sending terminal using a user private key corresponding to its own identifier, a device update time that indicates the update time of the device list, and the public parameters; and a first transmission unit that transmits the device private key to a child terminal represented by an identifier included in the device list, wherein the sending terminal has an encryption unit that generates an encrypted text by encrypting a message using the identifier of the representative terminal and the device update time, and a second transmission unit that transmits the encrypted text to the representative terminal or the child terminal. [Effects of the Invention]

[0011] It is possible to realize ID-based encryption that allows control over whether a device can decrypt data. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of a cryptographic system according to a first embodiment; [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a private key generation center. [Figure 3] FIG. 2 is a diagram illustrating an example of a functional configuration of a representative terminal. [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a child terminal. [Figure 5] 10 is a diagram illustrating an example of a functional configuration of a transmitting terminal. [Figure 6] FIG. 10 is a diagram for explaining an example of key generation in Example 1-1. [Figure 7] FIG. 10 is a diagram for explaining an example of key generation in Example 1-2. [Figure 8] FIG. 10 is a diagram illustrating an example of the overall configuration of a cryptographic system according to a second embodiment. [Figure 9] FIG. 2 illustrates an example of a functional configuration of an identifier issuing server. [Figure 10] FIG. 10 is a diagram for explaining an example of key generation in Example 2-1. [Figure 11] FIG. 10 is a diagram for explaining an example of key generation in Example 2-2. [Figure 12] FIG. 2 illustrates an example of the hardware configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, a first embodiment and a second embodiment of the present invention will be described. In each of the following embodiments, assuming a situation in which a user manages multiple devices that can decrypt ciphertext using ID-based encryption, a cryptosystem 1 will be described that can control the system so that if a device is discarded, decryption is not possible using the private key held by that device, or so that decryption is not possible on any device if the identifier ID in question has expired.

[0014] [Preparation] Before describing each embodiment, a hierarchical identity-based encryption (HIBE) scheme will be described as a preparatory step.

[0015] The user identifier is ID=(ID1,...,ID t ) where t represents the hierarchy and ID t is the identifier of the tth layer.

[0016] For two identifiers ID and ID', ID = (ID1,...,ID t-1 ), and ID'=(ID1, ,ID t-1,ID t ), we write pa(ID)=ID'. When t=1, ID' indicates PKG (that is, the 0th layer is PKG).

[0017] In this case, the hierarchical ID-based encryption method consists of the following four algorithms (HIBE.Setup, HIBE.KeyGen, HIBE.Encrypt, HIBE.Decrypt).

[0018] (pp,msk)←HIBE.Setup(1 κ ): Bit string 1 corresponding to security parameter κ κ (that is, a κ-bit string of 1s) is used as input, and a public parameter pp and a master private key msk are generated and output.

[0019] sk ID ←HIBE.KeyGen(pp,sk pa(ID) ,ID): Public parameters pp and private key sk pa(ID) and an identifier ID as input, and the secret key sk corresponding to the identifier ID is obtained. ID In addition, when t=1, sk pa(ID) =msk.

[0020] C←HIBE.Encrypt(pp, ID, M): Using public parameters pp, identifier ID, and plaintext M as input, generate and output ciphertext C.

[0021] M'←HIBE.Decrypt(pp,ID,sk ID ,C): Public parameters pp, identifier ID, and private key sk ID and the ciphertext C as input, generate and output plaintext M'.

[0022] Also, any (pp, msk) ← HIBE.Setup(1 κ ), an arbitrary plaintext M, an arbitrary identifier ID, and a secret key sk corresponding to the identifier ID. ID ←HIBE.KeyGen(pp,sk pa(ID), ID), M=HIBE.Decrypt(pp, ID, sk ID ,HIBE.Encrypt(pp,ID,M)).

[0023] An example of the hierarchical ID-based encryption method is the method described in Japanese Patent No. 5097102.

[0024] [First embodiment] The first embodiment will be described below.

[0025] <Example of overall configuration of cryptosystem 1> An example of the overall configuration of a cryptographic system 1 according to this embodiment is shown in Fig. 1. As shown in Fig. 1, the cryptographic system 1 according to this embodiment is composed of a plurality of entities connected to each other via a network 90 such as the Internet. The entities include a private key generation center 10, a representative terminal 20, and a i (i=1,...,n), child terminal 30 i,j (i=1,···, nj=1,···, m_i), a time server 40, and a transmitting terminal 50 exist.

[0026] The private key generation center 10 is a server that functions as a PKG. i is the identifier ID i The child terminal 30 is a device that has a private key corresponding to the i,j is the representative terminal 20 i The same identifier ID i The representative terminal 20 is a device that has a private key corresponding to the i and child terminal 30 i,j (j=1, , m_i) constitutes a user terminal group i representing a group of devices of the same user. n is the representative terminal 20 i The total number of m_i is the identifier ID. i A child terminal 30 having a private key corresponding to i,j Represents the total number of.

[0027] Here, the representative terminal 20 i The identifier ID iThe identifier ID is assigned. i Examples of such information include telephone numbers, email addresses, My Numbers, employee numbers, user IDs for social media accounts, and the main terminal 20. i Examples of identifiers include the manufacturing unique number, IP address, and MAC (Media Access Control) address. However, these are just some examples, and any information that can be uniquely identified among people, organizations, devices, etc. can be used as an identifier (ID). i In the following, the representative terminal 20 i The identifier ID assigned to i This is called the user identifier ID i I will also call it this.

[0028] In addition, the child terminal 30 i,j Also, the identifier ID i,j The identifier ID is assigned. i,j For example, the slave terminal 30 i,j If the child terminal 30 is a mobile phone or a smartphone, the child terminal 30 may have an IMEI (International Mobile Equipment Identity) or a phone number linked to a SIM (Subscriber Identity Module) card. i,j Any information that can be identified as an identifier ID i,j In the following, the child terminal 30 i,j The identifier ID assigned to i,j The device identifier ID i,j I will also call it this.

[0029] The time server 40 is a server that distributes time information to other entities. As a result, the time information of each entity constituting the cryptographic system 1 according to this embodiment is synchronized. This time information is used to identify or calculate the device update time τ and user update time T, as well as their update intervals Δτ and ΔT, which will be described later.

[0030] An example of the time server 40 is, but is not limited to, an NTP (Network Time Protocol) server. Although only one time server 40 is shown in the example shown in Fig. 1, multiple time servers 40 may exist as long as they are time-synchronized with each other.

[0031] The transmitting terminal 50 receives a user identifier ID i The message (plain text) is encrypted using the i or child terminal 30 i,j In addition, the representative terminal 20 i (i=1, , n) and child terminal 30 i,j (i=1, . . . , nj=1, . . . , m_i) may function as the transmitting terminal 50.

[0032] <Example of functional configuration> An example of the functional configuration of the private key generation center 10 is shown in Fig. 2. As shown in Fig. 2, the private key generation center 10 has a setup processing unit 101 and a user private key generation unit 102. Each of these units is realized, for example, by processing in which one or more programs installed in the private key generation center 10 are executed by a processor such as a CPU (Central Processing Unit). The private key generation center 10 also has a storage unit 103. The storage unit 103 is realized, for example, by a memory device such as an HDD (Hard Disk Drive), SSD (Solid State Drive), RAM (Random Access Memory), or flash memory.

[0033] The setup processing unit 101 executes the HIBE.Setup algorithm to generate and output public parameters and a master private key. The user private key generation unit 102 executes the HIBE.KeyGen algorithm to generate and output a private key. The storage unit 103 stores various information (e.g., master private key, time information, public parameters, etc.).

[0034] Main terminal 20 iAn example of the functional configuration is shown in FIG. 3. As shown in FIG. 3, the representative terminal 20 i The device private key generation unit 201 i and the decoding unit 202 i and the list update unit 203 i These units include, for example, a representative terminal 20 i The process is realized by causing the processor to execute one or more programs installed in the representative terminal 20. i is stored in the storage unit 204. i The storage unit 204 i is realized by, for example, a memory device.

[0035] Device private key generation unit 201 i executes the HIBE.KeyGen algorithm and i,j The decryption unit 202 generates and outputs a private key (hereinafter, this private key is also referred to as a device private key). i executes the HIBE.Decrypt algorithm and decrypts the ciphertext received from the sending terminal 50. i is the representative terminal 20 i List of devices that i Update the device list. i is child terminal 30 i,j Device identifier ID i,j The data is in a list format having the following elements. i various information (e.g., your own user ID) i , this user identifier ID i Private key, time information, public parameters, and device list corresponding to i etc.)

[0036] Child terminal 30 i,j An example of the functional configuration is shown in FIG. 4. As shown in FIG. i,j is a decoding unit 301 i,j Decoding unit 301 i,j For example, the child terminal 30 i,jThe program is implemented by a processor executing one or more programs installed in the slave terminal 30. i,j is stored in the storage unit 302. i,j The storage unit 302 i,j is realized by, for example, a memory device.

[0037] Decoding unit 301 i,j executes the HIBE.Decrypt algorithm and decrypts the ciphertext received from the transmitting terminal 50. i,j various information (e.g., your device ID) i,j , device private key, time information, public parameters, etc.)

[0038] An example of the functional configuration of the transmitting terminal 50 is shown in Fig. 5. As shown in Fig. 5, the transmitting terminal 50 has an encryption unit 501. The encryption unit 501 is realized, for example, by a process in which one or more programs installed in the transmitting terminal 50 are executed by a processor. The transmitting terminal 50 also has a storage unit 502. The storage unit 502 is realized, for example, by a memory device.

[0039] An encryption unit 501 executes the HIBE.Encrypt algorithm to encrypt a message (plain text). A storage unit 502 stores various information (for example, a user identifier, time information, public parameters, etc.).

[0040] <Example 1-1> In the following, Example 1-1 will be described. In this example, the child terminal 30 of the user terminal group i i,j When adding or deleting a child device 30 i,j A case where the decryption permission or the decryption permission is controlled will be explained.

[0041] In this embodiment, the representative terminal 20 i For each update interval Δτ, the device list List i Update (Device Identifier ID i,j The device manager also generates a device private key and manages the device list. iThe device identifier ID contained in i,j 30 child devices with i,j When generating the device private key, the user identifier ID i In addition, the device update time τ is used. The device update time τ is based on the update interval Δτ. For example, if the update interval Δτ is 1 hour, it is given as a string such as τ=2021032515 (15:00, March 25, 2021), and if the update interval Δτ is 1 day, it is given as a string such as τ=20210325 (March 25, 2021).

[0042] The transmitting terminal 50 also receives a user identifier ID i In addition to this, the message (plain text) is also encrypted using the device update time τ. i Other than that, the device list List i The device identifier ID contained in i,j Child device ID with i,j Therefore, for example, only a certain child terminal 30 i,j is discarded and its device identifier ID i,j is the device list i When the child terminal 30 is deleted from the i,j The device private key held by the user can be used to control the device so that the ciphertext cannot be decrypted thereafter.

[0043] The device update time τ is updated as τ←τ+Δτ at every update interval Δτ. i and a device private key is generated. For example, if the update interval Δτ is 1 hour and the current device update time is τ=2021032515, the device update time τ is updated to τ=2021032516 when one hour has passed since the previous update. Similarly, if the update interval Δτ is 1 day and the current device update time is τ=20210325, the device update time τ is updated to τ=20210326 when one day has passed since the previous update.

[0044] The following describes each process of setup, user private key generation, device list update, device private key generation, encryption, and decryption in this embodiment. Note that the security parameter κ represents the security strength, and may be set to, for example, κ=128 or κ=256.

[0045] <<Setup in Example 1-1>> The setup processing unit 101 of the private key generation center 10 executes the following: (pp, msk)←HIBE.Setup(1 κ ) to generate and output the public parameters pp and the master secret key msk. The public parameters pp are stored in the storage unit 103 and are also sent to other entities (representative terminal 20 i , child terminal 30 i,j , the transmitting terminal 50, etc. The master secret key msk is stored in the storage unit 103 and is managed in secret.

[0046] <<User Private Key Generation in Example 1-1>> The user private key generation unit 102 of the private key generation center 10 i In response to a request from this representative terminal 20 i User Identifier ID i The private key sk corresponding to ID_i and the representative terminal 20 i The private key sk ID_i Representative terminal 20 i When transmitting the data to the server, it is desirable to establish a secure communication path using a technology such as TLS (Transport Layer Security). ID_i The transmission method is not limited to this.

[0047] Specifically, the user private key generation unit 102 of the private key generation center 10 generates a user private key from the representative terminal 20. i Upon request from sk ID_i ←HIBE.KeyGen(pp,msk,ID i ) and run this private key sk ID_i The representative terminal 20 i Send the private key skID_i is the storage unit 204 i and kept secret.

[0048] <Device list update in Example 1-1> When the device update time τ is updated, the representative terminal 20 i List update section 203 i is the device list. i Update the device list. i AddDev a list of device identifiers to add to i , Device List i DelDev provides a list of device identifiers to be deleted from i In addition, AddDev i and DelDev i is the representative terminal 20 i , either or both of which may be empty lists.

[0049] At this time, the representative terminal 20 i List update section 203 i is a List i ←(List i \DelDev i )∪AddDev i Device list by List i Update the updated device list. i is the storage unit 204 i is stored in

[0050] <Device private key generation in Example 1-1> Device List i When updated, the representative terminal 20 i The device private key generation unit 201 i is your user identifier ID i The private key sk corresponding to ID_i and the device update time τ, the device private key dsk ID_i,τ Generate a device list List i The device identifier ID contained in i,j 30 child devices withi,j The device private key (dsk) ID_i,τ The device private key dsk ID_i,τ Child terminal 30 i,j When transmitting the device private key dsk, it is desirable to establish a secure communication path using a technology such as TLS. ID_i,τ The transmission method is not limited to this.

[0051] Specifically, the representative terminal 20 i The device private key generation unit 201 i is the ID i,τ =(ID i ,τ) and then create a hierarchical identifier in the form of dsk ID_i,τ ←HIBE.KeyGen(pp,sk ID_i ,ID i,τ ) and click the device list. i The device identifier ID contained in i,j 30 child devices with i,j The device private key (dsk) ID_i,τ The device private key dsk ID_i,τ is the representative terminal 20 i The storage unit 204 i and the device private key dsk ID_i,τ Child terminal 30 that received i,j The storage unit 302 i,j and kept secret.

[0052] Encryption in Example 1-1 Main terminal 20 i or its child terminal 30 i,j When transmitting the ciphertext of the message M to the user, the encryption unit 501 of the transmitting terminal 50 uses the user identifier ID i and the device update time τ, and the message M is encrypted and the ciphertext is sent to the representative terminal 20. i or child terminal 30 i,j Send to.

[0053] Specifically, the encryption unit 501 of the sending terminal 50 receives the ID i,τ =(ID i,τ), and then C←HIBE.Encrypt(pp,ID i,τ , M) and executes the process on the representative terminal 20 i or child terminal 30 i,j Send the ciphertext C to

[0054] <Decryption in Example 1-1> Main terminal 20 i When the representative terminal 20 receives the ciphertext C, i Decoding unit 202 i M←HIBE.Decrypt(pp,ID i,τ ,dsk ID_i,τ , C) to decrypt the ciphertext C. The message M obtained by this decryption is stored in the memory unit 204 i is stored in

[0055] Similarly, the child terminal 30 i,j When the child terminal 30 receives the ciphertext C, i,j Decryption unit 301 i,j M←HIBE.Decrypt(pp,ID i,τ ,dsk ID_i,τ , C) to decrypt the ciphertext C. Note that this is done using the device private key dsk ID_i,τ 30 child devices with i,j The message M obtained by this decryption is stored in the memory unit 302 i,j is stored in

[0056] Summary of Example 1-1 As described above, in this embodiment, the user identifier ID i and the hierarchical identifier ID from the device update time τ i,τ =(ID i ,τ) and then use this identifier ID i,τ The corresponding device private key (dsk) ID_i,τ the device list i The device identifier ID contained in i,j 30 child devices with i,j Similarly, when encrypting the message M, the identifier ID i,τAfter creating this identifier ID i,τ Create ciphertext C using

[0057] As a result, the representative terminal 20 i In addition, the device list i The device identifier ID contained in i,j 30 child devices with i,j Only the device private key (dsk) ID_i,τ Therefore, for example, a certain child terminal 30 can decrypt the ciphertext C by i,j is discarded and its device identifier ID i,j is the device list i When the child terminal 30 is deleted from the i,j Even if the device private key held by the device is leaked, it is possible to prevent a situation in which the ciphertext is decrypted using the device private key.

[0058] Here, the relationship between the identifier and the private key when generating the key in this embodiment is shown in Fig. 6. As shown in Fig. 6, the private key generation center 10 corresponds to the 0th layer, and the representative terminal 20 i User Identifier ID i The private key sk corresponding to ID_i and the representative terminal 20 i Distribute to the main terminal 20 i corresponds to the first level, and the identifier ID i,τ =(ID i ,τ) ID_i,τ and generates its own child terminal 30 i,j (However, the device list i The device identifier ID contained in i,j 30 child devices with i,j ) to each child terminal 30 i,j corresponds to the second layer.

[0059] <Example 1-2> In the following, Example 1-2 will be described. In this example, in addition to Example 1-1, a user identifier ID i When the user terminal group i is expired, the representative terminal 20 iand all child devices 30 i,j This section explains a case where an identifier ID is invalidated so that it cannot be decrypted by the user. Note that the invalidation of an identifier ID includes the case where the identifier ID (or the account corresponding to the identifier ID) is suspended or deleted.

[0060] In this embodiment, the private key generation center 10 is connected to the representative terminal 20. i When generating the private key, the user identifier ID i In addition to this, the user update time T is also used to determine the user identifier ID i At this time, for example, at a certain user update time T, a secret key corresponding to the user identifier ID i If the user ID is invalidated, after T+ΔT, i Here, ΔT is the update interval of the user update time T. The user update time T is updated to T←T+ΔT at each update interval ΔT.

[0061] The transmitting terminal 50 also receives a user identifier ID i In addition to this, the message (plain text) is encrypted using the user update time T and the device update time τ. i If the password is invalid, after T+ΔT, the representative terminal 20 i and all child devices 30 i,j It is possible to control the encryption so that it cannot be decrypted.

[0062] There is no particular dependency between the user update time T and the device update time τ, and they are independent of each other. For example, the update interval ΔT of the user update time T may be set to one year (e.g., T=2021, ΔT=1), and the update interval Δτ of the device update time τ may be set to one month (e.g., τ=202103, Δτ=1).

[0063] The following describes the setup, user private key generation, device list update, device private key generation, encryption, and decryption processes in this embodiment.

[0064] <<Setup in Example 1-2>> The setup in this embodiment is the same as in embodiment 1-1, so the description thereof will be omitted.

[0065] <<User Private Key Generation in Example 1-2>> The user private key generation unit 102 of the private key generation center 10 i In response to a request from this representative terminal 20 i User Identifier ID i and the user update time T i ||The private key sk corresponding to T ID_i,T and the representative terminal 20 i The private key sk ID_i,T Representative terminal 20 i When transmitting the secret key sk, it is desirable to establish a secure communication path using a technology such as TLS. ID_i,T The transmission method is not limited to this.

[0066] Specifically, the user private key generation unit 102 of the private key generation center 10 generates a user private key from the representative terminal 20. i Upon request from sk ID_i,T ←HIBE.KeyGen(pp,msk,ID i ||T) and use this secret key sk ID_i,T The representative terminal 20 i Send the private key sk ID_i,T is the storage unit 204 i and kept secret.

[0067] As described above, when a user identifier ID i' When invalidating the user identifier ID, the user private key generation unit 102 of the private key generation center 10 invalidates the user identifier ID at the user update time T' after T+ΔT. i' The private key sk corresponding to ID_i',T' This prevents the generation of

[0068] <Device list update in Example 1-2> The device list update in this embodiment is the same as in embodiment 1-1, and therefore the description thereof will be omitted.

[0069] <Device private key generation in Example 1-2> Device List i When updated, the representative terminal 20 i The device private key generation unit 201 i is a concatenated string ID i ||The private key sk corresponding to T ID_i,T and the device update time τ, the device private key dsk ID_i,T,τ Generate a device list List i The device identifier ID contained in i,j 30 child devices with i,j The device private key (dsk) ID_i,T,τ The device private key dsk ID_i,T,τ Child terminal 30 i,j When transmitting the device private key dsk, it is desirable to establish a secure communication path using a technology such as TLS. ID_i,T,τ The transmission method is not limited to this.

[0070] Specifically, the representative terminal 20 i The device private key generation unit 201 i is the ID i,T,τ =(ID i ||T,τ) and then create a hierarchical identifier ID_i,T,τ ←HIBE.KeyGen(pp,sk ID_i,T ,ID i,T,τ ) and click the device list. i The device identifier ID contained in i,j 30 child devices with i,j The device private key (dsk) ID_i,T,τ The device private key dsk ID_i,T,τ is the representative terminal 20 i The storage unit 204 i and the device private key dsk ID_i,T,τ Child terminal 30 that received i,j The storage unit 302 i,jand kept secret.

[0071] Encryption in Example 1-2 Main terminal 20 i or its child terminal 30 i,j When transmitting the ciphertext of the message M to the user, the encryption unit 501 of the transmitting terminal 50 uses the user identifier ID i The message M is encrypted using the user update time T and the device update time τ, and the ciphertext is sent to the representative terminal 20 i or child terminal 30 i,j Send to.

[0072] Specifically, the encryption unit 501 of the sending terminal 50 receives the ID i,T,τ =(ID i After creating a hierarchical identifier of the form ||T,τ), C←HIBE.Encrypt(pp,ID i,T,τ , M) and executes the process on the representative terminal 20 i or child terminal 30 i,j Send the ciphertext C to

[0073] Decryption in Example 1-2 Main terminal 20 i When the representative terminal 20 receives the ciphertext C, i Decryption unit 202 i M←HIBE.Decrypt(pp,ID i,T,τ ,dsk ID_i,T,τ , C) to decrypt the ciphertext C. The message M obtained by this decryption is stored in the memory unit 204 i is stored in

[0074] Similarly, the child terminal 30 i,j When the child terminal 30 receives the ciphertext C, i,j Decryption unit 301 i,j M←HIBE.Decrypt(pp,ID i,T,τ ,dsk ID_i,T,τ , C) to decrypt the ciphertext C. Note that this is done using the device private key dsk ID_i,T,τ 30 child devices with i,jThe message M obtained by this decryption is stored in the memory unit 302 i,j is stored in

[0075] Summary of Example 1-2 As described above, in this embodiment, the user identifier ID i and the user update time T i ||The private key sk corresponding to T ID_i,T Generate this private key sk ID_i,T Representative terminal 20 i And distribute the device private key dsk ID_i,T,τ When generating the ID i,T,τ =(ID i ||T,τ) and then use this identifier ID i,T,τ Using the device private key dsk ID_i,T,τ Similarly, when encrypting the message M, the identifier ID i,T,τ After creating this identifier ID i,τ Create ciphertext C using

[0076] This allows us to obtain the device secret key dsk that depends not only on the device update time τ but also on the user update time T. ID_i,T,τ Therefore, for example, if a user identifier ID i' If the user identifier ID is invalidated, the user identifier ID will be invalidated at the user update time T' after T+ΔT. i' The private key sk corresponding to ID_i',T' According to this embodiment, for example, the user identifier ID i' If the user update time T' (≧T+ΔT) is invalidated, the representative terminal 20 i' and its child terminal 30 i',j In addition, if the device private key dsk ID_i',T Even if the secret key is leaked, it can be made impossible to decrypt within the user update time T' (≧T+ΔT).

[0077] Here, the relationship between the identifier and the private key when generating the key in this embodiment is shown in Fig. 7. As shown in Fig. 7, the private key generation center 10 corresponds to the 0th layer, and the representative terminal 20 i User Identifier ID i and the secret key sk corresponding to the user update time T ID_i,T and the representative terminal 20 i Distribute to the main terminal 20 i corresponds to the first level, and the identifier ID i,T,τ =(ID i ||T,τ) corresponding private key sk ID_i,T,τ and generates its own child terminal 30 i,j (However, the device list i The device identifier ID contained in i,j 30 child devices with i,j ) to each child terminal 30 i,j corresponds to the second layer.

[0078] [Second embodiment] The second embodiment will be described below. In this embodiment, a user identifier ID i The following describes a case where there is an identifier issuing server 60 that issues an identifier. Note that the description of the same components as those in the first embodiment will be omitted.

[0079] <Example of overall configuration of cryptosystem 1> An example of the overall configuration of the cryptographic system 1 according to this embodiment is shown in Fig. 8. As shown in Fig. 8, the cryptographic system 1 according to this embodiment further includes an identifier issuing server 60 as an entity.

[0080] The identifier issuing server 60 is a server owned by a service provider that provides applications such as cloud services. The identifier issuing server 60 stores its own private key and the user identifier ID that it manages. i and the user ID identifier ID i 20 representative terminals with i Generate a private key for

[0081] Here, the identifier issuing server 60 has an identifier IDS The identifier ID is assigned. S Examples of the identifier ID include a telephone number, an email address, a My Number, a serial number specific to the identifier issuing server 60, an IP address, and a MAC address. However, these are just examples, and any information that can be uniquely identified within a device, etc. can be used as an identifier ID. S It can be used as:

[0082] In addition, all user identifiers ID i (i=1, . . . , n) does not need to be managed by the identifier issuing server 60. For example, some user identifiers ID i Only (e.g., user identifier ID for i=1,...,n1) i ) may be managed by the identifier issuing server 60. In addition, although only one identifier issuing server 60 is shown in the example shown in FIG. 8, multiple identifier issuing servers 60 may be present. For example, the user identifier ID of cloud service A i and an identifier issuing server 60A that manages the user identifier ID of the cloud service B. i There may also be an identifier issuing server 60B that manages the IDs.

[0083] <Example of functional configuration> An example of the functional configuration of the identifier issuing server 60 is shown in Fig. 9. As shown in Fig. 9, the identifier issuing server 60 has a user private key generation unit 601. The user private key generation unit 601 is realized, for example, by a process in which one or more programs installed in the identifier issuing server 60 are executed by a processor. The identifier issuing server 60 also has a storage unit 602. The storage unit 602 is realized, for example, by a memory device.

[0084] The user private key generation unit 601 executes the HIBE.KeyGen algorithm to generate and output a private key. The storage unit 602 stores various information (for example, its own identifier ID S , this user identifier ID S The private key corresponding to the user ID that you manage. i, time information, public parameters, etc.)

[0085] <Example 2-1> In the following, Example 2-1 will be described. In this example, the child terminal 30 of the user terminal group i i,j When adding or deleting a child device 30 i,j A case where the decryption permission or the decryption permission is controlled will be explained.

[0086] The following describes the setup, user private key generation, device list update, device private key generation, encryption, and decryption processes in this embodiment.

[0087] <<Setup in Example 2-1>> The setup in this embodiment is the same as in embodiment 1-1, so the description thereof will be omitted.

[0088] <<User Private Key Generation in Example 2-1>> In response to a request from the identifier issuing server 60, the user private key generating unit 102 of the private key generation center 10 generates the identifier ID of the identifier issuing server 60. S The private key sk corresponding to ID_S and transmits it to the identifier issuing server 60. ID_S When transmitting the secret key sk to the identifier issuing server 60, it is desirable to establish a secure communication path using a technology such as TLS. ID_S The transmission method is not limited to this.

[0089] Specifically, the user private key generation unit 102 of the private key generation center 10 generates a user private key in response to a request from the identifier issuing server 60. ID_S ←HIBE.KeyGen(pp,msk,ID S ) and run this private key sk ID_S The private key sk is sent to the identifier issuing server 60. ID_S is stored in the storage unit 602 and is managed in secret.

[0090] Next, the user private key generation unit 601 of the identifier issuing server 60 generates the identifier ID S and the user identifier ID that you manage i and the corresponding private key sk ID_i Generate the user identifier ID i 20 representative terminals with i The private key sk ID_i Representative terminal 20 i When transmitting the secret key sk, it is desirable to establish a secure communication path using a technology such as TLS. ID_i The transmission method is not limited to this.

[0091] Specifically, the user private key generation unit 601 of the identifier issuing server 60 generates sk ID_i ←HIBE.KeyGen(pp,sk ID_S ,(ID S ,ID i )) and run this private key sk ID_i The representative terminal 20 i Send the private key sk ID_i is stored in the storage unit 204 and is managed in secret.

[0092] <Device list update in Example 2-1> The device list update in this embodiment is the same as in embodiment 1-1, and therefore the description thereof will be omitted.

[0093] <Device private key generation in Example 2-1> The device private key generation in this embodiment is almost the same as in embodiment 1-1, but i,τ =(ID S ,ID i ,τ) and then create a hierarchical identifier of the device secret key dsk ID_i,τ The other points are the same as in Example 1-1, so the description thereof will be omitted.

[0094] Encryption in Example 2-1 The encryption in this embodiment is almost the same as in embodiment 1-1, buti,τ =(ID S ,ID i , τ) is created, and then a ciphertext C is generated. The other points are the same as in Example 1-1, and therefore a description thereof will be omitted.

[0095] <Decryption in Example 2-1> The decryption in this embodiment is almost the same as in embodiment 1-1, but the ID i,τ =(ID S ,ID i , τ) and then decrypts the ciphertext C. The other points are the same as in Example 1-1, and therefore the description thereof will be omitted.

[0096] Summary of Example 2-1 As described above, in this embodiment, the user identifier ID i There is an identifier issuing server 60 that manages the private key sk. ID_i Generate.

[0097] Here, the relationship between the identifier and the private key when generating the key in this embodiment is shown in Fig. 10. As shown in Fig. 10, the private key generation center 10 corresponds to the 0th layer, and the identifier ID of the identifier issuing server 60 is S The private key sk corresponding to ID_S and distributes it to the identifier issuing server 60. The identifier issuing server 60 corresponds to the first layer, and the identifier ID of the identifier issuing server 60 S and representative terminal 20 i User Identifier ID i and the corresponding private key sk ID_i and the representative terminal 20 i Distribute to the main terminal 20 i corresponds to the second level, and the identifier ID i,τ =(ID S ,ID i ,τ) ID_i,τ and generates its own child terminal 30 i,j (However, the device list i The device identifier ID contained in i,j30 child devices with i,j ) to each child terminal 30 i,j corresponds to the third layer.

[0098] <Example 2-2> In the following, Example 2-2 will be described. In this example, in addition to Example 2-1, a user identifier ID i When the user terminal group i is expired, the representative terminal 20 i and all child devices 30 i,j A case where control is performed so that decoding cannot be performed using the above method will be described.

[0099] The following describes the setup, user private key generation, device list update, device private key generation, encryption, and decryption processes in this embodiment.

[0100] <<Setup in Example 2-2>> The setup in this embodiment is the same as in embodiment 2-1, so the description thereof will be omitted.

[0101] <<User Private Key Generation in Example 2-2>> In response to a request from the identifier issuing server 60, the user private key generating unit 102 of the private key generation center 10 generates the identifier ID of the identifier issuing server 60. S The private key sk corresponding to ID_S and transmits it to the identifier issuing server 60. ID_S When transmitting the secret key sk to the identifier issuing server 60, it is desirable to establish a secure communication path using a technology such as TLS. ID_S The transmission method is not limited to this.

[0102] Specifically, the user private key generation unit 102 of the private key generation center 10 generates a user private key in response to a request from the identifier issuing server 60. ID_S ←HIBE.KeyGen(pp,msk,ID S ) and run this private key sk ID_S The private key sk is sent to the identifier issuing server 60. ID_Sis stored in the storage unit 602 and is managed in secret.

[0103] Next, the user private key generation unit 601 of the identifier issuing server 60 generates the identifier ID S and the user identifier ID that you manage. i and the user update time T i ||T and the corresponding private key sk ID_i,T Generate the user identifier ID i 20 representative terminals with i The private key sk ID_i,T Representative terminal 20 i When transmitting the secret key sk, it is desirable to establish a secure communication path using a technology such as TLS. ID_i,T The transmission method is not limited to this.

[0104] Specifically, the user private key generation unit 601 of the identifier issuing server 60 generates sk ID_i,T ←HIBE.KeyGen(pp,sk ID_S ,(ID S ,ID i ||T)) and use this secret key sk ID_i,T The representative terminal 20 i Send the private key sk ID_i,T is stored in the storage unit 204 and is managed in secret.

[0105] Note that a user identifier ID at a certain user update time T i' When invalidating the user identifier ID, the user private key generation unit 102 of the private key generation center 10 invalidates the user identifier ID at the user update time T' after T+ΔT. i' The private key sk corresponding to ID_i',T' This prevents the generation of

[0106] <Device list update in Example 2-2> The device list update in this embodiment is the same as in embodiment 2-1, and therefore a description thereof will be omitted.

[0107] <Device private key generation in Example 2-2> The device private key generation in this embodiment is almost the same as in the embodiment 1-2, but i,T,τ =(ID S ,ID i After creating a hierarchical identifier in the form of ||T,τ), the device private key dsk ID_i,T,τ The other points are the same as in Example 1-2, so the explanation will be omitted.

[0108] Encryption in Example 2-2 The encryption in this embodiment is almost the same as in embodiment 1-2, but i,T,τ =(ID S ,ID i A hierarchical identifier in the form ||T, τ) is created, and then a ciphertext C is generated. The other points are the same as in Example 1-2, and therefore a description thereof will be omitted.

[0109] <Decryption in Example 2-2> The decryption in this embodiment is almost the same as in embodiment 1-2, but the ID i,T,τ =(ID S ,ID i After creating a hierarchical identifier in the form ||T, τ), the ciphertext C is decrypted. Since the other points are the same as those in Example 1-2, the explanation thereof will be omitted.

[0110] Summary of Example 2-2 As described above, in this embodiment, the user identifier ID i There is an identifier issuing server 60 that manages the private key sk. ID_i,T In this embodiment, the identifier issuing server 60 generates the user identifier ID i It is possible to control whether or not decryption is possible when the password expires.

[0111] Here, the relationship between the identifier and the private key when generating the key in this embodiment is shown in Fig. 11. As shown in Fig. 11, the private key generation center 10 corresponds to the 0th layer, and the identifier ID of the identifier issuing server 60 is S The private key sk corresponding to ID_SThe identifier issuing server 60 corresponds to the first layer, and distributes the ID S ,ID i ||T) corresponding private key sk ID_i,T and the representative terminal 20 i Distribute to the main terminal 20 i corresponds to the second level, and the identifier ID i,T,τ =(ID S ,ID i ||T,τ) corresponding private key sk ID_i,T,τ and generates its own child terminal 30 i,j (However, the device list i The device identifier ID contained in i,j 30 child devices with i,j ) to each child terminal 30 i,j corresponds to the third layer.

[0112] <Hardware configuration> The private key generation center 10 and the representative terminal 20 in each of the above embodiments i , child terminal 30 i,j The time server 40, the transmitting terminal 50, and the identifier issuing server 60 can be realized, for example, by the hardware configuration of a computer 900 shown in FIG.

[0113] 12 includes an input device 901, a display device 902, an external I / F 903, a communication I / F 904, a processor 905, and a memory device 906. Each of these pieces of hardware is connected to each other via a bus 907 so as to be able to communicate with each other.

[0114] The input device 901 is, for example, a keyboard, a mouse, a touch panel, various physical buttons, etc. The display device 902 is, for example, a display, a display panel, etc. However, the computer 900 does not necessarily have to have at least one of the input device 901 and the display device 902.

[0115] The external I / F 903 is an interface with an external device such as a recording medium 903a. Examples of the recording medium 903a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0116] The communication I / F 904 is an interface for connecting to a communication network such as the Internet. The processor 905 is, for example, a variety of computing devices such as a CPU. The memory device 906 is, for example, a variety of storage devices such as an HDD, an SSD, a flash memory, a RAM, a ROM (Read Only Memory), etc.

[0117] Note that the hardware configuration of the computer 900 shown in FIG. 12 is an example, and the computer 900 may have, for example, multiple processors 905, multiple memory devices 906, or various other hardware components in addition to the hardware shown in the figure.

[0118] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of symbols]

[0119] 1: Cryptographic system, 10: Private key generation center (PKG), 20 i : Main terminal, 30 i,j : Child terminal, 40: Time server, 50: Transmission terminal, 60: Identifier issuing server, 90: Network, 101: Setup processing unit, 102: User private key generation unit, 103: Storage unit, 201 i : Device private key generation unit, 202 i : Decoding unit, 203 i : List Update Department, 204 i :Memory Department, 301 i,j : Decryption unit, 302 i,j: Storage unit, 501: Encryption unit, 502: Storage unit, 601: User private key generation unit, 602: Storage unit, 900: Computer, 901: Input device, 902: Display device, 903: External I / F, 903a: Recording medium, 904: External I / F, 905: Processor, 906: Memory device, 907: Bus

Claims

1. An encryption system including a private key generation center, one or more representative terminals, one or more slave terminals used by the same user as the representative terminal, and one or more transmitting terminals, The private key generation center a setup unit that generates public parameters of the hierarchical ID-based encryption and a master private key; a first user private key generation unit that generates a user private key of the representative terminal using an identifier of the representative terminal, the master private key, and the public parameters; The representative terminal is a storage unit that stores a device list configured with identifiers of child terminals used by the same user as the user who uses the device; a device private key generation unit that generates a device private key for decrypting an encrypted text transmitted from the transmitting terminal, using a user private key corresponding to its own identifier, a device update time indicating an update time of the device list, and the public parameters; a first transmission unit that transmits the device private key to a child terminal represented by an identifier included in the device list, The transmitting terminal an encryption unit that generates a ciphertext by encrypting a message using the identifier of the representative terminal and the device update time; a second transmission unit that transmits the ciphertext to the representative terminal or the child terminal; A cryptosystem having:

2. The first user private key generation unit generating a user private key for the representative terminal using an identifier of the representative terminal, a user update time indicating an update time of the identifier of the representative terminal, the master private key, and the public parameters; The device private key generation unit generating the device private key using a user private key corresponding to its own identifier, the user update time, the device update time, and the public parameters; The encryption unit The cryptosystem according to claim 1 , wherein the ciphertext is generated using an identifier of the representative terminal, the user update time, and the device update time.

3. The representative terminal is 3. The encryption system according to claim 1, further comprising an update unit that updates the device list at each device update time.

4. The encryption system according to claim 3 , wherein updating the device list includes adding an identifier of a child terminal to the device list and deleting an identifier of a child terminal from the device list.

5. the encryption system includes an identifier issuing server that issues and manages identifiers of the representative terminals, The identifier issuing server 5. The cryptographic system according to claim 1, further comprising a second private key generation unit that generates a user private key of the representative terminal using the user's own user private key generated by the private key generation center, an identifier of a representative terminal managed by the user, and the public parameters.

6. A terminal communicably connected to a secret key generation center that generates a user secret key by hierarchical ID-based encryption, one or more slave terminals used by the same user, and a transmitting terminal, a storage unit that stores a device list configured with identifiers of the child terminals; a device private key generation unit that generates a device private key for decrypting a ciphertext transmitted from the transmitting terminal, using a user private key corresponding to its own identifier, which is generated by the private key generation center, a device update time indicating an update time of the device list, and public parameters generated by the private key generation center; a transmitter that transmits the device private key to a child terminal represented by an identifier included in the device list; A terminal having:

7. A method for use in an encryption system including a private key generation center, one or more representative terminals, one or more slave terminals used by the same user as the representative terminal, and one or more transmitting terminals, comprising: The private key generation center a setup procedure for generating public parameters and a master private key for hierarchical identity-based encryption; executing a first user private key generation procedure for generating a user private key of the representative terminal using an identifier of the representative terminal, the master private key, and the public parameters; The representative terminal a storage step of storing, in a storage unit, a device list configured with identifiers of child terminals used by the same user as the user who uses the device itself; a device private key generation step of generating a device private key for decrypting an encrypted text transmitted from the transmitting terminal, using a user private key corresponding to its own identifier, a device update time indicating an update time of the device list, and the public parameters; a first transmission step of transmitting the device private key to a child terminal represented by an identifier included in the device list; The transmitting terminal: an encryption procedure for generating a ciphertext by encrypting a message using the identifier of the representative terminal and the device update time; a second transmission procedure of transmitting the ciphertext to the representative terminal or the child terminal; How to do it.

Images