Computer system and key exchange method

Abstract

To ensure security to implement efficient and easy key distribution.SOLUTION: A data management server manages a database for storing confidential data, and stores public information and first confidential information in a confidential region. A client terminal retains public information and second confidential information. When a request for generating a user private key is received, the data management server uses the public information and the first confidential information to generate a first public key, and transmits the key to the client terminal. The client terminal uses the public information, the second confidential information, and the first public key to generate a user private key, uses the public information and the second confidential information to generate a second public key, and transmits the keys to the data management server. The data management server, in the confidential region, uses the public information, the first confidential information, and the second public key to generate a user private key, generates key management data for managing the user private key, and records them.SELECTED DRAWING: Figure 6

Description

Technical Field

[0001] The present invention relates to a method for exchanging secret keys.

Background Art

[0002] In recent years, cloud services have been used for the purpose of reducing the development cost of systems and the operation and management cost of systems. In cloud services, since the organization that manages the system that provides the cloud service is different from the organization that uses the system, measures such as preventing information leakage and investigating the cause of accidents that have occurred and preventing recurrence are assignment required. As a measure to prevent data leakage, a method of utilizing encryption technology to ensure the confidentiality of data in advance can be considered.

[0003] For example, when using a symmetric key encryption method in which multiple clients have the same key (symmetric key) and perform data encryption / decryption, the risk of information leakage increases as the number of clients (users) sharing the symmetric key increases. Therefore, if the shared key used for the encrypted data held in the database is leaked, the encrypted data may be decrypted by a malicious third party.

[0004] When the symmetric key is leaked, in order to cope with the above-mentioned risks, it is necessary to quickly generate a new symmetric key and redistribute the symmetric key to all clients.

[0005] As a technology to solve the aforementioned problems, the technology described in Patent Document 1 is known. Patent Document 1 describes that "a data management server manages a database that stores confidential management data encrypted using a master secret key, a search client holds a common secret key and a user secret key assigned to each user, and when it receives a search instruction that includes a search keyword, it sends a search request that includes an output confidential search keyword generated using the common secret key and the user secret key, and if the user secret key is valid, the data management server generates a confidential management search keyword for searching the confidential management data by converting the output confidential search keyword into ciphertext using the master secret key, searches for confidential management data that matches the confidential management search keyword, and generates output confidential data using the confidential management data and the user secret key."

[0006] According to the invention described in Patent Document 1, if a user's private key is leaked, it is sufficient to take measures such as updating or revoking the leaked user's private key, and there is no need to update other user private keys or data stored in the database. Therefore, it becomes possible to take rapid measures against the leakage of private keys. [Prior art documents] [Patent Documents]

[0007] [Patent Document 1] Japanese Patent Publication No. 2018-97034 [Patent Document 2] Japanese Patent Publication No. 2012-123614 [Overview of the Initiative] [Problems that the invention aims to solve]

[0008] In the technology described in Patent Document 1, security is ensured by managing only key management information, which is related to the user's private key, rather than storing the common private key, user private key, and master private key on the data management server that stores confidential data.

[0009] When using cloud services, if a private key, or the formula for generating the key and confidential information, is stored on an external server accessed by the client, there is a security risk because the private key could be leaked due to an attack on the server, or because privileged users such as data center administrators could obtain the private key. Even if the data itself is encrypted, there is still a risk of information leakage. Therefore, from a security standpoint, the generation and distribution of master and user private keys should be performed on the user's administrator's terminal, and the keys should be distributed face-to-face by the administrator of each terminal, or by means of mail, etc., without using external servers or communication channels.

[0010] However, when there are many users, the aforementioned key exchange method is inefficient and impractical.

[0011] The present invention aims to enable the generation and distribution of user private keys without ever storing them in areas accessible to privileged users, and without concealing them during communication. [Means for solving the problem]

[0012] A representative example of the invention disclosed in this application is as follows: a computer system comprising a data management server and a client terminal, wherein the data management server has an arithmetic unit and a storage device, manages a database storing confidential data encrypted based on a probabilistic encryption scheme using a master secret key, the arithmetic unit has a function to generate a secure and logically isolated trusted area in the storage device, the trusted area stores the master secret key, as well as public information and first secret information used in the Diffie-Hellman key exchange scheme, the client terminal holds the public information and second secret information used in the Diffie-Hellman key exchange scheme, and the data management server is used by the client terminal to access the confidential data managed by the data management server. When a user private key generation request is received, the system generates a first public key using the public information and the first secret information, and sends the first public key to the client terminal. The client terminal generates the user private key using the public information, the second secret information, and the first public key, generates a second public key using the public information and the second secret information, and sends the second public key to the data management server. The data management server stores the second public key in the trust area, generates the user private key in the trust area using the public information, the first secret information, and the second public key, generates key management data for managing the user private key in the trust area, and records the key management data as information used for verification processing to determine whether the user private key is valid. Furthermore, after the key management data has been recorded, the data management server deletes the user private key from the trust area. do. [Effects of the Invention]

[0013] According to the present invention, the generation and distribution of user private keys can be achieved without ever storing the private key in an area accessible to privileged users, and without concealing the private key in the communication path. Other issues, configurations, and effects will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0014] [Figure 1] It is a diagram showing a configuration example of the computer system of Example 1. [Figure 2] It is a diagram showing an example of the hardware configuration of the client terminal of Example 1. [Figure 3] It is a diagram showing an example of the hardware configuration of the data management server of Example 1. [Figure 4] It is a diagram showing an example of the functional configuration of the client terminal (U) of Example 1. [Figure 5] It is a diagram showing an example of the functional configuration of the client terminal (KM) of Example 1. [Figure 6] It is a diagram showing an example of the functional configuration of the data management server of Example 1. [Figure 7] It is a sequence showing the procedure for registering the master secret key in the computer system of Example 1. [Figure 8] It is a sequence showing an example of the procedure for issuing the user secret key of the TEE trusted area processing unit in the computer system of Example 1. [Figure 9] It is a sequence showing an example of the procedure for issuing the user secret key of the client terminal (KM) in the computer system of Example 1. [Figure 10] It is a sequence diagram showing an example of the procedure for issuing the user secret key of the client terminal (U) in the computer system of Example 1. [Figure 11] It is a sequence diagram showing an example of the procedure for issuing the user secret key of the client terminal (U) in the computer system of Example 1. [Figure 12A] It is a sequence diagram showing an example of the procedure for issuing the user secret key of the client terminal (U) in the computer system of Example 1. [Figure 12B] It is a sequence diagram showing an example of the procedure for issuing the user secret key of the client terminal (U) in the computer system of Example 1. [Figure 13A] It is a diagram showing an example of the login control of a general user in the computer system of Example 1. [Figure 13B]It is a diagram showing an example of login control for a general user in the computer system of Example 1. [Figure 14A] It is a diagram showing an example of login control for a general user in the computer system of Example 2. [Figure 14B] It is a diagram showing an example of login control for a general user in the computer system of Example 2. [Figure 15] It is a sequence diagram showing an example of the procedure for issuing a user secret key of the client terminal (U) in the computer system of Example 2. [Figure 16A] It is a diagram showing an example of login control for a general user in the computer system of Example 3. [Figure 16B] It is a diagram showing an example of login control for a general user in the computer system of Example 3. [Figure 17A] It is a sequence diagram showing an example of the procedure for issuing a user secret key of the client terminal (U) at the time of login after the second time in the computer system of Example 3. [Figure 17B] It is a sequence diagram showing an example of the procedure for issuing a user secret key of the client terminal (U) at the time of login after the second time in the computer system of Example 3.

Embodiments for Carrying Out the Invention

[0015] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not to be construed as being limited to the description of the embodiments shown below. Those skilled in the art can easily understand that the specific configuration can be changed without departing from the spirit or gist of the present invention.

[0016] In the configuration of the invention described below, the same or similar configurations or functions are denoted by the same reference numerals, and duplicate descriptions are omitted.

[0017] The notations such as "first", "second", "third", etc. in this specification and the like are attached to identify the components, and do not necessarily limit the number or order.

Examples

[0018] The configuration of the computer system in Example 1 will be explained using Figures 1 to 6.

[0019] Figure 1 shows an example of the configuration of the computer system in Example 1.

[0020] The computer system of Embodiment 1 consists of a data management server 100 and a plurality of client terminals 101. The data management server 100 is connected to each client terminal 101 via a network 103 so as to be able to communicate with them. The network 103 could be, for example, a WAN (Wide Area Network) and a LAN (Local Area Network). The connection method of the network 103 may be either wired or wireless.

[0021] In the computer system, there is a master private key administrator, a user administrator, and a general user, each with their own client terminal 101. In the following description, the client terminal 101 used by the master private key administrator will be referred to as client terminal 101(KM), the client terminal 101 used by the user administrator will be referred to as client terminal 101(UM), and the client terminal 101 used by a general user will be referred to as client terminal 101(U). When there is no distinction between client terminal 101(KM), client terminal 101(UM), and client terminal 101(U), they will be referred to simply as client terminal 101.

[0022] The client terminal 101 (KM) generates and manages the master private key. Specifically, the client terminal 101 (KM) generates the master private key and registers the encrypted master private key with the data management server 100 according to the public key cryptography scheme. The client terminal 101 (KM) also generates a user private key, generates a difference key mask for the master private key and the user private key, and registers the key management data including the difference mask with the data management server 100.

[0023] Client terminal 101(UM) verifies and registers the application information of general users. Specifically, client terminal 101(UM) verifies and approves the application information of general users, encrypts the application information of general users according to a probabilistic encryption method, and registers it with the data management server 100. Furthermore, client terminal 101(UM) performs encryption that generates searchable data without decryption (searchable encryption).

[0024] Here, probabilistic encryption is an encryption algorithm that generates random encrypted data from plaintext data, while concealing equivalence and greater-than / less-than relationships. In probabilistic encryption, the plaintext and ciphertext have a one-to-many correspondence.

[0025] The client terminal 101(U) generates and manages the user's private key for general users. Specifically, the client terminal 101(U) performs user authentication with the data management server 100 and shares the user's private key between the data management server 100 and the client terminal 101(U) according to the Diffie-Hellman key exchange scheme (DH scheme).

[0026] Here, the DH method allows for the sharing of a common key while reducing the security risk of communication by sending and receiving publicly available parameters between terminals via the communication path. The client terminal 101 in this embodiment is equipped with all the necessary functions for any appropriate authenticated DH method. As for the type of DH key exchange, the use of DHE (Ephemeral DH) or ECDHE (Ephemeral ECDH), which are listed in the e-government recommended cryptography list, is assumed. DHE and ECDHE have the characteristic of Perfect Forward Secrecy (PFS) (the confidentiality of data is protected in the future), and are therefore preferable to Static DH from a security standpoint.

[0027] The data management server 100 authenticates the client terminal 101, shares the user secret key used by the client terminal 101(U) based on the DH method, and manages information related to the user secret key. Specifically, the data management server 100 performs authentication processing for general users operating the client terminal 101(U), and shares the user secret key between the data management server 100 and the client terminal 101(U) according to the DH method. The data management server 100 also generates and manages information related to the user secret key of the client terminal 101(U).

[0028] Figure 2 shows an example of the hardware configuration of the client terminal 101 in Embodiment 1.

[0029] The client terminal 101 is an information processing device such as a personal computer, smartphone, and server device, and comprises a CPU 201, main memory 202, secondary memory 203, network interface 204, input device 205, and display device 206. The main memory 202 is, for example, DRAM (Dynamic Random Access Memory), and the secondary memory 203 is, for example, an HDD (Hard Disk Drive) and an SSD (Solid State Drive). The input device 205 is, for example, a keyboard, mouse, and touch panel.

[0030] The client terminal 101 may be implemented as a virtual machine.

[0031] Figure 3 shows an example of the hardware configuration of the data management server 100 in Example 1.

[0032] The data management server 100 is an information processing device such as a personal computer, smartphone, and server device, and comprises a CPU 301, main memory 302, secondary memory 303, network interface 304, input device 305, and display device 306. The main memory 302 is, for example, DRAM, and the secondary memory 303 is, for example, an HDD and an SSD. The input device 305 is, for example, a keyboard, mouse, and touch panel.

[0033] The CPU 301 in the data management server 100 is a CPU with TEE functionality and can generate a TEE trust area 310 on the storage area of ​​the main memory 302. A CPU equipped with Intel SGX (Software Guard Extensions) (Intel is a registered trademark and the same applies hereafter) is a possible option.

[0034] The TEE Trust Area 310 is a hardware-based area where information cannot be read even if the computer's administrator privileges are compromised. As described later, by using the TEE Trust Area 310 to generate private keys, secure key management becomes possible even when using an external server.

[0035] The data management server 100 may be implemented as a virtual machine. Alternatively, the data management server 100 may be implemented as a data management system composed of multiple data sets.

[0036] Figure 4 shows an example of the functional configuration of client terminal 101(U) in Embodiment 1. Note that the functional configuration of client terminal 101(UM) is the same as that of client terminal 101(U), so its explanation is omitted.

[0037] The client terminal 101(U) has the following functional configuration: an encryption unit 400, a searchable encryption unit 401, a decryption unit 402, a DH public key generation unit 403, a DH secret information generation unit 404, and a DH user secret key generation unit 405. Each functional unit is realized by the CPU 201 executing a program stored in the main memory 202. The client terminal 101(U) also holds a DH public key 410, DH secret information 411, DH public information 412, a TEE public key 413, a user secret key 414, and a common secret key 415.

[0038] DH secret information 411 is a natural number used in the DH scheme. DH secret information 411 is generated for each user using client terminal 101, and each DH secret information 411 is unique. DH secret information 411 is generated by client terminal 101(U) and managed to prevent it from being known to third parties.

[0039] DH Public Information 412 is a combination of radix and prime numbers used in the DH method. The IETF (Internet Engineering Task Force), a voluntary organization promoting the standardization of internet technologies, provides guidance on selecting appropriate radix and prime numbers. In this embodiment, it is assumed that the data management server 100 generates the DH Public Information 412; however, the client terminal 101(U) may generate the DH Public Information 412 and send it to the data management server 100.

[0040] The DH public key 410 is the public key used in the DH scheme and is generated from the DH public information 412 and the DH secret information 411. The client terminal 101(U) shares the DH public key 410 with the data management server 100, which is the key exchange partner. As will be described later, the data management server 100 generates a user secret key using the DH public key 410.

[0041] The TEE public key 413 is a key generated by the data management server 100 and is shared between the client terminal 101(U) and the data management server 100. The TEE public key 413 is used to encrypt the user ID and password sent to the data management server 100.

[0042] The user secret key 414 is a secret key set for a user using the client terminal 101(U). The user secret key 414 is used for searchable encryption and decryption. For general users, the user secret key 414 is generated based on the DH method. The user secret key 414 is a secret key that can be added, deleted, and updated. Since the user secret key 414 is a secret key assigned to a user, the client terminal 101 holds as many user secret keys 414 as there are users using it. Also, each user secret key 414 has a different value from other user secret keys 414. A detailed explanation of the user secret key 414 is omitted as it is described in Patent Document 1.

[0043] The shared secret key 415 is a secret key used for encryption and decryption processing and is shared between the client terminal 101(U) and the data management server 100. In this embodiment, the client terminal 101(U) holds one shared secret key 415, and this shared secret key 415 is not updated. In this embodiment, the shared secret key 415 is generated by the data management server 100, and further, searchable encryption is performed on it before it is transmitted to the client terminal 101(U). A detailed explanation of the shared secret key is omitted as it is described in Patent Document 1.

[0044] The encryption unit 400 encrypts data using basic encryption technologies such as AES (Advanced Encryption Standard).

[0045] The searchable encryption unit 401 performs "searchable encryption," which allows data to be searched while remaining encrypted. Specifically, the searchable encryption unit 401 encrypts data using a probabilistic encryption scheme that employs a hash value and a mask based on the output value of a homomorphic function, thereby generating searchable encrypted data (confidential data). A method for generating searchable encrypted data is disclosed, for example, in Patent Document 2.

[0046] The decryption unit 402 decrypts the encrypted processing results, etc., received from the data management server 100. The DH public key generation unit 403 generates a DH public key 410 based on the DH scheme. The DH secret information generation unit 404 generates DH secret information 411. The DH user secret key generation unit 405 generates a user secret key 414 based on the DH scheme.

[0047] Figure 5 shows an example of the functional configuration of the client terminal 101(KM) in Embodiment 1.

[0048] The client terminal 101 (KM) has the following functional configuration: an encryption unit 500, a searchable encryption unit 501, a decryption unit 502, and a key generation unit 503. Each functional unit is realized by the CPU 201 executing a program stored in the main memory 202. The client terminal 101 (KM) also holds the TEE public key 510, the user private key 511, the master private key 512, and the common private key 513.

[0049] The TEE public key 510 is a key generated by the data management server 100 and is shared between the client terminal 101 (KM) and the data management server 100. The TEE public key 510 is used to encrypt the master private key 512 that is sent to the data management server 100.

[0050] User private key 511 is a private key set for a user using client terminal 101 (KM). User private key 511 has the same properties as user private key 414.

[0051] The master secret key 512 is a secret key used in the encryption process for generating searchable encrypted data. The master secret key 512 has a different value from the user secret key 511. In this embodiment, the master secret key 512 can only be handled by the master secret key administrator and the TEE trust area processing unit 600 of the data management server 100. A detailed explanation of the master secret key is omitted as it is described in Patent Document 1.

[0052] The shared secret key 513 is identical to the shared secret key 415. The client terminal 101 (KM) in this embodiment holds one shared secret key 513.

[0053] The encryption unit 500 encrypts the data using basic encryption techniques such as AES. The searchable encryption unit 501 performs searchable encryption on the data. The decryption unit 502 decrypts the encrypted processing results, etc., received from the data management server 100. The key generation unit 503 generates various private keys based on a standard key generation algorithm. In this embodiment, the key generation unit 503 generates a user private key 511 and a master private key 512.

[0054] Figure 6 shows an example of the functional configuration of the data management server 100 in Example 1.

[0055] The data management server 100 has a functional configuration that includes a TEE trust area processing unit 600, an encryption DB unit 601, a key management information management unit 602, and a user authentication unit 603. Each functional unit is realized by the CPU 301 executing a program stored in the main memory 302.

[0056] The data management server 100 stores the DH public key 640, DH secret information 641, DH public information 642, TEE secret key 643, user secret key 644, master secret key 645, common secret key 646, and confidential search keyword 647 in the TEE trust area 310. In addition, the data management server 100 stores searchable encrypted user management information 648 and key management information 649 in an area other than the TEE trust area 310. Furthermore, the data management server 100 stores a database in an area other than the TEE trust area 310 that stores confidential data generated using the master secret key 645. This database is omitted because it is not directly related to the present invention.

[0057] The TEE Trust Area Processing Unit 600 operates on the TEE Trust Area 310, which is inaccessible to both server administrators with administrator privileges on the server OS and cyber attackers who have seized those privileges through a cyberattack. In other words, the TEE Trust Area Processing Unit 600 can perform plaintext processing of confidential information and various key information while ensuring confidentiality to server administrators and cyber attackers.

[0058] The TEE Trust Area Processing Unit 600 includes an encryption unit 610, a searchable encryption unit 611, a decryption unit 612, a TEE key generation unit 613, a DH public key generation unit 614, a DH secret information generation unit 615, a DH public information generation unit 616, a DH user secret key generation unit 617, and a confidential search keyword generation unit 618. The TEE Trust Area Processing Unit 600 also manages the DH public key 640, DH secret information 641, DH public information 642, the TEE secret key 643, the user secret key 644, the master secret key 645, the common secret key 646, and the confidential search keyword 647.

[0059] DH Secret Information 641 is a natural number used in the DH scheme. DH Secret Information 641 is managed to prevent it from being known to third parties. DH Public Information 642 is a combination of a base and a prime number used in the DH scheme. DH Public Information 642 is identical to DH Public Information 412. DH Public Key 640 is the public key used in the DH scheme and is generated from DH Public Information 642 and DH Secret Information 641. The TEE Trust Area Processing Unit 600 shares the DH Public Key 640 with the client terminal 101(U), which is the key exchange partner.

[0060] TEE private key 643 is a pair of TEE public keys 413 and 510 that can only be used within TEE trust area 310. User private key 644 is a private key that can only be used within TEE trust area 310. User private key 644 is a private key with the same properties as user private key 414. Master private key 645 is the same key as master private key 512. Common private key 646 is the same key as common private keys 415 and 513.

[0061] The confidential search keyword 647 is data obtained by encrypting the search keyword (plaintext data) according to a probabilistic encryption scheme using a common secret key 646 and a user secret key 644. A detailed explanation of the confidential search keyword is omitted as it is described in Patent Document 1.

[0062] The encryption unit 610 encrypts the data using basic encryption techniques such as AES. The searchable encryption unit 611 performs searchable encryption on the data. The decryption unit 612 decrypts the encrypted processing results, etc., received from the client terminal. The TEE key generation unit 613 generates a key pair consisting of the TEE private key 643 and the TEE public keys 413 and 510.

[0063] The DH public key generation unit 614 generates a DH public key 640 based on the DH scheme. The DH secret information generation unit 615 generates DH secret information 641. Different DH secret information 641 is generated for each client terminal 101. The DH user secret key generation unit 617 generates a user secret key 414 based on the DH scheme.

[0064] The confidential search keyword generation unit 618 uses the user's secret key 644 to encrypt the user ID and password in a searchable manner and generates a confidential search keyword that can be used for confidential searches.

[0065] The encrypted database unit 601 includes a data registration unit 620 and a confidential search keyword determination unit 621. The encrypted database unit 601 also manages searchable encrypted user management information 648.

[0066] Searchable encrypted user management information 648 stores records consisting of a searchable encrypted user ID and information that can verify the user's identity. Each record corresponds to one user.

[0067] The data registration unit 620 registers data in the searchable encrypted user management information 648. The confidential search keyword determination unit 621 searches the searchable encrypted user management information 648 for searchable encrypted data that matches the confidential search keyword.

[0068] The key management information management unit 602 includes a data registration unit 630 and manages key management information 649.

[0069] The key management information 649 stores information about user private keys managed by the client terminal 101 and the TEE trust area processing unit 600, respectively. Specifically, the key management information 649 stores records consisting of a user ID, differential key mask, search key, and key version. Each record corresponds to one user.

[0070] The user ID is identification information used to uniquely identify a user. The differential key mask is generated from the user's private key and the master private key 645. The search key is a key included in the user's private key. The key version is the version of the user's private key. The key version is used as key verification information to determine whether or not the user's private key is valid. Detailed explanations of the differential key mask and key version are omitted here, as they are described in Patent Document 1.

[0071] The data registration unit 630 registers data in the key management information 649.

[0072] The user authentication unit 603 performs user authentication processing. For example, the user authentication unit 603 performs authentication processing based on a user ID and password, or authentication processing using a biometric authentication method. In this embodiment, multi-factor authentication is preferred from a security standpoint. However, the present invention is not limited to authentication processing.

[0073] The following describes the processes performed by the computer system in Example 1.

[0074] In this embodiment, information that only general users would know, such as secret questions, is registered in advance. Furthermore, in order to issue user private keys only to legitimate users, when issuing a user private key to a general user, the user administrator verifies the general user's application details.

[0075] The computer system of Example 1 enables the distribution of individual keys to many general users while ensuring security. This invention is intended for use in business operations where general users are managed by user administrators and a high level of security is required. For example, it can be adapted to systems for sharing encrypted files within an organization. General users are assumed to be employees, and user administrators are assumed to be from the human resources / general affairs department.

[0076] Figure 7 shows a sequence of steps for registering the master secret key in the computer system of Example 1. Here, we will explain the case where the client terminal 101 (KM) performs the processing as an example.

[0077] The client terminal 101 (KM) sends a user authentication request to the user authentication unit 603 of the data management server 100, which includes the login ID distributed in advance by the server administrator and the password set by the master secret key administrator (step S1001).

[0078] The user authentication unit 603 performs user authentication using the login ID and password. If user authentication is successful, the user authentication unit 603 sends a TEE public key sharing request to the client terminal 101 (KM) to the TEE trust area processing unit 600 (step S1002).

[0079] When the TEE Trust Area Processing Unit 600 receives a TEE public key sharing request, the TEE Key Generation Unit 613 generates a TEE public key 510 and a TEE private key 643, which are used to encrypt the master private key 512 (step S1003).

[0080] The TEE trust area processing unit 600 sends the TEE public key 510 to the client terminal 101 (KM) (step S1004).

[0081] The key generation unit 503 of the client terminal 101 (KM) generates a master secret key 512 based on a standard key generation algorithm (step S1005). A detailed explanation of the master secret key generation process is omitted as it is described in Patent Document 1.

[0082] The encryption unit 500 of the client terminal 101 (KM) encrypts the master private key 512 using the TEE public key 510 and generates an encrypted master private key (step S1006).

[0083] The client terminal 101 (KM) sends the encryption master secret key to the TEE trust area processing unit 600 of the data management server 100 (step S1007).

[0084] The decryption unit 612 of the TEE trust area processing unit 600 decrypts the received encryption master secret key using the TEE secret key 643 and stores it in the TEE trust area 310 (step S1008).

[0085] Figure 8 shows a sequence of examples of the procedure for issuing a user private key by the TEE trust area processing unit 600 in the computer system of Example 1. Figure 9 shows a sequence of examples of the procedure for issuing a user private key by the client terminal 101 (KM) in the computer system of Example 1.

[0086] The DH user private key generation unit 617 of the TEE trust area processing unit 600 generates a user private key 644 and a common private key 646 based on a standard key generation algorithm (step S1101). The process for generating the user private key and the common private key is described in Patent Document 1, so a detailed explanation is omitted.

[0087] The TEE trust area processing unit 600 generates key management data (step S1102). Specifically, the TEE trust area processing unit 600 performs a key version generation process and also performs a differential key mask generation process using the user private key 644 and the master private key 645 to generate key management data including the user ID, key version, differential key mask, and search key. Detailed explanations of the key version generation process and differential mask generation process are omitted as they are described in Patent Document 1.

[0088] The TEE trust area processing unit 600 sends a user addition request, including key management data, to the key management information management unit 602 (step S1103).

[0089] When the key management information management unit 602 receives a user addition request, it updates the key management information 649 (step S1104). Specifically, the key management information management unit 602 adds a record to the key management information 649 and sets the user ID, differential key mask, search key, and key version included in the key management data in the added record.

[0090] The key management information management unit 602 transmits the processing result, which includes a value indicating the success or failure of the update process for the key management information 649, to the TEE trust area processing unit 600 (step S1105).

[0091] TEE Trust Area Processing Unit 600The searchable encryption unit 611 generates a searchable encrypted common secret key by performing searchable encryption on the common secret key (step S1106) and transmits it to the client terminal 101 (KM) (step S1107).

[0092] Client terminal 101 (KM) has completed the user authentication process and received the searchable encrypted symmetric secret key. hand If available, issue a user private key 511 using the following procedure.

[0093] The key generation unit 503 of the client terminal 101 (KM) generates a user secret key 511 based on a standard key generation algorithm (step S1201).

[0094] The decryption unit 502 of the client terminal 101 (KM) decrypts the searchable encrypted common secret key using the generated user secret key 511 (step S1202).

[0095] The client terminal 101 (KM) generates key management data including the user ID, key version, differential key mask, and search key (step S1203).

[0096] The client terminal 101 (KM) sends a user addition request, including key management data, to the key management information management unit 602 of the data management server 100 (step S1204).

[0097] When the key management information management unit 602 receives a user addition request, it updates the key management information 649 (step S1205). The process in step S1205 is the same as the process in step S1104.

[0098] The key management information management unit 602 sends a processing result, including a value indicating the success or failure of the key management information 649 update process, to the client terminal 101 (KM) (step S1206).

[0099] The client terminal 101 (KM) displays the processing result to the master secret key administrator via the display device 206 (step S1207).

[0100] As explained in Figures 7 to 9, in this embodiment, the TEE trust area processing unit 600 generates a TEE public key 510 and a TEE private key 643 within the TEE trust area 310, and stores the master private key 645 in the TEE trust area 310, which is kept secret from the encryption DB unit 601 and the like.

[0101] Figures 10, 11, 12A, and 12B are sequence diagrams showing an example of the procedure for issuing a user secret key for client terminal 101(U) in the computer system of Embodiment 1.

[0102] In the following explanation, it is assumed that the processes shown in Figures 7 to 9 have already been executed. Specifically, it is assumed that client terminal 101 (KM) manages the master private key 512 and user private key 511, the TEE trust area processing unit 600 manages the master private key 645, and the key management information management unit 602 manages the key management data of the master private key administrator. It is also assumed that client terminal 101 (UM) manages the user private key. Note that the user administrator's user private key can be issued using the same procedure as the processing procedure described below.

[0103] In the computer system of Example 1, first, a general user is registered as shown in Figure 10, then a process to verify that the general user is not impersonating another user is executed as shown in Figure 11, and if the user is legitimate, the process of issuing a user secret key 414 is executed as shown in Figure 12.

[0104] The client terminal 101(U) sends a user addition request to the user authentication unit 603 of the data management server 100, which includes user authentication data including a user ID and password, and user management data which is information that can verify the user's identity (step S2001). Communication between the client terminal 101(U) and the data management server 100 is assumed to be encrypted using general communication encryption such as SSL communication. However, the present invention is not limited to encryption of the communication path or authentication processing.

[0105] In this embodiment, it is assumed that the user management data includes name, email address, security question, etc., in order to confirm whether a general user operating the client terminal 101(U) to which the user administrator has sent a user addition request is eligible for system registration.

[0106] The user authentication unit 603 adds a user to the client terminal 101 (UM). certification Send the request (step S2002).

[0107] After the authentication process is completed between the user authentication unit 603 and the client terminal 101 (UM), the user administrator checks whether the general user is eligible for system registration based on the user management data received from the user authentication unit 603. If the general user is eligible for system registration, the client terminal 101 (UM) sends an approval including the user ID to the user authentication unit 603 (step S2003).

[0108] In this case, when the user administrator verifies the user, client terminal 101 (UM) will not display the password or other information set by the general user, but will only display the information necessary for verifying the user's identity.

[0109] The user authentication unit 603 registers user authentication data according to a general user authentication mechanism (step S2004). Thereafter, when a general user logs in using their user ID and password, the user authentication unit 603 performs user authentication. After the user authentication data registration is complete, the user authentication unit 603 sends a processing result to the client terminal 101 (UM) indicating that user registration is complete (step S2005).

[0110] Furthermore, user authentication technology is not limited to methods using IDs and passwords; multi-factor authentication using biometrics or other methods may also be used.

[0111] When the client terminal 101 (UM) receives the processing result, the searchable encryption unit 401 generates searchable encrypted user management data by performing searchable encryption on the user management data using the user secret key issued to the user administrator (step S2006).

[0112] The client terminal 101 (UM) sends a user addition request containing searchable encrypted user management data to the encrypted DB unit 601 of the data management server 100 (step S2007).

[0113] The encryption DB unit 601 updates the searchable encrypted user management information 648 (step S2008). Specifically, the encryption DB unit 601 adds a record to the searchable encrypted user management information 648 and sets the added record to the value included in the searchable encrypted user management data.

[0114] The encrypted DB unit 601 sends a processing result to the client terminal 101(U) that includes a value indicating the success or failure of the update process for the searchable encrypted user management information 648 (step S2009).

[0115] After the authentication process is completed between the user authentication unit 603 and the client terminal 101(U), the client terminal 101(U) sends a user secret key generation request to the user authentication unit 603 (step S2101).

[0116] The user authentication unit 603 sends a TEE public key sharing request to the general user to the TEE trust area processing unit 600 (step S2102).

[0117] When the TEE Trust Area Processing Unit 600 receives a TEE public key sharing request, it sends the TEE public key 413 generated by the process described in Figure 7 to the client terminal 101(U). Step S2103).

[0118] When the client terminal 101(U) receives the TEE public key 413, it accepts user management data such as name and security question input from a general user. The encryption unit 400 generates encrypted user management data by encrypting the user management data using the TEE public key 413 (step S2104).

[0119] The client terminal 101(U) sends a search request containing encrypted user management data to the TEE trusted area processing unit 600 (step S2105).

[0120] The decryption unit 612 of the TEE trust area processing unit 600 decrypts the encrypted user management data included in the search request using the TEE secret key 643 (step S2106).

[0121] The TEE trust area processing unit 600 generates a confidential search keyword (confidential search user management data) using the user secret key 644 generated in the process described in Figure 7 (step S2107).

[0122] The TEE Trust Area Processing Unit 600 sends a search request containing the confidential search keyword to the Encryption DB Unit 601 (step S2108).

[0123] When the encrypted DB unit 601 receives a search request, it performs a matching process using the confidential search keyword (step S2109).

[0124] Since the matching process using confidential search keywords is described in Patent Document 1, a detailed explanation will be omitted.

[0125] If the encrypted DB unit 601 finds a record in the searchable encrypted user management information 648 that matches the confidential search keyword, it sends a user secret key sharing request to the TEE trust area processing unit 600 (step S2110).

[0126] In systems that issue user private keys using only email addresses for authentication, there is a risk that malicious users could obtain these private keys, leading to data breaches.

[0127] In the computer system of Example 1, as explained in Figures 10 and 11, the data management server 100 manages user management data of general users approved by the user administrator in a searchable encrypted state. When it receives a user secret key generation request from a general user, it performs a verification process using the input information obtained from the general user to confirm whether the general user who made the request is a legitimate user.

[0128] In the computer system of this embodiment, if an attacker impersonating a regular user sends a request to generate a user private key, it is necessary to input information that only a regular user registered by the user administrator would know, thus preventing the unauthorized acquisition of a user private key.

[0129] Searchable encrypted user management information is managed using a probabilistic encryption method in a random number state. This is due to the following issues:

[0130] For example, hashing, a common security technique, presents a challenge due to its deterministic nature: the hash value generated is always the same when a given value is input. A representative attack technique against hash values ​​is the "rainbow table." This attack method generates a correspondence table between plaintext and hash values, and by searching for the hash value and finding the corresponding plaintext, it illegally obtains information that has been concealed by hashing.

[0131] To counter this attack, there are techniques such as "salting," which involves adding a string to the data to be hashed, and "stretching," which involves repeatedly applying hashing. However, these only increase the time required to analyze the hash value; they do not inherently prevent analysis. When storing user IDs and passwords on cloud systems, the use of probabilistic encryption is desirable.

[0132] Next, the user's private key is shared between the client terminal 101(U) and the TEE trust area processing unit 600 using the Diffie-Hellman key exchange method.

[0133] When the TEE Trust Area Processing Unit 600 receives a user private key sharing request, it generates a server certificate containing DH public information 642 and DH public key 640 (step S2201). Specifically, the following processes are performed.

[0134] The DH public information generation unit 616 generates the base (x) and prime number (p) used in the DH scheme. The security of the DH scheme is based on the fact that the larger the value of p, the more difficult it becomes to obtain the secret key.

[0135] The DH secret information generation unit 615 generates the numerical value b as DH secret information 641. The numerical value b is a random number, and a different value is used for each client terminal 101. DH secret information 641 is managed as secret information within the TEE trusted area 310. This ensures security.

[0136] The DH public key generation unit 614 calculates the DH public key 640 by substituting the DH secret information 641 and the DH public information 642 into equation (1).

[0137]

number

[0138] The TEE trust area processing unit 600 generates a server certificate that includes DH public information 642 and DH public key 640.

[0139] The above is a description of the process in step S2201.

[0140] The TEE Trust Area Processing Unit 600 sends the server certificate to the client terminal 101(U) (step S2202).

[0141] When client terminal 101(U) receives a server certificate, it verifies whether the digital signature is correct, whether the reception time is within the validity period, etc. (step S2203).

[0142] Note that steps S2201 to S 2203 In this process, the TEE public key 413 and TEE private key 643 generated in the process described in Figure 7 may be used. Specifically, the TEE trust area processing unit 600 encrypts the server certificate with the TEE private key 643. The client terminal 101(U) decrypts the encrypted server certificate using the TEE public key 413.

[0143] The TEE private key 643 is generated by the TEE trust area processing unit 600 and managed within the TEE trust area 310. Therefore, by encrypting the DH public information 642 etc. with the TEE private key 643 and decrypting it with the TEE public key 413, it is possible to confirm whether or not the DH public information 642 was transmitted from the TEE trust area processing unit 600.

[0144] In this embodiment, the TEE trust area processing unit 600 generates DH public information 642 and sends it to the client terminal 101(U), but other forms of sharing DH public information 642 are also possible. For example, the client terminal 101(U) generates DH public information 642 and shares it with the data management server 100. In the method of this embodiment, the processing load on the client terminal 101(U) is reduced by having the data management server 100 perform the processing.

[0145] If the verification is completed successfully, the client terminal 101(U) generates the user secret key 414 (step S2204). Specifically, the following processes are executed.

[0146] The DH secret information generation unit 404 of client terminal 101(U) generates a numerical value a as DH secret information 411. The numerical value a is a random number and is different for each client terminal 101. DH secret information 411 is managed as secret information within client terminal 101(U).

[0147] The DH user private key generation unit 405 generates a user private key 414 by substituting the DH secret information 411, the DH public key 640, and the DH public information 642 into equation (2).

[0148]

number

[0149] The above is a description of the process in step S2204.

[0150] The client terminal 101(U) generates a DH public key 410 based on a standard DH key exchange scheme (step S2205). Specifically, the DH public key generation unit 403 calculates the DH public key 410 by substituting the DH secret information 411 and the DH public information 412 into equation (3).

[0151]

number

[0152] The above is a description of the process in step S2205.

[0153] The client terminal 101(U) sends the DH public key 410 to the TEE trust area processing unit 600 (step S2206).

[0154] The DH user private key generation unit 617 of the TEE trust area processing unit 600 generates a user private key 414 when it receives the DH public key 410 (step S2207). Specifically, the DH user private key generation unit 617 generates the user private key 414 by substituting the DH public key 410, the DH secret information 641, and the DH public information 642 into equation (4).

[0155]

number

[0156] Next, the TEE trust area processing unit 600 generates key management data (step S2208). Specifically, the TEE trust area processing unit 600 performs a key version generation process and also performs a differential key mask generation process using the user private key 414 and the master private key 645 to generate key management data including the user ID, key version, differential key mask, and search key.

[0157] The TEE trust area processing unit 600 sends a user addition request, including key management data, to the key management information management unit 602 (step S2209).

[0158] When the key management information management unit 602 receives a user addition request, it updates the key management information 649 (step S2210). Specifically, the key management information management unit 602 adds a record to the key management information 649 and sets the user ID, differential key mask, search key, and key version included in the key management data in the added record.

[0159] The key management information management unit 602 transmits the processing result, which includes a value indicating the success or failure of the key management information 649 update process, to the TEE trust area processing unit 600 (step S2211).

[0160] If the TEE trust area processing unit 600 receives a processing result that includes a value indicating the success of the TEE key management information update process, it deletes the user private key 414 (step S2212).

[0161] Due to the implementation of the TEE function, the amount of data that can be handled in the TEE trust area 310 is small. When sharing user private keys 414 with a large number of client terminals 101(U), it is difficult to store all user private keys 414 in the TEE trust area 310.

[0162] Therefore, the data management server 100 manages only the key management data, which is information about each user's private key 414, in a storage area other than the TEE trust area 310, and deletes the user's private key 414 from the TEE trust area 310. This enables the sharing of user private keys 414 while shortening the response time of processing results by efficiently utilizing the TEE trust area 310.

[0163] The searchable encryption unit 611 of the TEE trust area processing unit 600 generates a searchable encrypted common secret key by performing searchable encryption on the common secret key 646 using its own user secret key 644 (step S2213).

[0164] The TEE Trust Area Processing Unit 600 sends a searchable encrypted symmetric secret key to the client terminal 101(U) (step S2214).

[0165] The client terminal 101(U) decrypts the searchable encrypted symmetric secret key using the user secret key 414 (step S2215).

[0166] The client terminal 101(U) sends the processing result, which includes a value indicating the success or failure of the series of processes, to the TEE trust area processing unit 600 (step S2216).

[0167] As explained above, advanced processing can be performed securely by decrypting encrypted data and generating user private keys within the TEE trusted area 310. When sending or receiving information that needs to be kept confidential between the TEE trusted area processing unit 600 and an external source, such information is encrypted or made confidential.

[0168] The computer system in Example 1 never stores private keys in areas accessible to privileged users of the data management server 100, and it can share user private keys while concealing private keys and user information in the communication path. In other words, the computer system in Example 1 can achieve secure and convenient distribution and updating of private keys on a system that provides cloud services. This allows private keys to be distributed to many users without the need for email or face-to-face exchanges.

[0169] Figures 13A and 13B show an example of login control for a general user in the computer system of Example 1.

[0170] Figure 13A shows the initial login control. It is assumed that the processes described in Figures 7 and 8 have already been executed, and that the user administrator's user private key has already been issued. That is, the master private key administrator manages the master private key 512 and the user private key 511, the user administrator manages the user private key, the TEE trust area processing unit 600 manages the master private key 645, and the key management data for each key is registered in the key management information 649.

[0171] A regular user operates client terminal 101(U) to send a user addition request, including user ID and password, to data management server 100.

[0172] If the user administrator confirms that a general user is eligible for system registration using the user management data, that is, if they approve the application, they register the general user's user authentication data in the data management server 100 according to the processing procedure described in Figure 10.

[0173] Next, the general user operates the client terminal 101(U) to perform user authentication with the data management server 100 using their login ID and password. After user authentication is complete, the general user operates the client terminal 101(U) to send a user secret key generation request to the data management server 100. Between the client terminal 101(U) and the data management server 100, the process shown in Figure 11 is executed to confirm that the general user who sent the user secret key generation request is a legitimate general user.

[0174] After confirming that the user is a legitimate regular user, the data management server 100 issues the regular user's user secret key 414.

[0175] A regular user operates the client terminal 101(U) to register and search for confidential data on the data management server 100 using the acquired user private key 414. The regular user is responsible for managing the user private key 414 to prevent its leakage.

[0176] Figure 13B shows the login control for the second and subsequent login attempts.

[0177] General users operate client terminal 101(U) and perform user authentication using the login ID and password issued during their initial login.

[0178] A regular user operates the client terminal 101(U) to register and retrieve confidential data using the user's private key 414 on the data management server 100. [Examples]

[0179] Example 2 differs from Example 1 in that it is a computer system without user administrator intervention. Below, we will describe Example 2, focusing on the differences from Example 1.

[0180] The computer system of Example 2 does not include a client terminal 101 (UM). The hardware and software configuration of the client terminal 101 in Example 2 is the same as that of Example 1. The hardware and software configuration of the data management server 100 in Example 2 is the same as that of Example 1.

[0181] Figures 14A and 14B show an example of login control for a general user in the computer system of Example 2.

[0182] Figure 14A shows the initial login control. In Example 2, a regular user obtains a user secret key after user registration without being authenticated by a user administrator. Figure 14B shows the login control for subsequent logins. The login control for subsequent logins is the same as in Example 1.

[0183] In Example 2, we assume a system where the client terminal 101(U) of a general user that issues user private keys is strictly managed and can only access sites where key issuance is limited by IP restrictions. We assume that the sites where key issuance is possible are restricted by IP address. The system in Example 2 can be used in systems where the general user and client terminal 101(U) that issue keys are trusted, but the data management server 100 and communication path are not trusted.

[0184] The procedure for registering the master private key is the same as in Example 1 (Figures 7 to 9).

[0185] Figure 15 is a sequence diagram showing an example of the procedure for issuing a user private key for client terminal 101(U) in the computer system of Embodiment 2.

[0186] The client terminal 101(U) sends a user addition request, including user authentication data such as user ID and password, to the user authentication unit 603 of the data management server 100 (step S3001).

[0187] The user authentication unit 603 registers user authentication data according to a general user authentication mechanism (step S3002). Subsequently, when a regular user logs in using their user ID and password, the user authentication unit 603 performs user authentication. After the user authentication data registration is complete, the user authentication unit 603 sends a processing result to the client terminal 101(U) indicating that user registration is complete (step S3003).

[0188] After the authentication process is completed between the user authentication unit 603 and the client terminal 101(U), the client terminal 101(U) sends a user secret key generation request to the TEE trust area processing unit 600 (step S3004).

[0189] Subsequently, the processes from step S2201 onward are executed.

[0190] According to Example 2, in addition to the effects of Example 1, the effort required for user administrators to approve general users can be reduced. [Examples]

[0191] Example 3 differs from Example 1 in that it issues a user secret key 414 that is valid only once, similar to a one-time password. Below, we will explain Example 3, focusing on the differences from Example 1.

[0192] The configuration of the computer system in Example 3 is the same as that of Example 1. The hardware and software configuration of the client terminal 101 in Example 3 is the same as that of Example 1. The hardware and software configuration of the data management server 100 in Example 3 is the same as that of Example 1.

[0193] Figures 16A and 16B show an example of login control for a general user in the computer system of Embodiment 3.

[0194] Figure 16A shows the initial login control, and Figure 16B shows the control for subsequent logins. The initial login control is the same as in Example 1. That is, the processes from Figure 7 to Figure 12B are executed. In Example 3, upon login by a general user, the client terminal 101(U) sends a user secret key generation request to the data management server 100 and obtains a new user secret key 414.

[0195] The system in Example 3 could be used in systems where a large number of general users access a limited range of confidential data, such as portal sites used by specially retired employees and their dependents that are only accessible via the internet, where key distribution and management have previously been problematic.

[0196] Figures 17A and 17B are sequence diagrams showing an example of the procedure for issuing a user private key for client terminal 101(U) during the second and subsequent logins in the computer system of Embodiment 3.

[0197] When the TEE trust area processing unit 600 receives a user private key sharing request, it generates a server certificate containing DH public information 642 and DH public key 640 (step S4001). The processing in step S4001 is the same as the processing in step S2201.

[0198] The TEE Trust Area Processing Unit 600 sends the server certificate to the client terminal 101(U) (step S4002). The process in step S4002 is the same as the process in step S2202.

[0199] When client terminal 101(U) receives a server certificate, it verifies whether the digital signature is correct, whether the reception time is within the validity period, etc. (step S4003). The process in step S4003 is the same as the process in step S2203.

[0200] If the verification is completed successfully, the DH user private key generation unit 405 of the client terminal 101(U) generates a user private key 414 (step S4004). The process in step S4004 is the same as the process in step S2204.

[0201] The client terminal 101(U) generates a DH public key 410 based on the DH method (step S4005). The process in step S4005 is the same as the process in step S2205.

[0202] The client terminal 101(U) sends the DH public key 410 to the TEE trust area processing unit 600 (step S4006). The process in step S4006 is the same as the process in step S2206.

[0203] The DH user private key generation unit 617 of the TEE trust area processing unit 600 generates a new user private key 414 when it receives the DH public key 410 (step S4007). The process in step S4007 is the same as the process in step S2207.

[0204] Next, the TEE trust area processing unit 600 generates key management data (step S4008). The process in step S4008 is the same as the process in step S2208.

[0205] The TEE trust area processing unit 600 sends a request to the key management information management unit 602 to update the user private key, which includes key management data (step S4009).

[0206] When the key management information management unit 602 receives a request to update a user's private key, it updates the key management information 649 (step S4010). Specifically, the key management information management unit 602 refers to the key management information 649 and searches for a record that matches the user ID contained in the received key management data. The key management information management unit 602 overwrites the found record with the differential key mask, search key, and key version contained in the key management data.

[0207] The key management information management unit 602 transmits the processing result, which includes a value indicating the success or failure of the update process for the key management information 649, to the TEE trust area processing unit 600 (step S4011).

[0208] If the TEE trust area processing unit 600 receives a processing result that includes a value indicating the success of the TEE key management information update process, it deletes the user private key 414 (step S4012). The process in step S4012 is the same as the process in step S2212.

[0209] The TEE trust area processing unit 600 sends a processing result, including a value indicating the success or failure of the key management information update process, to the client terminal 101(U) (step S4013).

[0210] Furthermore, the process shown in Figure 11 may be executed during subsequent logins. Also, Example 3 may be applied to Example 2.

[0211] When updating the user private key 414 used for encryption and decryption, only the user private key 414 used by a specific user is updated. That is, the common private keys 415, 513, 646, and the user private keys 414 of other users are not updated. Furthermore, since the data management server 100 stores confidential data generated using the master private key 645, there is no need to update the confidential data stored in the data management server 100 when a user private key 414 is updated. Therefore, it is possible to generate a new user private key 414 at login while keeping processing costs down.

[0212] In this embodiment, the use of DHE and ECDHE is assumed as the types of DH key exchange. DHE and ECDHE have the characteristics of Perfect Forward Secrecy (PFS). Specifically, since a different unique public key and private key are generated for each session, even if a previously used user private key is compromised, the confidential data cannot be decrypted. Therefore, in the system of Embodiment 3, which generates a user private key that is valid only once (valid only for one login), the use of DHE and ECDHE is desirable.

[0213] As described above, by issuing a one-time-use user private key 414, it is possible to enhance security without burdening the user, for example, by reducing the burden of managing encryption keys that previously required strict management, and by preventing key compromise.

[0214] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. Furthermore, for example, the embodiments described above are detailed explanations of the configuration in order to clearly illustrate the present invention, and are not necessarily limited to those having all the configurations described. In addition, some of the configurations in each embodiment can be added to, deleted from, or replaced with other configurations.

[0215] Furthermore, each of the above-mentioned configurations, functions, processing units, processing means, etc., may be implemented in hardware, in whole or in part, for example, by designing them as integrated circuits. The present invention can also be implemented by software program code that realizes the functions of the embodiment. In this case, a storage medium on which the program code is recorded is provided to a computer, and the processor of that computer reads the program code stored in the storage medium. In this case, the program code read from the storage medium itself realizes the functions of the embodiment described above, and the program code itself and the storage medium on which it is stored constitute the present invention. Examples of storage media used to supply such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, SSDs (Solid State Drives), optical disks, magneto-optical disks, CD-Rs, magnetic tapes, non-volatile memory cards, ROMs, and the like.

[0216] Furthermore, the program code that implements the functions described in this embodiment can be implemented in a wide range of programming or scripting languages, such as assembler, C / C++, Perl, Shell, PHP, Python, and Java (registered trademark).

[0217] Furthermore, the program code for the software that implements the functions of the embodiment may be distributed via a network and stored in a storage means such as a computer's hard disk or memory, or in a storage medium such as a CD-RW or CD-R, and the computer's processor may read and execute the program code stored in the storage means or storage medium.

[0218] In the above-described embodiment, the control lines and information lines shown are those deemed necessary for explanation and do not necessarily represent all control lines and information lines in the actual product. All components may be interconnected. [Explanation of Symbols]

[0219] 100 Data Management Servers 101 Client terminals 103 Network 201, 301 CPU 202, 302 Main storage 203, 303 Secondary storage device 204, 304 network interfaces 205, 305 Input devices 206, 306 Display device 310 TEE Trust Area 400 Encryption section 401 Searchable Encryption Section 402 Decoding Unit 403 DH Public Key Generation Unit 404 DH secret information generation section 405 DH User Private Key Generation Unit 410 DH public key 411 DH Secret Information 412 DH Public Information 413 TEE public key 414 User private key 415 Common secret key 500 Encryption section 501 Searchable Encryption Section 502 Decoding Unit 503 Key generation section 510 TEE public key 511 User private key 512 Master private key 513 Common secret key 600 TEE Trust Area Processing Unit 601 Encrypted DB section 602 Key management information management department 603 User Authentication Section 610 Encryption section 611 Searchable encryption section 612 Decoding section 613 TEE Key Generation Unit 614 DH Public Key Generation Unit 615 DH secret information generation section 616 DH Public Information Generation Department 617 DH User Private Key Generation Unit 618 Confidential Search Keyword Generation Unit 620 Data Registration Section 621 Confidential Search Keyword Determination Unit 630 Data Registration Section 640 DH public keys 641 DH Secret Information 642 DH Public Information 643 TEE Secret Key 644 User private key 645 Master private key 646 Common secret key 647 Confidential Search Keywords 648 Searchable encrypted user management information 649 Key management information

Claims

1. A computer system comprising a data management server and client terminals, The aforementioned data management server has a computing unit and a storage device, Manage a database that stores confidential data encrypted using a probabilistic encryption method with a master secret key. The arithmetic unit has a function to generate a secure and logically isolated trusted area in the memory device. The trust area stores the master private key, as well as the public information and first private information used in the Diffie-Hellman key exchange scheme. The client terminal holds the public information and the second secret information used in the Diffie-Hellman key exchange scheme. The aforementioned data management server is When the data management server receives a request from the client terminal to generate a user secret key used to access the confidential data managed by the data management server, it generates a first public key using the public information and the first secret information. The first public key is sent to the client terminal. The aforementioned client terminal is The user's private key is generated using the public information, the second secret information, and the first public key. A second public key is generated using the aforementioned public information and the aforementioned second secret information. The second public key is sent to the data management server. The aforementioned data management server is The second public key is stored in the trust area, In the aforementioned trust domain, the user's private key is generated using the public information, the first secret information, and the second public key. Within the aforementioned trust area, key management data for managing the user's private key is generated. The key management data is recorded as information used for a verification process to determine whether the user's private key is valid or not. Furthermore, the data management server is characterized in that, after the key management data has been recorded, it deletes the user's private key from the trust area.

2. The computer system according to Claim 1, A computer system characterized in that the user's private key is a key that is valid only once.

3. The computer system according to Claim 1, The aforementioned client terminal is The system accepts input of registered user management data from the user operating the client terminal to verify the user's legitimacy. The registered user management data is encrypted, and the encrypted registered user management data is registered on the data management server. The aforementioned data management server is When the aforementioned user private key generation request is received, the user management data input is accepted. A computer system characterized by determining whether a user who requested the generation of the user secret key is a legitimate user, based on the encrypted user verification data and the encrypted registered user management data.

4. A method for exchanging keys in a computer system including a data management server and client terminals, The aforementioned data management server has a computing unit and a storage device, Manage a database that stores confidential data encrypted using a probabilistic encryption method with a master secret key. The arithmetic unit has a function to generate a secure and logically isolated trusted area in the memory device. The trust area stores the master private key, as well as the public information and first private information used in the Diffie-Hellman key exchange scheme. The client terminal holds the public information and the second secret information used in the Diffie-Hellman key exchange scheme. The aforementioned key exchange method is: When the data management server receives a request from the client terminal to generate a user secret key used to access the confidential data managed by the data management server, the first step is to generate a first public key using the public information and the first secret information. The second step is that the data management server transmits the first public key to the client terminal, A third step in which the client terminal generates the user private key using the public information, the second secret information, and the first public key, The fourth step involves the client terminal generating a second public key using the public information and the second secret information, A fifth step in which the client terminal transmits the second public key to the data management server, A sixth step in which the data management server stores the second public key in the trust area, A seventh step in which the data management server generates the user private key in the trusted area using the public information, the first secret information, and the second public key, The eighth step is for the data management server to generate key management data for managing the user private key in the trusted area, A ninth step in which the data management server records the key management data as information to be used for a verification process to determine whether the user secret key is valid, Includes, The seventh step of the key exchange method is characterized in that the data management server deletes the user private key from the trust area after the key management data has been recorded.

5. A key exchange method according to Claim 4, A key exchange method characterized in that the user's private key is a key that is valid only once.

6. A key exchange method according to claim 4, The client terminal receives input of registered user management data from a user operating the client terminal to verify the user's legitimacy; The client terminal includes the step of encrypting the registered user management data and registering the encrypted registered user management data with the data management server, The first step described above is: The data management server accepts the input of user management data for verification, A key exchange method characterized by the data management server determining whether the user who requested the generation of the user secret key is a legitimate user, based on the encrypted verified user management data and the encrypted registered user management data.

Images