Key issuing device, information processing system, method and program

Abstract

The present invention provides a key issuance device capable of preventing decryption of ciphertext by a key issuance authority even when the key issuance authority has malicious intent in an identity-based proxy re-encryption scheme. A distributed master key generation unit (12) generates at least distributed master secret keys distributed among a plurality of key issuance devices (10). A distributed user secret key generation unit (14) uses the distributed master secret keys and user identification information to generate a distributed user secret key. A transmission unit (16) transmits the distributed user secret key to a user device of a user.

Description

Key issuing device, information processing system, method and computer-readable medium

[0001] The present disclosure relates to a key issuing device, an information processing system, a method, and a computer-readable medium.

[0002] Known encryption technologies include ID-Based Encryption (IBE) and Proxy Re-Encryption (PRE). In relation to these technologies, Non-Patent Document 1 discloses an Identity-Based Proxy Re-Encryption scheme (IB-PRE). Non-Patent Documents 2 and 3 disclose technologies related to ID-based encryption. Non-Patent Documents 4 and 5 disclose technologies related to the present disclosure.

[0003] Chunpeng Ge1, Jinyue Xia and Liming Fang、"Key-Private Identity-Based Proxy Re-Encryption"、Computers, Materials & Continua 63.2 (2020): 633-647.Martin Geisler and Nigel P. Smart、"Distributing the Key Distribution Centre in Sakai-Kasahara Based Systems"、IMA International Conference on Cryptography and Coding. Springer, Berlin, Heidelberg, 2009.Aniket Kate, and Ian Goldberg、"Distributed Private-Key Generators for Identity-Based Cryptography"、Cryptology ePrint Archive, 2009、URL:https: / / eprint.iacr.org / 2009 / 355.pdfRosario Gennaro, Michael O. Rabin, and Tal Rabin、"Simplified VSS and Fast-track Multiparty Computations with Applications to Threshold Cryptography"、Proceedings of the seventeenth annual ACM symposium on Principles of distributed computing. 1998.、URL:https: / / dl.acm.org / doi / 10.1145 / 277697.277716Yoshinori Aono, et al.、"Key-Private Proxy Re-encryption under LWE"、International Conference on Cryptology in India. Springer, Cham, 2013

[0004] In ID-based proxy re-encryption, a key issuing authority issues a master public key and a master private key. Here, in ID-based proxy re-encryption, a user's private key can be generated using the master private key and the user's ID. In addition, the user's ID is often publicly known. Therefore, anyone who obtains the master private key can easily generate the user's private key. Therefore, with the technology disclosed in Non-Patent Document 1, if the key issuing authority has malicious intent, there is a risk that all ciphertexts in the system will be decrypted using the master private key.

[0005] The purpose of the present disclosure has been made to solve such problems, and is to provide a key issuing device, system, method, and program that can prevent the key issuing authority from decrypting ciphertext even if the key issuing authority is malicious in ID-based proxy re-encryption technology.

[0006] A key issuing device according to the present disclosure includes: a distributed master key generation means for generating at least a distributed master private key distributed to a plurality of key issuing devices; a distributed user private key generation means for generating, using the distributed master private key and user identification information, a distributed user private key obtained by distributing a user private key of the user, the user private key being obtained by using the distributed user private keys obtained from a plurality of key issuing devices; and a transmission means for transmitting the distributed user private key to the user device of the user, wherein the distributed master key generation means generates a first random number to be kept secret, a share of the first random number in the distributed state, and The distributed master private key is generated based on the share of the second random number obtained by distributing the second random number to be kept secret, and the distributed user private key generation means obtains the share of the third random number obtained by distributing the third random number to be kept secret and which is an element of the user private key, and the share of the fourth random number obtained by distributing the fourth random number to be kept secret, and multiplies each of the share of the first random number, which is an element of the distributed master private key, the share of the second random number, and the share of the third random number, which are elements of the distributed master private key, by the share of the fourth random number, and generates the distributed user private key based on the product obtained as a result of the multiplication.

[0007] Further, an information processing system according to the present disclosure includes a plurality of key issuing devices, a plurality of user devices, and a re-encryption device, each of the plurality of key issuing devices including a distributed master key generation means for generating at least a distributed master private key distributed among the plurality of key issuing devices, and a distributed user private key generation means for generating, using the distributed master private key and user identification information, a distributed user private key in a distributed state of the user private key of the user, the user private key being obtained by using the distributed user private keys obtained from the plurality of key issuing devices. and a transmission means for transmitting the distributed user private key to the user device of the user, wherein the distributed master key generation means generates the distributed master private key based on a share of a first random number obtained by distributing a first random number to be kept secret and a share of a second random number obtained by distributing a second random number to be kept secret, and the distributed user private key generation means generates the distributed master private key based on a share of a third random number obtained by distributing a third random number to be kept secret and which is an element of the user private key, and a share of a fourth random number obtained by distributing a fourth random number to be kept secret. and multiplying each of the shares of the first random number, the share of the second random number, and the share of the third random number, which are elements of the distributed master private key, by the share of the fourth random number, and generating the distributed user private key based on the product obtained as a result of the multiplication; each of the plurality of user devices comprises user private key generation means that generates the user private key using the distributed user private keys obtained from the plurality of key issuing devices, re-encryption key generation means that generates a re-encryption key using the user private key, and decryption means that decrypts ciphertext to obtain plaintext; the re-encryption device re-encrypts the ciphertext that can be decrypted with the user private key for the first user device without decrypting it, using the re-encryption key that makes a ciphertext that can be decrypted by a first user device of the plurality of user devices decryptable by a second user device of the plurality of user devices; and the decryption means of the second user device decrypts the re-encrypted ciphertext using the user private key for the second user device.

[0008] Furthermore, a key issuing method according to the present disclosure includes generating at least a distributed master private key distributed among a plurality of key issuing devices based on a share of a first random number obtained by distributing a first random number to be kept secret and a share of a second random number obtained by distributing a second random number to be kept secret, and using the distributed master private key and user identification information to generate a distributed user private key obtained by distributing a user private key of the user, the user private key being obtained by using the distributed user private keys obtained from a plurality of key issuing devices; At this time, a share of the third random number in a state in which the third random number that is kept secret and becomes an element of the user private key is distributed, and a share of the fourth random number in a state in which the fourth random number that is kept secret is distributed, are obtained, and the share of the first random number that is an element of the distributed master private key, the share of the second random number that is an element of the distributed master private key, and the share of the third random number are each multiplied by the share of the fourth random number, and the distributed user private key is generated based on the product obtained as a result of the multiplication, and the distributed user private key is transmitted to the user device of the user.

[0009] Furthermore, an information processing method according to the present disclosure includes generating, by each of a plurality of key issuing devices, at least a distributed master private key distributed among a plurality of key issuing devices based on a share of a first random number obtained by distributing a first random number to be kept secret and a share of a second random number obtained by distributing a second random number to be kept secret, and using the distributed master private key and user identification information to generate a distributed user private key obtained by distributing a user private key of the user, the user private key being obtained by using the distributed user private keys obtained from a plurality of key issuing devices, and at the same time, obtaining a share of a third random number obtained by distributing a third random number that is kept secret and that is an element of the user private key, and a share of a fourth random number obtained by distributing a fourth random number to be kept secret, and generating a distributed user private key by using the distributed master private key and user identification information to generate a distributed user private key obtained by distributing a third random number that is kept secret and that is an element of the user private key, and a share of a fourth random number that is kept secret and that is an element of the distributed master private key. A share of the second random number and a share of the third random number are each multiplied by a share of the fourth random number, and the distributed user private key is generated based on the product obtained by the multiplication. The distributed user private key is transmitted to the user's user device. The user device generates the user private key using the distributed user private keys obtained from multiple key issuing devices, generates a re-encryption key using the user private key, and decrypts the ciphertext to obtain plaintext. A re-encryption device re-encrypts the ciphertext that can be decrypted with the user private key for the first user device without decrypting it using the re-encryption key that makes the ciphertext that can be decrypted by a first user device decryptable by a second user device. The second user device decrypts the re-encrypted ciphertext using the user private key for the second user device.

[0010] The program according to the present disclosure also includes a step of generating at least a distributed master private key in a state in which a confidential first random number is distributed, based on a share of a first random number in a state in which a confidential second random number is distributed, and a step of generating a distributed master private key in a state in which a confidential first random number is distributed, based on a share of a second random number in a state in which a confidential second random number is distributed, using the distributed master private key and user identification information to generate a distributed user private key in a state in which a user private key of the user is distributed, the user private key being obtained using the distributed user private keys obtained from the multiple key issuing devices, and at that time, generating a distributed user private key in a state in which a user private key of the user is distributed, based on the shared share of a first random number in a state in which a confidential first random number is distributed, and a share of a second random number in a state in which a confidential second random number is distributed, using the distributed master private key and user identification information, the user private key being obtained using the distributed user private keys obtained from the multiple key issuing devices, and The computer is caused to execute the steps of: acquiring a share of a third random number obtained by distributing a third random number that is an element of a user private key; and a share of a fourth random number obtained by distributing a fourth random number that is to be kept secret; multiplying each of the shares of the first random number that is an element of the distributed master private key, the shares of the second random number that are elements of the distributed master private key, and the shares of the third random number by the share of the fourth random number; generating the distributed user private key based on the product obtained as a result of the multiplication; and transmitting the distributed user private key to the user device of the user.

[0011] According to the present disclosure, it is possible to provide a key issuing device, system, method, and program that can prevent a key issuing authority from decrypting ciphertext in ID-based proxy re-encryption technology, even if the key issuing authority is malicious.

[0012] FIG. 1 is a diagram for explaining general public key encryption. FIG. 2 is a diagram for explaining ID-based encryption. FIG. 3 is a diagram for explaining general proxy re-encryption. FIG. 4 is a diagram for explaining ID-based proxy re-encryption. FIG. 5 is a diagram showing a configuration of an information processing system according to a first embodiment. FIG. 6 is a diagram showing a configuration of a key issuing device according to the first embodiment. FIG. 7 is a diagram showing a configuration of a user device according to the first embodiment. FIG. 8 is a diagram showing a configuration of a re-encryption device according to the first embodiment. FIG. 9 is a flowchart showing processing executed in the information processing system according to the first embodiment. FIG. 10 is a flowchart showing processing executed in the information processing system according to the first embodiment. FIG. 11 is a diagram showing a configuration of a key issuing device according to a second embodiment. FIG. 12 is a block diagram showing an outline of an example hardware configuration of a calculation processing device capable of realizing the device and system according to each embodiment.

[0013] (Outline of the Present Embodiment) Prior to describing the present embodiment, an outline of the present embodiment will be described. Note that the present embodiment will be described below, but the following embodiment does not limit the invention according to the claims. Also, not all combinations of features described in the embodiment are necessarily essential to the solution of the invention. Also, in the following description, indexes (such as English letters) used are not necessarily common throughout this specification.

[0014] 1 to 4 are diagrams illustrating ID-based proxy re-encryption. FIG. 1 is a diagram illustrating general public key cryptography. A ciphertext creator possesses the public keys of users A to C. The ciphertext creator creates ciphertext Ca using user A's public key, creates ciphertext Cb using user B's public key, and creates ciphertext Cc using user C's public key. User A possesses user A's private key. User A can decrypt ciphertext Ca using user A's private key. User B possesses user B's private key. User B can decrypt ciphertext Cb using user B's private key. User C possesses user C's private key. User C can decrypt ciphertext Cc using user C's private key.

[0015] FIG. 2 is a diagram illustrating ID-based encryption (IBE). In ID-based encryption, a key issuing authority generates a master public key and a master private key. Then, a key issuing authority acquires the private keys of users A to C by embedding each user's ID (actually, a hash value of the ID, etc.) in the master private key. The user's ID (Identification) may be, for example, the user's email address. The key issuing authority distributes user private keys of users A to C to users A to C, respectively. The key issuing authority also distributes a master public key to a ciphertext creator. The ciphertext creator can acquire the public keys of users A to C by embedding the user ID in the acquired master public key.

[0016] As in the case of FIG. 1 , the ciphertext creator creates ciphertext Ca using user A's public key, creates ciphertext Cb using user B's public key, and creates ciphertext Cc using user C's public key. User A then decrypts ciphertext Ca using user A's private key generated from the master private key by the key issuing authority. User B decrypts ciphertext Cb using user B's private key generated from the master private key. User C decrypts ciphertext Cc using user C's private key generated from the master private key by the key issuing authority. ID-based encryption offers the following advantages over the public key encryption of FIG. 1 : Any character string (e.g., an email address) can be embedded as a user ID in a user key (public key and private key) or in a ciphertext. Furthermore, ciphertexts can be created in advance for users who do not exist in the system (such as non-existent user D in the example of FIG. 2 ). Furthermore, a public key certificate, which was necessary in the case of FIG. 1 , is no longer necessary.

[0017] FIG. 3 is a diagram for explaining a general proxy re-encryption (PRE). Proxy re-encryption is a technology that allows changing the decryption destination while keeping information encrypted on a server such as a cloud environment. Specifically, a re-encryption key (re-encryption key) required for re-encryption can be generated using the public key of the user of the destination (converted decryption destination) and the private key of the source user. In the example of FIG. 3, user A (source) generates a re-encryption key K using the private key of user A and the public keys of users B to D (destinations). Ａ→Ｂ , K Ａ→Ｃ , K Ａ→Ｄ Generate the conversion key K Ａ→Ｂ , K Ａ→Ｃ , K Ａ→Ｄ is a key (re-encryption key) for converting ciphertext Ca, which can be decrypted with the private key of user A, into ciphertexts Cb, Cc, and Cd, which can be decrypted with the private keys of users B to D, respectively.

[0018] User A transmits each reconversion key to the agent. The agent corresponds to, for example, a proxy server or a gateway server. The agent re-encrypts the ciphertext when, for example, the network environment to which the ciphertext is to be made public changes. The agent re-encrypts the ciphertext Ca, which can be decrypted with user A's private key, using each reconversion key without decrypting the ciphertext Ca. As a result, the ciphertext Ca is reconverted to the reconversion key K. Ａ→Ｂ The ciphertext Ca is converted into ciphertext Cb that can be decrypted with the private key of user B using the conversion key K. Ａ→Ｃ , K Ａ→Ｄ into ciphertexts Cc and Cd that can be decrypted with the private keys of users C and D, respectively. Users B to D can decrypt the ciphertexts Cb, Cc, and Cd with their own private keys. If user A does not want to disclose the ciphertext Ca to user D, user A can use the conversion key K Ａ→Ｄ As a result, the ciphertext Ca remains confidential to the user D.

[0019] FIG. 4 is a diagram for explaining ID-based proxy re-encryption (IB-PRE). ID-based proxy re-encryption performs proxy re-encryption on an ID-based basis. As in the case of FIG. 2, the key issuing authority generates a master public key and a master private key. Then, the key issuing authority acquires the private keys of users A to D by embedding the ID of each user in the master private key. In the example of FIG. 4, the key issuing authority distributes the master public key to user A. User A generates a re-encryption key (re-encryption key) using the master public key and the original private key. That is, user A acquires the public keys of users B to D using the IDs of users B to D. Then, as in the case of FIG. 3, user A acquires a re-encryption key K using the private key of user A and the public keys of users B to D. Ａ→Ｂ , K Ａ→Ｃ , K Ａ→Ｄ Generate.

[0020] As in Figure 3, user A sends each reconstitution key to the agent. The agent re-encrypts ciphertext Ca, which can be decrypted with user A's private key, using each reconstitution key without decrypting the ciphertext Ca. As a result, ciphertext Ca is converted into ciphertexts Cb, Cc, and Cd. As in Figure 3, users B to D can each decrypt ciphertexts Cb, Cc, and Cd with their own private keys.

[0021] As mentioned above, Non-Patent Document 1 discloses a technology for ID-based proxy re-encryption. The technology disclosed in Non-Patent Document 1 achieves key privacy, in which information about the ID of the target key is not leaked from the re-encryption key. Furthermore, Non-Patent Document 1 implements a re-encryption function for the so-called exponent-inversion type IBE, one of the three classifications of elliptic curve-based IBE. Note that while the Kasahara-Sakai method is an example of an exponent-inversion type IBE, the method on which Non-Patent Document 1 is based is not the Kasahara-Sakai method. Specifically, the Kasahara-Sakai method uses asymmetric pairing and the q-BDHI (Bilinear Diffie-Hellman Inversion) assumption, whereas Non-Patent Document 1 uses symmetric pairing and the q-DDHE (Decisional Diffie-Hellman Exponent) assumption.

[0022] Furthermore, DKG (Distributed Key Generation) is a technology for preventing the leakage of private keys. Non-Patent Document 2 and Non-Patent Document 3 propose DKG for the Kasahara-Sakai scheme. Here, Non-Patent Document 2 and Non-Patent Document 3 are technologies related to ID-based encryption (IBE), not ID-based agent re-encryption (IB-PRE). Therefore, the format of the private key according to Non-Patent Document 2 and Non-Patent Document 3 is different from the format of the private key according to IB-PRE as related to Non-Patent Document 1. Therefore, it is extremely difficult to simply combine the technology according to Non-Patent Document 1 with the technologies according to Non-Patent Document 2 and Non-Patent Document 3. In contrast, as described below, in this embodiment, DKG is realized in ID-based agent re-encryption. Therefore, in this embodiment, it is possible to prevent the key issuing authority from decrypting ciphertext even if the key issuing authority is malicious in the ID-based agent re-encryption technology.

[0023] (Principles Applied in the Present Embodiment) Here, the principles applied in the present embodiment will be described. In the present embodiment, multiparty computation (MPC) based on secret sharing is used to realize the DKG. Furthermore, Shamir's Secret Sharing scheme (SSS) is used as the secret sharing method. Note that these are merely examples, and the method for realizing the DKG is not limited to the above.

[0024] Shamir's secret sharing scheme is a type of (t, n) threshold secret sharing scheme, where n is the number of participants P ｉ The total number of participants P ｉ By distributing the secret among them, each participant receives a share (share: distribution value). When any number of shares equal to or greater than t are collected, the secret can be restored.

[0025] Let f be a polynomial of degree (t-1) on a prime number p. Here, f(0) = s. Here, f is a polynomial for polynomial interpolation. Also, s∈Z ｐ is a value that you want to keep secret (secret value). ｐ is a set of values ​​from 0 to p-1. ｉ The share of s in (i = 1, ..., n) is [s] ｉ = f(i). Also, the share of s is expressed as [s] = ([s] １ , ..., [s] ｎ ) where [s] can be said to represent the state in which the secret value s is distributed to all participants. ｉ is the participant P's share of the secret value s ｉ For convenience of explanation, in the following explanation, the share [s] is represented as the variance [s] where s is distributed to each participant. ｉ , ... [s] ｎ It is sometimes used to refer to the two without distinction.

[0026] Here, c, c １ , c ２ ∈Z ｐ Then, the following equations hold: These can be calculated without communication between participants. Linearity (addition of shares): [c １ a + c ２ b] = c １ [a] + c ２ [b] Constant multiplication: [ca] = c[a] Constant addition: [c+a] = c+[a] For example, participant P ｊ If we focus only on the operation of [ca], the above constant multiplication formula is ｊ = c[a] ｊ It is written as follows.

[0027] In Shamir's secret sharing scheme, the secret value is shared as follows: An input dealer (one of the participants P) randomly selects a polynomial f for the secret value s, and the participants P ｉ [s] ｉ (= f(i)). This distributes s to each participant.

[0028] In addition, in the Shamir secret sharing scheme, the secret value is restored as follows. That is, the reconstructing party is composed of participants P ｉ From [s] ｉ Then, the reconstructing party receives t pieces of the secret value s by polynomial interpolation using the following equation (1). ...(1)

[0029] where λ ｉ is a Lagrange coefficient and is expressed by the following equation (2). ... (2)

[0030] The share of the (t, n) threshold secret sharing is expressed as [s], and the share of the (t', n') threshold secret sharing is expressed as in the following equation (3). ...(3)

[0031] For convenience of notation, the formula (3) is written as "[[s]]". ｉ is λ ｉ [s] ｉ is kept secret, ｉ [s] ｉ ]] and then redistribute it as Σ[[λ ｉ [s] ｉ ]], the threshold and the number of participants may be changed from t and n to t' and n', respectively. Note that this can be realized under the assumption that old shares before the change are safely deleted.

[0032] In addition, in the multi-party computation in this embodiment, "Share()" of SSS is used as a function for sharing a secret value. That is, a is shared as shown in the following formula (4). Note that i is the number of participants P who are input dealers. ｉ corresponds to the subscript (index) of the formula, and a is a secret value. ...(4)

[0033] In addition, "Open()" of SSS is used as a function for restoring the secret value. That is, a is restored as shown in the following formula (5). ...(5)

[0034] In this embodiment, a function "Mult()" is used to multiply shares together. That is, as shown in the following equation (6), a share [a] of secret value a is multiplied by a share [b] of secret value b. ...(6)

[0035] Mult() can be implemented in various ways. For example, Mult() may be implemented using the method described in Non-Patent Document 4. Implementing Mult() requires communication between participants. For example, Mult() may be implemented using the following steps, but is not limited to these:

[0036] Step A1: Participant P ｉ (for i=1,...,n) is calculated by the following equation (7): ｉ Calculate and find c ｉ Distribute and ｉ Share of [c ｉ ] is calculated. ｉ is the share [c ｉ ](=[c ｉ ] １ , ..., [c ｉ ] ｎ ) to other participants. ... (7)

[0037] Step A2: By calculating the following equation (8), [c], which is the result of multiplying [a] and [b], is obtained. ...(8)

[0038] In addition, [a] ｉ = f(i), [b] ｉ = g(i). Furthermore, f and g are polynomials of degree (t-1). Furthermore, let f(i)g(i) = h(i). In this case, h is a polynomial of degree (2t-2). Furthermore, since f(0) = a and g(0) = b, h(0) = ab. Therefore, the above formula (8) holds.

[0039] In this embodiment, a pairing (bilinear mapping) is used. In this embodiment, calculations are performed under the pairing conditions described below.Ｔ are multiplicative cyclic groups of order p (p is a sufficiently large prime number). In this case, g∈G is the generator of G. For example, g is a rational point on an elliptic curve, but is not limited to this. G is a set composed of generators that are rational points on an elliptic curve, but is not limited to this. Also, G Ｔ is, for example, but not limited to, the set of elements of the extension field.

[0040] Also, the bilinear mapping e: G × G → G Ｔ satisfies the following properties: Bilinearity: e(g １ ａ , g ２ ｂ ) = e(g １ , g ２ ) ａｂ However, a and b are Z ｐ ＊ is an arbitrary value randomly selected from g １ , g ２ ∈G. Also, Z ｐ ＊ is a set of values ​​from 1 to p-1. Non-degenerate: e(g, g) ≠ 1 Computationally efficient: for any g １ , g ２ For ∈G, e(g １ , g ２ There is an efficient algorithm (polynomial time algorithm) for calculating e(g １ , g ２ ) is a multiplicative cyclic group G of order p Ｔ is an element (element) of.

[0041] Here, we will briefly explain how pairing is used to configure a cryptosystem. For example, if a public key is g ｔ , e(g, g) ｓｔ and the master private key is s. Then, g ｔ , e(g, g) ｓｔ Note that t and st cannot be calculated from m·e(g, g) ｓｔ Then, a ciphertext of the plaintext m is generated as follows.

[0042] Here, the key issuing authority cannot directly provide s to the user to prevent the master private key from being leaked, but the user cannot decrypt the ciphertext unless some value related to s is provided. Therefore, the key issuing authority may provide, for example, g as a private key. ｓ The value in the format shown below is passed to the user. ｓ Note that it is not possible to calculate s from

[0043] The user is g ｓ Since s cannot be calculated from m·e(g, g) ｓｔ However, the user can decrypt m from the public key g ｔ and private key g ｓ Using this, even if t and s are unknown, e(g ｔ , g ｓ ) = e(g, g) ｓｔ That is, by using the pairing, g ｘ , g ｙ Even if x and y cannot be calculated from e(g, g) ｘｙ Then, calculations such as xy can be performed at the exponent.

[0044] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. For clarity of explanation, the following description and drawings have been omitted and simplified as appropriate. In addition, in each drawing, the same elements are given the same reference numerals, and duplicate explanations are omitted as necessary.

[0045] 5 is a diagram showing the configuration of an information processing system 50 according to the first embodiment. The information processing system 50 includes a plurality of key issuing devices 100-1 to 100-n (n is an integer equal to or greater than 2), an encryption device 60, a plurality of user devices 200, and a re-encryption device 300. The key issuing device 100, the encryption device 60, the user devices 200, and the re-encryption device 300 are connected to each other via wire or wirelessly so as to be able to communicate with each other.

[0046] Each device constituting the information processing system 50 can be realized by, for example, a computer. The information processing system 50 realizes a DKG in IB-PRE using the above devices. This will be described in detail later. The information processing system 50 can also function as a key generation system (key issuing system) that generates public keys and private keys.

[0047] The key issuing device 100 can be managed by the key issuing organization described above. The key issuing device 100-i (i=1, . . . , n) is a participant P ｉ The key issuing device 100 is configured to generate at least a distributed master private key, and to generate distributed user private keys in a state in which the user private keys are distributed, using the distributed master private key and user identification information. The key issuing device 100 then transmits the distributed user private keys to the user devices of the users. Here, the distributed master private key can also be said to be a virtually distributed master private key. Note that in this embodiment, no master private key is actually generated. The distributed master private key is distributed among multiple key issuing devices 100 and includes elements for generating distributed user private keys. The distributed user private keys are distributed among multiple key issuing devices 100, and user private keys are obtained using the distributed user private keys obtained from the multiple key issuing devices 100. This will be described in more detail below.

[0048] The encryption device 60 is configured to create a ciphertext. Specifically, the encryption device 60 encrypts a plaintext m to create a ciphertext C. The encryption device 60 may be integrated with the user device 200. In this case, for example, the user device 200A of the user A may function as the encryption device 60.

[0049] The user devices 200 may be managed by the above-mentioned users. In the example of FIG. 5, user devices 200A to 200D may be managed by users A to D, respectively. Although four user devices 200 are shown in FIG. 5, any number of user devices 200 may be used. Each user device 200 is configured to generate a user private key for the user managing that user device 200, using the distributed user private keys obtained from the multiple key issuing devices 100. Furthermore, the user device 200 is configured to generate a re-encryption key (conversion key) using the user private key. Furthermore, the user device 200 is configured to decrypt ciphertext to obtain plaintext, using the user private key related to that user device 200. This will be described in more detail below.

[0050] The re-encryption device 300 may be managed by the agent described above. The re-encryption device 300 may be configured, for example, as the proxy server or gateway server described above. The re-encryption device 300 is configured to re-encrypt, without decrypting, a ciphertext that can be decrypted with a user private key related to a first user device of the multiple user devices 200, using a re-encryption key. That is, the re-encryption device 300 uses the re-encryption key to convert a ciphertext that can be decrypted with a user private key related to the first user device into a ciphertext that can be decrypted with a user private key related to a second user device. In this case, the re-encryption key is a conversion key that makes a ciphertext that can be decrypted by the first user device decryptable by a second user device of the multiple user devices 200. At this time, the second user device decrypts the re-encrypted ciphertext using the user private key related to the second user device. This will be described in more detail below.

[0051] 4, the user device 200A of the user A is the first user device, and the user device 200B of the user B is the second user device. In this case, the re-encryption device 300 generates a re-encryption key K Ａ→Ｂ The user device 200B converts (re-encrypts) the ciphertext Ca into the ciphertext Cb using the user B's user private key.

[0052] 6 is a diagram showing the configuration of a key issuing device 100 according to the first embodiment. The key issuing device 100 includes, as its components, a random number generation unit 102, a sharing unit 104, a random number share acquisition unit 106, a share multiplication unit 108, a restoration unit 110, and a share storage unit 112. The key issuing device 100 also includes, as its components, a distributed master key generation unit 120, a master public key generation unit 130, a distributed user private key generation unit 140, and a transmission unit 150. The random number generation unit 102 may be configured as a subroutine called by the distributed master key generation unit 120, the master public key generation unit 130, and the distributed user private key generation unit 140. Similarly, the distribution unit 104, random number share acquisition unit 106, share multiplication unit 108, restoration unit 110 and share storage unit 112 may be configured as subroutines called from the distributed master key generation unit 120, master public key generation unit 130 and distributed user private key generation unit 140.

[0053] The random number generation unit 102 functions as a random number generation means. The sharing unit 104 functions as a sharing means. The random number share acquisition unit 106 functions as a random number share acquisition means. The share multiplication unit 108 functions as a share multiplication means. The restoration unit 110 functions as a restoration means. The distributed master key generation unit 120 functions as a distributed master key generation means. The master public key generation unit 130 functions as a master public key generation means. The distributed user private key generation unit 140 functions as a distributed user private key generation means. The transmission unit 150 functions as a transmission means.

[0054] The random number generation unit 102 is configured to generate random numbers. The random number generation unit 102 also generates random number elements that become elements of the random numbers to be kept secret. The sharing unit 104 is configured to perform secret sharing on the random numbers (random number elements). The sharing unit 104 may perform secret sharing using, for example, the function shown in the above-mentioned equation (4) to obtain shares (shared values) of the random number elements. The sharing unit 104 transmits the obtained shares (shared values) of the random number elements to other key issuing devices 100.

[0055] The random number share acquisition unit 106 is configured to acquire a share of a random number using shares of multiple random number elements received from multiple key issuing devices 100. The random number share acquisition unit 106 may acquire a share of a random number by summing the shares (variance values) of multiple random number elements received from multiple key issuing devices 100. The share multiplication unit 108 is configured to multiply shares by each other. The share multiplication unit 108 may perform multiplication of shares by using, for example, the function shown in equation (6) above. The restoration unit 110 restores the share of a certain value (secret value) to acquire the value. The restoration unit 110 may perform restoration by using, for example, the function shown in equation (5) above. The share storage unit 112 stores shares (variance values) acquired during calculations related to shares. The share storage unit 112 stores shares (variance values) acquired in the processes of S120 to S140 described below. The share storage unit 112 may temporarily store shares (variance values).

[0056] The distributed master key generation unit 120 is configured to at least generate a distributed master private key that is distributed among multiple key issuing devices 100. The distributed master key generation unit 120 may also generate a distributed master public key that is distributed among multiple key issuing devices 100. This will be described in detail later. The master public key generation unit 130 is configured to generate a master public key. This will be described in detail later. The distributed user private key generation unit 140 is configured to generate a distributed user private key using the distributed master private key and user identification information. This will be described in detail later. The transmission unit 150 is configured to transmit the distributed user private key to the user device 200 of the user corresponding to the above identification information.

[0057] 7 is a diagram showing the configuration of a user device 200 according to the first embodiment. The user device 200 has a user private key generation unit 210, a user private key storage unit 220, a re-encryption key generation unit 230, and a decryption unit 240. The user private key generation unit 210 functions as a user private key generation unit. The user private key storage unit 220 functions as a user private key storage unit. The re-encryption key generation unit 230 functions as a re-encryption key generation unit. The decryption unit 240 functions as a decryption unit.

[0058] The user private key generation unit 210 is configured to generate a user private key for the user who manages the user device 200, using distributed user private keys obtained from multiple key issuing devices 100. This will be described in detail later. The user private key storage unit 220 is configured to store the generated user private key.

[0059] The re-encryption key generating unit 230 is configured to generate a re-encryption key using a user private key. For example, the re-encryption key generating unit 230 of the user device 200A generates a re-encryption key using the user private key K of the user A. Ａ , and re-encryption key (conversion key) K Ａ→Ｂ , K Ａ→Ｃ , K Ａ→Ｄ The decryption unit 240 is configured to decrypt the ciphertext using a user private key related to the user device 200 to obtain plaintext, as will be described in detail later.

[0060] 8 is a diagram showing the configuration of a re-encryption device 300 according to the first embodiment. The re-encryption device 300 has a re-encryption key storage unit 310, a ciphertext storage unit 320, and a re-encryption unit 330. The re-encryption key storage unit 310 functions as a re-encryption key storage unit. The ciphertext storage unit 320 functions as a ciphertext storage unit. The re-encryption unit 330 functions as a re-encryption unit.

[0061] The re-encryption key storage unit 310 stores the re-encryption key generated by the user device 200. The ciphertext storage unit 320 stores the ciphertext generated by the encryption device 60. The re-encryption unit 330 is configured to use the re-encryption key to re-encrypt, without decrypting, a ciphertext that can be decrypted with the user private key for a first user device of the multiple user devices 200. In other words, the re-encryption unit 330 uses the re-encryption key to convert (re-encrypt) a ciphertext that can be decrypted with the user private key for the first user device into a ciphertext that can be decrypted with the user private key for the second user device. This will be described in more detail below.

[0062] 9 to 12 are flowcharts showing processes executed by the information processing system 50 according to the first embodiment. Fig. 9 shows an information processing method (key issuing method, key generation method) executed by the information processing system 50. In Fig. 9, S120 to S160 show the key issuing method (key generation method) realized by the key issuing device 100.

[0063] The information processing system 50 sets the global parameters gparam (step S102). In S102, the information processing system 50 performs "Global Setup." The global parameters gparam may be made public within the information processing system 50. Note that the setting of the global parameters may be performed by any of the key issuing devices 100, or may be performed by a device (not shown) managed by a standardization organization.

[0064] Specifically, the information processing system 50 uses the security parameter λ to set a global parameter gparam=(p, G, e, g, H), where p is a prime number, G is a multiplicative cyclic group of order p, and e is a bilinear mapping, e: G × G → G Ｔ g is a generator of G, and g∈G. H is a hash function, and H:G Ｔ →Z ｐ In Non-Patent Document 1, h, which is an element (element) of G, is set as a global parameter (public parameter), but in this embodiment, h is not made public. This is because if h were made public, an attacker could potentially obtain plaintext from ciphertext.

[0065] The distributed master key generation unit 120 of each of the multiple key issuing devices 100 generates a distributed master key (step S120). In S120, the key issuing device 100 performs "Distribute Setup". As will be described later, the key issuing device 100-i (i=1, . . . , n) generates a distributed master key (mpk ｉ , msk ｉ ) where mpk ｉ is the distributed master public key. ｉ is the distributed master private key. That is, the distributed master key (mpk ｉ , msk ｉ ) is the distributed master public key mpk ｉ and the distributed master private key msk ｉ It is paired with.

[0066] The multiple key issuing devices 100-1 to 100-n each generate a distributed master key, and a set of distributed master keys {(mpk ｉ , msk ｉ )={(mpk １ , msk １ ),...,(mpk ｎ , msk ｎ )} is generated. That is, the distributed master public key mpk １ ~mpk ｎ is distributed among multiple key issuing devices 100. Similarly, the distributed master private key msk １ ~msk ｎ is distributed among the multiple key issuing devices 100. The multiple key issuing devices 100-1 to 100-n cooperate to generate a distributed master key {(mpk ｉ , msk ｉ )}.

[0067] Fig. 10 is a flowchart showing the processing of S120 in Fig. 9. Fig. 10 shows the processing of the distributed master key generation unit 120 according to the first embodiment. Note that, in the following explanation, the processing of the distributed master key generation unit 120 of the key issuing device 100-i will be described, but similar processing is performed for the other key issuing devices 100. In other words, similar processing is performed for the key issuing device 100-i (i = 1, ..., n). This also applies to other processing.

[0068] The distributed master key generation unit 120 generates a random number element (step S122). That is, the distributed master key generation unit 120 of the key issuing device 100-i generates a random number element α ｉ , β ｉ The distributed master key generation unit 120 may perform the process of S122 using the random number generation unit 102 described above. ｉ , β ｉ ∈Z ｐ In addition, the random number element α ｉ (first random number element) is an element of the random number α (first random number). ｉ (second random number element) becomes an element of random number β (second random number). Note that the values ​​of random numbers α and β are kept secret from each key issuing device 100, that is, are not known to each key issuing device 100.

[0069] The distributed master key generation unit 120 secretly shares the random number element (step S124). ｉ , β ｉ The distributed master key generation unit 120 may perform the process of S124 using the distribution unit 104 described above. The distributed master key generation unit 120 secretly shares the random number element α ｉ , β ｉ secret sharing is performed on the random number element α ｉ Share of [α ｉ ](variance value) and random number element β ｉ Share of [β ｉ ] (shared value) to the other key issuing devices 100.

[0070] Specifically, the distributed master key generation unit 120 of the key issuing device 100-i calculates the random number element α by the following equation (9): ｉ Share of [α ｉ ] (variance value). ... (9)

[0071] Similarly, the distributed master key generation unit 120 of the key issuing device 100-i calculates the random number element β by the following equation (10): ｉ Share of [β ｉ ] (variance value). ...(10)

[0072] Then, the distributed master key generation unit 120 of the key issuing device 100-i calculates the generated share [α ｉ ] (variance value) and share [β ｉ ] (shared value) to the other key issuing devices 100. Specifically, the distributed master key generation unit 120 of the key issuing device 100-i transmits the shared value [α ｉ ] ｊ and [β ｉ ] ｊ This sends [α ｉ ]=([α ｉ ] １ , ..., [α ｉ ] ｎ ) and [β ｉ ]=([β ｉ ] １ , ..., [β ｉ ] ｎ ) is generated. Similar processing is also performed in the other key issuing devices 100. Therefore, the key issuing device 100-i receives the state [α １ ] ｉ , ..., [α ｎ ] ｉ , and [β １ ] ｉ , ..., [β ｎ ] ｉ Get.

[0073] The distributed master key generation unit 120 acquires shares [α] and [β] (shares) of the random numbers α and β (step S126). The distributed master key generation unit 120 may perform the process of S126 using the random number share acquisition unit 106 described above. The distributed master key generation unit 120 acquires the share [α] (shares) of the random number α (first random number) using the shares (shares) of the first random number elements acquired from the multiple key issuing devices 100. Similarly, the distributed master key generation unit 120 acquires the share [β] (shares) of the random number β (second random number) using the shares (shares) of the second random number elements acquired from the multiple key issuing devices 100.

[0074] Specifically, the distributed master key generation unit 120 obtains the share [α] (share) of the random number α (first random number) by summing the shares (shares) of the first random number elements obtained from the multiple key issuing devices 100. Similarly, the distributed master key generation unit 120 obtains the share [β] (share) of the random number β (second random number) by summing the shares (shares) of the second random number elements obtained from the multiple key issuing devices 100.

[0075] That is, the distributed master key generation unit 120 generates shares [α] and [β] (distribution values) using the following formulas (11) and (12), respectively. ...(11) ...(12)

[0076] Focusing on the key issuing device 100-i, the distributed master key generation unit 120 generates random number elements α ｊ (j = 1, ..., n) variance value [α ｊ ] ｉ The sum of these is the variance (share) of the random number α [α] ｉ That is, the distributed master key generation unit 120 obtains the distribution value [α] by the following equation (13): ｉ Generate. ...(13)

[0077] Similarly, the distributed master key generation unit 120 uses the random number elements β obtained from the multiple key issuing devices 100 ｊ (j = 1, ..., n) variance value [β ｊ ] ｉThe variance (share) of the random number β is calculated by summing the above values ​​[β]. ｉ That is, the distributed master key generation unit 120 obtains the distribution value [β] by the following equation (14): ｉ Generate. ...(14)

[0078] The distributed master key generation unit 120 generates a distributed master key (step S128). Specifically, the distributed master key generation unit 120 generates a distributed master key based on the acquired shares [α] and [β] (share values). The distributed master key generation unit 120 of the key issuing device 100-i generates a distributed master key based on the acquired shares [α] and [β] (share values ​​[α] ｉ , [β] ｉ ), a distributed master key (mpk ｉ , msk ｉ ). That is, the distributed master key generation unit 120 generates a distributed master public key that is distributed among multiple key issuing devices 100, based on the shares [α] (shares) of the first random number α and the shares [β] (shares) of the second random number β. The distributed master key generation unit 120 also generates a distributed distributed master private key, based on the shares [α] (shares) of the first random number that is obtained by distributing the first random number α, and the shares [β] (shares) of the second random number that is obtained by distributing the second random number β.

[0079] More specifically, the distributed master key generation unit 120 of the key issuing device 100-i generates the distributed master public key mpk by the following equation (15): ｉ Generate. ...(15)

[0080] Furthermore, the distributed master key generation unit 120 of the key issuing device 100-i generates the distributed master secret key msk by the following equation (16): ｉ Generate. ...(16)

[0081] The processing of the distributed master key generation unit 120 described above makes it possible to realize a state in which the random numbers α and β are distributed among the multiple key issuing devices 100-1 to 100-n without informing any of the key issuing devices 100 (key issuing institutions) of the values ​​of the random numbers α and β. That is, as in the example of FIG. 4, when keys are not generated in a distributed manner, it is sufficient for a single key issuing institution (key issuing device) to generate the random numbers α and β. In contrast, when keys are generated in a distributed manner, in order to achieve the objective of preventing leakage of the private key, none of the key issuing devices 100 (key issuing institutions) should know the random numbers α and β. Therefore, in the processing of S122, each key issuing device 100-i (i = 1, ..., n) generates the random number elements α ｉ , β ｉ In the process of S124, a random number element α ｉ , β ｉ are secretly shared. Then, by the process of S126, each key issuing device 100-i generates shares [α], [β] (shares) of the random numbers α, β. By this process, a state in which the random numbers α, β are distributed can be achieved without any key issuing device 100 (key issuing institution) knowing the values ​​of the random numbers α, β. Then, with the random numbers α, β kept secret from any key issuing device 100 (key issuing institution), each key issuing device 100 can generate a distributed master key using the shares (shares) of the random numbers α, β.

[0082] Returning to the explanation of Fig. 9, the master public key generation unit 130 of each of the multiple key issuing devices 100 generates a master public key (step S130). In S130, the key issuing device 100 performs "Distribute PKG (Public Key Generation)." As described above, in the process of S120, the multiple key issuing devices 100-1 to 100-n generate a set of distributed master public keys {mpk ｉ}={mpk １ , ..., mpk ｎ The key issuing device 100-i (i=1, . . . , n) generates a global parameter gparam and a set of distributed master public keys {mpk ｉ} to generate a master public key mpk. That is, the master public key generation unit 130 generates a master public key based on the distributed master public keys acquired from the multiple key issuing devices 100-1 to 100-n.

[0083] 11 is a flowchart showing the process of S130 in FIG. 9. FIG. 11 shows the process of the master public key generation unit 130 according to the first embodiment. The master public key generation unit 130 transmits the distributed master public key (step S132). Specifically, the master public key generation unit 130 of the key issuing device 100-i (i=1, . . . , n) generates the distributed master public key mpk ｉ to all key issuing devices 100. The master public key generation unit 130 may transmit the distributed master public key to a device that requires the master public key (the encryption device 60, the user device 200, or the key issuing device 100).

[0084] The master public key generation unit 130 generates a master public key (step S134). Specifically, the master public key generation unit 130 generates a master public key by using the distributed master public keys {mpk ｉ}={mpk １ , ..., mpk ｎ}={(g^([α] ｉ ), e(g, g)^([β] ｉ ) ... α , e(g, g) β The master public key generation unit 130 may perform the process of S134 using the restoration unit 110 described above.

[0085] More specifically, the master public key generation unit 130 generates the master public key mpk using the following formulas (17) and (18). Note that by performing such processing, the same master public key can be generated in each key issuing device 100. In this way, by performing restoration using the exponent parts of the powers of g and the powers of e(g, g), it is possible for any key issuing device 100 (key issuing institution) to generate the master public key mpk=(g α , e(g, g) β ) can be generated. ...(17) ...(18)

[0086] Master public key generation unit 130 generates all n {[α] ｉ} = {[α] １ , ..., [α] ｎ} and perform the calculation shown in equation (17). ｉ By obtaining (the variance of α), g α Similarly, master public key generation unit 130 can generate all n {[β] ｉ} = {[β] １ , ..., [β] ｎ} and perform the calculation shown in equation (18). ｉ (variance of β) to obtain e(g, g) β can be generated.

[0087] In this embodiment, the parameter h disclosed in the technology of Non-Patent Document 1 is expressed as h=g β In this case, due to the bilinearity of the pairing described above, the following equation (19) holds. ...(19)

[0088] As described above, in the technique of Non-Patent Document 1, the above h is made public. That is, in the technique of Non-Patent Document 1, the public parameters are (g, g １ , h, H) will be made public. １ = gα On the other hand, in this embodiment, e(g,h) (=e(g,g)) is used instead of h. β ) is made public. In other words, in this embodiment, (g, g １ , e(g, h), H) are made public. Therefore, in this embodiment, h is not made public, so attacks from attackers such as those described above can be suppressed. Note that when e(g, h) = e(g, g), h = g, so h is made public. Therefore, in this case, the processing flow returns to the processing of S120, and the processing is executed again from S120.

[0089] Returning to the explanation of Fig. 9, the distributed user private key generation unit 140 of each of the multiple key issuing devices 100 generates a distributed user private key (step S140). In S140, the key issuing device 100 performs "Distribute KeyGen (Key Generation)". As described above, in the process of S120, the multiple key issuing devices 100-1 to 100-n generate a set of distributed master private keys {msk ｉ}={msk １ , ..., msk ｎ The key issuing device 100-i (i=1, . . . , n) generates a global parameter gparam, a set of distributed master private keys {msk ｉ} and an ID that is the user's identification information, a distributed user private key is generated in which the user private key of the user corresponding to the identification information ID is distributed.

[0090] That is, the shared user private key generation unit 140 generates the shared master private keys {msk ｉ} and the user's identification information ID, the shared user private key dk ＩＤ，ｉ The multiple key issuing devices 100-1 to 100-n each generate a shared user private key, and a set of shared user private keys {dk ＩＤ，ｉ}={dk ＩＤ，１ , ..., dk ＩＤ，ｎ} is generated. That is, the shared user private key dk ＩＤ，１ , ..., dk ＩＤ，ｎis distributed among multiple key issuing devices 100. Note that the identification information ID is, for example, an email address, and therefore the user's identification information ID may be made public.

[0091] 12 is a flowchart showing the process of S140 in FIG. 9. FIG. 12 shows the process of the shared user private key generation unit 140 according to the first embodiment. The shared user private key generation unit 140 generates a random number element (step S142). That is, the shared user private key generation unit 140 of the key issuing device 100-i generates a random number element r ＩＤ，ｉ , w ｉ The shared user private key generation unit 140 may perform the process of S142 using the random number generation unit 102. ＩＤ，ｉ , w ｉ ∈Z ｐ In addition, the random number element r ＩＤ，ｉ (third random number element) is the random number r ＩＤ (third random number). ｉ (fourth random number element) becomes an element of the random number w (fourth random number). ＩＤ , w are kept secret from each key issuing device 100, that is, are not known to each key issuing device 100.

[0092] The shared user private key generation unit 140 secretly shares the random number element (step S144). ＩＤ，ｉ , w ｉ The shared user private key generation unit 140 may perform the process of S144 using the sharing unit 104 described above. ＩＤ，ｉ , w ｉ secret sharing is performed on the random number element r obtained by secret sharing ＩＤ，ｉ Share of [r ＩＤ，ｉ ](variance value) and random number element w ｉ Share of [w ｉ ] (shared value) to the other key issuing devices 100.

[0093] Specifically, the shared user private key generation unit 140 of the key issuing device 100-i calculates the random number element r ＩＤ，ｉ Share of [r ＩＤ，ｉ ] (variance value). ...(20)

[0094] Similarly, the shared user private key generation unit 140 of the key issuing device 100-i calculates the random number element w ｉ Share of [w ｉ ] (variance value). ...(21)

[0095] Then, the shared user private key generation unit 140 of the key issuing device 100-i generates the generated share [r ＩＤ，ｉ ] (variance value) and share [w ｉ ] (shared value) to the other key issuing devices 100. Specifically, the shared user private key generation unit 140 of the key issuing device 100-i transmits the shared value [r ＩＤ，ｉ ] ｊ and [w ｉ ] ｊ This sends [r ＩＤ，ｉ ] = ([r ＩＤ，ｉ ] １ , ..., [r ＩＤ，ｉ ] ｎ ) and [w ｉ ]=([w ｉ ] １ , ..., [w ｉ ] ｎ ) is generated. Similar processing is also performed in the other key issuing devices 100. Therefore, the key issuing device 100-i receives the state [r ＩＤ，１ ] ｉ , ..., [r ＩＤ，ｎ ] ｉ , and [w １ ] ｉ , ..., [w ｎ ] ｉ Get.

[0096] The shared user private key generation unit 140 generates a random number r ＩＤ , w's share [r ＩＤ], [w] (shares) (step S146). The shared user private key generation unit 140 may perform the process of S146 using the random number share acquisition unit 106 described above. The shared user private key generation unit 140 obtains the random number r using the shares (shares) of the third random number element acquired from the multiple key issuing devices 100. ＩＤ (third random number) share [r ＩＤ Similarly, the shared user private key generation unit 140 obtains the shares [w] (shares) of the random number w (fourth random number) using the shares (shares) of the fourth random number element obtained from the multiple key issuing devices 100.

[0097] Specifically, the shared user private key generation unit 140 sums up the shares (shares) of the third random number elements obtained from the multiple key issuing devices 100 to generate a random number r ＩＤ (third random number) share [r ＩＤ Similarly, the distributed user private key generation unit 140 adds up the shares (distribution values) of the fourth random number element obtained from the multiple key issuing devices 100 to obtain the share [w] (distribution value) of the random number w (fourth random number).

[0098] That is, the shared user private key generation unit 140 calculates the shares [r ＩＤ ], [w] (variance value) are generated. ...(22) ...(23)

[0099] Focusing on the key issuing device 100-i, the shared user private key generation unit 140 generates the random number elements r ＩＤ，ｊ (j = 1, ..., n) variance value [r ＩＤ，ｊ ] ｉ Add up the random number r ＩＤ Variance value (share) [r ＩＤ ] ｉ That is, the shared user private key generation unit 140 obtains the shared value [r ＩＤ ] ｉ Generate. ...(24)

[0100] Similarly, the shared user private key generation unit 140 generates random number elements w obtained from the multiple key issuing devices 100. ｊ (j = 1, ..., n) variance value [w ｊ ] ｉ The sum of these is the variance (share) of the random number w [w] ｉ That is, the shared user private key generation unit 140 obtains the shared value [w] by the following equation (25): ｉ Generate. ...(25)

[0101] The shared user private key generation unit 140 performs the multiplication of the shares (step S148). The shared user private key generation unit 140 may perform the process of S148 using the share multiplication unit 108 described above. The shared user private key generation unit 140 multiplies [β] - [r ＩＤ ] and [α]-ID by [w]. That is, the shared user private key generation unit 140 multiplies the share [α] of α (first random number), the share [β] of β (second random number), and r ＩＤ (third random number) share [r ＩＤ ] is multiplied by the share [w] of w (fourth random number), where [α] and [β] are the shared master private key msk ｉ Therefore, the shared user private key generation unit 140 generates the shared master private key msk ｉ The share of α [α], which is an element of α, the distributed master private key msk ｉ The share of β [β], which is an element of ＩＤ Share of [r ＩＤ ] is multiplied by the share of w [w].

[0102] Specifically, the shared user private key generation unit 140 performs multiplications in parallel using the following equations (26) and (27). In this manner, in this embodiment, multiple multiplications between shares are performed. As described above, when Mult() is executed, communication is performed between multiple key issuing devices 100. ...(26) ...(27)

[0103] As shown in the above formula (26), [β]-[r ＩＤ] and [w], the product [(β-[r ＩＤ ])·w] (second product) is obtained. ＩＤ (i.e., β and r ＩＤ ) is masked (concealed) by w. Also, as shown in the above formula (27), by multiplying [α]-ID and [w], the product [(α-ID)·w] (first product) is obtained. By the above formula (27), α-ID (i.e., α) is masked (concealed) by w. As will be described later, β-r ＩＤ and α-ID (i.e., α, β, and r ＩＤ ) is an element of the user private key.

[0104] The shared user private key generation unit 140 restores [(α-ID) · w] and calculates 1 / (α-ID) · w, which is the inverse of the restored result (step S150). The shared user private key generation unit 140 may perform the process of S150 using the restoration unit 110 described above. The shared user private key generation unit 140 restores the first product [(α-ID) · w] obtained by multiplying the element (α-ID) of the user private key obtained from the share [α] of the random number α and the identification information ID by the share [w] of the random number w. This obtains the value of (α-ID) · w. The shared user private key generation unit 140 also calculates the inverse v (first value) of the value (α-ID) · w obtained as a result of the restoration.

[0105] Specifically, the shared user private key generation unit 140 restores [(α-ID)·w] using the following equation (28) to obtain the value of (α-ID)·w. ...(28)

[0106] Furthermore, the shared user private key generation unit 140 calculates the inverse element v of (α-ID)·w by the following equation (29). Note that if (α-ID)·w=0, the process of S140 is executed again from S142. ...(29)

[0107] Note that even if the value of (α-ID)·w is obtained as in equation (28), the value of α is also kept secret because w is kept secret. Therefore, the inverse element v of the value (α-ID)·w is obtained while keeping α and w secret.

[0108] The shared user private key generation unit 140 generates a shared user private key (step S152). As shown below, the shared user private key generation unit 140 generates a shared user private key based on the product obtained as a result of multiplication of equations (26) to (27). Note that, as will be described later, the shared user private key generation unit 140 generates the shared user private key such that the shares (shared values) of the random number w are removed when the user private key is obtained using the shared user private keys obtained from multiple key issuing devices 100.

[0109] Specifically, the shared user private key generation unit 140 of the key issuing device 100-i derives the element h of the shared user private key expressed by the following formula (30) from the above formulas (26) and (29): ＩＤ，ｉ That is, the shared user private key generation unit 140 calculates the power of g, g^([(β-r ＩＤ )・w] ｉ ) by v (exponentiation operation), (g^([(β-r ＩＤ )・w] ｉ ))^v, h ＩＤ，ｉ In other words, the shared user private key generation unit 140 calculates the first power of g, g^([(β-r ＩＤ )・w] ｉ ) to the second power (g^([(β-r ＩＤ )・w] ｉ ))^v, h ＩＤ，ｉ Here, the exponent (power) of the first power of g (first power) is calculated as the product [(β-r ＩＤ )・w] ｉ (second product). ...(30)

[0110] Then, the shared user private key generation unit 140 of the key issuing device 100-i generates the shared user private key dk ＩＤ，ｉ Generate. ...(31)

[0111] Here, the shared user private key dk ＩＤ，ｉ is [r ＩＤ ] ｉ and ＩＤ，ｉ That is, the shared user private key generation unit 140 generates the random number r ＩＤ A set of a share (share value) of the random number β and the first data is generated as a shared user private key. Here, the first data is a share of the random number β and a random number r ＩＤ The elements are the product (second product) obtained by multiplying the element of the user private key obtained by the share of w by the share of the random number w, and v (first value).

[0112] 9. The transmission unit 150 of each of the multiple key issuing devices 100 transmits the shared user private key to the user device 200 (step S160). Specifically, the transmission unit 150 of the key issuing device 100-i transmits the shared user private key dk to the user device 200 of the user corresponding to the identification information ID. ＩＤ，ｉ As a result, the user device 200 corresponding to the identification information ID receives the distributed user private key dk from the multiple key issuing devices 100-1 to 100-n. ＩＤ，ｉ (i=1, ..., n).

[0113] The user device 200 generates a user private key (step S162). Specifically, the user private key generation unit 210 of the user device 200 corresponding to the identification information ID generates a plurality of shared user private keys dk ＩＤ，ｉ Using the user private key dk ＩＤ = (r ＩＤ , h ＩＤ The user private key generation unit 210 may perform the process of S162 using substantially the same functions as the above-mentioned restoration unit 110. The user private key generated by the user private key generation unit 210 is stored in the user private key storage unit 220.

[0114] More specifically, the user private key generation unit 210 calculates r by the following equation (32): ＩＤ Generate. ...(32)

[0115] Furthermore, the user private key generation unit 210 calculates h by the following equation (33): ＩＤ As mentioned above, h = g β Please note that ...(33)

[0116] The user private key generation unit 210 generates all n {dk ＩＤ，ｉ}={dk ＩＤ，１ , ..., dk ＩＤ，ｎ} and perform the calculations shown in Equation (32) and Equation (33). ＩＤ ] ｉ By obtaining ＩＤ Similarly, the user private key generation unit 210 can generate t or more h ＩＤ，ｉ By obtaining ＩＤ can be generated.

[0117] Furthermore, when comparing equation (30) with equation (33), it can be seen that the random number w is removed in the processing of the user private key generation unit 210 in the user device 200. That is, h ＩＤ，ｉ The random number w is removed by putting it into the format shown in equation (30). Therefore, it can be said that the shared user private key generation unit 140 generates the shared user private key such that the share of the random number w is removed when the user private key is obtained using the shared user private keys obtained from multiple key issuing devices 100. In this way, the random number w that is not an element of the user private key is removed.

[0118] As in Non-Patent Document 1, the user private key in IB-PRE is dk ＩＤ = (r ＩＤ , h ＩＤ) is a format consisting of a pair of two values. In this way, the user private key is in the form of a pair, so that the ciphertext can be re-encrypted. Note that in Non-Patent Document 2 and Non-Patent Document 3, which disclose technologies related to IBE, the user private key is in a format consisting of a single value. Therefore, the format of the user private key differs between IB-PRE and IBE. Therefore, as described above, it is extremely difficult to simply combine the technology related to Non-Patent Document 1 with the technologies related to Non-Patent Document 2 and Non-Patent Document 3.

[0119] Furthermore, the key issuing device 100 according to the first embodiment generates a user private key and elements of the user private key (random number α, random number β, and random number r ＩＤ ) can generate a user private key without being known to any of the key issuing devices 100. Therefore, the configuration according to the first embodiment makes it possible to prevent the key issuing authority from decrypting the ciphertext in the ID-based proxy re-encryption technology even if the key issuing authority has malicious intent.

[0120] The encryption device 60 generates a ciphertext (step S170). The encryption device 60 may generate a ciphertext from a plaintext in substantially the same manner as the method of Non-Patent Document 1. The ciphertext generated by the encryption device 60 is stored in the ciphertext storage unit 320 of the re-encryption device 300. The encryption device 60 generates a ciphertext C from the plaintext m using the following equation (34): ＩＤ This generates a ciphertext that can be decrypted with the user private key of the user associated with the ID. Note that a public key associated with the user associated with the ID can be generated using the master public key mpk and the identification information ID. ...(34)

[0121] When generating a ciphertext that can be decrypted with the user private key of user i (i=A, B, C, D), the encryption device 60 derives the ciphertext C_(ID ｉ ) is generated. ｉ is the identification information of user i. ...(35)

[0122] The re-encryption key generation unit 230 of the user device 200 generates a re-encryption key (step S174). The re-encryption key generation unit 230 generates the re-encryption key using the user private key. The re-encryption key generation unit 230 may generate the re-encryption key in a manner substantially similar to the method described in Non-Patent Document 1.

[0123] The re-encryption key generation unit 230 generates the re-encryption key rk_(ID ｉ →ID ｊ ) is generated. ｉ ) is the user private key of user i. ｊ is the identification information of user j (i≠j, j=A, B, C, D). Therefore, the re-encryption key rk_(ID ｉ →ID ｊ ) is a re-encryption key for enabling a ciphertext that can be decrypted by a first user device (user device 200 of user i) to be decrypted by a second user device (user device 200 of user j). ...(36)

[0124] The re-encryption unit 330 of the re-encryption device 300 re-encrypts the ciphertext stored in the ciphertext storage unit 320 (step S176). The re-encryption unit 330 uses the re-encryption key stored in the re-encryption key storage unit 310 to re-encrypt, without decrypting, the ciphertext that can be decrypted with the user private key for a first user device of the plurality of user devices 200. The re-encryption unit 330 may perform re-encryption in a manner substantially similar to the method of Non-Patent Document 1. The re-encrypted ciphertext may be stored in the ciphertext storage unit 320.

[0125] The re-encryption unit 330 performs re-encryption using the following equation (37): In other words, the re-encryption unit 330 uses the re-encryption key to convert a ciphertext that can be decrypted with the user private key for the first user device (user device 200 of user i) into a ciphertext that can be decrypted with the user private key for the second user device (user device 200 of user j). ...(37)

[0126] The decryption unit 240 of the user device 200 decrypts the ciphertext to obtain plaintext (step S180). The decryption unit 240 decrypts the ciphertext using the user private key of the corresponding user. The decryption unit 240 may decrypt the ciphertext in a manner substantially similar to the method of Non-Patent Document 1.

[0127] When the ciphertext created in the process of S170 is decrypted, the decryption unit 240 performs decryption using the following formula (38) to obtain plaintext m. In this case, in formula (38), ID is the identification information ID of user i. ｉ Corresponds to. ...(38)

[0128] On the other hand, when decrypting the ciphertext re-encrypted in the process of S176, the decryption unit 240 performs decryption using the following formula (39) to obtain plaintext m. In this case, in formula (39), ID is the identification information ID of user j. ｊ That is, the decryption unit 240 of the second user device decrypts the re-encrypted ciphertext using the user private key for the second user device. ...(39)

[0129] Note: When adding or deleting a key issuing device 100 (key issuing authority), simply redistributing the master key shares can be problematic because, as will be shown below, it is difficult to simply change the initially set value of t (the number of fraudsters).

[0130] For example, assume that there are three key issuing devices 100 (n=3) and that t=1 is the maximum number of t-those that can be tolerated (t / 2>t). In this case, since "n / 2>t" holds, there is no problem of leakage of user private keys, and the system operates.

[0131] In this case, suppose two key issuing devices 100 are added, so that n = 5. In this case, it is not the case that it is acceptable if "n / 2 > t" is determined, and t = 2, that allows for t to be 2 and allows for t to be 2 with up to two key issuing devices 100. This is because if the original shares of the secret value before the redistribution described above are preserved, two of the three key issuing devices 100 before the addition can cooperate to obtain a random number α, etc., which is an element of the master private key. As a result, in this embodiment, a master private key that is not generated by the key issuing device 100 can be obtained.

[0132] Therefore, when updating n while changing t, it is necessary not only to properly delete the random number before the update, but also to reset the random number α, etc., change the re-encryption key in the re-encryption device, and update the ciphertext. Resetting the random number α, etc., renews the public key and private key. Regarding the change of the re-encryption key, the re-encryption key may be changed by the user device 200 or by multi-party computation in the key issuing device 100. Furthermore, the update of the ciphertext may be performed without the involvement of the user device 200 that can decrypt the ciphertext.

[0133] Furthermore, the maliciously secure method in Non-Patent Document 3 terminates the protocol when cheating is detected. However, a robust method is required that always operates correctly even when cheating occurs. In contrast, the shares of each participant (key issuing device 100) in the SSS may be replicated using secret sharing, and a majority vote may be taken during multiplication. In this way, by replicating and holding the shares at each participant (key issuing device 100), security is provided against attackers who attempt to tamper with the calculation results.

[0134] Regarding security against CCA (Chosen Ciphertext Attack), a system that achieves CCA security can be configured by using the Fujisaki-Okamoto transformation, for example, with reference to Non-Patent Document 5. That is, by applying the Fujisaki-Okamoto transformation to the encryption system (S170) according to this embodiment, CCA security can be achieved.

[0135] (Embodiment 2) Next, embodiment 2 will be described. Embodiment 2 shows an outline of the configuration according to the above-mentioned embodiment. Note that the information processing system 50 according to embodiment 2 is substantially similar to that according to embodiment 1, and therefore description thereof will be omitted. In other words, the information processing system 50 according to embodiment 2 has a plurality of key issuing devices.

[0136] 13 is a diagram showing the configuration of a key issuing device 10 according to the second embodiment. The key issuing device 10 according to the second embodiment corresponds to the key issuing device 100 according to the first embodiment. The key issuing device 10 according to the second embodiment includes a distributed master key generation unit 12, a distributed user private key generation unit 14, and a transmission unit 16. The distributed master key generation unit 12 functions as distributed master key generation means. The distributed user private key generation unit 14 functions as distributed user private key generation means. The transmission unit 16 functions as transmission means.

[0137] The distributed master key generation unit 12 corresponds to the distributed master key generation unit 120 according to the first embodiment. The distributed master key generation unit 12 can be realized by substantially the same functions as those of the distributed master key generation unit 120. The distributed master key generation unit 12 generates at least a distributed master private key distributed to a plurality of key issuing devices 10. The distributed master key generation unit 12 generates the distributed master private key based on the shares ([α]) of the first random number (α) to be kept secret and the shares ([β]) of the second random number (β) to be kept secret.

[0138] The shared user private key generation unit 14 corresponds to the shared user private key generation unit 140 according to the first embodiment. The shared user private key generation unit 14 can be realized by substantially the same function as the shared user private key generation unit 140. The shared user private key generation unit 14 generates a shared user private key using the shared master private key and the user's identification information. Here, the user private key is obtained using the shared user private keys obtained from multiple key issuing devices. The shared user private key generation unit 14 generates a third random number (r ＩＤ ) is the third random number share ([r ＩＤ]) and a share ([w]) of the fourth random number obtained by distributing the fourth random number (w) to be kept secret. The distributed user private key generation unit 14 multiplies each of the share of the first random number, which is an element of the distributed master private key, the share of the second random number, and the share of the third random number, which are elements of the distributed master private key, by the share of the fourth random number. The distributed user private key generation unit 14 generates a distributed user private key based on the product obtained as a result of the multiplication.

[0139] The transmitting unit 16 transmits the shared user private key to the user's user device 200. As described above, the user device 200 can generate a user private key using multiple shared user private keys obtained from multiple key issuing devices 10.

[0140] With the above-described configuration, the key issuing device 10 according to the second embodiment can generate a user private key without the user private key and its elements (the first random number, the second random number, and the third random number) being known to any of the key issuing devices 10. Therefore, in the ID-based proxy re-encryption technology, it is possible to prevent the key issuing authority from decrypting the ciphertext even if the key issuing authority has malicious intent. This also applies to an information processing system 50 having a plurality of key issuing devices 10, a key issuing method executed by the key issuing devices 10, and a program that realizes the key issuing method.

[0141] (Hardware Configuration Example) An example of the configuration of hardware resources for realizing the devices and systems according to the above-described embodiments using one calculation processing device (information processing device, computer) will be described. However, the devices according to the embodiments (key issuing device, encryption device, user device, re-encryption device, etc.) may be physically or functionally realized using at least two calculation processing devices. Furthermore, the devices according to the embodiments may be realized as dedicated devices or general-purpose information processing devices.

[0142] FIG. 14 is a block diagram illustrating an example of the hardware configuration of a calculation processing device capable of realizing the device and system according to each embodiment. The calculation processing device 1000 includes a CPU 1001, a volatile storage device 1002, a disk 1003, a non-volatile recording medium 1004, and a communication IF (Interface) 1007. Therefore, it can be said that the device according to each embodiment includes the CPU 1001, the volatile storage device 1002, the disk 1003, the non-volatile recording medium 1004, and the communication IF 1007. The calculation processing device 1000 may be connectable to an input device 1005 and an output device 1006. The calculation processing device 1000 may also include the input device 1005 and the output device 1006. The calculation processing device 1000 can also transmit and receive information to and from other calculation processing devices and communication devices via the communication IF 1007.

[0143] The nonvolatile recording medium 1004 is a computer-readable medium, such as a compact disc or a digital versatile disc. The nonvolatile recording medium 1004 may also be a universal serial bus (USB) memory, a solid state drive, or the like. The nonvolatile recording medium 1004 stores the program and allows portability without requiring a power supply. The nonvolatile recording medium 1004 is not limited to the above-mentioned medium. Instead of the nonvolatile recording medium 1004, the program may be supplied via the communication IF 1007 and a communication network.

[0144] The volatile storage device 1002 is computer-readable and can temporarily store data. The volatile storage device 1002 is a memory such as a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0145] That is, when executing a software program (computer program: hereinafter simply referred to as "program") stored on disk 1003, CPU 1001 copies the program to volatile storage device 1002 and executes arithmetic processing. CPU 1001 reads data necessary for executing the program from volatile storage device 1002. When display is required, CPU 1001 displays the output result on output device 1006. When inputting a program from the outside, CPU 1001 acquires the program from input device 1005. CPU 1001 interprets and executes programs corresponding to the functions (processing) of each component shown in FIGS. 6 to 8 and 13 described above. CPU 1001 executes the processing described in each of the above-mentioned embodiments. In other words, the functions of each component shown in FIGS. 6 to 8 and 13 described above can be realized by CPU 1001 executing a program stored on disk 1003 or volatile storage device 1002.

[0146] That is, each of the embodiments can be realized by the above-described program. Furthermore, each of the embodiments can be realized by a computer-readable non-volatile recording medium on which the above-described program is recorded.

[0147] (Modifications) The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention. For example, in the above-described flowchart, the order of each process (step) can be modified as appropriate. Furthermore, one or more of the multiple processes (steps) may be omitted. For example, the process of S102 in FIG. 9 may be omitted. Furthermore, the process of S139 in FIG. 9 may be omitted.

[0148] In the above-described embodiment, the shared user private key generation unit 140 calculates [β]-[r ＩＤ ] is multiplied by [w], but the present invention is not limited to this configuration. As shown in the following equations (40) and (41), ＩＤ ] may be multiplied by [w] separately. ...(40) ...(41)

[0149] In this case, the element h of the shared user private key ＩＤ，ｉ is expressed by the following equation (42). ...(42)

[0150] In this case, the user private key generation unit 210 calculates h by the following equation (43): ＩＤ Generate. ...(43)

[0151] On the other hand, in the case of the above formulas (40) to (43), the calculation of Mult() is increased by one compared to the cases of formulas (26), (30) and (33) shown in the first embodiment. Therefore, by performing calculations such as formula (26), the number of calculations of Mult() can be reduced, and the calculation efficiency can be improved. In other words, the first power of g, g^([(β-r ＩＤ )・w] ｉ ) to the second power (g^([(β-r ＩＤ )・w] ｉ ))^v, h ＩＤ，ｉ By performing the calculation as above, it is possible to improve the efficiency of the calculation.

[0152] In the above examples, the program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored on a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disk (DVD), Blu-ray disc or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may also be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

[0153] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the invention.

[0154] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes. (Supplementary Note 1) A key issuing device comprising: distributed master key generation means for generating at least a distributed master private key distributed to a plurality of key issuing devices; distributed user private key generation means for generating, using the distributed master private key and user identification information, a distributed user private key obtained by distributing a user private key of the user, the user private key being obtained by using the distributed user private keys obtained from a plurality of key issuing devices; and transmission means for transmitting the distributed user private key to the user device of the user, wherein the distributed master key generation means generates the distributed master private key based on a share of a first random number obtained by distributing a first random number to be kept secret and a share of a second random number obtained by distributing a second random number to be kept secret; and the distributed user private key generation means obtains a share of a third random number obtained by distributing a third random number to be kept secret and which is an element of the user private key, and a share of a fourth random number obtained by distributing a fourth random number to be kept secret; A key issuing device that multiplies each of a share of the first random number, a share of the second random number, and a share of the third random number, which are elements of the distributed master private key, by a share of the fourth random number, and generates the distributed user private key based on a product obtained as a result of the multiplication. (Supplementary Note 2) The key issuing device according to Supplementary Note 1, wherein the distributed user private key generation means generates the distributed user private key such that the share of the fourth random number is removed when the user private key is obtained using the distributed user private keys obtained from a plurality of key issuing devices. (Supplementary Note 3) The key issuing device according to Supplementary Note 2, wherein the distributed user private key generation means restores a first product obtained by multiplying an element of the user private key obtained from the share of the first random number and the identification information by the share of the fourth random number, and generates the distributed user private key using a first value that is an inverse of the value obtained as a result of the restoration.(Supplementary Note 4) The key issuing device according to Supplementary Note 3, wherein the shared user private key generation means generates, as the shared user private key, a set of a share of the third random number, a second product obtained by multiplying an element of the user private key obtained by the share of the second random number and the share of the third random number by the share of the fourth random number, and first data having the first value as an element. (Supplementary Note 5) The key issuing device according to Supplementary Note 4, wherein the shared user private key generation means generates, as the first data, a second exponentiation of a first power of a generator of a multiplicative cyclic group of a predetermined order, with the first value as an exponent, and the exponent of the first exponentiation corresponds to the second product. (Supplementary Note 6) The key issuing device according to Supplementary Note 1, wherein the distributed master key generation means generates a first random number element that will be an element of the first random number and a second random number element that will be an element of the second random number, performs secret sharing on the first random number element and the second random number element, and transmits shares of the first random number element and shares of the second random number element obtained by secret sharing to other key issuing devices, obtains shares of the first random number using shares of the first random number element obtained from the plurality of key issuing devices, and obtains shares of the second random number using shares of the second random number element obtained from the plurality of key issuing devices. (Supplementary Note 7) The key issuing device according to Supplementary Note 1, wherein the shared user private key generation means generates a third random number element that becomes an element of a third random number to be kept secret and that becomes an element of the user private key, and a fourth random number element that becomes an element of a fourth random number to be kept secret, performs secret sharing on the third random number element and the fourth random number element, and transmits shares of the third random number element and shares of the fourth random number element obtained by secret sharing to other key issuing devices, obtains shares of the third random number using shares of the third random number element obtained from the plurality of key issuing devices, and obtains shares of the fourth random number using shares of the fourth random number element obtained from the plurality of key issuing devices.(Supplementary Note 8) The key issuing device according to Supplementary Note 1, further comprising: a master public key generation means for generating a master public key, wherein the distributed master key generation means further generates distributed master public keys distributed to a plurality of key issuing devices based on a share of the first random number and a share of the second random number, and the master public key generation means generates the master public key based on the distributed master public keys obtained from the plurality of key issuing devices.(Supplementary Note 9) A system comprising: a plurality of key issuing devices; a plurality of user devices; and a re-encryption device, wherein each of the plurality of key issuing devices comprises: a distributed master key generation means for generating at least a distributed master private key distributed to a plurality of key issuing devices; a distributed user private key generation means for generating, using the distributed master private key and user identification information, a distributed user private key in a state in which the user private key of the user is distributed, the user private key being obtained by using the distributed user private keys obtained from a plurality of key issuing devices; and a transmission means for transmitting the distributed user private key to the user device of the user, wherein the distributed master key generation means generates the distributed master private key based on a share of a first random number in a state in which a confidential first random number is distributed and a share of a second random number in a state in which a confidential second random number is distributed, and the distributed user private key generation means and acquiring a share of a third random number obtained by distributing a third random number that is kept secret and that is to become an element of the user private key, and a share of a fourth random number obtained by distributing a fourth random number that is kept secret, and multiplying each of the share of the first random number that is an element of the distributed master private key, the share of the second random number that is an element of the distributed master private key, and the share of the third random number by the share of the fourth random number, and generating the distributed user private key based on the product obtained as a result of the multiplication, wherein each of the plurality of user devices comprises: user private key generation means that generates the user private key using the distributed user private keys obtained from the plurality of key issuing devices; re-encryption key generation means that generates a re-encryption key using the user private key; and decryption means that decrypts ciphertext to obtain plaintext, and the re-encryption device re-encrypts the ciphertext that can be decrypted with the user private key for the first user device without decrypting it, using the re-encryption key that makes the ciphertext that can be decrypted by a first user device of the plurality of user devices decryptable by a second user device of the plurality of user devices, The decryption means of the second user device decrypts the re-encrypted ciphertext using the user private key related to the second user device.(Supplementary Note 10) The information processing system according to Supplementary Note 9, wherein the shared user private key generation means of the key issuing device generates the shared user private key such that the share of the fourth random number is removed when the user private key is obtained using the shared user private keys obtained from a plurality of key issuing devices, and the user private key generation means of the user device generates the shared user private key such that the share of the fourth random number is removed. (Supplementary Note 11) The information processing system according to Supplementary Note 10, wherein the shared user private key generation means of the key issuing device restores a first product obtained by multiplying an element of the user private key obtained from the share of the first random number and the identification information by the share of the fourth random number, and generates the distributed user private key using a first value that is an inverse of the value obtained as a result of the restoration. (Supplementary Note 12) The information processing system according to Supplementary Note 11, wherein the shared user private key generation means of the key issuing device generates, as the shared user private key, a set of a share of the third random number, a second product obtained by multiplying the share of the second random number and an element of the user private key obtained from the share of the third random number by the share of the fourth random number, and first data having the first value as an element, and the user private key generation means of the user device generates the user private key by restoring each of the share of the third random number and the second product. (Supplementary Note 13) The information processing system according to Supplementary Note 12, wherein the shared user private key generation means of the key issuing device generates, as the first data, a second exponentiation of a first power of a generator of a multiplicative cyclic group of a predetermined order, with the first value as an exponent, and the exponent of the first exponentiation corresponds to the second product.(Supplementary Note 14) The information processing system according to Supplementary Note 9, wherein the distributed master key generation means of the key issuing device generates a first random number element that will be an element of the first random number and a second random number element that will be an element of the second random number, performs secret sharing on the first random number element and the second random number element, and transmits shares of the first random number element and shares of the second random number element obtained by secret sharing to other key issuing devices, obtains shares of the first random number using shares of the first random number element obtained from the plurality of key issuing devices, and obtains shares of the second random number using shares of the second random number element obtained from the plurality of key issuing devices. (Supplementary Note 15) The information processing system according to Supplementary Note 9, wherein the shared user private key generation means of the key issuing device generates a third random number element that is to be an element of a third random number that is to be kept secret and that is to be an element of the user private key, and a fourth random number element that is to be an element of a fourth random number that is to be kept secret, performs secret sharing on the third random number element and the fourth random number element, and transmits shares of the third random number element and shares of the fourth random number element obtained by secret sharing to other key issuing devices, obtains shares of the third random number using shares of the third random number element obtained from the plurality of key issuing devices, and obtains shares of the fourth random number using shares of the fourth random number element obtained from the plurality of key issuing devices. (Supplementary Note 16) The information processing system according to Supplementary Note 9, wherein the key issuing device further comprises master public key generation means for generating a master public key, wherein the distributed master key generation means of the key issuing device further generates distributed master public keys distributed to a plurality of key issuing devices based on a share of the first random number and a share of the second random number, wherein the master public key generation means of the key issuing device generates the master public key based on the distributed master public keys acquired from the plurality of key issuing devices, and wherein the re-encryption key generation means of the user device generates a re-encryption key using the master public key and the user private key.(Supplementary Note 17) At least, a distributed master private key in a state distributed among a plurality of key issuing devices is generated based on a share of a first random number obtained by distributing a first random number to be kept secret and a share of a second random number obtained by distributing a second random number to be kept secret; using the distributed master private key and user identification information, a distributed user private key in a state in which a user private key of the user is distributed, the user private key being obtained by using the distributed user private keys obtained from a plurality of key issuing devices, and at the same time, a share of a third random number obtained by distributing a third random number that is kept secret and is an element of the user private key, and a share of a fourth random number obtained by distributing a fourth random number to be kept secret, and multiplying each of the share of the first random number that is an element of the distributed master private key, the share of the second random number that is an element of the distributed master private key, and the share of the third random number, each element of the distributed master private key, by the share of the fourth random number, and generating the distributed user private key based on the product obtained as a result of the multiplication; a first value that is the inverse of the value obtained as a result of the restoration, wherein the shared user private key is generated using the share of the third random number and the identification information, and a second product obtained by multiplying the share of the fourth random number by the share of the fourth random number and an element of the user private key obtained from the share of the second random number and the share of the third random number, and the shared user private key is generated using a first value that is the inverse of the value obtained as a result of the restoration, (Supplementary Note 20) The key issuing method of Supplementary Note 19, wherein the shared user private key is generated using a set of the share of the third random number, the second product obtained by multiplying the share of the fourth random number by the element of the user private key obtained from the share of the second random number and the share of the third random number, and first data whose element is the first value. (Supplementary Note 21) The key issuing method according to Supplementary Note 20, further comprising generating, as the first data, a second power of a first power of a generator of a multiplicative cyclic group of a predetermined order, with the first value as an exponent, wherein the exponent of the first power corresponds to the second product.(Supplementary Note 22) The key issuing method according to Supplementary Note 17, comprising: generating a first random number element that will be an element of the first random number, and a second random number element that will be an element of the second random number; performing secret sharing on the first random number element and the second random number element; transmitting shares of the first random number element and shares of the second random number element obtained by secret sharing to another key issuing device; obtaining shares of the first random number using shares of the first random number element obtained from the plurality of key issuing devices, and obtaining shares of the second random number using shares of the second random number element obtained from the plurality of key issuing devices. (Supplementary Note 23) The key issuing method according to Supplementary Note 17, comprising: generating a third random number element to be an element of a third random number that is to be kept secret and that is to be an element of the user private key, and a fourth random number element to be an element of a fourth random number that is to be kept secret, performing secret sharing on the third random number element and the fourth random number element, and transmitting shares of the third random number element and shares of the fourth random number element obtained by secret sharing to other key issuing devices, obtaining shares of the third random number using shares of the third random number element obtained from the plurality of key issuing devices, and obtaining shares of the fourth random number using shares of the fourth random number element obtained from the plurality of key issuing devices. (Supplementary Note 24) The key issuing method according to Supplementary Note 17, further generating distributed master public keys that are distributed to a plurality of key issuing devices based on the shares of the first random number and the shares of the second random number, and generating a master public key based on the distributed master public keys obtained from the plurality of key issuing devices.(Supplementary Note 25) Each of a plurality of key issuing devices at least generates a distributed master private key distributed among the plurality of key issuing devices based on a share of a first random number obtained by distributing a first random number to be kept secret and a share of a second random number obtained by distributing a second random number to be kept secret, and generates a distributed user private key using the distributed master private key and user identification information, the distributed user private key being obtained by distributing a user private key of the user, the user private key being obtained by using the distributed user private keys obtained from a plurality of key issuing devices, and at the same time, obtains a share of a third random number obtained by distributing a third random number to be kept secret and which is an element of the user private key, and a share of a fourth random number obtained by distributing a fourth random number to be kept secret, and multiplies each of the share of the first random number, which is an element of the distributed master private key, the share of the second random number, and the share of the third random number, which are elements of the distributed master private key, by the share of the fourth random number, and generates the distributed user private key based on the product obtained as a result of the multiplication, an information processing method comprising: transmitting the shared user private key to a user device of the user; generating, by the user device, the user private key using the shared user private keys obtained from a plurality of the key issuing devices; generating a re-encryption key using the user private key; decrypting a ciphertext to obtain plaintext; re-encrypting, by a re-encryption device, the ciphertext decodable with the user private key for the first user device, without decrypting it, using the re-encryption key to make a ciphertext decodable with a first user device decodable with a second user device; and decrypting, by the second user device, the re-encrypted ciphertext using the user private key for the second user device. (Supplementary Note 26) The information processing method according to Supplementary Note 25, wherein the key issuing device generates the shared user private key such that a share of the fourth random number is removed when the user private key is obtained using the shared user private keys obtained from a plurality of key issuing devices; and generating, by the user device, the shared user private key such that the share of the fourth random number is removed.(Supplementary Note 27) The information processing method according to Supplementary Note 26, wherein the key issuing device restores a first product obtained by multiplying an element of the user private key obtained from the share of the first random number and the identification information by the share of the fourth random number, and generates the shared user private key using a first value that is the inverse of the value obtained as a result of the restoration. (Supplementary Note 28) The information processing method according to Supplementary Note 27, wherein the key issuing device generates, as the shared user private key, a set of the share of the third random number, a second product obtained by multiplying an element of the user private key obtained from the share of the second random number and the share of the third random number by the share of the fourth random number, and first data having the first value as an element, and the user device restores each of the share of the third random number and the second product to generate the user private key. (Supplementary Note 29) The information processing method according to Supplementary Note 28, wherein the key issuing device generates, as the first data, a second power of a first power of a generator of a multiplicative cyclic group of a predetermined order, with the first value as an exponent, and the exponent of the first power corresponds to the second product. (Supplementary Note 30) The information processing method according to Supplementary Note 25, wherein the key issuing device generates a first random number element that will be an element of the first random number, and a second random number element that will be an element of the second random number, performs secret sharing on the first random number element and the second random number element, and transmits shares of the first random number element and the second random number element obtained by secret sharing to other key issuing devices, and obtains shares of the first random number using shares of the first random number element obtained from the plurality of key issuing devices, and obtains shares of the second random number using shares of the second random number element obtained from the plurality of key issuing devices.(Supplementary Note 31) The information processing method according to Supplementary Note 25, wherein the key issuing device generates a third random number element that is to be kept secret and become an element of a third random number that is to be an element of the user private key, and a fourth random number element that is to be an element of a fourth random number that is to be kept secret, performs secret sharing on the third random number element and the fourth random number element, and transmits shares of the third random number element and shares of the fourth random number element obtained by secret sharing to other key issuing devices, obtains shares of the third random number using shares of the third random number element obtained from the plurality of key issuing devices, and obtains shares of the fourth random number using shares of the fourth random number element obtained from the plurality of key issuing devices. (Supplementary Note 32) The information processing method described in Supplementary Note 25, wherein the key issuing device further generates a distributed master public key that is distributed to multiple key issuing devices based on the share of the first random number and the share of the second random number, generates a master public key based on the distributed master public keys obtained from the multiple key issuing devices, and generates a re-encryption key using the master public key and the user private key by the user device.(Supplementary Note 33) A step of generating at least a distributed master private key in a state where it is distributed among a plurality of key issuing devices, based on a share of a first random number in a state where a first random number to be kept secret is kept distributed and a share of a second random number in a state where a second random number to be kept secret is kept distributed; a step of generating, using the distributed master private key and user identification information, a distributed user private key in a state where a user private key of the user is kept distributed, the user private key being obtained using the distributed user private keys obtained from a plurality of key issuing devices, obtaining a share of a third random number in a state where a third random number to be kept secret and which is an element of the user private key is kept distributed and a share of a fourth random number in a state where a fourth random number to be kept secret is kept distributed, multiplying each of the share of the first random number, the share of the second random number, and the share of the third random number which are elements of the distributed master private key by the share of the fourth random number, and generating the distributed user private key based on a product obtained as a result of the multiplication; a non-transitory computer-readable medium having stored thereon a program for causing a computer to execute the steps of: transmitting the distributed user private keys to the user devices of the users;

[0155] REFERENCE SIGNS LIST 10 Key issuing device 12 Distributed master key generation unit 14 Distributed user private key generation unit 16 Transmission unit 50 Information processing system 60 Encryption device 100 Key issuing device 102 Random number generation unit 104 Distribution unit 106 Random number share acquisition unit 108 Share multiplication unit 110 Restoration unit 112 Share storage unit 120 Distributed master key generation unit 130 Master public key generation unit 140 Distributed user private key generation unit 150 Transmission unit 200 User device 210 User private key generation unit 220 User private key storage unit 230 Re-encryption key generation unit 240 Decryption unit 300 Re-encryption device 310 Re-encryption key storage unit 320 Ciphertext storage unit 330 Re-encryption unit

Claims

1. A key issuing device, a distributed master key generating means for generating at least a distributed master private key that is distributed among a plurality of key issuing devices; a distributed user private key generation means for generating a distributed user private key by using the distributed master private key and user identification information, the distributed user private key being obtained by using the distributed user private key obtained from a plurality of key issuing devices; a transmitting means for transmitting the shared user private key to a user device of the user; having the distributed master key generation means generates the distributed master private key based on a share of a first random number obtained by distributing a first random number to be kept secret and a share of a second random number obtained by distributing a second random number to be kept secret; The distributed user private key generation means obtaining a share of a third random number obtained by distributing a third random number which is a secret element of the user private key, and a share of a fourth random number obtained by distributing a fourth random number which is a secret element of the user private key; multiplying each of a share of the first random number, which is an element of the distributed master private key, a share of the second random number, which is an element of the distributed master private key, and a share of the third random number by a share of the fourth random number; generating the shared user private keys based on a product of the multiplication; Key issuing device.

2. the shared user private key generation means generates the shared user private key such that a share of the fourth random number is removed when the user private key is obtained using the shared user private keys obtained from a plurality of key issuing devices. The key issuing device according to claim 1 .

3. the shared user private key generation means performs restoration on a first product obtained by multiplying an element of the user private key obtained by the share of the first random number and the identification information by the share of the fourth random number, and generates the shared user private key by using a first value that is an inverse of the value obtained as a result of the restoration. The key issuing device according to claim 2 .

4. the shared user private key generation means generates, as the shared user private key, a set of a share of the third random number, a second product obtained by multiplying an element of the user private key obtained by the share of the second random number and the share of the third random number by the share of the fourth random number, and first data having the first value as an element. The key issuing device according to claim 3.

5. the shared user private key generation means generates, as the first data, a second power of a first power of a generator of a multiplicative cyclic group of a predetermined order, with the first value as an exponent; the exponent of the first power corresponds to the second product; The key issuing device according to claim 4.

6. The distributed master key generation means generating a first random number element that is an element of the first random number and a second random number element that is an element of the second random number; performing secret sharing on the first random number element and the second random number element, and transmitting a share of the first random number element and a share of the second random number element obtained by the secret sharing to another key issuing device; obtaining a share of the first random number using a share of the first random number element obtained from the plurality of key issuing devices, and obtaining a share of the second random number using a share of the second random number element obtained from the plurality of key issuing devices. The key issuing device according to claim 1 .

7. The distributed user private key generation means generating a third random number element that is an element of a third random number that is to be kept secret and that is to be an element of the user private key, and a fourth random number element that is an element of a fourth random number that is to be kept secret; performing secret sharing on the third random number element and the fourth random number element, and transmitting a share of the third random number element and a share of the fourth random number element obtained by the secret sharing to another key issuing device; obtaining a share of the third random number using a share of the third random number element obtained from the plurality of key issuing devices, and obtaining a share of the fourth random number using a share of the fourth random number element obtained from the plurality of key issuing devices. The key issuing device according to claim 1 .

8. a master public key generating means for generating a master public key; and the distributed master key generation means further generates a distributed master public key distributed to a plurality of key issuing devices based on the share of the first random number and the share of the second random number; the master public key generation means generates the master public key based on the distributed master public keys acquired from the plurality of key issuing devices. The key issuing device according to claim 1 .

9. A plurality of key issuing devices; A plurality of user devices; A re-encryption device; having Each of the plurality of key issuing devices a distributed master key generating means for generating at least a distributed master private key that is distributed among a plurality of key issuing devices; a distributed user private key generation means for generating a distributed user private key by using the distributed master private key and user identification information, the distributed user private key being obtained by using the distributed user private key obtained from a plurality of key issuing devices; a transmitting means for transmitting the shared user private key to a user device of the user; having the distributed master key generation means generates the distributed master private key based on a share of a first random number obtained by distributing a first random number to be kept secret and a share of a second random number obtained by distributing a second random number to be kept secret; The distributed user private key generation means obtaining a share of a third random number obtained by distributing a third random number which is a secret element of the user private key, and a share of a fourth random number obtained by distributing a fourth random number which is a secret element of the user private key; multiplying each of a share of the first random number, which is an element of the distributed master private key, a share of the second random number, and a share of the third random number, which are elements of the distributed master private key, by a share of the fourth random number; generating the shared user private keys based on a product of the multiplication; Each of the plurality of user devices a user private key generating means for generating the user private key by using the shared user private keys acquired from a plurality of the key issuing devices; a re-encryption key generating means for generating a re-encryption key using the user private key; decryption means for decrypting the ciphertext to obtain a plaintext; having the re-encryption device re-encrypts, without decrypting, the ciphertext decodable by the user private key for the first user device, using the re-encryption key for making the ciphertext decodable by a first user device of the plurality of user devices decodable by a second user device of the plurality of user devices; a decryption means for the second user device decrypting the re-encrypted ciphertext using the user private key for the second user device; Information processing system.

10. generating at least a distributed master private key distributed among a plurality of key issuing devices based on a share of the first random number obtained by distributing the first random number to be kept secret and a share of the second random number obtained by distributing the second random number to be kept secret; using the distributed master private key and user identification information, generate a distributed user private key in a state in which the user private key of the user is distributed, the user private key being obtained using the distributed user private keys obtained from a plurality of key issuing devices, and at that time, obtain a share of a third random number in a state in which a third random number that is kept secret and is an element of the user private key is kept distributed, and a share of a fourth random number in a state in which a fourth random number that is kept secret is kept distributed, multiplying each of the share of the first random number that is an element of the distributed master private key, the share of the second random number that is an element of the distributed master private key, and the share of the third random number that is an element of the distributed master private key by the share of the fourth random number, and generating the distributed user private key based on the product obtained as a result of the multiplication; sending the distributed user private keys to user devices of the users; Key issuing method.

11. Each of the multiple key issuing devices generating at least a distributed master private key distributed among a plurality of key issuing devices based on a share of the first random number obtained by distributing the first random number to be kept secret and a share of the second random number obtained by distributing the second random number to be kept secret; using the distributed master private key and user identification information, generate a distributed user private key in a state in which the user private key of the user is distributed, the user private key being obtained using the distributed user private keys obtained from a plurality of key issuing devices, and at that time, obtain a share of a third random number in a state in which a third random number that is kept secret and is an element of the user private key is kept distributed, and a share of a fourth random number in a state in which a fourth random number that is kept secret is kept distributed, multiplying each of the share of the first random number that is an element of the distributed master private key, the share of the second random number that is an element of the distributed master private key, and the share of the third random number that is an element of the distributed master private key by the share of the fourth random number, and generating the distributed user private key based on the product obtained as a result of the multiplication; Sending the distributed user private keys to user devices of the users; by the user device, generating the user private key using the shared user private keys obtained from a plurality of the key issuing devices; generating a re-encryption key using the user private key; Decrypt the ciphertext to obtain the plaintext, re-encrypting, by a re-encryption device, the ciphertext decodable by the user private key for the first user device, without decrypting it, using the re-encryption key for making the ciphertext decodable by the first user device decodable by the second user device; decrypting the re-encrypted ciphertext by the second user device using the user private key for the second user device; Information processing methods.

12. generating at least a distributed master private key in a state in which the first random number to be kept secret is distributed, based on a share of the first random number and a share of the second random number to be kept secret is distributed, the distributed master private key being distributed among a plurality of key issuing devices; a step of generating a distributed user private key using the distributed master private key and user identification information, the distributed user private key being in a state in which the user private key of the user is distributed, the user private key being obtained using the distributed user private keys obtained from a plurality of key issuing devices, obtaining a share of a third random number in a state in which a third random number that is kept secret and is an element of the user private key is kept secret, and a share of a fourth random number in a state in which a fourth random number that is kept secret is kept secret, multiplying each of the share of the first random number that is an element of the distributed master private key, the share of the second random number that is an element of the distributed master private key, and the share of the third random number that is an element of the distributed master private key by the share of the fourth random number, and generating the distributed user private key based on a product obtained as a result of the multiplication; sending the distributed user private keys to user devices of the users; A program that causes a computer to execute the following.