Encrypted data management apparatus, conversion key generation apparatus, decryption apparatus, encrypted data conversion system, encrypted data management method, conversion key generation method, and decryption method

Abstract

This encrypted data management apparatus (100) comprises a conversion unit (105) that, on the basis of a conversion source secret key for decrypting a conversion source ciphertext that is generated by encrypting a plaintext by using a GCM encryption function, and a conversion destination secret key for decrypting a conversion destination ciphertext that is generated by converting the conversion source ciphertext by using a first conversion key for converting the conversion source ciphertext, generates an intermediate tag for generating a conversion destination tag for message authentication corresponding to the conversion destination ciphertext, by converting a conversion source tag that is generated by the encryption function when generating the conversion source ciphertext.

Description

Encryption data management device, conversion key generation device, decryption device, encryption data conversion system, encryption data management method, conversion key generation method, and decryption method

[0001] This disclosure relates to an encrypted data management device, a conversion key generation device, a decryption device, an encrypted data conversion system, an encrypted data management method, a conversion key generation method, and a decryption method. In particular, it relates to a technology for converting ciphertext encrypted with symmetric-key cryptography.

[0002] GCM (Galois / Counter Mode), an authenticated encryption mode, is a means of achieving both plaintext confidentiality and message authentication, and is widely used for its efficient operation. In authenticated encryption mode, when plaintext is encrypted, additional information called a tag is generated in addition to the ciphertext. By verifying this tag during decryption, tampering with the ciphertext can be detected. Therefore, encryption using authenticated encryption mode can be said to be one way to reduce the risk of information leakage and tampering when storing sensitive data in cloud storage. However, when storing data for long periods, it is necessary to consider the decrease in the strength of the encryption method due to advances in computing and cryptography. If the encryption method used for encryption becomes compromised, it will be necessary to maintain strength by changing the encryption method.

[0003] Changing the encryption method can be achieved, for example, by decrypting the ciphertext and then re-encrypting it with the desired encryption method. However, if the ciphertext is stored in cloud storage, the private key and plaintext cannot be exposed to the cloud storage. Therefore, the temporary decryption and re-encryption of the ciphertext must be performed by the user who holds the private key. Consequently, the user with the private key needs to download and upload the ciphertext to and from the cloud storage in order to change the encryption method. Here, the larger the total size of the stored ciphertext, the greater the communication burden.

[0004] Non-Patent Document 1 discloses proxy re-encryption applicable to a common key encryption method that applies an XOR operation to a key stream and plaintext, such as a stream cipher. The key stream is a pseudo-random number sequence generated by a secret key. Proxy re-encryption is a technique for changing the secret key that can decrypt the ciphertext without exposing the plaintext. In the method of Non-Patent Document 1, it utilizes that the ciphertext C is C = P + KS with respect to the plaintext P and the key stream KS. However, the operation "+" is XOR. When generating the conversion key RK = KS + KS' using the key streams KS and KS' generated from the source secret key K and the destination secret key K', the destination ciphertext C' is obtained as C' = C + RK. In fact, since C' = C + RK = P + KS + KS + KS' = P + KS', C' is a ciphertext that can be decrypted with the destination secret key K'.

[0005] Non-Patent Document 2 discloses an algorithm conversion type common key proxy re-encryption that utilizes that the ciphertext conversion method of Non-Patent Document 1 can not only change the secret key but also change the key stream generation method, that is, the encryption method. Thereby, the user does not need to download the source ciphertext and only needs to upload the conversion key instead of the destination ciphertext. Therefore, according to Non-Patent Document 2, the communication volume can be reduced to about 1 / 2 compared with the aforementioned naive conversion method. Here, consider the encryption method conversion when the ciphertext stored in the cloud storage is a GCM ciphertext. In this encryption method conversion, the block cipher and the secret key used in the GCM encryption are changed. Since the format of the GCM ciphertext is the same as that of the stream cipher, the conversion method of Non-Patent Document 2 can be applied. On the other hand, in Non-Patent Document 2, since an attacker who does not attempt to tamper with the ciphertext is assumed, there is no mention of the tag added to the ciphertext before conversion.

[0006] D. L. Cook and A. D. Keromytis, "Conversion and Proxy Functions for Symmetic Key Ciphers," IEEE International Symposium on Information Technology: Coding and Computing (ITCC), vol. 1, pp. 662-667, 2005. Yuma Nishihira, Tatsuya Suzuki, Hidenobu Watanabe, and Toshihiro Daito, "Algorithmic Transformation Type Symmetric Key Proxy Re-encryption and its Implementation," Transactions of the Information Processing Society of Japan, vol. 64, no. 9, pp. 1241-1254, 2023.

[0007] The ciphertext conversion method disclosed in Non-Patent Document 2 can convert GCM ciphertext, but it cannot convert tags. Therefore, this ciphertext conversion method has the problem that message authentication of the source ciphertext does not function.

[0008] This disclosure aims to enable message authentication of the source ciphertext in a technology for converting GCM ciphertext by not discarding the source tag of the GCM and using the source tag to generate the destination tag.

[0009] The encrypted data management device relating to this disclosure includes a transformation unit that generates an intermediate tag for generating a destination tag for message authentication corresponding to the destination ciphertext by transforming a source tag generated by the encryption function at the time the source ciphertext is generated, based on a source secret key for decrypting a source ciphertext generated by encrypting plaintext using a GCM (Galois / Counter Mode) encryption function, and a destination secret key for decrypting a destination ciphertext generated by transforming the source ciphertext using a first transformation key for transforming the source ciphertext.

[0010] According to this disclosure, the transformation unit generates an intermediate tag by transforming the source tag, which was generated by the GCM encryption function when the source ciphertext was generated, based on the source secret key and the destination secret key. The intermediate tag may be used to generate a destination tag for message authentication corresponding to the destination ciphertext generated by transforming the source ciphertext. In other words, by utilizing this disclosure, the source tag can be used to generate the destination tag. Therefore, according to this disclosure, in a technology for transforming GCM ciphertext, message authentication of the source ciphertext can be enabled by not discarding the GCM source tag and using the source tag to generate the destination tag.

[0011] A diagram showing an example configuration of the encrypted data conversion system 10 according to Embodiment 1. A diagram showing an example configuration of the encrypted data management device 100 according to Embodiment 1. A diagram showing an example configuration of the conversion key generation device 200 according to Embodiment 1. A diagram showing an example configuration of the decryption device 300 according to Embodiment 1. A diagram showing an example hardware configuration of the encrypted data management device 100 according to Embodiment 1. A flowchart showing the operation of generating and storing auxiliary keys according to Embodiment 1. A flowchart showing the operation of converting encrypted data according to Embodiment 1. A flowchart showing the operation of decrypting converted encrypted data according to Embodiment 1. A diagram showing an example hardware configuration of the encrypted data management device 100 according to a modified example of Embodiment 1.

[0012] In the description and drawings of the embodiments, the same elements and corresponding elements are denoted by the same reference numeral. The descriptions of elements denoted by the same reference numeral are omitted or simplified as appropriate. The arrows in the figures mainly indicate the flow of data or processing. Also, "part" may be read as "circuit," "device," "equipment," "process," "step," "procedure," "processing," or "circuitry" as appropriate. The functions of each part of each device may be realized by firmware, software, hardware, or a combination thereof.

[0013] Embodiment 1. This embodiment will be described in detail below with reference to the drawings. Specifically, a configuration will be described in which the ciphertext of GCM (Galois / Counter Mode) and the encryption method of the GCM tag are converted while message authentication is enabled. In this embodiment, data encrypted with GCM is "converted". "Conversion" means changing the block cipher and private key used in GCM afterwards without exposing the private key and plaintext. "Conversion" is also called re-encryption. The key point of this embodiment is to achieve the objective by introducing two conversion keys (RK2, RK3) and an auxiliary key (h).

[0014] ***Configuration Description*** Figure 1 shows an example configuration of the encryption data conversion system 10 according to this embodiment. As shown in Figure 1, the encryption data conversion system 10 comprises an encryption data management device 100, a conversion key generation device 200, and a decryption device 300. Each device of the encryption data conversion system 10 communicates with each other via a network 11.

[0015] Figure 2 shows an example configuration of the encrypted data management device 100. As shown in Figure 2, the encrypted data management device 100 comprises elements such as a receiving unit 101, a transmitting unit 102, a metadata acquisition unit 103, an auxiliary key completion unit 104, and a conversion unit 105. The encrypted data management device 100 is equivalent to cloud storage. The receiving unit 101 receives various types of data. The transmitting unit 102 transmits various types of data. The metadata acquisition unit 103 acquires various types of metadata.

[0016] The auxiliary key completion unit 104 generates an auxiliary key h based on the partial auxiliary key η. The partial auxiliary key η is a key generated based on the source secret key K, the source block cipher E, the target secret key K', the target block cipher E', and a random number group, and is the key for generating the auxiliary key h. The auxiliary key h is the key for generating the third transformation key RK3. The source secret key K is the secret key for decrypting the source ciphertext C. The source block cipher E is used when decrypting the source ciphertext C using the GCM's decryption function. The source ciphertext C is a ciphertext generated by encrypting the plaintext P using the GCM's encryption function. The target secret key K' is the secret key for decrypting the target ciphertext C'. The target block cipher E' is used when decrypting the target ciphertext C' using the GCM's decryption function. The target ciphertext C' is a ciphertext generated by transforming the source ciphertext C using the first transformation key RK1. The first transformation key RK1 is the transformation key used to transform the source ciphertext C. The random number group consists of a number of random numbers corresponding to the maximum number of blocks in the source bit sequence R generated from the authentication data A and the source ciphertext C. The authentication data A is data that is not confidential and is subject to message authentication.

[0017] The conversion unit 105 generates an intermediate tag τ by converting the source tag T based on the source secret key K and the destination secret key K'. Specifically, the conversion unit 105 generates an intermediate tag τ based on the second conversion key RK2, the third conversion key RK3, and the source tag T. The conversion unit 105 generates the destination ciphertext C' using the first conversion key RK1 and the source ciphertext C. The conversion unit 105 generates a third conversion key RK3 based on the length of the source tag T, the authentication data A, the destination ciphertext C', and the auxiliary key h. The conversion unit 105 converts the source encrypted data, consisting of the source initialization vector IV, the authentication data A, the source ciphertext C, and the source tag T, into intermediate encrypted data consisting of the destination initialization vector IV', the authentication data A, the destination ciphertext C', and the intermediate tag τ. The source tag T is a tag generated by the GCM's encryption function when the source ciphertext C is generated. The destination tag T' is a tag for message authentication corresponding to the destination ciphertext C'. The intermediate tag τ is a tag for generating the destination tag T'. The second conversion key RK2 is a key generated based on the length of the source tag T, the first conversion key RK1, the source keystream KS0, and the destination keystream KS0', and is a key for converting the source keystream KS0 to the destination keystream KS0'. The source keystream KS0 is a keystream generated based on the source block cipher E, the source secret key K, and the source initialization vector IV corresponding to the source ciphertext C. The destination keystream KS0' is a keystream generated based on the destination block cipher E', the destination secret key K', and the destination initialization vector IV' corresponding to the destination ciphertext C'. The third conversion key RK3 is a conversion key used to convert the source subkey H to the destination subkey H'. The source subkey H is a subkey generated based on the source block cipher E and the source secret key K, and is a subkey for message authentication. The destination subkey H' is a subkey generated based on the destination block cipher E' and the destination secret key K', and is a subkey for message authentication.

[0018] Figure 3 shows an example configuration of the conversion key generation device 200. As shown in Figure 3, the conversion key generation device 200 comprises elements such as a receiving unit 201, a transmitting unit 202, an auxiliary key generation unit 204, and a conversion key generation unit 205. The receiving unit 201 receives various data. The transmitting unit 202 transmits various data.

[0019] The auxiliary key generation unit 204 generates information based on the source secret key K and the target secret key K', using pseudorandom numbers, such that the source secret key K and the target secret key K' cannot be read. Specifically, the auxiliary key generation unit 204 generates a partial auxiliary key η based on the source secret key K, the source block cipher E, the target secret key K', the target block cipher E', and a group of random numbers.

[0020] The conversion key generation unit 205 generates a first conversion key RK1 based on the source ciphertext C, the first keystream, and the second keystream. The conversion key generation unit 205 generates a second conversion key RK2 based on the length of the source tag T, the first conversion key RK1, the source keystream KS0, and the destination keystream KS0'. The first keystream is a keystream generated based on the source keystream KS0, the number of blocks in the plaintext P, the source block cipher E, and the source secret key K. The second keystream is a keystream generated based on the destination keystream KS0', the number of blocks in the plaintext P, the destination block cipher E', and the destination secret key K'.

[0021] Figure 4 shows an example configuration of the decoding device 300. As shown in Figure 4, the decoding device 300 comprises elements such as a receiving unit 301, a correction unit 304, and a decoding unit 305. The receiving unit 301 receives various types of data.

[0022] The correction unit 304 corrects the "deviation" caused by the conversion of tags using the information provided by the conversion key generation device 200. Specifically, the correction unit 304 generates a target tag T' based on the authentication data A, the target ciphertext C', the intermediate tag τ, and the random number group.

[0023] The decryption unit 305 uses the destination tag T', the destination secret key K', and the destination block cipher E' to decrypt the destination encrypted data, which consists of the destination initialization vector IV' corresponding to the destination ciphertext C', authentication data A, the destination ciphertext C', and the destination tag T', using the GCM's decryption function.

[0024] Figure 5 shows an example of the hardware configuration of the encrypted data management device 100 according to this embodiment. The encrypted data management device 100 consists of a computer. The encrypted data management device 100 may consist of multiple computers.

[0025] As shown in this figure, the encrypted data management device 100 is a computer equipped with hardware such as a processor 1, memory 2, auxiliary storage device 3, input / output interface (IF) 4, and communication device 5. These hardware components are appropriately connected via signal lines 9.

[0026] Processor 1 is an IC (Integrated Circuit) that performs arithmetic processing and controls the hardware of the computer. Specific examples of Processor 1 include a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit). The encrypted data management device 100 may include multiple processors that replace Processor 1. The multiple processors share the role of Processor 1.

[0027] Memory 2 is typically a volatile storage device, specifically RAM (Random Access Memory). Memory 2 is also called main memory. Data stored in memory 2 is saved to auxiliary storage device 3 as needed.

[0028] The auxiliary storage device 3 is typically a non-volatile storage device, specifically a ROM (Read Only Memory), HDD (Hard Disk Drive), or flash memory. Data stored in the auxiliary storage device 3 is loaded into memory 2 as needed. Memory 2 and the auxiliary storage device 3 may be configured as an integrated unit.

[0029] Input / Output IF4 is a port to which input and output devices are connected. A specific example of an input / output IF4 is a USB (Universal Serial Bus) terminal. Specific examples of input devices include a keyboard and mouse. A specific example of an output device is a display.

[0030] Communication device 5 consists of a receiver and a transmitter. Specific examples of communication device 5 include a communication chip or a NIC (Network Interface Card).

[0031] Each part of the encrypted data management device 100 may use the input / output IF 4 and the communication device 5 as appropriate when communicating with other devices, etc.

[0032] The auxiliary storage device 3 stores the encrypted data conversion program. The encrypted data conversion program is a program that enables the computer to implement the functions of each part of the encrypted data management device 100. The encrypted data conversion program is loaded into memory 2 and executed by processor 1.

[0033] The data used when executing the encrypted data conversion program, and the data obtained by executing the encrypted data conversion program, are appropriately stored in the storage device. Each part of the encrypted data management device 100 makes appropriate use of the storage device. The storage device consists of, as a specific example, memory 2, auxiliary storage device 3, registers in the processor 1, and at least one of the cache memory in the processor 1. Note that the terms data and information may have the same meaning. The storage device may be independent of the computer. The functions of memory 2 and auxiliary storage device 3 may be implemented by other storage devices.

[0034] The encryption data conversion program may be recorded on a computer-readable non-volatile recording medium. Specific examples of non-volatile recording media include optical discs or flash memory. The encryption data conversion program may be provided as a program product. The hardware configurations of the conversion key generation device 200 and the decryption device 300 may be the same as those of the encryption data management device 100.

[0035] ***Explanation of Operation*** The operation procedure of the encrypted data management device 100 corresponds to the encrypted data management method. The operation procedure of the conversion key generation device 200 corresponds to the conversion key generation method. The operation procedure of the decryption device 300 corresponds to the decryption method. The operation procedures of each device in the encrypted data conversion system 10 are collectively called the encrypted data conversion method. In addition, the program that realizes the operation of each device in the encrypted data conversion system 10 is collectively called the encrypted data conversion program.

[0036] First, let's introduce some symbols and terms. `len(X)` represents the number of bits in bit sequence X. `X||Y` represents the concatenation of bit sequence X and bit sequence Y. `0^n` represents a bit sequence consisting of n zeros. `ceil(n)` represents the ceiling function. A block refers to a 128-bit bit sequence. The number of blocks in bit sequence X is `ceil(len(X) / 128)`. `E(K,X)` represents a block cipher using the secret key K. That is, `E` returns a block obtained by transforming block X with the secret key K. `inc32(X)` is a function that returns a block obtained by adding 1 to the lower 32 bits of block X. `MSB(n,X)` is a function that returns the upper n bits of bit sequence X. `LSB(n,X)` is a function that returns the lower n bits of bit sequence X. `[n]64` represents a 64-bit bit sequence encoded from the integer n. <X>128 represents a bit sequence of 128 * ceil(len(X) / 128) bits, obtained by padding the end of the bit sequence X with zeros. GHASH(H,X) is a function that returns a block calculated from block H and bit sequence X. Specifically, if each block Xi that makes up X (where i is an integer between 1 and n) is X = Xn||...||X2||X1, then GHASH(H,X) returns Xn*H^n + ... + X2*H^2 + X1*H^1. However, the operation "+" is XOR. IPROD(X,Y) is a function that returns a block calculated from bit sequence X and bit sequence Y. Specifically, if each block Xi constituting X is X = Xn||...||X2||X1, and each block Yi constituting Y is Y = Yn||...||Y2||Y1, then IPROD(X,Y) calculates Xn*Yn + ... + X2*Y2 + X1*Y1. Additional Authenticated Data (AAD) is data that is not secret but is subject to message authentication. AAD may be an empty string. Encrypted data refers to a set of initialization vector, AAD, ciphertext, and tags (IV, A, C, T).

[0037] This section explains GCM. GCM consists of an encryption function AE and a decryption function AD. The encryption function AE calculates the ciphertext C and tag T from the inputs of an initialization vector IV, AAD A, and plaintext P. Hereafter, (C, T) will be written as AE(E, K, IV, A, P), where E is the block cipher used in AE. The decryption function AD returns either plaintext P or FAIL from the inputs of IV, A, C, and T. Hereafter, P or FAIL will be written as AD(E, K, IV, A, C, T), where E is the block cipher used in AD. AD returns P if A and C are consistent with T, and FAIL otherwise.

[0038] This section explains how to generate ciphertext C and tag T in GCM. A block cipher E is used to calculate subkey H = E(K, 0^128). Since Subkey H plays an important role in message authentication, it needs to be kept secret, just like the private key K. H corresponds to the source subkey. First, block J0 is calculated from H and IV, and blocks J1, J2, ..., Jn are calculated as Ji + 1 = inc32(Ji). Note that the specific calculation procedure for J0 is not directly related to the conversion of GCM tags. Next, keystream KS0 is calculated as KS0 = E(K, J0), and keystream KS is calculated as KS = E(K, J1) || E(K, J2) || ... || E(K, Jn). At this time, the ciphertext C is obtained as C = P + MSB(len(P), KS). Let n be the number of blocks in the plaintext P. Next, let the bit string R be R = 128||<C>128||[len(A)]64||[len(C)]64. Then, the tag T is obtained as T = MSB(t, GHASH(H, R) + KS0), where t is one of the parameters and represents the length of the tag.

[0039] When the target secret key is K' and the target block cipher is E', the objective of this embodiment is to convert encrypted data (IV, A, C, T) that can be decrypted by AD(E, K, IV, A, C, T) into encrypted data (IV', A, C', T') that can be decrypted by AD(E', K', IV', A, C', T').

[0040] This section describes how to transform a GCM ciphertext C. First, the user receives the source initialization vector IV and the length of the source ciphertext, len(C), from the cloud storage. The user also generates the target initialization vector IV'. Here, the user is the one using the cloud storage. Furthermore, IV' only needs to be generated in such a way that it satisfies the condition required in conventional GCM, which is that "IV must not be reused". More specifically, IV' only needs to be generated in such a way that it satisfies the condition that "the combination of the secret key K and the initialization vector IV must not be used multiple times for encryption". For example, IV' may be set to IV = IV, IV' may be randomly generated using a pseudorandom number generator, or IV' may be a value that is counted up from a certain value. Next, the user generates (H, KS) from (E, K, IV) in the same way as GCM encryption. The user also generates (H', KS') from (E', K', IV'). H' corresponds to the target subkey. Here, the first conversion key RK1 is set to RK1 = MSB(len(C), KS + KS'), and RK1 is sent to the cloud storage. The cloud storage uses RK1 to obtain the target ciphertext C' = C + RK1.

[0041] This section describes how to convert the GCM tag T. Two conversion keys (RK2 and RK3) are used to convert tag T, and in addition, tag correction is performed before calling the decryption function AD during decryption. When the source tag T is T = MSB(t, GHASH(H, R) + KS0), the destination tag T' becomes T' = MSB(t, GHASH(H', R') + KS0'). Here, KS0' is a keystream generated from (E', K') and IV' in the same way as the method for generating KS0 in the generation of ciphertext C. R' is a bit sequence obtained by changing C in R to C'. Hereafter, first, the second conversion key RK2 is constructed as a conversion key that changes R to R' and KS0 to KS0'. Subsequently, the third conversion key RK3 is constructed as a conversion key that changes H to H'.

[0042] The method for generating the second transformation key RK2 will now be explained. The user generates KS0 from (E, K) and IV, and generates KS0' from (E', K') and IV', using the same method as when generating the ciphertext C. Here, using the first transformation key RK1 generated to transform the ciphertext C, the second transformation key RK2 is defined as RK2 = MSB(t, GHASH(H, <RK1>128||0^128) + KS0 + KS0'). Adding RK2 to T gives T + RK2 = MSB(t, GHASH(H, R') + KS0').

[0043] The method for generating the third transformation key RK3 is described below. Unlike other transformation keys, RK3 is generated in cloud storage. Furthermore, the generation of RK3 requires the target ciphertext C' and a partial auxiliary key η provided by the user. The user obtains the maximum size of the encrypted data from cloud storage. Specifically, the maximum size is an integer L that satisfies len(128 + <C>128) / 128 + 1 ≤ L for any stored encrypted data (IV, A, C, T). In other words, L is the maximum number of blocks in the bit sequence R generated from A and C. For simplicity, the following explanation assumes that L is an even number. If L is an odd number, you may add 1 to L. First, the user selects a seed s and generates blocks r1, r2, ..., rl of l = L / 2 using a pseudorandom number generator. That is, the user generates a group of random numbers consisting of a number of random numbers corresponding to the maximum number of blocks in the source bit sequence R. Note that s must be kept secret, just like the private key and the subkey. Next, the user generates a partial auxiliary key η = (η1, η2, ..., ηl) using the subkeys H and H' and the pseudo-random number blocks r1, r2, ..., rl. Here, the block ηi (where i is an integer between 1 and l, inclusive) which is an element of η, is ηi = H^(2i-1) + H'^(2i-1) + ri. The user sends η to the cloud storage. Next, the cloud storage generates an auxiliary key h = hL||...||h2||h1 from η. Here, the block hi that makes up h is hi = ηj, j = (i+1) / 2 when i is odd, and hi = hj^2, j = i / 2 when i is even. Here, R' is constructed from A and C', and the third transformation key RK3 is derived from h and R' as RK3 = MSB(t, IPROD(LSB(len(R'), h), R')). The τ obtained by adding RK2 and RK3 to T can be written as τ = T + RK2 + RK3 = T' + MSB(t, δ) such that there exists a block δ. Cloud storage updates encrypted data (IV, A, C, T) to (IV', A, C', τ). τ is also called an intermediate tag.

[0044] A method for decrypting the updated encrypted data (IV', A, C', τ) will be described. First, the user receives the encrypted data (IV', A, C', τ) from the cloud storage and constructs R' from A and C'. Next, the user regenerates the pseudo-random numbers r1, r2, …, rl using the seed s used in the generation of the partial auxiliary key η, and generates the bit sequence ρ = ρL || … || ρ2 || ρ1 using these. Here, the block ρi constituting ρ is ρi = rj, j = (i + 1) / 2 when i is odd, and ρi = ρj ^ 2, j = i / 2 when i is even. At this time, the block δ included in τ is δ = IPROD(LSB(len(R'), ρ), R'). Next, the user generates T' by adding δ to τ, and executes AD(E', K', IV', A, C', T'(= τ + MSB(t, δ))) using the GCM decryption function AD.

[0045] This section describes the amount of communication between the user and cloud storage. In a naive approach, the user needs to repeatedly receive encrypted data (IV, A, C, T) from cloud storage and send recalculated data (IV', C', T') to cloud storage for each encrypted data item. Here, AAD A needs to be obtained because it is necessary for GCM decryption, but it does not need to be sent back to cloud storage because it is not modified. Therefore, if N is the number of encrypted data items to be converted, the total amount of communication is Σ_{i=1}^N len(IVi||Ai||Ci||Ti||IV'i||C'i||T'i). In this embodiment, for each encrypted data item (IV, A, C, T) to be converted, the user needs to receive IV and send (IV', RK1, RK2). On the other hand, since the partial auxiliary key η does not depend on the encrypted data, η only needs to be sent once in advance, regardless of the number of encrypted data items. Therefore, the total amount of data transmitted is len(η) + Σ_{i=1}^N len(IVi||IV'i||RK1i||RK2i). Here, len(RK1) = len(C), len(RK2) = len(T), and len(η) = 128l. len(η) is approximately half the maximum size of the encrypted data. Consequently, the method of this embodiment uses less data than the naive method.

[0046] The operation of the encrypted data conversion system 10 will be explained based on Figure 1. The encrypted data management device 100 stores one or more encrypted data (IV, A, C, T) encrypted with GCM. The conversion key generation device 200 stores a source secret key K and a source block cipher E that can decrypt the encrypted data stored in the encrypted data management device 100. Furthermore, the conversion key generation device 200 stores a destination secret key K', a destination block cipher E', and a seed s. The decryption device 300 stores K', E', and s. The K, E, K', E', and s stored in the conversion key generation device 200 and the K', E', and s stored in the decryption device 300 may be set by inputting them into each device.

[0047] The encrypted data management device 100 calculates the maximum size L of the stored encrypted data, and transmits L to the conversion key generation device 200. The conversion key generation device 200 generates a partial auxiliary key η using the received L, the stored K, E, K', E', and s, and transmits η to the encrypted data management device 100. The encrypted data management device 100 generates an auxiliary key h using the received η and stores h.

[0048] The encrypted data management device 100 transmits the initialization vector IV of the encrypted data (IV, A, C, T) and the ciphertext size len(C) to the conversion key generation device 200. The conversion key generation device 200 generates a conversion destination initialization vector IV'. Also, the conversion key generation device 200 generates a first conversion key RK1 and a second conversion key RK2 using IV', the received IV and len(C), and the stored K, E, K', E', and s, and transmits IV', RK1, and RK2 to the encrypted data management device 100. The encrypted data management device 100 generates a conversion destination ciphertext C' using the received RK1 and the source ciphertext C. Also, the encrypted data management device 100 generates a third conversion key RK3 using AAD A, C', and the auxiliary key h. Then, the encrypted data management device 100 generates a tag τ using RK3 and the received RK2, and updates (IV, A, C, T) to the encrypted data (IV', A, C', τ). [[ID=G4]]

[0049] The encrypted data management device 100 transmits the updated encrypted data (IV', A, C', τ) to the decryption device 300. The decryption device 300 corrects the tag τ using the conversion destination ciphertext C' of the received (IV', A, C', τ) and the seed s to generate a conversion destination tag T'. Finally, the decryption device 300 decrypts the encrypted data (IV', A, C', T') corrected by the GCM decryption function AD(E', K', IV', A, C', T') using the conversion destination secret key K' and the conversion destination block cipher E'.

[0050] Based on the flowchart shown in FIG. 6, an example of the operation of generating and storing the auxiliary key h will be described. The generation and storage of the auxiliary key h are processes executed by the conversion key generation device 200 and the encrypted data management device 100.

[0051] (Step S101) The metadata acquisition unit 103 calculates the maximum size L of the stored encrypted data in accordance with the request of the conversion key generation device 200 and transmits L to the conversion key generation device 200.

[0052] (Step S102) The receiving unit 201 receives L. The auxiliary key generation unit 204 acquires L received by the receiving unit 201. The auxiliary key generation unit 204 also acquires the stored source secret key K, source block cipher E, destination secret key K', destination block cipher E', and seed s.

[0053] (Step S103) The auxiliary key generation unit 204 generates a partial auxiliary key η from the acquired L, K, E, K', E', and s, and transmits η to the encrypted data management device 100.

[0054] (Step S104) The receiving unit 101 receives η. The auxiliary key completion unit 104 obtains η received by the receiving unit 101 and generates an auxiliary key h from η.

[0055] (Step S105) The auxiliary key replacement unit 104 stores h.

[0056] An example of the operation of encrypted data conversion will be explained based on the flowchart shown in Figure 7. The conversion of encrypted data is a process performed by the encrypted data management device 100 and the conversion key generation device 200.

[0057] (Step S201) The metadata acquisition unit 103 acquires the stored encrypted data (IV, A, C, T) in accordance with the request of the conversion key generation device 200, and transmits the initialization vector IV and the ciphertext size len(C) to the conversion key generation device 200.

[0058] (Step S202) The receiving unit 201 receives IV and len(C). The conversion key generation unit 205 acquires IV and len(C) received by the receiving unit 201. The conversion key generation unit 205 also acquires the stored source secret key K, source block cipher E, destination secret key K', and destination block cipher E'.

[0059] (Step S203) The conversion key generation unit 205 generates the conversion target initialization vector IV'.

[0060] (Step S204) The conversion key generation unit 205 generates a first conversion key RK1 and a second conversion key RK2 from the acquired IV, IV', K, E, K', E', and len(C), and transmits IV', RK1, and RK2 to the encrypted data management device 100.

[0061] (Step S205) The receiving unit 101 receives IV', RK1 and RK2.

[0062] (Step S206) The conversion unit 105 generates a target ciphertext C' using the received RK1 and the acquired source ciphertext C.

[0063] (Step S207) The conversion unit 105 obtains the stored auxiliary key h and generates a third conversion key RK3 from the generated C' and h.

[0064] (Step S208) The conversion unit 105 generates a tag τ from the received RK2, the generated RK3, and the acquired source tag T.

[0065] (Step S209) The conversion unit 105 updates the stored encrypted data (IV, A, C, T) to (IV', A, C', τ). (IV', A, C', τ) corresponds to intermediate encrypted data.

[0066] An example of the decryption operation of converted encrypted data will be explained based on the flowchart shown in Figure 8. Decryption of converted encrypted data is a process performed by the encrypted data management device 100 and the decryption device 300.

[0067] (Step S301) The transmission unit 102 transmits the converted encrypted data (IV', A, C', τ) to the decryption device 300.

[0068] (Step S302) The receiving unit 301 receives (IV', A, C', τ).

[0069] (Step S303) The correction unit 304 obtains the stored seed s and generates a destination tag T' from the received A, C', τ, and s.

[0070] (Step S304) The decryption unit 305 obtains the stored target secret key K' and the target block cipher E', and uses the generated T', K' and E' to decrypt (IV', A, C', T'). (IV', A, C', T') corresponds to the target encrypted data.

[0071] ***Explanation of the Effects of Embodiment 1*** According to this embodiment, by converting the GCM ciphertext stored in cloud storage, the block cipher and secret key that can decrypt the ciphertext can be changed. Here, in this embodiment, the message authentication before conversion can be maintained even after conversion. In other words, according to this embodiment, even if the source ciphertext is tampered with, the tampering of the source ciphertext can be detected in the decryption of the target ciphertext. Therefore, according to this embodiment, security is improved compared to the conventional technology. Furthermore, according to this embodiment, the amount of communication is less compared to the naive method of downloading the ciphertext before conversion from cloud storage.

[0072] ***Other Configurations*** <Variation 1> A Deterministic Random Bit Generator (DRBG) may be used as the pseudorandom number generator used to generate the partial auxiliary key. Seed Homomorphic Pseudorandom Generators may be used as the pseudorandom number generator used to generate the partial auxiliary key. In this case, the number of seeds to be stored can be limited to one. The partial auxiliary key may be generated using the target secret key and the target block cipher. Instead of a seed, pseudorandom numbers generated using a seed may be stored, and the partial auxiliary key may be generated using the stored pseudorandom numbers. Furthermore, by storing the seed used to convert the encrypted data, it is possible to convert the encrypted data multiple times.

[0073] <Modification 2> Figure 9 shows an example of the hardware configuration of the encrypted data management device 100 according to this modification. The encrypted data management device 100 includes a processing circuit 8 instead of a processor 1, a processor 1 and memory 2, a processor 1 and auxiliary storage device 3, or a processor 1, memory 2 and auxiliary storage device 3. The processing circuit 8 is hardware that realizes at least a part of each part of the encrypted data management device 100. The processing circuit 8 may be dedicated hardware, or it may be a processor that executes a program stored in memory 2.

[0074] If the processing circuit 8 is dedicated hardware, specific examples of the processing circuit 8 include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The encrypted data management device 100 may also include multiple processing circuits that substitute for the processing circuit 8. The multiple processing circuits share the role of the processing circuit 8.

[0075] In the encrypted data management device 100, some functions may be implemented by dedicated hardware, while the remaining functions may be implemented by software or firmware.

[0076] The processing circuit 8 can be implemented, in specific examples, by hardware, software, firmware, or a combination thereof. The processor 1, memory 2, auxiliary storage device 3, and processing circuit 8 are collectively referred to as the "processing circuitry." In other words, the functions of each functional component of the encrypted data management device 100 are implemented by the processing circuitry. The hardware configurations of the conversion key generation device 200 and the decryption device 300 may be the same as those of this modified example.

[0077] ***Other Embodiments*** Although Embodiment 1 has been described, multiple parts of this embodiment may be combined and implemented. Alternatively, this embodiment may be implemented partially. Furthermore, this embodiment may be modified in various ways as needed, and may be implemented as a whole or in parts in any combination. Note that the embodiments described above are essentially preferred examples and are not intended to limit this disclosure, its applications, or the scope of use. Procedures described using flowcharts, etc., may be modified as appropriate.

[0078] 1 Processor, 2 Memory, 3 Auxiliary storage device, 4 Input / Output IF, 5 Communication device, 8 Processing circuit, 9 Signal line, 10 Encryption data conversion system, 11 Network, 100 Encryption data management device, 101 Receiving unit, 102 Transmitting unit, 103 Metadata acquisition unit, 104 Auxiliary key completion unit, 105 Conversion unit, 200 Conversion key generation device, 201 Receiving unit, 202 Transmitting unit, 204 Auxiliary key generation unit, 205 Conversion key generation unit, 300 Decryption device, 301 Receiving unit, 304 Correction unit, 305 Decryption unit.

Claims

1. An encrypted data management device comprising a transformation unit that generates an intermediate tag for generating a destination tag for message authentication corresponding to the destination ciphertext by transforming a source tag generated by the encryption function at the time the source ciphertext is generated, based on a source secret key for decrypting a source ciphertext generated by encrypting plaintext using a GCM (Galois / Counter Mode) encryption function, and a destination secret key for decrypting a destination ciphertext generated by transforming the source ciphertext using a first transformation key for transforming the source ciphertext.

2. The encrypted data management device further includes an auxiliary key completion unit that generates an auxiliary key based on a partial auxiliary key generated based on a random number group consisting of a number of random numbers corresponding to the maximum number of blocks in the source bit sequence generated from the source ciphertext, authentication data which is data that is not concealed and is subject to message authentication, and the source ciphertext; the conversion unit generates the destination ciphertext using the first conversion key and the source ciphertext; and generates a third conversion key based on the length of the source tag, the authentication data, the destination ciphertext, and the auxiliary key, for converting the source subkey for message authentication generated based on the source block cipher and the source secret key into a destination subkey for message authentication generated based on the destination block cipher and the destination secret key. The encrypted data management device according to claim 1, which generates the intermediate tag based on the length of the source tag, the first conversion key, a source keystream generated based on the source block cipher, the source secret key, and the source initialization vector corresponding to the source ciphertext, a destination keystream generated based on the destination block cipher, the destination secret key, and the destination initialization vector corresponding to the destination ciphertext, a second conversion key which is a key for converting the source keystream to the destination keystream, the third conversion key, and the source tag.

3. The encryption data management device according to claim 2, wherein the conversion unit converts source encrypted data, consisting of the source initialization vector, the authentication data, the source ciphertext, and the source tag, into intermediate encrypted data, consisting of the destination initialization vector, the authentication data, the destination ciphertext, and the intermediate tag.

4. A key transformation device comprising: a source secret key for decrypting a source ciphertext generated by encrypting plaintext using a GCM (Galois / Counter Mode) encryption function; a source block cipher used when decrypting the source ciphertext using the GCM decryption function; a destination secret key for decrypting a destination ciphertext generated by transforming the source ciphertext using a first transformation key for transforming the source ciphertext; a destination block cipher used when decrypting the destination ciphertext using the decryption function; and a group of random numbers consisting of a number of random numbers corresponding to the maximum number of blocks in the source bit sequence generated from the source ciphertext and the source secret key, wherein the source subkey for message authentication generated based on the source block cipher and the source secret key generates a third transformation key for generating a destination subkey for message authentication generated based on the destination block cipher and the destination secret key.

5. The conversion key generation device according to claim 4, further comprising: a conversion key generation unit that generates a first conversion key based on the source ciphertext, a source keystream generated based on the source block cipher, the source secret key, and the source initialization vector corresponding to the source ciphertext, a keystream generated based on the number of blocks in the plaintext, the source block cipher, and the source secret key, a destination keystream generated based on the destination block cipher, the destination secret key, and the destination initialization vector corresponding to the destination ciphertext, a keystream generated based on the number of blocks in the plaintext, the destination block cipher, and the destination secret key; and a conversion key generation unit that generates a second conversion key for converting the source keystream to the destination keystream based on the length of the source tag generated by the encryption function when the source ciphertext was generated, the first conversion key, the source keystream, and the destination keystream.

6. Authentication data which is non-confidential data and is subject to message authentication; a target ciphertext generated by transforming the source ciphertext, which is generated by encrypting plaintext using a GCM (Galois / Counter Mode) encryption function, using a first transformation key for transforming the source ciphertext; an intermediate tag which is a tag generated by transforming the source tag generated by the encryption function at the time of generating the source ciphertext, based on a source secret key for decrypting the source ciphertext and a target secret key for decrypting the target ciphertext, and is a tag for generating a target tag for message authentication corresponding to the target ciphertext; A decryption device comprising a correction unit that generates a destination tag for message authentication corresponding to the destination ciphertext, based on a group of random numbers used when generating a third transformation key for converting a source subkey for message authentication, which is generated based on a source block cipher and a source secret key used when decrypting the source ciphertext by the GCM's decryption function, into a destination subkey for message authentication, which is generated based on a destination block cipher and a destination secret key used when decrypting the destination ciphertext by the decryption function.

7. The decryption device according to claim 6, further comprising a decryption unit that uses the destination tag, the destination secret key, and the destination block cipher to decrypt destination encrypted data consisting of a destination initialization vector corresponding to the destination ciphertext, the authentication data, the destination ciphertext, and the destination tag, using the decryption function.

8. An encrypted data conversion system comprising an encrypted data management device according to any one of claims 1 to 3, a conversion key generation device according to claim 4 or 5, and a decryption device according to claim 6 or 7.

9. An encrypted data management method in which a computer-based encrypted data management device generates an intermediate tag for generating a destination tag for message authentication corresponding to the destination ciphertext by converting a source tag generated by the encryption function at the time the source ciphertext is generated, based on a source secret key for decrypting a source ciphertext generated by encrypting plaintext using a GCM (Galois / Counter Mode) encryption function and a destination secret key for decrypting a destination ciphertext generated by converting the source ciphertext using a first conversion key for converting the source ciphertext.

10. The auxiliary key generation unit of the computer-based conversion key generation device generates a source secret key for decrypting the source ciphertext generated by encrypting plaintext using the GCM (Galois / Counter Mode) encryption function; a source block cipher used when decrypting the source ciphertext using the GCM decryption function; a destination secret key for decrypting the destination ciphertext generated by transforming the source ciphertext using the first conversion key for transforming the source ciphertext; and a destination block cipher used when decrypting the destination ciphertext using the decryption function. A conversion key generation method that generates a partial auxiliary key for generating an auxiliary key for generating a third conversion 11. The correction unit of the decryption device, which is a computer, includes authentication data which is data that is not confidential and is subject to message authentication, a destination ciphertext generated by transforming the source ciphertext using a first transformation key for transforming the source ciphertext which was generated by encrypting the plaintext using the GCM (Galois / Counter Mode) encryption function, an intermediate tag which is a tag generated by transforming the source tag generated by the encryption function when the source ciphertext was generated based on the source secret key for decrypting the source ciphertext and the destination secret key for decrypting the destination ciphertext, and is a tag for generating a destination tag for message authentication corresponding to the destination ciphertext, A decryption method for generating a destination tag for message authentication corresponding to the destination ciphertext, based on a group of random numbers used when generating a third transformation key for converting a source subkey for message authentication, which is generated based on a source block cipher and a source secret key used when decrypting the source ciphertext using the GCM decryption function, into a destination subkey for message authentication, which is generated based on a destination block cipher and a destination secret key used when decrypting the destination ciphertext using the decryption function.

Images