Patent Grant
9842086
The present invention relates to a cryptographic technique, particularly to a self-correcting technique.
A self-correcting technique is one of cryptographic techniques (refer to Patent Literature 1 and Patent Literature 2, for example). The self-correcting technique is a technique for performing correct calculation at all time by using a calculator or a system which does not always output a correct calculation result (when a calculator which outputs a correct calculation result is used, a correct calculation result is outputted, and when a calculator which does not always output a correct result is used, a correct calculation result is obtained or a result representing that the calculation is impossible is obtained). For example, in a cloud-key management type decryption technique employing the self-correcting technique, a decryption capability provision device which holds a decryption key provides a decryption device only with information, by which the decryption device decrypts a cipher text, without providing the decryption device with the decryption key. The decryption device can always perform correct decryption calculation with this information.
Patent literature 1: International Publication No. WO/2011/086992
Patent literature 2: International Publication No. WO/2012/057134
However, in the self-correcting technique described on Patent Literature 1 and Patent Literature 2, two natural numbers a and b which are coprime are used and ub′va′ for integers a′ and b′ which satisfy the relation of a′a+b′b=1 is obtained. When a and b is not coprime or a′ and b′ do not satisfy the relation of a′a+b′b=1, this self-correcting technique is not available.
In view of such problem, an object of the present invention is to provide a self-correcting technique exhibiting high flexibility in setting.
In the present invention, f(x)bx1 is calculable, a calculation result of f(x)bx1 is denoted as u, f(x)ax2 is calculable, a calculation result of f(x)ax2 is denoted as v, and (ub′va′)1/d for d=a′a+b′b is outputted in a case where the calculation results u and v satisfy ua=vb.
The self-correcting technique of the present invention is available in such cases where a and b is not coprime and a′ and b′ do not satisfy the relation of a′a+b′b=1 because (ub′va′)1/d for d=a′a+b′b is obtained. Thus, the self-correcting technique of the present invention exhibits high flexibility in setting.
Embodiments of the present invention will be described below with reference to the accompanying drawings.
[First Embodiment]
<Configuration>
As illustrated in
This program may be installed on the computer or may be recorded in a ROM or the like in advance. Further, a part or all processing units may be constituted by using an electronic circuit which independently realizes the processing configuration instead of an electronic circuit (circuitry), which realizes the functional configuration when a program is read in, such as a CPU. Furthermore, an electronic circuit constituting a single piece of device may include a plurality of CPUs.
<Processing>
As illustrated in
The control unit 118 sets t=1 (step S102).
The first randomizable sampler 121 is capable of calculating f(x)bx1. The first randomizable sampler 121 performs calculation by using x and b and sets the calculation result to u (step S103). A specific example of the calculation result u will be described later. The calculation result u is transmitted to the first power calculation unit 113. In this application, the expression “capable of calculating” represents that calculation can be correctly performed with a probability which is equal to or larger than a non-negligible probability. The non-negligible probability represents a probability which is equal to or larger than 1/F(k) when a polynomial which is a broadly monotonic function for a security parameter k (here, k is a positive natural number) is set to a polynomial F(k). An example of the broadly monotonic function is a monotonically non-decreasing function (non-decreasing function). Here, to calculate f(x)bx1 represents to obtain a value of a formula which is defined as f(x)bx1. As long as a value of the formula f(x)bx1 can be finally obtained, a calculation method does not matter. The same goes for calculation of other formulas which will appear in this application. Further, in this application, calculation which is defined by a group is expressed in a multiplicative manner.
The first power calculation unit 113 calculates u′=ua (step S104). A pair (u,u′) of the calculation result u and u′ which is obtained by calculation based on the calculation result u is stored in the first list storage unit 114.
The determination unit 115 determines whether or not there is a pair which satisfies u′=v′ among pairs (u,u′) which are stored in the first list storage unit 114 and pairs (v,v′) which are stored in the second list storage unit 117 (step S105). If pairs (v,v′) are not stored in the second list storage unit 117, processing of following step S106 is performed without performing the processing of step S105. When there is a pair which satisfies u′=v′, the process goes to step S112. When there is not a pair which satisfies u′=v′, the process goes to step S106.
The second randomizable sampler 122 is capable of calculating f(x)ax2. The second randomizable sampler 122 performs calculation by using x and a and sets the calculation result to v (step S106). A specific example of the calculation result v will be described later. The calculation result v is transmitted to the second power calculation unit 116. The second power calculation unit 116 calculates v′=vb (step S107). A pair (v,v′) of the calculation result v and v′ which is obtained by calculation based on the calculation result v is stored in the second list storage unit 117.
The determination unit 115 determines whether or not there is a pair which satisfies u′=v′ among pairs (u,u′) which are stored in the first list storage unit 114 and pairs (v,v′) which are stored in the second list storage unit 117 (step S108). When there is a pair which satisfies u′=v′, the process goes to step S112. When there is not a pair which satisfies u′=v′, the process goes to step S110.
The control unit 118 determines whether or not t=T is satisfied (step S110). T denotes a predetermined positive natural number. When t=T is satisfied, the control unit 118 outputs information representing that calculation is impossible, for example, outputs a symbol “⊥” (step S111) and the processing is ended. The information representing that calculation is impossible (the symbol “⊥” in this example) represents that reliability of performance of correct calculation is below a reference which is defined by T. In other words, the information represents that calculation has not been able to be correctly performed in T-time repetitions. When t=T is not satisfied, the control unit 118 increments t by 1, that is, sets as t=t+1 (step S109) and the process returns to step S103.
When it is determined that u′=v′ is satisfied, the final calculation unit 119 calculates d=a′a+b′b (step S112) and calculates (ub′va′)1/d by using u and v which correspond to u′ and v′, and a′, b′, and d so as to output ub′va′)1/d (step S113). That is, the final calculation unit 119 obtains d=a′a+b′b and outputs (ub′va′)1/d for d. The outputted (ub′va′)1/d satisfies (ub′va′)1/d=f(x). The reason will be described below.
<<Reason Why (ub′va′)1/d=f(x) is satisfied>>
As disclosed in Patent Literature 1 and Patent Literature 2, if u′=v′ holds, that is, if ua=vb holds, it is highly probable that the first randomizable sampler has correctly computed u=f(x)b, the second randomizable sampler has correctly computed v=f(x)a, and x1 and x2 are identity elements eg of the group G. When the first randomizable sampler 121 correctly calculates u=f(x)bx1, further, the second randomizable sampler 122 correctly calculates v=f(x)ax2, and x1 and x2 are identity elements eg of the group G, ub′va′=(f(x)bx1)b′(f(x)ax2)a′=(f(x)beg)b′(f(x)aeg)a′=f(x)bb′egb′f(x)aa′ega′=f(x)(a′a+b′b) is satisfied. Here, ub′va′=f(x)d is satisfied when d=a′a+b′b. Therefore, (ub′va′)1/d=f(x) is satisfied.
<<Specific Examples of u and v>>
Examples of u and v include u and v which are disclosed in Patent Literature 1 and Patent Literature 2. For example, u=z1ν−r1 and v=z2ν−r2 are held. Here, the group H is a cyclic group, a generator of the cyclic group H is μh, r1 and r2 are random natural numbers which are 0 or larger, ν=f(μh) is satisfied, τ1=μhr1xb is satisfied, τ2=μhr2xa is satisfied, further, z1=f(τ1) is satisfied with a probability larger than a certain probability, and z2=f(τ2) is satisfied with a probability larger than a certain probability. That is, z1=f(τ1) may be satisfied or z1≠f(τ1) may be satisfied. Further, z2=f(τ2) may be satisfied or z2≠f(τ2) may be satisfied. Namely, z1 and z2 are respectively calculation results f(τ1) and f(τ2) which include an intended or unintended error. “A certain probability” is a probability which is smaller than 100% and equal to or larger than 0%. An example of “a certain probability” is a non-negligible probability.
Alternatively, u=z1Y−r4μg−r5 and v=z2Y−r6μg−r7 may be satisfied. Here, the group H is a direct product group G×G of the group G, the group G is a cyclic group, a generator of the cyclic group G is μg, x=(c1,c2), (V,W) is an element of the group H, f(V,W)=Y, r4 to r7 are random numbers of natural numbers which are 0 or larger, τ1(c2bW−r4,c1bVr4μgr5) is satisfied, τ2=(c2aWr6,c1aVr6μgr7) is satisfied, z1=f(τ1) is satisfied with a probability larger than a certain probability, and z2=f(τ2)is satisfied with a probability larger than a certain probability.
[Modification of First Embodiment]
One of the integers a and b may be a constant such as 1 and at least one of the integers a′ and b′ may be a constant. A part of the integers a, b, a′, and b′ may be a constant and a part of processing units and steps may be omitted. For example, when b is a constant which is 1, selection of the integer b in step S101 is unnecessary and v′=ν is obtained. Therefore, the second power calculation unit 116 and step S107 are unnecessary. Alternatively, d may be set to a constant or a random number which is other than 1, the integers a, b, a′, and b′ which satisfy d=a′a+b′b may be selected in step S101, and whereby the processing of step S112 may be omitted. Alternatively, the integer selection unit 112 may perform selection of the integers a, b, a′, and b′ and calculation of d=a′a+b′b in step S101. Alternatively, the integer selection unit 112 may calculate d=a′a+b′b at any time after step S102 and before step S113. In these cases, the processing of step S112 is omitted and the final calculation unit 119 obtains d from the integer selection unit 112. Further, the final calculation unit 119 may output (ub′va′)1/d in a case of d≠0. In a case of d=0, error termination may be performed. Alternatively, in a case of d=0, at least a part of the integers a, b, a′, and b′ may be reselected in step S101 and the processing may be done again. Further, a′ and b′ may be selected at any time as long as the selection is performed before a′ and b′ become necessary for calculation.
[Second Embodiment]
A second embodiment shows the configuration in which the first embodiment is applied to a cloud type key management system. Differences with the first embodiment will be chiefly described below and description of points common to the first embodiment will be omitted.
<Configuration>
As illustrated in
As illustrated in
As illustrated in
<Processing>
Processing of the present embodiment is now described. As premises for the processing, G and H are groups (for example, finite commutative groups such as a cyclic group), f(x) is a decryption function by which a cipher text x which is an element of the group H is decrypted by a specific decryption key s so as to obtain an element of the group G, generators of the groups G and H are μg and μh respectively, X1 and X2 are random variables values of which are in the group G, a realization of the random variable X1 is x1, and a realization of the random variable X2 is x2. Each processing of the calculation device 21 is executed in the control of the control unit 2113 and each processing of the capability provision device 22 is executed in the control of the control unit 2205.
As illustrated in
The control unit 2113 sets t=1 (step S2102).
The input information provision unit 2104 generates and outputs first input information τ1 and second input information τ2 which respectively correspond to the inputted cipher text x and are elements of the group H (step S2103). Preferably, each of the first input information τ1 and the second input information τ2 is information obtained by perturbing a relation with the cipher text x. For example, the first input information τ1 and the second input information τ2 respectively correspond to the cipher text x, but it is hard to obtain the cipher text x only from the first input information τ1 and the second input information τ2. The expression “hard to obtain the cipher text x” represents that it is impossible to obtain the cipher text x within polynomial time, for example. Accordingly, the calculation device 21 can conceal the cipher text x from the capability provision device 22. Preferably, the first input information τ1 of the present embodiment further corresponds to the integer b which is selected by the integer selection unit 2102 and the second input information τ2 further corresponds to the integer a which is selected by the integer selection unit 2102. Accordingly, the calculation device 21 is enabled to evaluate the decryption capability provided from the capability provision device 22 with high precision. Specific examples of τ1 and τ2 are same as those illustrated in the first embodiment.
As illustrated in
The first output information calculation unit 2201 correctly calculates f(τ1) with a probability larger than a certain probability by using the first input information τ1 and the decryption key s stored in the key storage unit 2204 and sets the obtained calculation result to first output information z1 (step S2201). The second output information calculation unit 2202 correctly calculates f(τ2) with a probability larger than a certain probability by using the second input information τ2 and the decryption key s stored in the key storage unit 2204 and sets the obtained calculation result to second output information z2 (step S2202). Namely, the first output information calculation unit 2201 and the second output information calculation unit 2202 output calculation results which include an intended or unintended error. In other words, the result of the computation by the first output information calculation unit 2201 may or may not be f(τl), and the result of the computation by the second output information calculation unit 2202 may or may not be f(τ2).
The first output information calculation unit 2201 outputs the first output information z1 and the second output information calculation unit 2202 outputs the second output information z2 (step S2203).
Referring back to
The first calculation unit 2105 generates a calculation result u=f(x)bx1 from the first output information z1. z1=f(τ1) may or may not be satisfied. The first calculation unit 2105 is capable of generating the calculation result u=f(x)bx1. A specific example of a method for generating u from z1 is described in the first embodiment. For example, u=z1ν−r1 is satisfied for τ1=μhr1xb, u=z1Y−r4μg−r5 is satisfied for τ1=(c2bWr4,c1bVr4μgr5). The calculation result u is transmitted to the first power calculation unit 2106 (step S2105).
The first power calculation unit 2106 calculates u′=ua. A pair (u,u′) of the calculation result u and u′ which is obtained by calculation based on the calculation result u is stored in the first list storage unit 2107 (step S2106).
The determination unit 2111 determines whether or not there is a pair which satisfies u′=v′ among pairs (u,u′) which are stored in the first list storage unit 2107 and pairs (v,v′) which are stored in the second list storage unit 2110 (step S2107). If pairs (v,v′) are not stored in the second list storage unit 2110, processing of following step S2108 is performed without performing the processing of step S2107. When there is a pair which satisfies u′=v′, the process goes to step S2114. When there is not a pair which satisfies the process goes to step S2108.
In step S2108, the second calculation unit 2108 generates a calculation result v=f(x)ax2 from the second output information z2. z2=f(τ2) may or may not be satisfied. The second calculation unit 2108 is capable of generating the calculation result v=f(x)ax2. A specific example of a method for generating v from z2 is described in the first embodiment. For example, v=z2ν−r2 is satisfied for τ2=μhr2xa, and ν=z2Y−r6μg−r7 is satisfied for τ2=(c2aWr6,c1aVr6μgr7). The calculation result v is transmitted to the second power calculation unit 2109 (step S2108).
The second power calculation unit 2109 calculates v′=vb. A pair (v,v′) of the calculation result v and v′ which is obtained by calculation based on the calculation result v is stored in the second list storage unit 2110 (step S2109).
The determination unit 2111 determines whether or not there is a pair which satisfies u′=v′ among pairs (u,u′) which are stored in the first list storage unit 2107 and pairs (v,v′) which are stored in the second list storage unit 2110 (step S2110). When there is a pair which satisfies u′=v′, the process goes to step S2114. When there is not a pair which satisfies u′=v′, the process goes to step S2111.
In step S2111, the control unit 2113 determines t=Tmax is satisfied (step S2111). Tmax is a predetermined natural number. When t=Tmax is satisfied, the control unit 2113 outputs information representing that the calculation is impossible, for example, outputs a symbol “⊥” (step S2113) and the processing is ended. When t=Tmax is not satisfied, the control unit 2113 increments t by 1, that is, sets as t=t+1 (step S2112) and the process returns to step S2103.
In step S2114, the final output unit 2112 calculates d=a′a+b′b (step S2114) and calculates (ub′va′)1/d by using u and v which correspond to u′ and v′, and a′, b′, and d so as to output (ub′va′)1/d (step S2115). That is, the final output unit 2112 obtains d=a′a+b′b and outputs (ub′va′1/d for d. The outputted (ub′va′)1/d is a decryption result f(x) of the cipher text x with high probability. Further, the above-described processing may be repeated several times and the most common value among values obtained in step S2115 may be set to a decryption result.
[Modification of Second Embodiment]
One of the integers a and b may be a constant such as 1 and at least one of the integers a′ and b′ may be a constant. A part of the integers a, b, a′, and b′ may be a constant and a part of processing units and steps may be omitted. For example, when b is a constant which is 1, selection of the integer b in step S2101 is unnecessary and v′=v is obtained. Therefore, the second power calculation unit 2109 and step S2109 are unnecessary. Alternatively, d may be set to a constant or a random number which is other than 1, the integers a, b, a′, and b′ which satisfy d=a′a+b′b may be selected in step S2101, and whereby the processing of step S2114 may be omitted. Alternatively, the integer selection unit 2102 may perform selection of the integers a, b, a′, and b′ and calculation of d=a′a+b′b in step S2101. Alternatively, the integer selection unit 2102 may calculate d=a′a+b′b at any time after step S2102 and before step S2115. In these cases, the processing of step S2114 is omitted and the final output unit 2112 obtains d from the integer selection unit 2102. Further, the final output unit 2112 may output (ub′va′)1/d when d≠0 is satisfied. The processing may terminate with error when d=0 is satisfied. Alternatively, when d=0 is satisfied, at least a part of the integers a, b, a′, and b′ may be reselected in step S2101 and the processing may be performed again. Further, a′ and b′ may be selected at any time as long as the selection is performed before a′ and b′ become necessary for calculation.
[Other Modifications]
The present invention is not limited to the above-described embodiments. For example, the self-correcting technique in each embodiment of Patent Literature 2, Japanese Patent Application Laid Open No. 2012-237881, Japanese Patent Application Laid Open No. 2012-220834, Japanese Patent Application Laid Open No. 2012-220814, Japanese Patent Application Laid Open No. 2012-151756, and the like may be used for the self-correcting technique of the present invention.
For example, the calculation system may further include a decryption control device in the second embodiment. This decryption control device may output a decryption control command for controlling decryption processing of the calculation device to the capability provision device and the capability provision device may control whether or not both of the first output information z1 and the second output information z2 are outputted, in accordance with the decryption control command. Further, the calculation system may include a plurality of pieces of capability provision devices and output a decryption control command to any of the capability provision devices and each of the capability provision devices may control whether or not both of the first output information z1 and the second output information z2 are outputted, in accordance with the decryption control command.
In the second embodiment, the calculation system may further include a decryption control device, Gι and Hι may be groups, ω may be an integer which is 2 or larger, ι=1, . . . , ω, fι(λι) may be a decryption function by which a cipher text λι which is an element of the group Hι is decrypted by a specific decryption key sι so as to obtain an element of the group Gι, Xι,1 and Xι,2 may be random variables values of which are in the group Gι, xι,1 may be a realization of the random variable Xι,1, xι,2 may be a realization of the random variable Xι,2, a(ι), b(ι), a′(ι), and b′(ι) may be integers, the group G may be a group G1, the group H may be a group H1, the cipher text x may be a cipher text λ1, the decryption function f(x) may be a decryption function f1(λ1), the random variable X1 may be a random variable X1,1, the random variable X2 may be a random variable X1,2, the realization x1 may be a realization x1,1, the realization x2 may be a realization x1,2, the integer a may be an integer a(1), the integer b may be an integer b(1), the integer at may be an integer a′(1), and the integer b′ may be an integer b′(1). In this case, the calculation device outputs first input information τι,1 and second input information τι,2 which correspond to the cipher text λι and are elements of the group Hι, and the capability provision device correctly calculates fι(τι,1) with a probability larger than a certain probability by using the first input information τι,1 so as to output the obtained arithmetic result as first output information zι,1 and the capability provision device correctly calculates fι(τι,2) with a probability larger than a certain probability by using the second input information τι,2 so as to output the obtained arithmetic result as second output information zι,2. The calculation device generates an arithmetic result uι=fι(λι)b(ι)xι,1 based on the first output information zι,1 and generates an arithmetic result vι=fι(λι)a(ι)xι,2 based on the second output information zι,2. When the arithmetic results uι and vι satisfy uιa(ι)=vιb(ι), the calculation device obtains a′(ι)a(ι)+b′(ι)b(ι)=d(ι), for example, so as to output (uιb′(ι)vιa′(ι))1/d(ι) for d(ι). The decryption control device Outputs a decryption control command for controlling decryption processing of the calculation device to the capability provision device and the capability provision device control whether or not both of the first output information zι,1 and the second output information zι,2 are outputted from the first output information calculation unit and the second output information calculation unit, in accordance with the decryption control command.
Further, in this case, the decryption control command may correspond to any decryption function fι and the capability provision device may control presence/absence of outputs of both of the first output information zι,1 and the second output information zι,2 which correspond to the decryption function ƒι corresponding to the decryption control command. Furthermore, the calculation device may generate a restored value which is restorable only when all decryption values which are obtained by decrypting the cipher texts λι for respective ι=1, . . . , ω with the decryption key sι are obtained, by using (uιb′(ι)vιa′(ι))1/d(ι) for respective ι=1, . . . , ω which are outputted from the final output unit.
Further, in the second embodiment, the calculation system may include a plurality of pieces of calculation devices and the calculation devices may obtain a decryption result by using one piece of capability provision device.
In the second embodiment, f(x) is a decryption function by which the cipher text x which is an element of the group H is decrypted by the specific decryption key s to obtain an element of the group G. However, other functions for obtaining an element of the group G based on an input of an element x of the group H may be set as f(x) in the second embodiment. For example, f(x) may be an encryption function.
Further, instead of exchanging information via a network by respective devices, at least part of pairs of the devices may exchange information via a portable recording medium. Alternatively, at least part of pairs of devices may exchange information via a non-portable recording medium. That is, a combination composed of part of these devices may be a single device. Alternatively, the calculation device may be composed of a plurality of devices and the capability provision device may be composed of a plurality of devices.
The above-described various types of processing may be executed not only in a time-series manner in accordance with the description but also in a parallel manner or an independent manner, depending on processing capability of a device which executes the processing or as necessary. Further, it is indisputable that alterations can be arbitrarily made without departing from the intent of the present invention.
In a case where the above-described configuration is realized by a computer, processing contents of functions which should be obtained by respective devices are described by a program. By executing this program by a computer, the above-described processing functions are realized on the computer. The program in which the processing contents are described can be recorded in a recording medium which is readable by a computer. An example of the recording medium which is readable by a computer is a is non-transitory recording medium. Examples of such recording medium include a magnetic recording device, an optical disk, a magnetooptical recording medium, a semiconductor memory, and the like.
This program is distributed by selling, transferring, or lending a portable recording medium such as a DVD and a CD-ROM in which the program is recorded, for example. Further, this program may be distributed such that this program is stored in a storage device of a server computer and is transferred from the server computer to other computers through the network.
A computer which executes such program once stores the program which is recorded in a portable recording medium or the program transferred from the server computer a storage device thereof, for example. In execution of processing, the computer reads the program which is stored in the storage device thereof and executes processing in accordance with the program which is read. As another executing configuration of this program, a computer may directly read the program from a portable recording medium so as to execute processing in accordance with the program, and further, the computer may sequentially execute processing in accordance with a received program whenever a program is transferred from the server computer to this computer. The above-described processing may be executed by a service of an application service provider (ASP) type in which a processing function is realized only by an executing instruction of processing and result acquisition, without transferring the program to the computer from the server computer.
The processing functions of the present device are realized by executing a predetermined program on a computer in the above-described embodiment, but at least a part of these processing functions may be realized on hardware.
1, 21: calculation device
2: proxy calculation system
| Number | Date | Country | Kind |
|---|---|---|---|
| 2013-149155 | Jul 2013 | JP | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2014/067310 | 6/30/2014 | WO | 00 |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO2015/008605 | 1/22/2015 | WO | A |
| Number | Name | Date | Kind |
|---|---|---|---|
| 20120323981 | Yamamoto et al. | Dec 2012 | A1 |
| 20130318360 | Yamamoto et al. | Nov 2013 | A1 |
| 20150358162 | Kobayashi et al. | Dec 2015 | A1 |
| Number | Date | Country |
|---|---|---|
| 2 525 341 | Nov 2012 | GB |
| 2 947 813 | Nov 2015 | GB |
| 2012-220814 | Nov 2012 | JP |
| 2012-220834 | Nov 2012 | JP |
| 2011086992 | Jul 2011 | WO |
| 2012057134 | May 2012 | WO |
| Entry |
|---|
| Notice of Reasons for Refusal dated Sep. 27, 2016 in Japanese Patent Application No. 2015-527238 (with English language translation). |
| Extended European Search Report dated Jan. 23, 2017 in patent application No. 14826908.7. |
| International Search Report dated Aug. 19, 2014 in PCT/JP14/067310 Filed Jun. 30, 2014. |
| Number | Date | Country | |
|---|---|---|---|
| 20160170937 A1 | Jun 2016 | US |
