Patent Application
20170310479
The present invention relates to a key replacement direction control system and a key replacement direction control method, and specifically relates to a technique for enabling multiple key replacements for information sharing between users, and control of the key replacement directions.
Encryption technology is a method for enabling information exchange over a network without interception by an outsider. In recent years, there has been widely used a system where an information owner and an information receiver exchange information with intermediation of a third party other than them. Such a system is typified by a cloud system. In such a cloud system, when an administrator of the cloud is malicious, it is difficult to prevent information leak on the cloud only by encrypting communication between an information owner and the cloud and between the cloud and an information receiver.
Thus, information encryption between an information owner and an information receiver, namely, end-to-end encryption is desirable. End-to-end encryption requires the information owner to take some measure when encrypting its information so that the information receiver can decrypt the encrypted information.
In an example where symmetric-key cryptography is employed as such a measure among conventional encryption techniques, the information owner (transmitter) needs to share an encryption/decryption key with the information receiver at some time point. Further, if there are many transmitters and receivers, many keys have to be shared and confidentially managed. This may pose issues in terms of system operability and security.
If public-key cryptography is employed, on the other hand, the key management issue in the symmetric-key cryptography is diminished because encryption keys can be published. However, as in the case of employing the symmetric-key cryptography, the public-key cryptography still requires an information owner to, in encryption before transmitting information, determine an information receiver and encrypt the information with a key corresponding to the information receiver.
A cloud storage, for example, has to be able to provide a use environment where an information owner uploads encrypted data to the cloud storage, and a user who wishes to (and is authorized to) use the data downloads, decrypts, and uses the data. However, conventional encryption techniques cannot establish such a use environment because the conventional encryption techniques need a transmitter to perform encryption specific to a particular receiver when uploading data.
In this regard, a technique called key replacement or re-encryption has been proposed and drawing attention as a secure information sharing technique. The following re-encryption system is an example of such information sharing technique (see, for example, PTL 1). The re-encryption system includes a file sharing apparatus and a re-encryption apparatus that are communicative with client apparatuses operated by members of a group. The file sharing apparatus stores first encrypted files, which are files encrypted based on a public key of the group, receives a request for a certain file from a member of the group, acquires the first encrypted file of the requested file, transmits a request to re-encrypt this file to the re-encryption apparatus, receives a second encrypted file, which is a file encrypted based on a public key of the member, from the re-encryption apparatus, and transmits the second encrypted file to the client apparatus. The re-encryption apparatus receives a request to re-encrypt a first encrypted file, acquires a re-encryption key corresponding to the requesting member, re-encrypts the first encrypted file into a second encrypted file based on this re-encryption key, and transmits the second encrypted file to the file sharing apparatus. The re-encryption apparatus decrypts a second encrypted file received from the file sharing apparatus based on a private key corresponding to the public key of the member, thereby obtaining the target file.
[PTL 1] WO2013069505
However, the conventional re-encryption technique described above cannot handle a situation where complicated considerations need to be made about directions of information encryption and decryption between information sharing players, such as a case where information access authorities of the players are hierarchical. Moreover, re-encryption is possible only once, and in order to perform two-stage re-encryption or key replacement of information, the information needs to be decrypted first. This lowers processing efficiency and increases risk of information leak upon the decryption. In any case, this is not desirable.
Meanwhile, there is also an approach for enabling key replacement multiple times by performing a commutative operation such as for example a bitwise exclusive OR, in which altering the input order of the operands does not change the result. This approach allows key replacement with a limited number of keys to handle.
In such a key replacement approach using the commutative property of an operation, however, when it is possible to perform key replacement on data encrypted by user A to enable user B to decrypt the encrypted data, it is also possible to perform key replacement on data encrypted by user B to enable user A to decrypt the encrypted data. In other words, key replacement directions between concerned users are symmetric.
Such symmetry means that when a third party such as a cloud administrator is commissioned to perform key replacement, the cloud administrator can perform, without permission, key replacement in a direction which is not actually permitted. Further, collusion between a cloud administrator and a certain (legitimate) user may cause important information owned by another user, such as its encryption key, to leak from information used for key replacement. Thus, the above approach has a problem of being vulnerable to such a colluding attack.
For these reasons, the present invention aims to provide a technique for enabling multiple key replacements for information sharing between users, and control of the key replacement directions.
A key replacement direction control system of the present invention for solving the above problem is characterized in that the system comprises a key replacement server including: a storage device that stores key replacement information defining a relation indicating permission and direction of information sharing between users, a replacement key for a first user and a second user who are defined in the key replacement information such that information sharing in a direction from the first user to the second user is permitted, the replacement key being for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data using a decryption key retained by the second user, and encrypted data of at least one of the users; and an arithmetic device that receives a transmission request for transmission of encrypted data of a certain user, from a user terminal of a different user, if the key replacement information defines that information sharing in a direction from the certain user to the different user is permitted, re-encrypts the encrypted data of the certain user using the replacement key for the users thus defined, and transmits the re-encrypted encrypted data to the user terminal of the different user.
A key replacement direction control method of the present invention is characterized in that the method is executed by a key replacement server that includes a storage device that stores key replacement information defining a relation indicating permission and direction of information sharing between users, a replacement key for a first user and a second user who are defined in the key replacement information such that information sharing in a direction from the first user to the second user is permitted, the replacement key being for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data using a decryption key retained by the second user, and encrypted data of at least one of the users, and the method comprises: receiving a transmission request for transmission of encrypted data of a certain user, from a user terminal of a different user; if the key replacement information defines that information sharing in a direction from the certain user to the different user is permitted, re-encrypting the encrypted data of the certain user using the replacement key for the users thus defined; and transmitting the re-encrypted encrypted data to the user terminal of the different user.
The present invention enables multiple key replacements for information sharing between users, and control of the key replacement directions.
A detailed description is given below of an embodiment of the present invention using the drawings.
The key replacement direction control system 100 exemplified in
However, in a possible minimum configuration, the key replacement direction control system 100 may include only the key replacement server 200. In yet another possible configuration, the key replacement direction control system 100 may include the key replacement server 200 and the key generation server 1000.
In a possible scenario, the key replacement server 200 is managed and operated by a cloud provider as a main body of providing a cloud service that intermediates exchange of encrypted data. In such a case, terminals, such as mobile phones, owned by users of the cloud service provided by the cloud provider correspond to the above-mentioned user terminals 300 to 600. The number of the user terminals is not limited to the one exemplified in
Next, the functional configurations of the apparatuses in the key replacement direction control system 100 are described. As mentioned above, each functional part to be described below may be taken as a function implemented by execution of a program stored in its host apparatus or a function implemented by an appropriate electric circuit.
The control part 210 includes an overall processor 211 and a key replacement processor 212. Of these, the overall processor 211 takes overall control of the processing performed by the key replacement server 200, such as storing information received via the input part 201 into the storage part 220 or exchanging information with the user terminals 300 to 600. Other processing performed by the overall processor 211 include displaying data on the output part 202, or reading data stored in the storage part 220 and then transmitting the data to the user terminal 300 to 600 via the communication part 203.
On the other hand, the key replacement processor 212 is configured to operate as follows upon receipt of a transmission request targeting encrypted data of a first user and coming from a second user different from the first user. When the replacement key table 232 defines that information sharing is permitted in a direction from the first user to the second user, the key replacement processor 212 re-encrypts the encrypted data of the first user (read from the encrypted data 231) using a replacement key corresponding to the users thus defined, and transmits the re-encrypted encrypted data to the user terminal of the second user.
The encrypted data 231 and the replacement key table 232 are stored in a data storage section 230 of the storage part 220. Of these, the encrypted data 231 is encrypted data received from the user terminals 300 to 600. The replacement key table 232 corresponds to key replacement information defining relations indicating permission and direction of information sharing between users. This key replacement information may be a key replacement graph 233 having vertices representing identification information on the users and edges each representing the relation indicating permission and direction and information sharing between the users.
In a temporary information storage section 240, information temporarily needed for processing by the control part 210 is stored.
Next, a description is given of the user terminal 300.
The user terminal 300 exemplified in
The control part 310 includes an overall processor 311, an encryption processor 312, and a decryption processor 313. Of these, the overall processor 311 takes overall control of the processing performed by the user terminal 300, such as storing information received via the input part 301 into the storage part 320 and exchanging information with the key replacement server 200. Other processing executed by the overall processor 311 include displaying data on the output part 302, reading data stored in the storage part 320 and then causing the encryption processor 312 to encrypt the data, causing the decryption processor 313 to decrypt encrypted data, and transmitting encrypted data to the key replacement server 200 via the communication part 303.
The encryption processor 312 registers encrypted data at the key replacement server 200 as follows. The encryption processor 312 generates ciphertext by encrypting encryption target data (retained in the data storage section 330) of a user of the user terminal 300 (user A in this case) using a public-key cryptography key generated by a predetermined algorithm. Then, the encryption processor 312 performs a predetermined commutative operation on the symmetric-key cryptography key and an encryption private key retained as encryption key 341, and joins a result of the operation to the ciphertext. The encryption processor 312 thereby generates encrypted data and transmits the encrypted data to the key replacement server 200.
The decryption processor 313 decrypts encrypted data of an information sharer user, which has been re-encrypted using a replacement key and acquired from the key replacement server 200 in response to a transmission request targeting the encrypted data. Specifically, the decryption processor 313 decrypts the encrypted data by performing a predetermined commutative operation on a decryption key retained as decryption key 342 in an encryption/decryption key storage section 340 and used by the user of the user terminal 300 to decrypt the encrypted data of the information sharer user, and an operation result portion of the re-encrypted encrypted data, which is joined to ciphertext therein, and decrypting the ciphertext using a result of the operation as a symmetric-key cryptography decryption key. The decryption processor 313 then outputs the decrypted data to a predetermined output device via the output part 302.
The storage part 320 includes the data storage section 330, the encryption/decryption key storage section 340, and a temporary information storage section 350. Of these, the data storage section 330 has stored therein encryption target data, or in other words, plaintext data. The encryption/decryption key storage section 340 stores encryption and decryption keys. The encryption key 341 is an encryption private key transmitted from the key generation server 1000. The decryption key 342 includes a decryption master key and a decryption key that are, again, transmitted from the key generation server 1000.
The temporary information storage section 350 stores information temporarily needed for processing performed by the control part 310.
Next, a description is given of the key generation server 1000.
The control part 1010 includes an overall processor 1011, an encryption key generator 1012, a decryption key generator 1013, and a replacement key generator 1014. Of these, the overall processor 1011 takes overall control of the processing performed by the key generation server 1000, such as storing information received via the input part 1001 into the storage part 1020 and exchanging information with the user terminals 300 to 600 and the key replacement server 200.
Other processing executed by the overall processor 1011 includes displaying data on the output part 1002 and reading data stored in the storage part 1020 and then causing the encryption key generator 1012 to generate an encryption key, causing the decryption key generator 1013 to generate a decryption key, and causing the replacement key generator 1014 to generate a replacement key. The overall processor 1011 transmits the thus-generated encryption key and decryption key to the corresponding user terminal 300 to 600 and the replacement key to the key replacement server 200.
The encryption key generator 1012 generates an encryption private key and a decryption master key for each user by using a predetermined algorithm.
The decryption key generator 1013 generates a decryption key with which encrypted data of a first user is decrypted by a second user. Specifically, the decryption key generator 1013 generates a decryption key by using the decryption master key of the second user and a hash code in identification information on the first user (which is, for example, a user ID or the like and stored in the storage part 1020 in advance).
The replacement key generator 1014 performs processing of generating, as key replacement information, a key replacement graph having vertices representing identification information on the users and edges each representing the relation indicating permission and direction of information sharing, and transmits the key replacement graph to the key replacement server 200. With respect to a first user and a second user who are, in the key replacement graph, linked to each other directly with an edge directed from the first user to the second user, the replacement key generator 1014 generates a replacement key 1043 for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data. Specifically, the replacement key generator 1014 performs a predetermined commutative operation on: a decryption key 1042 for use by the second user to decrypt encrypted data of the first user and an encryption private key 1041 of the first user, and uses a result of the operation as the replacement key 1043 for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data.
The storage part 1020 includes an encryption/decryption key storage section 1040 and a temporary information storage section 1050. Of these, the encryption/decryption key storage section 1040 stores an encryption key 1041, the decryption key 1042, and the replacement key 1043.
The temporary information storage section 1050 stores information temporarily needed for processing performed by the control part 1010.
The following describes a hardware configuration of a computer 10 typifying each apparatus of the key replacement direction control system 100 of the present embodiment. The computer 10 includes a storage device 11 formed of an appropriate non-volatile storage element such as a solid state drive or a hard disk drive, a memory 13 formed of a volatile storage element such as a RAM, an arithmetic device 14, such as a CPU, that takes overall control of the host apparatus by, for example, loading programs 12 stored in the storage device 11 into the memory 13 and executing the programs 12, and also performs various types of processing for determination, computation, and control by using data 18 appropriately, an input device 15 that receives key input and voice input made from outside, an output device 16, such as a display, that displays processed data, and a communication device 17 that is coupled to a network 150 and performs processing for communication with other apparatuses.
Of these, resources for the storage device 11 serve as the storage part of each apparatus, resources for the arithmetic device 14 serve as the control part of each apparatus, resources for the input device 15 serve as the input part of each apparatus, resources for the output device 16 serve as the output part of each apparatus, and resources for the communication device 17 serve as the communication part of each apparatus. The data 18 corresponds to the data stored in the storage part of each apparatus.
Next, an example of data structure used in the key replacement direction control system 100 of the first embodiment is described. In this regard, concrete examples of a key replacement graph and a corresponding replacement key table are shown.
The key replacement graph 233 exemplified in
In
An actual procedure of a key replacement direction control method of this embodiment is described below with reference to a drawing. Various actions involved in the key replacement direction control method described below are implemented when a corresponding apparatus forming the key replacement direction control system 100 loads a corresponding program into memory or the like and executes the program. Each program is formed by codes for implementing a corresponding one of the various actions to be described below.
First, the key generation server 1000 generates the key replacement graph 233 by linking vertices representing identification information on each pair of users, which are stored in the storage part 1020 in advance, with a line segment according to the relation indicating permission and direction of information sharing between the users, the relation being designated by an administrator or the like via the input part 1001 for example (S601). The key replacement graph 233 may be transmitted to the key replacement server 200 in this form.
Next, the key generation server 1000 generates an encryption key and a decryption key for each user according to the key replacement graph 233 (S602). A detailed description of this processing will be given later.
Next, the key generation server 1000 transmits the encryption key and the decryption key generated for each user in Step S602 to the user terminal 300 of the corresponding user (S603) This transmission must be carried out by encrypted communication or the like to prevent interception by an outsider.
On the other hand, the user terminal 300 receives the encryption key and the decryption key from the key generation server 1000 and stores them respectively as the encryption key 341 and the decryption key 342 in the encryption/decryption key storage section 340 in the storage part 320 (S606).
Then, the key generation server 1000 generates replacement keys based on the key replacement graph 233 and the encryption key and the decryption key generated for each user in Step S602, and generates the replacement key table 232 by storing the replacement keys in a table in a predetermined format defining relations indicating permission and direction of information sharing between users (S604).
Next, the key generation server 1000 transmits the replacement key table 232 generated in Step S604 to the key replacement server 200 (S605). This transmission must be carried out by encrypted communication or the like to prevent interception by an outsider.
On the other hand, the key replacement server 200 receives the replacement key table 232 from the key generation server 1000 and stores this in the storage part 220 (S607).
Next, a description is given of a procedure in which the user terminal 300 of user A encrypts data of user A and transmits the encrypted data to the key replacement server 200 which in turn performs key replacement on the encrypted data to generate encrypted data which can be decrypted by the user B 400 and transmits the encrypted data to user B 400 which in turn decrypts the encrypted data.
First, the user terminal 300 of user A generates encrypted data (S701). Specifically, the user terminal 300 receives a data encryption instruction from user A at the input part 301 for example, and in response to this instruction, reads encryption target data stored in the data storage section 330. The user terminal 300 then generates ciphertext by encrypting the encryption target data using its own encryption key 341 (public-key cryptography key generated by a predetermined algorithm such as a random number). The user terminal 300 then performs a predetermined commutative operation on the symmetric-key cryptography key and an encryption private key retained as the encryption key 341, and joins a result of the operation to the ciphertext, thereby generating the encrypted data. The user terminal 300 then transmits this encrypted data to the key replacement server 200 (S702).
Meanwhile, the key replacement server 200 performs key replacement (Step S705). Specifically, in response to a transmission request from the user terminal 400 of user B for example, the key replacement server 200 checks whether information sharing, or key replacement, from user A to user B is permitted by referring to the key replacement graph 233 (
The key replacement server 200 transmits the encrypted data which has undergone the key replacement in Step S705, to the user terminal 400 of user B (S706).
Meanwhile, upon receipt of the encrypted data from the key replacement server 200, the user terminal 400 reads the decryption key 342 for use to decrypt the encrypted data of user A from the encryption/decryption key storage section 340, and performs a commutative operation on this decryption key 342 and the operation result portion of the key-replaced (re-encrypted) encrypted data, joined to the ciphertext therein. The user terminal 400 decrypts the ciphertext using a result of the operation as a public-key cryptography decryption key, and outputs the decrypted data to the output part 302 (S707).
As an example, the following procedure generates an encryption key for user A, decryption keys for user B, and a replacement key to be retained by the key replacement server 200, which are necessary to perform key replacement, or re-encryption, on encrypted data of user A to enable the user terminal 400 of user B to decrypt the encrypted data.
First, the key generation server 1000 randomly generates an encryption key KcA for user A using a predetermined algorithm such as a random number (S801). The key generation server 1000 randomly generates a decryption master key KdB for user B using, again, a predetermined algorithm such as a random number (S802)
Next, in a secure manner, the key generation server 1000 transmits the encryption key KcA obtained in Step S801 to the user terminal of user A, and transmits the decryption master key KdB(A) obtained in Step S802 to the user terminal 400 of user B (S803)
Next, the key generation server 1000 generates a decryption key for use by the user terminal 400 of user B to decrypt the encrypted data of user A by computation of KdB(A)=H (KdB, IDA) (S804). In this formula, H(+) and IDA are respectively a hash function and the identifier of user A, which are published and stored in the storage part 1020 in advance.
The key generation server 1000 generates a replacement key KA-B for use to re-encrypt the encrypted data of user A to enable the user terminal 400 of user B to decrypt the encrypted data, by computing KA-B=KcA XOR Kd(A) (where XOR is a bitwise exclusive OR) (S805). The key generation server 1000 then adds this replacement key KA-B to a corresponding location in the replacement key table (which is stored, for example, as the replacement key 1043 in the storage part 1020), or more specifically, to a cell corresponding to information sharing permitted from user A to user B, and transmits this replacement key table to the key replacement server 200 in a secure manner (S806).
In the key replacement graph 233 (
In this case, the key generation server 1000 obtains a replacement key KA-C for information sharing from user A to user C by computing KA-C=KA-B XOR KB-C using the already-generated replacement key KA-B and replacement key KB-C (S901). The key generation server 1000 adds KA-C to the replacement key table and transmits the replacement key table to the key replacement server 200 in a secure manner (S902).
Additionally, the key generation server 1000 obtains a decryption key of user C for use to decrypt the encrypted data of user A, by computing KdC(A)=KdB(A) XOR K-c (S903), and finally transmits KdC(A) to the user terminal 500 of user C in a secure manner (S904)
As an example, the following procedure generates an encryption key for user A, decryption keys for user B, and a replacement key to be retained by the key replacement server 200, which are necessary to perform key replacement, or re-encryption, on encrypted data of user A to enable the user terminal 400 of user B to decrypt the encrypted data.
First, the key generation server 1000 randomly generates an encryption key KcA for user A using a predetermined algorithm such as a random number (S1001). The key generation server 1000 randomly generates a decryption partial key hA corresponding to user A using a predetermined algorithm such as a random number (S1003), and likewise, randomly generates a decryption partial key hB corresponding to user B using a predetermined algorithm such as a random number (S1004).
Then, the key generation server 1000 obtains a decryption key for use by user B to decrypt the encrypted data of user A, by computing KdB(A)=hA XOR hB (S1005), and transmits the decryption key KdB(A) to the user terminal 400 of user B in a secure manner (S1006).
Further, the key generation server 1000 computes, using KA-B=KcAXOR KdB(A), a replacement key for use to re-encrypt encrypted data of user A to enable the user terminal 400 of user B to decrypt the encrypted data (S1007). The key generation server 1000 then adds the replacement key KA-B to a corresponding location in the replacement key table, and transmits the table to the key replacement server 200 in a secure manner (S1008).
Although the example described above uses an exclusive OR (XOR) on keys, any approach typically involving bit strings and commutative operations defined in a key space may be used.
An example approach for data encryption by the user terminal 300 may involve randomly generating a symmetric-key cryptography key R, generating ciphertext C by encrypting encryption target data using the key R, and using C∥X as final ciphertext where X is a result of an exclusive OR, or a predetermined commutative operation, of the key R and an encryption key Ke* of the user terminal (where * is user name). In such a case, key replacement can be accomplished by replacement of the above-described operation result X portion with a result of a predetermined commutative operation performed on the operation result X and the replacement key. Nonetheless, this data encryption approach is of course merely an example, and should not be taken as restrictive.
According to the first embodiment set forth above, when user B is permitted to decrypt encrypted data of user A, but not vice versa, i.e., when the replacement key table 232 does not contain a replacement key for enabling information sharing in a direction from user B to user A, the key replacement server 200 cannot enable, by its own (malicious) decision, user A to decrypt data encrypted by user B. This information-security feature cannot be achieved by a conventional approach based on commutative operations.
In addition, the key replacement processing can be performed without causing discrepancies even when, for example, the key replacement graph 233 derived based on whether information sharing in a defined direction between users is or is not permitted contains complicated relations of information sharing, with an enormous number of users linked with edges in a complex manner, for example. The key replacement graph 233 thus having set therein the relations among users regarding information sharing without discrepancies can avoid a problem where a certain loop existing in the key replacement graph 233 permits key replacement in a direction which is not actually permitted.
Further, appropriately increasing the variations on decryption keys retained by each user can reduce the number of keys of other users that may leak due to collusion between the key replacement server 200 and a certain user (e.g., A). To be more accurate, the other users' keys obtainable by user A are a decryption key corresponding to user A of a user authorized to decrypt data encrypted by user A and an encryption key of a user whose data can be decrypted by user A. These keys do not provide more information than what is already available to user A anyway.
Next, a second embodiment of the present invention is described with reference to
The arrows in the hierarchical model 1300 represent that, for example, the key replacement server 200 can allow the user terminal of a user belonging to rank B or rank A to download, decrypt, and access data encrypted and uploaded to the key replacement server 200 by a user belonging to rankC (user C1 (501), user C2 (502), or user C3 (503) in
In this hierarchical model 1300, key replacement in an opposite direction is not permitted. Specifically, for example, key replacement cannot be performed on data encrypted by a rank B user with a key of a rank C user.
In the second embodiment, as in the first embodiment, a different key may be used for each user, or a common key may be used among users belonging to the same hierarchy.
Next, a third embodiment of the present invention is described with reference to
In the configuration of a hierarchical model 1400 exemplified in
Arrows in the hierarchical model 1400 indicate that data encrypted and uploaded to the key replacement server 200 by the user terminals 300 to 600 of users A to D cannot be subjected to key replacement to be decrypted among users A to D.
Best modes for carrying out the present invention have been described in detail above, but the present invention is not limited to these modes and can be modified variously without departing from the gist of the present invention.
The embodiments herein discuss a system where a key replacement server converts data encrypted by a certain user into encrypted data which can be decrypted by a second user and transmits the encrypted data to the second user. The system enables multiple key replacements, prevents key replacement from being performed in a direction opposite from a defined direction, prevents information leak due to collusion between a user and the key replacement server, and enables information sharing among users to be performed in a secure manner even with intermediation of a third party such as a cloud as well as in a discrepancy-free manner despite complicated relations among the users (such as whether information access is or is not permitted).
In sum, it is possible to perform multiple key replacements for information sharing between users and to control the key replacement directions.
According to the descriptions provided herein, at least the following become apparent. Specifically, the key replacement direction control system of the embodiments may further comprise a key generation server including an arithmetic device that: generates a key replacement graph as the key replacement information and transmits the key replacement graph to the key replacement server, the key replacement graph having vertices representing identification information on the users and edges each representing the relation indicating permission and direction of information sharing; generates an encryption private key and a decryption master key for each of the users by using a predetermined algorithm and transmits the encryption private key and the decryption master key to the user terminal of the user; uses a hash code in the identification information on a first user and the decryption master key of a second user to generate the decryption key for use by the second user to decrypt encrypted data of the first user, and transmits the decryption key to the user terminal of the second user; and with respect to a first user and a second user who are, in the key replacement graph, linked to each other directly with an edge directed from the first user to the second user, generates the replacement key for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data, the arithmetic device generating the replacement key by performing a predetermined commutative operation on the decryption key for use by the second user to decrypt the encrypted data of the first user and the encryption private key of the first user and by using a result of the operation as the replacement key, and transmits the thus-generated replacement key to the key replacement server.
This allows the decryption keys and replacement keys to be efficiently generated according to the user configurations, and transmitted to the key replacement server and the user terminal.
Additionally, the key replacement direction control system of the embodiments may be configured such that, in the transmitting the replacement key to the key replacement server, with respect to a first user and a second user who are, in the key replacement graph, linked to each other with a third user interposed in between with an edge directed from the first user to the third user and an edge directed from the third user to the second user, the arithmetic device of the key generation server generates the replacement key for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data, the arithmetic device generating the replacement key by performing a predetermined commutative operation on the replacement key for use to re-encrypt the encrypted data of the first user to enable the third user to decrypt the encrypted data using the decryption key retained by the third user and the decryption key for use by the second user to decrypt data encrypted by the third user and by using a result of the operation as the replacement key, and transmits the thus-generated replacement key to the key replacement server.
In this case, even for users not directly linked in the key replacement graph, a replacement key can be generated so that the users can share information (if it is permitted), and transmitted to the key replacement server. Thus, there is no need to generate various keys for the relation of every set of users, which enables efficient, secure key management.
Additionally, the key replacement direction control system of the embodiments may further comprise a user terminal including: a storage device that stores the encryption private key, the decryption master key, and the decryption key, all transmitted from the key generation server; and an arithmetic device that registers encrypted data at the key replacement server by performing processing of generating ciphertext by encrypting predetermined data of a user of the user terminal using a key for symmetric-key cryptography generated by a predetermined algorithm, and processing of performing a predetermined commutative operation on the key for symmetric-key cryptography and the encryption private key retained in the storage device, generating the encrypted data by joining a result of the operation to the ciphertext, and transmitting the encrypted data to the key replacement server, decrypts re-encrypted encrypted data, which is encrypted data registered by an information sharer user and re-encrypted with the replacement key, by acquiring the re-encrypted encrypted data by sending an encrypted-data transmission request to the key replacement server, performing a predetermined commutative operation on the decryption key, stored in the storage device, for use by the user of the user terminal to decrypt the encrypted data of the information sharer user and a portion of the re-encrypted encrypted data, the portion being the result of the operation joined to the ciphertext, and decrypting the ciphertext using a result of the operation as a decryption key for symmetric-key cryptography, and outputs the decrypted ciphertext to an output device.
This allows users to efficiently share information in a secure manner in a direction defined.
Additionally, the key replacement direction control system of the embodiments may be configured such that, in the re-encrypting the encrypted data with the replacement key and transmitting the re-encrypted encrypted data to the user terminal of the different user, if the key replacement information defines that information sharing in the direction from the certain user to the different user is permitted, the arithmetic device of the key replacement server generates the re-encrypted encrypted data in response to the transmission request by performing a predetermined commutative operation on the replacement key for the users thus defined and the operation result joined to the ciphertext in the encrypted data and by joining a result of the operation to the ciphertext, and transmits the re-encrypted encrypted data to the user terminal of the different user.
This allows the key replacement server to generate re-encrypted encrypted data, or key-replaced encrypted data in an efficient and secure manner, and transmit the re-encrypted data to the user terminal.
Additionally, the key replacement direction control system of the embodiments may further comprise a key generation server including an arithmetic device that: generates a key replacement graph as the key replacement information and transmits the key replacement graph to the key replacement server, the key replacement graph having vertices representing identification information on the users and edges each representing the relation indicating permission and direction of information sharing; generates an encryption private key and a decryption master key for each of the users by using a predetermined algorithm and transmits the encryption private key and the decryption master key to the user terminal of the user; generates a decryption key for use by a second user to decrypt encrypted data of a first user, by performing processing of generating decryption partial keys for the respective first and second users using a predetermined algorithm and processing of performing a predetermined commutative operation on the decryption partial keys for the respective first and second users and of using a result of the operation as the decryption key, and transmits the decryption key to the user terminal of the second user; and with respect to a first user and a second user who are, in the key replacement graph, linked to each other directly with an edge directed from the first user to the second user, generates the replacement key for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data, the arithmetic device generating the replacement key by performing a predetermined commutative operation on the encryption private key of the first user and the decryption key generated and by using a result of the operation as the replacement key, and transmits the thus-generated replacement key to the key replacement server.
Compared to a case where a decryption key is generated from a decryption master key and a hash code in user identification information, this requires fewer keys overall and allows more efficient, secure key management.
Additionally, the key replacement direction control method of the embodiments may be executed by a key generation server and comprise: generating a key replacement graph as the key replacement information and transmitting the key replacement graph to the key replacement server, the key replacement graph having vertices representing identification information on the users and edges each representing the relation indicating permission and direction of information sharing; generating an encryption private key and a decryption master key for each of the users by using a predetermined algorithm and transmitting the encryption private key and the decryption master key to the user terminal of the user; using a hash code in the identification information on a first user and the decryption master key of a second user to generate the decryption key for use by the second user to decrypt encrypted data of the first user, and transmitting the decryption key to the user terminal of the second user; and with respect to a first user and a second user who are, in the key replacement graph, linked to each other directly with an edge directed from the first user to the second user, generating the replacement key for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data, the key generation server generating the replacement key by performing a predetermined commutative operation on the decryption key for use by the second user to decrypt the encrypted data of the first user and the encryption private key of the first user and by using a result of the operation as the replacement key, and transmitting the thus-generated replacement key to the key replacement server.
Additionally, the key replacement direction control method of the embodiments, in the transmitting the replacement key to the key replacement server, with respect to a first user and a second user who are, in the key replacement graph, linked to each other with a third user interposed in between with an edge directed from the first user to the third user and an edge directed from the third user to the second user, the key generation server may generate the replacement key for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data, the key generation server generating the replacement key by performing a predetermined commutative operation on the replacement key for use to re-encrypt the encrypted data of the first user to enable the third user to decrypt the encrypted data using the decryption key retained by the third user and the decryption key for use by the second user to decrypt data encrypted by the third user and by using a result of the operation as the replacement key, and transmit the thus-generated replacement key to the key replacement server.
Additionally, the key replacement direction control method of the embodiments may be executed by a user terminal including a storage device that stores the encryption private key, the decryption master key, and the decryption key, all transmitted from the key generation server, and the method may comprise: registering encrypted data at the key replacement server by performing processing of generating ciphertext by encrypting predetermined data of a user of the user terminal using a key for symmetric-key cryptography generated by a predetermined algorithm, and processing of performing a predetermined commutative operation on the key for symmetric-key cryptography and the encryption private key retained in the storage device, generating the encrypted data by joining a result of the operation to the ciphertext, and transmitting the encrypted data to the key replacement server; decrypting re-encrypted encrypted data, which is encrypted data registered by an information sharer user and re-encrypted with the replacement key, by acquiring the re-encrypted encrypted data by sending an encrypted-data transmission request to the key replacement server, performing a predetermined commutative operation on the decryption key, stored in the storage device, for use by the user of the user terminal to decrypt the encrypted data of the information sharer user and a portion of the re-encrypted encrypted data, the portion being the result of the operation joined to the ciphertext, and decrypting the ciphertext using a result of the operation as a decryption key for symmetric-key cryptography; and outputting the decrypted ciphertext to an output device.
Additionally, in the key replacement direction control method of the embodiments, in the re-encrypting the encrypted data with the replacement key and transmitting the re-encrypted data to the user terminal of the different user, if the key replacement information defines that information sharing in the direction from the certain user to the different user is permitted, the key replacement server generates the re-encrypted encrypted data in response to the transmission request by performing a predetermined commutative operation on the replacement key for the users thus defined and the operation result joined to the ciphertext in the encrypted data and by joining a result of the operation to the ciphertext, and transmits the re-encrypted encrypted data to the user terminal of the different user.
Additionally, the key replacement direction control method of the embodiments may be executed by a key generation server and comprise: generating a key replacement graph as the key replacement information and transmitting the key replacement graph to the key replacement server, the key replacement graph having vertices representing identification information on the users and edges each representing the relation indicating permission and direction of information sharing; generating an encryption private key and a decryption master key for each of the users by using a predetermined algorithm and transmitting the encryption private key and the decryption master key to the user terminal of a corresponding one of the users; generating a decryption key for use by a second user to decrypt encrypted data of a first user, by performing processing of generating decryption partial keys for the respective first and second users using a predetermined algorithm and processing of performing a predetermined commutative operation on the decryption partial keys for the respective first and second users and by using a result of the operation as the decryption key, and transmitting the decryption key to the user terminal of the second user; and with respect to a first user and a second user who are, in the key replacement graph, linked to each other directly with an edge directed from the first user to the second user, generating the replacement key for use to re-encrypt encrypted data of the first user to enable the second user to decrypt the encrypted data, the key generation server generating the replacement key by performing a predetermined commutative operation on the encryption private key of the first user and the decryption key generated and by using a result of the operation as the replacement key, and transmitting the thus-generated replacement key to the key replacement server.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2015-036058 | Feb 2015 | JP | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2015/080082 | 10/26/2015 | WO | 00 |
