US 2013/0173929 A1Published application

Cryptographic processing system, key generation device, encryption device, decryption device, cryptographic processing method, and cryptographic processing program

AssigneesNippon Telegraph and Telephone Corporation, Mitsubishi Electric Corporation

InventorsKatsuyuki Takashima, Tatsuaki Okamoto

Life of this patent

Estimating the term…

Abstract

The object is to provide a secure functional encryption scheme having many cryptographic functions. An access structure is constituted by applying the inner-product of attribute vectors to a span program. The access structure has a degree of freedom in design of the span program and design of the attribute vectors, thus having a large degree of freedom in design of access control. A functional encryption process is implemented by imparting the access structure to each of a ciphertext and a decryption key.

Claims8

Dependent claims

A cryptographic processing system comprising a key generation device, an encryption device, and a decryption device, and serving to execute a cryptographic process using a basis B0 and a basis B0*, a basis BtKP a basis B*tKP for each integer t=1, . . . , dKP (dKP is an integer of 1 or more), and a basis BtCP and a basis B*tCP for each integer t=1, . . . , dCP (dCP is an integer of 1 or more),

wherein the key generation device includes
a first KP information input part which takes as input, a variable ρKP(i) for each integer i=1, . . . , LKP (LKP is an integer of 1 or more), which variable ρKP(i) is either one of a positive tuple (t, v→iKP) and a negative tuple (t, v→iKP) of identification information t (t is any one integer of t=1, . . . , dKP) and an attribute vector v→iKP:=(vi,i′KP)(i′=1, . . . , ntKP where ntKP is an integer of 1 or more), and a predetermined matrix MKP having LKP rows and rKP columns (rKP is an integer of 1 or more),
a first CP information input part which takes as input, an attribute set ΓCP having the identification information t and an attribute vector x→tCP:=(xt,i′CP) (i′=1, . . . , ntCP where ntCP is an integer of 1 or more) for at least one integer t=1, . . . , dCP,
a main decryption key generation part which generates an element k*0 by setting a value −s0KP(s0KP:=h→KP·(f→KP)T where h→KP and f→KP are vectors each having rKP pieces of elements) as a coefficient for a basis vector b*0,p (p is a predetermined value) of the basis B*0, by setting a random number δCP as a coefficient for a basis vector b*0,p′ (p′ is a predetermined value different from prescribed p), and by setting a predetermined value κ as a coefficient for a basis vector b*0,q (q is a predetermined value different from the prescribed p and prescribed p′),
a KP decryption key generation part which generates an element k*iKP for each integer i=1 . . . , LKP, based on a column vector (s→KP)T:=(s1KP, . . . , siKP)T:=MKP·(f→KP)T (i=LKP) generated based on prescribed f→KP and the matrix MKP which is inputted by the first KP information input part;
and a random number θiKP (i=1, . . . , LKP), the KP decryption key generation part being configured to generate the element k*iKP, when the variable ρKP(i) for each integer i=1, . . . , LKP is a positive tuple (t, v→iKP), by setting siKP+θiKPvi,1KP as a coefficient for a basis vector b*t,1KP of the basis B*tKP indicated by identification information t of the positive tuple, and by setting θiKPvi,1KP as a coefficient for a basis vector b*t,i′KP indicated by the identification information t and by each integer i′=2, . . . , ntKP, and when the variable ρKP(i) is a negative tuple (t, v→iKP), by setting siKPvi,i′KP as a coefficient for the basis vector b*t,i′KP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntKP, and
a CP decryption key generation part which generates an element k*tCP concerning each identification information t included in the attribute set ΓCP inputted by the first CP information input part, the CP decryption key generation part being configured to generate the element k*tCP by setting xt,i′CP multiplied by the random number δCP as a coefficient for a basis vector b*t,i′CP (i′=1, . . . , ntCP) of the basis B*tCP,
wherein the encryption device includes
a second KP information input part which takes as input, an attribute set ΓKP having the identification information t and an attribute vector x→tKP:=(xt,i′KP)(i′1, . . . , ntKP) for at least one integer t=1, . . . , dKP,
a second CP information input part which takes as input, a variable ρCP(i) for each integer i=1, . . . , LCP (LCP is an integer of 1 or more), which variable ρCP(i) is either one of a positive tuple (t, v→iCP) and a negative tuple (t, v→iCP) of identification information t (t is any one integer of t=1, . . . , dCP) and an attribute vector t, v→iCP:=(vi,i′CP) (i′=1, . . . , ntCP), and a predetermined matrix MCP having LCP rows and rCP columns (rCP is an integer of 1 or more),
a main encrypted data generation part which generates an element c0 by setting a random number ωKP as a coefficient for a basis vector b0,p of the basis B0, by setting a value −s0CP(s0CP:=h→CP·(f→CP)T where h→CP and f→CP are vectors each having rCP pieces of elements) as a coefficient for a basis vector b0,p′ of the basis B0, and by setting a random number ζ as a coefficient for a basis vector b0,q,
a KP encrypted data generation part which generates an element ctKP concerning each identification information t included in the attribute set ΓKP inputted by the second KP information input part, the KP encrypted data generation part being configured to generate the element ctKP by setting xt,i′KP multiplied by the random number ωKP as a coefficient for a basis vector bt,i′KP (i′=1, . . . , nt) of the basis BtKP, and
a CP encrypted data generation part which generates an element ciCP for each integer i=1 . . . , LCP, based on a column vector (s→CP)T:=(s1CP, . . . , siCP)T:=MCP·(f→CP)T (i=LCP) generated based on the prescribed f→CP and the matrix MCP which is inputted by the second CP information input part;
and a random number θiCP (i=1, . . . , LCP), the CP encrypted data generation part being configured to generate the element ciCP, when the variable ρCP(i) for each integer i=1, . . . , LCP is a positive tuple (t, v→iCP), by setting siCP+θiCPvi,1CP as a coefficient for a basis vector bt,1CP of the basis BtCP indicated by identification information t of the positive tuple, and by setting θiCPvi,i′CP as a coefficient for a basis vector bt,i′CP indicated by the identification information t and by each integer i′=2, . . . , ntCP, and when the variable ρCP(i) is a negative tuple (t, v→iCP), by setting siCPvi,i′CP as a coefficient for the basis vector bt,i′CP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntCP, and
wherein the decryption device includes
a data acquisition part which acquires encrypted data ct(ΓKP,SCP) including the element c0 generated by the main encrypted data generation part, the element ctKP generated by the KP encrypted data generation part, the element ciCP generated by the CP encrypted data generation part, the attribute set ΓKP, and the variable ρCP(i),
a decryption key acquisition part which acquires a decryption key sk(SKP,ΓCP) including the element k*0 generated by the main decryption key generation part, the element k*iKP generated by the KP decryption key generation part, the element k*tCP generated by the CP decryption key generation part, the variable ρKP(i), and the attribute set ΓCP,
a KP complementary coefficient calculation part which, based on the attribute set ΓKP included in the encrypted data ct(ΓKP,SCP) acquired by the data acquisition part, and the variable ρKP(i) included in the decryption key sk(SKP,ΓCP) acquired by the decryption key acquisition part, specifies, among integers i=1, . . . , LKP, a set IKP of i for which the variable ρKP(i) is a positive tuple (t, v→iKP) and with which an inner-product of v→iKP of the positive tuple and x→iKP included in ΓKP indicated by identification information t of the positive tuple becomes 0, and i for which the variable ρKP(i) is a negative tuple (t, v→iKP) and with which an inner-product of v→iKP of the negative tuple and x→tKP included in ΓKP indicated by identification information t of the negative tuple does not become 0;
and calculates a complementary coefficient αiKP with which a total of αiKPMiKP for i included in the set IKP specified becomes prescribed h→KP,
a CP complementary coefficient calculation part which, based on the variable ρCP(i) concerning each integer i=1, . . . , LCP included in the encrypted data ct(ΓKP,SCP), and the attribute set ΓCP included in the decryption key sk(SKP,ΓCP), specifies, among integers i=1, . . . , LCP, a set ICP of i for which the variable ρCP(i) is a positive tuple (t, v→iCP) and with which an inner-product of v→iCP of the positive tuple and x→tCP included in ΓCP indicated by identification information t of the positive tuple becomes 0, and i for which the variable ρCP(i) is a negative tuple (t, v→iCP) and with which an inner-product of v→iCP of the negative tuple and x→tCP included in ΓCP indicated by identification information t of the negative tuple does not become 0;
and calculates a complementary coefficient αiCP with which a total of αiCPMiCP for i included in the set ICP specified becomes the prescribed h→CP, and
a pairing operation part which calculates a value K by conducting a pairing operation indicated in Formula 1 for the elements c0, ctKP, and ciCP included in the encrypted data ct(ΓKP,SCP), and the elements k*0, k*iKP, and k*tCP included in the decryption key sk(DKP,ΓCP), based on the set IKP specified by the KP complementary coefficient calculation part, on the complementary coefficient αiKP calculated by the KP complementary coefficient calculation part, on the set ICP specified by the CP complementary coefficient calculation part, and on the complementary coefficient αiCP calculated by the CP complementary coefficient calculation part.
K
:=
e

(
c
0
,
k
0
*
)
·
i
∈
I
KP
⋀
∏
ρ
KP

(
i
)
=
(
t
,
v
→
i
KP
)


e

(
c
t
KP
,
k
i
*
KP
)

α
i
KP
·
i
∈
I
KP
⋀
∏
ρ
KP

(
i
)
=

(
t
,
v
→
i
KP
)


e

(
c
t
KP
,
k
i
*
KP
)

α
i
KP
/
(
v
→
i
KP
·
x
→
t
KP
)
·
i
∈
I
KP
⋀
∏
ρ
KP

(
i
)
=

(
t
,
v
→
i
KP
)


e

(
c
t
KP
,
k
i
*
KP
)

α
i
KP
/
(
v
→
i
KP
·
x
→
t
KP
)
·
i
∈
I
CP
⋀
∏
ρ
CP

(
i
)
=

(
t
,
v
→
i
CP
)


e

(
c
t
CP
,
k
i
*
CP
)

α
i
CP
·
i
∈
I
CP
⋀
∏
ρ
CP

(
i
)
=

(
t
,
v
→
i
CP
)


e

(
c
t
CP
,
k
i
*
CP
)

α
i
CP
/
(
v
→
i
CP
·
x
→
t
CP
)
[
Formula


1
]

277 more elements

A key generation device which generates a decryption key sk(SKP,ΓCP), in a cryptographic processing system which executes a cryptographic process using a basis B0 and a basis B0*, a basis BtKP and a basis B*tKP for each integer t=1, . . . , dKP (dKP is an integer of 1 or more), and a basis BtCP and a basis B*tCP for each integer t=1, . . . , dCP (dCP is an integer of 1 or more), the key generation device comprising:

a first KP information input part which takes as input, a variable ρKP(i) for each integer i=1, . . . , LKP (LKP is an integer of 1 or more), which variable ρKP(i) is either one of a positive tuple (t, v→KP) and a negative tuple (t, v→iKP) of identification information t (t is any one integer of t=1, . . . , dKP) and an attribute vector v→iKP:=(vi,i′KP) (i′=1, . . . , ntKP where ntKP is an integer of 1 or more), and a predetermined matrix MKP having LKP rows and rKP columns (rKP is an integer of 1 or more),
a first CP information input part which takes as input, an attribute set ΓCP having the identification information t and an attribute vector x→tCP:=(xt,i′CP) (i′ 1, . . . , ntCP where ntCP is an integer of 1 or more) for at least one integer t=1, . . . , dCP;
a main decryption key generation part which generates an element k*0 of the decryption key sk(SKP,ΓCP) by setting a value −s0KP(s0KPh→KP·(f→KP)T where h→KP and f→KP are vectors each having rKP of elements) as a coefficient for a basis vector b*0,p (p is a predetermined value) of the basis B*0, by setting a random number δCP as a coefficient for a basis vector b*0,p′ (p′ is a predetermined value different from prescribed p), and by setting a predetermined value κ as a coefficient for a basis vector b*0,q (q is a predetermined value different from the prescribed p and prescribed p′);
a KP decryption key generation part which generates an element k*iKP for each integer i=1 . . . , LKP, based on a column vector (s→KP)T:=(s1KP, . . . , siKP)T:=MKP·(f→KP)T (i=LKP) generated based on the prescribed f→KP and the matrix MKP which is inputted by the first KP information input part;
and a random number θiKP (i=1, . . . , LKP), the KP decryption key generation part being configured to generate the element k*iKP of the decryption key sk(SKP,ΓCP), when the variable ρKP(i) for each integer i=1, . . . , LKP is a positive tuple (t, v→iKP), by setting siKP+θiKPvi,1KP as a coefficient for a basis vector b*t,1KP of the basis B*tKP indicated by identification information t of the positive tuple, and by setting θiKPvi,i′KP as a coefficient for a basis vector b*t,i′KP indicated by the identification information t and by each integer i′=2, . . . , ntKP, and when the variable ρKP(i) is a negative tuple (t, v→iKP), by setting siKPvi,i′KP as a coefficient for the basis vector b*t,i′KP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntKP;
and
a CP decryption key generation part which generates an element k*tCP concerning each identification information t included in the attribute set ΓCP inputted by the first CP information input part, the CP decryption key generation part being configured to generate the element k*tCP of the decryption key sk(SKP,ΓCP) by setting xt,i′CP multiplied by the random number δCP as a coefficient for a basis vector b*t,i′CP (i′=1, . . . , ntCP) of the basis B*tCP.

4 more elements

An encryption device which generates encrypted data ct(ΓKP,SCP), in a cryptographic processing system which executes a cryptographic process using a basis B0 and a basis B0*, a basis BtKP and a basis B*tKP for each integer t=1, dKP (dKP is an integer of 1 or more), and a basis BtCP and a basis B*tCP for each integer t=1, . . . , dCP(dCP is an integer of 1 or more), the encryption device comprising:

a second KP information input part which takes as input, an attribute set ΓKP having identification information t and an attribute vector x→tKP:=(xt,i′KP) (i′=1, . . . , ntKP) for at least one integer t=1, . . . , dKP;
a second CP information input part which takes as input, a variable ρCP(i) for each integer i=1, . . . , LCP (LCP is an integer of 1 or more), which variable ρCP(i) is either one of a positive tuple (t, v→iCP) and a negative tuple (t, v→iKP) of identification information t (t is any one integer of t=1, . . . , dCP) and an attribute vector v→iCP:=(vi,i′CP)(i′=1, . . . ntCP), and a predetermined matrix MCP having LCP rows and rCP columns (rCP is an integer of 1 or more);
a main encrypted data generation part which generates an element c0 of encrypted data ct(ΓKP,SCP) by setting a random number ωKP as a coefficient for a basis vector b0,p of the basis B0, by setting a value −s0CP(s0CP:=h→CP·(f→CP)T where h→CP and r→CP are vectors each having rCP pieces of elements) as a coefficient for a basis vector b0,p′, and by setting a random number ζ as a coefficient for a basis vector b0,q;
a KP encrypted data generation part which generates an element ctKP concerning each identification information t included in the attribute set ΓKP inputted by the second KP information input part, the KP encrypted data generation part being configured to generate the element c0KP of the encrypted data ct(ΓKP,SCP) by setting xt,i′KP multiplied by the random number ωKP as a coefficient for a basis vector bt,i′KP (i′=1, . . . , nt) of the basis BtKP;
and
a CP encrypted data generation part which generates an element ciCP for each integer i=1 . . . , LCP, based on a column vector (s→CP)T:=(siCP, . . . , siCP)T:=MCP·(f→CP)T (i=LCP) generated based on prescribed f→CP and the matrix MCP which is inputted by the second CP information input part;
and a random number θiCP (i=1, . . . , LCP), the CP encrypted data generation part being configured to generate the element ciCP of the encrypted data ct(ΓKP,SCP), when the variable ρCP(i) for each integer i=1, . . . , LCP is a positive tuple (t, v→iCP), by setting siCP+θiCPvi,1CP as a coefficient for a basis vector bt,1CP of the basis BtCP indicated by identification information t of the positive tuple, and by setting θiCPvi,i′CP as a coefficient for a basis vector bt,i′CP indicated by the identification information t and by each integer i′=2, . . . , ntCP, and when the variable ρCP(i) is a negative tuple (t, v→iCP), by setting siCPvi,i′CP as a coefficient for the basis vector bt,i′CP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntCP.

4 more elements

A decryption device which decrypts encrypted data ct(ΓKP,SCP) with a decryption key sk(CKP,ΓCP), in a cryptographic processing system which executes a cryptographic process using a basis B0 and a basis B0*, a basis BtKP and a basis B*tKP for each integer t=1, . . . , dKP (dKP is an integer of 1 or more), and a basis BP and a basis B*tCP for each integer t=1, . . . , dCP (dCP is an integer of 1 or more), the decryption device comprising:

a data acquisition part which acquires the encrypted data ct(ΓKP,SCP) including
an attribute set ΓKP having identification information t and an attribute vector x→tKP:=(xt,i′KP) (i′=1, . . . , ntKP where ntKP is an integer of 1 or more) for at least one integer t=1, . . . , dKP,
a variable ρCP(i) for each integer i=1, . . . , LCP (LCP is an integer of 1 or more), which variable ρCP(i) is either one of a positive tuple (t, v→iCP) and a negative tuple (t, v→iCP) of identification information t (t is any one integer of t=1, . . . , dCP) and an attribute vector v→iCP:=(vi,i′CP) (i′=1, . . . , ntCP where ntCP is an integer of 1 or more),
a predetermined matrix MCP having LCP rows and rCP columns (rCP is an integer of 1 or more),
an element c0 where a random number ωKP is set as a coefficient for a basis vector b0,p of the basis B0, a value −s0CP(s0CP:=h→CP·(f→CP)T where h→CP and f→CP are vectors each having rCP pieces of elements) is set as a coefficient for a basis vector b0,p′, and a random number ζ is set as a coefficient for a basis vector b0,q,
an element ctKP concerning each identification information t included in the attribute set ΓKP where xt,i′KP multiplied by the random number ωKP is set as a coefficient for a basis vector bt,i′KP (i′=1, . . . , nt) of the basis BtKP, and
an element ciCP generated for each integer i=1 . . . , LCP, based on a column vector (s→CP)T:=(s1CP, . . . , siCP)T:=MCP·(f→CP)T (i=LCP) generated based on prescribed f→CP and the matrix MCP;
and a random number θiCP (i=1, . . . , LCP), wherein, in the element ciCP, when the variable ρCP(i) for each integer i=1, . . . , LCP is a positive tuple (t, v→iCP), siCP+θiCPvi,1CP is set as a coefficient for a basis vector bt,1CP of the basis BtCP indicated by identification information t of the positive tuple, and θiCPvi,i′CP is set as a coefficient for a basis vector bt,i′CP indicated by the identification information t and by each integer i′=2, . . . , ntCP, and when the variable ρCP(i) is a negative tuple (t, v→iCP), siCPvi,i′CP is set as a coefficient for the basis vector bt,i′CP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntCP;
a decryption key acquisition part which acquires a decryption key sk(SKP,ΓCP) including
a variable ρKP(i) for each integer i=1, . . . , LKP (LKP is an integer of 1 or more), which variable ρKP(i) is either one of a positive tuple (t, v→iKP) and a negative tuple (t, v→iKP) of identification information t (t is any one integer of t=1, . . . , dKP) and an attribute vector v→iKP:=(vi,i′KP) (i′=1, . . . , ntKP),
a predetermined matrix MKP having LKP rows and rKP columns (rKP is an integer of 1 or more),
an attribute set ΓCP having the identification information t and an attribute vector X→tCP:=(xt,i′CP) (i′=1, . . . , ntCP) for at least one integer t=1, . . . , dCP,
an element k*0 in which a value −s0KP(s0KP:=h→KP·(f→KP)T where h→KP and f→KP are vectors each having rKP pieces of elements) is set as a coefficient for a basis vector b*0,p (p is a predetermined value) of the basis B*0, a random number δCP is set as a coefficient for a basis vector b*0,p′ (p′ is a predetermined value different from prescribed p), and a predetermined value κ is set as a coefficient for a basis vector b*0,q (q is a predetermined value different from prescribed p and the prescribed p′),
an element k*iKP generated for each integer i=1 . . . , LKP, based on a column vector (s→KP)T:=(s1KP, . . . , siKP)T:=MKP·(f→KP)T (i=LKP) generated based on prescribed f→KP and the matrix MKP;
and a random number θiKP (i=1, . . . , LKP), wherein, in the element k*iKP, when the variable ρKP(i) for each integer i=1, . . . , LKP is a positive tuple (t, v→iKP), siKPθiKPvi,1KP is set as a coefficient for a basis vector b*t,iKP of the basis B*tKP indicated by identification information t of the positive tuple, and θiKPvi,i′KP is set as a coefficient for a basis vector b*t,i′KP indicated by the identification information t and by each integer i′=2, . . . , ntKP, and when the variable ρKP(i) is a negative tuple (t, v→iKP), siKPvi,i′KP is set as a coefficient for the basis vector b*t,i′KP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntKP, and
an element k*tCP concerning each identification information t included in the attribute set ΓCP, and where xt,i′CP multiplied by the random number δCP is set as a coefficient for a basis vector b*t,i′CP (i′=1, . . . , ntCP) of the basis B*tCP;
a KP complementary coefficient calculation part which, based on the attribute set ΓKP included in the encrypted data ct(ΓKP,SCP) acquired by the data acquisition part, and the variable ρKP(i) included in the decryption key sk(SKP,ΓCP) acquired by the decryption key acquisition part, specifies, among integers i=1, . . . , LKP, a set IKP of an integer i for which the variable ρKP(i) is a positive tuple (t, v→iKP) and with which an inner-product of v→iKP of the positive tuple and x→tKP included in ΓKP indicated by identification information t of the positive tuple becomes 0, and an integer i for which the variable ρKP(i) is a negative tuple (t, v→iKP) and with which an inner-product of v→iKP of the negative tuple and x→tKP included in ΓKP indicated by identification information t of the negative tuple does not become 0;
and calculates a complementary coefficient αiKP with which a total of αiKPMiKP for i included in the set IKP specified becomes prescribed h→KP;
a CP complementary coefficient calculation part which, based on the variable ρCP(i) concerning each integer i=1, . . . , LCP included in the encrypted data ct(ΓKP,SCP), and the attribute set ΓCP included in the decryption key sk(SKP,ΓCP), specifies, among integers i=1, . . . , LCP, a set ICP of i for which the variable ρCP(i) is a positive tuple (t, v→iCP) and with which an inner-product of v→iCP of the positive tuple and X→tCP included in ΓCP indicated by identification information t of the positive tuple becomes 0, and i for which the variable ρCP(i) is a negative tuple (t, v→iKP) and with which an inner-product of v→iCP of the negative tuple and x→tCP included in ΓCP indicated by identification information t of the negative tuple does not become 0;
and calculates a complementary coefficient αiCP with which a total of αiCPMiCP for i included in the set ICP specified becomes prescribed h→CP;
and
a pairing operation part which calculates a value K by conducting a pairing operation indicated in Formula 10 for the elements c0, ctKP, and ciCP included in the encrypted data ct(ΓKP,SCP), and the elements k*0, k*iKP, and k*tCP included in the decryption key sk(SKP,ΓCP), based on the set IKP specified by the KP complementary coefficient calculation part, on the complementary coefficient αiKP calculated by the KP complementary coefficient calculation part, on the set ICP specified by the CP complementary coefficient calculation part, and on the complementary coefficient αiCP calculated by the CP complementary coefficient calculation part.
[
Formula


10
]
K
:=
e

(
c
0
,
k
0
*
)
·
∏
i
∈

I
KP
⋀
ρ

KP

(
i
)
=
(
t
,
v
->
i
KP
)


e

(
c
t
KP
,
k
i
*
KP
)


α
i
KP
·
∏
i
∈
I
KP
⋀
ρ

KP

(
i
)
=

(
t
,
v
->
i
KP
)

e
(

c
t
KP
,

k
i
*
KP
)

α
i
KP
/
(
v
->
i
KP
·
x
_
t
KP
)
·
∏
i
∈
I
CP
⋀
ρ

CP

(
i
)
=
(
t
,
v
->
i
CP
)


e
(

c
t
CP
,

k
i
*
CP
)


α
i
CP
·

∏
i
∈

I
CP
⋀

ρ

CP

(
i
)
=

(
t
,
v
->
i
CP
)


e
(

c
t
CP

,

k
i
*
CP



)


α
i
CP
/

(
v
->
i
CP
·

x
->
t
CP
)

242 more elements

A cryptographic processing method which uses a basis B0 and a basis B0*, a basis BtKP and a basis B*tKP for each integer t=1, . . . , dKP (dKP is an integer of 1 or more), and a basis BP and a basis B*tCP for each integer t=1, . . . , dCP (d° is an integer of 1 or more), the cryptographic processing method comprising:

a first KP information input step of, with a key generation device, taking as input, a variable ρKP(i) for each integer i=1, . . . , LKP (LKP is an integer of 1 or more), which variable ρKP(i) is either one of a positive tuple (t, v→iKP) and a negative tuple (t, v→iKP) of identification information t (t is any one integer of t=1, . . . , dKP) and an attribute vector v→iKP:=(i′=1, . . . , ntKP where ntKP is an integer of 1 or more), and a predetermined matrix MKP having LKP rows and rKP columns (rKP is an integer of 1 or more);
a first CP information input step of, with the key generation device, taking as input, an attribute set ΓCP having the identification information t and an attribute vector x→tCP:=(xt,i′CP) (i′=1, . . . , ntCP where ntCP is an integer of 1 or more) for at least one integer t=1, . . . , dCP;
a main decryption key generation step of, with the key generation device, generating an element k*0 by setting a value −s0KP(s0KP:=h→KP·(f→KP)T where h→KP and f→KP are vectors each having rKP pieces of elements) as a coefficient for a basis vector b*0,p (p is a predetermined value) of the basis B*0, by setting a random number δCP as a coefficient for a basis vector b*0,p′ (p′ is a predetermined value different from prescribed p), and by setting a predetermined value κ as a coefficient for a basis vector b*0,q (q is a predetermined value different from the prescribed p and prescribed p′);
a KP decryption key generation step of, with the key generation device, generating an element k*iKP for each integer i=1 . . . , LKP, based on a column vector (s→KP)T:=(s1KP, . . . , siKP)T:=MKP·(f→KP)T (i=LKP) generated based on prescribed f→KP and the matrix MKP which is inputted in the first KP information input step;
and a random number θiKP (i=1, . . . , LKP), the KP decryption key generation step being configured to generate the element k*iKP, when the variable ρKP(i) for each integer i=1, . . . , LKP is a positive tuple (t, v→iKP), by setting siKP+θiKPvi,1KP as a coefficient for a basis vector b*t,1KP of the basis B*tKP indicated by identification information t of the positive tuple, and by setting θiKPvi,i′KP as a coefficient for a basis vector b*t,i′KP indicated by the identification information t and by each integer i′=2, . . . , ntKP, and when the variable ρKP(i) is a negative tuple (t, v→iKP), by setting siKPvi,i′KP as a coefficient for the basis vector b*t,i′KP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntKP;
a CP decryption key generation step of, with the key generation device, generating an element k*tCP concerning each identification information t included in the attribute set ΓCP inputted in the first CP information input step, the CP decryption key generation step being configured to generate the element k*tCP by setting xt,i′CP multiplied by the random number δCP as a coefficient for a basis vector b*t,i′CP (i′=1, . . . , ntCP) of the basis B*tCP;
a second KP information input step of, with an encryption device, taking as input, an attribute set ΓKP having the identification information t and an attribute vector x→tKP:=(xt,i′KP) (i′=1, . . . , ntKP) for at least one integer t=1, . . . , dKP;
a second CP information input step of, with the encryption device, taking as input, a variable ρCP(i) for each integer i=1, . . . , LCP (LCP is an integer of 1 or more), which variable ρCP(i) is either one of a positive tuple (t, v→iCP) and a negative tuple (t, v→iCP) of identification information t (t is any one integer of t=1, . . . , dCP) and an attribute vector v→iCP:=(vi,i′CP)(i′=1, . . . , ntCP), and a predetermined matrix MCP having LCP rows and rCP columns (rCP is an integer of 1 or more);
a main encrypted data generation step of, with the encryption device, generating an element c0 by setting a random number ωKP as a coefficient for a basis vector b0,p of the basis B0, by setting a value −s0CP(s0CP:=h→CP·(f→CP)T where h→CP and f→CP are vectors each having tCP pieces of elements) as a coefficient for a basis vector b0,p′, and by setting a random number ζ as a coefficient for a basis vector b0,q;
a KP encrypted data generation step of, with the encryption device, generating an element ctKP concerning each identification information t included in the attribute set ΓKP inputted in the second KP information input step, the KP encrypted data generation step being configured to generate the element ctKP by setting xt,i′KP multiplied by the random number ωKP as a coefficient for a basis vector bt,i′KP (i′=1, . . . , nt) of the basis BtKP;
a CP encrypted data generation step of, with the encryption device, generating an element ciCP for each integer i=1 . . . , LCP, based on a column vector (s→CP)T:=(s1CP, . . . , siCP)T:=MCP·(f→CP)T (i=LCP) generated enerated based on the prescribed f→CP and the matrix MCP which is inputted in the second CP information input step;
and a random number θiCP (i=1, . . . , LCP), the CP encrypted data generation step being configured to generate the element ciCP, when the variable ρCP(i) for each integer i=1, . . . , LCP is a positive tuple (t, v→iCP), by setting siCP+θiCPvi,1CP as a coefficient for a basis vector bt,1CP of the basis BtCP indicated by identification information t of the positive tuple, and by setting θiCPvi,i′CP as a coefficient for a basis vector bt,i′CP indicated by the identification information t and by each integer i′=2, . . . , ntCP, and when the variable ρCP(i) is a negative tuple (t, v→iCP), by setting siCPvi,i′CP as a coefficient for the basis vector bt,i′CP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntCP;
a data acquisition step of, with a decryption device, acquiring encrypted data ct(ΓCP,SCP) including the element c0 generated in the main encrypted data generation step, the element ctKP generated in the KP encrypted data generation step, the element ciCP generated in the CP encrypted data generation step, the attribute set ΓKP, and the variable ρCP(i);
a decryption key acquisition step of, with the decryption device, acquiring a decryption key sk(SKP,ΓCP) including the element k*0 generated in the main decryption key generation step, the element k*iKP generated in the KP decryption key generation step, the element k*tCP generated in the CP decryption key generation step, the variable ρKP(i), and the attribute set ΓCP;
a KP complementary coefficient calculation step of, with the decryption device, based on the attribute set ΓKP included in the encrypted data ct(ΓKP,SCP) acquired in the data acquisition step, and the variable ρKP(i) included in the decryption key sk(SKP,ΓCP) acquired in the decryption key acquisition step, specifying, among integers i=1, . . . , LKP, a set IKP of i for which the variable ρKP(i) is a positive tuple (t, v→iKP) and with which an inner-product of v→iKP of the positive tuple and x→tKP included in ΓKP indicated by identification information t of the positive tuple becomes 0, and i for which the variable ρKP(i) is a negative tuple (t, v→iKP) and with which an inner-product of v→iKP of the negative tuple and x→tKP included in ΓKP indicated by identification information t of the negative tuple does not become 0;
and calculating a complementary coefficient αiKP with which a total of αiKPMiKP for i included in the set IKP specified becomes prescribed h→KP;
a CP complementary coefficient calculation step of, with the decryption device, based on the variable ρCP(i) concerning each integer i=1, . . . , LCP included in the encrypted data ct(ΓKP,SCP), and the attribute set ΓCP included in the decryption key sk(SKP,ΓCP), specifying, among integers i=1, . . . , LCP, a set ICP of i for which the variable ρCP(i) is a positive tuple (t, v→iCP) and with which an inner-product of v→iCP of the positive tuple and x→tCP included in FCP indicated by identification information t of the positive tuple becomes 0, and i for which the variable ρCP(i) is a negative tuple (t, v→iCP) and with which an inner-product of v→iCP of the negative tuple and x→tCP included in ΓCP indicated by identification information t of the negative tuple does not become 0;
and calculating a complementary coefficient αiCP with which a total of αiCPMiCP for i included in the set ICP specified becomes the prescribed h→CP;
and
a pairing operation step of, with the decryption device, calculating a value K by conducting a pairing operation indicated in Formula 11 for the elements C0, ctKP, and ciCP included in the encrypted data ct(ΓKP,SCP), and the elements k*0, k*iKP, and k*tCP included in the decryption key sk(SKP,ΓCP), based on the set IKP specified in the KP complementary coefficient calculation step, on the complementary coefficient αiKP calculated in the KP complementary coefficient calculation step, on the set ICP specified in the CP complementary coefficient calculation step, and on the complementary coefficient αiCP calculated in the CP complementary coefficient calculation step.
[
Formula


11
]
K
:=
e

(
c
0
,
k
0
*
)
·
∏
i
∈

I
KP
⋀
ρ

KP

(
i
)
=
(
t
,
v
->
i
KP
)


e

(
c
t
KP
,
k
i
*
KP
)


α
i
KP
·
∏
i
∈
I
KP
⋀
ρ

KP

(
i
)
=

(
t
,
v
->
i
KP
)

e
(

c
t
KP
,

k
i
*
KP
)

α
i
KP
/
(
v
->
i
KP
·
x
_
t
KP
)
·
∏
i
∈
I
CP
⋀
ρ

CP

(
i
)
=
(
t
,
v
->
i
CP
)


e
(

c
t
CP
,

k
i
*
CP
)


α
i
CP
·

∏
i
∈

I
CP
⋀

ρ

CP

(
i
)
=

(
t
,
v
->
i
CP
)


e
(

c
t
CP
,

k
i
*
CP


)


α
i
CP
/

(
v
->
i
CP
·

x
->
t
CP
)

238 more elements

A cryptographic processing program comprising a key generation program, an encryption program, and a decryption program, and serving to execute a cryptographic process using a basis B0 and a basis B0*, a basis BtKP and a basis B*tKP for each integer t=1, . . . , dKP (dKP is an integer of 1 or more), and a basis BtCP and a basis B*tCP for each integer t=1, . . . , dCP (dCP is an integer of 1 or more),

wherein the key generation program includes causing a computer to execute
a first KP information input process of taking as input, a variable ρKP(i) for each integer i=1, . . . , LKP (LKP is an integer of 1 or more), which variable ρKP(i) is either one of a positive tuple (t, v43iKP) and a negative tuple (t, v→iKP) of identification information t (t is any one integer of t=1, . . . , dKP) and an attribute vector v→iKP:=(vi,i′KP) (i′=1, . . . , ntKP where ntKP is an integer of 1 or more), and a predetermined matrix MKP having LKP rows and rKP columns (rKP is an integer of 1 or more),
a first CP information input process of taking as input, an attribute set ΓCP having the identification information t and an attribute vector x→tCP:=(xt,i′CP) (i′=1, . . . , ntCP where ntCP is an integer of 1 or more) for at least one integer t=1, . . . , dCP,
a main decryption key generation process of generating an element k*0 by setting a value −s0KP(s0KP:=h→KP·(f→KP)T where h→and f→KP are vectors each having rKP pieces of elements) as a coefficient for a basis vector b*0,p (p is a predetermined value) of the basis B*0, by setting a random number δCP as a coefficient for a basis vector b*0,p′ (p′ is a predetermined value different from prescribed p), and by setting a predetermined value κ as a coefficient for a basis vector b*0,q (q is a predetermined value different from the prescribed p and prescribed p′),
a KP decryption key generation process of generating an element k*iKP for each integer i=1 . . . , LKP, based on a column vector (s→KP)T:=(s1KP, . . . , siKP)T:=MKP·(f→KP)T (i=LKP) generated based on prescribed r→KP and the matrix MKP which is inputted in the first KP information input process;
and a random number θiKP (i=1, . . . , LKP), the KP decryption key generation process being configured to generate the element k*iKP, when the variable ρKP(i) for each integer i=1, . . . , LKP is a positive tuple (t, v→iKP), by setting siKP+θiKPvi,1KP as a coefficient for a basis vector b*t,1KP of the basis B*tKP indicated by identification information t of the positive tuple, and by setting θiKPvi,i′KP as a coefficient for a basis vector b*t,i′KP indicated by the identification information t and by each integer i′=2, . . . , ntKP, and when the variable ρKP(i) is a negative tuple (t, v→iKP), by setting siKPvi,i′KP as a coefficient for the basis vector b*t,i′KP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntKP, and
a CP decryption key generation process of generating an element k*tCP concerning each identification information t included in the attribute set ΓCP inputted in the first CP information input process, the CP decryption key generation process being configured to generate the element k*tCP by setting xt,i′CP multiplied by the random number δCP as a coefficient for a basis vector b*t,i′CP (i′=1, . . . , ntCP) of the basis B*tCP,
wherein the encryption program includes causing the computer to execute
a second KP information input process of taking as input, an attribute set ΓKP having the identification information t and an attribute vector x→tKP:=(xt,i′KP) (i′=1, . . . , ntKP) for at least one integer t=1, . . . , dKP,
a second CP information input process of taking as input, a variable ρCP(i) for each integer i=1, . . . , LCP) (LCP is an integer of 1 or more), which variable ρCP(i) is either one of a positive tuple (t, v→iCP) and a negative tuple (t, v→iCP) of identification information t (t is any one integer of t=1, . . . , dCP) and an attribute vector v→iCP:=(vi,i′CP)(i′=1, . . . , ntCP), and a predetermined matrix MCP having LCP rows and rCP columns (rCP is an integer of 1 or more),
a main encrypted data generation process of generating an element c0 by setting a random number ωKP as a coefficient for a basis vector b0,p of the basis B0, by setting a value −s0CP(s0CP:=h→CP·(f→CP)T where h→CP and f→CP are vectors each having rCP pieces of elements) as a coefficient for a basis vector b0,p′, and by setting a random number ζ as a coefficient for a basis vector b0,q,
a KP encrypted data generation process of generating an element ctKP concerning each identification information t included in the attribute set ΓKP inputted in the second KP information input process, the KP encrypted data generation process being configured to generate the element ctKP by setting xt,i′KP multiplied by the random number ωKP as a coefficient for a basis vector bt,i′KP (i′=1, . . . , nt) of the basis BtKP, and
a CP encrypted data generation process of generating an element ciCP for each integer i=1 . . . , LCP, based on a column vector (s→CP)T:=(s1CP, . . . , siCP)T:=MCP·(f→CP)T (i=LCP) generated based on the prescribed f→CP and the matrix MCP which is inputted in the second CP information input process;
and a random number θiCP (i=1, . . . , LCP), the CP encrypted data generation process being configured to generate the element ciCP, when the variable ρCP(i) for each integer i=1, . . . , LCP is a positive tuple (t, v→iCP), by setting siCP+θiCPvi,1CP as a coefficient for a basis vector bt,1CP of the basis BtCP indicated by identification information t of the positive tuple, and by setting θiCPvi,i′CP as a coefficient for a basis vector bt,i′CP indicated by the identification information t and by each integer i′=2, . . . , ntCP, and when the variable ρCP(i) is a negative tuple (t, v→iCP), by setting siCPvi,i′CP as a coefficient for the basis vector bt,i′CP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntCP, and
wherein the decryption program includes causing the computer to execute
a data acquisition process of acquiring encrypted data ct(ΓKP,SCP) including the element c0 generated in the main encrypted data generation process, the element ctKP generated in the KP encrypted data generation process, the element ciCP generated in the CP encrypted data generation process, the attribute set ΓKP, and the variable ρCP(i),
a decryption key acquisition process of acquiring a decryption key sk(SKP,ΓCP) including the element k*0 generated in the main decryption key generation process, the element k*iKP generated in the KP decryption key generation process, the element k*tCP generated in the CP decryption key generation process, the variable ρKP(i), and the attribute set ΓCP,
a KP complementary coefficient calculation process of, based on the attribute set ΓKP included in the encrypted data ct(ΓKP,SCP) acquired in the data acquisition process, and the variable ρKP(i) included in the decryption key sk(SKP,ΓCP) acquired in the decryption key acquisition part, specifying, among integers i=1, . . . , LKP, a set IKP of i for which the variable ρKP(i) is a positive tuple (t, v→iKP) and with which an inner-product of v→iKP of the positive tuple and x→tKP included in ΓKP indicated by identification information t of the positive tuple becomes 0, and i for which the variable ρKP(i) is a negative tuple (t, v→iKP) and with which an inner-product of v→iKP of the negative tuple and x→tKP included in ΓKP indicated by identification information t of the negative tuple does not become 0;
and calculating a complementary coefficient αiKP with which a total of αiKPMiKP for i included in the set IKP specified becomes prescribed h→KP,
a CP complementary coefficient calculation process of, based on the variable ρCP(i) concerning each integer i=1, . . . , LCP included in the encrypted data ct(ΓKP,SCP), and the attribute set ΓCP included in the decryption key sk(SKP,ΓCP), specifying, among integers i=1, . . . , LCP, a set ICP of i for which the variable ρCP(i) is a positive tuple (t, v→iCP) and with which an inner-product of v→iCP of the positive tuple and x→tCP included in ΓCP indicated by identification information t of the positive tuple becomes 0, and i for which the variable ρCP(i) is a negative tuple (t, v→iCP) and with which an inner-product of v→iCP of the negative tuple and x→tCP included in ΓCP indicated by identification information t of the negative tuple does not become 0;
and calculating a complementary coefficient αiCP with which a total of αiCPMiCP for i included in the set ICP specified becomes the prescribed h→CP, and
a pairing operation process of calculating a value K by conducting a pairing operation indicated in Formula 12 for the elements c0, ctKP, and ciCP included in the encrypted data ct(ΓKP,SCP), and the elements k*0, k*iKP, and k*tCP included in the decryption key sk(SKP,ΓCP), based on the set IKP specified in the KP complementary coefficient calculation process, on the complementary coefficient αiKP calculated in the KP complementary coefficient calculation process, on the set ICP specified in the CP complementary coefficient calculation process, and on the complementary coefficient αiCP calculated in the CP complementary coefficient calculation process.
[
Formula


12
]
K
:=
e

(
c
0
,
k
0
*
)
·
∏
i
∈

I
KP
⋀
ρ

KP

(
i
)
=
(
t
,
v
->
i
KP
)


e

(
c
t
KP
,
k
i
*
KP
)


α
i
KP
·
∏
i
∈
I
KP
⋀
ρ

KP

(
i
)
=

(
t
,
v
->
i
KP
)

e
(

c
t
KP
,

k
i
*
KP
)

α
i
KP
/
(
v
->
i
KP
·
x
_
t
KP
)
·
∏
i
∈
I
CP
⋀
ρ

CP

(
i
)
=
(
t
,
v
->
i
CP
)


e
(

c
t
CP
,

k
i
*
CP
)


α
i
CP
·

∏
i
∈

I
CP
⋀

ρ

CP

(
i
)
=

(
t
,
v
->
i
CP
)


e
(

c
t
CP
,

k
i
*
CP


)


α
i
CP
/

(
v
->
i
CP
·

x
->
t
CP
)

240 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/823,507Filed 6 Dec 2011
Priority: JP 2010-28651122 Dec 2010
Published: 4 Jul 2013
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 9/08
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: key distribution or…
G09C 1/00
Apparatus or methods whereby a given sequence of signs
H04L 9/3073
Involving algebraic varieties, e.g. elliptic or hyper-elliptic curves: involving pairings, e.g. identity based encryption [IBE], bilinear mappings…
H04L 9/007
Involving public key infrastructure [PKI] trust models: involving hierarchical structures

Family

US 8,938,623 B2Related patent
US 2013/0173929 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

patentgrep

Loading patent…

Abstract

wherein the key generation device includes
a first KP information input part which takes as input, a variable ρKP(i) for each integer i=1, . . . , LKP (LKP is an integer of 1 or more), which variable ρKP(i) is either one of a positive tuple (t, v→iKP) and a negative tuple (t, v→iKP) of identification information t (t is any one integer of t=1, . . . , dKP) and an attribute vector v→iKP:=(vi,i′KP)(i′=1, . . . , ntKP where ntKP is an integer of 1 or more), and a predetermined matrix MKP having LKP rows and rKP columns (rKP is an integer of 1 or more),
a first CP information input part which takes as input, an attribute set ΓCP having the identification information t and an attribute vector x→tCP:=(xt,i′CP) (i′=1, . . . , ntCP where ntCP is an integer of 1 or more) for at least one integer t=1, . . . , dCP,
a main decryption key generation part which generates an element k*0 by setting a value −s0KP(s0KP:=h→KP·(f→KP)T where h→KP and f→KP are vectors each having rKP pieces of elements) as a coefficient for a basis vector b*0,p (p is a predetermined value) of the basis B*0, by setting a random number δCP as a coefficient for a basis vector b*0,p′ (p′ is a predetermined value different from prescribed p), and by setting a predetermined value κ as a coefficient for a basis vector b*0,q (q is a predetermined value different from the prescribed p and prescribed p′),
a KP decryption key generation part which generates an element k*iKP for each integer i=1 . . . , LKP, based on a column vector (s→KP)T:=(s1KP, . . . , siKP)T:=MKP·(f→KP)T (i=LKP) generated based on prescribed f→KP and the matrix MKP which is inputted by the first KP information input part;
and a random number θiKP (i=1, . . . , LKP), the KP decryption key generation part being configured to generate the element k*iKP, when the variable ρKP(i) for each integer i=1, . . . , LKP is a positive tuple (t, v→iKP), by setting siKP+θiKPvi,1KP as a coefficient for a basis vector b*t,1KP of the basis B*tKP indicated by identification information t of the positive tuple, and by setting θiKPvi,1KP as a coefficient for a basis vector b*t,i′KP indicated by the identification information t and by each integer i′=2, . . . , ntKP, and when the variable ρKP(i) is a negative tuple (t, v→iKP), by setting siKPvi,i′KP as a coefficient for the basis vector b*t,i′KP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntKP, and
a CP decryption key generation part which generates an element k*tCP concerning each identification information t included in the attribute set ΓCP inputted by the first CP information input part, the CP decryption key generation part being configured to generate the element k*tCP by setting xt,i′CP multiplied by the random number δCP as a coefficient for a basis vector b*t,i′CP (i′=1, . . . , ntCP) of the basis B*tCP,
wherein the encryption device includes
a second KP information input part which takes as input, an attribute set ΓKP having the identification information t and an attribute vector x→tKP:=(xt,i′KP)(i′1, . . . , ntKP) for at least one integer t=1, . . . , dKP,
a second CP information input part which takes as input, a variable ρCP(i) for each integer i=1, . . . , LCP (LCP is an integer of 1 or more), which variable ρCP(i) is either one of a positive tuple (t, v→iCP) and a negative tuple (t, v→iCP) of identification information t (t is any one integer of t=1, . . . , dCP) and an attribute vector t, v→iCP:=(vi,i′CP) (i′=1, . . . , ntCP), and a predetermined matrix MCP having LCP rows and rCP columns (rCP is an integer of 1 or more),
a main encrypted data generation part which generates an element c0 by setting a random number ωKP as a coefficient for a basis vector b0,p of the basis B0, by setting a value −s0CP(s0CP:=h→CP·(f→CP)T where h→CP and f→CP are vectors each having rCP pieces of elements) as a coefficient for a basis vector b0,p′ of the basis B0, and by setting a random number ζ as a coefficient for a basis vector b0,q,
a KP encrypted data generation part which generates an element ctKP concerning each identification information t included in the attribute set ΓKP inputted by the second KP information input part, the KP encrypted data generation part being configured to generate the element ctKP by setting xt,i′KP multiplied by the random number ωKP as a coefficient for a basis vector bt,i′KP (i′=1, . . . , nt) of the basis BtKP, and
a CP encrypted data generation part which generates an element ciCP for each integer i=1 . . . , LCP, based on a column vector (s→CP)T:=(s1CP, . . . , siCP)T:=MCP·(f→CP)T (i=LCP) generated based on the prescribed f→CP and the matrix MCP which is inputted by the second CP information input part;
and a random number θiCP (i=1, . . . , LCP), the CP encrypted data generation part being configured to generate the element ciCP, when the variable ρCP(i) for each integer i=1, . . . , LCP is a positive tuple (t, v→iCP), by setting siCP+θiCPvi,1CP as a coefficient for a basis vector bt,1CP of the basis BtCP indicated by identification information t of the positive tuple, and by setting θiCPvi,i′CP as a coefficient for a basis vector bt,i′CP indicated by the identification information t and by each integer i′=2, . . . , ntCP, and when the variable ρCP(i) is a negative tuple (t, v→iCP), by setting siCPvi,i′CP as a coefficient for the basis vector bt,i′CP indicated by the identification information t of the negative tuple and by each integer i′=1, . . . , ntCP, and
wherein the decryption device includes
a data acquisition part which acquires encrypted data ct(ΓKP,SCP) including the element c0 generated by the main encrypted data generation part, the element ctKP generated by the KP encrypted data generation part, the element ciCP generated by the CP encrypted data generation part, the attribute set ΓKP, and the variable ρCP(i),
a decryption key acquisition part which acquires a decryption key sk(SKP,ΓCP) including the element k*0 generated by the main decryption key generation part, the element k*iKP generated by the KP decryption key generation part, the element k*tCP generated by the CP decryption key generation part, the variable ρKP(i), and the attribute set ΓCP,
a KP complementary coefficient calculation part which, based on the attribute set ΓKP included in the encrypted data ct(ΓKP,SCP) acquired by the data acquisition part, and the variable ρKP(i) included in the decryption key sk(SKP,ΓCP) acquired by the decryption key acquisition part, specifies, among integers i=1, . . . , LKP, a set IKP of i for which the variable ρKP(i) is a positive tuple (t, v→iKP) and with which an inner-product of v→iKP of the positive tuple and x→iKP included in ΓKP indicated by identification information t of the positive tuple becomes 0, and i for which the variable ρKP(i) is a negative tuple (t, v→iKP) and with which an inner-product of v→iKP of the negative tuple and x→tKP included in ΓKP indicated by identification information t of the negative tuple does not become 0;
and calculates a complementary coefficient αiKP with which a total of αiKPMiKP for i included in the set IKP specified becomes prescribed h→KP,
a CP complementary coefficient calculation part which, based on the variable ρCP(i) concerning each integer i=1, . . . , LCP included in the encrypted data ct(ΓKP,SCP), and the attribute set ΓCP included in the decryption key sk(SKP,ΓCP), specifies, among integers i=1, . . . , LCP, a set ICP of i for which the variable ρCP(i) is a positive tuple (t, v→iCP) and with which an inner-product of v→iCP of the positive tuple and x→tCP included in ΓCP indicated by identification information t of the positive tuple becomes 0, and i for which the variable ρCP(i) is a negative tuple (t, v→iCP) and with which an inner-product of v→iCP of the negative tuple and x→tCP included in ΓCP indicated by identification information t of the negative tuple does not become 0;
and calculates a complementary coefficient αiCP with which a total of αiCPMiCP for i included in the set ICP specified becomes the prescribed h→CP, and
a pairing operation part which calculates a value K by conducting a pairing operation indicated in Formula 1 for the elements c0, ctKP, and ciCP included in the encrypted data ct(ΓKP,SCP), and the elements k*0, k*iKP, and k*tCP included in the decryption key sk(DKP,ΓCP), based on the set IKP specified by the KP complementary coefficient calculation part, on the complementary coefficient αiKP calculated by the KP complementary coefficient calculation part, on the set ICP specified by the CP complementary coefficient calculation part, and on the complementary coefficient αiCP calculated by the CP complementary coefficient calculation part.
K
:=
e

(
c
0
,
k
0
*
)
·
i
∈
I
KP
⋀
∏
ρ
KP

(
i
)
=
(
t
,
v
→
i
KP
)


e

(
c
t
KP
,
k
i
*
KP
)

α
i
KP
·
i
∈
I
KP
⋀
∏
ρ
KP

(
i
)
=

(
t
,
v
→
i
KP
)


e

(
c
t
KP
,
k
i
*
KP
)

α
i
KP
/
(
v
→
i
KP
·
x
→
t
KP
)
·
i
∈
I
KP
⋀
∏
ρ
KP

(
i
)
=

(
t
,
v
→
i
KP
)


e

(
c
t
KP
,
k
i
*
KP
)

α
i
KP
/
(
v
→
i
KP
·
x
→
t
KP
)
·
i
∈
I
CP
⋀
∏
ρ
CP

(
i
)
=

(
t
,
v
→
i
CP
)


e

(
c
t
CP
,
k
i
*
CP
)

α
i
CP
·
i
∈
I
CP
⋀
∏
ρ
CP

(
i
)
=

(
t
,
v
→
i
CP
)


e

(
c
t
CP
,
k
i
*
CP
)

α
i
CP
/
(
v
→
i
CP
·
x
→
t
CP
)
[
Formula


1
]

277 more elements

Facts

Application

13/823,507Filed 6 Dec 2011

Priority

JP 2010-28651122 Dec 2010

Published

4 Jul 2013

Term ends

Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 9/08
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: key distribution or…
G09C 1/00
Apparatus or methods whereby a given sequence of signs
H04L 9/3073
Involving algebraic varieties, e.g. elliptic or hyper-elliptic curves: involving pairings, e.g. identity based encryption [IBE], bilinear mappings…
H04L 9/007
Involving public key infrastructure [PKI] trust models: involving hierarchical structures