Electronic data encryption and encrypted data decryption system, and its method
An object of the present invention is to provide an electronic data encryption and decryption system allowing a privileged user to decrypt all encrypted data without using a plurality of secret keys but only by using a single secret key that the privileged user himself has. An electronic data encryption and decryption system includes: a privileged user device, a user device, and an encrypted data generation device. The privileged user device has: a privileged user key generation means for generating a privileged user secret key x and a privileged user public key x·P (P is a generator); a first session key generation means for generating a session key K; and a first decryption means for decrypting the encrypted data by using the session key K generated by the first session key generation means. The user device has: a user key generation means for generating a user secret key r, a user public key r·P, and a public key rx·P; a second session key generation means for generating the session key K; and a second decryption means for decrypting the encrypted data by using the session key K generated by the second session key generation means. The encrypted data generation device has: a third session key generation means for generating the session key K by using the public key rx·P, session key generation information s, and a random point Q; and a means for encrypting the input electronic data by using the session key K generated by the third session key generation means.
1. An electronic data encryption and decryption system comprising:
a privileged-user device, a user device and an encrypted data generation device, wherein the privileged-user device comprises:
a privileged-user key generation unit that generates a privileged-user secret key x and a privileged-user public key x·P, where P is a generator, and stores the privileged-user secret key and the privileged-user public key in a first key storage unit,
a first input/output unit that receives at least encrypted data from the encrypted data generation device and sends to the user device the privileged-user public key stored in the first key storage unit,
a first session key generation unit that generates a session key K based on bilinear pairing using the privileged-user secret key stored in the first key storage unit, and
a first decryption unit that decrypts the encrypted data by using the session key K generated by the first session key generation unit;
the user device comprises:
a second input/output unit that receives the privileged-user public key x·P from the privileged-user device, and receives at least the encrypted data from the encrypted data generation device,
a user key generation unit that generates a user secret key r, a user public key r·P, and a public key rx·P and stores the user secret key, the user public key and the public key in a second key storage unit,
a second session key generation unit that generates the session key K based on the bilinear pairing using the user secret key stored in the second key storage unit, and
a second decryption unit that decrypts the encrypted data by using the session key K generated by the second session key generation unit; and
the encrypted data generation device comprises:
a third input/output unit that receives from the user device at least the public key rx·P and stores the at least the public key in a third key storage unit,
a third session key generation unit that generates a session key K based on the bilinear pairing by using the public key rx·P, session key generation information s and a random point Q, which are stored in the third key storage unit, and
a unit that encrypts input electronic data using the session key K generated by the third session key generation unit.
2. The electronic data encryption and decryption system according to claim 1 , wherein the first session key generation unit uses the following expression to generate the session key K:
K=e ( sr·P,x·Q ) [Numeral Expression 10]
where e( ) denotes bilinear pairs, s is session key generation information, r denotes a user secret key, P denotes a generator, x denotes a privileged-user secret key, and Q is a random point.
3. The electronic data encryption and decryption system according to claim 1 , wherein the second session key generation unit uses the following expression to generate the session key K:
K=e ( sx·P,r·Q ) [Numeral Expression 11]
where e( ) denotes bilinear pairs, s is session key generation information, x denotes a privileged-user secret key, P denotes a generator, r denotes a user secret key, and Q is a random point.
4. The electronic data encryption and decryption system according to claim 1 , wherein the third session key generation unit uses the following expression to generate the session key K:
K=e ( rx·P,s·Q ) [Numeral Expression 12]
where e( ) denotes bilinear pairs, r denotes a user secret key, x denotes a privileged-user secret key, P denotes a generator, s is session key generation information, and Q is a random point.
5. The electronic data encryption and decryption system according to claim 1 , wherein session key information sx·P and sr·P and random point Q have been added to the encrypted data.
6. A privileged-user device comprising:
a privileged-user key generation unit that generates a privileged-user secret key x and a privileged-user public key x·P, where P is a generator, and stores the privileged-user secret key and the privileged-user public key in a key storage unit;
an input/output unit that receives at least encrypted data from an encrypted data generation device and sends to the user device the privileged-user public key stored in the key storage unit;
a session key generation unit that generates a session key K based on bilinear pairing using the privileged-user secret key stored in the key storage unit; and
a decryption unit that decrypts encrypted data by using the session key K generated by the session key generation unit, wherein the session key generation unit uses the following expression to generate the session key K:
K=e ( sr·P,x·Q ) [Numeral Expression 13]
where e( ) denotes bilinear pairs, s is session key generation information, r denotes a user secret key, P denotes a generator, x denotes a privileged-user secret key, and Q is a random point.
7. A user device comprising:
an input/output unit that receives from a privileged-user device a privileged-user public key x·P, where x is a privileged-user secret key and P is a generator, and receives at least encrypted data from an encrypted data generation device;
a user key generation unit that generates a user secret key r, a user public key r· 3 , and a public key rx·P and stores the user secret key, the user public key and the public key in a key storage unit, the generated user public key r·P and the public key rx·P being sent from the input/output unit to the encrypted data generation device;
a session key generation unit that generates a session key K based on bilinear pairing using the user secret key stored in the key storage unit; and
a decryption unit that decrypts the encrypted data sent from the encrypted data generation device by using the session key K generated by the session key generation unit.
8. The user device according to claim 7 , wherein the session key generation unit uses the following expression to generate the session key K:
K=e ( sx·P,r·Q ) [Numeral Expression 14]
where e( ) denotes bilinear pairs, s is session key generation information, x denotes a privileged-user secret key, P denotes a generator, r denotes a user secret key, and Q is a random point.
9. An encrypted data generation device comprising:
an input/output unit that receives from a user device at least a public key rx·P, where r is a user secret key, x is a privileged-user secret key, and P is a generator, and stores the at least the public key in a key storage unit;
a session key generation unit that generates a session key K based on bilinear pairing using the public key rx·P, session key generation information s and a random point Q, which are stored in the key storage unit; and
a unit that encrypts input electronic data using the session key K generated by the session key generation unit, wherein the input/output unit sends the encrypted electronic data to the user device and a privileged user device.
10. The encrypted data generation device according to claim 9 , wherein the key generation unit uses the following expression to generate the session key K:
K=e ( rx·P,s·Q ) [Numeral Expression 15]
where e( ) denotes bilinear pairs, r denotes a user secret key, x denotes a privileged-user secret key, P denotes a generator, s is session key generation information, and Q is a random point.
11. A non-transitory record medium on which a computer program is recorded, said computer program comprising instructions for having a computer function as a privileged-user device, the privileged-user device comprising:
a privileged-user key generation unit that generates a privileged-user secret key x and a privileged-user public key x·P, where P is a generator, and stores the privileged-user secret key and the privileged-user public key in a key storage unit;
an input/output that receives at least encrypted data from an encrypted data generation device and sends to the user device the privileged-user public key stored in the first key storage unit;
a session key generation unit that generates a session key K based on based on bilinear pairing using the privileged-user secret key stored in the key storage unit; and
a decryption unit that decrypts encrypted data by using the session key K generated by the session key generation unit, wherein the session key generation unit uses the following expression to generate the session key K:
K=e ( sr·P,x·Q ) [Numeral Expression 16]
where e( ) denotes bilinear pairs, s is session key generation information, r denotes a
user secret key, P denotes a generator, x denotes a privileged-user secret key, and Q is a random point.
12. A non-transitory record medium on which a computer program is recorded, said computer program comprising instructions for having a computer function as a user device, the user device comprising:
an input/output unit that receives from a privileged-user device a privileged-user public key x·P, where x is a privileged-user secret key and P is a generator, and receives at least encrypted data from an encrypted data generation device;
a user key generation unit that generates a user secret key r, a user public key r·P, and a public key rx·P and stores the user secret key, the user public key and the public key in a key storage unit, the generated user public key r·P and the public key rx·P being sent from the input/output unit to the encrypted data generation device;
a session key generation unit that generates a session key K based on bilinear pairing using the user secret key stored in the key storage unit; and
a decryption unit that decrypts the encrypted data sent from the encrypted data generation device by using the session key K generated by the session key generation unit.
13. The non-transitory record medium according to claim 12 , wherein the session key generation unit uses the following expression to generate the session key K:
K=e ( sx·P,r·Q ) [Numeral Expression 17]
where e( ) denotes bilinear pairs, s is session key generation information, x denotes a privileged-user secret key, P denotes a generator, r denotes a user secret key, and Q is a random point.
14. A non-transitory record medium on which a computer program is recorded, said computer program comprising instructions for having a computer function as an encrypted data generation device, the encrypted data generation device comprising:
an input/output unit that receives from a user device at least a public key rx·P, where r is a user secret key, x is a privileged-user secret key, and P is a generator, and stores the at least the public key in a key storage unit;
a session key generation unit that generates a session key K based on bilinear pairing using the public key rx·P, session key generation information s and a random point Q, which are stored in the key storage unit; and
a unit that encrypts input electronic data using the session key K generated by the session key generation unit, wherein the input/output unit sends the encrypted electronic data to the user device and the privileged user device.
15. The non-transitory record medium according to claim 14 , wherein the session key generation unit uses the following expression to generate the session key K:
K=e ( rx·P,s·Q ) [Numeral Expression 18]
where e( ) denotes bilinear pairs, r denotes a user secret key, x denotes a privileged-user secret key, P denotes a generator, s is session key generation information, and Q is a random point.
16. An electronic data encryption and decryption method comprising:
a privileged-user key generation step of generating a privileged-user secret key x and a privileged-user public key x·P;
a first input/output step of receiving encrypted data
a first session key generation step of generating a session key K based on bilinear pairing using the privileged-user secret key;
a first decryption step of decrypting encrypted data by using the session key K generated by the first session key generation step;
a second input/output step of receiving the privileged-user public key x·P, and receives at least the encrypted data
a user key generation step of generating a user secret key r, a user public key r·P, and a public key rx·P;
a second session key generation step of generating the session key K based on the bilinear pairing using the user secret key;
a second decryption step of decrypting the encrypted data by using the session key K generated by the second session key generation step;
a third input/output step of receiving at least a public key rx·P, where r is a user secret key, x is a privileged-user secret key, and P is the generator;
a third session key generation step of generating a session key K based on bilinear pairing by using the public key rx·P, session key generation information s and a random point Q; and
a step of encrypting input electronic data using the session key K generated by the third session key generation step.
17. The electronic data encryption and decryption method according to claim 16 , wherein the first session key generation step uses the following expression to generate the session key K:
K=e ( sr·P,x·Q ) [Numeral Expression 19]
where e( ) denotes bilinear pairs, s is session key generation information, r denotes a user secret key, P denotes a generator, x denotes a privileged-user secret key, and Q is a random point.
18. The electronic data encryption and decryption method according to claim 16 , wherein the second session key generation step uses the following expression to generate the session key K:
K=e ( sx·P,r·Q ) [Numeral Expression 20]
where e( ) denotes bilinear pairs, s is session key generation information, x denotes a privileged-user secret key, P denotes a generator, r denotes a user secret key, and Q is a random point.
19. The electronic data encryption and decryption method according to claim 16 , wherein the third session key generation step uses the following expression to generate the session key K:
K=e ( rx·P,s·Q ) [Numeral Expression 21]
where e( ) denotes bilinear pairs, r denotes a user secret key, x denotes a privileged-user secret key, P denotes a generator, s is session key generation information, and Q is a random point.
20. The electronic data encryption and decryption method according to claim 16 , wherein session key information sx·P and sr·P and random point Q have been added to the encrypted data.