JP4819625B2 - Encryption processing method, key-isolated encryption system, and terminal device - Google Patents

Description

  The present invention relates to an encryption processing method in a key-separated encryption system, a key-isolated encryption system, and a terminal device used in the key-isolated encryption system.

  Along with the advance of so-called information technology (IT), encryption systems that perform encryption processing of information to be transmitted and received are widely used today.

  In such an encryption system, if the encryption algorithm used for the encryption process is analyzed, there is a problem because the security of the information to be encrypted cannot be ensured.

  However, the problem is that the key used for the encryption process is leaked to the outside due to carelessness of the user who uses the cryptographic system, rather than analyzing the cryptographic algorithm. .

  Therefore, in order to deal with such key leakage, a so-called “key isolation type cryptographic system” is known (for example, Non-Patent Documents 1 and 2). In the key-separated encryption system, information encrypted by other users in the key-isolated encryption system is stored for a predetermined period using the user's decryption key stored in the terminal device connected to the communication network. It is possible to decrypt only.

  In the key isolation type cryptographic system, “key update information” is generated using “secret information” stored in an external device (for example, an IC card) connected to the terminal device. The user of the terminal device can update the user's decryption key used in the terminal device using the key update information.

  In other words, a major feature of the key-isolated cryptographic system is that even if some of the user's decryption keys applied in a certain period are leaked to the outside, as long as the total number of leaked decryption keys does not exceed a certain number, the leak The decryption key applied in other periods other than the period in which the decryption key is applied is still unknown to users other than the user. That is, it does not affect the security in other periods other than the period in which the leaked decryption key is applied.

  Here, a specific configuration example of the key isolation type cryptographic system will be briefly described. For example, assume that the update interval of the user's decryption key is 1 day, and (N-1) key updates, that is, N days are assumed.

A user (terminal device) in the key-isolated encryption system uses a public key encryption (for example, RSA encryption or ElGamal encryption), and N public key / decryption key pairs ((pk _i , sk _i ) _{1 ≦ i ≦ N} ) and pk = (pk _i ) _{0 ≦ i ≦ N} is disclosed as a public key.

Further, the user (terminal device) stores dk ₀ = sk ₀ as an initial decryption key. Further, the decryption key sk = (sk _i ) _{0 ≦ i ≦ N} is used as a master key hk * (secret information), and the master key hk * is enclosed in an external device (for example, a tamper resistant area such as an IC card).

For example, in the j-th key update, the external device generates key update information d _j = sk _j based on the master key hk * and the j-th key update. The generated key update information d _j is transmitted to a terminal device connected through a secure communication path.

The user (terminal device), and generates a new decryption key dk _j = d _j by using the key update information d _j, erases the decryption key dk _j-1 and d _j far.
Y. Dodis, J. Katz, S. Xu and M. Yung, “Key-Insulated Public-Key Cryptosystems”, Proc. Of Eurocrypt 2002, Lecture Notes in Computer Science Vol. 2332, 2002, Springer-Verlag, p. 65-82 M. Bellare and A. Palacio, “Protecting against Key Exposure: Strongly Key-Insulated Encryption with Optimal Threshold”, Cyptology ePrint Archive 064, Internet <URL: http://eprint.iacr.org/2002>

  However, the above-described conventional key isolation type cryptographic system has the following problems. That is, since there is basically only one external device used by the user in the key isolation type cryptographic system, there is a problem that the user cannot flexibly update the decryption key.

  For example, when the external device is stored at home, the user cannot update the decryption key while out.

  Although it is conceivable that the user carries an external device, it causes another problem that the key isolation type cryptographic system is threatened by loss or theft. It is also possible to prepare multiple external devices that contain the same master key hk * (secret information). In this case as well, the key-separated encryption system is threatened by the loss or theft of any external device. Therefore, the security of the encrypted information is reduced as compared with the case where there is one external device.

  Therefore, the present invention has been made in view of such a situation, and an encryption process capable of performing a key update and an encryption process more flexibly without reducing the security of encrypted information. It is an object to provide a method, a key-isolated encryption system, and a terminal device.

In order to solve the problems described above, the present invention has the following features. First, the first feature of the present invention is to update a terminal device (for example, terminal device 10A) that executes encryption processing and a terminal secret key (for example, decryption key dk _j ) stored in the terminal device. An encryption processing method in a key-isolated encryption system including an external device (external device 40A, 40B) that stores secret information that is a secret key selected from a predetermined number of public key and secret key pairs The key isolation type cryptographic system includes at least a first external device (external device 40A) and a second external device (external device 40B), and the first external device and the second external device have already been updated. Associated with the updated number of times the terminal secret key is updated (for example, whether the updated number is an odd number or an even number), and the first external device and the second external device have different secret information. (Master key hk * _odd and master key hk * _even ) are stored, the step of selecting either the first external device or the second external device according to the number of updates, and the selected first external device Or the second external device generates key update information (for example, d _j ) used for updating the terminal secret key based on the number of updates and the stored secret information; Updating the terminal secret key to a first updated terminal secret key (decryption key dk _j-1 ) using the key update information generated by the first external device; and the first updated terminal secret key Updating the terminal secret key to a second updated terminal secret key (decryption key dk _j ) using the key update information generated by the second external device at an update timing immediately after being generated; The terminal device is a terminal secret after the first update First public key corresponding to the key (the public key pk _j-1), and encrypts information (plain text m) using the second public key (public key pk _j) which corresponds to the second updated terminal secret key And a step in which another terminal device different from the terminal device (for example, the terminal device 20) decrypts the information using the first updated terminal secret key and the second updated terminal secret key. The gist is to provide.

  According to such a feature, different external devices are associated with the number of times the terminal secret key has been updated, and different secret information is stored in each of the external devices. That is, the user of the terminal device can use different external devices installed in a plurality of different places by connecting the associated external devices according to the number of times the terminal secret key is updated. Also, since different secret information is stored in each external device, even if any external device is lost or stolen, a certain number of decryption keys cannot be obtained. The security of the cryptographic system can be maintained.

  That is, according to such a feature, it is possible to update the key more flexibly without reducing the security of the encrypted information.

  Furthermore, according to such a feature, the public key (second public key) corresponding to the number of times the terminal private key has been updated, and the public key (first public key) corresponding to the period immediately before the public key are stored. Information is encrypted using both public keys. Further, the encrypted information can be decrypted unless both the second updated terminal private key and the first updated terminal private key decryption key immediately before the second updated terminal private key are used. Can not.

  Therefore, even if either the first external device or the second external device is lost or stolen, the attacker who obtained the external device can decrypt the encrypted information without using the external device. Therefore, the security of the key isolation type cryptographic system can be further improved.

A second feature of the present invention relates to the first feature of the present invention, wherein the terminal device uniquely identifies the external device identification information for uniquely identifying the first external device, and the second external device. Acquiring external device identification information from the first external device and the second external device, respectively,
In the step of selecting the first external device or the second external device, the external device connected to the terminal device is connected to the terminal secret based on the external device identification information and the update count. The gist is to determine whether or not the device is an external device for which a key update is to be requested.

  A third feature of the present invention relates to the first feature of the present invention, wherein the first external device is associated with a first cycle (for example, one month) for generating key update information, and The second external device is shorter than the first cycle and is associated with a second cycle (for example, one day) for generating key update information (key update information δi), and the first external device or In the step of selecting one of the second external devices, either the first external device or the second external device is selected according to the update time of the terminal secret key (for example, the first day of a certain month). In the step of selecting and generating the key update information, the first external device or the second external device generates the key update information based on the update time and the stored secret information. In the step of updating to the terminal secret key after the second update, Terminal device, by using the key update information and the second external device is generated, is summarized in that updating the terminal secret key to the second updated terminal secret key.

A fourth feature of the present invention relates to the third feature of the present invention, wherein, in the encrypting step, the terminal device uses a public key (public key pk _all ) corresponding to the terminal secret key and the update time. The gist is to encrypt the information using the update time information (date) indicating.

A fifth feature of the present invention relates to the third feature of the present invention, wherein G1 and G2 are groups of order q, and g is a generation source of G1, and e: G1 × G1 → G2 and the ^{e (g a, g b)} = e (g, g) bilinear map satisfying the ^ab, the key update information is generated using a hash function defined on the basis of the bilinear mapping This is the gist.

A sixth feature of the present invention is that a terminal device (for example, terminal device 10A, terminal device 20) that executes encryption processing, and a terminal secret key (for example, decryption key dk _j ) stored in the terminal device. A key-isolated cryptographic system comprising an external device (external device 40A, 40B) for storing secret information that is a secret key selected from a predetermined number of public key and secret key pairs used for updating. The key-separated encryption system includes at least a first external device (external device 40A) and a second external device (external device 40B), and the first external device and the second external device have already been updated. It is associated with the number of updates of the terminal secret key (for example, whether the number of updates is an odd number or an even number), and different secret information (master key) is stored in the first external device and the second external device. hk * _odd and a master The key hk * _{the even)} is stored, the first external device and the second external device, wherein a number of updates, on the basis of said secret information stored and used to update the terminal secret key A key update information generation unit (key update information generation unit 403) that generates key update information (for example, d _j ), wherein the terminal device uniquely identifies the first external device; and An external device identification information acquisition unit (update unit 205) that acquires external identification information for uniquely identifying the second external device from the first external device and the second external device, respectively, and the external device identification information acquisition unit An external device that determines whether or not the external device connected to the terminal device is an external device that should request the update of the terminal secret key based on the acquired external device identification information and the number of times of update Device judgment And (updating unit 205), the corresponding to the first first updated terminal secret key external device is the terminal secret key which is updated using the key update information is generated (decryption key dk _j-1) 1 public key (public key pk _j-1 ) and the update timing immediately after the first updated terminal secret key is generated, updated using the key update information generated by the second external device An encryption unit (encryption) that encrypts information (plain text m) using a second public key (public key pk _j ) corresponding to a second updated terminal secret key (decryption key dk _j ) that is a terminal secret key Part 105).

  A seventh feature of the present invention relates to the sixth feature of the present invention, wherein the terminal device decrypts the information using the first updated terminal secret key and the second updated terminal secret key. The gist is to further include a unit (decoding unit 209).

An eighth feature of the present invention relates to the sixth feature of the present invention, wherein the first external device is associated with a first cycle (for example, one month) for generating key update information, and The second external device is shorter than the first cycle and is associated with a second cycle (for example, one day) for generating key update information (key update information δi), and the external device determination unit Depending on the update time of the terminal secret key (for example, the first day of a certain month), either the first external device or the second external device is selected, and the key update information generation unit One external device or the second external device generates the key update information on the basis of the update time and the stored secret information, and the encryption unit releases the public corresponding to the terminal secret key key (public key pk _all) and said indicating an update time update time before using the information (date) Information is summarized in that the encryption.

A ninth feature of the present invention is that it is connected to an external device (external device 40A, 40B) that stores secret information that is a secret key selected from a predetermined number of public key and secret key pairs, and is a key isolation type. A terminal device (for example, terminal device 10A, terminal device 20) used in the cryptographic system, wherein the external device includes at least a first external device (external device 40A) and a second external device (external device 40B), The first external device and the second external device are associated with the number of updates of the terminal secret key that has already been updated (for example, whether the number of updates is an odd number or an even number), Different secret information (master key hk * _odd and master key hk * _even ) is stored in one external device and the second external device, and external device identification information for uniquely identifying the first external device, and The second outside External identification information for uniquely identifying the external device is acquired by the external device identification information acquisition unit (update unit 205) that acquires the external identification information from the first external device and the second external device, respectively, and the external device identification information acquisition unit. Whether the external device connected to the terminal device is an external device that should request the update of the terminal secret key based on the external device identification information and the number of times the terminal secret key has been updated. An external device determination unit (update unit 205) that determines whether or not, and a first updated terminal secret key (decryption key) that is the terminal secret key updated using the key update information generated by the first external device dk _j-1 ) corresponding to the first public key (public key pk _j-1 ) and the key generated by the second external device at the update timing immediately after the first updated terminal secret key is generated Updated with update information The terminal secret key a is using the second public key (public key pk _j) which corresponds to the second updated terminal secret key (decryption key dk _j), the encryption unit for encrypting information (plaintext m) was ( And an encryption unit 105).

  A tenth feature of the present invention relates to the ninth feature of the present invention, wherein a decryption unit (decryption unit 209) decrypts the information using the first updated terminal secret key and the second updated terminal secret key. ) Is further provided.

An eleventh feature of the present invention relates to the ninth feature of the present invention, wherein the first external device is associated with a first period (for example, one month) for generating key update information, and The second external device is shorter than the first cycle and is associated with a second cycle (for example, one day) for generating key update information (key update information δi), and the external device determination unit Depending on the update time of the terminal secret key (for example, the first day of a certain month), either the first external device or the second external device is selected, and the encryption unit The information is encrypted using a public key (public key pk _all ) corresponding to, and update time information (date) indicating the update time.

A twelfth feature of the present invention relates to the eleventh feature of the present invention, wherein G1 and G2 are groups of order q, and g is a generation source of G1, and e: G1 × G1 → G2 and the ^{e (g a, g b)} = e (g, g) bilinear map satisfying the ^ab, the key update information is generated using a hash function defined on the basis of the bilinear mapping This is the gist.

  According to the features of the present invention, there is provided an encryption processing method, a key-isolated encryption system, and a terminal device that can perform key update and encryption processing more flexibly without reducing the security of encrypted information. Can be provided.

[First Embodiment]
Next, a first embodiment of the present invention will be described. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals. However, it should be noted that the drawings are schematic and ratios of dimensions and the like are different from actual ones.

  Accordingly, specific dimensions and the like should be determined in consideration of the following description. Moreover, it is a matter of course that portions having different dimensional relationships and ratios are included between the drawings.

(Overall schematic configuration of key-isolated encryption system)
FIG. 1 is an overall schematic configuration diagram of a key isolation type cryptographic system according to the present embodiment. As shown in FIG. 1, the key-separated encryption system according to the present embodiment includes terminal devices 10A and 10B, a terminal device 20, a public information server 30, and external devices 40A and 40B.

  The terminal devices 10A and 10B, the terminal device 20, and the public information server 30 are connected to the communication network 1.

  In the key isolation type cryptographic system according to the present embodiment, the key isolation type encryption is performed using the user's decryption key dk (terminal secret key) stored in the terminal device 20 (terminal device) connected to the communication network 1. Information encrypted by a terminal device (for example, terminal device 10A) used by another user in the system can be decrypted only for a predetermined period.

  In the key-isolated encryption system according to the present embodiment, encryption processing of information to be transmitted / received is executed according to the encryption method described in Non-Patent Document 1 or Non-Patent Document 2 described above.

  The terminal devices 10 </ b> A and 10 </ b> B encrypt the plaintext m using the user's public key pk of the terminal device 20, and transmit the ciphertext c obtained by encrypting the plaintext m to the terminal device 20.

  The terminal device 20 receives the ciphertext c transmitted by the terminal device 10A (or 10B), and restores the received ciphertext c to the plaintext m using the decryption key dk of the user of the terminal device 20. In this embodiment, terminal device 10A, 10B and the terminal device 20 comprise the terminal device which performs an encryption process.

  As the terminal devices 10A and 10B and the terminal device 20, a personal computer or a PDA (personal digital assistant) provided with a communication interface for accessing the communication network 1 can be used.

  Further, as the terminal device, a mobile communication terminal (for example, a mobile phone terminal) that can access the communication network 1 via the radio base station 1a, such as the terminal device 10B, may be used.

  The public information server 30 discloses the public keys pk of the users of the terminal devices 10A and 10B and the terminal device 20 constituting the key-isolated encryption system to other users via the communication network 1.

  The external devices 40A and 40B store a master key hk * (secret information) used for updating the decryption key dk (terminal secret key) of the user of the terminal device 20 stored in the terminal device 20. In the present embodiment, the external device 40A is installed in the home RG. The external device 40B is installed in the company OF.

  The master key hk * is a secret key selected from a predetermined number of public key and secret key pairs using general public key encryption (for example, RSA encryption or ElGamal encryption). The master key hk * is used to generate key update information d for updating the decryption key dk (terminal secret key) of the user of the terminal device 20.

  In the present embodiment, the external devices 40A and 40B, that is, a plurality of external devices are associated with the number of updates of the decryption key dk that has already been updated.

In addition, the external device 40A (first external device) and the external device 40B (second external device) have different master keys hk * (specifically, master key hk * _odd and master key hk * _even ). Is stored. Details of the master key hk * stored in the external devices 40A and 40B will be described later.

  The external devices 40A and 40B can be configured by, for example, an IC card having a tamper-resistant area and an IC card reader / writer. Further, when the terminal device is a mobile communication terminal, the charger of the terminal device may have the function of the external device 40A (40B).

(Logical block configuration of key isolation type cryptosystem)
Next, the logical block configuration of the terminal device 10A (10B), the terminal device 20, the public information server 30, and the external device 40A (40B) constituting the key-isolated encryption system according to the present embodiment will be described.

(1) Terminal device 10A
FIG. 2 is a logical block configuration diagram of the terminal device 10A. The terminal device 10B has the same configuration as the terminal device 10A. Hereinafter, portions related to the present invention will be mainly described. Accordingly, it should be noted that the terminal device 10A may include a logical block (such as a voice communication unit) that is not illustrated or omitted in description, which is essential for realizing the function of the terminal device 10A (described below). The same applies to the terminal device 20, the public information server 30, and the external device 40A).

  As illustrated in FIG. 2, the terminal device 10A includes a communication unit 101, an input unit 103, an encryption unit 105, and a storage unit 107.

  The communication unit 101 provides a communication interface for connecting to the communication network 1. The communication unit 101 relays the ciphertext c transmitted by the encryption unit 105.

  The input unit 103 is an interface (for example, a keyboard or a drive device for a data recording medium) for inputting the plaintext m encrypted by the encryption unit 105.

  The encryption unit 105 encrypts the plaintext m input by the input unit 103 and generates a ciphertext c. Specifically, the encryption unit 105 acquires the public key pk of the user of the terminal device 20 disclosed in the public information server 30, and uses the acquired public key pk of the user of the terminal device 20 to convert the plaintext m. Encrypt.

In the present embodiment, the encryption unit 105 encrypts the plaintext m using the following public key pk. First, the encryption unit 105 uses the key update information (for example, key update information d _j-1 ) generated by the external device 40A (first external device) to update the decryption key dk _j-1 (first The public key pk _j-1 (first public key) corresponding to (1 updated terminal private key) is used.

Second, the encryption unit 105 performs key update information (for example, key update information) generated by the external device 40B (second external device) at the update timing (j) immediately after the decryption key dk _j-1 is generated. The public key pk _j (second public key) corresponding to the decryption key dk _j (second updated terminal secret key) updated using d _j ) is used.

The encryption unit 105 encrypts the plaintext m (information) using both public keys pk _j-1 and pk _j .

  The storage unit 107 stores the public key pk of the user of the terminal device 20 acquired from the public information server 30.

(2) Terminal device 20
FIG. 3 is a logical block configuration diagram of the terminal device 20. As illustrated in FIG. 3, the terminal device 20 includes a communication unit 201, a generation unit 203, an update unit 205, a storage unit 207, a decoding unit 209, and an output unit 211.

  The communication unit 201 provides a communication interface for connecting to the communication network 1. The communication unit 101 is connected to the generation unit 203, the update unit 205, the decryption unit 209, and the output unit 211, and relays the key update information d and the decryption key dk transmitted and received between the logical blocks.

  The generation unit 203 generates a predetermined number of public key and private key pairs using general public key cryptography (for example, RSA cipher or ElGamal cipher).

  The update unit 205 updates the decryption key dk of the user of the terminal device 20. Specifically, the update unit 205 updates the decryption key dk using the key update information d generated by the external device 40A or the external device 40B.

  In particular, in the present embodiment, the external device 40A is associated with an odd-numbered update of the decryption key dk. On the other hand, the external device 40B is associated with the even-numbered update of the decryption key dk.

  In addition, the update unit 205 can acquire external device identification information that uniquely identifies the external devices 40A and 40B from the external device. In the present embodiment, the update unit 205 constitutes an external device identification information acquisition unit.

  Furthermore, the update unit 205 is connected to the terminal device 20 based on the acquired external device identification information and the number of updates in which the decryption key dk (terminal secret key) of the user of the terminal device 20 has already been updated. It is possible to determine whether or not the device is an external device that should request the update of the decryption key dk. In the present embodiment, the update unit 205 constitutes an external device determination unit.

  The storage unit 207 stores a predetermined number of public / private key pairs generated by the generation unit 203, the decryption key dk of the user of the terminal device 20, and the like.

  The decryption unit 209 decrypts the ciphertext c transmitted by the terminal device 10A (10B). Specifically, the decryption unit 209 decrypts the ciphertext c using the decryption key dk of the user of the terminal device 20 stored in the storage unit 207.

Specifically, the decryption unit 209 uses the decryption keys dk _j-1 (first updated terminal secret key) and decryption key dk _j (second updated terminal secret key) to decrypt the ciphertext c. Decrypt. The decryption unit 209 can store the plaintext m restored by decrypting the ciphertext c in the storage unit 207 or output it to the output unit 211.

  The output unit 211 outputs plain text m obtained by decrypting the ciphertext c. For example, the output unit 211 includes a liquid crystal display that displays contents such as plaintext m, and a drive device that records data such as plaintext m on a recording medium (for example, a memory card).

  In the present embodiment, the terminal device 10A (10B) and the terminal device 20 have different logical blocks. However, the terminal device 10A (10B) includes the terminal device 20 in addition to the logical block of the terminal device 10A. The logic block may be provided. Similarly, the terminal device 20 may include a logical block of the terminal device 10 </ b> A in addition to the logical block of the terminal device 20.

(3) Public information server 30
FIG. 4 is a logical block configuration diagram of the public information server 30. As shown in FIG. 4, the public information server 30 includes a communication unit 301, a control unit 303, and a public information database 305.

  The communication unit 301 provides a communication interface for connecting to the communication network 1. In addition, the communication unit 301 relays the public key pk of the user of the terminal device 20 transmitted by the control unit 303.

  The control unit 303 stores the public key pk of the user of the terminal device 20 transmitted by the terminal device 20 in the public information database 305. In response to a request from the terminal device 10A or the like, the control unit 303 transmits the user's public key pk of the terminal device 20 stored in the public information database 305 to the terminal device 10A.

  The public information database 305 stores the public key pk of the user of the terminal device 20 and forms a public information database composed of the public key pk of the user in the key isolation type cryptographic system.

(4) External device 40A
FIG. 5 is a logical block diagram of the external device 40A. The external device 40B has the same configuration as the external device 40A. As illustrated in FIG. 5, the external device 40 </ b> A includes a communication unit 401, a key update information generation unit 403, and a storage unit 405.

  The communication unit 401 provides a communication interface for connecting to the communication network 1. The communication unit 401 relays the key update information d transmitted by the key update information generation unit 403.

The key update information generation unit 403 is used to update the decryption key dk of the user of the terminal device 20 using the master key hk * (specifically, the master key hk * _odd ) stored in the storage unit 405. Key update information d to be generated.

  In the present embodiment, as described above, the external device 40A is associated with the odd-numbered update of the decryption key dk.

That is, the key update information generation unit 403 is used for updating the decryption key dk based on the number of updates of the decryption key dk and the stored master key hk * (specifically, the master key hk * _odd ). Key update information d is generated. Specifically, the key update information generation unit 403 generates key update information d based on an instruction from the terminal device 20 when the decryption key dk is updated an odd number of times. In the present embodiment, the key update information generation unit 403 constitutes a key update information generation unit.

  Also, the key update information generation unit 403 can transmit external device identification information that uniquely identifies the external device 40A to the terminal device 20 in response to a request from the terminal device 20 (update unit 205). As the external device identification information, for example, the device type information and the manufacturing serial number of the external device 40A can be used.

The storage unit 405 stores a master key hk * (specifically, a master key hk * _odd ). The master key hk * is preferably stored in the tamper resistant area of the storage unit 405.

(Operation of key-isolated cryptosystem)
Next, with reference to FIGS. 6 to 8, the operation of the key-separated encryption system according to the present embodiment described above will be described.

  In the key isolation type cryptographic system according to the present embodiment, the public key pk of the user of the terminal device 20 once generated is not changed, and only the decryption key dk is updated every predetermined period.

  In the present embodiment, the update interval of the decryption key dk is assumed to be half a day (predetermined period), and the user of the terminal device 20 is assumed to use the key-separated encryption system for N days.

  The user of the terminal device 20 alternately uses the external device 40A installed in the home RG and the external device 40B installed in the company OF, and updates the decryption key dk every half day.

(1) Storage of Master Key FIG. 6 shows that the terminal device 20 generates a master key hk * (master key hk * _odd , master key hk * _even ), and stores the generated master key hk * in the external devices 40A and 40B. The operation flow up to is shown.

  In step S <b> 101, the terminal device 20 generates a predetermined number of public key and private key pairs using general public key encryption (for example, RSA encryption or ElGamal encryption).

Specifically, the terminal device 20 generates _2N public / private key pairs ((pk _i , sk _i ) _{1 ≦ i ≦ 2N} ) according to use for N days.

In step S102, the terminal device 20 sets the public key (pk _i ) _{0 ≦ i ≦ 2N} as the public key pk of the user of the terminal device 20 in the key-isolated encryption system.

  In step S <b> 103, the terminal device 20 transmits the public key pk to the public information server 30.

  In step S <b> 104, the public information server 30 stores the public key pk received from the terminal device 20 in the public information database 305.

In step S105, the terminal device 20 stores dk ₀ = sk ₀ in the storage unit 207 as an initial decryption key.

In step S106, the terminal device 20, the secret key _{sk = (sk i) (i} = odd, 1 ≦ i ≦ N) to the external device 40A of the master key hk * _odd, the master key hk * _odd to an external device 40A Send.

In step S107, the external device 40A stores the master key hk * _odd in the storage unit 405.

In step S108, the terminal device 20, the secret key _{sk = (sk i) (i} = even, 1 ≦ i ≦ N) to the external device 40B of the master key hk * _{the even,} the master key hk * _{the even} the external device 40B Send.

In step S109, the external device 40B stores the master key hk * _even in the storage unit 405.

(2) Update of Decryption Key dk FIG. 7 shows an operation flow in which the terminal device 20 updates the decryption key dk. As shown in FIG. 7, in step S201, the terminal device 20 determines that a predetermined period (half day) has passed since the last update of the decryption key dk, and needs to update the j-th decryption key dk. Recognize

  In step S202, the terminal device 20 determines whether the j-th update of the decryption key dk is an odd number or an even number.

When the decryption key dk is updated an odd number of times (“j = odd number” in step S202), in step S203, the terminal device 20 sends the decryption key dk (specifically, the decryption key dk) to the external device 40A. Requests generation of key update information d required for updating _j-1 ).

  Prior to the processing in step S203, the user of the terminal device 20 connects the terminal device 20 and the external device 40A.

  Also, in conjunction with the processing of step S203 of the terminal device 20, external device identification information that uniquely identifies the external device 40A is acquired from the external device 40A, and the external device 40A updates the j-th (odd-number) decryption key dk. It may be determined whether or not the external device is to be used for the above.

In step S204, the external apparatus 40A uses the master key hk * _odd stored in the storage unit 405 and the key update information d using the period information j associated with the j-th update of the decryption key dk. Generate _j = sk _j . Note that the specific key update information d _j is generated according to the method disclosed in Non-Patent Document 1 described above.

In step S205, the external device 40A transmits the generated key update information d _j to the terminal device 20.

On the other hand, when the decryption key dk is updated for the even number of times (“j = even” in step S202), in step S206, the terminal device 20 sends a decryption key dk (specifically, decryption) to the external device 40B. Requests generation of key update information d necessary for updating the key dk _j-1 ).

  Prior to the processing in step S206, the user of the terminal device 20 connects the terminal device 20 and the external device 40B.

  Also, in conjunction with the process of step S206 of the terminal device 20, external device identification information that uniquely identifies the external device 40B is acquired from the external device 40B, and the external device 40B updates the j-th (even-numbered) decryption key dk. It may be determined whether or not the external device is to be used for the above.

In step S207, the external device 40B uses the master key hk * _even stored in the storage unit 405 and the key update information d using the period information j associated with the j-th update of the decryption key dk. Generate _j = sk _j .

In step S208, the external device 40B transmits the generated key update information d _j to the terminal device 20.

In step S209, the terminal device 20 generates a decryption key dk _j = d _j using the key update information d _j and the period information j received from the external device 40A or the external device 40B. The specific key update information _dj is generated according to the method disclosed in Non-Patent Document 1 described above.

In step S _< b> 210, the terminal device 20 deletes the key update information d _j and the old decryption key dk (specifically, the decryption key dk _j−2 ) from the storage unit 207.

(3) Transmission / Reception of Ciphertext FIG. 9 shows an operation flow in which the terminal device 10A transmits the ciphertext c to the terminal device 20, and the terminal device 20 decrypts the ciphertext c. As illustrated in FIG. 9, in step S <b> 301, the terminal device 10 </ b> A requests the public information server 30 for the public key pk of the user of the terminal device 20.

  In step S302, the public information server 30 transmits the public key pk of the user of the terminal device 20 to the terminal device 10A in response to a request from the terminal device 10A.

In step S303, the terminal apparatus 10A corresponds to the public key pk _j corresponding to the period j when the ciphertext c is generated from the received public key pk, and the period j-1 immediately before the public key pk _j. Select the public key pk _j-1 to be used.

Furthermore, the terminal device 10A applies a combination of the public key pk _j-1 and the public key pk _j to a predetermined encryption algorithm (for example, RSA encryption). The terminal device 10A applies the combination of the public key pk _j-1 and the public key pk _{j to} the encryption algorithm, thereby encrypting the plaintext m including the content of the message to be transmitted to the user of the terminal device 20, Generate c.

  In step S <b> 304, the terminal device 10 </ b> A transmits the generated ciphertext c to the terminal device 20.

In step S305, the terminal device 20, the decryption key dk _j, and the decryption key dk _j decryption key dk _j-1 a predetermined encryption algorithm also corresponds to a period j-1 of the previous one from being stored in the storage unit 207 (For example, RSA encryption) The terminal device 20 decrypts the received ciphertext c and restores the plaintext m by applying the combination of the decryption key dk _j and the decryption key dk _{j-1 to} the encryption algorithm.

(Action / Effect)
According to the key isolation type cryptographic system according to the present embodiment described above, a plurality of different external devices, that is, the external devices 40A and 40B are associated with the number of times the decryption key dk has been updated. Are stored with different master keys hk * (master key hk * _odd and master key hk * _even ).

  That is, the user of the terminal device 20 connects an associated external device (for example, the external device 40A if the decryption key dk is updated for the odd number of times) according to the number of updates of the decryption key dk. External devices installed in a plurality of different places (home RG and company OF) can be used properly.

In addition, each external device stores a different master key hk * (master key hk * _odd and master key hk * _even ), so _even if one of the external devices is lost or stolen, it remains constant. Since the number of decryption keys dk cannot be acquired, the security of the key-isolated encryption system can be maintained.

Furthermore, in the present embodiment, both the public of the public key pk _j-1 corresponding to the public key pk _j, and the previous one than the public key pk _j period j-1 corresponding to the period j when generating the ciphertext c The plaintext m is encrypted using the key. The ciphertext c plaintext m is encrypted, to be used both decryption key of the decryption key dk _j-1 corresponding to the decryption key dk _j, and the previous one than the decryption key dk _j period j-1 Unable to decrypt into plaintext m.

  For this reason, even if either the external device 40A or the external device 40B is lost or stolen, an attacker who has obtained the external device can decrypt the ciphertext c at all using the external device. Therefore, it is possible to further improve the security of the key isolation type cryptographic system.

  Further, even if the attacker uses the key update information d stored in the external device and the decryption key dk of the user of the terminal device 20 leaked at the specific time, the period including the specific time, and The security of all periods other than the decryption key dk generated in the period before and after the period can be ensured.

  That is, according to the key isolation type cryptographic system according to the present embodiment, the update and encryption processing of the decryption key dk can be performed more flexibly without reducing the security of the encrypted information (for example, the ciphertext c). It can be carried out.

[Second Embodiment]
Next, a second embodiment of the present invention will be described. In the first embodiment described above, the key update information d for updating the decryption key dk (terminal secret key) is generated by always using two external devices (external devices 40A and 40B) alternately. In the embodiment, the two external devices may not be used alternately. In other words, this embodiment considers improving the convenience of the user while ensuring a certain level of security of the key-separated encryption system.

  Specifically, in this embodiment, the decryption key dk is updated every day. The user of the terminal device 20 updates the decryption key dk every day using the external device 40B installed in the company OF. Furthermore, the user of the terminal device 20 updates the decryption key dk only once a month using the external device 40A installed in the home RG.

  The user of the terminal device 20 does not have to update the decryption key dk by always using the external device 40A and the external device 40B alternately. Therefore, the user can store the external device 40A that is used only once a month in a physically safe place such as a safe (not shown) of the home RG.

  Hereinafter, parts different from the first embodiment will be mainly described, and description of parts similar to the first embodiment will be omitted as appropriate.

(Logical block configuration of key isolation type cryptosystem)
The logical block configuration of the key-isolated cryptographic system according to the present embodiment is the same as the logical block configuration (see FIGS. 2 to 5) of the key-isolated cryptographic system according to the first embodiment.

  In the present embodiment, the external device 40A (first external device) is used to generate the key update information δi only once a month. That is, the external device 40A is associated with one used every month (first period).

  On the other hand, the external device 40B (second external device) is used every day to generate the key update information δi except when the external device 40A is used. That is, the external device 40B is associated with a one-day cycle (second cycle). As described above, the cycle in which the external device 40B is used to generate the key update information δi is set to be shorter than the cycle in which the external device 40A is used to generate the key update information δi (one month cycle).

In the present embodiment, generation of key update information δi, generation of ciphertext c, and restoration of plaintext m are executed based on a bilinear map that satisfies a predetermined condition. Specifically, G1 and G2 are groups of order q, and g is a generator of G1. Further, e: G1 × G1 → G2 is a bilinear map satisfying (Expression 1).
^{e (g a, g b)} = e (g, g) ab ... ( Equation 1)

Also, let G and H be hash functions shown in (Equation 2).
G: G2 → {0, 1} ⁿ , H: {0, 1} ^* → G1 (Formula 2)

  Furthermore, s1 and s2 are randomly selected from a set Zq that is a set of integers 1 to q-1. The selected s1 is stored as the master key 1 in the external device 40B. The selected s2 is stored as the master key 2 in the external device 40A.

In the present embodiment, the date i is used to generate (calculate) the initial decryption key dk ₀ and the ciphertext c. The date i is expressed in the form of “year / month / day”. For example, if it is August 1, 2006, it is expressed as “2006/08/01”.

  Next, functional blocks that execute processing different from the first embodiment will be described. The update unit 205 of the terminal device 20 according to the present embodiment selects either the external device 40A or the external device 40B according to the update time of the decryption key dk (terminal secret key). Specifically, the decryption key dk on the first day of every month is generated by updating the decryption key dk on the previous day, that is, the last day of the previous month, using the master key 2 stored in the external device 40A.

  On the other hand, the decryption key dk on days other than the first day of each month is generated by updating the decryption key dk of the previous day using the master key 1 stored in the external device 40B.

For example, when the update unit 205 starts to use from August 1, 2006 (the update of the decryption key dk starts from the next day), the update unit 205 generates the initial decryption key dk ₀ using (Equation 3).
Initial decryption key dk ₀ = H (2006/08/01) ^s1 · H (2006/08/01) ^s2 (Formula 3)

In addition, the update unit 205 generates the decryption key dk _i of the date i using (Equation 4) including the decryption key dk _i-1 of the previous day and the key update information δi.
Decryption key dk _i = δi · dk _i-1 (Formula 4)

Incidentally, the update unit 205, after generating a decryption key dk _i, erasing the previous day of the decryption key dk _i-1 and the key update information δi from the storage unit 207.

In the public information server 30 according to the present embodiment, the following information is disclosed as the public key pk _all of the user of the terminal device 20.

Public key pk _all = <q, G1, G2, g, e, n, h1, h2, G, H>
In addition, h1 and h2 are calculated | required by (Formula 5). The public key pk _all is used in common for all periods.
h1 = g ^s1
h2 = g ^s2 (Formula 5)

The key update information generation unit 403 of the external devices 40A and 40B generates key update information δi using the hash function H determined based on the bilinear mapping described above. Specifically, when the date i is the first day of the month (for example, September 1, 2006), the key update information generation unit 403 generates key update information δi using (Equation 6). .
Key update information δi = H (date of the first day of the previous month) ^−s2 · H (i) ^s2 (Expression 6)

  That is, when the date i is the first day of the month, the key update information δi is generated using the master key 2 (s2) stored in the external device 40A.

When the date i is the second day of the month (for example, September 2, 2006), the key update information generation unit 403 generates key update information δi using (Expression 7).
Key update information δi = H (date of the day before last) ^−s1 · H (i) ^s1 (Expression 7)

  That is, when the date i is the second day of the month, the key update information δi is generated using the master key 1 (s1) stored in the external device 40B. Note that “date two days before” in (Expression 7) indicates August 31, 2006 when the date i is September 2, 2006.

Furthermore, when the date i is other than the first day or the second day of the month, the key update information generation unit 403 generates key update information δi using (Equation 8).
Key update information δi = H (date of previous day) ^−s1 · H (i) ^s1 (Expression 8)

  That is, when the date i is other than the first day or the second day of the month, the key update information δi is generated using the master key 1 (s1) stored in the external device 40B.

Further, the encryption unit 105 of the terminal device 10A (10B) according to the present embodiment encrypts the plaintext m using (Equation 9) to generate a ciphertext c.
Ciphertext c = <i, c0, c1> (Equation 9)

Here, c0 is obtained using (Equation 10).
c0 = g ^r (Formula 10)

Further, the encryption unit 105 encrypts the plaintext m using the update time information corresponding to the update time of the public key pk _all and the decryption key dk, and generates a ciphertext c. Specifically, when the date i is the first day of the month, the encryption unit 105 generates a ciphertext c1 using (Equation 11).
Ciphertext c1 = m XOR G ((e (h1, H (previous day date)) · e (h2, H (i))) ^ r) (Formula 11)

If the date i is other than the first day of the month, the encryption unit 105 generates a ciphertext c1 using (Equation 12).
Ciphertext c1 = m XOR G ((e (h1, H (i)) · e (h2, H (date of the first day of the current month))) ^ r)
... (Formula 12)

  That is, when the date i is the first day of the month (for example, September 1, 2006), the encryption unit 105 uses the date of the previous day (2006) as the update time information corresponding to the update time of the decryption key dk. August 31 of the year). When the date i is other than the first day of the month (for example, September 3, 2006), the encryption unit 105 uses the first time of the current month as update time information corresponding to the update time of the decryption key dk. The date of the day (September 1, 2006) is used. In the present embodiment, the plain text m is assumed to be an n-bit bit string.

Further, the decryption unit 209 of the terminal device 20 according to the present embodiment uses the public key pk _all , the date i, and the ciphertext c (= <i, c0, c1>) to use the ciphertext using (Formula 13). Decrypt c and restore plaintext m.
Plain text m = c1 XOR G (e (c0, dk _i )) (Formula 13)

(Operation of key-isolated cryptosystem)
Next, with reference to FIGS. 9 to 11, the operation of the key-isolated encryption system according to the present embodiment will be described. FIGS. 9 to 11 respectively correspond to FIGS. 6 to 8 showing an operation flow of the key isolation type cryptographic system according to the first embodiment. Specifically, FIG. 9 shows a master key storage operation, FIG. 10 shows a decryption key dk update operation, and FIG. 11 shows a ciphertext transmission / reception operation.

  The following description will mainly focus on differences from the operation of the key-isolated cryptographic system according to the first embodiment described above.

(1) Storage of Master Key As shown in FIG. 9, in step S1101, the terminal device 20 randomly selects s1 and s2 from the set Zq.

  In step S1102, the terminal device 20 transmits the selected s1 as the master key 1 to the external device 40A.

  In step S1103, the external device 40A stores the master key 1 in the storage unit 405.

  In step S1104, the terminal apparatus 20 transmits the selected s2 as the master key 2 to the external apparatus 40B.

  In step S1105, the external device 40B stores the master key 2 in the storage unit 405.

In step S1106, the terminal device 20 determines the public key pk _all (= <q, G1, G2, g, e, n, h1, h2, G, H>).

In step S <b> 1107, the terminal device 20 transmits the public key pk _all to the public information server 30.

In step S 1108, the public information server 30 stores the public key pk _all received from the terminal device 20 in the public information database 305.

In step S 1109, the terminal device 20 stores the initial decryption key dk ₀ in the storage unit 207. The initial decryption key dk ₀ is generated using (Equation 3) as described above.

(2) Update of Decryption Key dk As shown in FIG. 10, in step S1201, the terminal device 20 determines that a predetermined period (one day) has elapsed since the last update of the decryption key dk, and i Recognizes that it is necessary to update the decryption key dk for the first time.

  In step S1202, the terminal device 20 determines the current date i. When the date i is the first day of the month (for example, September 1, 2006), in step S1203, the terminal device 20 requests the external device 40B to generate the key update information δi.

  In step S1204, the external device 40B generates the key update information δi using (Equation 6) described above. In step S1205, the external device 40B transmits the generated key update information δi to the terminal device 20.

  If the date i is the second day of the month (for example, September 2, 2006), the terminal device 20 requests the external device 40A to generate the key update information δi in step S1206.

  In step S1207, the external device 40A generates the key update information δi using (Expression 7) described above. In step S1208, the external device 40A transmits the generated key update information δi to the terminal device 20.

  Furthermore, when the date i is other than the first day or the second day of the month, in step S1209, the terminal device 20 requests the external device 40A to generate the key update information δi.

  In step S1210, the external device 40A generates the key update information δi using (Equation 8) described above. In step S1211, the external device 40A transmits the generated key update information δi to the terminal device 20.

In step S1212, the terminal device 20 based on the key update information δi received from the external device 40A or the external device 40B, to generate a decryption key dk _i by using the above-described (Equation 4).

In step S1213, the terminal device 20 deletes the key update information δi and the decryption key dk _i-1 from the storage unit 207.

(3) Transmission / Reception of Ciphertext The processing in steps S1301 and S1302 shown in FIG. 11 is the same as the processing in steps S301 and S302 shown in FIG. In step S1303, the terminal apparatus 10A randomly selects r from the set Zq.

  If the current date i, that is, the timing for generating the ciphertext c is the first day of the month, in step S1304, the terminal apparatus 10A generates the ciphertext c using (Equation 11) described above.

  If the current date i is other than the first day of the month, in step S1305, the terminal device 10A generates the ciphertext c using (Equation 12) described above.

  In step S1306, the terminal apparatus 10A transmits the generated ciphertext c to the terminal apparatus 20.

  In step S1307, the terminal apparatus 10A decrypts the received ciphertext c and restores the plaintext m using (Equation 13) described above.

(Action / Effect)
According to the key isolation type cryptographic system according to the present embodiment, generation of the key update information δi, generation of the ciphertext c, and restoration of the plaintext m are executed based on the bilinear mapping that satisfies a predetermined condition. Further, as shown in (Equation 11) and (Equation 12), the date (date of the previous day or the first day of the current month) used for generating the key update information δi differs depending on the update time of the decryption key dk. The use frequency between the external device 40A and the external device 40B can be differentiated.

  Specifically, since the external device 40A only needs to be used once a month, the user of the terminal device 20 that updates the decryption key dk by using the external device 40A and the external device 40B is an external device other than during use. Device 40A can be stored in a physically safe place such as in a safe (not shown) of home RG.

  That is, the user of the terminal device 20 hardly needs to be aware of updating the decryption key dk by alternately using the external device 40A and the external device 40B. For this reason, the user only needs to concentrate on the management of the external device 40B used almost every day, which improves convenience.

  Compared to the key-isolated encryption system according to the first embodiment that always uses the external device 40A and the external device 40B alternately, the security of the encrypted communication is lowered, but the conventional key-isolated encryption system is more difficult. In addition, it is possible to improve user convenience while ensuring high safety.

[Other Embodiments]
As described above, the content of the present invention has been disclosed through one embodiment of the present invention. However, it should not be understood that the description and drawings constituting a part of this disclosure limit the present invention. From this disclosure, various alternative embodiments will be apparent to those skilled in the art.

  For example, in the above-described embodiment of the present invention, two external devices (external devices 40A and 40B) are associated with the odd-numbered update of the decryption key dk and the even-numbered update of the decryption key dk. The number of external devices may be three instead of two.

  When there are three external devices, different master keys hk * are stored in each of the external devices (for example, external devices # 1 to # 3), as in the above-described embodiment of the present invention. Each external device is associated with the number of updates of the decryption key dk. For example, the external device # 1 updates the first, fourth, seventh, etc. decryption key dk, the external device # 2 updates the second, fifth, eighth, etc. decryption key dk, and the external device # 3, Used to update the decryption key dk for the sixth, ninth.

  When the order of external devices used for updating the decryption key dk is known in advance, the usage order of external devices may be irregular.

  The user (terminal device 20) requests the external device to generate key update information d according to a predetermined order (external device # 1 to external device # 2 to external device # 3). .

  The functions of the logical blocks of the terminal device 10A (10B), the terminal device 20, the public information server 30, and the external device 40A (40B) described above (excluding specific blocks such as a storage unit) are also provided as programs. You can also.

  As described above, the present invention naturally includes various embodiments that are not described herein. Therefore, the technical scope of the present invention is defined only by the invention specifying matters according to the scope of claims reasonable from the above description.

1 is an overall schematic configuration diagram of a key-separated encryption system according to an embodiment of the present invention. It is a logic block block diagram of the terminal device by the side of the ciphertext transmission which concerns on embodiment of this invention. It is a logic block block diagram of the terminal device by the side of the ciphertext receiving which concerns on embodiment of this invention. It is a logical block block diagram of the public information server which concerns on embodiment of this invention. It is a logic block block diagram of the external device which concerns on embodiment of this invention. It is an operation | movement flowchart of the key isolation type | mold encryption system which concerns on 1st Embodiment of this invention. It is an operation | movement flowchart of the key isolation type | mold encryption system which concerns on 1st Embodiment of this invention. It is an operation | movement flowchart of the key isolation type | mold encryption system which concerns on 1st Embodiment of this invention. It is an operation | movement flowchart of the key isolation type | mold encryption system which concerns on 2nd Embodiment of this invention. It is an operation | movement flowchart of the key isolation type | mold encryption system which concerns on 2nd Embodiment of this invention. It is an operation | movement flowchart of the key isolation type | mold encryption system which concerns on 2nd Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Communication network, 1a ... Wireless base station, 10A, 10B, 20 ... Terminal device, 30 ... Public information server, 40A, 40B ... External device, 101 ... Communication part, 103 ... Input part, 105 ... Encryption part, 107 DESCRIPTION OF SYMBOLS ... Storage part 201 ... Communication part 203 ... Generation part 205 ... Update part 207 ... Storage part 209 ... Decoding part 211 ... Output part 301 ... Communication part 303 ... Control part 305 ... Public information database, 401 ... Communication unit, 403 ... Key update information generation unit, 405 ... Storage unit, OF ... Company, RG ... Home

Claims (12)

A terminal device that performs encryption processing;
A key isolation type comprising: an external device for storing secret information, which is a secret key selected from a predetermined number of public key and secret key pairs, used for updating a terminal secret key stored in the terminal device An encryption processing method in an encryption system,
The key isolation type cryptographic system includes at least a first external device and a second external device,
The first external device and the second external device are associated with the number of updates of the terminal secret key that has already been updated,
Different secret information is stored in the first external device and the second external device,
Selecting either the first external device or the second external device according to the number of updates;
The selected first external device or the second external device generates key update information used for updating the terminal secret key based on the number of times of update and the stored secret information; ,
The terminal device updates the terminal secret key to the first updated terminal secret key using the key update information generated by the first external device;
At the update timing immediately after the first updated terminal secret key is generated, the terminal device uses the key update information generated by the second external device to change the terminal secret key to the second updated terminal secret. Updating to a key;
The terminal device encrypts information using a first public key corresponding to the first updated terminal secret key and a second public key corresponding to the second updated terminal secret key;
An encryption processing method comprising: a step in which another terminal device different from the terminal device decrypts the information using the first updated terminal secret key and the second updated terminal secret key. The terminal device acquires external device identification information for uniquely identifying the first external device and external device identification information for uniquely identifying the second external device from the first external device and the second external device, respectively. Further comprising the step of:
In the step of selecting the first external device or the second external device, the external device connected to the terminal device is connected to the terminal secret based on the external device identification information and the update count. The encryption processing method according to claim 1, wherein it is determined whether or not the external apparatus is to request a key update. The first external device is associated with a first cycle for generating key update information,
The second external device is shorter than the first cycle and is associated with a second cycle for generating key update information,
In the step of selecting either the first external device or the second external device, according to the update time of the terminal secret key, either the first external device or the second external device is selected,
In the step of generating the key update information, the first external device or the second external device generates the key update information based on the update time and the stored secret information,
In the step of updating to the second updated terminal secret key, the terminal device updates the terminal secret key to the second updated terminal secret key using the key update information generated by the second external device. The encryption processing method according to claim 1.   The encryption processing method according to claim 3, wherein in the step of encrypting, the terminal device encrypts the information using a public key corresponding to the terminal secret key and update time information indicating the update time. G1 and G2 are groups of order q, and g is a generation source of G1, and e: G1 × G1 → G2 is set to e (g ^a , g ^b ) = e (g, g) ^ab 4. The encryption processing method according to claim 3, wherein the bilinear mapping is satisfied, and the key update information is generated using a hash function determined based on the bilinear mapping. A terminal device that performs encryption processing;
A key isolation type comprising: an external device for storing secret information, which is a secret key selected from a predetermined number of public key and secret key pairs, used for updating a terminal secret key stored in the terminal device A cryptographic system,
The key isolation type cryptographic system includes at least a first external device and a second external device,
The first external device and the second external device are associated with the number of updates of the terminal secret key that has already been updated,
Different secret information is stored in the first external device and the second external device,
The first external device and the second external device generate a key update information generation unit that generates key update information used for updating the terminal secret key based on the number of updates and the stored secret information. With
The terminal device
External device identification information for uniquely identifying the first external device and external identification information for uniquely identifying the second external device from the first external device and the second external device, respectively. An acquisition unit;
Based on the external device identification information acquired by the external device identification information acquisition unit and the update count, an external device connected to the terminal device should request an update of the terminal secret key. An external device determination unit that determines whether or not there is,
A first public key corresponding to a first updated terminal secret key, which is the terminal secret key updated using the key update information generated by the first external device, and the first updated terminal secret key are generated. At the update timing immediately after being performed, using the second public key corresponding to the second updated terminal secret key that is the terminal secret key updated using the key update information generated by the second external device, A key isolation type cryptographic system comprising an encryption unit for encrypting information.   The key isolation type cryptographic system according to claim 6, wherein the terminal device further includes a decryption unit that decrypts the information using the first updated terminal secret key and the second updated terminal secret key. The first external device is associated with a first cycle for generating key update information,
The second external device is shorter than the first cycle and is associated with a second cycle for generating key update information,
The external device determination unit selects either the first external device or the second external device according to the update time of the terminal secret key,
The key update information generation unit generates the key update information based on the update time and the stored secret information by the first external device or the second external device,
The key isolation type cryptographic system according to claim 6, wherein the encryption unit encrypts the information using a public key corresponding to the terminal secret key and update time information indicating the update time. A terminal device connected to an external device for storing secret information, which is a secret key selected from a predetermined number of public key and secret key pairs, and used in a key-isolated encryption system,
The external device includes at least a first external device and a second external device,
The first external device and the second external device are associated with the number of updates of the terminal secret key that has already been updated,
Different secret information is stored in the first external device and the second external device,
External device identification information for uniquely identifying the first external device and external identification information for uniquely identifying the second external device from the first external device and the second external device, respectively. An acquisition unit;
Based on the external device identification information acquired by the external device identification information acquisition unit and the number of times the terminal secret key has already been updated, an external device connected to the terminal device An external device determination unit that determines whether or not the external device should be requested to be updated;
A first public key corresponding to a first updated terminal secret key, which is the terminal secret key updated using the key update information generated by the first external device, and the first updated terminal secret key are generated. At the update timing immediately after being performed, using the second public key corresponding to the second updated terminal secret key that is the terminal secret key updated using the key update information generated by the second external device, A terminal device comprising: an encryption unit that encrypts information.   The terminal device according to claim 9, further comprising a decrypting unit configured to decrypt the information using the first updated terminal secret key and the second updated terminal secret key. The first external device is associated with a first cycle for generating key update information,
The second external device is shorter than the first cycle and is associated with a second cycle for generating key update information,
The external device determination unit selects either the first external device or the second external device according to the update time of the terminal secret key,
The terminal device according to claim 9, wherein the encryption unit encrypts the information using a public key corresponding to the terminal secret key and update time information indicating the update time. G1 and G2 are groups of order q, and g is a generation source of G1, and e: G1 × G1 → G2 is set to e (g ^a , g ^b ) = e (g, g) ^ab The terminal device according to claim 11, wherein the bilinear mapping is satisfied, and the key update information is generated by using a hash function determined based on the bilinear mapping.

Images