JP5046852B2 - Key generation device, terminal device, storage server, and computer program - Google Patents

Description

  The present invention relates to a key generation device, a terminal device, a storage server, and a computer program.

Conventionally, a method of encrypting shared data and sharing it within a group is known (see, for example, Patent Document 1). When sharing certain shared data within a group, first, the data (M _G ) desired to be shared within the group is encrypted (E _KM (M _G )) with the common key encryption using the encryption key (K _M ). Then, K _M is encrypted (E _pk1 (K _M ),..., _P K _N ) with public keys (pk ₁ ,..., _{Pk N} ) owned by all members (U ₁ ,..., U _N ) of the group. , E _pkN (K _M )), list it, and store it together with E _KM (M _G ) in a server or the like. The group member (U _i ) who refers to the data obtains K _M (E _pki (K _M ) and E _KM (M _G ) encrypted with his / her public key (pk _i ) from the list, and encrypts it. by decoding using its own secret key (sk _i) have been _{K M,} obtaining a _{K M.} then, it decrypts the _E KM _{(M G)} in _{K M,} to obtain the original data _{M G.}
Japanese Patent Application Laid-Open No. 2005-223953

  However, in the technique described in Patent Document 1, when a terminal device owned by a group member is used by a malicious third party, the terminal device holds a secret key used for encryption of shared data. The private key may be leaked. Therefore, even if the shared data is encrypted by another group member, there is a problem that a third party may be able to decrypt the content of the shared data using the leaked secret key. In addition, when a group member publishes shared data for the first time, it is necessary to encrypt the key used to encrypt the shared data with a public key owned by the group member, that is, to perform key encryption processing for the number of group members. there were. Therefore, there has been a problem that the processing load when the shared data is first disclosed is large. In addition, even when the shared data is made public for the first time after the encryption key used for encrypting the shared data is updated, it is necessary to perform the key encryption process for the number of group members. Therefore, there has been a problem that the processing load when the shared data is made public for the first time after updating the encryption key used for encrypting the shared data is large.

  The present invention has been made to solve the above-described problems. Even if a terminal device owned by a group member is used by a malicious third party and a key held by the terminal device is leaked, It is possible to reduce the possibility that the shared data encrypted by a group member will be decrypted by a third party, and to reduce the processing load when the shared data is published for the first time. An object of the present invention is to provide a key generation device, a terminal device, a storage server, and a computer program that can reduce the processing load when sharing data is first disclosed after updating the encryption key used for encryption.

The present invention relates to a storage server that stores encrypted shared data (corresponding to shared data MG and MG ′ in an embodiment described later), N (N is an integer of 1 or more) terminal devices, and a key generation device (Corresponding to a certificate authority in an embodiment to be described later), a group key generation unit that generates a public key and a secret key, and a first distributed key (an implementation to be described later) Corresponding to the distributed keys ski, U (i = 1,..., N) of the form and the second distributed key (distributed keys ski, S (i = 1,..., N) of the embodiment described later). The secret key can be generated using a secret sharing method, which is a method for generating a set of distributed keys that can generate the secret key from a set of distributed keys. A distributed key generation unit that generates N sets of one distributed key and the second distributed key; The N first distributed keys included in the N sets of distributed keys generated by the distributed key generation unit are distributed to N terminal devices one by one, and each of the N terminal devices is distributed. A key distribution unit that distributes the public key and distributes the N second distributed keys included in the N sets of distributed keys to the storage server, and a terminal that is the destination of the environment of the source terminal device A receiving unit that receives terminal device migration information including migration destination terminal device information that uniquely identifies a migration destination terminal device that is a device, and when the receiving unit receives the terminal device migration information, the distribution The key generation unit generates one set of the first distributed key and the second distributed key, and the key distribution unit generates a set of the distributed keys generated by the distributed key generation unit. Distributing the included first distributed key and public key to the destination terminal device, A key generating apparatus characterized by distributing one of said second distributed key in the set of the set of distributed key generated in Chikagi generation unit to the storage server.

The present invention also provides a migration source generated when the key generation device receives the terminal device migration information in a storage server included in a data sharing system including a storage server, a terminal device, and a key generation device. The second distribution key included in the set of the first distribution key distributed to the transfer destination terminal apparatus that is the transfer destination terminal apparatus of the environment of the terminal apparatus and the second distribution key distributed to the storage server is and Ri受 signal by the key generation device, the destination terminal and a receiving section for receiving the shared data and the first key recovery information encrypted by the device, the shared data and the first received by the receiver The key restoration information in association with each other, the storage unit storing the second distributed key received by the reception unit, and the reception unit receiving the first key restoration information from the destination terminal device. If received, the destination Identifying the second distributed key corresponding to end devices, said the first key recovery information, based on the specified and the second distributed key, the key recovery for generating a second key recovery information And a transmission unit that transmits the encrypted shared data, the first key recovery information, and the second key recovery information to the migration destination terminal device. Is a storage server characterized by

In addition, the present invention provides a computer including an arithmetic processing unit and a communication unit, a group key generating step in which the arithmetic processing unit generates a public key and a secret key, and the arithmetic processing unit includes a first distributed key and a first distributed key. The secret key can be generated by using a secret sharing method, which is a method for generating a set of distributed keys that can generate the secret key from a set of distributed keys composed of two distributed keys. A distributed key generation step of generating N sets (N is an integer of 1 or more) of the first distributed key and the second distributed key; and the N sets generated by the arithmetic processing unit in the distributed key generation step The communication unit transmits N pieces of the first distributed keys included in the set of distributed keys to the N terminal devices one by one, and the communication unit transmits the public information to each of the N terminal devices. sending the key, N pieces of the second distributed key included in the N sets of the set of distributed key And key distribution step by the communication unit is transmitted to the storage server, a terminal device migration information including the destination terminal apparatus information uniquely identifying the migration source terminal device of the migration destination terminal device a destination terminal device environment A receiving step received by the communication unit, and when the communication unit receives the terminal device transition information in the receiving step, in the distributed key generation step, the arithmetic processing unit is configured to execute the first distributed key. And a pair of the second distributed key are generated, and in the key distribution step, one set of the distributed keys included in the one set of the distributed keys generated by the arithmetic processing unit in the distributed key generation step The communication unit transmits the first distributed key and the public key to the destination terminal device, and one included in the set of distributed keys generated by the arithmetic processing unit in the distributed key generation step Said second distributed key A program, wherein the communication unit is transmitted to the storage server.

Further, the present invention provides a computer that includes an arithmetic processing unit, a communication unit, and a storage unit, in which a key generation device uniquely identifies a migration destination terminal device that is a migration destination terminal device of the migration source terminal device environment. The first distribution key generated when receiving the terminal device migration information including the destination terminal device information and distributed to the migration destination terminal device that is the migration destination terminal device of the environment of the migration source terminal device and the distribution to the storage server the second of the communication unit to distributed key is Ri受 signal by the key generation device, the encrypted shared data and the first key from the destination terminal apparatus contained in the set of the second distributed key to a receiving step of receiving and restoring information is the communication unit, and stores the said shared data by the communication unit is received in the receiving step the first key recovery information the storage unit in association with the received Said second minute received in step A storage step of storing the key the storage unit, when the communication unit receives the first key recovery information from said destination terminal device, the one of the second distributed key which the storage unit stores The second shared key corresponding to the transfer destination terminal device is specified, and second key recovery information is generated based on the first key recovery information and the specified second shared key. A key recovery information generation step, a transmission step in which the communication unit transmits the encrypted shared data, the first key recovery information, and the second key recovery information to the destination terminal device. Is a program for causing a computer to execute.

  According to the present invention, even if a terminal device owned by a group member is used by a malicious third party and the key held by the terminal device leaks, the shared data encrypted by another group member is It is possible to reduce the possibility of decryption by the three parties, it is possible to reduce the processing load when sharing data is first disclosed, and for the first time after updating the encryption key used for encryption of shared data It is possible to reduce the processing load when releasing shared data.

  Hereinafter, the first to third embodiments of the present invention will be described. First, the secret sharing method used in the first to third embodiments of the present invention will be described. The secret sharing method is a method for securely storing original secret information by distributing and storing secret information by several people. The (k, n) threshold secret sharing method is a kind of secret sharing method, and the secret information is divided into n pieces of divided information (shares) and stored, and k or more pieces of divided information are obtained. If possible, the original secret information can be restored. (Reference: “A. Shamir,“ How to share a secret, ”Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979”)

In addition, RSA-KEM based on RSA (RSA) cipher, which is a key encapsulation technique (KEM) for securely delivering a cipher key used in common key cipher using public key cipher. Will be described. The outline of the procedure of RSA-KEM is as follows.
[Key Generation Procedure] An RSA private key (e, n) and a public key (d, (n)) are generated. Here, n = pq (p and q are prime numbers), ed≡1 (mod λ (n)) (e and λ (n) are prime and λ (n) = LCM (p−1, q−1) (LCM (a, b) is the least common multiple of a and b)).
[Encryption and Encryption Key Generation Procedure] (Step S101) A random number r is generated. Here, r satisfies the formula (1).

  (Step S102) r is converted into a character string using equation (2). Here, I2OSP is an inter-to-octet string conversion.

(Step S103) generated in the ciphertext _{C 0} (3) expression.

  (Step S104) The encryption key K is generated by equation (4). Here, KDF is (Key Delivery Function), and KeyLen is the key length of the encryption key.

[Decryption and Encryption Key Restoration Procedure] (Step S110) The character string R is restored by the equation (5).

(Step S111) The encryption key K is restored by the equation (6).

(Reference: “V. Shop,“ FCD 18033-2 Encryption algorithms-Part 2: Asymmetric ciphers ”, http://shoop.net/iso/std6.pdf”)

(First embodiment)
Next, a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a configuration diagram showing a data sharing system according to the present embodiment. In the illustrated example, the data sharing system includes group member terminals (terminal devices) 1-1, 1-2,..., 1-N, a storage server 2, a certificate authority (key generation device) 3, and a communication network. 4. The group member terminals 1-1, 1-2,..., 1 -N can access the storage server 2 via the communication network 4 and send / receive data to / from the storage server 2. The communication network 4 may be a wireless network or a wired network. For example, the communication network 4 may be composed of the Internet, a fixed telephone network, a mobile telephone network, and the like.

  The group member terminals 1-1, 1-2,..., 1-N may be devices that can be used while moving (for example, portable devices), or devices that are used in a fixed manner ( For example, a stationary apparatus such as a personal computer may be used. Examples of the portable terminal device include a mobile communication network terminal device provided by a mobile communication carrier (for example, a mobile phone having a data communication function, a data communication terminal device, etc.), a PDA (Personal Digital Assistants: personal). Information equipment). In the case of a PDA, a communication unit may be built in or a communication unit may be connected from the outside.

  The group member terminals 1-1, 1-2,..., 1-N include an arithmetic processing unit, a storage unit, a communication unit, an input unit, a display unit, an external interface, and the like. The arithmetic processing unit includes a CPU (central processing unit), a memory, and the like. The storage unit stores, for example, a hard disk device, a magneto-optical disk device, an optical disk device such as a DVD (Digital Versatile Disk), a nonvolatile memory such as a flash memory, and a volatile memory such as a DRAM (Dynamic Random Access Memory). It is comprised by the apparatus or those combination. The storage unit stores various data such as a computer program executed by the CPU. The communication unit performs data communication via the communication network 4. The input unit includes input devices such as a keyboard, a numeric keypad, and a mouse, and performs data input according to user operations. The display unit includes a display device such as a CRT (Cathode Ray Tube) or a liquid crystal display device, and performs data display. The external interface directly transmits / receives data to / from an external device by wire or wireless.

  The group member terminals 1-1, 1-2,..., 1 -N execute an encryption program generation function, a transmission function, a reception function, an encryption key restoration function, A decryption function, an update information reception function, a split key update function, and a share generation function are realized. The computer program may be fixedly installed in the group member terminals 1-1, 1-2,..., 1-N, or a communication line when a computer program on the server is required. It may be downloaded via.

  The storage server 2 includes an arithmetic processing unit, a storage unit, a communication unit, an input unit, a display unit, an external interface, and the like. The arithmetic processing unit includes a CPU and a memory. The storage unit includes, for example, a hard disk device, a magneto-optical disk device, an optical disk device such as a DVD, a nonvolatile memory such as a flash memory, a storage device such as a volatile memory such as a DRAM, or a combination thereof. The storage unit stores various data such as a computer program executed by the CPU. The communication unit performs data communication via the communication network 4. The input unit includes input devices such as a keyboard, a numeric keypad, and a mouse, and performs data input according to user operations. The display unit is composed of a display device such as a CRT or a liquid crystal display device, and displays data. The external interface directly transmits / receives data to / from an external device by wire or wireless. Further, the storage unit has a data management function for storing various data transmitted from the group member terminals 1-1, 1-2, ..., 1-N. The reception function, storage function, key recovery information generation function, transmission function, and split key update function of the storage server 2 execute a computer program for the CPU of the storage server 2 to realize the above functions. It is realized by.

  The certificate authority 3 includes an arithmetic processing unit, a storage unit, a communication unit, an input unit, a display unit, an external interface, and the like. The arithmetic processing unit includes a CPU and a memory. The storage unit includes, for example, a hard disk device, a magneto-optical disk device, an optical disk device such as a DVD, a nonvolatile memory such as a flash memory, a storage device such as a volatile memory such as a DRAM, or a combination thereof. The storage unit stores various data such as a computer program executed by the CPU. The communication unit performs data communication via the communication network 4. The input unit includes input devices such as a keyboard, a numeric keypad, and a mouse, and performs data input according to user operations. The display unit is composed of a display device such as a CRT or a liquid crystal display device, and displays data. The external interface directly transmits / receives data to / from an external device by wire or wireless. The group key generation function, the distributed key generation function, the distributed key division function, the key distribution function, the reception function, the divided key update information generation function, and the update information distribution function of the certificate authority 3 This is realized by the CPU executing a computer program for realizing the above functions.

[Advance preparation]
Next, preparations in the present embodiment will be described with reference to FIG. FIG. 2 is a sequence diagram showing a preparatory processing operation in the present embodiment. In advance preparation, the certificate authority 3 creates a key for encryption, and distributes the created key to the group member terminals 1-1 and 1-2 and the storage server 2.

(Step P1-1) The certificate authority 3 generates a pair (pk _G , sk _G ) of a group public key and a secret key. Hereinafter, the public key of RSA encryption will be described as pk _G and the secret key will be described as sk _G. That is, pk _G = (e, n), sk _G = (d), where n = pq (p and q are prime numbers, p = 2p ′ + 1, q = 2q ′ + 1, p ′ and q ′ are prime numbers) Ed≡1 (mod λ (n)), λ (n) = 2p′q ′, gcd (e, λ (n)) = 1.

(Step P1-2) The certificate authority 3 divides sk _G into two distributed keys using the (2, 2) threshold secret sharing method for each group member terminal. The distributed key for the group member terminal 1-1 is (sk _{1, U} , sk _{1, S} ). The distributed key for the group member terminal 1-2 is (sk _{2, U} , sk _{2, S} ). Specifically, a polynomial f _i (x) on a finite field GF (λ (n)) corresponding to each group member terminal is generated, and distributed keys sk _{i, U} , sk _{i, S} are generated. Note that sk _{i, U} , sk _{i, S} satisfy the following formulas (7) to (13). A _i is a random number (a _i = 1,..., Λ (n) −1), ID _i is an ID of the group member terminal i, and ID _S is an ID of the storage server. Further, i = 1,..., N (N is the number of group member terminals included in the data sharing system, and N is an integer of 1 or more).

(Step P1-3) The certification authority 3 distributes one group public key pk _G to each group member terminal included in the data sharing system. Further, the certificate authority 3 distributes the distributed keys sk _{i, U} (i = 1,..., N) generated for each terminal in step P1-2 to the corresponding terminals. Further, the certificate authority 3 distributes all the distributed keys sk _{i, S} (i = 1,..., N) generated for each terminal in step P1-2 to the storage server 2.

FIG. 3 is a diagram showing a key distribution method in the present embodiment. In the illustrated example, the certificate authority 3 has a group public key pk _G and a group secret key sk _G. The authentication station 3 generates polynomial _f 1 (x) from the group secret key sk _G, are generated and distributed key _{sk 1, S} and _{sk 1, U} from the generated polynomial _f 1 (x) . The authentication station 3 generates polynomial _f 2 (x) from the group secret key sk _G, are generated and distributed key _{sk 2, S} and _{sk 2, U} from the generated polynomial _f 2 (x) . Similarly, the certificate authority 3 generates as many distributed keys sk _{N, S} and sk _{N, U as the} number of group member terminals (1-1 to 1-N) included in the data sharing system. .

The certificate authority 3 distributes the group public key pk _G and the distributed keys sk _{1, U} to the group member terminal 1-1. The certificate authority 3 distributes the group public key pk _G and the distributed keys sk _{2 and U} to the group member terminal 1-2. Similarly, the certificate authority 3 distributes the group public key pk _G and the distributed keys sk _{N and U} to the group member terminals (1-1 to 1-N) included in the data sharing system. . The certificate authority 3 distributes the distributed keys sk _{1, S to} sk _{N, S} to the storage server 2. In addition, as a method for the certificate authority 3 to distribute the distributed key to the group member terminals (1-1 to 1-N) and the storage server 2, it may be distributed by network communication or via an external device such as a recording medium. You may distribute it.

[Shared data storage processing: Shared data new storage, shared data update storage (with key update)]
Next, processing for newly saving shared data or updating and saving shared data in the present embodiment when there is a key update will be described with reference to FIGS. FIG. 4 shows a data format (hereinafter referred to as a member terminal format) of a list of data (local data list) stored in the storage unit of the group member terminals (1-1 to 1-N) in the present embodiment. It is a figure. In the illustrated example, the member terminal format is 4 of data ID (D ₁ ), data label (L ₁ ), last reference time (T _1,1 ), and encrypted data (E _KM (M _G )). Has one attribute. The data ID is an identifier for uniquely identifying data within the data sharing system. The data label is a name representing the content and form of data such as a file name. The last reference time is the time when shared data was last referenced. Encrypted data is data obtained by encrypting shared data.

FIG. 5 is a diagram showing a data format (hereinafter referred to as a storage server format) of data stored in the storage unit of the storage server 2 in the present embodiment. In the illustrated example, the storage server format includes a data ID (D ₁ ), a user ID (ID ₁ ), a data label (L ₁ ), a last update time (T _{S, 1} ), and encrypted data (E _KM (M _G )) and key recovery information (C _0,1 ). The three attributes of data ID, data label, and encrypted data are the same as the attributes of the member terminal format. The user ID is an identifier for uniquely identifying the group member terminal that generated the encrypted data. The last update time is the time when the shared data was last updated. The key recovery information is information used when creating a key used when decrypting encrypted data.

  FIG. 6 is a diagram illustrating an example of data stored in the storage unit of the storage server 2 in the present embodiment. In the illustrated example, the storage unit of the storage server 2 stores X data from the data record 1 to the data record X. The format of each data record is the same as in FIG.

  FIG. 7 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 stores group shared data in the storage server 2 in the present embodiment.

User using the (step W1-1) group member terminal 1-1 operates the group member terminal 1-1, to prepare a shared data _{M G} to group member terminal 1-1. In addition, the file name of _{M G} and the data label _{L 1.}
(Step W1-2) Using the key encapsulation technique, the group member terminal 1-1 generates the encryption key K _M and the key recovery information C _0,1 from pk _G.

(Step W1-3) common key encryption, the group member terminal 1-1, encrypts the shared data _{M G} with _{K M.} The shared data after encryption (encrypted data) is E _KM (M _G ). After encryption completion, the group member terminal 1-1 deletes the _{M G} and _{K M} for the group member terminal 1-1 stores.
(Step W1-4) The group member terminal 1-1 prompts the user to input information for user authentication, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W1-5) The group member terminal 1-1 has the ID (ID ₁ ), E _KM (M _G ), C ₀ , ₁ , L ₁ , and UID possessed by the group member terminal 1-1. The PN is sent to the storage server 2.
(Step W1-6) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-1 matches the previously stored set of UID and PN. If they match, the storage server 2 assigns a data ID (D ₁ ) to the data set received from the group member terminal 1-1. Also, the storage server 2 stores ID ₁ , E _KM (M _G ), C _0,1 , L ₁ , D _1, and the last update time (T _{S, 1} ) according to the storage server format. Stored in the storage unit. The latest update time (T _{S, 1} ) is the time at the time of storage.

(Step W1-7) The storage server 2 transmits an ACK (Acknowledgement) message to the user terminal 1 in order to notify the group member terminal 1-1 that the storage process in Step W1-6 has been completed. The ACK message includes D ₁ and T _{S, 1} .
(Step W1-8) After receiving the ACK message from the storage server 2, the group member terminal 1-1 deletes K _M and C _0,1 stored in the group member terminal 1-1. The group member terminal 1-1 creates an entry for the data to the local data list to the new, the _{D 1} as the data ID, and _{L 1} as the data _label, T 1, 1 a _{(= T S, 1)} As the last reference time, E _KM (M _G ) is stored as encrypted data according to the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Shared data storage processing: Shared data update storage (no key update)]
Next, shared data update storage processing in this embodiment in the case where there is no key update will be described with reference to FIG. As an example of the case of updating and storing shared data without a key update, there is a case where a group member terminal that updates shared data updates shared data previously registered in the storage server. In this case, by using the encryption key K _M was used when you save the shared data before, it is possible to encrypt the shared data again updated, omitted key generation procedure.

  FIG. 8 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 updates and saves the group shared data in the storage server 2 without updating the encryption key in the present embodiment.

(Step Wa1-1) The user who uses the group member terminal 1-1 operates the group member terminal 1-1 to prepare shared data M _G ′ on the group member terminal 1-1. In addition, to 'the file name of the data label _{L 1' M G} and.
(Step Wa1-2) common key encryption, the group member terminal 1-1, encrypts the shared data _{M G} 'using a _{K M.} Shared data encrypted (encrypted data) and _E KM _{(M G} '). After completing the encryption, the group member terminal 1-1 deletes M _G ′ stored in the group member terminal 1-1.
(Step Wa1-3) The group member terminal 1-1 prompts the user to input information for user authentication, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W1a-4) group member terminal 11, the ID (ID ₁₎ of the group member terminal 1-1 _{has, 'and, L 1 E KM (M G} )' and, a data ID _{(D 1)} UID and PN are sent to the storage server 2.
(Step W1a-5) The storage server 2 collates whether or not the set of UID and PN transmitted from the group member terminal 1-1 matches the set of UID and PN stored in advance. If they match, the storage server 2 sets ID ₁ , E _KM (M _G '), L ₁ ', and the last update time (T _{S, 1} ') according to the format of the storage server format. The storage unit of the storage server 2 to be stored is overwritten. The latest update time (T _{S, 1} ′) is the time at the time of the overwriting.

(Step W1a-6) The storage server 2 transmits an ACK message to the user terminal 1 in order to notify the group member terminal 1-1 that the storage process in Step W1a-5 has been completed. The ACK message includes T _{S, 1} '.
(Step W1a-7) After receiving the ACK message from the storage server 2, the group member terminal 1-1 uses D ₁ as the data ID and L ₁ ′ as the data label in the entry for the data in the local data list. Store T _1,1 ′ (= T _{S, 1} ′) as the last reference time and E _KM (M _G ′) as encrypted data according to the member terminal format. Note that E _KM (M _G ′) may or may not be deleted, and may be selected by setting of a setting file or the like.

[Shared data reference processing]
Next, processing when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 will be described with reference to FIGS.

FIG. 9 is a diagram showing a data list transmitted from the storage server to each group member terminal in the present embodiment. The data list stores data labels of data stored in the storage unit of the storage server 2. The data list stores the data label and the last update time of the data label in association with each other. In the illustrated example, the data labels of data stored in the storage server 2 are data label 1 (D ₁ ), data label 2 (D ₂ ),..., Data label X (D _X ). Further, the last update time of the data label 1 (D ₁ ) is the last update time 1 (L ₁ ), the last update time of the data label 2 (D ₂ ) is the last update time 2 (L ₂ ),. The last update time of the data label X (D _X ) is the last update time X (L _X ).

  FIG. 10 is a sequence diagram showing processing operations when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 in the present embodiment.

  (Step R1-0) The storage server 2 sends a data list to the group member terminal 1-1 and the group member terminal 1-2. For example, the data list transmission timing may be transmitted every time the data list is updated. Further, it may be transmitted only when there is a data access request from the user terminal.

  (Step R1-1) The group member terminal 1-2 receives an input of a reference request for shared data from the user. Subsequently, the group member terminal 1-2 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step R1-2) group member terminal 1-2, the data ID of the reference data _{M G (D 1),} the ID of the group member terminal 1-2 has (ID _2), UID and data and a PN The message is sent to the storage server 2 as a request message. If the data has been referred to in the past, the last reference time (T _2,1 ) of the data is added to the data request message. Information indicating the presence / absence of encrypted data E _KM (M _G ) in the group member terminal may be added to the data request message. In the illustrated example, since the group member terminal 1-2 refers to the data _MG for the first time, the last reference time (T _2,1 ) is not included in the request message.

(Step R1-3) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-2 matches the set of UID and PN stored in advance. If they match, the storage server 2 uses C _0,1 and sk _{2, S} to generate key recovery information C _1,1 = C _0,1 ^W1 . W1 satisfies the following expression (14).

(Step R1-4) The storage server 2 sends E _KM (M _G ), last update time (T _{S, 1} ), C _0,1 and C _1,1 to the group member terminal 1-2. To do. In step R1-0, processing for not sending E _KM (M _G ) when information notifying that “the encrypted data exists in the group member terminal” is added to the request message and there is no update of the data. It is also good. Here, as a method for determining whether or not the data has been updated, for example, the last reference time (T _2,1 ) sent from the group member terminal and the last update time (TS _{, 1} ), and if the values are different, there is a method of determining that the value has been updated.

(Step R1-5) group member terminal 1-2, restores the _{K M} with the _{sk 2, U,} and _{C 0, 1,} and _{C 1, 1.} The last reference time (T _2,1 ) is updated to T _{S, 1} . Incidentally, restoration method of K _M are as follows. First, r is restored from the following equation (15). Subsequently, _KM is restored from the following equation (16). W2 satisfies the following expression (17).

(Step R1-6) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R1-7) after reference _{M G,} group member terminal 1-2 and _{K M,} and _{M G,} and _{C 0, 1,} to remove the _{C 1, 1.} Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Environment migration process]
Next, a procedure for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 when the group member terminal 1-2 is lost will be described with reference to FIG. The environment migration means that an environment capable of executing encryption / decryption of shared data possessed by a certain group member terminal is migrated to another group member terminal. In this embodiment, the transfer source terminal device is the group member terminal 1-2, and the transfer destination terminal device is the group member terminal 1-3. FIG. 11 is a sequence diagram showing processing operations for migrating the environment in which the group member terminal 1-2 can execute encryption / decryption of shared data to the group member terminal 1-3 in this embodiment. FIG.

  (Step RE1-1) The group member terminal 1-3 receives terminal device transition information including the loss of the group member terminal 1-2 and a request to migrate the environment of the group member terminal 1-2 to the group member terminal 1-3. To the certificate authority 3. The terminal device migration information includes the terminal ID of the group member terminal 1-2 as the original terminal device that migrates the environment of the terminal device, and the terminal of the group member terminal 1-3 as the destination terminal device that migrates the environment of the terminal device. ID is included. The notification method may be notified online or may be notified offline.

(Step RE1-2) The certificate authority 3 receives terminal transition information from the group member terminal 1-3. Subsequently, the certificate authority 3 generates a split key sk ′ _{2, U} and a split key sk ′ _{2, S} for the group member terminal 1-3. The generation method is the same as in Step P1-2.
(Step RE1-3) The certificate authority 3 sends the split keys sk ′ _{2 and S} to the storage server 2. After receiving the split key sk ′ _{2, S} , the storage server 2 deletes the split key sk _{2, S} for the group member terminal 1-2.
(Step RE1-4) The certification authority 3 sends the split key sk ′ _{2, U} and the public key pk _G for the group member terminal 1-3 to the group member terminal 1-3.

As described above, since the shared key sk _{2, S} and the key recovery information C _0,1 held by the storage server are necessary for the decryption of the encrypted shared data, the terminal device owned by the group member To reduce the possibility that shared data encrypted by other group members will be decrypted by a third party even if the key held by the terminal device is leaked Is possible. In addition, the key used for encrypting the shared data, which was conventionally required when publicly sharing the shared data for the first time, is encrypted with the public key owned by the group member, that is, the key encryption process for the number of group members. It is possible to reduce the processing load when sharing data is first disclosed. In addition, since it is not necessary to perform key encryption processing for the number of group members, which was necessary when the shared data was released for the first time after updating the encryption key used to encrypt the shared data, It is possible to reduce the processing load when the shared data is made public for the first time after updating the encryption key used for encryption.

(Second Embodiment)
Next, a second embodiment of the present invention will be described with reference to the drawings. In this embodiment, in addition to the key exchange process by the key encapsulation technique of the first embodiment, a key exchange process by secret sharing is added. Specifically, when newly registering shared data in the storage server or referring to shared data for the first time, the group member terminal uses the secret sharing method to set the encryption key of the data to ₂ of S ₁ and S 2. Divide into two shares. Note that the encryption key can be generated using only two shares S ₁ and dispersed S _2. Then, the group member terminal may send the shares S ₁ to the storage server holds shares S ₂ in the own terminal. The data sharing system according to the present embodiment is the same as the data sharing system according to the first embodiment.

[Advance preparation]
Next, advance preparation in the present embodiment will be described. The preparatory processing operation in the present embodiment is performed in the same manner as the preparatory processing operation of the first embodiment.

[Shared data storage processing: Shared data new storage, shared data update storage (with key update)]
Next, processing for newly saving shared data or updating and saving shared data in the present embodiment when there is a key update will be described with reference to FIGS. FIG. 12 is a diagram showing a data format (hereinafter referred to as a member terminal format) of a list of data (local data list) stored in the storage unit of the group member terminal in the present embodiment. In the illustrated example, the member terminal format includes data ID (D ₁ ), data label (L ₁ ), last reference time (T _1,1 ), last key reference time (TK _1,1 ), and encryption key. It has six attributes of share (S _1,2 ) and encrypted data (E _KM (M _G )). The data ID is an identifier for uniquely identifying data within the data sharing system. The data label is a name representing the content and form of data such as a file name. The last reference time is the time when shared data was last referenced. The last key reference time is the time when the encryption key was last referenced. The encryption key share is a share created by group member terminals by distributing an encryption key by a secret sharing method. Encrypted data is data obtained by encrypting shared data.

FIG. 13 is a diagram showing a data format (hereinafter referred to as a storage server format) of data stored in the storage unit of the storage server 2 in the present embodiment. In the example shown in the figure, the storage server format is data ID (D ₁ ), data label (L ₁ ), last update time (T _{S, 1} ), last key update time (TK _{S, 1} ), and encryption. It has eight attributes of data (E _KM (M _G )), key recovery information (C _0,1 ), user ID (ID ₁ ), and encryption key share (S _1,1 ). The four attributes of data ID, data label, encrypted data, and encryption key share are the same as those of the member terminal format. The user ID is an identifier for uniquely identifying the group member terminal. The last update time is the time when the shared data was last updated. The last key update time is the time when the encryption key was last updated. The key recovery information is information used when creating a key used when decrypting encrypted data.

  FIG. 14 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 stores group shared data in the storage server 2 in the present embodiment.

User using the (step W2-1) group member terminal 1-1 operates the group member terminal 1-1, to prepare a shared data _{M G} to group member terminal 1-1. In addition, the file name of _{M G} and the data label _{L 1.}
Using (step W2-2) key encapsulation technique, group member terminal 1-1 generates the encryption key _{K M} and the key decoding information _{C 0, 1} from pk _G.

(Step W2-3) common key encryption, the group member terminal 1-1, encrypts the shared data _{M G} with _{K M.} The shared data after encryption (encrypted data) is E _KM (M _G ). After encryption completion, the group member terminal 1-1 deletes the _{M G} group members terminal 1-1 stores.
(Step W2-4) group member terminal 1-1 creates the share _{S 1,1} and share _{S 1, 2} corresponding to the _{K M} with (2,2) threshold dispersion method. Incidentally, _{K M} can be generated using only two shares _{S 1,1} and share _{S 1, 2} dispersed. After creating a share, to remove the _{K M.} The share S _{i, 1} is generated using the following equation (18). Here, X _{i, 1} = h (ID _i ) (h is a hash function), u ₁ (x) = b ₁ x + K _M , u ₁ (x) is a polynomial on a finite field GF (2 ^b −1) ( b is the key length of the encryption key).

The share S _{i, 2} is generated using the following equation (19). Here, X _{i, 2} = h (ID _i ‖r ₁ ) (where r ₁ is a random number and h is a hash function).

  (Step W2-5) The group member terminal 1-1 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W2-6) The group member terminal 1-1 has the ID (ID ₁ ), S _1,1 , E _KM (M _G ), C _0,1 , and L held by the group member terminal 1-1. ₁ , UID, and PN are sent to the storage server 2.
(Step W2-7) The storage server 2 collates whether or not the pair of UID and PN transmitted from the group member terminal 1-1 matches the pair of UID and PN stored in advance. If they match, the storage server 2 assigns a data ID (D ₁ ) to the data. Also, the storage server 2 has ID ₁ , L ₁ , E _KM (M _G ), C ₀ , ₁ , S ₁ , ₁ , D ₁ , last update time (T _{S, 1} ), and last The key update time (TK _{S, 1} ) is stored in the storage unit of the storage server 2 according to the format of the storage server format. The latest update time (T _{S, 1} ) and the last key update time (TK _{S, 1} ) are the times at the time of storage.

(Step W2-8) The storage server 2 transmits an ACK (Acknowledgement) message to the user terminal 1 in order to notify the group member terminal 1-1 that the storage process in Step W2-7 has been completed. The ACK message includes D ₁ and T _{S, 1} and TK _{S, 1} .
(Step W2-9) after receiving the ACK message from the storage server 2, group member terminal 1-1 deletes the _{K M} for storing a group member terminal _1-1, and _{C 0, 1} and _{S 1,1} . The group member terminal 1-1 creates an entry for the data to the local data list to the new, the _{D 1} as the data ID, and _{L 1} as the data _label, T 1, 1 a _{(= T S, 1)} As the final reference time, TK _1,1 (= TK _{S, 1} ) is stored as the final key reference time, S _1,2 is stored as the encryption key share, and E _KM (M _G ) is stored as the encrypted data according to the member terminal format. To do. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Shared data storage processing: Shared data update storage (no key update)]
Next, shared data update storage processing in the present embodiment when there is no key update will be described. The shared data update storage processing operation in the present embodiment when there is no key update is performed in the same manner as the shared data update storage processing operation in the first embodiment when there is no key update.

[Shared data reference processing]
Next, processing when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 will be described with reference to FIG. FIG. 15 is a sequence diagram showing processing operations when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 in the present embodiment.

  (Step R2-0) The storage server 2 sends the data list to the group member terminal 1-1 and the group member terminal 1-2. For example, the data list transmission timing may be transmitted every time the data list is updated. Further, it may be transmitted only when there is a data access request from the user terminal.

  (Step R2-1) The group member terminal 1-2 receives an input of a reference request for shared data from the user. Subsequently, the group member terminal 1-2 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step R2-2) group member terminal 1-2, the data ID of the reference data _{M G (D 1),} the ID of the group member terminal 1-2 has (ID _2), UID and data and a PN The message is sent to the storage server 2 as a request message. If the data has been referred to in the past, the last reference time (T _2,1 ) and the last key reference time (TK _2,1 ) of the data are added to the data request message. Information indicating the presence / absence of encrypted data E _KM (M _G ) in the group member terminal may be added to the data request message. In the illustrated example, since the group member terminal 1-2 refers to the data _MG for the first time, the last reference time (T _2,1 ) and the last key reference time (TK _2,1 ) are included in the request message. Not.

(Step R2-3) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-2 matches the previously stored set of UID and PN. If they match, the storage server 2 determines whether or not the encryption key for the data held by the storage server 2 has been updated after the group member terminal 1-2 refers to the data. Here, as a method for determining whether or not the encryption key for the data is updated, for example, the last key reference time (TK _2,1 ) of the encryption key sent from the group member terminal and the storage server 2 store the data. There is a method of comparing the last update time (TK _{S, 1} ) of the encryption key for the data and determining that the data has been updated if the values are different.

(Step R2-4) When the shared data is newly referred to or when the shared data with the key update is referred to, the group member terminal creates a key and refers to the shared data. The reference method will be described later.
(Step R2-5) The group member terminal refers to shared data that has no key update. The reference method will be described later.

  Next, a procedure when the group member terminal creates a key and refers to the shared data in step R2-4 will be described with reference to FIG. FIG. 16 is a sequence diagram showing a processing operation in which a group member terminal creates a key and refers to shared data.

(Step R2-4a) The storage server 2 uses C _0,1 and sk _{2, S} to generate key recovery information C _1,1 = C _0,1 ^W1 . The method for generating the key recovery information is the same as in step R1-3.

(Step R2-4b) the storage server 2, and _{D 1,} and E KM _{(M G),} a last update time _{(T S, 1),} the last key update time _{(TK S, 1), C} 0,1 _and, sending the _{C 1,1} to a group member terminals 1-2.
(Step R2-4c) group member terminal 1-2, restores the _{K M} with the _{sk 2, U,} and _{C 0, 1,} and _{C 1, 1.} Incidentally, restoration method of _{K M} is the same as step R1-5.

(Step R2-4d) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R2-4e) The group member terminal 1-2 creates a share S _2,1 and a share S _2,2 corresponding to K _M using the (2,2) threshold distribution method.
(Step R2-4f) group member terminal 1-2, and _{D 1,} and ID _2, it sends a _{S 2,1} to the storage server 2. Moreover, after the reference of _{M G,} group member terminal 1-2 and _{K M,} and _{M G,} and _{C 0, 1,} and _{C 1, 1,} to remove the _{S 2,1.} In addition, in the entry for the data in the local data list, TK ′ _2,1 is set with D ₁ as the data ID, L ₁ as the data label, and T ′ _2,1 (= T _{S, 1} ) as the last reference time. Store (= TK _{S, 1} ) as the last key reference time, S _2,2 as the encryption key share, and E _KM (M _G ) as the encrypted data according to the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

  Next, the procedure when the group member terminal refers to the shared data without the key update in step R2-5 will be described with reference to FIG. FIG. 17 is a sequence diagram showing a processing operation in which a group member terminal refers to shared data with no key update.

(Step R2-5a) The storage server 2 sends the encryption key shares S _2,1 , E _KM (M _G ), and the last update time (T _{S, 1} ) to the group member terminal 1-2. In step R2-1, information notifying that “the encrypted data exists in the group member terminal” is added to the request message, and if there is no update of the data, processing for not sending E _KM (M _G ) It is also good. Here, as a method for determining whether or not the data has been updated, for example, the last reference time (T _2,1 ) sent from the group member terminal and the last update time (TS _{, 1} ), and if the values are different, there is a method of determining that the value has been updated.

(Step R2-5b) group member terminal _1-2, restores the _{K M} with the _{S 2, 2,} and _{S 2,1.}
(Step R2-5c) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R2-5d) after reference _{M G,} group member terminal 1-2 deletes the _{K M,} and _{M G,} and _{S 2,1.} Further, the group member terminal 1-2 overwrites the value of _T′2,1 of the entry for the data in the local data list as the value of TS _{, 1} . Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Environment migration process]
Next, a procedure for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 when the group member terminal 1-2 is lost will be described. The migration procedure in this embodiment is performed in the same manner as the migration procedure in the first embodiment.

As described above with respect to the second embodiment, in this embodiment, a key exchange process based on secret sharing is added to the key exchange process based on the key encapsulation technique of the first embodiment. Therefore, when the group member terminal refers to the encrypted data using the same encryption key, it is not necessary to obtain the key recovery information C ₀ and C ₁ from the storage server, and only the share S ₁ needs to be sent. Therefore, the message size between the user terminal and the storage server can be reduced. For example, if the key length of the public key encryption is 1024 bits and the key length of the common key encryption is 256 bits, 1792 bits can be reduced per data reference. Moreover, since it is not necessary to perform exponentiation and multiplication on the user terminal side, the load on the user terminal is reduced.

(Third embodiment)
Next, a third embodiment of the present invention will be described with reference to the drawings. In this embodiment, information called a master share, which is basic information for generating an encryption key, is generated in a group member terminal, and an encryption key and an encryption key share are generated using the generated master share. The encryption key can be generated using only the encryption key share and the master share. Further, the master share is distributed to two divided shares of the divided share _{SMS, 1} and the divided share _{SMS, 2} by the secret sharing method. The master share can be generated using only two divided shares _{SMS, 1} and _{SMS, 2} . The data sharing system according to the present embodiment is the same as the data sharing system according to the first embodiment.

[Advance preparation]
Next, advance preparation in the present embodiment will be described.
(Step P3-1) The certificate authority 3 generates a pair (pk _G , sk _G ) of a group public key and a secret key. Hereinafter, the public key of RSA encryption will be described as pk _G and the secret key will be described as sk _G.

(Step P3-2) The certification authority 3 divides sk _G into two distributed keys by using the (2, 2) threshold secret sharing method for each group member terminal. The distributed key for the group member terminal 1-1 is (sk _{1, U} , sk _{1, S} ). The distributed key for the group member terminal 1-2 is (sk _{2, U} , sk _{2, S} ). The method for generating the distributed key is the same as in step P1-2.

(Step P3-3) The certificate authority 3 distributes one group public key pk _G to each group member terminal included in the data sharing system. Further, the certificate authority 3 distributes the distributed keys sk _{i, U} (i = 1,..., N) generated for each terminal in step P3-2 to the corresponding terminals. Further, the certificate authority 3 distributes all the distributed keys ski _{i, S} (i = 1,..., N) generated for each terminal in step P3-2 to the storage server 2.
(Step P3-4) Each group member terminal performs initial setting of the master share, and holds the master share (MS _i ) in its own terminal. A method for initial setting of the master share will be described later.

  Next, the procedure in which the group member terminal performs the initial setting of the master share in step P3-4 will be described with reference to FIG. FIG. 18 is a sequence diagram showing processing operations in which the group member terminals perform initial setting of the master share.

(Step P3-4a) The group member terminal 1-1 generates a master share MS ₁ . The master share MS _i is generated from the following equation (20). Here, X _{MS, i} = h (ID _i ) (h is a hash function, i = 1,..., N + 1), g (x) is a polynomial over a finite field GF (2 ^b −1) (b is an encryption key) Key length).

(Step P3-4b) The group member terminal 1-1 uses the (2, 2) threshold distribution method _, and the split share SMS _{, 1, 1} and the split share SMS _{, 1 , 2} , corresponding to the master share MS ₁ , Is generated. The master share MS ₁ can be generated using only the split shares _{SMS 1, 1, 1} and the split shares _{SMS 1 , 2, 1} . Further, the divided share _{SMS, i, 1} is generated using the following equation (21).

Further, the divided share _{SMS, i, 2} is generated using the following equation (22). Here, X _{i, 2} = h (ID _i ‖r ₃ ) (r ₃ is a random number, h is a hash function, i = 1,..., N + 1).

(Step P3-4c) The group member terminal 1-1 sends the ID (ID ₁ ) of the group member terminal 1-1 and the SMS _{, 1, 2} to the storage server 2.
(Step P3-4d) The group member terminal 1-1 sends SMS _{, 1, 1} to the external device. The external device is, for example, a storage device such as a USB memory. The external device storing _{the SMS, 1, 1} is detached from the group member terminal 1-1 and stored in a safe place such as a safe. The external device is not used for data storage processing and data reference processing that are processing other than environment restoration processing.
(Step P3-4e) The group member terminal 1-1 deletes SMS _{, 1, 1} and SMS _{, 1 , 2} .

  The master share is held in the group member terminal 1-1 and used for data storage processing, encryption key generation for data reference processing, and encryption key distribution processing. Further, the master share is encrypted in the group member terminal 1-1, and after the user authentication to the storage server 2, the master share decryption key is obtained from the storage server, so that the master share is decrypted. Doing so may increase safety.

[Shared data storage processing: Shared data new storage]
Next, a process for newly saving shared data will be described with reference to FIGS. FIG. 19 is a diagram showing a data format (hereinafter referred to as a member terminal format) of a list of data (local data list) stored in the storage unit of the group member terminal in the present embodiment. In the illustrated example, the member terminal format is 4 of data ID (D ₁ ), data label (L ₁ ), last reference time (T _1,1 ), and encrypted data (E _KM (M _G )). Has one attribute. The data ID is an identifier for uniquely identifying data within the data sharing system. The data label is a name representing the content and form of data such as a file name. The last reference time is the time when shared data was last referenced. Encrypted data is data obtained by encrypting shared data.

FIG. 20 is a diagram illustrating a data format of data stored in the storage unit of the storage server 2 (hereinafter referred to as a storage server format) in the present embodiment. In the illustrated example, the storage server format includes a data ID (D ₁ ), a data label (L ₁ ), a last update time (T _{S, 1} ), encrypted data (E _KM (M _G )), a key It has seven attributes: restoration information (C _0,1 ), user ID (ID ₁ ), and encryption key share (S _{KM, 1} ). The four attributes of data ID, data label, encrypted data, and encryption key share are the same as those of the member terminal format. The user ID is an identifier for uniquely identifying the group member terminal. The last update time is the time when the shared data was last updated. The key recovery information is information used when creating a key used when decrypting encrypted data.

  FIG. 21 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 stores group shared data in the storage server 2 in the present embodiment.

User using the (step W3-1) group member terminal 1-1 operates the group member terminal 1-1, to prepare a shared data _{M G} to group member terminal 1-1. In addition, the file name of _{M G} and the data label _{L 1.}
(Step W3-2) Using the key encapsulation technique, the group member terminal 1-1 generates the encryption key K _M and the key decryption information C _0,1 from pk _G.

(Step W3-3) common key encryption, the group member terminal 1-1, encrypts the shared data _{M G} with _{K M.} The shared data after encryption (encrypted data) is E _KM (M _G ). After encryption completion, the group member terminal 1-1 deletes the _{M G} group members terminal 1-1 stores.
(Step W3-4) group member terminal 11, generates an encryption key shares _{S KM, 1} corresponding to the _{K M} using the master share MS _1. The encryption key share S _{KM, 1} is generated using the following equation (23). Here, X _{KM, 1} = h (ID ₁ ‖r ₂ ) (r ₂ is a random number and h is a hash function). Incidentally, _{K M} can be generated using only the master share MS ₁ and the encryption key shares _{S KM, 1.}

  (Step W3-5) The group member terminal 1-1 prompts the user to input information for user authentication, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W3-6) The group member terminal 1-1 receives the ID (ID ₁ ), E _KM (M _G ), C _0,1 , L ₁ , and S _{KM, which the} group member terminal 1-1 has _{. 1} , UID, and PN are sent to the storage server 2.
(Step W3-7) The storage server 2 collates whether or not the pair of UID and PN transmitted from the group member terminal 1-1 matches the pair of UID and PN stored in advance. If they match, the storage server 2 assigns a data ID (D ₁ ) to the data. The storage server 2 also stores ID ₁ , L ₁ , E _KM (M _G ), C _{0 , 1} , S _{KM, 1} , D ₁ and the last update time (T _{S, 1} ). The data is stored in the storage unit of the storage server 2 according to the server format. The latest update time (T _{S, 1} ) is the time at the time of storage.

(Step W3-8) In order to notify the group member terminal 1-1 that the storage process in step W3-7 has been completed, the storage server 2 transmits an ACK (acknowledgement) message to the user terminal 1. The ACK message includes D ₁ and T _{S, 1} and TK _{S, 1} .
(Step W3-9) after receiving the ACK message from the storage server 2, group member terminal 1-1 deletes the _{K M} and _{C 0, 1} and _{S KM, 1} stored by the group member terminal 1-1. The group member terminal 1-1 creates an entry for the data to the local data list to the new, the _{D 1} as the data ID, and _{L 1} as the data _label, T 1, 1 a _{(= T S, 1)} As the last reference time, E _KM (M _G ) is stored as encrypted data according to the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Shared data storage processing: Shared data update storage (with key update)]
Next, update storage processing in the present embodiment when there is a key update will be described with reference to FIG. FIG. 22 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 stores group shared data in the storage server 2 in the present embodiment.

(Step W3a-1) The user who uses the group member terminal 1-1 operates the group member terminal 1-1 to prepare the shared data M _G ′ on the group member terminal 1-1. In addition, the file name of _{M G} 'with the data label _{L 1.}
(Step W3a-2) Using the key encapsulation technique, the group member terminal 1-1 generates the encryption key K _M ′ and key decryption information C _0,1 ′ from pk _G.

(Step W3a-3) By the common key encryption, the group member terminal 1-1 encrypts the shared data M _G ′ using K _M ′. The encrypted shared data (encrypted data) is E _{KM ′} (M _G ′). After completing the encryption, the group member terminal 1-1 deletes M _G ′ stored in the group member terminal 1-1.
(Step W3a-4) group member terminal 11, generates the 'encryption key shares _{S KM, 1} corresponding to' _{K M} using the master share MS _1. The method for generating the encryption key share S _{KM, 1} ′ is the same as in step W3-4.

  (Step W3a-5) The group member terminal 1-1 prompts the user to input information for user authentication, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W3a-6) group member terminal 11, the ID of the group member terminal 1-1 has (ID _{1), E KM} and _{'(M G'),} and _{C 0, 1} ', and _{L 1,} S _{KM, 1} ′, UID, and PN are sent to the storage server 2.
(Step W3a-7) The storage server 2 collates whether or not the pair of UID and PN transmitted from the group member terminal 1-1 matches the pair of UID and PN stored in advance. If they match, the storage server 2 assigns a data ID (D ₁ ) to the data. Further, the storage server 2 to the ID _1, and _{L 1, E KM} and _{'(M G'), 'and, S KM, 1' C 0,1} and, as _{D 1,} last update time _{(T S, 1} ') Is stored in the storage unit of the storage server 2 in accordance with the format of the storage server format. The latest update time (T _{S, 1} ′) is the time at the time of storage.

(Step W3a-8) The storage server 2 transmits an ACK (acknowledgement) message to the user terminal 1 in order to notify the group member terminal 1-1 that the storage process in step W3a-7 has been completed. The ACK message includes D ₁ and T _{S, 1} ′.
(Step W3a-9) after receiving the ACK message from the storage server 2, delete group members terminal 1-1 'and _{S KM, 1' K M} and _{C 0, 1} for storing a group member terminal 1-1 and To do. The group member terminal 1-1 creates an entry for the data to the local data list to the new, the _{D 1} as the data ID, and _{L 1} as the data _{label, T 1,1 '(= T S} , 1' ) As the last reference time and E _{KM ′} (M _G ′) as encrypted data according to the member terminal format. Note that E _{KM ′} (M _G ′) may or may not be deleted, and may be selected according to settings such as a setting file.
(Step W3a-10) The storage server _{2, S KM,} based on ₁ and _{S KM, 1} ', the encryption key shares _{S KM} another user (ID _i) is used with respect to _{M G,} a _{i S KM, i} Update to '. The encryption key share S _{KM, i} ′ is generated using the following equation (24). Here, X ₁ = h (ID ₁ ) is the x coordinate of the master share MS ₁ of the group member terminal 1-1, and X _i = h (ID _i ) is the x coordinate of the master share MS _i of the group member terminal i. , X _{KM, i} is the x coordinate of the encryption key share S _{KM, i} .

[Shared data storage processing: Shared data update storage (no key update)]
Next, shared data update storage processing in the present embodiment when there is no key update will be described. The shared data update storage processing operation in the present embodiment when there is no key update is performed in the same manner as the shared data update storage processing operation in the first embodiment when there is no key update.

[Shared data reference processing (new reference)]
Next, processing when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 for the first time will be described with reference to FIG. FIG. 23 is a sequence diagram showing processing operations when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 for the first time in this embodiment.

  (Step R3-0) The storage server 2 sends a data list to the group member terminal 1-1 and the group member terminal 1-2. For example, the data list transmission timing may be transmitted every time the data list is updated. Further, it may be transmitted only when there is a data access request from the user terminal.

  (Step R3-1) The group member terminal 1-2 receives an input of a reference request for shared data from the user. Subsequently, the group member terminal 1-2 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step R3-2) group member terminal 1-2, the data ID of the reference data _{M G (D 1),} the ID of the group member terminal 1-2 has (ID _2), UID and data and a PN The message is sent to the storage server 2 as a request message.

(Step R3-3) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-2 matches the set of UID and PN stored in advance. If they match, the storage server 2 uses C _0,1 and sk _{2, S} to generate key recovery information C _1,1 = C _0,1 ^W1 . The method for generating the key recovery information is the same as in step R1-3.

(Step R3-4) the storage server 2, and _{D 1,} E and KM _{(M G),} the last update time and _{(T S, 1),} and _{C 0, 1, C 1, 1} and group member terminal 1 -2.
(Step R 35) group member terminal 1-2, restores the _{K M} with the _{sk 2, U,} and _{C 0, 1,} and _{C 1, 1.} Incidentally, restoration method of _{K M} is the same as step R1-5.

(Step R3-6) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R3-7) group member terminal 1-2, to generate an encrypted share _{S KM, 2} corresponding to the _{K M} using the master share MS _2.

(Step R3-8) group member terminal 1-2, and _{D 1,} and ID _2, sends the _{S KM, 2} to the storage server 2. Moreover, after the reference of _{M G,} group member terminal 1-2 and _{K M,} and _{M G,} and _{C 0, 1,} and _{C 1, 1,} to remove the _{S KM, 2.} In addition, in the entry for the data in the local data list, D ₁ is a data ID, L ₁ is a data label, T _2,1 (= T _{S, 1} ) is a final reference time, and E _KM (M _G ) Is stored as encrypted data in accordance with the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Shared data reference processing (re-reference)]
Next, processing when the group member terminal 1-2 refers again to the shared data registered in the storage server 2 by the group member terminal 1-1 will be described with reference to FIG. FIG. 24 is a sequence diagram showing a processing operation when the group member terminal 1-2 refers again to the shared data registered in the storage server 2 by the group member terminal 1-1 in the present embodiment.

  (Step R3a-0) The storage server 2 sends a data list to the group member terminal 1-1 and the group member terminal 1-2. For example, the data list transmission timing may be transmitted every time the data list is updated. Further, it may be transmitted only when there is a data access request from the user terminal.

  (Step R3a-1) The group member terminal 1-2 receives an input of a shared data reference request from the user. Subsequently, the group member terminal 1-2 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step R3a-2) group member terminal 1-2, the data ID of the data _{M G} reference _{(D 1),} the ID of the group member terminal 1-2 has (ID _2), the UID, the PN, the The data last reference time (T _2,1 ) is sent to the storage server 2 as a data request message. Information indicating the presence / absence of encrypted data E _KM (M _G ) in the group member terminal may be added to the data request message.

(Step R3a-3) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-2 matches the set of UID and PN stored in advance. If they match, the storage server 2 sends the encryption key share S _{KM, 2} , E _KM (M _G ), and the last update time (T _{S, 1} ) to the group member terminal 1-2. Incidentally, Step R3a-2 and information indicating the added "encrypted data perforated in the group member terminals" request in the message, in the case yet no updating of the data does not send E _{KM (M G)} process It is also good. Here, as a method for determining whether or not the data has been updated, for example, the last reference time (T _{i, 1} ) sent from the group member terminal 1-i and the last update time stored in the storage server 2 ( T _{S, 1} ) is compared, and if the values are different, there is a method of determining that the value has been updated.

(Step R3a-4) group member terminal _1-2, restores the _{K M} with the _{S KM, 2,} and MS _2.
(Step R3a-5) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R3a-6) after reference _{M G,} group member terminal 1-2 deletes the _{K M,} and _{M G,} and _{S KM, 2.} Further, T _2,1 (= T _{S, 1} ) is stored in the entry for the data in the local data list as the last reference time according to the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Environment migration process]
Next, a procedure for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 when the group member terminal 1-2 is lost will be described with reference to FIG. FIG. 25 is a sequence diagram showing a processing operation for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 in the present embodiment.

(Step RE3-1) The group member terminal 1-3 notifies the certificate authority 3 of the loss of the group member terminal 1-2 and a request to move the environment of the group member terminal 1-2 to the group member terminal 1-3. To do. Further, the group member terminal 1-3 acquires the SMS _{, 2, 1} stored in the external device in step P3-4d.

(Step RE3-2) The certificate authority 3 receives terminal transition information from the group member terminal 1-3. Subsequently, the certificate authority 3 generates a split key sk ′ _{2, U} and a split key sk ′ _{2, S} for the group member terminal 1-3. The generation method is the same as in Step P1-2.
(Step RE3-3) The certificate authority 3 sends the split key sk ′ _{2, U} and the public key pk _G to the group member terminal 1-3. In addition, the certificate authority 3 sends the split keys sk ′ _{2 and S} to the storage server 2. After receiving the split key sk ′ _{2, S} , the storage server 2 deletes the split key sk _{2, S} for the group member terminal 1-2.

(Step RE3-4) The storage server 2 generates a divided share S′MS _{, 2, 2} and sends it to the group member terminal 1-3. The divided share S ′ _{MS, i, 2} is generated using the following equation (25). Here, g _j (x) = b _j x (b _j is a random number).

The group member terminal 1-3 generates MS ₃ from S ′ _{MS, 2,2} and _{SMS, 2,1} . MS ₃ satisfies the following formula (26).

  (Step RE3-5) The certification authority 3 notifies the storage server 2 that the environment of the group member terminal 1-2 has been shifted to the group member terminal 1-3.

  As described above with respect to the third embodiment, in the present embodiment, information called a master share, which is basic information for generating an encryption key, is generated in a group member terminal, and an encryption key is generated using the generated master share. The encryption key share is generated. Further, when the group member terminal changes the encryption key and updates and saves the shared data, the storage server stores all group member terminals stored in the storage server in step W3a-10 based on the updated encryption key information. Update the encryption key share for. Therefore, after the group member terminal changes the encryption key and updates and saves the shared data, when the group member terminal refers to the data once referenced again, the secret sharing is performed without performing the key restoration again by the key encapsulation technique. Key recovery by law can be used.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes designs and the like that do not depart from the gist of the present invention.

  The key update determination in step R2-3 may be performed using the hash value HK = h (KM) of the encryption key. Specifically, the group member terminal generates a hash value during data storage processing and transmits it to the storage server 2. Thereafter, at the time of data reference processing, the group member terminal sends the hash value of the encryption key to the storage server 2 in step R2-2. The storage server 2 may compare the hash value of the encryption key at the time of data storage processing with the hash value of the encryption key in step R2-2, and if they match, may determine that the encryption key has not been updated.

  In addition, the entire processing functions of the encryption key generation function, transmission function, reception function, encryption key restoration function, decryption function, update information reception function, split key update function, share generation function of the group member terminal in the above-described embodiment or its Part of storage server reception function, storage function, key recovery information generation function, transmission function, split key update function as a whole or part of it, certificate authority group key generation function, distributed key generation function, distributed All or some of the processing functions of the key splitting function, key distribution function, receiving function, split key update information generation function, and update information distribution function are recorded on a computer-readable recording medium. Then, the program recorded on the recording medium may be read by the computer system and executed. Here, the “computer system” includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a computer program that is dynamically stored for a short time, such as a communication line when a computer program is transmitted via a network such as the Internet or a communication line such as a telephone line. What is held, and what holds a computer program for a certain period of time, such as volatile memory inside a computer system serving as a server or client in that case, are included. Further, the computer program may be for realizing a part of the functions described above, and may be implemented in combination with a computer program already recorded in the computer system. good.

1 is a configuration diagram illustrating a data sharing system according to a first embodiment. FIG. It is a sequence diagram which shows the processing operation of the preparatory in 1st Embodiment. It is the figure which showed the key distribution method in 1st Embodiment. It is a figure showing the data format of the list of the data which the storage part of a group member terminal memorizes in a 1st embodiment. It is a figure showing the data format of the data which the storage part of a storage server memorizes in a 1st embodiment. FIG. 3 is a diagram illustrating an example of data stored in a storage unit of a storage server in the first embodiment. FIG. 5 is a sequence diagram illustrating a processing operation in which a group member terminal stores group shared data in a storage server in the first embodiment. FIG. 5 is a sequence diagram illustrating a processing operation in which a group member terminal updates and stores group shared data in a storage server without updating the encryption key in the first embodiment. FIG. 6 is a diagram illustrating a data list transmitted from the storage server to each group member terminal in the first embodiment. FIG. 6 is a sequence diagram showing processing operations when the group member terminal 1-2 refers to the shared data registered in the storage server by the group member terminal 1-1 in the first embodiment. FIG. 6 is a sequence diagram illustrating a processing operation for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 in the first embodiment. In 2nd Embodiment, it is the figure which showed the data format of the list | wrist of the data which the memory | storage part of a group member terminal memorize | stores. In 2nd Embodiment, it is the figure which showed the data format of the data which the memory | storage part of a storage server memorize | stores. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal 1-1 stores group shared data in a storage server in the second embodiment. FIG. 10 is a sequence diagram illustrating a processing operation when a group member terminal 1-2 refers to shared data registered in a storage server by a group member terminal 1-1 in the second embodiment. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal creates a key and refers to shared data in the second embodiment. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal refers to shared data with no key update in the second embodiment. In the third embodiment, a group member terminal is a sequence diagram showing processing operations for initial setting of a master share. In 3rd Embodiment, it is the figure which showed the data format of the list | wrist of the data which the memory | storage part of a group member terminal memorize | stores. In 3rd Embodiment, it is the figure which showed the data format of the data which the memory | storage part of a storage server memorize | stores. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal 1-1 stores group shared data in a storage server in the third embodiment. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal 1-1 stores group shared data in a storage server in the third embodiment. FIG. 15 is a sequence diagram illustrating processing operations when a group member terminal 1-2 refers to shared data registered in a storage server by a group member terminal 1-1 for the first time in the third embodiment. FIG. 15 is a sequence diagram showing processing operations when the group member terminal 1-2 refers again to the shared data registered in the storage server by the group member terminal 1-1 in the third embodiment. FIG. 10 is a sequence diagram illustrating a processing operation for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 in the third embodiment.

Explanation of symbols

1-1 to 1-N: Group member terminals, 2 ... Storage server, 3 ... Certificate authority, 4 ... Communication network

Claims (4)

In the key generation device included in a data sharing system comprising a storage server for storing encrypted shared data, N (N is an integer of 1 or more) terminal devices, and a key generation device,
A group key generation unit for generating a public key and a secret key;
Using the secret sharing method, which is a method of generating a set of distributed keys capable of generating the secret key from a set of distributed keys consisting of a first distributed key and a second distributed key, the secret key A distributed key generation unit that generates N sets of the first distributed key and the second distributed key capable of generating
The N first distributed keys included in the N sets of distributed keys generated by the distributed key generation unit are distributed to N terminal devices one by one, and each of the N terminal devices is distributed. A key distribution unit that distributes the public key and distributes the N second distributed keys included in the N sets of distributed keys to the storage server;
A receiving unit that receives terminal device migration information including migration destination terminal device information that uniquely identifies a migration destination terminal device that is a migration destination terminal device in the environment of the migration source terminal device;
With
When the receiving unit receives the terminal device transition information, the distributed key generation unit generates one set of the first distributed key and the second distributed key,
The key distribution unit distributes the first shared key and the public key included in the set of distributed keys generated by the distributed key generation unit to the migration destination terminal device, and A key generation device that distributes one second distributed key included in a set of the distributed keys generated by a distributed key generation unit to the storage server . In a storage server included in a data sharing system including a storage server, a terminal device, and a key generation device,
The migration source terminal generated when the key generation device receives the terminal device migration information including the migration destination terminal device information that uniquely identifies the migration destination terminal device that is the migration destination terminal device of the environment of the migration source terminal device The second distributed key included in the set of the first distributed key distributed to the transfer destination terminal device that is the transfer destination terminal device of the environment of the device and the second distributed key distributed to the storage server is the key. a receiving unit generator by and Ri受 signal, receives the encrypted shared data and the first key recovery information from said destination terminal device,
A storage unit that stores the shared data received by the receiving unit in association with the first key recovery information, and stores the second distributed key received by the receiving unit;
When the receiving unit receives the first key recovery information from the transfer destination terminal device, the second shared key corresponding to the transfer destination terminal device is identified, and the first key recovery information and A key recovery information generation unit that generates second key recovery information based on the identified second distributed key;
A transmitting unit that transmits the encrypted shared data, the first key recovery information, and the second key recovery information to the destination terminal device;
A storage server comprising: In a computer equipped with an arithmetic processing unit and a communication unit,
A group key generating step in which the arithmetic processing unit generates a public key and a secret key;
A secret sharing method is used in which the arithmetic processing unit generates a set of distributed keys that can generate the secret key from a set of distributed keys composed of a first distributed key and a second distributed key. A distributed key generation step of generating N sets (N is an integer of 1 or more) of the first distributed key and the second distributed key capable of generating the secret key;
The communication unit transmits N pieces of the first distributed keys included in the N sets of distributed keys generated by the arithmetic processing unit in the distributed key generation step to the N terminal devices one by one. the transmitted communication unit said public key to each N number of the terminal device, transmitting the N number of the second distributed key contained in the N sets of the set of distributed key the communication unit in the storage server Key distribution step to perform,
A receiving step in which the communication unit receives terminal device migration information including migration destination terminal device information that uniquely identifies a migration destination terminal device that is a migration destination terminal device in the environment of the migration source terminal device;
And execute
When the communication unit receives the terminal device transition information in the receiving step, in the distributed key generation step, the arithmetic processing unit generates one set of the first distributed key and the second distributed key And
In the key distribution step, the communication unit transmits the first distributed key and the public key included in the set of the distributed keys generated by the arithmetic processing unit in the distributed key generation step. The communication unit transmits to the storage server one second distributed key included in one set of the distributed key that is transmitted to the transfer destination terminal device and generated by the arithmetic processing unit in the distributed key generation step. Send
A program characterized by that . In a computer equipped with an arithmetic processing unit, a communication unit, and a storage unit,
The source terminal device generated when the key generation device receives the terminal device migration information including the destination device information that uniquely identifies the destination device that is the destination device in the environment of the source terminal device. The second shared key included in the set of the first distributed key distributed to the transfer destination terminal device that is the transfer destination terminal device of the environment and the second distributed key distributed to the storage server is the communication unit. a receiving step but the key generating apparatus by then Ri受 signal, for receiving said destination terminal shared data and the first key recovery information encrypted by the device is the communication unit,
Storing said reception step in said shared data and said first key recovery information to the communication unit has received said storage unit is associated with the storage unit the second distributed key received by the receiving step A storage step for storing;
When the communication unit receives the first key recovery information from the transfer destination terminal device, the second distribution corresponding to the transfer destination terminal device among the second distributed keys stored in the storage unit identify key, and the first key recovery information, identified based on the said second distributed key, and the key recovery information generating step of generating a second key recovery information,
A transmission step in which the communication unit transmits the encrypted shared data, the first key recovery information, and the second key recovery information to the migration destination terminal device;
A program that causes a computer to execute.

Images