JP6467385B2 - User terminal, encryption / decryption method, and program - Google Patents

Description

  The present invention relates to an encryption technique for taking measures against information leakage, and more particularly, to a user terminal using functional encryption that does not require a user to manage keys, an encryption / decryption method, and a program.

  In order to prevent information leakage, file encryption is effective (see Patent Documents 1 to 3). ID-based encryption, attribute-based encryption, and functional encryption developed from these have been proposed as techniques that do not require the user to manage decryption keys such as passwords. According to these technologies, "decrease in confidentiality due to simple password use and password memos" and "decrease in availability due to password forgetting or loss of stored data" that occur when users manage decryption keys The problem can be avoided.

JP 2011-232475 A JP 2014-207521 A Japanese Patent Laid-Open No. 2006-76022

  However, in these technologies, a configuration in which a third party on the Internet performs key management on a general basis is common. For this reason, if access to a key issuing station or ID certification authority on the Internet is not possible due to communication interruption or server overload, data decryption processing cannot be performed, and availability is reduced.

  In view of the above-described conventional technology, an object of the present invention is to provide a user terminal, an encryption / decryption method, and a program that do not cause a decrease in availability due to communication interruption or server overload.

In order to achieve the above object, the invention according to the first aspect is a user terminal used in an encryption system using functional encryption, and whether or not decryption is possible based on a file decryption condition and an environmental condition of the user terminal. A condition confirmation function unit to confirm, a key generation unit that generates a decryption key based on a service secret key held in advance when the condition confirmation function unit confirms that decryption is possible, and the key generation unit An encryption / decryption unit that decrypts a file using the decryption key generated by the method, and the user terminal in the same environment as the encryption / decryption unit includes the key generation unit that holds the service secret key in advance , the user terminal decodes the file without querying the external, leave described encrypted data by hashing the decryption condition, the hash that is described in the encrypted data Was determined to be decoded in the case where the hash value calculated at the time of decoding the test and match, if the hash values do not match the gist to display the decoded error without generating the decryption key.

  The gist of the invention according to the second aspect is that, in the invention according to the first aspect, the decoding conditions are distributed and arranged in the Internet, the LAN, and the user terminal.

  The invention according to a third aspect is the invention according to the first aspect, wherein the decryption conditions are hashed and described in the encrypted data, and the hash value described in the encrypted data and the hash calculated at the time of the decryption test The gist is to determine that decoding is possible when the values match.

The invention according to a third aspect is an encryption / decryption method of a user terminal used in an encryption system using functional encryption, wherein the user terminal is based on a file decryption condition and an environmental condition of the user terminal. A condition confirmation step for confirming whether or not decryption is possible, and a key generation unit that generates a decryption key based on a service secret key held in advance when it is confirmed that decryption is possible in the condition confirmation step. And a key generation unit that holds the service secret key in advance, and a decryption step of decrypting the file with an encryption / decryption unit using the decryption key generated in the key generation step. provided to the user terminal of the decryption unit and the same environment, the user terminal decodes the file without querying the external, issued the decryption condition If the hash value written in the encrypted data matches the hash value calculated at the time of the decryption test, it is determined that the decryption is possible. The gist is to display a decryption error without generating a decryption key .

The gist of the invention according to the fifth aspect is a program for causing a computer to function as the user terminal of the invention according to the first to third aspects .

  According to the present invention, it is possible to provide a user terminal, an encryption / decryption method, and a program that do not cause a decrease in availability due to communication interruption or server overload.

It is a block diagram of the encryption system which concerns on embodiment of this invention. It is a functional block diagram of the encryption system which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the encryption system which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the encryption system which concerns on embodiment of this invention. It is explanatory drawing of the encryption system which concerns on a comparative example. It is explanatory drawing of the encryption system which concerns on embodiment of this invention. It is explanatory drawing of the encryption system which concerns on embodiment of this invention. It is explanatory drawing of the encryption system which concerns on embodiment of this invention. It is explanatory drawing of the encryption system which concerns on embodiment of this invention. It is explanatory drawing of the file operation procedure at the time of utilization of the encryption system which concerns on embodiment of this invention. It is explanatory drawing of the encryption system which concerns on embodiment of this invention. It is explanatory drawing of the encryption system which concerns on embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The following embodiments exemplify an encryption system for embodying the technical idea of the present invention, and the configuration of the apparatus and the configuration of data are limited to the following embodiments. is not.

  The encryption system according to the embodiment of the present invention is an encryption / decryption system that does not require centralized management by a server or the like. That is, in order to avoid the availability risk due to the inaccessibility to a centralized management device such as a server, a key generation function (encryption / decryption program) is built in the terminal, and decryption conditions are set to the Internet (WAN), LAN, LOCAL. Are arranged in a distributed manner. If availability measures are taken in this way, confidentiality may be reduced, but it is not necessary to operate the key management server but to ensure confidentiality by the complexity of the decryption conditions, and to prevent attacks on the decryption conditions. Hashing is performed.

  As a result, according to the encryption system of the embodiment of the present invention, even when the user terminal cannot communicate with an external system such as a key issuing station due to the use terminal being taken out or a network server failure, the file is decrypted and encrypted. Since it can be processed, high availability can be secured. In addition, since the encryption system can eliminate the processing at the key issuing authority or the like (external service) at the time of encryption and decryption, the cost of constructing and operating the external service can be reduced. Also, confidentiality can be ensured according to the decryption conditions specified by the user. As the condition, for example, it is possible to specify a more advanced condition than using a password, such as authentication by an external authentication service or confirmation by a file creator. In addition, when decrypting a ciphertext, whether or not decryption is possible is determined not by a password but by condition matching, so that it is possible to construct a highly convenient encryption system that does not require input from the user depending on the conditions.

Next, functional encryption will be described. Functional encryption is an extension of public key cryptography. In the functional encryption, at least one of the encryption and decryption conditions can be given as a single parameter or a plurality of parameters and a logical operation expression thereof. The logical operation expression includes at least one of logical sum (OR condition), logical product (AND condition), negation (NOT condition), and a combination thereof. A method using a single parameter is called ID-based encryption, and a method of performing encryption and decryption using a plurality of parameters and their logical operation expressions is called functional encryption. Functional encryption can be said to be an extension encryption of ID-based encryption. In ID-based encryption and functional encryption, a set of a master public key and a master secret key paired in advance is generated, and a public key and a secret key that are different for each parameter are generated by calculating the master public key, the master secret key, and the parameter. (See References 1, 2, and 3). Reference 4 uses a usage environment of a user terminal device as a parameter to perform encryption and decryption of a file that controls the activation of an arbitrary application on the user terminal device, thereby controlling the start and stop of complicated applications. To achieve without implementing logic.
[Reference 1] Tetsuro Kobayashi, Go Yamamoto, Kotaro Suzuki, Shinichi Hirata, "Application of ID-based cryptography and keyword search cryptography", NTT Technical Journal, 2010, p.17-20
[Reference 2] JP 2011-004366 A
[Reference 3] Pamphlet of International Publication No. WO2010 / 123122
[Patent Document 4] Japanese Patent Application Laid-Open No. 2013-0704302

  FIG. 1 is a configuration diagram of an encryption system according to an embodiment of the present invention. In this encryption system, the role of the key management server is reduced when using functional encryption technology, and security is ensured by the decryption conditions. This eliminates the need for a third party server and improves availability.

  Specifically, as shown in FIG. 1, user terminals U 1, U 2, U 3 installed in a user office 1 are connected to a condition presentation server 3 via a network 2. The condition presentation server 3 is a server for presenting conditions, and includes a user authentication unit 3A, a time management unit 3B, an authorization unit 3C, and the like. The solid line portion in the figure represents the minimum necessary equipment, and the dotted line portion represents a system that can be added. That is, the minimum required device is only one user terminal U1, and the other user terminals U2 and U3 and the condition presentation server 3 can be added as necessary.

  FIG. 2 is a functional block diagram of the encryption system according to the embodiment of the present invention. Although the user terminal U1 is illustrated here, the same applies to the other user terminals U2 and U3.

  The user terminal U1 is various terminals such as a notebook computer operated by a user, and includes a condition confirmation function unit 10, an encryption function unit 20, and an HDD 30. The condition confirmation function unit 10 is a function unit for confirming a condition, and includes a condition 1 confirmation unit 10_1, ..., a condition n confirmation unit 10_n. The condition 1 confirmation unit 10_1,..., And the condition n confirmation unit 10_n correspond to the decoding conditions 1,. The encryption function unit 20 is a function unit that encrypts and decrypts a file, and includes a key generation unit 21, an encryption / decryption unit 22, and a file management unit 23. The HDD 30 is a storage device that stores various data such as a plain text file F1 and an encrypted file F2.

  The key generation unit 21 generates and stores a service public key SPk and a service secret key SSk when starting a service, a function to generate and return a key in response to a user request, and a service generated in the user environment The public key SPk and the service secret key SSk are shared and converted so that they can be shared among service users.

  The condition 1 confirmation unit 10_1 acquires information according to the decryption condition x (in-use user name, etc.), and confirms the validity by the method (AD inquiry, etc.) designated at the time of setting the condition, the user operation, and the environment Inquires an external server based on information, etc., obtains a response, confirms the validity of the response with a server certificate, etc., and forwards the information obtained for the condition to the encryption / decryption unit 22 Function. The same applies to the other condition 2 confirmation units 10_2,... And the condition n confirmation unit 10_n.

  The encryption / decryption unit 22 has a function of decrypting a file based on an input from the condition confirmation function unit 10, a function of determining whether a file can be decrypted based on an input from the condition confirmation function unit 10, and a user-specified A function for encrypting a file using a decryption condition and a function for encrypting a file using a default decryption condition are provided.

  The file management unit 23 has a function of identifying a document file and a system file, a function of automatically encrypting a plain text document file when there is a plain text document file in a file accessed by the user, A function for scanning a file and automatically encrypting a plain text document file.

  Of course, you may equip the user terminal U1 and an external server with another function part. For example, an external server may be provided with a user management unit. The user management unit has a function of adding and deleting users and a function of adding and deleting usage conditions.

  FIG. 3 is a flowchart showing the operation of the encryption system according to the embodiment of the present invention. Here, a case where a file read operation is performed will be described.

  First, when a file read request is made via a file browser, a file editing application (hereinafter, application 40) (step S1), the encryption function unit 20 catches the file read request and whether decryption is necessary or not. Is confirmed (step S2). When it is confirmed in step S2 that decryption is necessary, conditions necessary for file decryption are confirmed (step S3). If it is confirmed in step S3 that decryption is possible, a key corresponding to the conditions is generated, the encrypted file F2 is decrypted, the plaintext file F1 is cached in a memory or the like (step S4), and the plaintext cache is stored in the application 40. The file is returned, the file is opened, and the process is terminated (step S5). If it is confirmed in step S3 that decryption is impossible, a decryption error is displayed (step S6), the encrypted file F2 is returned to the application 40, and the process is terminated (step S7). Even when it is confirmed in step S2 that decryption is unnecessary, the encrypted file F2 is returned to the application 40 and the process is terminated (step S7). As a result, the plain text file F1 is returned to the application 40 at the time of normal file use, whereas the encrypted file F2 can be returned to the application 40 at the time of illegal use, file take-out, transfer, or the like.

  FIG. 4 is a flowchart showing the operation of the encryption system according to the embodiment of the present invention. Here, a case where a file writing operation is performed will be described.

  First, when a file write request is made via the application 40 (step S11), the encryption function unit 20 catches the file write request and confirms whether encryption is necessary (step S12). When it is confirmed in step S12 that encryption is necessary, the plaintext file F1 is encrypted using default decryption conditions (step S13), and the encrypted file F2 is written in the HDD 30 (step S14). When it is confirmed in step S12 that encryption is unnecessary, the plaintext file F1 is written in the HDD 30 (step S15). As a result, the document file can be written as the encrypted file F2, while the system file or the like can be written as the plain text file F1.

  FIG. 5 is an explanatory diagram of an encryption system according to a comparative example, and shows an application of an existing technology. Here, a state in which plain text data is encrypted and encrypted data is generated by a file writing operation (see reference numerals 51 → 52 → 53). In addition, the encrypted data is decrypted and plain text data is generated by the file reading operation (see reference numerals 53 → 54 → 55).

  When the existing technology is applied, a third party server that issues a key is required, and the cost increases (see reference numeral 56). Further, the acquisition method and contents of the decoding condition f (x = A & xx = B) in the system for ensuring availability are not specified (see reference numeral 53). f is a function, x and xx are conditions, and A and B are parameters corresponding to the conditions. Furthermore, since the decryption condition f (x = A & xx = B) is written in the encrypted data as it is, forgery is possible and confidentiality is reduced (see reference numeral 53).

  FIG. 6 is an explanatory diagram of the encryption system according to the embodiment of the present invention. Here, similarly to FIG. 5, plain text data is encrypted and encrypted data is generated (see reference numerals 61 → 62 → 63). In addition, the encrypted data is decrypted and plain text data is generated (see reference numerals 63 → 64 → 65).

  As already described, when an existing technology is applied, a third party server that issues a key is required, which increases costs. Therefore, in this embodiment, as shown in FIG. 6, the key generation function holding the service secret key SSk is performed in the same environment as the decryption function (see reference numeral 65). In other words, the key generation unit 21 is provided in the user terminal U1 in the same environment as the encryption / decryption unit 22. As a result, it is possible to increase the speed without making an external inquiry every time decryption is performed, and a key generation server becomes unnecessary. Further, the decryption key DSk based on the service secret key SSk embedded in the program can be generated, and there is an advantage that the versatility of the ciphertext is improved.

  Although there is a risk that the service secret key SSk is acquired by a side channel attack or the like, the decryption key DSk corresponding to the encrypted data cannot be generated by the service secret key SSk alone by concealing the decryption conditions. If the condition is found, an attack such as camouflage can be considered, and security cannot be ensured, so it is desirable to hash it (described later).

  FIG. 7 is an explanatory diagram of the encryption system according to the embodiment of the present invention. As already described, in the existing technology, the acquisition method and contents of the decoding condition in the system for ensuring availability are not embodied. Therefore, in this embodiment, as shown in FIG. 7, the method and contents for obtaining the decoding conditions are embodied. “◯” in the figure means possible (recommended), “Δ” means possible, and “x” means impossible. Conditions that support offline use as necessary are desirable, assuming that it is difficult to forge and can be used both inside and outside the company.

  For example, for a company-use file, a high-security external proof such as f (Oauth = A & SAML = B) may be mainly used, and a plurality of medium classifications may be used together. For other company's shared files, specify external certifications that can be used by other companies based on the company's files, such as f (Oauth = A & SAML = B | Oauth = C & SAML = D). Classification may be used in combination. In addition, for offline files taken by the company, add internal certification when offline, based on the files used by the company, such as f (Oauth = A & SAML = B | mail = C & TPM = D & WiFi SSID = E) A plurality of medium classifications may be used in combination. In addition, for offline take-out files of other companies, based on other company's shared files such as f (Oauth = A & SAML = B | Oauth = C & SAML = D | mail = E & TPM = F & WiFi SSID = G) When offline, an internal certificate may be added, and multiple categories may be used together.

  FIG. 8 is an explanatory diagram of the encryption system according to the embodiment of the present invention. As already described, in the existing technology, the acquisition method and contents of the decoding condition in the system for ensuring availability are not embodied. Therefore, in the present embodiment, as described below, it is possible to appropriately select condition confirmation from the Internet, condition confirmation on the LAN, and condition confirmation on the Local (the user terminal).

  Here, as the condition confirmation from the Internet, the user authentication unit 3A confirms that the user is an authorized user, the time management unit 3B confirms that it is a decryptable time, and the authorization unit 3C Applicable to check whether the file can be accessed. Specifically, as shown in FIG. 8, the server response result is returned by a protocol such as XML, REST, or NTP. Since the condition comparison is only plaintext, it is possible to impersonate by an attack in a decryptable environment. As a countermeasure against impersonation, it is used only when a message signature or identification information such as SSL is attached in addition to the message included in the server response.

  In addition, as a condition check in the LAN, it is applicable to have peripheral employees confirm that the access is in the office. Specifically, a creator is searched for in an environment using the encryption tool by a messenger protocol such as XMPP, and an approval request and a response are received. For example, a password determined by the user can be used as the approval message.

  Furthermore, as local condition confirmation, environmental information (terminal information, location information) is used corresponding to the condition, and user information (information that can be uniquely determined such as an email address) is used corresponding to the condition. Is applicable.

  FIG. 9 is an explanatory diagram of the encryption system according to the embodiment of the present invention. Here, similarly to FIG. 6, the plain text data is encrypted and the encrypted data is generated (see reference numerals 71 → 72 → 73). In addition, the encrypted data is decrypted and plain text data is generated (see reference numerals 73 → 74 → 75). The same is true in that the key generation function holding the service secret key SSk is implemented in the same environment as the decryption function (see reference numeral 75).

  As already described, in the existing technology, the decryption condition f (x = A & xx = B) is described as it is in the encrypted data, so that it can be camouflaged and the confidentiality is lowered. Therefore, in this embodiment, the condition is c = (Hash (x = A & xx = B), x & xx), and the hash value c is described in the encrypted data. Then, a parameter corresponding to x & xx included in the hash value c is acquired, and the parameter corresponding to the condition cannot be confirmed by taking a hash. At the time of the decryption test, a parameter corresponding to x & xx is substituted, a hash is taken, and it is confirmed whether the hash value matches the hash value c described in the encrypted data. If the hashes do not match, a decryption error may be displayed without generating the decryption key DSk.

  According to such a configuration, even if the service secret key SSk is leaked by a side channel attack, the decryption key DSk that can decrypt the encrypted data cannot be generated unless the decryption conditions are specified. That is, as a system, confidentiality can be ensured by the decryption conditions. In the key generation, the decryption key DSk is generated for the parameter, so that it is not affected by the conditional text description method in the ciphertext.

  Hereinafter, the configuration of the encryption system will be described in more detail with specific examples.

  FIG. 10 is an explanatory diagram of a file operation procedure when using the encryption system according to the embodiment of the present invention. Here, a case where a file is transmitted and received between a user terminal U1 and a user terminal U1 ′ connected via a network 2A such as a LAN will be described.

  First, the file reading time in the user terminal U1 will be described. The application 40 requests the encryption function unit 20 to read the file. The encryption function unit 20 confirms the requested application with the file management unit 23, and when decryption is necessary, reads the encrypted file F <b> 2 from the HDD 30 and makes an inquiry to the condition confirmation function unit 10. The condition confirmation function unit 10 confirms whether or not decryption is possible from the decryption conditions of the file and the environmental conditions of the user terminal U1, and returns the environmental conditions to the encryption function unit 20 if the decryption is possible. The encryption function unit 20 generates a decryption key by the key generation unit 21 using the environmental condition received from the condition confirmation function unit 10, and decrypts it by the encryption / decryption unit 22. The decrypted data is returned to the application 40 via the memory. The application 40 reads the plain text data received from the encryption function unit 20.

  Next, a description will be given of file writing in the user terminal U1. The application 40 requests the encryption function unit 20 to write a file. The encryption function unit 20 confirms the requested file application with the file management unit 23 and, if it is an encryption target, applies the default decryption condition and encrypts it. The encrypted data is written to the HDD 30.

  Next, the file reading time in the user terminal U1 'will be described. The application 40 'requests the encryption function unit 20' to read the file. The encryption function unit 20 'confirms the requested application with the file management unit 23'. If decryption is necessary, the encryption function unit 20 'reads the encrypted file F2' from the HDD 30 'and inquires the condition confirmation function unit 10'. The condition confirmation function unit 10 ′ confirms whether or not decryption is possible based on the file decryption conditions and the environmental conditions of the user terminal U <b> 1 ′. If decryption is possible, the condition confirmation function unit 10 ′ returns the environmental conditions to the encryption function unit 20 ′. The encryption function unit 20 ′ generates a decryption key by the key generation unit 21 ′ using the environmental condition received from the condition confirmation function unit 10 ′, and decrypts it by the encryption / decryption unit 22 ′. The decrypted data is returned to the application 40 'via the memory. The application 40 'reads the plain text data received from the encryption function unit 20'.

  Next, the file transmission / reception between the user terminals U1 and U1 'will be described. The application 40 requests the encryption function unit 20 to read the file. The encryption function unit 20 confirms the requested application with the file management unit 23, and when decryption such as external take-out is not necessary, reads the encrypted file F2 from the HDD 30, confirms whether the authority needs to be changed, Respond to 40. The application 40 transmits the encrypted file F2 to the external application 40 '. The application 40 'receives the encrypted file F2 and stores it in the HDD 30'.

  FIG. 11 is an explanatory diagram of the encryption system according to the embodiment of the present invention. As shown in this figure, it is desirable to adopt a built-in encryption tool as the configuration of the key issuing authority. That is, both the service secret key SSk and the service public key SPk are disclosed without having a key issuing authority. In the client terminal, a decryption key DSk for its own environment is issued. According to such a configuration, the encryption system can be used without using a common key issuing authority by using the complexity of specifying the decryption conditions, instead of ensuring the security of the service secret key SSk. it can. However, since the identification conditions and the impersonation have a great influence on the security, the key generation function must be implemented in the same environment as the decryption function.

  FIG. 12 is an explanatory diagram of the encryption system according to the embodiment of the present invention. As shown in this figure, it is desirable to perform hashing as a process for the decryption condition. That is, the decryption environment condition is hashed, and when the hash matches, the decryption is possible. According to such a configuration, obfuscation can be achieved by hashing, and both anti-spoofing measures and offline decryptability can be ensured. However, since the range that can be taken by the numerical value set in the condition can be easily guessed, such as MD5 (“Director”), there is a possibility of camouflaging by brute force. A wide range of conditions is also required.

  As described above, the user terminal U1 included in the encryption system according to the embodiment of the present invention is a user terminal used in the encryption system using functional encryption, and confirms whether or not the decryption is possible based on the decryption condition. And a key generation unit that generates a decryption key DSk corresponding to the decryption condition based on the service secret key SSk embedded in the program when the condition confirmation function unit 10 confirms that the decryption is possible. 21 and an encryption / decryption unit 22 that decrypts a file using the decryption key DSk generated by the key generation unit 21. This eliminates the need for an external server such as a key issuing authority even when building an encryption system using functional encryption, so there is no problem that the “availability” of the system decreases due to network disconnection or overload of the server. .

  Also, the decoding conditions are distributed and arranged in the Internet, the LAN, and the user terminal U1 (Local). As a result, information that matches the decryption conditions can be acquired from the Internet, LAN, or Local, and therefore is not easily affected by network disconnection or overload of the corresponding server.

  Further, the decryption condition is hashed and described in the encrypted data, and when the hash value described in the encrypted data matches the hash value calculated at the time of the decryption test, it is determined that the decryption is possible. As a result, when the hashes do not match, the decryption error can be displayed without generating the decryption key DSk, so that the decryption process can be reduced. Of course, hashing also has the effect of preventing attacks on the decryption conditions.

  In addition, although the encryption system by functional encryption was illustrated here, this invention is not limited to this. For example, the present invention can be applied to an encryption system using ID-based encryption or attribute-based encryption.

  In addition, the present invention can be realized not only as such a user terminal U1, but also as an encryption / decryption method using a characteristic processing unit provided in such a user terminal U1 as a step. It can also be realized as a program for causing a computer to execute. Needless to say, such a program can be distributed via a recording medium such as a CD-ROM or a transmission medium such as the Internet.

DESCRIPTION OF SYMBOLS 1 ... User office U1, U2, U3 ... User terminal 2 ... Network 3 ... Condition presentation server 3A ... User authentication part 3B ... Time management part 3C ... Authorization part 10 ... Condition confirmation function part 20 ... Encryption function part 30 ... HDD
21 ... Key generation unit 22 ... Encryption / decryption unit 23 ... File management unit F1 ... Plain text file F2 ... Encryption file

Claims (4)

A user terminal used in a functional encryption system,
A condition confirmation function unit for confirming whether or not decryption is possible based on the decryption condition of the file and the environmental condition of the user terminal;
A key generation unit that generates a decryption key based on a service secret key held in advance when it is confirmed by the condition confirmation function unit that decryption is possible;
An encryption / decryption unit that decrypts a file using the decryption key generated by the key generation unit,
The key generation unit holding the service secret key in advance is provided in the user terminal in the same environment as the encryption / decryption unit, and the user terminal decrypts the file without making an external inquiry ,
The decryption condition is hashed and described in the encrypted data, and when the hash value described in the encrypted data matches the hash value calculated during the decryption test, it is determined that the decryption is possible, and the hash value is A user terminal that displays a decryption error without generating the decryption key if they do not match .   The user terminal according to claim 1, wherein the decoding conditions are distributed and arranged in the Internet, a LAN, and the user terminal. An encryption / decryption method for a user terminal used in an encryption system using functional encryption,
The user terminal is
A condition confirmation step for confirming whether the decryption is possible or not based on the decryption condition of the file and the environmental condition of the user terminal;
When it is confirmed that decryption is possible in the condition confirmation step, a key generation step of generating a decryption key by a key generation unit based on a service secret key held in advance;
Performing a decryption step of decrypting the file by the encryption / decryption unit using the decryption key generated in the key generation step;
The key generation unit holding the service secret key in advance is provided in the user terminal in the same environment as the encryption / decryption unit, and the user terminal decrypts the file without making an external inquiry ,
The decryption condition is hashed and described in the encrypted data, and when the hash value described in the encrypted data matches the hash value calculated during the decryption test, it is determined that the decryption is possible, and the hash value is An encryption / decryption method characterized by displaying a decryption error without generating the decryption key if they do not match . Program for causing a computer to function as a user terminal according to claim 1 or 2.

Images