FUNCTIONAL ENCRYPTION APPLIED SYSTEM, INFORMATION OUTPUT APPARATUS, INFORMATION PROCESSING APPARATUS, ENCRYPTION PROTOCOL EXECUTION METHOD, INFORMATION OUTPUT METHOD, INFORMATION PROCESSING METHOD, PROGRAM AND RECORDING MEDIUM

• US 20120163588A1
• Filed: 07/30/2010
• Published: 06/28/2012
• Est. Priority Date: 08/03/2009
• Status: Active Grant

• Current Assignee: Nippon Telegraph and Telephone Corporation
• Original Assignee: Nippon Telegraph and Telephone Corporation
• Inventors: Kobayashi, Tetsutaro, Suzuki, Koutarou
• Granted Patent: US 8,938,068 B2
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: H04L 9/0847 involving identity based encryption [IBE] schemes
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

An information output apparatus identifies, according to a rule established for each of functional encryption protocols or a rule established for each combination of the protocols, one or more identifiers corresponding to a particular functional encryption protocol or a combination of the particular protocols, sets a particular piece of first correspondence information corresponding to the identifier or identifiers, and outputs first information which is a ciphertext or key information of the functional encryption scheme that corresponds to the particular piece of first correspondence information. An information processing apparatus inputs the first information and second information which is key information or a ciphertext of the functional encryption scheme that corresponds to a particular piece of second correspondence information into a decryption function of the functional encryption scheme and, when the truth value of a logical formula corresponding to the combination of the particular piece of first correspondence information corresponding to the first information and the particular piece of second correspondence information corresponding to the second information is true, generates a decryption result

Claims

1. A functional encryption applied system comprising an information output apparatus and an information processing apparatus, wherein:

the information output apparatus includes;

an identifier identifying unit for identifying one identifier or a plurality of identifiers according to a rule established for each of protocols that are in accordance with a functional encryption scheme or a rule established for each combination of protocols that are in accordance with the functional encryption scheme, the one identifier or the plurality of identifiers corresponding to a particular protocol that is in accordance with the functional encryption scheme or a combination of particular protocols that are in accordance with the functional encryption scheme, the functional encryption scheme being a scheme in which a ciphertext is correctly decrypted when a truth value of a logical formula corresponding to a combination of first correspondence information and second correspondence information is true;

a correspondence information setting unit for setting a particular piece of first correspondence information corresponding to the one identifier or the combination of the plurality of identifiers; and

an output unit for outputting first information, the first information being a ciphertext or key information of the functional encryption scheme that corresponds to the particular piece of first correspondence information; and

the information processing apparatus includes;

a decryption unit for inputting the first information and second information corresponding to a particular piece of second correspondence information into a decryption function of the functional encryption scheme and, generating a decryption result when a truth value of a logical formula corresponding to a combination of the particular piece of first correspondence information corresponding to the first information and the particular piece of second correspondence information corresponding to the second information is true, the second information being key information of the functional encryption scheme or a ciphertext of the functional encryption scheme;

the particular piece of second correspondence information takes on a value that yields a decryption result for one value or each of a plurality of values that the particular piece of first correspondence information takes on, when the first information corresponding to the particular piece of first correspondence information and the second information corresponding to the particular piece of second correspondence information are input into the decryption function; and

when the first information is a ciphertext corresponding to the particular piece of first correspondence information, the second information is key information corresponding to the particular piece of second correspondence information and when the first information is key information corresponding to the particular piece of first correspondence information, the second information is a ciphertext corresponding to the particular piece of second correspondence information.

2. The functional encryption applied system according to claim 1, wherein the particular piece of second correspondence information takes on a value that yields a decryption result for each of a plurality of values that the particular piece of first correspondence information takes on, when the first information corresponding to the particular piece of first correspondence information and the second information corresponding to the particular piece of second correspondence information are input into the decryption function.

3. The functional encryption applied system according to claim 1 or 2, wherein:

the identifier identifying unit identifies the one identifier or the plurality of identifiers corresponding to the combination of the particular protocols; and

the combination of the particular protocols is a combination made up of a plurality of protocols that are in accordance with the functional encryption scheme.

4. The functional encryption applied system according to claim 3, wherein:

the information output apparatus further comprises a first switching unit for selecting whether the first information is to be a ciphertext or key information, depending on the particular protocol; and

the information processing apparatus further comprising a second switching unit for selecting whether the second information is to be a ciphertext or key information, depending on the particular protocol.

5. The functional encryption applied system according to claim 1 or 2, wherein:

the information output apparatus further comprises a first switching unit for selecting whether the first information is to be a ciphertext or key information, depending on the particular protocol; and

the information processing apparatus further comprising a second switching unit for selecting whether the second information is to be a ciphertext or key information, depending on the particular protocol.

6. The functional encryption applied system according to claim 1, wherein:

the second correspondence information causes a predetermined function to return a predetermined function value for one or a plurality of values that the first correspondence information takes on, when the second correspondence information and the first correspondence information are input into the function; and

the decryption function generates a correct decryption result when the predetermined function into which the particular piece of first correspondence information corresponding to the first information and the particular piece of second correspondence information corresponding to the second information are input returns the predetermined function value.

7. The functional encryption applied system according to claim 6, wherein the second correspondence information causes a predetermined function to return a predetermined function value for a plurality of values that the first correspondence information takes on, when the second correspondence information and the first correspondence information are input into the function.

8. The functional encryption applied system according to claim 7, wherein:

the first correspondence information and the second correspondence information are vectors; and

the predetermined function is a function calculating an inner product of the first correspondence information and the second correspondence information and the predetermined value is 0.

9. The functional encryption applied system according to claim 8, wherein:

at least some of the first correspondence information is a vector some of whose elements are first spare fields whose value is fixed;

at least some of the second correspondence information is a vector some of whose elements are second spare fields whose value is fixed;

the positions of the first spare fields of the first correspondence information including the first spare fields are identical to the positions of the second spare fields of the second correspondence information; and

an inner product of a vector constituting the first spare fields of the first correspondence information including the first spare fields and a vector constituting the second fields of the second correspondence information is 0 regardless of the first identifier or the combination of the plurality of identifiers.

10. The functional encryption applied system according to claim 9, wherein values in all of the first spare fields are 0.

11. The functional encryption applied system according to claim 9, wherein values in all of the second spare fields are 0.

12. The functional encryption applied system according to claim 10, wherein values in at least some of the second spare fields are nonzero.

13. The functional encryption applied system according to claim 11, wherein values in at least some of the first spare fields are nonzero.

14. The functional encryption applied system according to any one of claims 8 to 13, wherein:

the first correspondence information is a vector each of whose elements is a value that is an indeterminate component of each term of polynomial representing a logical formula including a logical disjunction and/or conjunction, the value being assigned the identifier; and

the second correspondence information is a vector each of whose elements is a coefficient component of each term of the polynomial representing the logical formula;

the polynomial representing the logical formula is a polynomial in which a polynomial that calculates a difference between an indeterminate and a constant expresses a proposition that the indeterminate is the constant, a product of polynomials each of which expresses a proposition expresses a logical disjunction of the propositions, a linear sum of polynomials each of which expresses a proposition or a logical disjunction of propositions expresses a logical conjunction of the proposition or the logical disjunction of the propositions, thereby expressing the logical formula; and

the polynomial representing the logical formula is equal to an inner product of the first correspondence information and the second correspondence information and, the logical formula being true is equivalent to the polynomial representing the logical formula being 0.

15. The functional encryption applied system according to claim 14, wherein:

the first correspondence information and the second correspondence information corresponds to the logical formula including as a part a logical conjunction of propositions that is preset to result in true regardless of the one identifier or the combination of the plurality of identifiers.

16. The functional encryption applied system according to claim 1, wherein:

the first correspondence information includes one or a plurality of pieces of first partial correspondence information and the second correspondence information includes one or a plurality of pieces of second partial correspondence information;

when the first partial correspondence information and the second partial correspondence information are input into a predetermined function, the function returns a value a predetermined value or a value other than the predetermined value depending on a combination of a value of the first partial correspondence information and a value of the second partial correspondence information;

for each combination of the first partial correspondence information and the second partial correspondence information, it is predetermined whether a combination of the first partial correspondence information and the second partial correspondence information is true when the function returns the predetermined value or a combination of the first partial correspondence information and the second partial correspondence information is true when the function does not return the predetermined value; and

the decryption function is a function that generates a correct decryption result when a set of combinations of pieces of the first partial correspondence information and pieces of the second partial correspondence information that combinations yield true satisfies a predetermined condition.

17. The functional encryption applied system according to claim 16, wherein:

a vector is associated with each of the pieces of the first partial correspondence information or each of the pieces of the second partial correspondence information;

the decryption information is a function that generates a correct decryption result when a particular vector exists in a vector space formed by vectors associated with the first partial correspondence information or the second partial correspondence information that are included in each combination of the first partial correspondence information and the second partial correspondence information that combination yields true.

18. The functional encryption applied system according to claim 16 or 17, wherein:

the first partial correspondence information and the second partial correspondence information are vectors; and

the predetermined function is a function that calculates an inner product of the first partial correspondence information and the second partial correspondence information and the predetermined value is 0.

19. The functional encryption applied system according to claim 18, wherein:

at least some of the first partial correspondence information is a vector whose value is fixed;

at least some of the second partial correspondence information is a vector whose value is fixed; and

an inner product of the first partial correspondence information that is a vector whose value is fixed and the second partial correspondence information that is a vector whose value is fixed is 0 regardless of the one identifier or the combination of the plurality of identifiers.

20. The functional encryption applied system according to claim 19, wherein:

the first partial correspondence information that is a vector whose value is fixed is a vector all of whose elements are 0.

21. The functional encryption applied system according to claim 19, wherein the second partial correspondence information that is a vector whose value is fixed is a vector all of whose elements are 0.

22. The functional encryption applied system according to claim 20, wherein the second partial correspondence information that is a vector whose value is fixed is a vector including a nonzero element.

23. The functional encryption applied system according to claim 21, wherein the first partial correspondence information that is a vector whose value is fixed is a vector including a nonzero elements.

24. The functional encryption applied system according to claim 1, wherein the information processing apparatus stores one piece of the second information that corresponds to one particular piece of the second correspondence information.

25. The functional encryption applied system according to claim 1, wherein:

a type of first correspondence information to be used for a protocol that is in accordance with the functional encryption scheme or a combination of protocols that is in accordance with the functional encryption scheme is predetermined and the rule identifies the one identifier or combination of the plurality of identifiers that determines the particular piece of first correspondence information of the type to be used for the particular protocol or combination of the particular protocols.

26. The functional encryption applied system according to claim 1 or 25, wherein:

the protocol is selected from a set including at least one of a Timed-Release encryption protocol, a Forward Secure encryption protocol, a Key Insulated encryption protocol, a CCA2 secure encryption protocol, and a Keyword search encryption protocol;

when the protocol is the Timed-Release encryption protocol, the rule is a rule that sets information identifying a time point after the time of generation of the first information as the identifier;

when the protocol is the Forward Secure encryption protocol or the Key Insulated encryption protocol, the rule is a rule that sets information identifying a time period including the time of generation of the first information or a time period after the time of generation of the first information, respectively as the identifier;

when the protocol is the CCA2 secure encryption protocol, the rule is a rule that sets as the identifier information identifying one-time information which is newly set each time the first information is generated; and

when the protocol is the Keyword search encryption protocol, the rule is a rule that sets information identifying a keyword for searching a database as the identifier.

27. An information output apparatus comprising:

an identifier identifying unit for identifying one identifier or a plurality of identifiers according to a rule established for each of protocols that are in accordance with a functional encryption scheme or a rule established for each combination of protocols that are in accordance with the functional encryption scheme, the one identifier or the plurality of identifiers corresponding to a particular protocol that is in accordance with the functional encryption scheme or a combination of particular protocols that are in accordance with the functional encryption scheme, the functional encryption scheme being a scheme in which a ciphertext is correctly decrypted when a truth value of a logical formula corresponding to a combination of first correspondence information and second correspondence information is true;

a correspondence information setting unit for setting a particular piece of first correspondence information corresponding to the one identifier or the combination of the plurality of identifiers; and

an output unit for outputting first information, the first information being a ciphertext or key information of the functional encryption scheme that corresponds to the particular piece of first correspondence information.

28. The information output apparatus according to claim 27, wherein:

the identifier identifying unit identifies the one identifier or the plurality of identifiers corresponding to the combination of the particular protocols; and

the combination of the particular protocols is a combination made up of a plurality of protocols that are in accordance with the functional encryption scheme.

29. The information output apparatus according to claim 27 or 28, further comprising a first switching unit for selecting whether the first information is to be a ciphertext or key information, depending on the particular protocol.

44. A program for causing a computer to function as the information output apparatus according to claim 27.

46. A computer-readable recording medium on which a program for causing a computer to function as the information output apparatus according to claim 27 is recorded.

30. An information processing apparatus comprising:

a decryption unit for inputting first information and second information into a decryption function of a functional encryption scheme and, generating a decryption result when a truth value of a logical formula corresponding to a combination of a particular piece of first correspondence information corresponding to the first information and a particular piece of second correspondence information corresponding to the second information is true, the first information being a ciphertext or key information of the functional encryption scheme that corresponds to the particular piece of first correspondence information corresponding to one identifier or a combination of a plurality of identifiers determined according to a rule established for each of protocols that are in accordance with the functional encryption scheme or a rule established for each combination of protocols that are in accordance with the functional encryption protocol, the second information being key information or a ciphertext of the functional encryption scheme that corresponds to the particular piece of second correspondence information, the functional encryption protocol being a protocol in which a ciphertext is correctly decrypted when a truth value of a logical formula corresponding to a combination of the first correspondence information and the second correspondence information is true;

wherein the particular piece of second correspondence information takes on a value that yields a decryption result for one value or each of a plurality of values that the particular piece of first correspondence information takes on, when the first information corresponding to the particular piece of first correspondence information and the second information corresponding to the particular piece of second correspondence information are input into the decryption function; and

when the first information is a ciphertext corresponding to the particular piece of first correspondence information, the second information is key information corresponding to the particular piece of second correspondence information and when the first information is key information corresponding to the particular piece of first correspondence information, the second information is a ciphertext corresponding to the particular piece of second correspondence information.

31. The information processing apparatus according to claim 30, wherein the particular piece of second correspondence information takes on a value that yields a decryption result for each of a plurality of values that the particular piece of first correspondence information takes on, when the first information corresponding to the particular piece of first correspondence information and the second information corresponding to the particular piece of second correspondence information are input into the decryption function.

32. The information processing apparatus according to claim 30 or 31, wherein:

the identifier identifying unit identifies the one identifier or plurality of identifiers corresponding to the combination of the particular protocols; and

the combination of the particular of protocols is a combination made up of a plurality of protocols that are in accordance with the functional encryption scheme.

33. The information processing apparatus according to claim 32, further comprising a second switching unit for selecting whether the second information is to be a ciphertext or key information, depending on the particular protocol.

34. The information processing apparatus according to claim 30 or 31, further comprising a second switching unit for selecting whether the second information is to be a ciphertext or key information, depending on the particular protocol.

45. A program for causing a computer to function as the information processing apparatus according to claim 30.

47. A computer-readable recording medium on which a program for causing a computer to function as the information processing apparatus according to claim 30 is recorded.

35. An encryption protocol execution method comprising:

an identifier identifying step of, by an information output apparatus, identifying one identifier or a plurality of identifiers according to a rule established for each of protocols that are in accordance with a functional encryption scheme or a rule established for each combination of protocols that are in accordance with the functional encryption scheme, the one identifier or the plurality of identifiers corresponding to a particular protocol that is in accordance with the functional encryption scheme or a combination of particular protocols that are in accordance with the functional encryption scheme, the functional encryption scheme being a scheme in which a ciphertext is correctly decrypted when a truth value of a logical formula corresponding to a combination of first correspondence information and second correspondence information is true;

a correspondence information setting step of, by the information output apparatus, setting a particular piece of first correspondence information corresponding to the one identifier or the combination of the plurality of identifiers; and

an output step of, by the information output apparatus, outputting first information, the first information being a ciphertext or key information of the functional encryption scheme that corresponds to the particular piece of first correspondence information; and

a decryption step of, by an information processing apparatus, inputting the first information and second information corresponding to a particular piece of second correspondence information into a decryption function of the functional encryption scheme and, generating a decryption result when a truth value of a logical formula corresponding to a combination of the particular piece of first correspondence information corresponding to the first information and the particular piece of second correspondence information corresponding to the second information is true, the second information being key information of a functional encryption scheme or a ciphertext of the functional encryption scheme;

wherein the particular piece of second correspondence information takes on a value that yields a decryption result for one value or each of a plurality of values that the particular piece of first correspondence information takes on, when the first information corresponding to the particular piece of first correspondence information and the second information corresponding to the particular piece of second correspondence information are input into the decryption function; and

when the first information is a ciphertext corresponding to the particular piece of first correspondence information, the second information is key information corresponding to the particular piece of second correspondence information and when the first information is key information corresponding to the particular piece of first correspondence information, the second information is a ciphertext corresponding to the particular piece of second correspondence information.

36. An information output method comprising:

an identifier identifying step of, by an identifier identifying unit, identifying one identifier or a plurality of identifiers according to a rule established for each of protocols that are in accordance with a functional encryption scheme or a rule established for each combination of protocols that are in accordance with the functional encryption scheme, the one identifier or the plurality of identifiers corresponding to a particular protocol that is in accordance with the functional encryption scheme or a combination of particular protocols that are in accordance with the functional encryption scheme, the functional encryption scheme being a scheme in which a ciphertext is correctly decrypted when a truth value of a logical formula corresponding to a combination of first correspondence information and second correspondence information is true;

a correspondence information setting step of, by a correspondence information setting unit, setting a particular piece of first correspondence information corresponding to the one identifier or the combination of the plurality of identifiers; and

an output step of, by an output unit, outputting first information being a ciphertext or key information of the functional encryption scheme that corresponds to the particular piece of first correspondence information.

37. The information output method according to claim 36, wherein:

the identifier identifying step is a step of identifying the one identifier or the plurality of identifiers corresponding to the combination of the particular protocols; and

the combination of the particular protocols is a combination made up of a plurality of protocols that are in accordance with the functional encryption scheme.

38. The information output method according to claim 36 or 37, further comprising a switching step of, by a switching unit, selecting whether the first information is to be a ciphertext or key information, depending on the particular protocol.

39. An information processing method comprising:

a decryption step of, by decryption unit, inputting first information and second information into a decryption function of a functional encryption scheme and, generating a decryption result when a truth value of a logical formula corresponding to a combination of a particular piece of first correspondence information corresponding to the first information and a particular piece of second correspondence information corresponding to the second information is true, the first information being a ciphertext or key information of the functional encryption scheme that corresponds to a particular piece of first correspondence information corresponding to one identifier or a combination of a plurality of identifiers determined according to a rule established for each of protocols that are in accordance with the functional encryption scheme or a rule established for each combination of protocols that are in accordance with the functional encryption protocol, the second information being key information or a ciphertext of the functional encryption scheme that corresponds to the particular piece of second correspondence information, the functional encryption protocol being a protocol in which a ciphertext is correctly decrypted when a truth value of a logical formula corresponding to a combination of the first correspondence information and the second correspondence information is true;

wherein the particular piece of second correspondence information takes on a value that yields a decryption result for one value or each of a plurality of values that the particular piece of first correspondence information takes on, when the first information corresponding to the particular piece of first correspondence information and the second information corresponding to the particular piece of second correspondence information are input into the decryption function; and

when the first information is a ciphertext corresponding to the particular piece of first correspondence information, the second information is key information corresponding to the particular piece of second correspondence information and when the first information is key information corresponding to the particular piece of first correspondence information, the second information is a ciphertext corresponding to the particular piece of second correspondence information.

40. The information processing method according to claim 39, wherein the particular piece of second correspondence information takes on a value that yields a decryption result for each of a plurality of values that the particular piece of first correspondence information takes on, when the first information corresponding to the particular piece of first correspondence information and the second information corresponding to the particular piece of second correspondence information are input into the decryption function.

41. The information processing method according to claim 39 or 40, wherein the one identifier or plurality of identifies correspond to a combination of the particular protocols and the combination of the particular protocols is a combination made up of a plurality of protocols that are in accordance with the functional encryption method.

42. The information processing method according to claim 41 further comprising the step of, by a switching unit, selecting whether the second information is to be a ciphertext or key information, depending on the particular protocol.

43. The information processing method according to claim 39 or 40 further comprising the step of, by a switching unit, selecting whether the second information is to be a ciphertext or key information, depending on the particular protocol.