JP2009087182A - Security method for information-recording medium, information-processing device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make a plurality of information-processing devices safely share an information-recording medium without complicated processing. <P>SOLUTION: Each secret key SK(i) is stored in the storage part 13 of each PC 10-i (iE<SP>*</SP>[1, ..., n]), wherein E<SP>*</SP>means a symbol of sets and i is an element of set ä1, ... n}. Each encoded sentence IBE (MPK, ID(i), KA), which is obtained by encoding a common key KA by an ID-BASE encoding method by using a master public key MPK and the identification information ID(i) of each PC10-i, is stored in a USB memory 20. Each PC10-i decodes the encoded sentence IBE (MPK, ID(i), KA) stored in the USB memory 20, by using its own secret key SK(i), to extract the common key KA. Then, each PC10-i generates an encoded sentence SE (KA, M(i)) of an ordinary sentence M(i) by using the extracted common key KA and stores it in the USB memory 20. Each PC10-i decodes the encoded sentence SE (KA, M(i)), which is read out from the USB memory 20, by using the extracted common key KA. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a technology for concealing information, and more particularly to a technology for concealing and storing information in an information recording medium shared by a plurality of information processing apparatuses.

  It is important to prevent leakage of data stored in a portable information recording medium such as a USB (universal serial bus) memory shared by a plurality of information processing apparatuses. As a countermeasure, conventionally, a method of encrypting data by a common key encryption method and storing the data in an information recording medium has been used (for example, see Non-Patent Document 1). In this case, a general method is to encrypt the data M stored in the information recording medium with the common key K of the common key cryptosystem and store only the ciphertext C in the information recording medium. The common key K is generally stored in the information processing apparatus or stored in the form of a password by the user.

Patent Document 1 discloses a method of storing a first decryption key for decrypting an encrypted file in a removable memory.
However, in the method of storing the common key K in the information processing apparatus, it is necessary to share the common key K among a plurality of information processing apparatuses that share the information recording medium. However, the process of sharing the common key K, which is secret information, with a plurality of information processing devices in advance is complicated. Further, in the method of creating the common key K using a password, the user must store the password and enter the password for each information processing apparatus. Such processing is also complicated. Furthermore, in general, the length of a password considering the convenience of the user is not sufficiently long in terms of cryptography. Therefore, the ciphertext C generated using such a common key K is easily deciphered and has a security problem.

Further, in the case of a method of storing a first decryption key for decrypting an encrypted file in a portable information recording medium such as a removable memory as in Patent Document 1, the information Anyone who acquires a recording medium or reads data from the information recording medium can decrypt the encrypted file.
These problems apply not only when a plurality of information processing apparatuses share a portable information recording medium, but also when a plurality of information processing apparatuses share a non-portable information recording medium.
On the other hand, the present applicant devised a method for solving such a problem and filed a patent application thereof (Japanese Patent Application No. 2007-113708 (unpublished)).

  In the method of Japanese Patent Application No. 2007-113708 (unpublished), first, in the registration process, each information processing device PC (i) (i∈ {1, ..., n}, where n is 2 or more) sharing the information recording medium Each of the information processing devices PC is stored in the storage unit of the information processing device PC (i) corresponding to the secret key SK (i). Each ciphertext PE (PK (i), KA) obtained by encrypting the common key KA of the common key cryptosystem using the public key PK (i) of the public key cryptosystem corresponding to (i) is used as the information recording medium. Store.

  The information processing device PC (p) (p∈ {1, ..., n}) that performs plaintext encryption reads the ciphertext PE (PK (p), KA) from the information recording medium and stores it in the storage unit. The ciphertext PE (PK (p), KA) is decrypted using the encrypted secret key SK (p), the common key KA is extracted, and the plaintext M (p) is encrypted using the common key KA SE (KA, M (p)) is generated, and the ciphertext SE (KA, M (p)) is stored in the information recording medium.

  Then, the information processing apparatus PC (q) (q∈ {1,..., N}) that decrypts the ciphertext SE (KA, M (p)) receives the ciphertext PE (PK (q)) from the information recording medium. , KA) and ciphertext SE (KA, M (p)), and decrypts the ciphertext PE (PK (q), KA) using the secret key SK (q) stored in the storage unit. KA is extracted, and the ciphertext SE (KA, M (p)) is decrypted using the common key KA to extract plaintext M (p).

In this process, a complicated process for sharing the common key KA in advance between the information processing apparatus PC (p) and the information processing apparatus PC (q) is unnecessary. In the case of this processing, even if the data length of the common key KA is cryptographically safe, the convenience for the user is not lowered. Further, in this process, instead of storing the common key KA for decrypting the plaintext ciphertext in the information recording medium, the ciphertext obtained by encrypting the common key KA with the public key is stored in the information recording medium. . Therefore, even when the younger brother acquires the information recording medium or reads data from the information recording medium, the third party cannot decrypt the plaintext ciphertext.
“BUFFALO” homepage, [May 18, 2007 search], Internet <URL http://buffalo.jp/products/slw/keitai.html> JP 2006-67313 A

However, the method of Japanese Patent Application No. 2007-113708 (unpublished) has room for further improvement in convenience.
That is, in the method of Japanese Patent Application No. 2007-113708 (unpublished), in the registration process, the public key encryption method using the public key PK (i) corresponding to the information processing apparatus PC (i) to be registered is used. Each ciphertext PE (PK (i), KA) obtained by encrypting the common key KA of the method is stored in the information recording medium. However, the public key PK (i) is just an enumeration of numbers, and just looking at the public key PK (i) determines whether or not it really belongs to the information processing device PC (i) to be registered. Can not. Therefore, in order to properly perform the registration process, it is necessary to strictly associate the information processing apparatus PC (i) to be registered with its public key PK (i).

In the method of Japanese Patent Application No. 2007-113708 (unpublished), the registration process is performed by associating the information processing device PC (i) to be registered with its public key PK (i) by the following method. ing.
First, an unregistered information processing device PC (s) generates a public key cryptography secret key SK (s) and a public key PK (s), and uses the secret key SK (s) as the information processing device PC (s). And the public key PK (s) is stored in the information recording medium (registration application).

  Next, the ciphertext PE (PK (t), KA) (t∈ {1, ..., n}) is stored in the information recording medium, and the private key SK (t) is stored in its own storage unit The registered information processing device PC (t) reads the ciphertext PE (PK (t), KA) from the information recording medium, and uses the secret key SK (t) stored in the storage unit to encrypt the ciphertext PE (PK The common key KA is extracted by decrypting (t), KA). Further, the information processing device PC (t) reads the public key PK (s) from the information recording medium, and encrypts the common key KA using the public key PK (s), and the ciphertext PE (PK (s), KA ) And the ciphertext PE (PK (s), KA) is stored in the information recording medium (registration approval).

  As described above, in the method of Japanese Patent Application No. 2007-113708 (unpublished), it is necessary to strictly associate the information processing apparatus PC (i) to be registered with its public key PK (i). The information processing device PC (s) to be stored stores the public key PK (s) in the information recording medium (registration application), and the other information processing device PC (t) that has been registered reads the information from the information recording medium. A complicated process of registering the information processing apparatus PC (s) using the key PK (s) (registration approval) has been performed.

  The present invention has been made in view of these points, and can register a new information processing apparatus without performing complicated processing such as registration application and registration approval, and a plurality of information processing apparatuses can safely store information recording media. The purpose is to provide technology that can be shared.

  In the present invention, in order to solve the above problem, a common master secret key is assigned to each information processing apparatus PC (i) (i∈ {1,..., N}, n is an integer of 2 or more). Identification information ID (i) for identifying each information processing device PC (i) with MPK as a common master public key for each information processing device PC (i) generated using the master secret key MSK SK (i) is a secret key of the ID-BASE encryption method generated using the master secret key MSK. The process of storing the secret key SK (i) in the storage unit of the information processing device PC (i) corresponding to the secret key SK (i), the master public key MPK, and the identification information ID (i) A registration process comprising: storing each ciphertext IBE (MPK, ID (i), KA), which is obtained by encrypting the common key KA of the common key encryption system by the ID-BASE encryption system, in an information recording medium; Any of the information processing devices PC (p) (p) in which the ciphertext IBE (MPK, ID (p), KA) is stored in the information recording medium and the secret key SK (p) is stored in its own storage unit ∈ {1, ..., n}), the process of reading the ciphertext IBE (MPK, ID (p), KA) from the information recording medium, and the common key of the information processing device PC (p) A process in which the restoration unit decrypts the ciphertext IBE (MPK, ID (p), KA) using the secret key SK (p) stored in the storage unit and extracts the common key KA, and the information processing apparatus PC The encryption unit (p) encrypts the ciphertext SE (KA, M (p)) obtained by encrypting the plaintext M (p) using the common key KA. A writing process comprising: a generating process; and an external writing unit of the information processing apparatus PC (p) storing the ciphertext SE (KA, M (p)) in an information recording medium; and the information Any of the information processing devices PC (q) (q∈ {1) in which the ciphertext IBE (MPK, ID (q), KA) is stored in the recording medium and the secret key SK (q) is stored in its own storage unit , ..., n}) the external reading unit reads the ciphertext IBE (MPK, ID (q), KA) from the information recording medium, and the external reading unit of the information processing apparatus PC (q) The process of reading the ciphertext SE (KA, M (p)) from the information recording medium and the common key recovery unit of the information processing apparatus PC (q) using the secret key SK (q) stored in the storage unit The process of decrypting the ciphertext IBE (MPK, ID (q), KA) and extracting the common key KA, and the decryption unit of the information processing device PC (q) uses the common key KA to encrypt the ciphertext SE ( KA, M (p)) to extract plaintext M (p), and a reading process comprising To.

  Here, in the registration process of the present invention, the identification information ID (i) for identifying the information processing apparatus PC (i) to be registered and the master public key MPK common to all information processing apparatuses are used, and the ID Generates ciphertext IBE (MPK, ID (i), KA) using the -BASE encryption method and stores it in the information recording medium. In this process, the registration application process in which the information processing apparatus to be registered stores its own public key in the information recording medium as in the method of Japanese Patent Application No. 2007-113708 (unpublished) becomes unnecessary. For example, the information processing device PC (r) (rε {1,..., N}) that performs registration first generates the common key KA, and the master public key MPK and one of the information processing devices PC (u ) (U∈ {1, ..., n}) and identification information ID (u), each ciphertext IBE ( The registration process can be performed simply by generating MPK, ID (u), KA) and storing the ciphertext IBE (MPK, ID (u), KA) in the information recording medium. Further, any one of the information processing devices PC (t) (t) in which the ciphertext IBE (MPK, ID (t), KA) is stored in the information recording medium and the secret key SK (t) is stored in its own storage unit ∈ {1, ..., n}) reads the ciphertext IBE (MPK, ID (t), KA) from the information recording medium and uses the secret key SK (t) to encrypt the ciphertext IBE (MPK, ID ( t), KA) is decrypted to extract the common key KA, and the identification information ID for identifying the master public key MPK and one of the information processing devices PC (g) (g∈ {1, ..., n}) (g) is used to generate each ciphertext IBE (MPK, ID (g), KA) by encrypting the common key KA using the ID-BASE encryption method, and the ciphertext IBE (MPK, ID (g), KA) ) Can be stored in the information recording medium.

Further, in the processing of the present invention, complicated processing for sharing the common key KA in advance between the information processing device PC (p) and the information processing device PC (q) is unnecessary. In the case of this processing, even if the data length of the common key KA is cryptographically safe, the convenience for the user is not lowered.
Preferably, in the present invention, the ciphertext IBE (MPK, ID (r), KA) (r∈ {1,..., N}) is stored in the information recording medium, and the secret key SK is stored in its own storage unit. The information processing device PC (r) storing (r) reads the ciphertext IBE (MPK, ID (r), KA) from the information recording medium, and the secret key SK (r) stored in the storage unit Is used to decrypt the ciphertext IBE (MPK, ID (r), KA) and extract the common key KA, to generate a _new common key KA _new , and from the information recording medium to the information processing device PC ( p) (ciphertext SE (KA, M (p)) using the common key KA and the process of reading the ciphertext SE (KA, M (p)) corresponding to (p∈ {1, ..., n}) ) To extract plaintext M (p) and generate a ciphertext SE (KA _new , M (p)) by encrypting each plaintext M (p) using a _new common key KA _new and process, perform the re-encryption process comprising the steps of storing the ciphertext _{SE (KA new, M (p} )) to the information recording medium, and further, the master public key MPK and identification Using the broadcast ID (p), ID-BASE cryptosystem ciphertext new common key KA _{new new} encrypted by IBE (MPK, ID (p) , KA new) generates a ciphertext IBE (MPK, ID (p), KA _new ) are stored in the information recording medium, and the re-registration process is performed.

  Thereby, the common key can be updated. This update of the common key can be used for registration deletion processing, for example. In that case, the re-registration process is executed for the information processing apparatus PC (s) other than the information processing apparatus PC (w) (w∈ {1,..., N}) to be registered and deleted. The stored ciphertext SE (KA, M (p)) (pε {1,..., N}) is deleted from the information recording medium. In this case, even if the old common key KA remains in the information processing apparatus PC (w) whose registration has been deleted, the information processing apparatus PC (w) can read the plaintext M from the information stored in the information recording medium. (p) cannot be decrypted. As a result, safety is improved.

  Preferably, in the present invention, the encryption unit of the information processing apparatus PC (p) generates a ciphertext SE (KA, M (p)) obtained by encrypting the plaintext M (p) using the common key KA. In the process, the block division unit of the encryption unit divides the plaintext M (p) into X (X ≧ 2) blocks MB (p, x) (x∈ {1,..., X}). The process, the random number generation unit of the encryption unit generates a random number E (p) for each plaintext M (p), and the external writing unit of the information processing apparatus PC (p) And a function value obtained by substituting at least the block number x of block MB (p, x) and the random number E (p) into a predetermined function π by the function calculation unit of the encryption unit. The process of calculating IV = π (x, E (p)), and the block encryption unit of the encryption unit uses the common key KA and sets each block MB (p, x) using the function value IV as an initial vector. Encrypted and calculated ciphertext SE (KA, M (p)) from ciphertext of all blocks MB (p, x) A step of generating to a process comprising a.

  In the preferred method, a random number E (p) is generated for each plaintext M (p), and a function value IV = π (x, E (p) in which a block number x and a random number E (p) are substituted into a predetermined function π. The ciphertext SE (KA, M (p)) is generated by block cipher using)). In this case, even if the value between blocks obtained by dividing a plaintext M (p) is the same, the ciphertext between the blocks is not the same. Furthermore, the block MB (p, x) of the block number x obtained by dividing the plaintext M (p) and the block MB of the same block number x obtained by dividing another plaintext M (p ′) ( Even if p ′, x) are the same, their ciphertexts are not the same. As a result, it is possible to prevent the plaintext identity from being inferred from the identity of the ciphertext and the safety from being lowered. Such a block encryption method is particularly suitable for the use of the present invention in which a plurality of plaintexts are repeatedly encrypted with the same common key KA and the generated plurality of ciphertexts are stored in the same information recording medium. .

  Further, preferably, when performing encryption using the random number E (p), the registration process uses the master public key MPK and the identification information ID (i), and the ciphertext authentication key by the ID-BASE encryption method. Each ciphertext IBE (MPK, ID (i), KB) obtained by encrypting KB is stored in an information recording medium. Further, in the writing process, the information processing device PC (p) reads the ciphertext IBE (MPK, ID (p), KB) from the information recording medium, and uses the secret key SK (p) stored in the storage unit. The ciphertext IBE (MPK, ID (p), KB) is decrypted to extract the ciphertext authentication key KB, and at least the ciphertext authentication key KB, the random number E (p), and the ciphertext generated by the encryption unit Generate an authenticator AU (KB, E (p), SE (KA, M (p))) for the ciphertext SE (KA, M (p)) using SE (KA, M (p)) The authenticator AU (KB, E (p), SE (KA, M (p))) is stored in the information recording medium.

  In this way, the ciphertext SE (KA, M (p)) using the ciphertext authentication key KB, the random number E (p), and the ciphertext SE (KA, M (p)) generated by the encryption unit. By generating the authenticator AU (KB, E (p), SE (KA, M (p))), the reliability of the ciphertext SE (KA, M (p)) can be improved. Furthermore, the random number E (p) used to generate the ciphertext SE (KA, M (p)) is diverted to the generation of the authenticator AU (KB, E (p), SE (KA, M (p))). Therefore, it is not necessary to generate a new random number for generating an authenticator or store a random number other than the random number E (p) in the storage unit in order to verify the authenticator.

  As described above, in the present invention, a new information processing apparatus can be registered without performing complicated processes such as registration application and registration approval, and a plurality of information processing apparatuses can safely share an information recording medium.

The best mode for carrying out the present invention will be described below with reference to the drawings.
[First Embodiment]
First, a first embodiment of the present invention will be described.
<Configuration>
FIG. 1 is a conceptual diagram illustrating the overall configuration of an information recording medium sharing system 1 according to this embodiment.
As illustrated in FIG. 1, the information recording medium sharing system 1 includes n (n is an integer of 2 or more) personal computers (hereinafter referred to as “PC”) 10-1 to n (“information processing apparatus PC ( i) (corresponding to i∈ {1,..., n} ”), the USB memory 20 (corresponding to“ information recording medium ”) shared between these PCs 10-1 to n, and ID-BASE encryption An ID-BASE key generation device 30 for generating a key for (IBE: Identity Based Encryption).

  The PCs 10-1 to 10-n store the ciphertext in the USB memory 20 and share information with each other by decrypting the plaintext from the ciphertext stored in the USB memory 20. In addition, the PCs 10-1 to n of this embodiment and the ID-BASE key generation device 30 are connected by a dedicated line or a communication path that is secured by encryption of communication information.

  In this embodiment, a personal computer is illustrated as an example of an information processing apparatus, and a USB memory is illustrated as an example of an information recording medium. However, the present invention is not limited to this. ID-BASE encryption is an encryption method that uses identification information (for example, an e-mail address, URL, user name, etc.), which is unique information of a user, as a public key. Regarding ID-BASE encryption, for example, “D. Boneh, M. Franklin,“ Identity based encryption from the Weil pairing ”, Crypto 2001, Lecture Notes in Computer Science, Vol. 2139, Springer-Verlag, pp.213-229 , 2001 (Reference 1) ".

FIG. 2A is a block diagram illustrating the functional configuration of the PC 10-i (iε {1,..., N}) according to the present embodiment, and FIG. 2B illustrates the USB memory 20 according to the present embodiment. It is the block diagram which illustrated the functional composition of.
As shown in FIG. 2A, the PC 10-i includes an external writing unit 11a, an external reading unit 11b, an internal writing unit 12a, an internal reading unit 12b, a storage unit 13, and a common key generation unit 14a. , Key concealment unit 14c, common key restoration unit 14d, encryption unit 14e, decryption unit 14f, deletion unit 14g, application execution unit 14h, control unit 14i, temporary memory 14j, and input unit 15, an output unit 16, and a communication unit 17. As shown in FIG. 2B, the USB memory 20 includes an interface unit 21, a storage unit 22, and a control unit 23. The storage unit 22 includes areas 22a to 22c. .

The PC 10-i of this embodiment is a Neumann computer having a communication function, which includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), a LAN card, and the like. By reading, the functional configuration shown in FIG.
Specifically, an OS (Operating System) and application software are installed in the PC 10-i in this example. When the USB memory 20 is mounted and mounted on the USB port of the PC 10-i, the security program is read from the area 22a of the storage unit 22 of the USB memory 20 into the PC 10-i. Then, when the CPU of the PC 10-i executes a security program or application software on the OS, the functional configuration shown in FIG. Instead of the PC 10-i reading the security program from the USB memory 20, each PC 10-i may be configured to read the security program from another recording medium, or the security program may be downloaded and read via the Internet or the like. It may be a configuration. In such a case, it is not necessary to store the security program in the USB memory 20.

FIG. 3 is a block diagram illustrating a functional configuration of the ID-BASE key generation apparatus 30 according to the present embodiment.
As shown in FIG. 3, the ID-BASE key generation device 30 includes a random number generation unit 31a, a parameter setting unit 31b, a scalar multiplication unit 31c, a control unit 31d, a temporary memory 31e, and an internal writing unit 32a. , An internal reading unit 32b, a storage unit 33, and a communication unit 34. The ID-BASE key generation device 30 of this embodiment is a Neumann computer having a communication function, which includes a CPU, a RAM, a ROM, a LAN card, and the like. The functional configuration shown in FIG. 3 is obtained by reading a predetermined program. Is built.

<Processing>
Next, the processing of this embodiment will be described.
The processing according to this embodiment includes (1) a process of distributing a master public key MPS and a secret key SK (i) to each PC 10-i (key distribution process), and (2) n PCs 10-i sharing the USB memory 20. Are registered in the USB memory 20 (registration process), (3) the PC 10-i writes the ciphertext to the USB memory 20 (write process), and (4) the PC 10-i reads the ciphertext from the USB memory 20. (5) Deletion of registration from the USB memory 20 (deletion process). Hereinafter, each process will be described.

[Key distribution process]
First, the key distribution process will be described.
In the key distribution process, the ID-BASE key generation device 30 follows the well-known ID-BASE encryption algorithm (see, for example, Reference 1), the master public key MPK common to all PCs 10-i, and each PC 10- An i-specific secret key SK (i) is generated and delivered to each PC 10-i. An example of this process will be described below.

<Example of key generation processing>
First, the random number generation unit 31a of the ID-BASE key generation device 30 (FIG. 3) randomly determines a point (sx, sy) on the elliptic curve E. The internal writing unit 32a securely stores the information on the point (sx, sy) as the master secret key MSK in the storage unit 33 of the ID-BASE key generation device 30. Further, the parameter setting unit 31b of the ID-BASE key generation device 30 determines the integer parameter P. Then, the scalar multiplication unit 31c calculates a scalar multiplication value P · MSK (a point on the elliptic curve E) obtained by multiplying the master secret key MSK by P on the elliptic curve E. For scalar multiplication on an elliptic curve, for example, a known elliptic scalar multiplication method such as a binary expansion method or a window NAF method is used. Then, the internal writing unit 32a of the ID-BASE key generation device 30 stores MPK = (P, P · MSK) in the storage unit 33 as a master public key.

  In addition, the internal reading unit 32b of the ID-BASE key generation device 30 reads the master public key MPK and the identification information ID (i), which is information stored in advance for each PC 10-i, from the storage unit 33. To the scalar multiplication unit 31c. The scalar multiplication unit 31c uses each identification information ID (i) and the master secret key MSK, and the scalar multiplication value ID (i) · MSK () obtained by multiplying the master secret key MSK on the elliptic curve E by ID (i). Point on the elliptic curve E). The internal writing unit 32a of the ID-BASE key generation device 30 stores the calculation result in the storage unit 33 as a secret key SK (i) unique to each PC 10-i.

  Then, the communication unit 34 of the ID-BASE key generation device 30 sets each key pair (MPK, SK (i)) of the master public key and the secret key generated as in the above example to each SK (i). It transmits to corresponding PC10-i. Each PC 10-i receives the key pair (MPK, SK (i)) and stores it in its storage unit 13 (end of explanation of << example of key generation processing >>).

[Registration process]
Next, the registration process will be described.
FIG. 4 is a diagram showing each functional block and data flow related to the registration process of this embodiment, and FIG. 10 is a sequence diagram for explaining the registration process of this embodiment. In the following, an example in which the PC 10-1 performs registration processing between the PC 10-1 and the PC 10-2 will be described. Further, it is assumed that an OS, a security program, and application software are installed in the PC 10-i as a premise of each process. Although not described below, each process is executed under the control of the control units 14i and 23, and each data obtained by each calculation in the PC 10-i is written to the temporary memory 14j one by one. In response, it is read for other operations. Also, sending data from one computing unit to another computing unit means storing the computation result calculated by a certain computing unit in the temporary memory 14j, and the other computing unit reads the computation result from the temporary memory 14j. Means that.

  First, when the USB memory 20 is mounted and mounted on the PC 10-1, the output unit 16 of the PC 10-1 displays an input instruction for the identification information ID (i) of the PC 10-i to be registered. In accordance with this input instruction, the user inputs the identification information ID (i) of the PC 10-i to be registered to the input unit 15 (FIG. 4 (a)). In the example of this embodiment, the identification information ID (1) and ID (2) of the PCs 10-1 and PC-2 are input to the input unit 15 and stored in the storage unit 13 (step S1).

  Next, the common key generation unit 14a of the PC 10-1 generates (for example, randomly generates) the common key KA and outputs it (step S2). The internal reading unit 12b reads the master public key MPK and the identification information ID (1) and ID (2) from the storage unit 13. The common key KA, master public key MPK, and identification information ID (1), ID (2) are input to the key concealment unit 14c. The key concealment unit 14c uses the master public key MPK and the identification information ID (1) and ID (2), and each ciphertext IBE ( MPK, ID (1), KA) and IBE (MPK, ID (2), KA) are generated (step S3). Below, the process of step S3 when using the master public key MPK generated in the above-mentioned << Example of key generation process >> is illustrated. Note that the identification information ID (i) in this example is an integer, for example, information in which a character string of a mail address is expressed numerically.

<< Example of processing in step S3 >>
First, the random number generation unit 14ca (FIG. 4A) of the key concealment unit 14c randomly determines the point r = (rx, ry) on the above-described elliptic curve E, and the scalar multiplication unit of the key concealment unit 14c. 14cb calculates a scalar multiplication value ID (i) · r (a point on the elliptic curve E) by multiplying the point r on the elliptic curve E by ID (i) on the elliptic curve E. Further, the scalar multiplication unit 14cb of the key concealment unit 14c is a scalar multiplication value P · r (P · r (P is a part of the master public key MPK) multiplied by a point r on the elliptic curve E on the elliptic curve E). Point on the elliptic curve E).

  Next, the pairing calculation unit 14cc of the key concealment unit 14c substitutes ID (i) · r and P · MSK (part of the master public key MPK) into a known pairing function Pair. (i) = Pair (ID (i) · r, P · MSK) is calculated. The pairing function Pair is, for example, Weil Pairing or Tate Pairing, and satisfies the relationship of Pair (ID (i) · r, P · MSK) = Pair (P · r, ID (i) · MSK) ( See Reference 1 and “Alfred. J. Menezes, ELLIPTIC CURVE PUBLIC KEY CRYPTOSYSTEMS, KLUWER ACADEMIC PUBLISHERS, ISBN 0-7923-9368-6, pp. 61-81 (reference 2)”). Next, the common key encryption unit 14cd of the key concealment unit 14c encrypts the common key KA by using the function value CK (i) as a key and the common key encryption method (Camellia, AES, etc.), and the ciphertext CE (CK (i), KA) and scalar multiplication value P ・ r are output as ciphertext IBE (MPK, ID (i), KA) = (CE (CK (i), KA), P ・ r) (End of description of << Example of processing in step S3 >>).

  The identification information ID (1), ID (2) read from the storage unit 13 by the internal reading unit 12b, and the ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (2), KA) is sent to the external writing unit 11a. The external writing unit 11a sends these to the interface unit 21 (FIG. 4B) of the USB memory 20, and the interface unit 21 transmits the identification information ID (1) and the ciphertext IBE (MPK, ID (1), KA). And the identification information ID (2) and the ciphertext IBE (MPK, ID (2), KA) are associated and stored in the area 22b of the storage unit 22 (step S4).

  Thus, registration of the PCs 10-1 and 2 is completed. For the sake of simplification of explanation, the case where only registration of the PCs 10-1 and 2 is performed is illustrated here. However, it is also possible for the PC 10-1 to register other PCs 10-i by a similar method. In the following, all PCs 10-i (i∈ {1,..., N}) are registered, and each identification information ID (i) and ciphertext IBE (MPK, ID (i), KA) are stored in the USB memory. It is assumed that the data is stored in the area 22b of the 20 storage units 22.

[Writing process / Reading process]
Next, the writing process and the reading process of this embodiment will be described. It is assumed that the OS, security program, and application software are installed in the PC 10-i.
FIG. 5 is a diagram showing each functional block and data flow related to the writing process of this embodiment, and FIG. 6 shows each functional block and data flow related to the reading process of this embodiment. FIG. FIG. 11 is a sequence diagram for explaining the writing process and the reading process of this embodiment. Here, an example is shown in which the PC 10-1 writes the ciphertext to the USB memory 20 (writing process), and the PC 10-2 reads the ciphertext from the USB memory 20 and decrypts it (reading process).

  First, it is assumed that the USB memory 20 is mounted and mounted on the PC 10-1. In this state, the application execution unit 14h (FIG. 5A) of the PC 10-1 that executes application software such as Word or Excel (registered trademark) sends the ciphertext of plaintext M (1) to the control unit 14i. A write request to the USB memory 20 is made. With this as a trigger, the internal reading unit 12b of the PC 10-1 reads the identification information ID (1) from the storage unit 13 and sends it to the external reading unit 11b of the PC 10-1. The external reading unit 11b reads the ciphertext IBE (MPK, ID (1), KA) associated with the identification information ID (1) from the area 22b (FIG. 5B) of the storage unit 22 of the USB memory 20. Is read (step S21).

  The ciphertext IBE (MPK, ID (1), KA) is sent to the common key restoration unit 14d (FIG. 5A) of the PC 10-1. Also, using this as a trigger, the internal reading unit 12b of the PC 10-1 reads the secret key SK (1) from the storage unit 13 and sends the secret key SK (1) to the common key restoration unit 14d. The common key restoration unit 14d decrypts the ciphertext IBE (MPK, ID (1), KA) using the secret key SK (1) and decrypts the common key KA [KA = PD (SK (1), IBE (MPK, ID (1), KA))] is extracted, and the common key KA is sent to the encryption unit 14e (step S22). Hereinafter, a decryption process of the ciphertext IBE (MPK, ID (1), KA) encrypted in << Example of process in step S3 >> will be exemplified.

<< Example of processing in step S22 >>
In this example, first, the pairing calculation unit 14da (FIG. 5A) of the common key restoration unit 14d adds the ciphertext IBE (MPK, ID (i), KA) = (CE) to the above-described pairing function Pair. Pair (P ・ r, ID (1) substituting P ・ r that is a part of (CK (i), KA), P ・ r) and secret key SK (1) = ID (1) ・ MSK -Calculate MSK). Here, from the property of the pairing function Pair (Pair (ID (i) · r, P · MSK) = Pair (P · r, ID (i) · MSK)), Pair (P · r, ID ( 1) · MSK) = Pair (ID (1) · r, P · MSK) = CK (i). Next, the common key decryption unit 14db of the common key restoration unit 14d uses this Pair (P · r, ID (1) · MSK) = CK (i) and uses the ciphertext IBE (MPK, ID (i), KA). ) = (CE (CK (i), KA), P · r) is part of CE (CK (i), KA) and KA is extracted (Explanation of << Example of Step S22 >>) the end).

Further, the application execution unit 14h of the PC 10-1 sends the plaintext M (1) to the encryption unit 14e, and the encryption unit 14e uses the common key KA and the plaintext M (1) by the common key encryption method. A ciphertext SE (KA, M (1)) is generated by encrypting (step S23). SE (α, β) means a ciphertext obtained by encrypting β using the common key α by a predetermined common key cryptosystem. Examples of the common key encryption method include Camellia and AES.
The generated ciphertext SE (KA, M (1)) is sent to the interface unit 21 of the USB memory 20 by the external writing unit 11a, and stored in the area 22c (FIG. 5B) of the storage unit 22 therefrom. (Step S24 / End of writing process).

  Next, the USB memory 20 is mounted and mounted on the PC 10-2. In this state, the application execution unit 14h of the PC 10-2 makes a request for reading the ciphertext SE (KA, M (1)) from the USB memory 20 to the control unit 14i. With this as a trigger, the control unit 14 i gives an instruction to the external reading unit 11 b (FIG. 6A) of the PC 10-2, and the external reading unit 11 b of the PC 10-2 has an area 22 c ( The ciphertext SE (KA, M (1)) is read from FIG. 6B (step S25), and the ciphertext IBE (MPK, ID (2), KA) is read from the area 22b (step S26). Next, the internal reading unit 12b (FIG. 6A) of the PC 10-2 reads the secret key SK (2) from the storage unit 13. Then, the common key restoration unit 14d of the PC 10-2 decrypts the ciphertext IBE (MPK, ID (2), KA) using the secret key SK (2) and uses the common key KA [KA = PD (SK ( 2), IBE (MPK, ID (2), KA))] is extracted (step S27). After that, the decryption unit 14f of the PC 10-2 decrypts the ciphertext SE (KA, M (1)) using the common key KA to obtain plaintext M (1) [M (1) = SD (KA, SE (KA, M (1))] is extracted (step S28), where SD (α, β) means a result value obtained by decrypting β with the common key α by the common key cryptosystem.

The extracted plaintext M (1) is sent to the application execution unit 14h of the PC 10-2 (end of the reading process).
[Deleting process]
Next, the deletion process of this embodiment will be described. It is assumed that the OS, security program, and application software are installed in the PC 10-i.
7 to 9 are diagrams showing each functional block and data flow related to the deletion process of this embodiment. FIG. 12 is a sequence diagram for explaining the deletion process of this embodiment.

  In the deletion process of the present embodiment, not only the data of the PC 10-w to be registered and deleted is deleted from the USB memory 20, but also the common key KA used for plaintext encryption is reset and stored in the USB memory 20. Regenerate the stored ciphertext. As a result, it is possible to prevent the PC 10-w whose registration has been deleted from decrypting the ciphertext stored in the USB memory 20 using the common key KA acquired in the past. In the following, an example in which the PC 10-1 deletes the registration of the PC 10-2 from the USB memory 20 is shown.

  First, it is assumed that the USB memory 20 is mounted and mounted on the PC 10-1. In this state, the user designates the registration deletion target as follows, for example. First, the external reading unit 11b reads all the identification information ID (i) from the area 22b of the storage unit 22 of the USB memory 20. Each identification information ID (i) is output from the output unit 16 (for example, displayed on the screen). The user inputs the identification information ID (w) to be deleted to the input unit 15 while referring to the output identification information ID (i). In this example, it is assumed that the identification information ID (2) is input to the input unit 15. Based on the input result, the control unit 14i executes the deletion process as follows.

  First, the internal reading unit 12b of the PC 10-1 reads the identification information ID (1) from the storage unit 13, and sends the identification information ID (1) to the external reading unit 11b (FIG. 7 (a)). The external reading unit 11b (FIG. 7A) reads the ciphertext IBE (MPK, ID) associated with the identification information ID (1) from the area 22b (FIG. 7B) of the storage unit 22 of the USB memory 20. (1), KA) is read (step S31).

Next, the internal reading unit 12b of the PC 10-1 reads the secret key SK (1) from the storage unit 13 and sends the secret key SK (1) to the common key restoration unit 14d. Using the secret key SK (1), the common key restoration unit 14d decrypts the ciphertext IBE (MPK, ID (1), KA) read from the USB memory 20 and uses the common key KA [KA = PD (SK (1), IBE (MPK, ID (1), KA))] is extracted (step S32). Further, the common key generation unit 14a of the PC 10-1 generates a new common key KA _new (step S33).

  Further, the external reading unit 11b of the PC 10-1 reads the ciphertext SE (KA, M (i)) (i∈ {1,..., N}) corresponding to the PC 10-i from the USB memory 20 (Step S1). S34). The decryption unit 14f of the PC 10-1 uses the common key KA obtained by the common key restoration unit 14d to decrypt the ciphertext SE (KA, M (i)) to obtain plaintext M (i) [M (i ) = SD (KA, SE (KA, M (i))] is extracted (step S35).

Next, each extracted plaintext M (i) and a new common key KA _new are input to the encryption unit 14e of the PC 10-1, and the encryption unit 14e uses the new common key KA _new. A ciphertext SE (KA _new , M (i)) obtained by encrypting each plaintext M (i) is generated (step S36). Each ciphertext SE (KA _new , M (i)) is sent to the external writing unit 11a of the PC 10-1. The external writing unit 11a sends the ciphertext SE (KA _new , M (i)) to the interface unit 21 of the USB memory 20, and the interface unit 21 stores these in the area 22c of the storage unit 22 (FIG. 7B). (Step S37).

Next, the external reading unit 11b (FIG. 8A) of the PC 10-1 moves from the area 22b of the storage unit 22 of the USB memory 20 to the PC 10-s (s ≠ 2) other than the PC 10-2 to be deleted. The identification information ID (s) is read (step S38).
The identification information ID (s) read in step S38 and the common key KA _new newly generated in step S33 are input to the key concealment unit 14c. The internal reading unit 12b reads the master public key MPK from the storage unit 13, and the master public key MPK is input to the key concealment unit 14c. Then, the key concealment unit 14c uses the master public key MPK and the identification information ID (s), and the ciphertext IBE (MPK, ID (s) obtained by encrypting the _new common key KA _new by the ID-BASE encryption method. , KA _new ) is generated (step S39). Each ciphertext IBE (MPK, ID (s), KA _new ) is sent to the interface unit 21 of the USB memory 20 by the external writing unit 11a of the PC 10-1. The interface unit 21 stores each ciphertext IBE (MPK, ID (s), KA _new ) in the region 22b of the storage unit 22 of the USB memory 20 in association with the identification information ID (s) (FIG. 8). (B)) (step S40).

  Next, the deletion unit 14g (FIG. 9A) of the PC 10-1 issues a deletion command, and the external writing unit 11a receiving the command issues the area 22c of the storage unit 22 of the USB memory 20 (FIG. 9B). The ciphertext SE (KA, M (i)) is deleted from the ID, and the IBE (MPK, ID (i), KA) and the identification information ID (2) are deleted from the area 22b (FIG. 9B) (step S41). ).

[Second Embodiment]
Next, a second embodiment of the present invention will be described.
This embodiment is a modification of the first embodiment, in which a PC other than the PC 10-1 that generated the common key KA also executes the registration process. Below, only the registration process of this form is demonstrated.

[Registration process]
As a premise, the PCs 10-1 and 2 are registered as in the first embodiment, and ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (2), KA) are stored in the USB memory 20. It is assumed that the secret key SK (i) is stored in the storage unit of each PC 10-i. In this embodiment, an example will be described in which the PC 10-2 other than the PC 10-1 that has generated the common key KA performs the registration process of the PC 10-3.
FIG. 13 is a sequence diagram for explaining the registration process of this embodiment.
First, when the USB memory 20 is mounted and mounted on the PC 10-2, the output unit 16 (FIG. 2) of the PC 10-2 displays an input instruction for the identification information ID (i) of the PC 10-i to be registered. In accordance with this input instruction, the user inputs the identification information ID (i) of the PC 10-i to be registered into the input unit 15. In the example of the present embodiment, the identification information ID (3) of the PC 10-3 is input to the input unit 15 and stored in the storage unit 13 (step S51).

  Next, the external reading unit 11b of the PC 10-2 reads the ciphertext IBE (MPK, ID (2), KA) corresponding to the identification information ID (2) from the area 22b of the storage unit 22 of the USB memory 20 (step) S52). Next, the internal reading unit 12b of the PC 10-2 reads the secret key SK (2) from the storage unit 13. Then, the common key restoration unit 14d of the PC 10-2 decrypts the ciphertext IBE (MPK, ID (2), KA) using the secret key SK (2), and the common key KA [KA = PD (SK ( 2), IBE (MPK, ID (2), KA))] is extracted (step S53).

  Next, the internal reading unit 12b reads the master public key MPK and the identification information ID (3) from the storage unit 13. The common key KA, the master public key MPK, and the identification information ID (3) are input to the key concealment unit 14c. The key concealment unit 14c uses the master public key MPK and the identification information ID (3), and encrypts each ciphertext IBE (MPK, ID (3) obtained by encrypting the common key KA of the common key encryption method by the ID-BASE encryption method. ), KA) is generated (step S54).

  The identification information ID (3) read from the storage unit 13 by the internal reading unit 12b and the ciphertext IBE (MPK, ID (3), KA) generated by the key concealment unit 14c are sent to the external writing unit 11a. . The external writing unit 11a sends these to the interface unit 21 of the USB memory 20, and the interface unit 21 associates the identification information ID (3) with the ciphertext IBE (MPK, ID (3), KA) and stores them. The data is stored in the area 22b of the unit 22 (step S55).

  Thus, the registration process of the PC 10-3 is completed. The registered PC 10-3 can execute registration processing of other PCs 10 by the same processing. As a modification of the second embodiment, after the PC 10-1 that generates the common key KA stores the ciphertext IBE (MPK, ID (1), KA) in the USB memory 20, the ciphertext IBE (MPK , ID (1), KA) may be decrypted to obtain a common key KA, and ciphertext IBE (MPK, ID (i), KA) corresponding to another PC 10-i may be generated.

[Third Embodiment]
Next, a third embodiment of the present invention will be described.
The present embodiment is a modification of the first embodiment, in which an authenticator is attached to the ciphertext stored in the USB memory to prevent forgery of the ciphertext, and a key for creating an authenticator for ciphertext is used. It differs from the first embodiment in that it is encrypted with the identification information ID of each PC and stored in the USB memory. Below, it demonstrates centering around difference with 1st Embodiment, and simplifies description about the matter which is common in 1st Embodiment.

<Configuration>
The overall configuration of the information recording medium sharing system of the present embodiment is the same as that of the first embodiment except that the PCs 10-1 to n are replaced with the PCs 110-1 to 110 -n and the USB memory 20 is replaced with the USB memory 20.

FIG. 14 is a block diagram illustrating a functional configuration of the PC 110-i (iε {1,..., N}) according to this embodiment. FIG. 15 is a block diagram illustrating the functional configuration of the USB memory 20 of this embodiment. In addition, in FIG. 14, 15, the part which is common in 1st Embodiment is attached | subjected the same code | symbol as 1st Embodiment.
As shown in FIG. 14, the PC 110-i includes an external writing unit 11a, an external reading unit 11b, an internal writing unit 12a, an internal reading unit 12b, a storage unit 13, a common key generation unit 114a, and a key concealment. 114c, common key recovery unit 114d, encryption unit 114e, decryption unit 114f, deletion unit 14g, application execution unit 14h, control unit 14i, temporary memory 14j, and ciphertext authenticator generation 114n, ciphertext verification unit 114p, input unit 15, output unit 16, and communication unit 17. The PC 110-i of this embodiment is also a Neumann computer having a communication function, and the functional configuration shown in FIG. 14 is realized by reading a predetermined program.

As shown in FIG. 15, the functional configuration of the USB memory 20 of the present embodiment is the same as that of the first embodiment, but the data stored in the storage unit 22 is different from that of the first embodiment.
<Processing>
Next, the processing of this embodiment will be described.
The processing of this embodiment can also be roughly divided into (1) key distribution process, (2) registration process, (3) write process, (4) read process, and (5) delete process. Hereinafter, each process will be described.
[Key distribution process]
The key distribution process is the same as in the first embodiment. The description is omitted here.

[Registration process]
FIG. 16 is a diagram showing each functional block and data flow related to the registration process of this embodiment, and FIG. 22 is a sequence diagram for explaining the registration process of this embodiment. In the following, an example in which the PC 110-1 performs registration processing between the PC 110-1 and the PC 110-2 will be described. Further, it is assumed that an OS, a security program, and application software are installed in the PC 110-i as a premise of each process. Although not described below, each process is executed under the control of the control units 14i and 23, and each data obtained by each calculation in the PC 110-i is written to the temporary memory 14j one by one. In response, it is read for other operations.

First, as in the first embodiment, the identification information ID (1) and ID (2) of the PCs 10-1 and PC-2 are input to the input unit 15 (FIG. 16A) and stored in the storage unit 13. (Step S61).
Next, the common key generation unit 114a of the PC 110-1 generates (for example, randomly generates) the common keys KA and KB and outputs them (step S62). The internal reading unit 12b reads the master public key MPK and the identification information ID (1) and ID (2) from the storage unit 13. The common key KA, master public key MPK, and identification information ID (1), ID (2) are input to the key concealment unit 114c. The key concealment unit 114c uses the master public key MPK and the identification information ID (1) and ID (2), and each ciphertext IBE () obtained by encrypting the common key KA of the common key encryption method by the ID-BASE encryption method. MPK, ID (1), KA), IBE (MPK, ID (2), KA) and ciphertext IBE (MPK, ID (1), KB), IBE (MPK, ID) (2), KB) is generated (step S63).

  The identification information ID (1), ID (2) read from the storage unit 13 by the internal reading unit 12b and the ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (2), KA), IBE (MPK, ID (1), KB), and IBE (MPK, ID (2), KB) are sent to the external writing unit 11a. The external writing unit 11a sends them to the interface unit 21 (FIG. 16B) of the USB memory 20, and the interface unit 21 sends the identification information ID (1) and the ciphertext IBE (MPK, ID (1), KA). , IBE (MPK, ID (1), KB) and the identification information ID (2) and ciphertext IBE (MPK, ID (2), KA), IBE (MPK, ID (2), KB) They are associated and stored in the area 22b of the storage unit 22 (step S64).

  Thus, registration of the PCs 110-1 and 2 ends. Here, for simplification of explanation, a case where only registration of the PCs 110-1 and 2 is performed is illustrated. However, it is also possible for the PC 110-1 to register other PCs 110-i by the same method as described above. In the following, all PCs 110-i (iε {1, ..., n}) are registered, and each identification information ID (i), ciphertext IBE (MPK, ID (i), KA), IBE (MPK , ID (i), KB) is stored in the area 22 b of the storage unit 22 of the USB memory 20.

[Writing process / Reading process]
Next, the writing process and the reading process of this embodiment will be described. It is assumed that the OS, security program, and application software are installed on the PC 110-i.

  FIG. 17 is a diagram showing each functional block and data flow related to the writing process of this embodiment, and FIG. 18 shows each functional block and data flow related to the reading process of this embodiment. FIG. FIG. 23 is a sequence diagram for explaining a writing process and a reading process of this embodiment. Here, an example is shown in which the PC 110-1 writes the ciphertext to the USB memory 20 (writing process), and the PC 110-2 reads the ciphertext from the USB memory 20 and decrypts it (reading process).

  First, it is assumed that the USB memory 20 is mounted and mounted on the PC 110-1. In this state, the application execution unit 14h (FIG. 17A) of the PC 110-1 requests the control unit 14i to write the plaintext M (1) ciphertext to the USB memory 20. With this as a trigger, the internal reading unit 12b of the PC 110-1 reads the identification information ID (1) from the storage unit 13, and sends this to the external reading unit 11b of the PC 110-1. The external reading unit 11b reads the ciphertext IBE (MPK, ID (1), KA) associated with the identification information ID (1) from the area 22b (FIG. 17B) of the storage unit 22 of the USB memory 20. , IBE (MPK, ID (1), KB) is read (step S71).

  The ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (1), KB) are sent to the common key restoration unit 114d (FIG. 17 (a)) of the PC 110-1. Also, using this as a trigger, the internal reading unit 12b of the PC 110-1 reads the secret key SK (1) from the storage unit 13, and sends the secret key SK (1) to the common key restoration unit 114d. The common key restoration unit 114d decrypts the ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (1), KB) using the secret key SK (1), and uses the common key KA [KA = PD (SK (1), IBE (MPK, ID (1), KA))], KB [KB = PD (SK (1), IBE (MPK, ID (1), KB))] Step S72). The common key KA is sent to the encryption unit 114e of the PC 110-1, and the common key KB is sent to the ciphertext authenticator generation unit 114n. Further, the application execution unit 14h of the PC 110-1 sends the plaintext M (1) to the encryption unit 114e, and the encryption unit 114e uses the common key KA and the plaintext M (1) by the common key encryption method. A ciphertext SE (KA, M (1)) is generated by encrypting (step S73). The generated ciphertext SE (KA, M (1)) is sent to the ciphertext authenticator generation unit 114n.

The ciphertext authenticator generation unit 114n uses at least the common key KB and the ciphertext SE (KA, M (1)) to encrypt the ciphertext authenticator AU (KB, SE) of the ciphertext SE (KA, M (1)). (KA, M (1))) is generated (step S74). The ciphertext authenticator AU (KB, SE (KA, M (1))) is generated as follows, for example.
AU (KB, SE (KA, M (1))) = HMAC (KB, SE (KA, M (1)))… (1)
HMAC (α, β) (m is an integer greater than or equal to 1) is that γ (+) δ is an exclusive OR of γ and δ, opad and ipad are constant bit strings, and H (σ) is σ When a hash value is used and γ | δ is a bit concatenation of γ and δ,
H ((α (+) opad) | H ((α (+) ipad) | β))… (2)
(See “Mihir Bellare, Ran Canetti and Hugo Krawczyk,“ Keying Hash Functions for Message Authentication ”, CRYPTO'96, pp1-15, 1996.”, etc.)

The ciphertext authenticator AU (KB, SE (KA, M (1))) is not limited to the formula (2), and the ciphertext SE (KA, M (1)) is used by using the common key KB. As long as the information can prove the validity of (), any information such as an electronic signature may be used.
The ciphertext SE (KA, M (1)) generated in this way and the ciphertext authenticator AU (KB, SE (KA, M (1))) are transferred to the USB memory 20 by the external writing unit 11a. Is stored in the area 22c (FIG. 17B) of the storage unit 22 (step S75 / end of the writing process).

  Next, the USB memory 20 is mounted and mounted on the PC 110-2. In this state, the application execution unit 14h of the PC 110-2 sends the ciphertext SE (KA, M (1)) and the ciphertext authenticator AU (KB, SE (KA, M) from the USB memory 20 to the control unit 14i. (1))) and read request. Using this as a trigger, under the control of the control unit 14i, the external reading unit 11b (FIG. 18 (a)) of the PC 110-2 encrypts from the area 22c (FIG. 18 (b)) of the storage unit 22 of the USB memory 20. The text SE (KA, M (1)) and the ciphertext authenticator AU (KB, SE (KA, M (1))) are read (step S76), and the ciphertext IBE (MPK, ID (2) is read from the area 22b. ), KA), IBE (MPK, ID (2), KB) are read (step S77). Next, the internal reading unit 12b (FIG. 18A) of the PC 110-2 reads the secret key SK (2) from the storage unit 13. Then, the common key recovery unit 114d of the PC 110-2 uses the secret key SK (2) to convert the ciphertexts IBE (MPK, ID (2), KA), IBE (MPK, ID (2), KB), respectively. Decrypt the common key KA (KA = PD (SK (2), IBE (MPK, ID (2), KA))), KB (KB = PD (SK (2), IBE (MPK, ID (2), KB))] is extracted (step S78).

  Thereafter, the common key KB, the ciphertext SE (KA, M (1)), and the ciphertext authenticator AU (KB, SE (KA, M (1))) are input to the ciphertext verification unit 114p of the PC 110-2. The ciphertext verification unit 114p uses the common key KB and the ciphertext authenticator AU (KB, SE (KA, M (1))), and the ciphertext SE (KA, M (1)) is valid. It is verified whether or not (step S79). For example, in the example in which the certifier AU (KB, SE (KA, M (1))) is generated by the above-described equation (2) in step S74, the ciphertext verification unit 114p of the PC 110-2 is input. HMAC (KB, SE (KA, M (1))) is calculated using the common key KB and ciphertext SE (KA, M (1)), and the operation result and the input AU (KB, SE ( It is determined whether or not KA, M (1))) = HMAC (KB, SE (KA, M (1))).

  Here, if they are not equal, it is determined that the ciphertext SE (KA, M (1)) is invalid, and the control unit 14i ends the process with an error. On the other hand, if they are equal, it is assumed that the ciphertext SE (KA, M (1)) is valid, and the decryption unit 114f of the PC 110-2 uses the common key KA to encrypt the ciphertext SE (KA, M ( 1)) is decrypted to extract plaintext M (1) [M (1) = SD (KA, SE (KA, M (1))] (step S80). The data is sent to the application execution unit 14h of the PC 110-2 (end of the reading process).

[Deleting process]
Next, the deletion process of this embodiment will be described. It is assumed that the OS, security program, and application software are installed on the PC 110-i.
19 to 21 are diagrams showing each functional block and data flow related to the deletion process of this embodiment. 24 and 25 are sequence diagrams for explaining the deletion process of this embodiment.

It is assumed that the USB memory 20 is mounted and mounted on the PC 110-1. Also in this embodiment, the registration of the PC 110-2 is deleted as in the first embodiment.
First, the internal reading unit 12b of the PC 110-1 reads the identification information ID (1) from the storage unit 13 and sends it to the external reading unit 11b (FIG. 19). The external reading unit 11b reads the ciphertext IBE (MPK, ID (1), KA) associated with the identification information ID (1) from the area 22b (FIG. 20) of the storage unit 22 of the USB memory 20 (step S91). ).

Next, the internal reading unit 12b (FIG. 19) of the PC 110-1 reads the secret key SK (1) from the storage unit 13 and sends it to the common key restoration unit 14d. Using the secret key SK (1), the common key restoration unit 14d decrypts the ciphertext IBE (MPK, ID (1), KA) read from the USB memory 20 and uses the common key KA [KA = PD (SK (1), IBE (MPK, ID (1), KA))] is extracted (step S92).
Next, the common key generation unit 114a of the PC 110-1 generates new common keys KA _new and KB _new (step S93).

  Further, the external reading unit 11b of the PC 110-1 reads the ciphertext SE (KA, M (i)) (iε {1,..., N}) corresponding to the PC 110-i from the USB memory 20 (step S94), and sends it to the decoding unit 114f. The decryption unit 114f decrypts the ciphertext SE (KA, M (i)) using the common key KA obtained by the common key restoration unit 114d, and plaintext M (i) [M (i) = SD (KA, SE (KA, M (i))] is extracted (step S95).

Next, each extracted plaintext M (i) and a new common key KA _new are input to the encryption unit 114e of the PC 110-1, and the encryption unit 114e uses the new common key KA _new. A ciphertext SE (KA _new , M (i)) obtained by encrypting each plaintext M (i) is generated (step S96). Further, the ciphertext authenticator generation unit 114n receives the ciphertext SE (KA _new , M (i)) and the new common key KB _new, and the ciphertext authenticator generation unit 114n performs the same as in step S74. , the ciphertext SE ciphertext authenticator for AU _{(KA new, M (i)} ) (KB new, SE (KA new, M (i))) to generate a (step S97).

The generated ciphertexts SE (KA _new , M (i)) and their ciphertext authenticators AU (KB _new , SE (KA _new , M (i))) are the external writing unit 11a of the PC 110-1. Sent to. The external writing unit 11 a stores the ciphertext SE (KA _new , M (i)) and the ciphertext authenticator AU (KB _new , SE (KA _new , M (i))) in the USB memory 20. The interface unit 21 sends them to the interface unit 21 and stores them in the area 22c (FIG. 20) of the storage unit 22 (step S98).

Next, the external reading unit 11b (FIG. 19) of the PC 110-1 identifies from the USB memory 20 the identification information ID (s) other than the PC 110-2 to be deleted (sε {1,..., N}, s ≠ 2) are read (step S99), and they are sent to the key concealment unit 114c. Also, the internal reading unit 12b reads the master public key MPK from the storage unit 13 and sends it to the key concealment unit 114c. The key ciphering unit 114c includes a respective identification information ID (s) using the master public key MPK, the newly generated common key KA _{new new} common key generation unit 114a, a KB _{new new,} by the respective ID-BASE cryptosystem Encryption is performed to generate ciphertexts IBE (MPK, ID (s), KA _new ), IBE (MPK, ID (s), KB _new ) (step S100).

Each ciphertext IBE (MPK, ID (s), KA _new ), IBE (MPK, ID (s), KB _new ) is transferred to the interface unit 21 (FIG. 20) of the USB memory 20 by the external writing unit 11a of the PC 110-1. Sent to. Then, the interface unit 21 stores the ciphertexts IBE (MPK, ID (s), KA _new ), IBE (MPK, ID (s), KB _new ) in the area 22 b of the storage unit 22 of the USB memory 20. Each is stored in association with the identification information ID (s) (FIG. 20) (step S101).
Next, the deletion unit 14g (FIG. 21A) of the PC 110-1 issues a deletion command, and the external writing unit 11a receiving the command issues the area 22c of the storage unit 22 of the USB memory 20 (FIG. 21B). The ciphertext SE (KA, M (i)) and ciphertext authenticator AU (KB, SE (KA, M (i))) are deleted from the ciphertext IBE (MPK, ID (i), KA ), IBE (MPK, ID (i), KB) and identification information ID (2) are deleted (FIG. 21B) (step S102).

[Fourth Embodiment]
Next, a fourth embodiment of the present invention will be described. This embodiment is a modification of the third embodiment. The only difference from the third embodiment is that the configuration of the key concealment unit 114c and the common key restoration unit 114d that conceal and decrypt a plurality of common keys is devised to reduce the amount of calculation. Hereinafter, only the key concealment unit 114c and the common key restoration unit 114d of this embodiment will be described.

<Key concealment unit 114c>
FIG. 26A is a block diagram showing the configuration of the key concealment unit 114c of this embodiment. FIG. 27 is a flowchart for explaining the key concealment processing of this embodiment. Hereinafter, using these figures, the secret key KA.KB, the master public key MPK, and the identification information ID (1) are input to the key concealment unit 114c of the present embodiment, and the key concealment unit 114c transmits the ciphertext IBE ( A process for calculating MPK, ID (1), KA), IBE (MPK, ID (1), KB) will be described as an example.

  First, the random number generation unit 114ca of the key concealment unit 114c generates a random number Z (1) (for example, an integer having a bit length of 384 bits) (step S121), which is converted into the public key encryption unit 114cb of the key concealment unit 114c. It is sent to the random number division unit 114cc. The public key encryption unit 114cb encrypts the random number Z (1) by the ID-BASE encryption method using the input master public key MPK and the identification information ID (1), and the ciphertext C (1) = IBE (MPK , ID (1), Z (1)) is generated (step S122). In addition, the random number dividing unit 114cc divides the random number Z (1) into 2 (example of Y = 2) random numbers Z (1, y) (y∈ {1, 2}) (for example, bit length 128 bits). (Step S123). Each divided random number Z (1, y) is sent to the common key encryption unit 114cd of the key concealment unit 114c. The common key encryption unit 114cd uses the random number Z (1, 1) as a key and a ciphertext SE (Z (1, 1), KA) obtained by encrypting the common key KA by a common key encryption method (Camellia, AES, etc.). Is generated (step S124). Further, the common key encryption unit 114cd generates a ciphertext SE (Z (1, 2), KB) obtained by encrypting the common key KB by the common key encryption method using the random number Z (1, 2) as a key ( Step S125).

Then, the key concealment unit 114c
IBE (MPK, ID (1), KA) = (C (1), SE (Z (1, 1), KA))
IBE (MPK, ID (1), KB) = (C (1), SE (Z (1, 2), KB))
Is output (step S126). Note that (C (1), SE (Z (1, 1), KA)) means information having C (1) and SE (Z (1, 1), KA), and (C (1 ), SE (Z (1, 2), KB)) means information having C (1) and SE (Z (1, 2), KB). Further, specific examples of “information having α and β” include bit combination between α and β, bit combination between the bit combination and other data, and the like.

<Common key restoration unit 114d>
FIG. 26B is a block diagram showing the configuration of the common key restoration unit 114d of this embodiment. FIG. 28 is a flowchart for explaining the key restoration processing of this embodiment. Hereinafter, using these figures, the ciphertext IBE (MPK, ID (1), KA), IBE (MPK, ID (1), KB) and the secret key SK (1) are the common key restoration unit 114d of this embodiment. The common key restoration unit 114d decrypts the ciphertext IBE (MPK, ID (1), KA), IBE (MPK, ID (1), KB) as an example.

  First, the public key decryption unit 114da of the common key restoration unit 114d uses the input secret key SK (1) to generate ciphertext C (1) = IBE (MPK, ID (1), Z (1)). Decryption is performed to extract a random number Z (1) [Z (1) = PD (SK (1), C (1))] (step S131). The random number Z (1) is input to the random number dividing unit 114db of the common key restoration unit 114d, and the random number dividing unit 114db converts the random number Z (1) into the random number dividing unit 114cc (FIG. 26A). It is divided into 2 (example of Y = 2) random numbers Z (1, y) (yε {1, 2}) (for example, bit length 128 bits) (step S132).

  Next, a random number Z (1, y) (y∈ {1, 2}) and ciphertext SE (Z (1, 1), KA), SE ( Z (1, 2), KB) is entered. The common key decryption unit 114 dc uses the random number Z (1, 1) as a key, decrypts the ciphertext SE (Z (1, 1), KA) by the common key cryptosystem, and the random number Z (1, 2). Is used as a key, and the KB obtained by decrypting the ciphertext SE (Z (1, 2), KB) by the common key cryptosystem is calculated (steps S133 and S134). Then, the common key restoration unit 114d outputs the common keys KA and KB (step S135).

  As described above, the key concealment unit 114c of the present embodiment uses the secret key SK (1) by performing one encryption process by the ID-BASE encryption method and two encryption processes by the common key encryption method. Cipher texts IBE (MPK, ID (1), KA) and IBE (MPK, ID (1), KB) of each decryptable secret key KA, KB can be created. The amount of computation required for this is smaller than the amount of computation when each of the secret keys KA and KB is encrypted by two encryption processes using the ID-BASE encryption method. Such an effect of reducing the amount of calculation can be obtained at the time of decoding.

[Fifth Embodiment]
Next, a fifth embodiment of the present invention will be described. This embodiment is also a modification of the third embodiment. While improving the security by devising the processing of the encryption unit 114e and the decryption unit 114f, and using the random numbers used for the processing to generate a ciphertext authenticator, while suppressing an increase in the amount of computation The point that the security of the ciphertext authenticator is improved is different from the third embodiment. Only the differences from the third embodiment will be described below.

<Writing process of this embodiment>
FIG. 29 is a diagram showing each functional block and data flow related to the writing process of the present embodiment. Here, an example in which the PC 110-1 writes the ciphertext to the USB memory 20 is shown.
It is assumed that the USB memory 20 is mounted and mounted on the PC 110-1. First, the application execution unit 14h of the PC 110-1 designates the sector number se (1 sector = 512 bytes) to the control unit 14i and makes a request to write the ciphertext of plaintext M (1) to the USB memory 20. . With this as a trigger, the same processing as steps S71 and 72 (FIG. 23) of the third embodiment is executed.

  Next, the common key KA, the designated sector number se, and plaintext M (1) are input to the encryption unit 114e, and the encryption unit 114e encrypts the plaintext M (1) using the common key KA. The encrypted ciphertext SE (KA, M (1)) is generated, and the random number E (1) and the ciphertext SE (KA, M (1)) are output. Details of the encryption unit 114e will be described below.

[Details of Encryption Unit 114e of this Embodiment]
FIG. 31A is a block diagram showing details of the encryption unit 114e of this embodiment. FIG. 32A is a flowchart for explaining the encryption processing of this embodiment.
First, the block division unit 114ea of the encryption unit 114e receives X (X ≧ 2) (for example, X = 32) blocks MB (p, x) (x∈ {1,. .., X}) (step S141). Each block MB (p, x) is sent to the block encryption unit 114ed, and the block number x is sent to the function calculation unit 114ec.

  Further, the random number generation unit 114eb of the encryption unit 114e generates and outputs a random number E (1) for each plaintext M (1) (step S142). Next, in the function calculation unit 114ec of the encryption unit 114e, the sector number se of the storage unit 22 of the USB memory 20 that stores the ciphertext of plaintext M (1), the random number E (1), the block number x, And the function calculation unit 114ec calculates a function value IV = π (x, E (1), se) obtained by substituting these into a predetermined function π for each block number x (for example, x, E (1 ), se bit concatenation is set to IV) (step S143).

  Further, the function value IV, the block MB (1, x), and the common key KA are input to the block encryption unit 114ed of the encryption unit 114e. The block encryption unit 114ed encrypts each block MB (1, x) by a block encryption method (counter mode or the like) using the common key KA and the function value IV as an initial vector. Then, the block encryption unit 114ed generates a ciphertext SE (KA, M (1)) from the ciphertext of the calculated all blocks MB (1, x) (for example, all the blocks MB (1, x) The bit concatenated value of the ciphertext is output as ciphertext SE (KA, M (1)) (step S144).

  The generated ciphertext SE (KA, M (1)) is sent to the ciphertext authenticator generation unit 114n together with the random number E (1). The ciphertext authenticator generation unit 114n uses at least the common key KB, the ciphertext SE (KA, M (1)), and the random number E (1) to encrypt the ciphertext SE (KA, M (1)). A child AU (KB, E (1), SE (KA, M (1))) is generated.

  The ciphertext SE (KA, M (1)) generated as described above, its ciphertext authenticator AU (KB, SE (KA, M (1))), random number E (1), and application execution The sector number se sent from the part 14h is sent to the interface part 21 of the USB memory 20 by the external writing part 11a (FIG. 29 (b)). The interface unit 21 adds the ciphertext SE (KA, M (1)) and the ciphertext authenticator AU (KB, SE (KA, M (1)) to the sector in the area 22c of the storage unit 22 specified by the sector number se. ))) And random number E (1) are stored (step S145) (end of description of [details of encryption unit 114e of this embodiment]).

<Reading process of this embodiment>
FIG. 30 is a diagram showing each functional block and data flow related to the reading process of this embodiment. In this example, the PC 110-2 reads the ciphertext from the USB memory 20 and decrypts it.
First, the USB memory 20 is mounted and mounted on the PC 110-2. Then, the application execution unit 14h of the PC 110-2 requests the control unit 14i to read the ciphertext from the USB memory 20 and to decrypt the ciphertext by designating the sector number se. Using this as a trigger, first, the external reading unit 11b of the PC 110-2 designates the sector number se, and from the area 22c of the storage unit 22 of the USB memory 20, the ciphertext SE (KA, M (1)) and The ciphertext authenticator AU (KB, E (1), SE (KA, M (1))) and the random number E (1) are read, and the ciphertext IBE (MPK, ID (2), KA is read from the area 22b. ), IBE (MPK, ID (2), KB).

  Next, the internal reading unit 12b (FIG. 30A) of the PC 110-2 reads the secret key SK (2) from the storage unit 13. Then, the common key recovery unit 114d of the PC 110-2 uses the secret key SK (2) to convert the ciphertexts IBE (MPK, ID (2), KA), IBE (MPK, ID (2), KB), respectively. Decrypt the common key KA (KA = PD (SK (2), IBE (MPK, ID (2), KA))), KB (KB = PD (SK (2), IBE (MPK, ID (2), KB))] is extracted.

  Thereafter, the ciphertext verification unit 114p of the PC 110-2 receives the common key KB, the ciphertext SE (KA, M (1)), and the ciphertext authenticator AU (KB, E (1), SE (KA, M (1)). )) And a random number E (1) are input, and the ciphertext verification unit 114p uses these to verify whether the ciphertext SE (KA, M (1)) is valid. If the ciphertext SE (KA, M (1)) is valid, the decryption unit 114f of the PC 110-2 uses the common key KA, the random number E (1), and the sector number se to encrypt the ciphertext SE (KA, M (1)) is decrypted, and plaintext M (1) [M (1) = SD (KA, SE (KA, M (1))] is extracted. explain.

[Details of Decoding Unit 114f of this Embodiment]
FIG. 31B is a block diagram showing details of the decoding unit 114f of the present embodiment. FIG. 32B is a flowchart for explaining the decoding processing of this embodiment.
First, the block division unit 114fa of the decryption unit 114f converts the ciphertext SE (KA, M (1)) into X (X ≧ 2) (for example, X = 32) blocks SEB (KA, M (1), x ) (X∈ {1,..., X}) (Step S151). This process is a reverse process of the process in which the block encryption unit 114ed in FIG. 31A generates the ciphertext SE (KA, M (1)) from the ciphertext of all the blocks MB (1, x). Each block SEB (KA, M (1), x) is sent to the block decoder 114fd, and the block number x is sent to the function calculator 114fc.

  Next, the sector number se, the random number E (1), and the block number x are input to the function calculation unit 114fc of the decryption unit 114f. The function calculation unit 114fc calculates a function value IV = π (x, E (1), se) obtained by substituting these into a predetermined function π for each block number x (for example, x, E (1), se) Bit concatenation is set to IV) (step S152).

  The function value IV, the block SEB (KA, M (1), x), and the common key KA are input to the block decryption unit 114fd of the encryption unit 114e. The block decryption unit 114fd decrypts the block SEB (KA, M (1), x) using the common key KA and the block decryption method (counter mode or the like) using the function value IV as an initial vector, and each block MB Extract (1, x). This process is a reverse process of the process of the block encryption unit 114ed in FIG. Then, the block decryption unit 114fd generates and outputs plaintext M (1) from all the calculated blocks MB (1, x) (step S153). The output plaintext M (1) is sent to the application execution unit 14h of the PC 110-2 (end of description of [Details of the decryption unit 114f of this embodiment]).

  The encryption unit 114e and the decryption unit 114f of the present embodiment described above are similarly executed in the [deletion process], but description thereof is omitted here. Further, the configuration may be such that the sector number se is not used for the encryption processing and the decryption processing of the encryption unit 114e and the decryption unit 114f, or other information is used to generate the function value IV. There may be.

[Other variations, etc.]
The present invention is not limited to the above-described embodiment. For example, in the first embodiment, the common key is regenerated and the information in the USB memory is rewritten in the deletion process of deleting a specific PC from the registration, but the common key is not deleted from the registration. May be regenerated to rewrite the information in the USB memory. Such processing is effective, for example, when the common key is leaked to a third party.

  In each of the above-described embodiments, a personal computer is illustrated as an example of an information processing apparatus, and a USB memory is illustrated as an example of an information recording medium. However, the present invention is not limited to these. For example, a mobile phone, a personal digital assistant (PDA), or the like may be used as the information processing apparatus. As an information recording medium, a DVD-RAM (Random Access Memory), a CD-R (Recordable) / RW (ReWritable), an MO (Magneto-Optical disc), or the like may be used, or a non-portable type such as a hard disk. A recording medium may be used. Furthermore, as an information recording medium, a memory of a device including a calculation device such as a mobile phone, a personal digital assistant (PDA), or a personal computer may be used.

FIG. 33 is a conceptual diagram illustrating an information recording medium sharing system 201 using a non-portable recording medium as an information recording medium.
The example of FIG. 33 is an example in which the hard disk device 221 included in the server device 220 is used as an information recording medium. The server device 220 and the plurality of PCs 10-1 to 10 -n described above are communicably connected, and the external writing unit 11 a (FIG. 2A) of each PC 10-i writes various data to the hard disk device 221. The external reading unit 11b of each PC 10-i is configured to be able to read various data from the hard disk device 221. The server device 221 and the PCs 10-1 to 10-n may be connected through a local network or may be connected through a global network. Then, not the USB memory 20 or the USB memory 120 but the hard disk device 221 is used as the information recording medium, and the same processing as in each of the above embodiments is executed. Other configurations and processes are the same as those in the above-described embodiments.

Further, a plurality of information recording media may be used, and information stored in the information recording media may be distributed and stored.
FIG. 34 is a conceptual diagram illustrating an information recording medium sharing system 301 using a plurality of information recording media. FIG. 35 is a block diagram illustrating the USB memories 320 and 330 of FIG.
34 and 35, the present invention is implemented using two USB memories 320 and 330 as information recording media. As illustrated in FIG. 35A, the USB memories 320 and 330 are configured in the same manner as the USB memory 20 described above. However, in the storage unit 22 of the USB memory 320, {ID (1), IBE (MPK (1), ID (1), KA)} ... {ID (n), IBE (MPK (n), ID (n), KA)} and only the security program are stored, and {SE (KA, M (1))}... {SE (KA, M (n))} is not stored. On the other hand, the storage unit 22 of the USB memory 330 stores only {SE (KA, M (1))}... {SE (KA, M (n))}, and {ID (1), IBE ( MPK (1), ID (1), KA)} ... {ID (n), IBE (MPK (n), ID (n), KA)} and security programs are not stored. The procedure for storing each information is as described above. In addition, when configuring an information recording medium sharing system using a plurality of information recording media, the information recording media may be different from each other, and a part of the plurality of information recording media may be used. A portable information recording medium may be used, and another information recording medium may be a non-portable recording medium. For example, the present invention may be implemented using a USB memory removable from a PC and a hard disk provided in a server device connected through a network as an information recording medium.

  Specific examples of the identification information ID used in each of the above-described embodiments include position information (latitude, longitude, building name, floor name, address, etc.), machine number (CPU ID, MAC address, device manufacturing number). Etc.), software license number, user's biometric information (fingerprint, rainbow collection, vein), job title identifier (department manager, section manager, root, etc.).

  In each of the above-described embodiments, the key pair (MPK, SK (i)) of the master public key and the secret key is transmitted to each PC 10-i corresponding to each SK (i) in the key distribution process. However, the distribution of the master public key MPK and the distribution of the secret key SK (i) may be executed at different timings (the key distribution process may be executed in a distributed manner at a plurality of times). That is, it is sufficient that the master public key MPK is distributed until the key concealment process (eg, step S3) in the registration process, and the secret key SK (i) is distributed in the common key recovery process in the writing process and the reading process. It is sufficient if it is executed by (for example, steps S22 and S27).

  Therefore, for example, the distribution of the master public key MPK is executed before the key concealment process in the registration process, and the distribution of the secret key SK (i) is performed after the key concealment process in the registration process, and the common key recovery in the writing process and the reading process is performed. It may be executed before processing. In such a case, for example, in addition to the above specific example, the identification information ID includes the date when the key concealment process of the registration process is performed, an arbitrary time, the elapsed time after the key concealment process of the registration process, etc. Can be used as In this case, for example, the information processing apparatus that performed the key concealment process in the registration process sends the date of the process or the like as the identification information ID to the ID-BASE key generation apparatus, and the ID-BASE key generation apparatus The secret key generated using this identification information ID may be distributed.

  Further, when the information recording medium is a portable information recording medium, information obtained by sampling an arbitrary time, an elapsed time after performing the key concealment process in the registration process, arbitrary position information, etc. under a predetermined condition The information processing device that uses the machine number, software license number, and the user's biometric information as the identification information ID, and performs the common key recovery process in the writing process and the reading process, A configuration in which information obtained by sampling position information or the like under a predetermined condition, its own machine number, software license number, or user's biological information is used as an identification information ID is effective. In this case, the information processing apparatus that performs the common key recovery process in the writing process and the reading process satisfies the set conditions (time, elapsed time, location information, machine number, software license number, user biometric information, etc.). Unless this is the case, the common key restoration process cannot be performed. As a result, detailed management of the information processing apparatus that performs the common key recovery process in the writing process and the reading process becomes possible.

In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.
The program describing the processing contents executed by the PC can be recorded on a computer-readable recording medium. As the computer-readable recording medium, any of the above-described USB memory, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like may be used. As a device, a hard disk device, a flexible disk, a magnetic tape or the like, and an optical disk such as a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only Memory), a CD-R (Recordable) / RW (ReWritable) or the like can be used as a magneto-optical recording medium, an MO (Magneto-Optical disc) or the like as a semiconductor memory, or an EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like.

The program is distributed by selling, transferring, or lending a portable recording medium such as a USB memory, DVD, or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.
A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, a computer may read the program directly from a portable recording medium and execute processing according to the program.

Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).
In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  As a field of use of the present invention, for example, concealment of data stored in a USB memory can be exemplified.

FIG. 1 is a conceptual diagram illustrating the overall configuration of the information recording medium sharing system according to the first embodiment. FIG. 2A is a block diagram illustrating the functional configuration of the PC according to the first embodiment, and FIG. 2B is a block diagram illustrating the functional configuration of the USB memory according to the present embodiment. FIG. 3 is a block diagram illustrating a functional configuration of the ID-BASE key generation apparatus according to the first embodiment. FIG. 4 is a diagram illustrating each functional block and data flow related to the registration process of the first embodiment. FIG. 5 is a diagram showing each functional block and data flow related to the writing process of the first embodiment. FIG. 6 is a diagram illustrating each functional block and data flow related to the reading process of the first embodiment. FIG. 7 is a diagram showing each functional block and data flow related to the deletion process of the first embodiment. FIG. 8 is a diagram illustrating each functional block and data flow related to the deletion process of the first embodiment. FIG. 9 is a diagram illustrating each functional block and data flow related to the deletion process of the first embodiment. FIG. 10 is a sequence diagram for explaining a registration process according to the first embodiment. FIG. 11 is a sequence diagram for explaining a writing process and a reading process according to the first embodiment. FIG. 12 is a sequence diagram for explaining a deletion process according to the first embodiment. FIG. 13 is a sequence diagram for explaining a registration process according to the second embodiment. FIG. 14 is a block diagram illustrating a functional configuration of a PC according to the third embodiment. FIG. 15 is a block diagram illustrating a functional configuration of the USB memory according to the third embodiment. FIG. 16 is a diagram illustrating each functional block and data flow related to the registration process of the third embodiment. FIG. 17 is a diagram illustrating each functional block and data flow related to the writing process of the third embodiment. FIG. 18 is a diagram illustrating each functional block and data flow related to the reading process of the third embodiment. FIG. 19 is a diagram illustrating each functional block and data flow related to the deletion process of the third embodiment. FIG. 20 is a diagram illustrating each functional block and data flow related to the deletion process of the third embodiment. FIG. 21 is a diagram illustrating each functional block and data flow related to the deletion process of the third embodiment. FIG. 22 is a sequence diagram for explaining a registration process according to the third embodiment. FIG. 23 is a sequence diagram for explaining a writing process and a reading process according to the third embodiment. FIG. 24 is a sequence diagram for explaining a deletion process according to the third embodiment. FIG. 25 is a sequence diagram for explaining a deletion process according to the third embodiment. FIG. 26A is a block diagram illustrating a configuration of a key concealment unit according to the fourth embodiment. FIG. 26B is a block diagram illustrating a configuration of the common key restoration unit according to the fourth embodiment. FIG. 27 is a flowchart for explaining a key concealment process according to the fourth embodiment. FIG. 28 is a flowchart for explaining a key restoration process according to the fourth embodiment. FIG. 29 is a diagram illustrating each functional block and data flow related to the writing process of the fifth embodiment. FIG. 30 is a diagram illustrating each functional block and data flow related to the reading process of the fifth embodiment. FIG. 31A is a block diagram illustrating details of the encryption unit according to the fifth embodiment. FIG. 31B is a block diagram showing details of the decoding unit of this embodiment. FIG. 32A is a flowchart for explaining the encryption processing of the fifth embodiment. FIG. 32B is a flowchart for explaining the decoding processing of this embodiment. FIG. 33 is a conceptual diagram illustrating an information recording medium sharing system using a non-portable recording medium as an information recording medium. FIG. 34 is a conceptual diagram illustrating an information recording medium sharing system using a plurality of information recording media. FIG. 35 is a block diagram illustrating each information recording medium of FIG.

Explanation of symbols

1,200,300 Information recording medium sharing system 10,110 PC (equivalent to “information processing device”)
20 USB memory (equivalent to “information recording medium”)
220 Hard disk device (equivalent to “information recording medium”)

Claims (15)

n (n is an integer of 2 or more) information processing devices PC (i) (i∈ {1,..., n}) share the information recording medium, and store the ciphertext in the information recording medium. An information recording medium security method for decrypting plaintext from ciphertext stored in the information recording medium,
A common master secret key for each information processing device PC (i) is MSK, and a common master public key for each information processing device PC (i) generated using the master secret key MSK is MPK, A secret key when the ID-BASE encryption scheme secret key generated using the identification information ID (i) and master secret key MSK for identifying each information processing device PC (i) is SK (i) SK (i) is stored in the storage unit of the information processing apparatus PC (i) corresponding to the secret key SK (i), and the master public key MPK and the identification information ID (i) are used. A process of storing each ciphertext IBE (MPK, ID (i), KA) obtained by encrypting the common key KA of the common key encryption system by the BASE encryption system in the information recording medium,
Any of the information processing devices PC (p) (p∈) in which the ciphertext IBE (MPK, ID (p), KA) is stored in the information recording medium and the secret key SK (p) is stored in its own storage unit {1, ..., n}) external reading unit reads the ciphertext IBE (MPK, ID (p), KA) from the information recording medium and the common key of the information processing device PC (p) A process in which the restoration unit decrypts the ciphertext IBE (MPK, ID (p), KA) using the secret key SK (p) stored in the storage unit and extracts the common key KA, and the information processing apparatus PC the encryption unit of (p) generates a ciphertext SE (KA, M (p)) obtained by encrypting the plaintext M (p) using the common key KA, and the information processing apparatus PC (p) An external writing unit storing the ciphertext SE (KA, M (p)) in the information recording medium, a writing process comprising:
Any of the information processing devices PC (q) (q∈) in which the ciphertext IBE (MPK, ID (q), KA) is stored in the information recording medium and the secret key SK (q) is stored in its own storage unit {1, ..., n}) external reading unit reads the ciphertext IBE (MPK, ID (q), KA) from the information recording medium, and external reading of the information processing device PC (q) The process of reading the ciphertext SE (KA, M (p)) from the information recording medium, and the common key recovery unit of the information processing device PC (q) includes the secret key SK (q ) To decrypt the ciphertext IBE (MPK, ID (q), KA) and extract the common key KA, and the decryption unit of the information processing device PC (q) uses the common key KA. Decrypting the ciphertext SE (KA, M (p)) and extracting the plaintext M (p), and a reading process comprising:
A security method for an information recording medium, comprising: The information recording medium security method according to claim 1,
The registration process is
The process of generating the common key KA by the common key generation unit of any one of the information processing apparatuses PC (r) (r∈ {1,..., N}), and the key concealment of the information processing apparatus PC (r) Uses the master public key MPK and identification information ID (u) that identifies one of the information processing devices PC (u) (u∈ {1, ..., n}), and the ID-BASE encryption method The process of generating each ciphertext IBE (MPK, ID (u), KA) obtained by encrypting the common key KA of the common key cryptosystem, and the external writing unit of the information processing apparatus PC (r) MPK, ID (u), KA) is stored in the information recording medium,
A security method for an information recording medium, comprising: The information recording medium security method according to claim 2,
Identification information ID (u) in which the key concealment unit of the information processing device PC (r) identifies the master public key MPK and any one of the information processing devices PC (u) (u∈ {1,..., N}) ), And the process of generating each ciphertext IBE (MPK, ID (u), KA) obtained by encrypting the common key KA of the common key encryption method by the ID-BASE encryption method,
The random number generation unit of the key concealment unit of the information processing device PC (r) generates a random number Z (u), and the public key encryption unit of the key concealment unit of the information processing device PC (r) , Using the master public key MPK and the identification information ID (u), the random number Z (u) is encrypted by the ID-BASE encryption method, and the ciphertext C (u) = IBE (MPK, ID (u), Z ( u)) and the random number dividing unit of the key concealment unit of the information processing apparatus PC (r) convert the random number Z (u) into Y (Y ≧ 2) random numbers Z (u, y) ( y = 1,..., Y) and the common key encryption unit of the key concealment unit of the information processing apparatus PC (r) is one of random numbers Z (u, y1) (y1 = 1, ..., Y) as a key, and the ciphertext SE (Z (u, y1), KA) is obtained by encrypting the common key KA using the common key cryptosystem, and the ciphertext C (u) and ciphertext are encrypted. Outputs information (C (u), SE (Z (u, y1), KA)) with the text SE (Z (u, y1), KA) as ciphertext IBE (MPK, ID (u), KA) And the common key encryption unit of the key concealment unit of the information processing apparatus PC (r) , The other random number Z (u, y2) (y2 = 1,..., Y, y2 ≠ y1) obtained as a key, and the ciphertext SE ( Z (u, y2), K ′)
A security method for an information recording medium. The information recording medium security method according to claim 1 or 2,
The registration process is
Any of the information processing devices PC (t) (t∈) in which the ciphertext IBE (MPK, ID (t), KA) is stored in the information recording medium and the secret key SK (t) is stored in its own storage unit {1, ..., n}) external reading unit reads the ciphertext IBE (MPK, ID (t), KA) from the information recording medium and the common key of the information processing device PC (t) A process in which the restoration unit decrypts the ciphertext IBE (MPK, ID (t), KA) using the secret key SK (t) stored in the storage unit and extracts the common key KA, and the information processing apparatus PC The key concealment unit in (t) uses the master public key MPK and the identification information ID (g) that identifies one of the information processing devices PC (g) (g∈ {1, ..., n}) , The process of generating each ciphertext IBE (MPK, ID (g), KA) obtained by encrypting the common key KA by the ID-BASE encryption method, and the external writing unit of the information processing device PC (t) Storing IBE (MPK, ID (g), KA) in the information recording medium,
A security method for an information recording medium, further comprising: The information recording medium security method according to claim 4,
Identification information ID (g) for identifying the information processing apparatus PC (g) (g∈ {1,..., N}) by the key concealing unit of the information processing apparatus PC (t) and the master public key MPK ) And generating each ciphertext IBE (MPK, ID (g), KA) in which the common key KA is encrypted by the ID-BASE encryption method,
The random number generation unit of the key concealment unit of the information processing device PC (t) generates a random number Z (g) and the public key encryption unit of the key concealment unit of the information processing device PC (t) , Using the master public key MPK and the identification information ID (g), the random number Z (g) is encrypted by the ID-BASE encryption method, and the ciphertext C (g) = IBE (MPK, ID (g), Z ( g)) and the random number dividing unit of the key concealment unit of the information processing apparatus PC (t) convert the random number Z (g) into Y (Y ≧ 2) random numbers Z (g, y) ( y = 1,..., Y) and the common key encryption unit of the key concealment unit of the information processing apparatus PC (t) perform any random number Z (g, y1) (y1 = 1, ..., Y) as a key, and the ciphertext SE (Z (g, y1), KA) is obtained by encrypting the common key KA using the common key cryptosystem, and the ciphertext C (g) and ciphertext above Outputs information (C (g), SE (Z (g, y1), KA)) with text SE (Z (g, y1), KA) as cipher text IBE (MPK, ID (g), KA) And the common key encryption unit of the key concealment unit of the information processing apparatus PC (t) , The other random numbers Z (g, y2) (y2 = 1,..., Y, y2 ≠ y1) obtained as a key, and the ciphertext SE ( Z (g, y2), K ′)
A security method for an information recording medium. The information recording medium security method according to claim 1,
Ciphertext IBE (MPK, ID (r), KA) (r∈ {1, ..., n}) is stored in the above information recording medium, and private key SK (r) is stored in its own storage unit The external reading unit of the information processing device PC (r) reads the ciphertext IBE (MPK, ID (r), KA) from the information recording medium, and the common key recovery unit of the information processing device PC (r) The process of decrypting the ciphertext IBE (MPK, ID (r), KA) using the secret key SK (r) stored in the storage unit and extracting the common key KA, and the information processing apparatus PC (r) The common key generation unit generates a new common key KA _new, and the external reading unit of the information processing apparatus PC (r) transmits the information processing apparatus PC (p) (p∈ {1 , ..., n}) and the decryption unit of the information processing apparatus PC (r) uses the common key KA to read the ciphertext SE. The process of decrypting (KA, M (p)) and extracting plaintext M (p) and the encryption unit of the information processing device PC (r) use a new common key KA _new . There are ciphertext SE for each plaintext M (p) encrypted and generating a _{(KA new, M (p)} ), external write unit of the information processing apparatus PC (r) is the ciphertext SE (KA _{new new} , M (p)) in the information recording medium, and a re-encryption process comprising:
The key ciphering unit of the information processing apparatus PC (r) is, using the master public key MPK identification information ID (p), ID-BASE cryptosystem ciphertext new common key KA _{new new} encrypted by IBE ( MPK, ID (p), KA _new ) and the external writing unit of the information processing device PC (r) use the ciphertext IBE (MPK, ID (p), KA _new ) to the information recording medium. A storing process, a re-registration process comprising,
A security method for an information recording medium, comprising: The information recording medium security method according to claim 6,
The re-registration process is a process executed for the information processing apparatus PC (s) other than the information processing apparatus PC (w) (w∈ {1,..., N}) to be deleted.
The security method of the information recording medium is as follows:
The deletion unit of the information processing device PC (r) transmits the ciphertext SE (KA, M (p)) (p∈ {1,..., N}) stored in the information recording medium from the information recording medium. Having a deletion process to delete,
A security method for an information recording medium. The information recording medium security method according to claim 1,
The process of generating the ciphertext SE (KA, M (p)) in which the encryption unit of the information processing apparatus PC (p) encrypts the plaintext M (p) using the common key KA,
A process in which the block division unit of the encryption unit divides the plaintext M (p) into X (X ≧ 2) blocks MB (p, x) (x∈ {1,..., X});
The random number generator of the encryption unit generates a random number E (p) for each plaintext M (p),
The external writing unit of the information processing device PC (p) stores a random number E (p) in the information recording medium,
The function calculation unit of the encryption unit substitutes a function value IV = π (x, E (p)) in which at least the block number x of block MB (p, x) and the random number E (p) are substituted into a predetermined function π. The process of calculating
The block encryption unit of the encryption unit encrypts each block MB (p, x) using the common key KA and the function value IV as an initial vector, and the ciphertext of all the calculated blocks MB (p, x) Generating ciphertext SE (KA, M (p)) from
A security method for an information recording medium. The information recording medium security method according to claim 8,
The registration process is
Record the above ciphertext IBE (MPK, ID (i), KB) obtained by encrypting the ciphertext authentication key KB by the ID-BASE encryption method using the master public key MPK and identification information ID (i). Comprising the process of storing on a medium;
The above writing process is
The external reading unit of the information processing device PC (p) reads the ciphertext IBE (MPK, ID (p), KB) from the information recording medium, and the common key recovery unit of the information processing device PC (p) Decrypting the ciphertext IBE (MPK, ID (p), KB) using the secret key SK (p) stored in the storage unit and extracting the ciphertext authentication key KB, and the information processing apparatus PC The ciphertext authentication unit (p) uses at least the ciphertext authentication key KB, the random number E (p), and the ciphertext SE (KA, M (p)) generated by the encryption unit. The process of generating the authenticator AU (KB, E (p), SE (KA, M (p))) of (KA, M (p)) and the external writing unit of the information processing device PC (p) Storing the authenticator AU (KB, E (p), SE (KA, M (p))) in the information recording medium,
A security method for an information recording medium. Information processing device PC (p) (pε {1,...) That stores ciphertext on an information recording medium shared with other information processing devices PC (q) (q∈ {1, ..., n}) ., n}, q ≠ p),
A storage unit for storing the ID-BASE encryption secret key SK (p);
Each ciphertext IBE (MPK) obtained by encrypting the common key KA of the common key encryption method by the ID-BASE encryption method using the identification information ID (p) for identifying the information processing device PC (p) and the master public key MPK. , ID (p), KA) is stored at least from the above information recording medium, an external reading unit that reads ciphertext IBE (MPK, ID (p), KA),
A common key recovery unit that decrypts the ciphertext IBE (MPK, ID (p), KA) using the secret key SK (p) stored in the storage unit and extracts the common key KA;
An encryption unit that generates a ciphertext SE (KA, M (p)) obtained by encrypting plaintext M (p) using the common key KA;
An external writing unit for storing the ciphertext SE (KA, M (p)) in the information recording medium;
An information processing apparatus comprising: Information processing device PC (q) (qε that decrypts plaintext from ciphertext stored in an information recording medium shared with other information processing devices PC (p) (pε {1, ..., n}) {1, ..., n}, q ≠ p)
A storage unit for storing the secret key SK (q) of the ID-BASE encryption method;
Using the identification information ID (q) for identifying the information processing device PC (q) and the master public key MPK, the ciphertext IBE (MPK, ID (q), KA) and ciphertext IBE from the information recording medium storing at least the ciphertext SE (KA, M (p)) obtained by encrypting the plaintext M (p) using the common key KA. An external reading unit that reads (MPK, ID (q), KA) and ciphertext SE (KA, M (p));
A common key recovery unit that decrypts the ciphertext IBE (MPK, ID (q), KA) using the secret key SK (q) stored in the storage unit and extracts the common key KA;
A decryption unit that decrypts the ciphertext SE (KA, M (p)) using the common key KA and extracts the plaintext M (p);
An information processing apparatus comprising:   The program for making a computer perform each process of the security method of the information recording medium described in any one of Claim 1 to 9.   A program for causing a computer to function as the information processing apparatus according to claim 10.   A computer-readable recording medium storing the program according to claim 12.   A computer-readable recording medium storing the program according to claim 13.

Images