(19)
(11)EP 3 407 531 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
22.07.2020 Bulletin 2020/30

(21)Application number: 17741448.9

(22)Date of filing:  18.01.2017
(51)International Patent Classification (IPC): 
H04L 9/08(2006.01)
G06F 21/60(2013.01)
(86)International application number:
PCT/JP2017/001608
(87)International publication number:
WO 2017/126571 (27.07.2017 Gazette  2017/30)

(54)

CIPHERTEXT MANAGEMENT METHOD, CIPHERTEXT MANAGEMENT DEVICE, AND PROGRAM

CHIFFRIERTEXTVERWALTUNGSVERFAHREN, CHIFFRIERTEXTVERWALTUNGSVORRICHTUNG UND PROGRAMM

PROCÉDÉ DE GESTION DE CRYPTOGRAMME, DISPOSITIF DE GESTION DE CRYPTOGRAMME, ET PROGRAMME


(84)Designated Contracting States:
AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

(30)Priority: 18.01.2016 JP 2016007309

(43)Date of publication of application:
28.11.2018 Bulletin 2018/48

(73)Proprietors:
  • Real Technology Inc.
    Yokohama-shi, Kanagawa 232-0066 (JP)
  • Ozaki, Hiroyuki
    Yokohama-shi, Kanagawa 232-0066 (JP)

(72)Inventor:
  • OZAKI Hiroyuki
    Yokohama-shi Kanagawa 232-0066 (JP)

(74)Representative: Plougmann Vingtoft a/s 
Strandvejen 70
2900 Hellerup
2900 Hellerup (DK)


(56)References cited: : 
JP-A- 2013 243 441
US-A1- 2014 229 731
JP-A- 2014 060 614
  
  • HUGO KRAWCZYK ED - STINSON D R: "Secret Sharing Made Short", 22 August 1993 (1993-08-22), ADVANCES IN CRYPTOLOGY (CRYPTO). SANTA BARBARA, AUG. 22 - 26, 1993; [PROCEEDINGS OF THE ANNUAL INTERNATIONAL CRYPTOLOGY CONFERENCE (CRYPTO)], BERLIN, SPRINGER, DE, PAGE(S) 136 - 146, XP019194050, ISBN: 978-3-540-57766-9 * section 3 *
  • PARAKH A ET AL: "Space efficient secret sharing for implicit data security", INFORMATION SCIENCES, AMSTERDAM, NL, vol. 181, no. 2, 15 January 2011 (2011-01-15), pages 335-341, XP027448826, ISSN: 0020-0255, DOI: 10.1016/J.INS.2010.09.013 [retrieved on 2010-09-21]
  • MIHIR BELLARE ET AL: "Robust Computational Secret Sharing and a Unified Account of Classical Secret-Sharing Goals", INTERNATIONAL ASSOCIATION FOR CRYPTOLOGIC RESEARCH,, vol. 20070820:074831, 20 August 2007 (2007-08-20), pages 1-36, XP061002103, [retrieved on 2007-08-20]
  • KATSUMA TAKIMOTO et al.: "A Content Protection Method Using Secret Sharing and Attribute-Based Encryption", IEICE Technical Report, vol. 113, no. 135, 11 July 2013 (2013-07-11), pages 199-204, XP055573528,
  • HIROSHI NOGUCHI et al.: "Common-key crypto file systems with leveled structure", IEICE Technical Report, vol. 101, no. 728, 12 March 2002 (2002-03-12), pages 117-120, XP9512458,
  
Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


Description

Technical Field



[0001] The present invention relates to a ciphertext management method, a ciphertext management apparatus and program, and particularly to a ciphertext management method or the like for managing ciphertext data.

Background Art



[0002] Krawczyk proposed a SS (Secret Sharing) scheme, configured as a combination of the IDA (Information Dispersal Algorithm) proposed by Rabin and the PSS (Perfect Sharing Scheme) proposed by Shamir, which provides a safe encryption scheme from the viewpoint of the amount of calculation (SSMS, see Non-patent document 1). First, secret data is encrypted by means of secret key encryption. The encrypted data is dispersed by means of the IDA, and the secret key is divided by means of the PSS. This allows the size of the shared secret data to be dramatically reduced as compared with an arrangement in which only the Shamir method is applied.

[Dispersal processing]



[0003] (Dis1) First, the secret key K is selected at random. The secret data S is encrypted using an encryption function ENC and the key K as represented by E = ENCK(S).

[0004] (Dis2) E is divided into β multiple pieces, i.e., E1, E2, ..., Eβ by means of the IDA(α, β).

[0005] (Dis3) The key K is divided into β multiple pieces, i.e., K1, K2, ..., Kp by means of the PSS (α, β) proposed by Shamir.

[0006] (Dis4) The divided pieces (Ei, Ki) are distributed to the players Pi (i = 1, 2, ..., β). It should be noted that each key Ki must be transmitted to the corresponding player Pi in secret.

[Reconstruction/decoding processing]



[0007] (Rec1) The players are called and instructed to present the α multiple pairs Sj (j represents an integer of α or less, and α represents an integer of β or less).

[0008] (Rec2) E is reconstructed based on the α multiple Ej pieces using the IDA.

[0009] (Rec3) K is reconstructed based on the α multiple Kj pieces using the PSS.

[0010] (Rec4) S is decoded from E using K.

Citation List


Patent Literature


[Non-patent document 1]



[0011] Krawczyk, H. "Secret sharing made short", CRYPTO'93, 1993.

Summary of Invention


Technical Problem



[0012] With the information division/dispersal storage methods according to the conventional techniques, the greatest feature is that all the pieces are divided equally. For example, with the dispersal processing in the method described in the Non-patent document 1, the number of Ei is the same as that of Ki. Furthermore, the pairs of pieces are generated such that all the different Ei are respectively combined with different Ki. Accordingly, each Ei has an equal weight. In the distribution, each player Pi receives the corresponding piece having an equal weight.

[0013] However, such equality provided by the information division/dispersal storage method leads to a restriction in practical operation. For example, let us consider a (3, 5)-type secret sharing method described in Non-patent document 1. In this example, the information is divided into five pieces. From among the five pieces thus divided, the original information can be reconstructed based on the three pieces. In this case, in a case in which three staff members who possess these three pieces resign at the same time and take out the files, and the three files fall into the hands of a malicious third party, this has the potential to cause information leakage. As described above, the advantage of the information division/dispersal storage method conventionally designed so as to attach importance to equality conversely becomes a problem from the viewpoint of organization management.

[0014] Furthermore, Non-patent document 1 proposes only the need to transmit the keys Ki to the players Pi in secret. That is to say, Non-patent document 1 proposes no satisfactory method for supporting a case in which information leakage of Ei or Ki has occurred.

[0015] Accordingly, it is a purpose of the present invention to provide a ciphertext management method or the like for supporting novel ciphertext data management by introducing inequality to the information dispersal/sharing storage method.

Solution of Problem



[0016]  A first aspect of the present invention relates to a ciphertext management method for managing ciphertext data. The ciphertext management method comprises: encrypting, by means of an encryption unit included in a ciphertext management apparatus, secret data using key data so as to generate the ciphertext data; dividing, by means of a dividing unit included in the ciphertext management apparatus, the ciphertext data and the key data so as to generate m (m represents an integer) pieces of divided ciphertext data and n (n represents an integer) pieces of divided key data; and linking, by means of a distribution unit included in the ciphertext management apparatus, the divided ciphertext data and the divided key data. In the linking, equal pairs are generated such that each piece of divided ciphertext data and each piece of divided key data are used only once to perform pairing. In addition, unequal pairs are generated such that one piece from among at least one from among the divided ciphertext data and the divided key data is used multiple times to perform pairing.

[0017] A second aspect of the present invention relates to the ciphertext management method according to the first aspect. In the dividing, the number of the pieces of divided ciphertext data differs from the number of pieces of the divided key data. In the linking, in a case in which n > m, the distribution unit respectively pairs the (m-1) pieces of divided ciphertext data with the (m-1) pieces of divided key data so as to generate (m-1) equal pairs, and pairs the other (n-m+1) pieces of divided ciphertext data with the remaining one piece of divided key data so as to generate (n-m+1) unequal pairs. In the linking, conversely, in a case in which n < m, the distribution unit respectively pairs the (n-1) pieces of divided ciphertext data with the (n-1) pieces of divided key data so as to generate (n-1) equal pairs, and pairs the remaining one piece of divided ciphertext data with the remaining (m-n+1) pieces of divided key data so as to generate (m-n+1) unequal pairs.

[0018] A third aspect of the present invention relates to the ciphertext management method according to the first or second aspect. In the dividing, the dividing unit divides the ciphertext data and the key data such that the ciphertext data can be reconstructed based on s (s represents an integer that is equal to or greater than 2 and that is smaller than m) pieces of divided ciphertext data, and such that the key data can be reconstructed based on t (t represents an integer that is equal to or greater than 2 and that is smaller than n) pieces of divided key data. In the linking, all the unequal pairs are generated such that the number of the pieces of divided ciphertext data to be used is smaller than s and/or the number of the pieces of divided key data to be used is smaller than t.

[0019] A fourth aspect of the present invention relates to a ciphertext data management apparatus configured to manage ciphertext data. The ciphertext data management apparatus comprises: an encryption unit configured to encrypt secret data using key data so as to generate the ciphertext data; a dividing unit configured to divide the ciphertext data and the key data into multiple pieces of divided ciphertext data and multiple pieces of divided key data; and a distribution unit configured to generate pairs of the piece of divided ciphertext data and the piece of divided key data. The pairs comprise: equal pairs generated such that each piece of divided ciphertext data and each piece of divided key data are used only once to perform pairing; and unequal pairs generated such that one piece from among at least one from among the divided ciphertext data and the divided key data is used multiple times to perform pairing.

[0020] A fifth aspect of the present invention relates to a computer program configured to instruct a computer to function as the ciphertext management apparatus according to the fourth aspect.

[0021]  It should be noted that the present invention may be configured as a computer-readable recording medium for storing the program according to the fifth aspect.

[0022] Also, the present invention may be configured including an holding operation in which the distribution unit instructs a holding apparatus to hold the pairs of the divided ciphertext data and the divided key data. Here, the holding apparatus may be configured as an information processing apparatus owned by a player such as a personal computer or a smartphone. Also, the holding apparatus may be configured as a server to be accessed by a player by means of communication. Also, the holding apparatus may be configured as a storage apparatus such as USB memory or the like that stores information.

[0023] For example, in a case in which the holding apparatus is configured as a server, when the server is accessed by a player, judgment is made regarding whether or not the player has been permitted to access the server via an appropriate user authentication. By controlling the access permission/prohibition, this arrangement is capable of protecting secret data from leakage.

[0024] Furthermore, by storing the equal pairs and the unequal pairs in different storage apparatuses at geographically different positions, and since the arrangement allows each player to reconstruct and decode the secret data based on the pieces of divided ciphertext data and the divided keys received from the multiple storage apparatuses according to the user's access rights, it provides a system with improved fault tolerance and disaster resistance.

Advantageous Effects of Invention



[0025] With each aspect of the present invention, in addition to the equal pairs, unequal pairs are generated. This provides novel security management based on the information dispersal/sharing storage method.

[0026] Description will be made regarding an example in which the pieces of divided ciphertext data and the pieces of divided key data are generated based on the (3,5)-type secret sharing scheme. In this example, the encrypted data and the key data are each divided into five pieces. The ciphertext data or the key data can be reconstructed based on three pieces of the corresponding divided data. In this case, the secret data can be reconstructed based on three equal pairs. This provides equality as with conventional techniques. In contrast, the secret data cannot be reconstructed even if three unequal pairs are acquired. That is because the three unequal pairs include the same piece of data. This provides inequality.

[0027] Furthermore, with the second aspect of the present invention, respective different pieces of divided ciphertext data or otherwise respective different pieces of divided key data are used to generate the unequal pairs. Accordingly, if leakage of the unequal information pairs occurs, judgement can be made regarding who has leaked the information.

[0028] Furthermore, with the third aspect of the present invention, even if all the unequal pairs are acquired, the number of the different pieces of divided ciphertext data is smaller than s and/or the number of the different pieces of divided key data is smaller than t. In this case, the secret data cannot be reconstructed. Accordingly, by protecting the equal pairs from leakage, this arrangement is capable of maintaining a secret state. This allows the security management burden to be dramatically reduced.

[0029] It should be noted that Shamir has proposed a hierarchical structure in which the number of pieces of data to be shared by a shared-data recipient is adjusted according to the level of importance of the shared-data recipient. In such a method proposed by Shamir, the upper-level recipient has a privilege to reconstruct the secret data by himself or herself. However, if a particular number of lower-level recipients cooperate with each other, the secret data can be reconstructed. Accordingly, this arrangement is not capable of protecting the secret data from leakage. In contrast, with the present invention, in order to protect the secret data from leakage, this arrangement provides a structure such that the lower-level recipients cannot generate the secret data by themselves even if this structure has the same hierarchical structure.

Brief Description of Drawings



[0030] 

Fig. 1 is a diagram showing an example of a ciphertext management system according to an embodiment of the present invention.

Fig. 2A is a block diagram showing a ciphertext management apparatus 3 shown in Fig. 1, Fig. 2B is a block diagram showing each server of a server group 5, and Fig. 2C is a block diagram showing an example of the configuration of each reconstruction apparatus of a reconstruction apparatus group 7.

Fig. 3A is a flowchart showing an example of the operation of the ciphertext management apparatus 3 shown in Fig. 1, Fig. 3B is a flowchart showing an example of the operation of the server, and Fig. 3C is a flowchart showing an example of the operation of each of a top reconstruction apparatus 21, a leader reconstruction apparatus 23, and a follower reconstruction apparatus 25.

Fig. 4 is a diagram showing a configuration of the ciphertext management system according to an example of the present invention.


Description of Embodiments



[0031] Description will be made below with reference to the drawings regarding an embodiment of the present invention. It should be noted that the embodiment of the present invention is by no means restricted to the following example.

[Example]



[0032] Description will be made assuming that an organization has a single team. The team has a leader and multiple followers. Furthermore, the top of the organization remotely manages the team.

[0033] Fig. 1 is a diagram showing an example of a ciphertext management system according to an embodiment of the present invention. A ciphertext management system 1 includes a ciphertext management apparatus 3 (an example of the "ciphertext management apparatus" in the present claims), a server group 5 (an example of the "holding apparatus" in the present claims), and a reconstruction apparatus group 7.

[0034] The server group 5 includes a top server group 11 and a leader server group 13.

[0035] The reconstruction apparatus group 7 includes a top reconstruction apparatus 21, a leader reconstruction apparatus 23, and follower reconstruction apparatuses 251, ..., 25r. It should be noted that, in some cases, the index appended to each reference symbol is omitted. Each reconstruction apparatus is configured as a personal computer or the like, to be used by the corresponding player. It should be noted that the ciphertext data, the key data, and the secret data are not stored on a hard disk or the like. Instead, such data is temporarily stored in memory or the like, in order to protect the data from leakage.

[0036] The top server group 11 is configured as a single server or otherwise multiple servers to be managed by the top. In a case in which a given player other then the top acquires permission from the top, the given player is able to access the information stored in the top server group 11. The top reconstruction apparatus 21 is a reconstruction apparatus to be used by the top.

[0037] The leader server group 13 is configured as a single server or otherwise multiple servers to be managed by the leader. In a case in which a given follower acquires permission from the leader, the given follower is able to access the information stored in the leader server group 13. The leader reconstruction apparatus 23 is a reconstruction apparatus to be used by the leader.

[0038] The follower reconstruction apparatuses 25 are each configured as a reconstruction apparatus to be used by the corresponding follower.

[0039] The ciphertext management apparatus 3 generates a ciphertext using the key data. Furthermore, the ciphertext management apparatus 3 divides the ciphertext data and the key data, and distributes pairs of the divided ciphertext data and the divided key data to the server groups 5 or the reconstruction apparatus group 7. The servers and the reconstruction apparatuses each receive the corresponding pair of the divided ciphertext data and the divided key data from the ciphertext management apparatus 3, and each store the data pair thus received. The reconstruction apparatus reconstructs the ciphertext data and the key data from the divided ciphertext data and the divided key data, and decodes the secret data from the ciphertext data using the key data. In the following description, in some cases, the term "data" will be omitted for simplicity of description. Here, "pairing" represents both a case in which two pieces of data are physically combined as a single unit ("link" as ordinarily used in the computer field) and a case in which two pieces of data are simply handled as a data pair ("link" as a general term).

[0040] Fig. 2A is a block diagram showing an example configuration of the ciphertext management apparatus 3. Fig. 2B is a block diagram showing an example configuration of each server of the server group 5. Fig. 2C is a block diagram showing an example configuration of each reconstruction apparatus of the reconstruction apparatus group 7. Fig. 3A is a flowchart showing an example of the operation of the ciphertext management apparatus 3. Fig. 3B is a flowchart showing an example of the operation of the server. Fig. 3C is a flowchart showing an example of the operation of each of the top reconstruction apparatus 21, the leader reconstruction apparatus 23, and the follower reconstruction apparatus 25.

[0041] Referring to Figs. 2A and 3A, description will be made regarding an example of the configuration and the operation of the ciphertext management apparatus.

[0042] The ciphertext management apparatus 31 includes a secret data storage unit 33, a key storage unit 35, a ciphertext storage unit 37, a divided ciphertext storage unit 39, a divided key storage unit 41, an encryption unit 43 (an example of the "encryption unit" in the present claims), a dividing unit 45 (an example of the "dividing unit" in the present claims), and a distribution unit 47 (an example of the "distribution unit" in the present claims).

[0043] The secret data storage unit 33 stores the secret data. The key storage unit 35 stores the key.

[0044] The encryption unit 43 encrypts the secret data using the key so as to generate a ciphertext (Step STM1). The ciphertext storage unit 37 stores the ciphertext thus generated.

[0045] The dividing unit 45 divides the ciphertext and the key, so as to generate the divided ciphertexts and the divided keys (Step STM2). The dividing unit 45 divides the ciphertext E into m multiple divided ciphertexts Eq (q = 1, ..., m) based on the (s, m)-type secret sharing scheme. The original ciphertext can be reconstructed based on s multiple pieces from among the m multiple divided ciphertexts Eq. Furthermore, the dividing unit 45 divides the key K into n multiple divided keys Kq (q = 1, ..., n) based on the (t, n)-type secret sharing scheme. The key can be reconstructed based on t multiple pieces from among the n multiple divided keys Kq. The divided ciphertext storage unit 39 stores the divided ciphertexts. The divided key storage unit 41 stores the divided keys. Here, "m" represents an integer, and "s" represents an integer that is equal to or greater than 2 and that is smaller than m. Moreover, "n" represents an integer, and "t" represents an integer that is equal to or greater than 2 and that is smaller than n. For simplicity of description, description will be made assuming that s = t and m > n hold true, the number of the divided ciphertexts is larger than that of the divided keys, and the key can be reconstructed based on the s multiple divided keys, as with the reconstruction of the ciphertext.

[0046] The distribution unit 47 generates pairs Sq (q = 1, ..., m) each of which is formed of the divided ciphertext and the divided key (Step STM3). Specifically, the pairs are generated such that Sq = (Eq, Kq) (q = 1, ..., n-1), and such that Sq = (Eq, Kn) (q = n, ..., m). That is to say, the pairs of Eq and Kq (q = 1, ..., n-1) are generated such that each piece of divided encrypted data Eq is paired with the corresponding different divided key data Kq. Such pairs thus generated such that each piece of divided encrypted data Eq is paired with the corresponding different piece of divided key data Kq will be referred to as "equal pairs". In contrast, the pairs of Eq (q = n, ..., m) and Kn are generated. In this case, Kn is used to generate multiple pairs. Such pairs generated such that a particular divided ciphertext and/or a particular divided key are/is used to generate multiple pairs will be referred to as "unequal pairs". The pairs Sq are generated as a combination of equal pairs and unequal pairs.

[0047] Subsequently, the distribution unit 47 distributes the pairs Sq to the servers and the reconstruction apparatuses (Step STM4).

[0048] The distribution unit 47 transmits s multiple pairs selected from among the equal pairs Sq (q = 1, ..., n-1) to the top server group 11. Furthermore, the distribution unit 47 transmits the (m-n+1) multiple unequal pairs to the top server group 11. The sop server group 11 stores the pairs Sq thus received. The secret data can be reconstructed based on the information stored in the top server group 11. It should be noted that a single server does not manage all the pairs. Instead, (s+m-n+1) multiple servers each store only a single pair. Also, in order to reduce the costs of the servers, each server may store multiple linked pieces of data so long as the number of the linked pieces of data to be stored in each server is smaller than a threshold value. Such an arrangement also prevents each server alone from encrypting and decoding the secret data. However, this arrangement leads to an increased risk from the viewpoint of security. In contrast, the unequal pairs have a common divided key Kn. Accordingly, the secret data cannot be reconstructed even if s multiple unequal pairs are acquired.

[0049] The distribution unit 47 transmits (s-1) or less multiple pairs from among the equal pairs to the leader server group 13. The leader server group 13 stores Sq thus received. Description will be made below regarding an example in which the (s-1) multiple pairs are transmitted to the (s-1) multiple servers, and each server stores the corresponding one pair. The secret data cannot be reconstructed based on the information stored in the leader server group 13.

[0050] In a case in which the information of one unequal pair is added to the information stored in the leader server group 13, the secret data can be reconstructed. Accordingly, the secret data can be reconstructed even if a malfunction occurs in the servers that each store an equal pair. That is to say, such an arrangement exhibits improved fault tolerance. It should be noted that, to be exact, the secret data can be reconstructed if the information of only one equal information pair that is not stored in the leader server group 13 is added. Accordingly, in this example, this arrangement requires only one pair as an additional piece of information from among the pairs stored in the top server group 11, which is not stored in the leader server group 13, to reconstruct the secret data after access permission is acquired.

[0051] Description will be made with reference to Figs. 2B and 3B regarding an example of the configuration and the operation of the server.

[0052] A server 61 includes a pair storage unit 63, a reception unit 65, and a transmission unit 67. The reception unit 65 receives a pair of the divided ciphertext and the divided key from the distribution unit 47 of the ciphertext management apparatus 31 (Step STS1), and stores the pair thus received in the pair storage unit 63 (Step STS2). Upon receiving a request from a reconstruction apparatus 71 having access permission, the transmission unit 67 transmits the pair of the divided ciphertext and the divided key to the reconstruction unit 71 (Step STS3).

[0053] Description will be made with reference to Figs. 2C and 3C regarding an example of the configuration and the operation of the reconstruction apparatus. The reconstruction apparatus 71 includes a divided ciphertext storage unit 73, a divided key storage unit 75, a ciphertext storage unit 77, a key storage unit 79, a secret data storage unit 81, a reception unit 83, a reconstruction unit 85, and a decoding unit 87. The secret data is displayed on an unshown display unit.

[0054] The reception unit 83 receives a pair of the divided ciphertext and the divided key from the server. The divided ciphertext storage unit 73 stores the divided ciphertext. The divided key storage unit 75 stores the divided key. The reconstruction unit 85 reconstructs the ciphertext and the key from the divided ciphertexts and the divided keys. The decoding unit 87 decodes the ciphertext stored in the ciphertext storage unit 77 using the key stored in the key storage unit 79, so as to generate the secret data. The secret data storage unit 81 stores the secret data.

[0055] Referring to Fig. 3C, description will be made regarding an example of the operation of the top reconstruction apparatus 21. The secret data can be reconstructed based on the information of the equal pairs. Accordingly, the reception unit 83 of the top reconstruction apparatus 21 accesses the top server group 11 so as to receive the equal pairs Sq (Step STF1). The divided ciphertexts and the divided keys thus received are stored in the divided ciphertext storage unit 73 and the divided key storage unit 75, respectively. The reconstruction unit 85 reconstructs the ciphertext and the key using the divided ciphertexts and the divided keys, and stores the ciphertext and the key thus reconstructed in the ciphertext storage unit 77 and the key storage unit 79, respectively (Step STF2). The decoding unit 87 decodes the ciphertext using the key so as to generate the secret data, and stores the secret data thus obtained in the secret data storage unit 81 (Step STF3).

[0056] Referring to Fig. 3C, description will be made regarding an example of the operation of the leader reconstruction apparatus 23. The reception unit 83 receives s multiple pairs Sq (Step STF1). First, the reception unit 83 receives (s-1) multiple pairs Sq stored in the leader server group 13. After receiving permission to access the servers from the top, the reception unit 83 receives a different single pair Sq. The reception unit 83 stores each divided ciphertext and each divided key thus received in the divided ciphertext storage unit 73 and the divided key storage unit 75, respectively. The reconstruction unit 85 reconstructs the ciphertext and the key using the divided ciphertexts and the divided keys, and stores each ciphertext and each key in the ciphertext storage unit 77 and the key storage unit 79, respectively (Step STF2). The decoding unit 87 decodes the ciphertext using the key so as to generate the secret data, and stores the secret data thus obtained in the secret data storage unit 81 (Step STF3).

[0057] Referring to Fig. 3C, description will be made regarding an example of the operation of the follower reconstruction apparatus 25. Initially, each follower has no access permission. With permission from the top and the leader, the follower acquires permission to access the servers only to receive the s multiple pairs. The reception unit 83 receives s multiple pairs Sq (Step STF1). For example, after the follower acquires permission from the top, the reception unit 83 receives the Sq, which is one from among the unequal pairs. The follower acquires permission to access the leader server group 13 from the leader. Subsequently, the follower accesses the servers managed by the leader so as to receive the remaining (s-1) multiple pairs Sq. The reception unit 83 stores the divided ciphertexts and the divided keys thus received in the divided ciphertext storage unit 73 and the divided key storage unit 75, respectively. The reconstruction unit 85 reconstructs the ciphertext and the key using the divided ciphertexts and the divided keys, and stores the ciphertext and the key thus reconstructed in the ciphertext storage unit 77 and the key storage unit 79, respectively (Step STF2). The decoding unit 87 decodes the ciphertext using the key so as to generate the secret data, and the secret data thus obtained is stored in the secret data storage unit 81 (Step STF3).

[0058] It should be noted that description has been made in the present embodiment regarding an example in which each server stores a pair of the divided ciphertext and the divided key, and supports the security management including the access control operation. For example, such a pair of the divided ciphertext and the divided key may be stored in a portable recording medium such as USB memory or the like. Also, the reconstruction apparatus may read out the pairs from such a recording medium so as to perform decoding processing or the like.

[0059] Next, referring to Fig. 4 and Table 1, description will be made regarding the present invention with reference to an example. The symbol IDA (t, m) represents an IDA scheme as proposed by Rabin in which the information is divided into m multiple pieces of information, and the original information can be regenerated using t multiple pieces of information. The symbol PSS(s, n) represents a PSS scheme as proposed by Shamir in which the information is divided into n multiple pieces of information, and the original information can be regenerated using t multiple pieces of information. Description will be made regarding an example in which the organization has one president (L1), one division manager (L2), and two staff members (L31 and L32).

[0060] First, description will be made with reference to Fig. 4 regarding an example of the configuration and the operation of the ciphertext management system in this example. A ciphertext management system 101 includes an information generating apparatus 103, a ciphertext management apparatus 105, a server group 107, a decryption apparatus 109, and a display apparatus 111.

[0061] The information generating apparatus 103 includes a plaintext storage unit 113 and a plaintext processing unit 115. The plaintext storage unit 113 stores the secret data. The plaintext processing unit 115 supports processing such as editing of the secret data. An author of the document generates a document using the information processing apparatus, and transmits the document thus generated to the ciphertext management apparatus 105 in order to encrypt the document.

[0062] The ciphertext management apparatus 105 includes an encryption unit 117, a dividing unit 119, and a distribution unit 121. The encryption unit 117, the dividing unit 119, and the distribution unit 121 operate in the same manner as those of the encryption unit 43, the dividing unit 45, and the distribution unit 47 shown in Fig. 2. This arrangement performs encryption processing and dividing processing for the secret data stored in the plaintext storage unit 113, so as to generate the divided ciphertexts and divided keys. The distribution unit 121 generates the pairs of the divided ciphertext and the divided keys, and distributes the pairs to the respective servers of the server group 107.

[0063] In this example, the server group 107 includes five servers, i.e., the server 1, ..., the server 5.

[0064] Specific description will be made regarding the dividing processing and the distribution processing. In this example, the threshold value is set to 2, and the division number for the ciphertext is set to 5, and the division number for the key is set to 4.

[0065] (Dis1) First, the secret key K is selected at random. The secret data S is encrypted using an encryption function ENC and the key K as represented by E = ENCK(S).

[0066] (Dis2) E is divided into five pieces, i.e., E1, E2, E3, E4, and E5 by means of the IDA(2, 5) .

[0067] (Dis3) The key K is divided into four pieces, i.e., K1, K2, K3, and K4 by means of the PSS(2, 4) as proposed by Shamir.

[0068] (Dis4) The pairs Sk are each generated as a pair of the dispersed ciphertext and the dispersed key. In this example, S1 = (E1, K1), S2 = (E2, K2), S3 = (E3, K3), S4 = (E4, K4), and S5 = (E5, K4), are generated.

[0069] (Dis5) The pairs Sk are distributed to the respective servers.

[0070] Table 1 shows the pairs of the divided ciphertext and the divided key each of which is to be stored in the corresponding server. The symbol "◆" represents a pair stored in each server. The symbol "↑" represents a pair Sk to be acquired by accessing a server managed by another player after acquiring permission from the manager.

[0071] The server 1 stores S1, the server 2 stores S2, the server 3 stores S3, the server 4 stores S4, and the server 5 stores S5. The player L1 manages access to the servers 1, 2, 4 and 5. The player L2 manages access to the server 3. The player L1 gives the player L2 permission to access the server 2. The player L1 gives the player L31 permission to access the server 4. The player L1 gives the player L32 permission to access the server 5. The player L2 gives the player L3 permission to access the server 3.
[Table 1]
 SERVER 1SERVER 2SERVER 3SERVER 4SERVER 5
[Ei,Ki] [E1,K1] [E2,K2] [E3,K3] [E4,K4] [E5,K4]
L1  
L2      
L31      
L32      


[0072] The player L1 (president) has two divided pieces of information that can be used to regenerate the secret information. Accordingly, the player L1 is able to regenerate the secret information at a desired timing. The player L2 (division manager) is not able to regenerate the secret information by himself/herself alone. The player L2 is required to use one divided piece of information from the server 2 managed by the president. The player L3 (staff member) is not able to regenerate the secret information by himself/herself alone. The player L3 is required to use one divided piece of information from the server 3 managed by the division manager. The two players L3 are not able to regenerate the secret information by themselves alone even if the divided pieces of information assigned to the two players L3 are used. This is because the divided pieces of information assigned to the two players L3, i.e., S4 = S(E4, K4) and S5 = S(E5, K4), have the same key. If the player L32 leaks his/her divided piece of information, the divided piece of information thus leaked includes E5. Accordingly, judgment can be made regarding who has leaked the divided piece of information.

[0073] The reconstruction apparatus 109 includes a reception unit 123, a reconstruction unit 125, and a decoding unit 127. The reception unit 123 transmits a download request to the server group. After the player is authenticated, the reception unit 123 downloads the pairs of the divided ciphertext and the divided key.

[0074] When the player L1 is authenticated as a user, the servers 1 and 2 permit downloading of the divided pieces of information stored therein. When the player L2 is authenticated as a user, the server 2 permits downloading of the divided piece of information stored therein. When the player L2 or L3 is authenticated as a user, the server 3 permits downloading of the divided piece of information stored therein. When the player L31 or L32 is authenticated as a user, the server 4 or 5 permits downloading of the divided piece of information stored therein.

[0075] The reconstruction unit 125 and the decoding unit 127 operate in the same manner as the reconstruction unit 85 and the decoding unit 87 shown in Fig. 2. Specifically, the ciphertext and the key are reconstructed from the divided ciphertexts and the divided keys thus downloaded, the number of which matches the threshold number. The original secret data is decoded using the ciphertext and the key thus reconstructed.

[0076] The display unit 111 displays the secret data thus decoded.

[0077] After the player L2 prohibits access by the player L3 to the server 3, each of the players L31 and L32 is not able to reconstruct the secret data by himself/herself alone. Furthermore, even if they cooperate with each other, they are not able to reconstruct the secret data because the divided pieces of information managed by them include the same key K4. That is to say, there is inequality. Accordingly, when an emergency such as information leakage has occurred, by disabling access to the server 3, this arrangement is capable of preventing information leakage.

[0078] It should be noted that, in Fig. 4, the information generating apparatus 103, the ciphertext management apparatus 105, and the reconstruction apparatus 109 may be configured as separate systems (personal computers). Also, in order to prevent information leakage in communication, such apparatuses may be configured as function components included in a single system (personal computer). When only viewing of information is to be performed, this begins with the reconstruction apparatus 109 transmitting a download request.

[0079] It should be noted that the present embodiment can be easily generalized. That is to say, description has been made in the present embodiment regarding a case in which the pairs of the divided ciphertext and the key are generated such that the unequal pairs have a single divided key and multiple divided ciphertexts. Also, the unequal pairs may have a single divided ciphertext and multiple different divided keys. Also, the unequal pairs may have multiple different divided keys and multiple different divided ciphertexts. It should be noted that, in the actual operation, it is assumed that such unequal pairs are to be accessed by players having the potential to cause information leakage. Accordingly, from the viewpoint of security management, the unequal pairs are preferably generated at least such that the number of the divided ciphertexts is smaller than "s" or such that the number of the divided keys is smaller than "t". With this arrangement, even if the players that are allowed to access the unequal pairs gather together, either the ciphertext or the key, or both cannot be reconstructed. Accordingly, in order to reconstruct the secret data, such a player must acquire permission to access the equal pairs. Thus, by appropriately managing the equal pairs, this arrangement supports security management.

[0080] For example, the ciphertext is divided based on the (3,7)-type secret sharing scheme, so as to generate the divided ciphertexts E1 through E7. The key is divided based on the (3,5)-type secret sharing scheme, so as to generate the divided keys K1 through K5. Subsequently, the equal pairs (E1, K1), (E2, K2), and (E3, K3) are generated. As the unequal pairs, the pairs (E4, K4), (E5, K4), (E6, K5), and (E7, K5) may be generated, for example. With this arrangement, the followers of team 1 may be permitted to access the pairs including the divided key K4, and the followers of team 2 may be permitted to access the pairs including the divided key K5, for example. That is to say, this arrangement is capable of supporting a horizontal organization structure having same-level divisions, in addition to a vertical hierarchical structure. Also, by generating the unequal pairs (E4, K4), ..., (E7, K4), (E4, K5), ..., (E7, K5), for example, this arrangement is capable of dramatically increasing the number of the unequal pairs.

[0081] Description has been made in the present embodiment regarding an arrangement in which the ciphertext and the key are respectively divided based on the IDA scheme and the PSS scheme according to the method proposed by Krawczyk. However, the present invention can be provided using any desired algorithm or method of secret sharing in which the secret data is divided into n multiple pieces, and the secret data can be reconstructed based on t multiple pieces thus divided. For example, a ramp scheme may be employed. For example, in 1997, Rivest proposed AONT, which is recognized as a safe (n,n)-type secret sharing method that is only computationally secure. Furthermore, AONT-RS has been proposed, in which RS coding is applied as post processing. The present invention can also be provided using AONT or AONT-RS. In this case, for example, the secret sharing proposed by Shamir is applied to the key of keyed-AONT, the initial value of which can be used as a private key.

Reference Signs List



[0082] 1 ciphertext management system, 3 ciphertext management apparatus, 5 server group, 7 reconstruction apparatus group, 11 top server group, 13 leader server group, 21 top reconstruction apparatus, 23 leader reconstruction apparatus, 25 follower reconstruction apparatus, 31 ciphertext management apparatus, 33 secret data storage unit, 35 key storage unit, 37 ciphertext storage unit, 39 divided ciphertext storage unit, 41 divided key storage unit, 43 encryption unit, 45 dividing unit, 47 distribution unit, 61 server, 63 pair storage unit, 65 reception unit, 67 transmission unit, 71 reconstruction apparatus, 73 divided ciphertext storage unit, 75 divided key storage unit, 77 ciphertext storage unit, 79 key storage unit, 81 secret data storage unit, 83 reception unit, 85 reconstruction unit, 87 decoding unit, 101 ciphertext management system, 103 information generating apparatus, 105 ciphertext management apparatus, 107 server group, 109 reconstruction apparatus, 111 display unit, 113 plaintext storage unit, 115 plaintext processing unit, 117 encryption unit, 119 dividing unit, 121 distribution unit, 123 reception unit, 125 reconstruction unit, 127 decoding unit.


Claims

1. A ciphertext management method for managing ciphertext data, comprising:

encrypting, by means of an encryption unit included in a ciphertext management apparatus, secret data using key data so as to generate the ciphertext data;

dividing, by means of a dividing unit included in the ciphertext management apparatus, the ciphertext data and the key data so as to generate m (m represents an integer) pieces of divided ciphertext data and n (n represents an integer) pieces of divided key data; and

linking, by means of a distribution unit included in the ciphertext management apparatus, the divided ciphertext data and the divided key data,

characterised in that, in the linking, equal pairs are generated such that each piece of divided ciphertext data and each piece of divided key data are used only once to perform pairing,

and wherein unequal pairs are generated such that one piece from among at least one from among the divided ciphertext data and the divided key data is used multiple times to perform pairing.


 
2. The ciphertext management method according to claim 1, wherein, in the dividing, the number of the pieces of divided ciphertext data differs from the number of pieces of the divided key data,
wherein, in the linking, in a case in which n > m, the distribution unit respectively pairs the (m-1) pieces of divided ciphertext data with the (m-1) pieces of divided key data so as to generate (m-1) equal pairs, and pairs the other (n-m+1) pieces of divided ciphertext data with the remaining one piece of divided key data so as to generate (n-m+1) unequal pairs,
and wherein, in the linking, in a case in which n < m, the distribution unit respectively pairs the (n-1) pieces of divided ciphertext data with the (n-1) pieces of divided key data so as to generate (n-1) equal pairs, and pairs the remaining one piece of divided ciphertext data with the remaining (m-n+1) pieces of divided key data so as to generate (m-n+1) unequal pairs.
 
3. The ciphertext management method according to claim 1 or 2, wherein, in the dividing, the dividing unit divides the ciphertext data and the key data such that the ciphertext data can be reconstructed based on s (s represents an integer that is equal to or greater than 2 and that is smaller than m) pieces of divided ciphertext data, and such that the key data can be reconstructed based on t (t represents an integer that is equal to or greater than 2 and that is smaller than n) pieces of divided key data,
and wherein, in the linking, all the unequal pairs are generated such that the number of the pieces of divided ciphertext data to be used is smaller than s and/or the number of the pieces of divided key data to be used is smaller than t.
 
4. A ciphertext data management apparatus configured to manage ciphertext data, the ciphertext data management apparatus comprising:

an encryption unit configured to encrypt secret data using key data so as to generate the ciphertext data;

a dividing unit configured to divide the ciphertext data and the key data into a plurality of pieces of divided ciphertext data and a plurality of pieces of divided key data; and

a distribution unit configured to generate pairs of the piece of divided ciphertext data and the piece of divided key data,

characterised in that the pairs comprise:

equal pairs generated such that each piece of divided ciphertext data and each piece of divided key data are used only once to perform pairing; and

unequal pairs generated such that one piece from among at least one from among the divided ciphertext data and the divided key data is used multiple times to perform pairing.


 
5. A computer program configured to instruct a computer to function as the ciphertext management apparatus according to claim 4.
 


Ansprüche

1. Geheimtextverwaltungsverfahren zum Verwalten von Geheimtextdaten, umfassend:

Verschlüsseln, mittels einer Verschlüsselungseinheit, die in einer Geheimtextverwaltungsvorrichtung beinhaltet ist, von geheimen Daten unter Verwendung von Schlüsseldaten, um so die Geheimtextdaten zu erzeugen;

Teilen, mittels einer Teilungseinheit, die in der Geheimtextverwaltungseinheit beinhaltet ist, der Geheimtextdaten und der Schlüsseldaten, um so m (m steht für eine Ganzzahl) Teile von geteilten Geheimtextdaten und n (n steht für eine Ganzzahl) Teile von geteilten Schlüsseldaten zu erzeugen; und

Verknüpfen, mittels einer Verteilungseinheit, die in der Geheimtextverwaltungseinheit beinhaltet ist, der geteilten Geheimtextdaten und der geteilten Schlüsseldaten,

dadurch gekennzeichnet, dass bei der Verknüpfung gleiche Paare so erzeugt werden, dass jeder Teil von geteilten Geheimtextdaten und jeder Teil von geteilten Schlüsseldaten nur einmal verwendet wird, um das Paaren durchzuführen,

und wobei ungleiche Paare so erzeugt werden, dass ein Teil von zumindest einem von den geteilten Geheimtextdaten und den geteilten Schlüsseldaten mehrere Male verwendet wird, um das Paaren durchzuführen.


 
2. Geheimtextverwaltungsverfahren nach Anspruch 1, wobei sich bei dem Teilen die Anzahl der Teile von geteilten Geheimtextdaten von der Anzahl von Teilen der geteilten Schlüsseldaten unterscheidet,
wobei bei dem Verknüpfen in einem Fall, bei dem n > m, die Verteilungseinheit jeweils die (m-1) Teile von geteilten Geheimtextdaten mit den (m-1) Teilen von geteilten Schlüsseldaten paart, um so (m-1) gleiche Paare zu erzeugen, und die anderen (n-m+1) Teile von geteilten Geheimtextdaten mit dem verbleibenden einen Teil von geteilten Schlüsseldaten paart, um so (n-m+1) ungleiche Paare zu erzeugen,
und wobei bei dem Verknüpfen in einem Fall, bei dem n < m, die Verteilungseinheit jeweils die (n-1) Teile von geteilten Geheimtextdaten mit den (n-1) Teilen von geteilten Schlüsseldaten paart, um so (n-1) gleiche Paare zu erzeugen, und den verbleibenden einen Teil von geteilten Geheimtextdaten mit den verbleibenden (m-n+1) Teilen von geteilten Schlüsseldaten paart, um so (m-n+1) ungleiche Paare zu erzeugen.
 
3. Geheimtextverwaltungsverfahren nach Anspruch 1 oder 2, wobei bei dem Teilen die Teilungseinheit die Geheimtextdaten und die Schlüsseldaten so teilt, dass die Geheimtextdaten basierend auf s (s steht für eine Ganzzahl, die gleich oder größer als 2 ist und die kleiner als m ist) Teilen von geteilten Geheimtextdaten rekonstruiert werden können, und so, dass die Schlüsseldaten basierend auf t (t steht für eine Ganzzahl, die gleich oder größer als 2 ist und die kleiner als n ist) Teile von geteilten Schlüsseldaten rekonstruiert werden können,
und wobei bei dem Verknüpfen alle ungleichen Paare so erzeugt werden, dass die Anzahl der zu verwendenden Teile von geteilten Geheimtextdaten kleiner als s ist und/oder die Anzahl der zu verwendenden Teile von geteilten Schlüsseldaten kleiner als t ist.
 
4. Geheimtextdatenverwaltungsvorrichtung, die dazu konfiguriert ist, Geheimtextdaten zu verwalten, wobei die Geheimtextdatenverwaltungsvorrichtung Folgendes umfasst:

eine Verschlüsselungseinheit, die dazu konfiguriert ist, geheime Daten unter Verwendung von Schlüsseldaten zu verschlüsseln, um so die Geheimtextdaten zu erzeugen;

eine Teilungseinheit, die dazu konfiguriert ist, die Geheimtextdaten und die Schlüsseldaten in eine Vielzahl von Teilen von geteilten Geheimtextdaten und eine Vielzahl von Teilen von geteilten Schlüsseldaten zu teilen; und

eine Verteilungseinheit, die dazu konfiguriert ist, Paare aus dem Teil von geteilten Geheimtextdaten und dem Teil von geteilten Schlüsseldaten zu erzeugen,

dadurch gekennzeichnet, dass die Paare Folgendes umfassen:

gleiche Paare, die so erzeugt werden, dass jeder Teil von geteilten Geheimtextdaten und jeder Teil von geteilten Schlüsseldaten nur einmal verwendet wird, um das Paaren durchzuführen; und

ungleiche Paare, die so erzeugt werden, dass ein Teil von zumindest einem von den geteilten Geheimtextdaten und dem geteilten Schlüsseldaten mehrere Male verwendet wird, um das Paaren durchzuführen.


 
5. Computerprogramm, das dazu konfiguriert ist, einen Computer anzuweisen, als die Geheimtextverwaltungsvorrichtung nach Anspruch 4 zu arbeiten.
 


Revendications

1. Procédé de gestion de texte chiffré pour gérer des données de texte chiffré, comprenant :

le chiffrage, au moyen d'une unité de chiffrement comprise dans un appareil de gestion de texte chiffré, des données secrètes à l'aide des données de clé de façon à générer les données de texte chiffré ;

la division, au moyen d'une unité de division comprise dans l'appareil de gestion de texte chiffré, des données de texte chiffré et des données de clé de façon à générer m (m représente un entier) blocs de données de texte chiffré divisées et n (n représente un entier) blocs de données de clé divisées ; et

la liaison, au moyen d'une unité de distribution comprise dans l'appareil de gestion de texte chiffré, des données de texte chiffré divisées et des données de clé divisées,

caractérisé en ce que, dans la liaison, des paires égales sont générées de sorte que chaque bloc de données de texte chiffré divisées et chaque bloc de données de clé divisées ne soient utilisés qu'une seule fois pour effectuer l'appariement,

et des paires inégales étant générées de sorte qu'un bloc parmi au moins un parmi les données de texte chiffré divisées et les données de clé divisées soit utilisé plusieurs fois pour effectuer l'appariement.


 
2. Procédé de gestion de texte chiffré selon la revendication 1, lors de la division, ledit nombre de blocs de données de texte chiffré divisées étant différent du nombre de blocs de données de clé divisées,
dans la liaison, dans un cas où n>m, ladite unité de distribution appariant respectivement les (m-1) blocs de données de texte chiffré divisées aux (m-1) blocs de données de clé divisées de façon à générer (m-1) paires égales, et appariant les autres (n-m+1) blocs de données de texte chiffré divisées au bloc restant de données de clé divisées de façon à générer (n-m+1) paires inégales,
et dans la liaison, dans un cas dans lequel n<m, ladite unité de distribution appariant respectivement les (n-1) blocs de données de texte chiffré divisées aux (n-1) blocs de données de clé divisées de façon à générer (n-1) paires égales, et appariant le bloc restant de données de texte chiffré divisées aux (m-n+1) blocs restants de données de clé divisées de façon à générer (m-n+1) paires inégales.
 
3. Procédé de gestion de texte chiffré selon la revendication 1 ou 2, lors de la division, ladite unité de division divisant les données de texte chiffré et les données de clé de sorte que les données de texte chiffré puissent être reconstruites sur la base de s (s représente un entier qui est supérieur ou égal à 2 et inférieur à m) blocs de données de texte chiffré divisées, et de sorte que les données de clé puissent être reconstruites sur la base de t (t représente un nombre entier qui est supérieur ou égal à 2 et inférieur à n) blocs de données de clé divisées,
et dans la liaison, toutes les paires inégales étant générées de sorte que le nombre de blocs de données de texte chiffré divisées à utiliser soit inférieur à s et/ou le nombre de blocs de données de clé divisées à utiliser soit inférieur à t.
 
4. Appareil de gestion de données de texte chiffré configuré pour gérer des données de texte chiffré, l'appareil de gestion de données de texte chiffré comprenant :

une unité de chiffrement configurée pour chiffrer des données secrètes à l'aide des données de clé de façon à générer les données de texte chiffré ;

une unité de division configurée pour diviser les données de texte chiffré et les données de clé en une pluralité de blocs de données de texte chiffré divisées et une pluralité de blocs de données de clé divisées ; et

une unité de distribution configurée pour générer des paires du bloc de données de texte chiffré divisées et du bloc de données de clé divisées,

caractérisé en ce que les paires comprennent :

des paires égales générées de sorte que chaque bloc de données de texte chiffré divisées et chaque bloc de données de clé divisées ne soient utilisés qu'une seule fois pour effectuer l'appariement ; et

des paires inégales générées de sorte qu'un bloc parmi au moins un parmi les données de texte chiffré divisées et les données de clé divisées soit utilisé plusieurs fois pour effectuer l'appariement.


 
5. Programme informatique configuré pour commander à un ordinateur de fonctionner en tant qu'appareil de gestion de texte chiffré selon la revendication 4.
 




Drawing