JP5274271B2 - SEARCH SYSTEM, INDEX ENCRYPTION DEVICE, SEARCH ENCRYPTION DEVICE, SEARCH DEVICE, COMPUTER PROGRAM, AND SEARCH METHOD - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enhance safety in confidential retrieval for retrieving such data that the d-number or more out of the n-number of index data are coincident with retrieval data. <P>SOLUTION: An index encrypting device 200 encrypts the n-number of index data to obtain the n-number of encrypted index data, and a retrieval device 400 accumulates the data. A retrieval encrypting device 300 encrypts the n-number of retrieval data using the value of a (d-1) order polynomial f(x) to obtain the n-number of encrypted retrieval data. The retrieval device 400 carries out retrieval using the value of a Lagrange's interpolation coefficient &Delta;<SB>i,S</SB>(x). <P>COPYRIGHT: (C)2010,JPO&amp;INPIT

Description

  The present invention relates to a secret search in which an encrypted index is searched with an encrypted search sentence in an encrypted state.

The secret search is a search in an encrypted state without decrypting the encrypted data when searching for desired data from a large amount of encrypted data.
In the secret search, the keyword used for the search is determined in advance as an index keyword, and the encrypted keyword is used to perform a search by specifying the search keyword, and the index keyword and the search keyword match are extracted. There is a method.

  Further, as a technique for realizing such a special encryption method, there is a method using a bilinear pairing map such as pairing on an algebraic curve.

JP 2005-500740 gazette JP 2007-114494 A

Dan Boneh, Matthew Franklin, “Identity-Based Encryption from The Weil Pairing”, Crypto 2001, LNCS 2139, 213-229, Springer-Verlag, 2001. Dan Boneh, Giovanni Di Crescenzo, Rafir Ostrovsky, Giuseppe Persiano, "Public Key Encryption with keyword Search, Vol. 4 to No. 40, No. 4", Euroc. Jonathan Katz, Amit Sahai, Brent Waters, “Predictate Encryption Supporting Discovery, Polynomial Equations, and Inner Products, Vol. 8 to No. 49, Eur.

When there are multiple types of index keywords, and you want to extract those that match a certain search keyword with a certain number or more, apply secret search when there is only one index keyword, and perform the set operation on the extracted set A method for obtaining a set of data to be extracted can be considered.
However, in this method, since all the keywords that match are known, there is a possibility that the security as the encryption method is lowered.
The present invention has been made, for example, in order to solve the above-described problems, and enhances the security as an encryption method by concealing as much as possible information about which keywords are matched when executing a search. With the goal.

A search system according to the present invention includes:
An index encryption device, a search encryption device, and a search device;
The index encryption device includes a storage device that stores data, a processing device that processes data, an index storage unit, and an index encryption unit,
The index storage unit stores n index data corresponding to n integers of 1 to n (n is an integer of 1 or more) using the storage device,
The index encryption unit encrypts the index data stored in the index storage unit for each of n integers of 1 to n using the processing device to obtain n encrypted index data,
The search encryption device includes a storage device that stores data, a processing device that processes data, a search storage unit, a polynomial value calculation unit, and a search encryption unit,
The search storage unit stores n search data corresponding to n integers of 1 to n using the storage device,
The polynomial value calculation unit uses the processing device to convert the integer into a (d-1) -degree univariate polynomial (d is an integer of 1 to n) for each of n integers of 1 to n. Is calculated as n polynomial values,
The search encryption unit uses the processing device to set the search data stored in the search storage unit and the polynomial value calculated by the polynomial value calculation unit for each of n integers of 1 to n. Is encrypted into n pieces of encrypted search data,
The search device includes a processing device that processes data, a storage device that stores data, an encryption index storage unit, an encrypted search storage unit, a determination target selection unit, an interpolation coefficient value calculation unit, and a mapping calculation. Part, a comparison calculation part, and a determination part,
The encrypted index storage unit uses the storage device to store n encrypted index data encrypted by the index encryption device;
The encrypted search storage unit stores n encrypted search data encrypted by the search encryption device using the storage device,
The determination target selection unit uses the processing device to select d integers from n integers of 1 to n to obtain d determination target integers,
The interpolation coefficient value calculation unit calculates a Lagrange interpolation coefficient value based on the d determination target integers selected by the determination target selection unit using the processing device, and obtains d interpolation coefficient values. age,
The mapping calculation unit uses the processing device to store the encrypted index data stored in the encrypted index storage unit and the encrypted search storage for each of the d determination target integers selected by the determination target selection unit. A set of encrypted search data stored by the unit and the interpolation coefficient value calculated by the interpolation coefficient value calculation unit to obtain d mapped data;
The comparison calculation unit calculates comparison data based on the d pieces of mapping data mapped by the mapping calculation unit using the processing device,
The determination unit uses the processing device to determine the index data, the search data, and the search data for the d determination target integers selected by the determination target selection unit based on the comparison data calculated by the comparison calculation unit. It is characterized by determining whether or not.

  According to the search system of the present invention, (d-1) the search data is encrypted using the value of the univariate polynomial of order (d-1), and the search is executed using the value of the Lagrange interpolation coefficient. When d or more of the data matches, the search device can determine that they match, and when only less than d data match, the search device cannot know which data matched. Thereby, it is possible to prevent leakage of information related to index data and search data.

1 is a system configuration diagram illustrating an example of an overall configuration of a search system 800 according to Embodiment 1. FIG. FIG. 3 is a perspective view illustrating an example of the appearance of a decryption device 810, an encryption device 820, and a server device 830 in Embodiment 1. 3 is a diagram illustrating an example of hardware resources of a decryption device 810, an encryption device 820, and a server device 830 in Embodiment 1. FIG. FIG. 2 is a block configuration diagram illustrating an example of a configuration of a setting device 100 according to the first embodiment. FIG. 3 is a block configuration diagram illustrating an example of a configuration of a search encryption apparatus 300 according to Embodiment 1. FIG. 3 is a block configuration diagram showing an example of the configuration of the index encryption device 200 according to the first embodiment. FIG. 3 is a block configuration diagram illustrating an example of a configuration of a search device 400 according to Embodiment 1. 2 is a block configuration diagram illustrating an example of a configuration of a data encryption device 840, an encrypted data storage device 850, and a data decryption device 860 according to Embodiment 1. FIG. FIG. 6 is a flowchart showing an example of a flow of setting processing S610 in the first embodiment. FIG. 6 is a flowchart showing an example of a flow of index encryption processing S630 in the first embodiment. FIG. 6 is a flowchart showing an example of a flow of search encryption processing S650 in the first embodiment. FIG. 6 is a flowchart showing an example of a flow of search execution processing S670 in the first embodiment. FIG. 4 is a block configuration diagram illustrating an example of a configuration of a setting device 100 according to a second embodiment. FIG. 6 is a block configuration diagram illustrating an example of a configuration of a search encryption device 300 according to Embodiment 2. FIG. 6 is a block configuration diagram showing an example of a configuration of an index encryption device 200 according to Embodiment 2. FIG. 9 is a block configuration diagram illustrating an example of a configuration of a search device 400 according to Embodiment 2. FIG. 10 is a flowchart showing an example of a flow of setting processing S610 in the second embodiment. FIG. 10 is a flowchart showing an example of a flow of index encryption processing S630 in the second embodiment. FIG. 10 is a flowchart showing an example of a flow of search encryption processing S650 in the second embodiment. FIG. 11 is a flowchart showing an example of a flow of search execution processing S670 in the second embodiment.

Embodiment 1 FIG.
The first embodiment will be described with reference to FIGS.

FIG. 1 is a system configuration diagram showing an example of the overall configuration of a search system 800 in this embodiment.
The search system 800 includes a decryption device 810, an encryption device 820, and a server device 830.
The encryption device 820 encrypts the data body (plain text data) and the index for keyword search of the data body and sends them to the server device 830. The server device 830 cannot decrypt the data body or index sent from the encryption device 820. The server device 830 stores the encrypted data body and the index while being encrypted. The decryption device 810 encrypts the search text for executing the keyword search and sends it to the server device 830. The server device 830 cannot decrypt the search text sent from the decryption device 810. The server device 830 searches the index stored in the encrypted form by using the encrypted search sentence, determines whether or not the index is hit, and returns the search result. In response to a request from the decryption device 810, the server device 830 sends a data body corresponding to the index hit in the search to the decryption device 810. The decryption device 810 decrypts the data body sent from the server device 830 and acquires the decrypted data body.

The data body is, for example, image data representing biometric information such as fingerprints, glows, and veins, e-mails, and other database records.
A predetermined number (hereinafter referred to as “index number n”) of indexes is attached to one data body. For example, with respect to image data, the position and size are normalized, and the value of each pixel is used as an index. For e-mail, the sender and date are used as an index. For the database, the data of each field is used as an index.
The search condition specifies a threshold value d and data corresponding to each index. A hit is determined when the number of matches between the contents of each index and the data designated for the index is equal to or greater than the threshold value d. For example, in the case of image data, hits are made when the values of pixels equal to or more than the number specified as the threshold value are hit, so that similar images can be searched.
Note that even if the specified data matches the index at a different position, it does not count as a match. For example, even if the data specified for searching for the sender of an email matches the destination of the email, it does not count as a match.

The decryption device 810 includes a setting device 100, a search encryption device 300, and a data decryption device 860.
The setting device 100 sets parameters necessary for encrypting or searching an index or a search sentence. The setting device 100 publishes a part of the set parameters (hereinafter referred to as “public parameter”) in the search system 800 and the other part (hereinafter referred to as “secret parameter”) for search encryption. The device 300 is notified secretly.
The search encryption device 300 holds the secret parameter (secret information) set by the setting device 100 in a secret manner. The search encryption device 300 inputs a search condition and encrypts a search sentence using a secret parameter or a public parameter (public information). The encrypted search text (hereinafter referred to as “encrypted search data”) is notified to the server device 830.
The data decryption device 860 decrypts the data body notified from the server device 830.

The encryption device 820 includes an index encryption device 200 and a data encryption device 840.
The index encryption device 200 encrypts the index using the public parameter set by the setting device 100.
The data encryption device 840 encrypts the data body. Note that the encryption method that the data encryption device 840 encrypts the data body and the data decryption device 860 decrypts may be an existing public key encryption method or a common key encryption method.
The encrypted index (hereinafter referred to as “encrypted index data”) and the encrypted data body are notified as a pair to the server device 830.

The server device 830 includes a search device 400 and an encrypted data storage device 850.
The search device 400 accumulates the encrypted index data notified from the encryption device 820 and executes a search using the encrypted search data notified from the decryption device 810.
The encrypted data storage device 850 stores the data body notified from the encryption device 820 in an encrypted state.

  The number of decryption devices 810, encryption devices 820, and server devices 830 is not limited to one, and may be two or more. When there are a plurality of decrypting devices 810, the encrypting device 820 encrypts the index data using the parameters set for each decrypting device 810. Therefore, the same number of encrypted index data as the number of decrypting devices 810 is generated for one index data. Further, the server device 830 stores the encrypted index data generated by the encryption device 820 for each decryption device 810, and in accordance with the request from each decryption device 810, the encrypted search data stored for the decryption device 810 Perform a search.

FIG. 2 is a perspective view showing an example of the external appearance of the decryption device 810, the encryption device 820, and the server device 830 in this embodiment.
The decryption device 810, the encryption device 820, and the server device 830 are a system unit 910, a display device 901 having a CRT (Cathode / Ray / Tube) or LCD (liquid crystal) display screen, a keyboard 902 (Key / Board: K / B). ), A mouse 903, an FDD 904 (Flexible / Disk / Drive), a compact disk device 905 (CDD), a printer device 906, a scanner device 907, and the like, which are connected by cables and signal lines.
The system unit 910 is a computer, and is connected to the facsimile machine 932 and the telephone 931 via a cable, and is connected to the Internet 940 via a local area network 942 (LAN) and a gateway 941.

FIG. 3 is a diagram illustrating an example of hardware resources of the decryption device 810, the encryption device 820, and the server device 830 in this embodiment.
The decryption device 810, the encryption device 820, and the server device 830 include a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, a processing unit, a microprocessor, a microcomputer, or a processor) that executes a program. . The CPU 911 is connected to the ROM 913, the RAM 914, the communication device 915, the display device 901, the keyboard 902, the mouse 903, the FDD 904, the CDD 905, the printer device 906, the scanner device 907, and the magnetic disk device 920 via the bus 912, and the hardware. Control the device. Instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of a storage device or a storage unit. A communication device 915, a keyboard 902, a scanner device 907, an FDD 904, and the like are examples of an input unit and an input device. Further, the communication device 915, the display device 901, the printer device 906, and the like are examples of an output unit and an output device.

The communication device 915 is connected to a facsimile machine 932, a telephone 931, a LAN 942, and the like. The communication device 915 is not limited to the LAN 942, and may be connected to the Internet 940, a WAN (wide area network) such as ISDN, or the like. When connected to a WAN such as the Internet 940 or ISDN, the gateway 941 is unnecessary.
The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924. The programs in the program group 923 are executed by the CPU 911, the operating system 921, and the window system 922.

The program group 923 stores programs that execute functions described as “˜units” in the description of the embodiments described below. The program is read and executed by the CPU 911.
The file group 924 includes information, data, signal values, variable values, and parameters that are described as “determination results of”, “calculation results of”, and “processing results of” in the description of the embodiments described below. Are stored as items of “˜file” and “˜database”. The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, Used for CPU operations such as calculation, calculation, processing, output, printing, and display. Information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory during the CPU operations of extraction, search, reference, comparison, operation, calculation, processing, output, printing, and display. Is remembered.
In addition, the arrows in the flowcharts described in the following description of the embodiments mainly indicate input / output of data and signals. The data and signal values are the RAM 914 memory, the FDD 904 flexible disk, the CDD 905 compact disk, and the magnetic field. The data is recorded on a recording medium such as a magnetic disk of the disk device 920, another optical disk, a mini disk, and a DVD (Digital Versatile Disk). Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In the description of the embodiments described below, what is described as “to part” may be “to circuit”, “to device”, and “to device”, and “to step” and “to”. “Procedure” and “˜Process” may be used. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as “to part” described below. Alternatively, the procedure or method of “to part” described below is executed by a computer.

  FIG. 4 is a block configuration diagram showing an example of the configuration of the setting device 100 according to this embodiment.

The setting device 100 includes a setting storage unit 110, a pairing value calculation unit 121, a secret generation unit 130, a public calculation unit 140, and a public output unit 150.
The setting storage unit 110 stores parameters representing basic settings of the search system 800 using the magnetic disk device 920 in advance. The parameter stored in the setting storage unit 110 may be determined in advance or may be set by the setting device 100.

また、元ｇが群Ｇ_１の単位元でなく、かつ、元ｈが群Ｇ_２の単位元でなければ、ｅ（ｇ，ｈ）は、群Ｇ_３の単位元ではない（非縮退性）。 The search system 800 performs cryptographic operations using groups. The group used by the search system 800 for the cryptographic operation is a group that can calculate the group operation using the CPU 911, for example, a group formed by points on the algebraic curve. In the following, group operations are described in a multiplicative manner. For example, the combination of element a and element b by group operation is called “product” and described as “a · b” or “ab”. Also, the inverse element of element a is described as “1 / a”, and the product of element a and inverse element 1 / b of element b is called “quotient” and is described as “a / b”. The product of m number of elements a is called “power” and is described as “a ^m ” or “a ^ m”. That is, “a ² = a · a”, “a ³ = a · a · a”, and “a ^m = a · a ··· a (m)”.
In the search system 800, three groups G ₁ , G ₂ , and G ₃ are used for cryptographic operations. All of the three groups G ₁ , G ₂ , and G ₃ are groups in which it is difficult to solve the discrete logarithm problem. Note that the group G ₁ and the group G ₂ may be the same group. The orders of the three groups G ₁ , G ₂ , G ₃ are all prime numbers p. Pairing mapping copy a set of the original and the original group _{G 2} group _{G 1} to the original group _{G 3 e: G 1 × G} 2 → G 3 is defined, using the CPU 911, can be calculated . An element of the group G ₃ obtained by mapping a pair of the element g of the group G ₁ and the element h of the group G ₂ by the pairing map e is described as “e (g, h)”. The pairing map e is bilinear and non-degenerate. That is, any element g of the group G _1, any element h of the group G _2, any integer a, the b, the following equation is satisfied (bilinearity).

If element g is not a unit element of group G ₁ and element h is not a unit element of group G ₂ , e (g, h) is not a unit element of group G ₃ (non-degenerate). .

In the following description, the integer arithmetic, unless otherwise stated, by the four arithmetic operations in finite field Z _p consisting of coset modulo to p. That is, addition / subtraction / multiplication is performed by calculating the remainder obtained by dividing the result of normal integer addition / subtraction / multiplication by p, and division is the reciprocal of the divisor (the result of multiplication with the divisor is 1). It is calculated by multiplying by (integer).

The setting device 100 may be configured to use a predetermined group G _{1 to} G ₃ , a pairing map e, or the like, or a security parameter k that is an index for determining the degree of safety is input and input. A configuration may be used in which groups G _{1 to} G ₃ , pairing map e, and the like used for cryptographic computation are defined based on security parameter k. In that case, the setting apparatus 100 publishes it as a part of public parameters such as the defined groups G _{1 to} G ₃ and the pairing map e.

The setting storage unit 110 includes a first generation source storage unit 111, a second generation source storage unit 112, a third generation source storage unit 113, and an index number storage unit 115.
The first generation source storage unit 111 stores the generation source g ₁ of the group G ₁ using the magnetic disk device 920. The second generation source storage unit 112 stores the generation source g ₂ of the group G ₂ using the magnetic disk device 920. The third generator storage unit 113 uses the magnetic disk device 920 to store the generator g ₃ of the group G ₃ . The index number storage unit 115 uses the magnetic disk device 920 to store the index number n. The index number n is an integer of 1 or more.

  The setting device 100 may have a configuration having an index number input unit. In that case, the index number input unit inputs the index number, and the index number storage unit 115 stores the index number input by the index number input unit.

The pairing value calculation unit 121 uses the CPU 911 to input the generation source g ₁ stored in the first generation source storage unit 111 and the generation source g ₂ stored in the second generation source storage unit 112. The pairing value calculation unit 121 uses the CPU 911 to calculate an element e (g ₁ , g ₂ ) obtained by mapping a pair of the generation source g ₁ and the generation source g ₂ by the pairing mapping e. Pairing value calculation unit 121, by using the CPU 911, the calculated original, and outputs as a generator _{g 3} groups _{G 3.} The third generation source storage unit 113 receives the generation source g ₃ of the group G ₃ output from the pairing value calculation unit 121 using the CPU 911 and stores it using the magnetic disk device 920.

The secret generation unit 130 uses the CPU 911 to generate a secret parameter. The secret generation unit 130 includes a secret integer generation unit 131 and a secret random number generation unit 132.
The secret integer generation unit 131 uses the CPU 911 to randomly generate an integer of 1 or more and less than p. Using the CPU 911, the secret integer generation unit 131 outputs the generated integer as a secret integer y.
Using the CPU 911, the secret random number generator 132 randomly generates an integer of 1 to less than p for each of n integers of 1 to n. Using the CPU 911, the secret random number generation unit 132 outputs the generated n integers as secret random numbers u _i (i is an integer between 1 and n).

The public calculation unit 140 uses the CPU 911 to calculate public parameters. The public calculation unit 140 includes a public source calculation unit 141 and a public random number source calculation unit 142.
Public element calculation unit 141, by using the CPU 911, and generates original _{g 3} groups _{G 3} to the third generation source storage unit 113 stores, inputs the secret integer y outputted secret integer generation unit 131. Public element calculation unit 141, by using the CPU 911, based on the origin _{g 3} entered secret integer y, to calculate the original _g ^{3 y} groups _{G 3} be a power y of the original _{g 3.} The publisher calculation unit 141 uses the CPU 911 to output the calculated source as the publisher Y.
The public random number source calculation unit 142 uses the CPU 911 to generate the generation source g ₁ of the group G ₁ stored in the first generation source storage unit 111 and the n secret random numbers u _i output from the secret random number generation unit 132. input. The public random number element calculation unit 142 uses the CPU 911 to calculate the element g _{1 to} the power of u _i based on the generator g ₁ and the corresponding secret random number u _i for each of n integers of 1 to n. An element [g ₁ ^ u _i ] of a certain group G ₁ is calculated. Using the CPU 911, the public random number element calculation unit 142 outputs the calculated n elements as public random number elements U _i (i is an integer of 1 to n).

The public output unit 150 publishes the public parameter calculated by the public calculation unit 140. The public output unit 150 includes a public source output unit 151 and a public random number source output unit 152.
The publisher output unit 151 uses the CPU 911 to input the publisher Y output from the publisher calculation unit 141. The publisher output unit 151 uses the CPU 911 to output the input publisher Y to the outside.
The public random number source output unit 152 uses the CPU 911 to input n public random number sources U _i output from the public random number source calculation unit 142. Using the CPU 911, the public random number source output unit 152 outputs the input n public random number sources U _i to the outside.
Since the group G ₁ and the group G ₃ are groups in which it is difficult to solve the discrete logarithm problem, even if the public source Y and the public random number source U _i are disclosed, the secret integer y and the secret random number u _i are transferred to a third party. Can not know.

FIG. 5 is a block configuration diagram showing an example of the configuration of the search encryption device 300 in this embodiment.
The search encryption apparatus 300 includes a setting storage unit 310, a secret storage unit 320, a search condition input unit 330, a threshold storage unit 341, a polynomial coefficient generation unit 342, a polynomial coefficient storage unit 343, a polynomial value calculation unit 344, and a search conversion unit 352. A search integer storage unit 353, a search source calculation unit 360, and an encrypted search output unit 370.

The setting storage unit 310 uses the magnetic disk device 920 to store basic settings of the search system 800, public parameters released by the setting device 100, and the like. The setting storage unit 310 includes a second generation source storage unit 312 and an index number storage unit 315.
The second generator storage unit 312 stores the generator g ₂ of the group G ₂ using the magnetic disk device 920. The index number storage unit 315 uses the magnetic disk device 920 to store the index number n.

The secret storage unit 320 stores the secret parameter set by the setting device 100 using a tamper-resistant storage device. The secret storage unit 320 includes a secret integer storage unit 321 and a secret random number storage unit 323.
The secret integer storage unit 321 stores the secret integer y generated by the setting device 100 using a tamper-resistant storage device. The secret random number storage unit 323 stores n secret random numbers u _i generated by the setting device 100 using a tamper-resistant storage device.

The search condition input unit 330 inputs a search condition using an input device such as a keyboard 902. The search condition input unit 330 includes a threshold value input unit 331 and a search input unit 332.
The threshold value input unit 331 inputs a threshold value d using an input device such as a keyboard 902. The threshold input unit 331 uses the CPU 911 to output the input threshold d.
The search input unit 332 uses an input device such as the keyboard 902 to input a character string having an arbitrary length for each of n integers of 1 to n. Using the CPU 911, the search input unit 332 outputs the input n character strings as a search character string ω _i (i is an integer of 1 to n).

The integer i corresponding to the search character string ω _i input by the search input unit 332 corresponds to the index number to be determined for matching. For example, when the first index indicates “name”, the second index indicates “gender”, and the third index indicates “age”, the search input unit 332 displays the first search character string ω ₁ as the user. you want to search by entering the "name", you want to search the user as the second search string ω ₂ enter the "sex", the user inputs the "age" you want to search as the third search string ω ₃ .
If an index with a certain number is not to be searched, the search input unit 332 does not input the search character string ω _i for the integer. In the above example, when it is desired to make “sex” unquestioned, the search input unit 332 does not input the _second search character string ω2. In this case, since the index with that number does not match the search character string, the threshold value input unit 331 inputs one less threshold value as the threshold value d.

  Using the CPU 911, the threshold storage unit 341 inputs the threshold d output from the threshold input unit 331. The threshold storage unit 341 stores the input threshold d using the magnetic disk device 920.

The polynomial coefficient generation unit 342 uses the CPU 911 to calculate 0 to less than p for each of (d−2) integers of 1 or more and (d−2) or less based on the threshold value d stored by the threshold storage unit 341. Generate integers one by one at random. The polynomial coefficient generation unit 342 uses the CPU 911 to randomly generate an integer of 1 or more and less than p for the integer (d−1). The polynomial coefficient generation unit 342 outputs the generated (d−1) integers as polynomial coefficients a _j (j is an integer of 1 or more and (d−1) or less).

Using the CPU 911, the polynomial coefficient storage unit 343 inputs (d−1) polynomial coefficients a _j output from the polynomial coefficient generation unit 342. Using the RAM 914, the polynomial coefficient storage unit 343 stores the input (d-1) polynomial coefficients a _j .

Using the CPU 911, the polynomial value calculation unit 344 inputs (d−1) polynomial coefficients a _j stored in the polynomial coefficient storage unit 343 and the secret integer y stored in the secret integer storage unit 321. The polynomial value calculation unit 344 uses the CPU 911 to set the polynomial coefficient a _j as the coefficient of the j-th term based on the input (d−1) polynomial coefficients a _j and the secret integer y. For a polynomial f (x) = Σ (a _j · x ^j ) + y with y as a constant term, a value obtained by substituting each of n integers of 1 to n for x is calculated. Using the CPU 911, the polynomial value calculation unit 344 outputs the calculated n values as a polynomial value f (i) (i is an integer between 1 and n).
Specifically, the polynomial value calculation unit 344 uses the CPU 911 to calculate the j-th power of the integer i for each of (d−1) integers j that are 1 or more and d−1 or less, and calculates the calculated integer i ^j And a polynomial coefficient a _j (a _j · i ^j ) is calculated. The polynomial value calculation unit 344 uses the CPU 911 to calculate the sum [Σ (a _j · i ^j ) + y] of the calculated (d−1) products (a _j · i ^j ) and the secret integer y. The polynomial value is f (i). The polynomial value calculation unit 344 repeats this for n integers i of 1 to n.

Using the CPU 911, the search conversion unit 352 inputs n search character strings ω _i output from the search input unit 332. The search conversion unit 352 uses the CPU 911 to calculate an integer obtained by mapping the search character string ω _i by using a predetermined mapping H for each of the n search character strings ω _i inputted. Using the CPU 911, the search conversion unit 352 outputs the calculated n integers as search integers η _i (where i is an integer between 1 and n).
The map H is a map that maps a character string of an arbitrary length to an integer of 1 or more and less than p. The map H has collision resistance. That is, for any two character strings, the probability that the integers copied by the mapping H are equal is extremely low. For example, the search conversion unit 352 uses a hash function as the mapping H. Alternatively, the search conversion unit 352, the hash function may be configured to enter a search string omega _i string by combining the integer i the search string omega _i is the number of [i‖ω _i] The reciprocal of the output of the hash function, a constant multiple of the output of the hash function, or the like may be used as an integer copied by the mapping H.

Note that if the search input unit 332 does not input the search character string ω _i for an integer, the search conversion unit 352 randomly generates an integer that is greater than or equal to 1 and less than p for the integer, and retrieves the search integer η _{Let i} .

The search integer storage unit 353 (search storage unit) uses the CPU 911 to input the n search integers η _i output by the search conversion unit 352. Using the magnetic disk device 920, the search integer storage unit 353 stores n input search integers η _i (search data).

The search source calculation unit 360 uses the CPU 911 to calculate n search sources T _i (i is an integer of 1 to n). The search source T _i is obtained by encrypting the search integer η _i and is a part of the encrypted search data. The search source calculation unit 360 includes an index calculation unit 361 and a power unit 366.
The exponent calculation unit 361 uses the CPU 911 to store n secret random numbers u _i stored in the secret random number storage unit 323, n polynomial values f (i) output from the polynomial value calculation unit 344, and a search integer storage The n search integers η _i stored in the unit 353 are input. Using the CPU 911, the exponent calculation unit 361 uses, based on the corresponding secret random number u _i , the corresponding polynomial value f (i), and the corresponding search integer η _i for each of n integers of 1 to n. Then, the product of the secret random number u _i and the search integer η _i, and the quotient f (i) / (u _i · η _i ) (i is an integer of 1 to n) obtained by dividing the polynomial value f (i). calculate. The exponent calculation unit 361 uses the CPU 911 to output the calculated n quotients.
Power unit 366, by using the CPU 911, and generates original _{g 2} groups _{G 2} to the second generation source storage unit 312 has stored, n-number of the quotient f the index calculating unit 361 outputs _(i) / _(u i · η _i ). The power unit 366 uses the CPU 911 to calculate the element g based on the generator g ₂ and the corresponding quotient f (i) / (u _i · η _i ) for each of n integers of 1 to n. calculating a _{second f (i) / (u i} · η i) th power in which the original group _{G 2.} Power unit 366, by using the CPU 911, and outputs the calculated n elements as search source _{T i.}

Using the CPU 911, the encrypted search output unit 370 outputs the encrypted search data to the outside. The encrypted search output unit 370 includes a threshold output unit 371 and a search source output unit 372.
Using the CPU 911, the threshold output unit 371 inputs the threshold d stored by the threshold storage unit 341. Using the CPU 911, the threshold output unit 371 outputs the input threshold d to the outside.
Search source output unit 372, using the CPU 911, inputs the n number of search source _{T i} that power unit 366 is output. Using the CPU 911, the search source output unit 372 outputs the input n search sources _Ti to the outside.

Incidentally, the encryption search output unit 370 combines the data representing the threshold value d threshold output unit 371 outputs, and the data representing the n-number of search source T _i output by the search source output unit 372 to one, It may be configured to output as encrypted search data (search text).

FIG. 6 is a block configuration diagram showing an example of the configuration of the index encryption device 200 in this embodiment.
The index encryption apparatus 200 includes a setting storage unit 210, an index input unit 221, an index conversion unit 223, an index integer storage unit 224, an index random number generation unit 230, a determination source calculation unit 240, an index source calculation unit 250, and an encrypted index output. Part 260.

The setting storage unit 210 stores basic settings of the search system 800 and public parameters disclosed by the setting device 100. The setting storage unit 210 includes an index number storage unit 215, a public source storage unit 216, and a public random number source storage unit 217.
The index number storage unit 215 uses the magnetic disk device 920 to store the index number n. The disclosure source storage unit 216 uses the magnetic disk device 920 to store the disclosure source Y set by the setting device 100. The public random number source storage unit 217 stores n public random number sources U _i set by the setting device 100 using the magnetic disk device 920.

The index input unit 221 inputs a character string (keyword) having an arbitrary length for each of n integers of 1 to n using an input device such as a keyboard 902. Using the CPU 911, the index input unit 221 outputs the input n character strings as index character strings w _i (i is an integer of 1 to n).
The index conversion unit 223 uses the CPU 911 to input the n index character strings w _i stored in the index input unit 221. Index conversion unit 223, using the CPU 911, for n indexed string _{w i} respectively inputted, the mapping H, calculates the integer obtained by mapping the index string _{w i.} Using the CPU 911, the index conversion unit 223 outputs the calculated n integers as index integers h _i (i is an integer of 1 to n).
The map H is the same map as the map used by the search conversion unit 352 and has collision resistance. Therefore, when the index character string w _i matches the search character string ω _i , the index integer h _i is equal to the search integer η _i, and when the index character string w _i does not match the search character string ω _i , The integer h _i and the search integer η _i are not equal.
Index integer storage unit 224 (index storage unit), using the CPU 911, inputs the n number of indexes integer _{h i} the index conversion unit 223 is output. Index integer storage unit 224, by using the magnetic disk device 920 stores the entered n number of indexes integral h _{i (index} data).

Note that less than n index character strings may be designated as indexes for some or all data bodies. In that case, the index input unit 221 does not input an index character string w _i for an integer that does not designate an index character string, and the index conversion unit 223 randomly generates an integer of 0 or more and less than p to generate an index integer h _i. And the index integer storage unit 224 stores it.

  The index random number generator 230 uses the CPU 911 to randomly generate an integer of 1 or more and less than p. Using the CPU 911, the index random number generation unit 230 outputs the generated integer as the index random number s.

The determination source calculation unit 240 uses the CPU 911 to calculate the determination source E ′. The determination source E ′ is obtained by encrypting the index random number s and is a part of the encrypted index data. The determination source calculation unit 240 includes a power unit 242.
The power unit 242 uses the CPU 911 to input the publication source Y stored in the publication source storage unit 216 and the index random number s output from the index random number generation unit 230. The power unit 242 uses the CPU 911 to calculate the element Y ^s of the group G ₃ that is the s power of the element Y based on the input disclosure element Y and the index random number s. The power unit 242 uses the CPU 911 to output the calculated element Y ^s as the determination element E ′.
Here, the public element Y, since it is the power of y original _{g 3,} determined based on E 'is a power of the original _{g 3} (s · y).

The index element calculation unit 250 uses the CPU 911 to calculate n index elements E _i (i is an integer of 1 to n). The index source E _i is obtained by encrypting the index integer h _i and is a part of the encrypted index data. The index element calculation unit 250 includes an index calculation unit 251 and a power unit 253.
Index calculating unit 251, using the CPU 911, the index integer storage unit 224 inputs the n number of indexes integer _{h i} which stores, and indexes random number s to the index random number generation unit 230 has output. The index calculation unit 251 uses the CPU 911 to calculate the product of the index random number s and the index integer h _i based on the index random number s and the corresponding index integer h _i for each of n integers of 1 to n. to calculate the s · _{h i.} Index calculating unit 251, using the CPU 911, and outputs the calculated n pieces of the product s · _{h i.}
The power unit 253 uses the CPU 911 to input the n public random number sources U _i stored in the public random number source storage unit 217 and the n products s · h _i output from the exponent calculation unit 251. Power unit 253, by using the CPU 911, for each 1 to n of n integers, the corresponding public random number based on _{U i,} corresponding on the basis of a product s · _{h i,} of the original _{U i} (s · calculating the h _i) th power in which the original group _{G 2.} The power unit 253 uses the CPU 911 to output the calculated n elements as the index element E _i .
Here, since the public random number element U _i is the u _i power of the element g ₁ , the index element E _i is the (s · h _i · u _i ) power of the element g ₁ .

Using the CPU 911, the encrypted index output unit 260 outputs the encrypted index data to the outside. The encrypted index output unit 260 includes an index source output unit 261 and a determination source output unit 262.
Using the CPU 911, the index source output unit 261 inputs the n index sources E _i output from the power unit 253. Using the CPU 911, the index source output unit 261 outputs the input n index sources E _i to the outside.
Using the CPU 911, the determination source output unit 262 inputs the determination source E ′ output from the power unit 242. Using the CPU 911, the determination source output unit 262 outputs the input determination source E ′ to the outside.

The encrypted index output unit 260 combines the data representing the n index sources E _i output from the index source output unit 261 and the data representing the determination source E ′ output from the determination source output unit 262 into one. It may be configured to be combined and output as encrypted index data (keyword ciphertext).

FIG. 7 is a block configuration diagram showing an example of the configuration of the search device 400 in this embodiment.
The search apparatus 400 includes an index number storage unit 415, an encrypted index storage unit 420, an encrypted search storage unit 430, a determination target selection unit 441, an interpolation coefficient value calculation unit 442, a mapping source calculation unit 450, a comparison source calculation unit 460, A determination unit 470 is included.

  The index number storage unit 415 uses the magnetic disk device 920 to store the index number n.

Using the magnetic disk device 920, the encrypted index storage unit 420 stores the encrypted index data output by the index encryption device 200. The encrypted index storage unit 420 stores one piece of encrypted index data for one data body. The encrypted index storage unit 420 includes an index source storage unit 421 and a determination source storage unit 422.
Using the magnetic disk device 920, the index source storage unit 421 stores n index sources E _i for each encrypted index data. The determination source storage unit 422 uses the magnetic disk device 920 to store one determination source E ′ for each encrypted index data.

Using the magnetic disk device 920, the encrypted search storage unit 430 stores the encrypted search data output by the search encryption device 300. The encrypted search storage unit 430 includes a threshold storage unit 431 and a search source storage unit 432.
The threshold storage unit 431 stores the threshold d using the magnetic disk device 920. Search source storage unit 432, by using the magnetic disk device 920 stores n pieces of retrieval source _{T i.}

Using the CPU 911, the determination target selection unit 441 selects a set S that is a subset of a set of n integers that are 1 or more and n or less and that includes d integers.
Using the CPU 911, the determination target selection unit 441 inputs the threshold value d stored in the threshold storage unit 431. The determination target selection unit 441 uses the CPU 911 to select d integers from n integers of 1 to n. Using the CPU 911, the determination target selection unit 441 outputs the selected d integers (set S).

集合Ｓはｄ個の元からなるので、ラグランジュの補間係数は変数ｘについて（ｄ−１）次の多項式である。
補間係数値算出部４４２は、ラグランジュの補間係数の変数ｘに０を代入したときの値Δ_ｉ，Ｓ（０）を算出する。
補間係数値算出部４４２は、ＣＰＵ９１１を用いて、判定対象選択部４４１が出力したｄ個の整数を入力する。補間係数値算出部４４２は、ＣＰＵ９１１を用いて、入力したｄ個の整数それぞれについて、ラグランジュの補間係数の値を算出する。補間係数値算出部４４２は、ＣＰＵ９１１を用いて、算出したｄ個のラグランジュの補間係数の値を補間係数値Δ_ｉ，Ｓとして出力する。
具体的には、判定対象選択部４４１が選択したｄ個の整数のうち、補間係数値を求める対象である整数を対象整数ｉとし、対象整数ｉ以外の（ｄ−１）個の整数を対象外整数ｊとすると、補間係数値算出部４４２は、ＣＰＵ９１１を用いて、（ｄ−１）個の対象外整数ｊそれぞれについて、対象外整数ｊから対象整数ｉを差し引いた差（ｊ−ｉ）を算出し、算出した差（ｊ−ｉ）で対象外整数ｊを割った商［ｊ／（ｊ−ｉ）］を算出する。補間係数値算出部４４２は、ＣＰＵ９１１を用いて、算出した（ｄ−１）個の商［ｊ／（ｊ−ｉ）］すべての総積Π［ｊ／（ｊ−ｉ）］を算出して、補間係数値Δ_ｉ，Ｓとする。 The interpolation coefficient value calculation unit 442 uses the CPU 911 to calculate the value of the Lagrange interpolation coefficient. The Lagrangian interpolation coefficient is defined by the following equation.

Since the set S consists of d elements, the Lagrange interpolation coefficient is a (d-1) degree polynomial for the variable x.
The interpolation coefficient value calculation unit 442 calculates a value Δ _{i, S} (0) when 0 is substituted for the variable x of the Lagrange interpolation coefficient.
The interpolation coefficient value calculation unit 442 uses the CPU 911 to input the d integers output from the determination target selection unit 441. Using the CPU 911, the interpolation coefficient value calculation unit 442 calculates a Lagrange interpolation coefficient value for each of the input d integers. Using the CPU 911, the interpolation coefficient value calculation unit 442 outputs the calculated d Lagrangian interpolation coefficient values as interpolation coefficient values Δ _{i, S.}
Specifically, among the d integers selected by the determination target selection unit 441, the integer that is the target for obtaining the interpolation coefficient value is the target integer i, and (d−1) integers other than the target integer i are the targets. When the outer integer j is used, the interpolation coefficient value calculation unit 442 uses the CPU 911 to calculate the difference (j−i) obtained by subtracting the target integer i from the non-target integer j for each of (d−1) non-target integers j. And the quotient [j / (j−i)] obtained by dividing the non-target integer j by the calculated difference (j−i). Using the CPU 911, the interpolation coefficient value calculation unit 442 calculates the total product Π [j / (j−i)] of all the calculated (d−1) quotients [j / (j−i)]. Interpolation coefficient value Δ _{i, S.}

Using the CPU 911, the mapping source calculation unit 450 (mapping calculation unit) calculates d mapping sources e ′ _i (mapping data). The mapping source calculation unit 450 includes a pairing value calculation unit 451 and a power unit 455.
Using the CPU 911, the pairing value calculation unit 451 uses the n index sources E _i stored in the index source storage unit 421 and the search source storage unit 432 for an index that is a target for determining whether or not the search condition is met. The n search sources T _i stored in are input. Pairing value calculation unit 451, by using the CPU 911, for 1 to n of n integers, the corresponding index based _{E i,} based on the corresponding search source _{T i,} an index based on _{E i} Search The element e (E _i , T _i ) of the group G ₃ obtained by mapping the pair with the element T _i by the pairing map e is calculated. Using the CPU 911, the pairing value calculation unit 451 outputs the calculated n elements e (E _i , T _i ) as a pairing value e _i (i is an integer between 1 and n).
Here, the index element E _i is the power of the element g _{1 to} the (s · hi _i · u _i ) power, and the search source T _i is the element g ₂ [f (i) / (u _i · η _i )]. Since it is a power, the pairing value e _i is the [f (i) · s · h _i / η _i ] power of the element g ₃ .

Using the CPU 911, the power unit 455 uses the d interpolation coefficient values Δ _{i, S} output from the interpolation coefficient value calculation unit 442 and the n pairing values e _i output from the pairing value calculation unit 451. The d pairing values e _i corresponding to the d interpolation coefficient values Δ _{i, S} (that is, corresponding to the d integers selected by the determination target selection unit 441) are input. Power unit 455, for each determination target selection unit 441 selects the d integers, and the corresponding interpolation coefficient value delta _{i, S,} on the basis of the corresponding pairing value e _i, the pairing value e _i delta _i, to calculate the original group _{G 3} be a power _S. The power unit 455 uses the CPU 911 to output the calculated d elements as the mapping element e ′ _i .

である。 The comparison source calculation unit 460 (comparison calculation unit) uses the CPU 911 to calculate the comparison source B (comparison data). The comparison source calculation unit 460 includes a total product unit 461.
Using the CPU 911, the total product unit 461 receives the d mapping sources e ′ _i output from the power unit 455. Total product unit 461, using the CPU 911, calculates a d number of elements e _'i all of the total product [pi [e' entered _i]. The total product unit 461 uses the CPU 911 to output the calculated total product Π [e ′ _i ] as the comparison source B.
Here, the comparison source B is

It is.

  The determination unit 470 uses the CPU 911 to determine the determination source E ′ stored in the determination source storage unit 422 for the index that is the target for determining whether or not the search condition is satisfied, and the comparison source B output from the total product unit 461. Enter. The determination unit 470 compares the input determination source E ′ and the comparison source B, and determines that the index meets the search condition if they match. Using the CPU 911, the determination unit 470 outputs the determined result as a search result.

とおく。ラグランジュの補間係数Δ_ｉ，Ｓ（ｘ）は、定義より明らかに、ｘ＝ｉのとき１、ｘ∈Ｓかつｘ≠ｉのとき０である。したがって、ｘ∈Ｓのとき、φ（ｘ）＝ｆ（ｘ）である。φ（ｘ）及びｆ（ｘ）は、ｘについての（ｄ−１）次多項式であり、ｄ個のｘについてφ（ｘ）＝ｆ（ｘ）であるから、φ（ｘ）≡ｆ（ｘ）である。したがって、

である。 here,

far. The Lagrange interpolation coefficient Δ _{i, S} (x) is apparently 1 by 1 when x = i, and 0 when x∈S and x ≠ i. Therefore, when xεS, φ (x) = f (x). φ (x) and f (x) are (d−1) degree polynomials for x, and φ (x) = f (x) for d xs, so φ (x) ≡f (x ). Therefore,

It is.

であるから、比較元Ｂは、判定元Ｅ’と一致する。 For all i∈S, if h _i = η _i , then the comparison source B is

Therefore, the comparison source B matches the determination source E ′.

であるから、Ｂ＝Ｅ’となるのは、

の場合のみである。この値は、０以上ｐ未満のランダムな値をとるから、０になる確率は１／ｐである。ｐは通常大きな数であるから、この確率は、極めて低い。 On the other hand, for any iεS, if h _i ≠ η _i , the probability of B = E ′ is very low. For example, if i ∈ S ′ (S ′ is a subset of S and not an empty set), and h _i ≠ η _i and h _i = η _i for other i∈S,

Therefore, B = E '

This is only the case. Since this value takes a random value of 0 or more and less than p, the probability of becoming 0 is 1 / p. Since p is usually a large number, this probability is very low.

  FIG. 8 is a block configuration diagram showing an example of the configuration of the data encryption device 840, the encrypted data storage device 850, and the data decryption device 860 in this embodiment.

The data encryption device 840 includes a main body storage unit 841, an encryption key storage unit 842, and a main body encryption unit 843.
The main body storage unit 841 stores the data main body (plain text data) using the magnetic disk device 920.
Using the magnetic disk device 920, the encryption key storage unit 842 stores an encryption key used for encrypting the data body.
Using the CPU 911, the main body encryption unit 843 inputs the data main body stored in the main body storage unit 841 and the encryption key stored in the encryption key storage unit 842. The main body encryption unit 843 uses the CPU 911 to encrypt the input data main body with the input encryption key. Using the CPU 911, the main body encryption unit 843 outputs the encrypted data body as an encrypted data body.
The encryption method used by the main body encryption unit 843 may be a general public key encryption method such as RSA encryption, a common common key encryption method such as AES encryption, or ID-based encryption. An encryption method such as Alternatively, the main body encryption unit 843 encrypts the data body using a common key encryption method using a randomly generated common key, and then uses the encryption key stored in the encryption key storage unit 842 to perform public key encryption. The common key may be encrypted by an encryption method such as a scheme, and the encrypted data body may be combined with the encrypted data body and the encrypted common key.

The encrypted data storage device 850 includes an encrypted main body storage unit 851, a search result input unit 852, and a search main body output unit 853.
The encrypted body storage unit 851 stores the encrypted data body output from the data encryption device 840 using the magnetic disk device 920.
Using the CPU 911, the search result input unit 852 inputs the search result output by the search device 400.
Using the CPU 911, the search main body output unit 853 stores the encrypted data main body associated with the index that meets the search condition based on the search result input by the search result input unit 852. Obtain from the encrypted data itself. Using the CPU 911, the search body output unit 853 outputs the acquired encrypted data body.

  Note that only whether or not the search hits is a problem. If there is no data body or if the search apparatus 400 stores the encrypted data body in a format combined with the encrypted index data, the encrypted data is stored. A configuration without the storage device 850 may be used.

The data decryption apparatus 860 includes a decryption key storage unit 861, a main body decryption unit 862, and a decryption main body output unit 863.
The decryption key storage unit 861 stores a decryption key corresponding to the encryption key stored by the data encryption device 840 using the magnetic disk device 920.
The main body decrypting unit 862 uses the CPU 911 to input the encrypted data main body output from the encrypted data storage device 850 and the decryption key stored in the decryption key storage unit 861. The body decrypting unit 862 uses the CPU 911 to decrypt the input encrypted data body using the input decryption key. The main body decoding unit 862 outputs the decoded data body as a decoded data body.
Using the CPU 911, the decrypted body output unit 863 inputs the decrypted data body output from the body decryptor 862. Using the CPU 911, the decrypted body output unit 863 outputs the input decrypted data body to the outside.

FIG. 9 is a flowchart showing an example of the flow of the setting process S610 in this embodiment.
In the setting process S610, the setting apparatus 100 sets parameters used in the search system 800. The setting process S610 includes a third generation source calculation step S611, a secret integer generation step S613, a disclosure source calculation step S615, an integer selection step S616, a secret random number generation step S617, a public random number source calculation step S619, and an integer repetition step S620.

In a third generation element calculation step S611, the pairing value calculation unit 121, by using the CPU 911, and a generator _{g 1} of the group _{G 1} of the first generation source storage unit 111 is stored, the second generation source storage unit 112 the stored based on the generated original _{g 2} groups _{G 2,} and calculates an element _e of the group _{G 3} which maps a set of the original _{g 1} from the original _{g 2} by pairing mapping e _(g 1, _{g 2)} , to the original _{g 3.}

  In the secret integer generation step S613, the secret integer generation unit 131 uses the CPU 911 to randomly generate an integer of 1 or more and less than p and set it as the secret integer y.

In the public element calculation step S615, the public element calculation unit 141, by using the CPU 911, the original _{g 3} pairing value calculation unit 121 is calculated in the third generation element calculation step S611, a secret integer generated by the secret integer generating step S613 based on the secret integer y which part 131 is generated, and calculates an element g ₃ ^y groups G ₃ be a power y of the original g _3, and public element Y.

  In the integer selection step S616, the secret random number generation unit 132 uses the CPU 911 to select integers one by one from n integers of 1 to n in order to obtain an integer i.

In the secret random number generation step S617, the secret random number generation unit 132 uses the CPU 911 to randomly generate an integer less than or equal to 1 and less than p for the integer i selected in the integer selection step S616 and set it as the secret random number u _i .

In the public random number source calculation step S619, the public random number source calculation unit 142 uses the CPU 911 to store the group G stored in the first generation source storage unit 111 for the integer i selected by the secret random number generation unit 132 in the integer selection step S616. _{Based on} the generator g _{1 of 1} and the secret random number u _i generated by the secret random number generator 132 in the second secret random number generation step S617, the element of the group G ₁ that is the u _i power of the element g ₁ is calculated. The public random number source U _i .

  In the integer repetition step S620, the secret random number generation unit 132 determines whether all integers greater than or equal to 1 and less than n have been selected in the integer selection step S616. If it is determined that there is an integer that has not yet been selected, the secret random number generation unit 132 returns to the integer selection step S616 and selects the next integer. If it is determined that all the integers have been selected, the setting apparatus 100 ends the setting process S610.

FIG. 10 is a flowchart showing an example of the flow of the index encryption processing S630 in this embodiment.
In the index encryption process S630, the index encryption apparatus 200 generates an encrypted index. The index encryption processing S630 includes an index random number generation step S631, a determination source calculation step S633, an integer selection step S635, an index integer calculation step S636, an index source calculation step S637, and an integer repetition step S638.

  In the index random number generation step S631, the index random number generation unit 230 uses the CPU 911 to randomly generate an integer greater than or equal to 1 and less than p to obtain an index random number s.

In the determination source calculation step S633, the power unit 242 uses the CPU 911 based on the disclosure source Y stored in the disclosure source storage unit 216 and the index random number s generated by the index random number generation unit 230 in the index random number generation step S631. Te, and calculates an element Y ^s of the group G ₃ be a power s of the original Y, and determines based on E '.

  In the integer selection step S635, the index conversion unit 223 uses the CPU 911 to select integers one by one from n integers of 1 to n in order to obtain an integer i.

In the index integer calculation step S636, the index conversion unit 223 uses the CPU 911 to calculate an integer obtained by mapping the index character string w _i input by the index input unit 221 using the mapping H for the integer i selected in the integer selection step S635. calculated and, to an index integer _{h i.}

In the index source calculation step S637, the index calculation unit 251 uses the CPU 911 to calculate the index random number s generated by the index random number generation unit 230 in the index random number generation step S631 and the index conversion unit 223 in the index integer calculation step S636. The product (s · h _i ) with the index integer h _i is calculated.
The power unit 253 uses the CPU 911 to calculate the public random number source U _i stored in the public random number source storage unit 217 and the product calculated by the exponent calculation unit 251 for the integer i selected by the index conversion unit 223 in the integer selection step S635. based on (s · _{h i)} and calculates the original _{U i} of (s · _{h i)} th power in which the original group _{G 1,} and an index based on _{E i.}

  In the integer repetition step S638, the index conversion unit 223 uses the CPU 911 to determine whether all integers of 1 or more and n or less have been selected in the integer selection step S635. If it is determined that there is an integer that has not yet been selected, the index conversion unit 223 returns to the integer selection step S635 and selects the next integer. If it is determined that all the integers have been selected, the index encryption apparatus 200 ends the index encryption process S630.

FIG. 11 is a flowchart showing an example of the flow of the search encryption process S650 in this embodiment.
In the search encryption process S650, the search encryption apparatus 300 generates an encrypted search sentence. The search encryption processing S650 includes an order selection step S651, a polynomial coefficient generation step S652, an order repetition step S653, a highest order coefficient generation step S654, an integer selection step S655, a search integer calculation step S656, a polynomial value calculation step S657, and a search source calculation. Step S659 has an integer repeating step S661.

  In the order selection step S651, the polynomial coefficient generation unit 342 uses the CPU 911 to sequentially select integers one by one from (d-2) integers of 1 to (d-2). j.

In the polynomial coefficient generation step S652, the polynomial coefficient generation unit 342 uses the CPU 911 to randomly select an integer of 0 or more and less than p for the integer j selected in the order selection step S651 to obtain a polynomial coefficient a _j .

  In the order repetition step S653, the polynomial coefficient generation unit 342 uses the CPU 911 to determine whether all integers greater than or equal to 1 and less than (d−2) are selected in the order selection step S651. When it is determined that there is an integer that has not yet been selected, the polynomial coefficient generation unit 342 returns to the order selection step S651 and selects the next integer. If it is determined that all the integers have been selected, the search encryption apparatus 300 proceeds to the highest order coefficient generation step S654.

In the highest-order coefficient generation step S654, the polynomial coefficient generation unit 342 uses the CPU 911 to randomly select an integer that is greater than or equal to ₁ and less than p for the integer (d−1) and sets it as the polynomial coefficient a _d−1 .

  In the integer selection step S655, the search conversion unit 352 uses the CPU 911 to select integers one by one from n integers of 1 to n in order to obtain an integer i.

In the search integer calculation step S656, the search conversion unit 352 uses the CPU 911 to calculate an integer obtained by mapping the search character string ω _i input by the search input unit 332 using the mapping H for the integer i selected in the integer selection step S655. Calculated as a search integer η _i .

In the polynomial value calculation step S657, the polynomial value calculation unit 344 uses the CPU 911 to generate the secret integer y stored in the secret integer storage unit 321 and the polynomial coefficient generation unit 342 in the polynomial coefficient generation step S652 (d-2). ) and number of polynomial coefficients a _j, the polynomial coefficient generator 342 in the highest order coefficient generation step S654 is based on the polynomial coefficients a _d-1 was generated, the polynomial coefficients a _j and a coefficient of j-th order term, secret integer A value obtained by substituting the integer i selected by the search conversion unit 352 in the integer selection step S655 into the univariate polynomial f (x) having y as a constant term coefficient is calculated as a polynomial value f (i).

In the search source calculation step S659, the index calculation unit 361 uses the CPU 911 to store the secret random number u _i stored in the secret random number storage unit 323 and the search integer for the integer i selected by the search conversion unit 352 in the integer selection step S655. Based on the search integer η _i calculated by the search conversion unit 352 in the calculation step S656 and the polynomial value f (i) calculated by the polynomial value calculation unit 344 in the polynomial value calculation step S657, the secret random number u _i and the search integer η _The quotient [f (i) / (u _i · η _i )] obtained by dividing the polynomial value f (i) by the product (u _i · η _i ) with _i is calculated.
The power unit 366 uses the CPU 911 to generate the generation source g ₂ of the group G ₂ stored in the second generation storage unit 312 and the exponent calculation unit 361 for the integer i selected by the search conversion unit 352 in the integer selection step S655. There based on the calculated quotient _{[f (i) / (u} i · η i)], the original _{g 2} a _{[f (i) / (u} i · η i)] th power at which the original group _{G 2} calculated and, as a search based on _{T i.}

  In the integer repetition step S661, the search conversion unit 352 uses the CPU 911 to determine whether all integers greater than or equal to 1 and less than n have been selected in the integer selection step S655. If it is determined that there is an integer that has not yet been selected, the search conversion unit 352 returns to the integer selection step S655 and selects the next integer. If it is determined that all the integers have been selected, the search encryption device 300 ends the search encryption processing S650.

FIG. 12 is a flowchart showing an example of the flow of search execution processing S670 in this embodiment.
In the search execution process S670, the search device 400 executes a search. Search execution processing S670 includes index selection step S671, integer selection step S672, pairing value calculation step S673, integer repetition step S674, determination selection step S675, determination integer selection step S676, interpolation coefficient value calculation step S677, power step S678, It has determination integer repetition process S679, total product process S680, determination process S681, determination repetition process S682, and index repetition process S683.

  In the index selection step S671, the pairing value calculation unit 451 uses the CPU 911 to sequentially select the encrypted index data one by one from the encrypted index data stored in the encrypted index storage unit 420.

  In the integer selection step S672, the pairing value calculation unit 451 uses the CPU 911 to select integers one by one from n integers of 1 to n in order to obtain an integer i.

In the pairing value calculation step S673, the pairing value calculation unit 451 uses the CPU 911 to store the index source E _i stored in the index source storage unit 421 for the encrypted index data selected in the index selection step S671, and the integer selection step. Based on the search source T _i stored in the search source storage unit 432 for the integer i selected in S672, the element of the group G ₃ in which the pair of the index source E _i and the search source T _i is mapped by the pairing map e Is calculated as a pairing value e _i .

  In the integer repetition step S674, the pairing value calculation unit 451 uses the CPU 911 to determine whether all integers of 1 or more and n or less have been selected in the integer selection step S672. If it is determined that there is an integer that has not yet been selected, the pairing value calculation unit 451 returns to the integer selection step S672 and selects the next integer. If it is determined that all the integers have been selected, the search device 400 proceeds to the determination selection step S675.

  In the determination selection step S675, the determination target selection unit 441 uses the CPU 911 to select d integers from n integers of 1 to n based on the threshold value d stored in the threshold storage unit 431. From the combinations, combinations are selected one by one in order, and set S is obtained.

  In the determination integer selection step S676, the interpolation coefficient value calculation unit 442 uses the CPU 911 to sequentially select integers one by one from the integers included in the set S selected by the determination target selection unit 441 in the determination selection step S675. And an integer i.

In the interpolation coefficient value calculation step S677, the interpolation coefficient value calculation unit 442 uses the CPU 911 to calculate the interpolation coefficient values Δ _{i, S} for the integer i selected in the determination integer selection step S676.

In the power step S678, the power unit 455 uses the CPU 911 to calculate the integer i selected by the interpolation coefficient value calculation unit 442 in the determination integer selection step S676 and calculated by the pairing value calculation unit 451 in the pairing value calculation step S673. Based on the pairing value e _i and the interpolation coefficient value Δ _{i, S} calculated by the interpolation coefficient value calculation unit 442 in the interpolation coefficient value calculation step S677, the group G is the Δ _{i, S} power of the pairing value e _{i. The element of 3} is calculated and set as a mapping element e ′ _i .

  In the determination integer repetition step S679, the interpolation coefficient value calculation unit 442 uses the CPU 911 to determine whether all the integers included in the set S have been selected in the determination integer selection step S676. If it is determined that there is an integer that has not yet been selected, the interpolation coefficient value calculation unit 442 returns to the determination integer selection step S676 and selects the next integer. If it is determined that all the integers have been selected, the search device 400 proceeds to the total product step S680.

In the total product step S680, the total product unit 461 uses the CPU 911 to calculate the total product of the d mapping sources e ′ _i calculated in the power step S678, and sets it as the comparison source B.

  In the determination step S681, the determination unit 470 uses the CPU 911, the determination source E ′ stored in the determination source storage unit 422 for the index selected by the pairing value calculation unit 451 in the index selection step S671, and the total product step S680. The comparison unit B calculated by the total product unit 461 is compared to determine whether or not they are equal. If it is determined that they are equal, the determination unit 470 uses the CPU 911 to determine that the index selected by the pairing value calculation unit 451 in the index selection step S671 matches the search condition, and proceeds to the index repetition step S683. If it is determined that they are not equal, the search device 400 proceeds to the determination repetition step S682.

  In the determination repetition step S682, the determination target selection unit 441 uses the CPU 911 to select, in the determination selection step S675, all combinations that select d integers from n integers of 1 to n. Determine whether or not. When it is determined that there is a combination that has not yet been selected, the determination target selection unit 441 returns to the determination selection step S675 and selects the next combination. If it is determined that all combinations have been selected, the determination unit 470 determines that the index selected by the pairing value calculation unit 451 in the index selection step S671 does not match the search condition, and proceeds to the index repetition step S683.

  In the index repetition step S683, the determination unit 470 uses the CPU 911 to output the determination result determined in the determination step S681 or the determination repetition step S682. Using the CPU 911, the pairing value calculation unit 451 determines whether or not all the encrypted index data stored in the encrypted index storage unit 420 has been selected in the index selection step S671. If it is determined that there is encrypted index data that has not yet been selected, the pairing value calculation unit 451 returns to the index selection step S671 and selects the next encrypted index data. If it is determined that all the encrypted index data have been selected, the search device 400 ends the search execution process S670.

As described above, for all the d integers included in the set S selected by the determination target selection unit 441 in the determination selection step S675, only when the index integer h _i matches the search integer η _i , Since the determination source E ′ is equal, d or more index character strings w _i out of the n index character strings w _i included in the index are the search character strings ω _i designated by the search encryption device 300. If they match, the determination unit 470 determines that the search condition is met.
At this time, the search device 400 can know d integers i in which the index character string w _i matches the search character string ω _i . In the search execution processing S670 described above, when the comparison source B and the determination source E ′ match in the determination step S681, determination is made for all combinations in which d integers are selected from n integers of 1 to n. Since (n−d) integers other than the d integers i included in the set S are clearly not determined whether or not the index character string w _i matches the search character string ω _i. However, even if the comparison source B and the determination source E ′ match in the determination step S681, the processing is continued, and comparison is made for all combinations in which d integers are selected from n integers of 1 to n. If it is configured to determine whether or not the element B and the determination source E ′ determine, the search apparatus 400 uses the index character string w _i and the search character string ω _{i for} all n integers of 1 to n. You can know whether or not That is, when d or more index character strings w _i and search character strings ω _i match, it is possible to know which data matches.

However, it is possible to know the index integer h _i and the search integer η _i from the index source E _i and the determination source E ′ stored in the encrypted index storage unit 420, the search source T _i stored in the encrypted search storage unit 430, and the like. Therefore, even if the reverse map H ⁻¹ of the map H is known, the matched index character string w _i and the search character string ω _i cannot be known.

In addition, for n integers less than d among n integers greater than or equal to 1 and less than or equal to n, if the index character string w _i matches the search character string ω _i and the others do not match, n equal to or greater than 1 and less than n The comparison source B does not match the determination source E ′ for all combinations that select d integers from the integers. Therefore, it is not possible to know which data matches.

In addition to the elements of the index integer h _i determined by the index character string w _i , the index element E _i includes elements of random index random numbers s that differ for each index. Therefore, even if the index string w _i of the index string w _i and another index of a index was the same, the index based on E _i is different for each index, whether the index string w _i are the same The information is hidden.

Some index string w _i is, there is and it can be seen that match the search string ω _i in the search conditions, and the index string w _i in a certain index, whether the index string or w _i and is the same in other index Can know. This can be a clue to deciphering the index string w _i . If clues increase by repeating the search with various search conditions many times, the index character string w _i and eventually the data body may be decoded.
For this reason, it is preferable that information regarding whether or not a certain index character string w _i matches a search character string ω _i in a certain search condition is not known as much as possible.

In the search system 800 according to this embodiment, the index character string w _i matches the search character string ω _i for n integers less than d out of n integers greater than or equal to 1 and less than or equal to n. , Information about which index character string w _i matches the search character string ω _i can be concealed. For this reason, it is possible to minimize the clue of leakage to decipher the index string w _i.

The search system 800 in this embodiment includes an index encryption device 200, a search encryption device 300, and a search device 400.
The index encryption device 200 includes a storage device (magnetic disk device 920) for storing data, a processing device (CPU 911) for processing data, an index storage unit (index integer storage unit 224), and an index encryption unit ( Index source calculation unit 250).
The index storage unit stores n index data (index integer h _i ) corresponding to n integers (n is an integer of 1 or more) using the storage device.
The index encryption unit encrypts the index data stored in the index storage unit for each of n integers of 1 to n using the processing device, so that n encrypted index data (index source E _i ).
The search encryption device 300 includes a storage device (magnetic disk device 920) for storing data, a processing device (CPU 911) for processing data, a search storage unit (search integer storage unit 353), and a polynomial value calculation unit 344. And a search encryption unit (search source calculation unit 360).
The search storage unit stores n search data (search integer η _i ) corresponding to n integers of 1 to n using the storage device.
The polynomial value calculation unit 344 uses the processing device to calculate (d−1) -order univariate polynomial f (x) (d is an integer of 1 to n) for each of n integers of 1 to n. .)), The value obtained by substituting the integer is calculated as n polynomial values f (i).
The search encryption unit uses the processing device to store the search data stored in the search storage unit and the polynomial value f ( The pair with i) is encrypted to obtain n encrypted search data (search source T _i ).
The search device 400 includes a processing device (CPU 911) that processes data, a storage device (magnetic disk device 920) that stores data, an encrypted index storage unit 420, an encrypted search storage unit 430, and a determination target selection. Unit 441, interpolation coefficient value calculation unit 442, mapping calculation unit (mapping source calculation unit 450), comparison calculation unit (comparison source calculation unit 460), and determination unit 470.
The encrypted index storage unit 420 stores n pieces of encrypted index data (index source E _i ) encrypted by the index encryption apparatus 200 using the storage device.
The encrypted search storage unit 430 stores n pieces of encrypted search data (search source T _i ) encrypted by the search encryption device 300 using the storage device.
The determination target selection unit 441 uses the processing device to select d integers from n integers equal to or greater than 1 and equal to or less than n to obtain d determination target integers.
The interpolation coefficient value calculation unit 442 calculates the value of the Lagrange interpolation coefficient based on the d determination target integers selected by the determination target selection unit 441 using the processing device, and calculates d interpolations. The coefficient value is Δ _{i, S.}
The mapping calculation unit uses the processing apparatus to store the encrypted index data stored in the encrypted index storage unit 420 for each of the d determination target integers selected by the determination target selection unit 441, and the encryption A set of the encrypted search data stored in the search storage unit 430 and the interpolation coefficient value calculated by the interpolation coefficient value calculation unit 442 is mapped to obtain d mapping data (mapping source e ′ _i ).
The comparison calculation unit calculates comparison data (comparison source B) based on the d pieces of mapping data mapped by the mapping calculation unit using the processing device.
The determination unit 470 uses the processing device to calculate the index data and the search for the d determination target integers selected by the determination target selection unit 441 based on the comparison data calculated by the comparison calculation unit. It is determined whether or not the data matches.

According to the search system 800 in this embodiment, the search data is encrypted using the value f (i) of the (d−1) -order univariate polynomial f (x), and the value of the Lagrange interpolation coefficient Δ _{i , S} is used to perform a search, so that when d or more of n pieces of data match, the search apparatus 400 can determine that they match, and if less than d matches, The search device 400 cannot know whether the data matches. Thereby, it is possible to prevent leakage of information related to index data and search data.

In the search system 800 in this embodiment, the interpolation coefficient value calculation unit 442 uses the processing device (CPU 911) to calculate one of the d determination target integers selected by the determination target selection unit 441. The target integer i is set, and (d−1) determination target integers other than the target integer among the d determination target integers selected by the determination target selection unit 441 are (d−1) non-target integers j. , (D−1) for each non-target integer j, the quotient [j / (j) obtained by dividing the non-target integer j by the difference (j−i) obtained by subtracting the target integer i from the non-target integer j. −i)], and the total product Π [j / (j−i)] of the calculated (d−1) quotients is calculated, and the interpolation coefficient value Δ _{i, S} for the target integer i To do.

According to the search system 800 in this embodiment, the Lagrange interpolation coefficient in the case where the value obtained by substituting the d determination target integers selected by the determination target selection unit 441 for the unknown variable function is known. Since the interpolation coefficient value calculation unit 442 calculates a value when 0 is substituted for the Lagrange interpolation coefficient to obtain the interpolation coefficient value Δ _{i, S} , the d determination target integers selected by the determination target selection unit 441 When the index data matches the search data, the comparison source B becomes a value corresponding to the value f (0) when 0 is substituted into the univariate polynomial f (x). By using this, the search device 400 determines whether or not the index data and the search data match for the d determination target integers selected by the determination target selection unit 441.

In the search system 800 in this embodiment, the polynomial value calculation unit 344 uses the processing device (CPU 911) to set the predetermined polynomial integer y as a constant term of the univariate polynomial f (x) and the polynomial value. f (i) is calculated.
The index encryption unit (determination source calculation unit 240) encrypts the index data based on the data (public source Y) obtained by encrypting the secret integer y.

  According to the search system 800 in this embodiment, the search encryption device 300 uses the secret variable y as a constant term of the (d−1) -degree univariate polynomial f (x), so that the secret integer y Information is embedded in n polynomial values f (i). Therefore, if d or more of n polynomial values f (i) can be known, the secret integer y can be obtained. The search device 400 does not directly determine the secret integer y, but when the index data and the search data match for the d determination target integers selected by the determination target selection unit 441, the d polynomial values f The encrypted data corresponding to the secret integer y can be obtained from the encrypted data corresponding to (i). By using this, the search device 400 determines whether or not the index data and the search data match for the d determination target integers selected by the determination target selection unit 441.

The search system 800 in this embodiment further includes a setting device 100.
The setting apparatus 100 includes a secret integer generation unit 131 and a public source calculation unit 141.
The secret integer generation unit 131 randomly generates an integer of 1 or more and less than p (p is a prime number) using the processing device, and sets it as a secret integer y.
The public source calculation unit 141 uses the processing device to generate a secret integer generated by the secret integer generation unit 131 by a first mapping that injects an integer of 0 or more and less than p into a group of order p. The element which mapped y is calculated and set as the publication source Y.
The index encryption apparatus 200 includes a public source storage unit 216, an index integer storage unit 224, an index source calculation unit 250, and a determination source calculation unit 240.
The publisher storage unit 216 stores the publisher Y calculated by the setting device 100 using the storage device.
The index integer storage unit 224, using the storage device, an integer less than n 1-or p, is stored as an index integer h _i corresponding to each 1 to n of the n integers i.
The index element calculation unit 250, using the processing device, for each 1 to n of the n integers i, based on an index integer h _i where the index integral storage unit 224 stores, from 0 to less than p An element that maps the index integer h _i is calculated by a second mapping that injects the integer onto the group of the order p, and is set to n index elements E _i .
The determination source calculation unit 240 uses the processing device to inject the elements of the group of order p into the elements of the group of order p based on the disclosure source Y stored in the disclosure source storage unit 216. Based on the third mapping, an element that maps the publication source Y is calculated as a determination source E ′.
The search encryption apparatus 300 includes a secret integer storage unit 321, a search integer storage unit 353, a polynomial coefficient generation unit 342, and a search source calculation unit 360.
The secret integer storage unit 321 stores the secret integer y generated by the setting device 100 using the storage device.
Using the storage device, the search integer storage unit 353 stores n integers from 1 to less than p as search integers η _i corresponding to n integers from 1 to n.
The polynomial coefficient generation unit 342 randomly generates (d−1) integers of 0 or more and less than p using the processing device, and sets them as (d−1) polynomial coefficients a _j .
The polynomial value calculation unit 344 uses the processing device to set the secret integer y stored in the secret integer storage unit 321 as a constant term of the univariate polynomial f (x) and generate the polynomial coefficient generation unit 342. The polynomial value f (i) is calculated using the (d−1) polynomial coefficients a _j as the coefficients of the respective terms from the first order to the (d−1) th order of the univariate polynomial f (x). .
The search source calculation unit 360 uses the processing device to store the search integer η _i stored in the search integer storage unit 353 and the polynomial value calculation unit 344 for each of the n integers 1 to n. Based on the calculated polynomial value f (i), a fourth mapping that maps a set of integers greater than or equal to 1 and less than p and integers greater than or equal to 0 and less than p to a group of order p is used to obtain the search integer η to calculate the _i and the original that maps the set of the above polynomial solutions f (i), and n number of search source T _i.
The search device 400 includes an index source storage unit 421, a determination source storage unit 422, a search source storage unit 432, a mapping source calculation unit 450, and a comparison source calculation unit 460.
The index source storage unit 421 stores n index sources E _i calculated by the index encryption device 200 using the storage device.
The determination source storage unit 422 stores the determination source E ′ calculated by the index encryption device 200 using the storage device.
The search source storage unit 432 stores n search sources T _i calculated by the search encryption device 300 using the storage device.
The mapping source calculation unit 450 uses the processing device to store the index source E _i stored in the index source storage unit 421 for each of the d determination target integers i selected by the determination target selection unit 441, and the above Search and retrieval source T _i of source storage unit 432 has stored, on the basis of the interpolation coefficient value delta _{i, S} where the interpolation coefficient value calculation unit 442 calculates, in a group of order p source and order of the group of p By a fifth mapping that maps a set of elements and integers greater than or equal to 0 and less than p to a group of order p, the index element E _i , the search source T _i, and the interpolation coefficient value Δ _{i, S} The element which mapped the set is calculated, and d mapping elements e ′ _i are obtained.
The comparison element calculation unit 460 calculates an element obtained by combining the d mapping elements e ′ _i calculated by the mapping element calculation unit 450 by the group operation using the processing device, and sets the comparison element B as the comparison element B.
The determination unit 470 selects the determination target when the comparison source B calculated by the comparison source calculation unit 460 and the determination source E ′ stored by the determination source storage unit 422 are equal using the processing device. For the d determination target integers i selected by the unit 441, it is determined that the index integer h _i matches the search integer η _i .

  According to the search system 800 in this embodiment, since encryption processing is performed using a group whose order p is a prime number, there are many types of groups and mappings that can be used, and a highly secure system is constructed. can do.

If the first mapping here is φ ₁ , the second mapping is φ ₂ , the third mapping is φ ₃ , the fourth mapping is φ ₄ , and the fifth mapping is φ ₅ , then this implementation Maps φ _{1 to} φ ₅ used in the form are defined by the following equations.

That is, the first mapping φ ₁ is a mapping that maps an integer of 0 or more and less than p to the element of the group G ₃ of order p, and maps the integer x to the power of the element e (g ₁ , g ₂ ). . Since p is a prime number, element g ₁ is not a unit element of group G ₁ , element g ₂ is not a unit element of group G ₂ , and pairing map e is bilinear and non-degenerate, element e (g ₁ , g ₂ ) is not a unit element of group G ₃ . Therefore, the first map φ ₁ is bijective, and is an isomorphism from the group to the group G ₃ formed by addition with an integer modulo p.
The second mapping φ ₂ is a mapping that maps an integer of 0 or more and less than p to an element of the group G ₁ of order p, and converts the integer x to the power of the element [g ₁ raised to the (u _i · s) power] x Copy to. Since the generator g ₁ is not a unit element of the group G ₁ and the secret random number u _i and the index random number s are not 0, the element [g ₁ raised to the power of (u _i · s)] is not a unit element of the group G ₁ . Therefore, the second map φ ₂ is bijective, and is an isomorphism from the group to the group G ₁ formed by addition in which the integer modulo p.
Third mapping phi ₃ is a mapping which maps the original group G ₃ of order p to order p group G ₃ of the original, the original X, copy to the original X s ride. The index random number s is not 0. Therefore, the third map φ ₃ is bijective and is an automorphism map of the group G ₃ .
The fourth mapping φ ₄ is a mapping that maps a set of integers greater than or equal to 1 and less than p and integers greater than or equal to 0 and less than p to the group G ₂ of order p, and a set of integer x ₁ and integer x ₂ Copy (x ₁ , x ₂ ) to the (x ₂ / x ₁ ) power of the element [g ₂ raised to the (1 / u _i ) power]. Since the generator g ₂ is not the unit element of the group G ₂ , the element [g ₂ raised to the (1 / u _i ) power] is not the unit element of the group G ₂ . Therefore, when the integer x ₁ is fixed, the fourth map φ ₄ is bijective, and is an isomorphism from the group to the group G ₂ formed by addition of the integer modulo p. When the integer x ₂ is fixed, the fourth map φ ₄ is a bijection, and a bijection to the set obtained by removing the unit element from the group G ₂ .
The fifth mapping φ ₅ is a mapping that maps a set of elements of group G ₁ of order p, elements of group G ₂ of order p, and integers greater than or equal to 0 and less than p to elements of group G ₃ of order p. , and the sets of the original _{X 1} original _{X 2} and integer _{x 3 (X 1, X 2} , x 3), copy the _{x 3} cube of the original _{e (X} 1, _{X 2).} The pairing map e is bilinear and non-degenerate. Accordingly, when X ₂ and x ₃ are fixed, the fifth map φ ₅ is a homomorphic map from the group G ₁ to the group G ₃ , and is bijective when x ₃ is not 0. If X ₁ and x ₃ are fixed, the fifth map φ ₅ is a homomorphic map from the group G ₂ to the group G ₃ , and is bijective when x ₃ is not 0. Further, when X ₁ and X ₂ are fixed, the fifth map φ ₅ is bijective, and is an isomorphism from the group formed by addition modulo p to the group G ₃ .

The determination source calculation unit 240 converts, for an arbitrary integer x not less than 0 and less than p, an element φ ₁ (x) obtained by mapping the arbitrary integer x by the first mapping φ ₁ to the third mapping φ _3. The mapping in which the element φ ₃ (φ ₁ (x)) mapped by the above is equal to the element [Z ^x ] obtained by combining the predetermined number of predetermined elements Z equal to the above-mentioned arbitrary integer x by the group operation is expressed as the third used as a mapping φ _3.
The mapping element calculation unit 450, for any first integer x ₁ that is greater than or equal to 1 and less than p, is an element φ ₂ (x ₁ ) obtained by mapping the arbitrary first integer x ₁ by the second mapping φ _2. And an element φ ₄ (x ₁ , x ₂ ) obtained by mapping the set of the arbitrary first integer x ₁ and the second integer x ₂ by the fourth mapping φ ₄ , and a third integer x ₃ And the element φ ₅ (φ ₂ (x ₁ ), φ ₄ (x ₁ , x ₂ ), x ₃ ) mapped by the fifth mapping is the second integer x ₂ and the third A map that is equal to the element [Z ^ (x ₂ · x ₃ )] obtained by combining the predetermined elements Z equal to the product of the integer x ₃ with the group operation is used as the fifth map φ _5. .

According to the search system 800 in this embodiment, when the index integer h _i matches the search integer η _i for the d determination target integers selected by the determination target selection unit 441, the comparison source calculation unit 460 The comparison source B to be calculated matches the determination source E ′ calculated by the determination source calculation unit 240. By using this, the search device 400 determines whether or not the index integer h _i matches the search integer η _i for the d determination target integers selected by the determination target selection unit 441.

For example, the following relations hold for the mappings φ _{1 to} φ ₅ in this embodiment.

The above five maps φ _{1 to} φ ₅ are not limited to the examples in this embodiment. Any combination that satisfies the above-described relationship can be searched by the search device 400.

In the search system 800 according to this embodiment, the setting device 100 further includes a secret random number generation unit 132 and a public random number source calculation unit 142.
The secret random number generation unit 132 randomly generates an integer less than or equal to 1 and less than p for each of n integers i greater than or equal to 1 and less than or equal to n by using the processing device, thereby obtaining n secret random numbers u _i . .
The public element calculation unit 141 uses the processing device to map a pair of elements of the first group G ₁ and elements of the second group G ₂ to elements of the third group G _3. The ring map e (the order of the first group G _1, the second group G _2, and the third group G ₃ is p.) Is the first generation source of the first group G ₁ . Generated by the third generator g ₃ that is a mapping element of the generator g ₁ and the second generator g ₂ that is the generator of the second group G ₂ and the secret integer generator 131. Based on the secret integer y, the element g ₃ ^y obtained by combining the third generators g ₃ having the same number as the secret integer y by the group operation of the third group G ₃ is calculated. And
The public random number source calculation unit 142 uses the processing device to generate the first random number g ₁ and the secret random number u generated by the secret random number generation unit 132 for each of n integers 1 to n. Based on _i , an element [g ₁ ^ u _i ] obtained by combining the first generator g ₁ having the same number as the secret random number u _i by the group operation of the first group G ₁ is calculated. Let n public random number sources U _i .
The index encryption apparatus 200 further includes a public random number source storage unit 217 and an index random number generation unit 230.
The public random number source storage unit 217 stores n public random number sources U _i calculated by the setting device 100 using the storage device.
The index random number generation unit 230 randomly generates an integer that is greater than or equal to 1 and less than p by using the processing device, and sets it as an index random number s.
The determination source calculation unit 240 uses the processing device to calculate the index random number s based on the publication source Y stored in the publication source storage unit 216 and the index random number s generated by the index random number generation unit 230. The element Y ^s obtained by combining the same number of public elements Y with the group operation of the third group G ₃ is calculated as a determination element E ′.
The index source calculation unit 250 uses the processing device to store the public random number element U _i stored in the public random number source storage unit 217 and the index integer storage unit for each of the n integers 1 to n. Based on the index integer h _i stored in 224 and the index random number s generated by the index random number generator 230, the number of the public random number elements U _i equal to the product of the index integer h _i and the index random number s. Are combined by the group operation of the first group G ₁ to calculate n [U _i ^ (s · h _i )] as n index elements E _i .
The search encryption device 300 further includes a secret random number storage unit 323.
The secret random number storage unit 323 stores n secret random numbers u _i generated by the setting device 100 using the storage device.
The search source calculation unit 360 uses the processing device to store the second generation source g ₂ and the secret random number u _i stored in the secret random number storage unit 323 for each of n integers 1 to n. Based on the search integer η _i stored in the search integer storage unit 353 and the polynomial value f (i) calculated by the polynomial value calculation unit 344, the secret random number u _i and the search integer η _i An element [g ₂ ^ {f (i) / a] obtained by combining the number of the second generators g ₂ equal to the quotient obtained by dividing the polynomial value f (i) by the product by the group operation of the second group G _2. (U _i · η _i )}] is calculated and set as n search sources T _i .
In the search device 400, the mapping source calculation unit 450 uses the processing device to store the index stored in the index source storage unit 421 for each of the d determination target integers i selected by the determination target selection unit 441. Based on the element E _i and the search source T _i stored in the search source storage unit 432, the bilinear pairing map e maps the set of the index element E _i and the search source T _i . The element e (E _i , T _i ) of the third group G ₃ is calculated as d pairing values e _i and calculated for each of the d determination target integers i selected by the determination target selection unit 441. Based on the pairing value e _i and the interpolation coefficient value Δ _{i, S} calculated by the interpolation coefficient value calculation unit 442 _{, the same} number of pairing values e _i as the interpolation coefficient value Δ _{i, S} are obtained. , Group operation of the _third group G3 The element [e _i ^ Δ _{i, S} ] combined by is calculated as d mapping elements e ′ _i .
The comparison source calculation unit 460 uses the processing apparatus to combine the d mapping sources e ′ _i calculated by the mapping source calculation unit 450 by the group operation of the third group G _3. e ′ _i ) is calculated and set as the comparison source B.

  Although the proof of security is omitted, the search system 800 in this embodiment has security against attacks by a third party who tries to decipher the index integer and the search integer.

In the search system 800 in this embodiment, the index encryption apparatus 200 further includes an index conversion unit 223.
The index conversion unit 223 uses the processing device to input n index character strings w _i corresponding to n integers i of 1 to n, and each of n integers i of 1 to n. , The input index character string w _i is converted into n index integers h _i by a conversion map H that converts a character string of an arbitrary length into an integer of 1 or more and less than p.
The index integer storage unit 224, using the storage device, for storing the n index integer h _i where the index conversion unit 223 converts.
The search encryption apparatus 300 further includes a search conversion unit 352.
The search conversion unit 352 uses the processing device to input n search character strings ω _i corresponding to n integers i of 1 to n, and each of n integers i of 1 to n. , The input search character string ω _i is converted by the conversion map H to obtain n search integers η _i .
The search integer storage unit 353 stores the n search integers η _i converted by the search conversion unit 352 using the storage device.

  According to the search system 800 in this embodiment, the index data and the search data are not limited to integers of 1 or more and less than p, and a character string of any length can be used. Becomes wider.

  According to the index encryption apparatus 200 in this embodiment, even if the calculated encrypted index data is known to a third party, the original index data is not known, and the encrypted index data is By using this, it is possible to search for n index data whose d or more matches the search data. Further, when n index data matches the search data, and less than d, it is not necessary to know which index data matches the search data, so that higher security can be realized.

  According to the search encryption device 300 in this embodiment, even if the calculated encrypted search data is known to a third party, the original search data is not known, and the encrypted search data is still stored. By using this, it is possible to search for n index data whose d or more matches the search data. Further, when n index data matches the search data, and less than d, it is not necessary to know which index data matches the search data, so that higher security can be realized.

  According to the search device 400 in this embodiment, it is possible to search for data in which d or more of the index data matches the search data without decrypting both the encrypted index data and the encrypted search data. Can do.

  The index encryption device 200, the search encryption device 300, and the search device 400 in this embodiment are all computer programs that cause a computer to function as the index encryption device 200, the search encryption device 300, or the search device 400. This can be realized by execution by a computer.

In the search system 800 in this embodiment, a search is performed using the encrypted index data obtained by encrypting the index data by the index encryption device 200 and the encrypted search data obtained by encrypting the search data by the search encryption device 300. A search method in which the apparatus 400 determines whether or not the index data matches the search data includes the following steps.
The index encryption device 200 stores n pieces of index data (index integers h _i ) corresponding to n integers i (n is an integer of 1 or more).
The index encryption apparatus 200 encrypts the stored index data for each of the n integers i of 1 to n to obtain n encrypted index data (index source E _i ).
The search encryption apparatus 300 stores n search data (search integer η _i ) corresponding to n integers i of 1 to n.
For each of n integers i of 1 to n, the search encryption apparatus 300 converts the integer i to a (d-1) -degree univariate polynomial f (x) (d is an integer of 1 to n). Is substituted into n polynomial values f (i).
The search encryption device 300 encrypts a set of the stored search data and the calculated polynomial value f (i) for each of n integers i of 1 to n, and n encrypted search data (Search source T _i ).
The search device 400 stores the n encrypted index data encrypted by the index encryption device 200.
The search device 400 stores the n encrypted search data encrypted by the search encryption device 300.
The search device 400 selects d integers out of n integers greater than or equal to 1 and less than or equal to n to obtain d determination target integers i.
The search device 400 calculates Lagrangian interpolation coefficient values based on the selected d determination target integers i and sets them as d interpolation coefficient values Δ _{i, S.}
The search device 400 maps a set of the stored encrypted index data, the stored encrypted search data, and the calculated interpolation coefficient value Δ _{i, S} for each of the selected d determination target integers i. , D mapping data (mapping source e ′ _i ).
The search device 400 calculates comparison data (comparison source B) based on the mapped d pieces of mapping data.
Based on the calculated comparison data, the search device 400 determines whether or not the index data matches the search data for the selected d determination target integers i.

According to the search method in this embodiment, the search encryption apparatus 300 encrypts the search data using the value f (i) of the (d−1) -order univariate polynomial f (x), and the search apparatus 400 performs a search using Lagrange interpolation coefficient values Δ _{i, S,} and therefore, when d or more of n pieces of data match, the search device 400 can determine that they match, and d If there is less than a match, the search device 400 cannot know which data matched. Thereby, it is possible to prevent leakage of information related to index data and search data.

  According to the search system 800 described above, keyword search can be performed in an encrypted state, and if a certain number or more of a plurality of keywords match, the search is hit. If the search is not hit, information about which keywords match and which keywords do not match does not leak.

  On the other hand, even if a single keyword search method is applied, it is possible to determine whether or not a certain number or more of a plurality of keywords match. That is, the data creator (index encryption device) generates a plurality of encryption tags (encrypted index data) according to the number of keywords (number of indexes), and the data searcher (search encryption device) also searches the search keyword. If a plurality of search trap doors (search encrypted data) are generated according to the number (index number) and the data storage server (search device) executes a search to extract those that match each keyword It is possible to check whether or not a certain number or more of a plurality of keywords match. However, in this method, the data storage server (search device) cannot know the keyword itself, but knows how many encryption tags and which search trap doors match. Therefore, using this information, the data archiving server can infer what data the data searcher is seeking.

  According to the search system 800 described above, it is possible to search whether a certain number or more of a plurality of keywords match, and to reduce the leakage of information related to how many encrypted keywords match. be able to.

  The search system 800 described above uses pairing in a group of prime orders. On the other hand, a method of using pairing in a group of composite orders is also conceivable, but in that case, the types of pairing that can be used are limited. According to the search system 800 described above, since pairing in a group of prime orders is used, the type of pairing that can be used is not limited, and the amount of calculation for pairing can be reduced.

In the above description, the search encryption device 300 designates the threshold value d as encrypted search data, and the search device 400 is configured to search for data that matches d or more indexes. The apparatus 300 may be configured to specify conditions more finely.
For example, the search encryption device 300 may be configured to specify an index number that must match or an index number that does not matter whether or not they match. When specifying the number of the index does not matter whether the matching, it is not necessary to include a search source T _i corresponding to the number to the encrypted search data, it is possible to reduce the amount of encrypted search data.
In response to this, in the search device 400, when the determination target selection unit 441 selects d integers from n integers of 1 to n, a number designated as an index that must be matched. Is always included in the d integers to be selected, and the number designated as an index regardless of whether or not they match is not included in the d integers to be selected. Thereby, the calculation amount in the search device 400 can be reduced.

Further, when there is an index for which no index character string is designated, the index encryption apparatus 200 may be configured to include the index number in the encrypted index data and notify the search apparatus 400. In that case, it is not necessary to include the index source E _i corresponding to the number in the encrypted index data, and the amount of the encrypted index data can be reduced.
In response to this, in the search device 400, when performing a search on the encrypted index data, the determination target selection unit 441 selects an index number for which no index character string is designated. Do not include in integers. Thereby, the calculation amount in the search device 400 can be reduced.

Embodiment 2. FIG.
The second embodiment will be described with reference to FIGS.
In addition, about the part which is common in Embodiment 1, the same code | symbol is attached | subjected and description is abbreviate | omitted.
The overall configuration of the search system 800 in this embodiment, the external appearance and hardware resources of the decryption device 810, the encryption device 820, and the server device 830 are the same as those in the first embodiment.

FIG. 13 is a block configuration diagram showing an example of the configuration of the setting device 100 according to this embodiment.
The setting device 100 includes a setting storage unit 110, a secret generation unit 130, a public calculation unit 140, and a public output unit 150.

The setting storage unit 110 includes a first generation source storage unit 111 and an index number storage unit 115. The first generation source storage unit 111 stores the generation source g ₁ of the group G ₁ using the magnetic disk device 920. The index number storage unit 115 uses the magnetic disk device 920 to store the index number n.

  The secret generation unit 130 includes a secret integer generation unit 131. Using the CPU 911, the secret integer generation unit 131 randomly generates an integer between 1 and p and outputs it as a secret integer y.

The public calculation unit 140 includes a public source calculation unit 141, a public random number source calculation unit 142, and a second generation source calculation unit 147.
Using the CPU 911, the disclosure source calculation unit 141 inputs the generation source g ₁ of the group G ₁ stored in the first generation source storage unit 111 and the secret integer y output from the secret integer generation unit 131. Public element calculation unit 141, by using the CPU 911, based on the origin _{g 1} input and secret integer y, to calculate the original _g ^{1 y} of the group _{G 1} be a power of the original _{g 1} y. Using the CPU 911, the publication source calculation unit 141 outputs the calculated element as the publication source g ₁ ′.
The public random number source calculation unit 142 uses the CPU 911 to input the index number n stored in the index number storage unit 115. Published random number element calculation unit 142 uses the CPU 911, for each 1 to n of n integers, to produce the original other than the unit of the group G ₂ source randomly. Using the CPU 911, the public random number element calculation unit 142 outputs the generated n elements as public random number elements u _i (i is an integer of 1 to n).
Second generation element calculation unit 147, using the CPU 911, generates the original than the unit of the group _{G 2} source randomly. Second generation element calculation unit 147, using the CPU 911, and outputs the generated original as a generation source _{g 2.}

The public output unit 150 includes a public source output unit 151, a public random number source output unit 152, a first generation source output unit 156, and a second generation source output unit 157. Using the CPU 911, the publishing source output unit 151 inputs the publishing source g ₁ ′ output from the publishing source calculation unit 141, and outputs it to the outside. Published random number based on the output unit 152, using the CPU 911, and enter the n-number of public random number source _{u i} public random element calculation unit 142 is output, and output to the outside. Using the CPU 911, the first generation source output unit 156 inputs the generation source g ₁ of the group G ₁ stored in the first generation source storage unit 111 and outputs it to the outside. The second generation output unit 157 receives the generation source g ₂ of the group G ₂ output by the second generation calculation unit 147 and outputs the input to the outside.

FIG. 14 is a block configuration diagram showing an example of the configuration of the search encryption device 300 in this embodiment.
The search encryption apparatus 300 includes a setting storage unit 310, a secret storage unit 320, a search condition input unit 330, a threshold storage unit 341, a polynomial coefficient generation unit 342, a polynomial coefficient storage unit 343, a polynomial value calculation unit 344, and a search conversion unit 352. A search integer storage unit 353, a search random number generation unit 380, a search random number source calculation unit 390, a search source calculation unit 360, and an encrypted search output unit 370.

The setting storage unit 310 includes a first generation source storage unit 311, a second generation source storage unit 312, an index number storage unit 315, and a public random number source storage unit 317. The first generation source storage unit 311 stores the generation source g ₁ of the group G ₁ using the magnetic disk device 920. The second generator storage unit 312 stores the generator g ₂ of the group G ₂ using the magnetic disk device 920. The index number storage unit 315 uses the magnetic disk device 920 to store the index number n. The public random number source storage unit 317 uses the magnetic disk device 920 to store n public random number sources u _i disclosed by the setting device 100.

Using the CPU 911, the search random number generation unit 380 randomly generates an integer of 1 to less than p for each of n integers of 1 to n. Using the CPU 911, the search random number generation unit 380 outputs the generated n integers as search random numbers r _i (i is an integer of 1 to n).

Using the CPU 911, the search random number source calculation unit 390 calculates n search random number sources t _i (i is an integer between 1 and n). Search random number based on t _i is obtained by encrypting the search random number, which is part of the encrypted search data. The search random number source calculation unit 390 includes a power unit 391.
The power unit 391 uses the CPU 911 to input the generation source g ₁ of the group G ₁ stored in the first generation source storage unit 311 and the n search random numbers r _i output from the search random number generation unit 380. The power unit 391 uses the CPU 911 to generate a group G that is the r _i power of the element g ₁ based on the generator g ₁ and the corresponding search random number r _i for each of n integers of 1 to n. to calculate the ₁ of the original _[g 1 ^ _{r i].} The power unit 391 uses the CPU 911 to output the calculated n elements as a search random number element t _i (i is an integer of 1 to n).

この例において、関数値算出部３６２は、ＣＰＵ９１１を用いて、１以上ｎ以下の整数ｉについて、第二生成元記憶部３１２が記憶した群Ｇ_２の生成元ｇ_２と、検索変換部３５２が出力した検索整数η_ｉとに基づいて、元ｇ_２のη_ｉ乗である群Ｇ_２の元［ｇ_２＾η_ｉ］を算出する。関数値算出部３６２は、ＣＰＵ９１１を用いて、算出した元［ｇ_２＾η_ｉ］と、公開乱数元記憶部３１７が記憶した公開乱数元ｕ_ｉとの積を算出して、関数値Ｕ（η_ｉ，ｕ_ｉ）とする。 The search source calculation unit 360 includes a function value calculation unit 362, two power units 365 and 366, and a product calculation unit 367.
Using the CPU 911, the function value calculation unit 362 inputs n public random number sources u _i stored in the public random number source storage unit 317 and n search integers η _i stored in the search integer storage unit 353. . The function value calculation unit 362 uses the CPU 911 to disclose the search integer η _i and the public based on the corresponding public random number element u _i and the corresponding search integer η _i for each of n integers of 1 to n. A value obtained by substituting the pair with the random number element u _i into the function U is calculated. Using the CPU 911, the function value calculation unit 362 outputs the calculated n values as function values U (η _i , u _i ) (i is an integer between 1 and n).
The function U takes a pair of an integer of 0 or more and less than p and an element of the group G ₂ as an argument, and takes an element of the group G ₂ as a value. The function U is defined by the following expression, for example.

In this example, the function value calculation unit 362 uses the CPU 911 to generate the generation source g ₂ of the group G ₂ stored in the second generation storage unit 312 and the search conversion unit 352 for an integer i of 1 or more and n or less. based on the search integer eta _i outputted, it calculates a group _{G 2} be a power eta _i of the original _{g 2} based on _{[g 2} ^ η _i]. Using the CPU 911, the function value calculation unit 362 calculates the product of the calculated element [g ₂ ^ η _i ] and the public random number source u _i stored in the public random number source storage unit 317, and the function value U ( η _i , u _i ).

The power unit 365 uses the CPU 911 to calculate the n function values U (η _i , u _i ) output from the function value calculation unit 362 and the n search random numbers r _i output from the search random number generation unit 380. input. Power unit 365, for each 1 to n of n integers, the corresponding function value _{U (η i, u i)} , based on the corresponding search random number _{r i,} the function value U (η _i, u _The element [U (η _i , u _i ) ^ r _i ] of the group G ₂ that is the power of _{i i} ri is calculated. The power unit 365 uses the CPU 911 to output the calculated n elements [U (η _i , u _i ) ^ r _i ] (i is an integer of 1 to n).

The power unit 366 uses the CPU 911 to input the generation source g ₂ of the group G ₂ stored in the second generation source storage unit 312 and the n polynomial values f (i) output from the polynomial value calculation unit 344. To do. Power unit 366, by using the CPU 911, for 1 to n of n integers, the origin _{g 2,} based on the corresponding polynomial solutions f (i), multiply the original _{g 2} of f (i) The element [g ₂ ^ f (i)] of the group G ₂ is calculated. The power unit 366 uses the CPU 911 to output the calculated n elements [g ₂ ^ f (i)] (i is an integer of 1 to n).

Using the CPU 911, the product calculation unit 367 uses the n function values U (η _i , u _i ) output from the power unit 365 and the n elements [g ₂ ^ f (i) output from the power unit 366. ]. Using the CPU 911, the product calculation unit 367 uses a function value U (η _i , u _i ) corresponding to each of n integers of 1 to n and a corresponding element [g ₂ ^ f (i)] The product of is calculated. Using the CPU 911, the product calculation unit 367 outputs the calculated n products as a search source T _i (i is an integer of 1 to n).

The encrypted search output unit 370 includes a threshold output unit 371, a search source output unit 372, and a search random number source output unit 373. Using the CPU 911, the threshold output unit 371 inputs the threshold d stored by the threshold storage unit 341 and outputs it to the outside. Search source output unit 372, using the CPU 911, and enter the n-number of search source _{T i} which calculating unit 367 is output, and output to the outside. Search random number based on the output unit 373, using the CPU 911, and enter the n-number of search random number based on _{t i} the power unit 391 has been output to the outside.

FIG. 15 is a block configuration diagram showing an example of the configuration of the index encryption device 200 in this embodiment.
The index encryption apparatus 200 includes a setting storage unit 210, an index input unit 221, an index conversion unit 223, an index integer storage unit 224, an index random number generation unit 230, a determination source calculation unit 240, a random number source calculation unit 270, and an index source calculation unit. 250 and an encrypted index output unit 260.

The setting storage unit 210 includes a first generation source storage unit 211, a second generation source storage unit 212, an index number storage unit 215, a public source storage unit 216, and a public random number source storage unit 217. The first generation source storage unit 211 stores the generation source g ₁ of the group G ₁ using the magnetic disk device 920. The second generation source storage unit 212 stores the generation source g ₂ of the group G ₂ using the magnetic disk device 920. The index number storage unit 215 uses the magnetic disk device 920 to store the index number n. The disclosure source storage unit 216 stores the disclosure source g ₁ ′ disclosed by the setting device 100 using the magnetic disk device 920. The public random number source storage unit 217 uses the magnetic disk device 920 to store n public random number sources u _i released by the setting device 100.

The determination source calculation unit 240 includes a pairing value calculation unit 241 and a power unit 242.
Using the CPU 911, the pairing value calculation unit 241 inputs the disclosure source g ₁ ′ stored in the disclosure source storage unit 216 and the generation source g ₂ of the group G ₂ stored in the second generation source storage unit 212. . The pairing value calculation unit 241 uses the CPU 911 to calculate an element e (g ₁ ′, g ₂ ) of the group G ₃ obtained by mapping a pair of the element g ₁ ′ and the element g ₂ using the pairing map e. . The pairing value calculation unit 241 uses the CPU 911 to output the calculated element e (g ₁ ′, g ₂ ).
The power unit 242 uses the CPU 911 to input the element e (g ₁ ′, g ₂ ) output from the pairing value calculation unit 241 and the index random number s output from the index random number generation unit 230. Power unit 242, by using the CPU 911, calculates an original _{e (g 1 ', g 2} ) based on [e _{(g 1} of the group _{G 3} be a power s _of', g ^{2) s].} The power unit 242 uses the CPU 911 to output the calculated element as the determination element E ′.
Here, since the disclosure source g ₁ ′ is the y-th power of the generation source g ₁ of the group G ₁ , the determination source E ′ is
The element e (g ₁ , g ₂ ) of the group G ₃ is the (s · y) power.

The random number source calculation unit 270 calculates a random number source E ″ using the CPU 911. The random number source E ″ is an encrypted index random number and is a part of the encrypted index data. The random number element calculation unit 270 includes a power unit 271.
The power unit 271 uses the CPU 911 to input the generation source g ₁ of the group G ₁ stored in the first generation source storage unit 211 and the index random number s output from the index random number generation unit 230. Power unit 271, by using the CPU 911, calculates an original _(g ^{1 s)} of the group _{G 1} be a power of the original _{g 1} s. The power unit 271 uses the CPU 911 to output the calculated element (g ₁ ^s ) as the random number element E ″.

The index element calculation unit 250 includes a function value calculation unit 252 and a power unit 253.
Using the CPU 911, the function value calculation unit 252 inputs n public random number sources u _i stored in the public random number source storage unit 217 and n index integers h _i stored in the index integer storage unit 224. . Function value calculation unit 252, by using the CPU 911, for each 1 to n of n integers, the corresponding public random number source _{u i,} based on the corresponding index integer _{h i,} publish and index integer _{h i} A value obtained by substituting the pair with the random number element u _i into the function U is calculated. Using the CPU 911, the function value calculation unit 252 outputs the calculated n values as function values U (h _i , u _i ).
The function U is the same function as the function used by the function value calculation unit 362. Therefore, if the index integer h _i is equal to the search integer η _i , the function value U (h _i , u _i ) calculated by the function value calculation unit 252 and the function value U (η _i , u _i ).

The power unit 253 uses the CPU 911 to input the n function values U (h _i , u _i ) output from the function value calculation unit 252 and the index random number s output from the index random number generation unit 230. The power unit 253 uses the CPU 911 to generate an element [U (h _i , u _i ) of the group G ₂ that is the s power of the function value U (h _i , u _i ) for each of n integers of 1 to n. ) ^S ] is calculated. The power unit 253, using the CPU 911, outputs the calculated n elements [U (h _i , u _i ) ^s ] as the index element E _i .

The encrypted index output unit 260 includes an index source output unit 261, a determination source output unit 263, and a random number source output unit 264. Using the CPU 911, the index source output unit 261 inputs the n index sources E _i output from the power unit 253 and outputs them to the outside. Using the CPU 911, the determination source output unit 263 inputs the determination source E ′ output from the power unit 242 and outputs the input to the outside. Using the CPU 911, the random number source output unit 264 receives the random number source E ″ output from the power unit 271 and outputs it to the outside.

FIG. 16 is a block configuration diagram showing an example of the configuration of the search device 400 in this embodiment.
The search apparatus 400 includes an index number storage unit 415, an encrypted index storage unit 420, an encrypted search storage unit 430, a determination target selection unit 441, an interpolation coefficient value calculation unit 442, a mapping source calculation unit 450, a comparison source calculation unit 460, A determination unit 470 is included.

The encrypted index storage unit 420 includes an index source storage unit 421, a determination source storage unit 422, and a random number source storage unit 424. The index source storage unit 421 uses the magnetic disk device 920 to store n index sources E _i for each encrypted index data. The determination source storage unit 422 uses the magnetic disk device 920 to store one determination source E ′ for each encrypted index data. The random number source storage unit 424 uses the magnetic disk device 920 to store one random number source E ″ for each encrypted index data.

The encrypted search storage unit 430 includes a threshold value storage unit 431, a search source storage unit 432, and a search random number source storage unit 433. The threshold storage unit 431 stores the threshold d using the magnetic disk device 920. Search source storage unit 432, by using the magnetic disk device 920 stores n pieces of retrieval source _{T i.} Search random number source storage unit 433, by using the magnetic disk device 920 stores n pieces of search random number based on t _i.

The mapping source calculation unit 450 includes two pairing value calculation units 451 and 453, a division unit 454, and a power unit 455.
Pairing value calculation unit 451, by using the CPU 911, the random number and the source storage unit 424 stores the random number based on E ", the search source storage unit 432 inputs the n number of search source T _i stored. Pairing value calculating unit 451, using the CPU 911, for each 1 to n of the n integers, the random number based on E "and, on the basis of the corresponding search source _{T i,} by pairing mapping e, a random number based on E" and The element e (E ″, T _i ) of the group G ₃ that maps the pair with the search source T _i is calculated. Using the CPU 911, the pairing value calculation unit 451 outputs the calculated n elements e (E ″, T _i ) (i is an integer between 1 and n).
The pairing value calculation unit 453 uses the CPU 911 to input the n index sources E _i stored in the index source storage unit 421 and the n search random number sources t _i stored in the search random number source storage unit 433. To do. The pairing value calculation unit 453 uses the CPU 911 to perform the pairing map e on the basis of the corresponding index element E _i and the corresponding search random number element t _i for each of n integers of 1 to n. , calculated based on _{e (t} i, _{E i)} of the group _{G 3} which maps a set of the search random number based on _{t i} and index based _{E i} a. Using the CPU 911, the pairing value calculation unit 453 outputs the calculated n elements e (t _i , E _i ) (i is an integer of 1 to n).
Using the CPU 911, the division unit 454 uses the n elements e (E ″, T _i ) output by the pairing value calculation unit 451 and the n elements e (t _i ) output by the pairing value calculation unit 453. , E _i ) Using the CPU 911, the division unit 454 uses a corresponding element e (E ″, T _i ) and a corresponding element e (t) for each of n integers of 1 to n. _i, based on the _{E i),} based on e (E ", _{T i)} the original _{e (t} i, the quotient obtained by dividing by _{E i) [e (E"} , T i) / e (t i, E i )] Is calculated. Using the CPU 911, the division unit 454 outputs the calculated n quotients as a pairing value e _i (i is an integer between 1 and n).
Here, the random number element E ″ is the s-th power of the generator g ₁ of the group G ₁ , and the search source T _i is the f (i) power of the generator g ₂ of the group G ₂ and the function value U (η _i , _{u i)} the product of the search random number based on _{t i} is a power of _{t i} of origin _{g 1} of the group _{G 1,} an index based on _{E i} is the function value _{U (h} i, s of _{u i)} Since it is a power, the pairing value e _i is

It is.

Using the CPU 911, the power unit 455 uses the d interpolation coefficient values Δ _{i, S} output from the interpolation coefficient value calculation unit 442 and the n pairing values e _i output from the pairing value calculation unit 451. The d pairing values e _i corresponding to the d integers selected by the determination target selection unit 441 are input. Power unit 455, for each determination target selection unit 441 selects the d integers, and the corresponding interpolation coefficient value delta _{i, S,} on the basis of the corresponding pairing value e _i, the pairing value e _i delta _i, to calculate the original group _{G 3} be a power _S. The power unit 455 uses the CPU 911 to output the calculated d elements as the mapping element e ′ _i .

である。 The comparison source calculation unit 460 includes a total product unit 461.
Using the CPU 911, the total product unit 461 receives the d mapping sources e ′ _i output from the power unit 455. Using the CPU 911, the total product unit 461 calculates the total product Π [e ′ _i ] of all the input d mapping sources e ′ _i . The total product unit 461 uses the CPU 911 to output the calculated total product Π [e ′ _i ] as the comparison source B.
Here, the comparison source B is

It is.

  The determination unit 470 uses the CPU 911 to determine the determination source E ′ stored in the determination source storage unit 422 for the index that is the target for determining whether or not the search condition is satisfied, and the comparison source B output from the total product unit 461. Enter. The determination unit 470 compares the input determination source E ′ and the comparison source B, and determines that the index meets the search condition if they match. The determination unit 470 uses the CPU 911 to output the determined result.

となり、比較元Ｂは、判定元Ｅ’と一致する。 For all iεS, if h _i = η _i , U (h _i , u _i ) = U (η _i , u _i ), so the comparison source B is

Thus, the comparison source B matches the determination source E ′.

である。例えば、関数Ｕが数２１で定義される関数である場合、

であるから、Ｂ＝Ｅ’となるのは、

の場合のみである。この値は、０以上ｐ未満のランダムな値をとるから、０になる確率は１／ｐである。ｐは通常大きな数であるから、この確率は、極めて低い。 On the other hand, for any iεS, if h _i ≠ η _i , the probability of B = E ′ is very low. For example, if i ∈ S ′ (S ′ is a subset of S and not an empty set), and h _i ≠ η _i and h _i = η _i for other i∈S,

It is. For example, when the function U is a function defined by Equation 21,

Therefore, B = E '

This is only the case. Since this value takes a random value of 0 or more and less than p, the probability of becoming 0 is 1 / p. Since p is usually a large number, this probability is very low.

FIG. 17 is a flowchart showing an example of the flow of the setting process S610 in this embodiment.
The setting process S610 includes a second generation source generation step S612, a secret integer generation step S614, a public source calculation step S615, an integer selection step S616, a public random number source generation step S618, and an integer repetition step S620.

In the second generation source generating step S612, the second generation element calculation unit 147, using the CPU 911, the original non-unity a former group G ₂ are randomly generated, and a generator g _2.
In the secret integer generation step S614, the secret integer generation unit 131 uses the CPU 911 to randomly generate an integer that is greater than or equal to 1 and less than p and sets it as the secret integer y.
In the public element calculation step S615, the public element calculation unit 141, by using the CPU 911, and a generator _{g 1} of the group _{G 1} of the first generation source storage unit 111 and stored by the secret integer generating unit 131 by the secret integer generating step S614 Based on the secret integer y generated by, the element of the group G ₁ that is the y-th power of the element g ₁ is calculated as a public element g ₁ ′.

In the integer selection step S616, the public random number source calculation unit 142 uses the CPU 911 to select integers one by one from n integers of 1 to n in order to obtain an integer i.
In public random element generation step S618, the public random element calculation unit 142 uses the CPU 911, the integer i selected in integer selection step S616, the source is not the unit A of the original group G ₂ source to randomly generated , The public random number source u _i .
In the integer repetition step S620, the public random number source calculation unit 142 uses the CPU 911 to determine whether all integers greater than or equal to 1 and less than n have been selected in the integer selection step S616. If it is determined that there is an integer that has not yet been selected, the public random number source calculation unit 142 uses the CPU 911 to return to the integer selection step S616 and select the next integer. If it is determined that all the integers have been selected, the setting apparatus 100 ends the setting process S610.

FIG. 18 is a flowchart showing an example of the flow of the index encryption processing S630 in this embodiment.
The index encryption processing S630 includes an index random number generation step S631, a determination source calculation step S632, a random number source calculation step S634, an integer selection step S635, an index integer calculation step S636, an index source calculation step S637, and an integer repetition step S638.

In the index random number generation step S631, the index random number generation unit 230 uses the CPU 911 to randomly generate an integer greater than or equal to 1 and less than p to obtain an index random number s.
In the determination source calculation step S632, the pairing value calculation unit 241 uses the CPU 911 to store the disclosure source g ₁ ′ stored in the disclosure source storage unit 216 and the second generation source storage unit 212 using the pairing map e. The element e (g ₁ ′, g ₂ ) of the group G ₃ that maps the set of the group G _{2 and} the generation source g ₂ is calculated. The power unit 242 uses the CPU 911 to convert the element e (g ₁ ′, g ₂ ) calculated by the pairing value calculation unit 241 and the index random number s generated by the index random number generation unit 230 in the index random number generation step S631. Based on the element e (g ₁ ′, g ₂ ), the element of the group G ₃ that is the s-th power is calculated and set as the determination element E ′.
In random element calculation step S634, a power unit 271, by using the CPU 911, and a generator _{g 1} of the group _{G 1} of the first origin storage section 211 has stored, index random number generation unit 230 in the index number generating step S631 is generated Based on the index random number s, the element of the group G ₁ that is the power of the element g _{1 to} the s power is calculated as a random number element E ″.

In the integer selection step S635, the index conversion unit 223 uses the CPU 911 to select integers one by one from n integers of 1 to n in order to obtain an integer i.
In the index integer calculation step S636, the index conversion unit 223 uses the CPU 911 to calculate an integer obtained by mapping the index character string w _i input by the index input unit 221 using the mapping H for the integer i selected in the integer selection step S635. calculated and, to an index integer _{h i.}
In the index source calculation step S637, the function value calculation unit 252 uses the CPU 911 to calculate the index integer calculated by the index conversion unit 223 in the index integer calculation step S636 for the integer i selected by the index conversion unit 223 in the integer selection step S635. and h _i, a set of the public random number source _{u i,} calculate the original group _{G 2} is a value assigned to a function U, the function value _{U (h i, u} i) and. The power unit 253 uses the CPU 911 based on the function value U (h _i , u _i ) calculated by the function value calculation unit 252 and the index random number s generated by the index random number generation unit 230 in the index random number generation step S631. Then, the element of the group G ₂ that is the s-th power of the function value U (h _i , u _i ) is calculated and set as the index element E _i .
In the integer repetition step S638, the index conversion unit 223 uses the CPU 911 to determine whether all integers of 1 or more and n or less have been selected in the integer selection step S635. If it is determined that there is an integer that has not been selected, the index conversion unit 223 uses the CPU 911 to return to the integer selection step S635 and select the next integer. If it is determined that all the integers have been selected, the index encryption apparatus 200 ends the index encryption process S630.

FIG. 19 is a flowchart showing an example of the flow of the search encryption process S650 in this embodiment.
The search encryption process S650 includes an order selection step S651, a polynomial coefficient generation step S652, an order repetition step S653, a highest order coefficient generation step S654, an integer selection step S655, a search integer calculation step S656, a polynomial value calculation step S657, and a search random number generation. Step S658, search source calculation step S659, search random number source calculation step S660, and integer repetition step S661.

In the search random number generation step S658, the search random number generation unit 380 uses the CPU 911 to randomly generate an integer between 1 and less than p for the integer i selected by the search conversion unit 352 in the integer selection step S655. Let r _i .
In the search source calculation step S659, the function value calculation unit 362 uses the CPU 911 to search for the integer i selected by the search conversion unit 352 in the integer selection step S655, and the search integer calculated by the search conversion unit 352 in the search integer calculation step S656. and eta _i, a set of the public random number source u _i, calculate the original group G ₂ is a value assigned to the function U, a function value _{U (η i, u i)} . The power unit 365 uses the CPU 911 to convert the function value U (η _i , u _i ) calculated by the function value calculation unit 362 and the search random number r _i generated by the search random number generation unit 380 in the search random number generation step S658. Based on this, the element [U (η _i , u _i ) ^ r _i ] of the group G ₂ that is the r _i power of the function value U (η _i , u _i ) is calculated. The power unit 366 uses the CPU 911 to generate the generator g ₂ of the group G ₂ stored in the second generator storage unit 312 and the polynomial value f (i) calculated by the polynomial value calculator 344 in the polynomial value calculation step S657. Based on the above, the element [g ₂ ^ f (i)] of the group G ₂ that is the power of the element g _{2 to} the power of f (i) is calculated. Using the CPU 911, the product calculation unit 367 uses the element [g ₂ ^ f (i)] calculated by the power unit 366 and the element [U (η _i , u _i ) ^ r _i ] calculated by the power unit 365. It calculates the original group G ₂ is a product, a search source T _i.
In search random element calculation step S660, a power unit 391, by using the CPU 911, and a generator _{g 1} of the group _{G 1} of the first generation source storage unit 311 and stored by the search random number generation unit 380 in the search random number generation step S658 generated on the basis of the search random number r _i, to calculate the original group G ₁ be a power r _i of the original g _1, and searches the random number based on t _i.

FIG. 20 is a flowchart showing an example of the flow of search execution processing S670 in this embodiment.
Search execution processing S670 includes index selection step S671, integer selection step S672, pairing value calculation step S673, integer repetition step S674, determination selection step S675, determination integer selection step S676, interpolation coefficient value calculation step S677, power step S678, It has determination integer repetition process S679, total product process S680, determination process S681, determination repetition process S682, and index repetition process S683.

In the pairing value calculation step S673, the pairing value calculation unit 451 uses the CPU 911 to store the random number source E ″ stored in the random number source storage unit 424 for the encrypted index data selected in the index selection step S671, and the integer selection step. Based on the search source T _i stored in the search source storage unit 432 for the integer i selected in S672, the element of the group G ₃ is obtained by mapping the pair of the random number source E ″ and the search source T _i by the pairing map e. e (E ″, T _i ) is calculated and used as the first pairing value. The pairing value calculation unit 453 uses the CPU 911 to perform the index source storage unit 421 for the integer i selected in the integer selection step S672. There the index based on E _i stored, based on the search random number based on t _i a search random number source storage unit 433 stores, by pairing mapping e, a set of the search random number based on t _i and index based E _i Source _{e (t i, E} i) of the group _{G 3} that image and the second pairing value calculated. Division unit 454, by using the CPU 911, the first pairing the pairing value calculation unit 451 has calculated Based on the value e (E ″, T _i ) and the second pairing value e (t _i , E _i ) calculated by the pairing value calculation unit 453, the first pairing value e (E ″, T _i). ) the second pairing value _{e (t} i, and calculates an element of a group _{G 3} is divided by _{E i),} the pairing value _{e i.}

The search system 800 in this embodiment has the same effect as that of the first embodiment.
Further, since the number of secret integers that the search encryption apparatus 300 should keep in a secret manner using a tamper-resistant storage device or the like is one regardless of the index number n, the storage of the tamper-resistant storage device is possible. The number of indexes n is not limited by the capacity.

Maps φ _{1 to} φ ₅ used in this embodiment are defined by the following equations.

That is, the first mapping φ ₁ is a mapping that maps an integer of 0 or more and less than p to the element of the group G ₁ of order p, and maps the integer x to the x power of the element g ₁ . Element g ₁ is not a unit element of group G ₁ . Accordingly, the first map φ ₁ is bijective, and is an isomorphism from group to group G ₁ formed by addition in which an integer modulo p.
The second mapping φ ₂ is a mapping that maps an integer of 0 or more and less than p to the element of the group G ₂ of order p, and maps the integer x to the s-th power of the function value U (x, u _i ). The index integer s is not zero. Therefore, if the function U is bijective with respect to x, the second map φ ₂ is also bijective.
The third mapping φ ₃ is a mapping that maps the element of the group G ₁ of order p to the group G ₃ of the order p, and maps the element X to the power s of the element e (X, g ₂ ). The generator g ₂ is not a unit element of the group G ₂ , the pairing map e is bilinear and non-degenerate, and the index random number s is not zero. Therefore, the third map φ ₃ is bijective and is an isomorphic map.
Fourth mapping phi ₄ of a set of copy to order p group G ₂ of the original mapping and 0 or p less than an integer and 0 or p less than an integer, a set of integer x ₁ and integer x _{2 (x} 1, _{x 2),} and copy to the product of the _{r i} th power of the original _{g 2} of _{x 2} square and function values _{U (x 1, u i)} . The generator g ₂ is not a unit element of the group G ₂ and the search random number r _i is not 0. Therefore, when x ₂ is fixed, if x ₂ is not 0 and the function U is bijective, the fourth map φ ₄ is bijective. When x ₁ is fixed, the fourth map φ ₄ is bijective, and is an isomorphism from the group to the group G ₂ formed by addition with an integer modulo p.
A fifth mapping phi _5, copy a set of the order p integer less than the original and 0 or p group G ₂ of the original and the order p of the group G ₂ of the original order p group G ₃ mapping , and the sets of the original _{X 1} original _{X 2} and integer _{x 3 (X 1, X 2} , x 3), based on ^{_{e (g 1 s, X 2}} ) the original _{e (g 1 ^ r i,} X ₁ ) Copy the quotient divided by x _{3 to the} power of x3. The generator g ₁ is not a unit element of the group G ₁ , the index random number s and the search random number r _i are not 0, and the pairing map e is bilinear and non-degenerate. Therefore, when X ₂ and x ₃ are fixed, the fifth map φ ₅ is bijective when x ₃ is not 0. When X ₁ and x ₃ are fixed, the fifth map φ ₅ is bijective when x ₃ is not 0, and is an isomorphic map from the group G ₂ to the group G ₃ . Further, when X ₁ and X ₂ are fixed, the fifth map φ ₅ is bijective, and is an isomorphism from the group formed by addition modulo p to the group G ₃ .

Further, the following relations hold for the mappings φ _{1 to} φ ₅ in this embodiment.

In the search system 800 in this embodiment, the setting device 100 further includes a public random number source calculation unit 142.
The public element calculation unit 141, using the processing device, the first product based on g ₁ is the first group G ₁ of origin _(of order of the first group G ₁ is p.) And, the Based on the secret integer y generated by the secret integer generator 131, the element g ₁ ^y obtained by combining the first generator g ₁ having the same number as the secret integer y by the group operation of the first group G ₁ Is calculated as the publisher g ₁ ′.
The public random number element calculation unit 142 uses the processing apparatus to generate the second group G ₂ for each of n integers 1 to n (the order of the second group is p. ) Are randomly generated to be n public random number elements u _i .
The index encryption apparatus 200 further includes a public random number source storage unit 217 and a random number source calculation unit 270.
The public random number source storage unit 217 stores the n public random number sources u _i calculated by the setting device 100 using the storage device.
The index random number generation unit 230 randomly generates an integer that is greater than or equal to 1 and less than p by using the processing device, and sets it as an index random number s.
The determination source calculation unit 240 uses the processing device, the second generation source g ₂ that is the generation source of the second group G ₂ , and the disclosure source g ₁ ′ stored in the disclosure source storage unit 216. Based on the above, the set of the element of the first group G ₁ and the element of the second group G ₂ is mapped to the element of the third group G ₃ (the order of the third group is p.). The element e (g ₁ ′, g ₂ ) of the third group G ₃ to which the pair of the public element g ₁ ′ and the second generator g ₂ is mapped is calculated by the bilinear pairing map e Then, based on the calculated element e (g ₁ ′, g ₂ ) of the third group G ₃ and the index random number s generated by the index random number generator 230, the number of the above-mentioned index random number s original e of the third group _{G 3 (g 1 ', g} 2) the original e linked by a group operation of the third group _{G 3 (g 1', g} 2) to calculate the ^s, determination source Let E '
The random number element calculation unit 270 uses the processing device to generate a number equal to the index random number s based on the first generator g ₁ and the index random number s generated by the index random number generation unit 230. The element g ₁ ^s obtained by combining the first generation element g ₁ by the group operation of the first group G ₁ is calculated as a random number element E ″.
The index source calculation unit 250 uses the processing device to store the index integer h _i stored in the index integer storage unit 224 and the public random number source storage unit 217 for each of n integers 1 to n. There based on a public random number based on u _i stored by the mapping function U of a set of the integer and the 0 to less than p second original group G ₂ is mapped to the second original group G _2, An element of the second group G ₂ that maps the set of the index integer h _i and the public random number element u _i is calculated to obtain n index function values U (h _i , u _i ), one or more For each of n integers i less than or equal to n, based on the calculated index function value U (h _i , u _i ) and the index random number s generated by the index random number generation unit 230, it is equal to the index random number s the number of the index function value _{U (h i, u} i) and the second group operation of group _{G 2} of More bound original _U (h _i, u ^_i) to calculate the ^s, the n number of indexes based on _{E i.}
The search encryption apparatus 300 further includes a public random number source storage unit 317, a search random number generation unit 380, and a search random number source calculation unit 390.
The public random number source storage unit 317 stores n public random number sources u _i calculated by the setting device 100 using the storage device.
The search random number generation unit 380 randomly generates an integer less than or equal to 1 and less than p for each of n integers i greater than or equal to 1 and less than or equal to n, using the processing device, to obtain n search random numbers r _i . .
The search source calculation unit 360 uses the processing device to store the search integer η _i stored in the search integer storage unit 353 and the public random number source storage unit 317 for each of n integers 1 to n. Based on the stored public random number element u _i , the mapping function U maps the set of the search integer η _i and the public random number element u _i to calculate the element of the second group G ₂ Then, the n search function values U (η _i , u _i ) are set, and the calculated search function values U (η _i , u _i ) and the search are calculated for each of the n integers i of 1 to n. Based on the search random number r _i generated by the random number generation unit 380, the search function values U (η _i , u _i ) equal to the search random number r _i are obtained by the group operation of the second group G _2. bound original _{[U (η i, u i} ) ^ r i] is calculated, the second generator g If, on the basis of the above polynomial value calculation unit 344 has calculated polynomial value f (i), the number of which is equal to the above polynomial solutions f (i) said second product based on g _2, said second group G ₂ The combined element [g ₂ ^ f (i)] is calculated by the group operation, and the calculated _two elements [U (η _i , u _i ) ^ r _i ], [g ₂ ^ f ( i)] to calculate the original bound by group operation of the second group G _2, and n number of search source T _i.
The search random number source calculation unit 390 uses the processing device to calculate the first generation source g ₁ and the search random number r generated by the search random number generation unit 380 for each of n integers ₁ to n. based on the _i, the search random number r _i and the number of the first generation source g ₁ equal to calculate the original [g 1 _{^ r i]} linked by the group calculation of the first group G _1, and n number of search random number based on _{t i.}
The search device 400 further includes a random number source storage unit 424 and a search random number source storage unit 433.
The random number source storage unit 424 stores the random number source E ″ calculated by the index encryption device 200 using the storage device.
The search random number source storage unit 433, using the storage device, for storing the n search random number based on t _i of the search encoder 300 is calculated.
The mapping source calculation unit 450 uses the processing device to calculate the random number source E ″ stored in the random number source storage unit 424 and the search for each of the d determination target integers selected by the determination target selection unit 441. Based on the search source T _i stored in the original storage unit 432, the elements of the third group obtained by mapping the pair of the random number source E ″ and the search source T _i are calculated by the bilinear pairing map e. The search random number source storage unit 433 stores the d first pairing values e (E ″, T _i ) for each of the d determination target integers selected by the determination target selection unit 441. Based on the search random number element t _i and the index element E _i stored in the index element storage unit 421, the bilinear pairing map e is used to determine a set of the search random number element t _i and the index element E _i. calculate the mapping was the third group G ₃ of the original To, d pieces of the second pairing value e (t _{i, E i)} and, for each of the judging target selecting unit 441 d items to be determined integer selected calculated the first pairing value e (E ”, T _i ) and an inverse element of the calculated second pairing value e (t _i , E _i ) by a group operation of the third group G ₃ [e (E”, T _i ) / E (t _i , E _i ) is calculated and d mapping sources e ′ _i are obtained.
The comparison element calculation unit 460 uses the processing apparatus to combine the d mapping elements e ′ _i calculated by the mapping element calculation unit 450 by the group operation of the third group G ₃ [ e ′ _i ] is calculated as a comparison source B.

Although the proof of security is omitted, the search system 800 in this embodiment has security against attacks by a third party who tries to decipher the index integer and the search integer.
Furthermore, since the amount of secret data that the search encryption apparatus 300 should keep secretly is small and constant regardless of the number of indexes n, the storage capacity of the tamper-resistant storage device can be small, and tamper resistance The number of indexes n is not limited by the storage capacity of the storage device having.

  Note that the various modifications described in the first embodiment can also be applied to the search system 800 in this embodiment.

  If the search system 800 described above is applied to, for example, a database that stores attribute information such as an individual's age, address, occupation, and preference, secret data matching that extracts only persons close to a certain attribute can be realized. Or if it applies to the database which saved image data for every pixel, secret image matching which extracts only an image close to a certain picture is realizable. Alternatively, if it is applied to a database that stores biometric information such as fingerprint information, glow information, and vein information, the biometric information is used during personal identification to perform a search while maintaining the safety of the biometric information. Biometric authentication can be realized.

  100 setting device, 110, 210, 310 setting storage unit, 111, 211, 311 first generation source storage unit, 112, 212, 312 second generation source storage unit, 113 third generation source storage unit, 115, 215, 315 , 415 Index number storage unit, 121 Pairing value calculation unit, 130 Secret generation unit, 131 Secret integer generation unit, 132 Secret random number generation unit, 140 Public calculation unit, 141 Public source calculation unit, 142 Public random number source calculation unit, 147 Second generation source calculation unit, 150 public output unit, 151 public source output unit, 152 public random number source output unit, 156 first generation source output unit, 157 second generation source output unit, 200 index encryption device, 216 public source Storage unit, 217, 317 Public random number source storage unit, 221 Index input unit, 223 Index conversion unit, 224 Index integer storage unit, 230 Index random number generation , 240 determination source calculation unit, 241 pairing value calculation unit, 242 exponentiation unit, 250 index source calculation unit, 251 exponent calculation unit, 252 function value calculation unit, 253 exponentiation unit, 260 encrypted index output unit, 261 index source Output unit, 262 Judgment source output unit, 263 Judgment source output unit, 264 Random number source output unit, 270 Random number source calculation unit, 271 Power unit, 300 Search encryption device, 320 Secret storage unit, 321 Secret integer storage unit, 323 Secret Random number storage unit, 330 Search condition input unit, 331 Threshold input unit, 332 Search input unit, 341 Threshold storage unit, 342 Polynomial coefficient generation unit, 343 Polynomial coefficient storage unit, 344 Polynomial coefficient calculation unit, 352 Search conversion unit, 353 search Integer storage unit, 360 search source calculation unit, 361 index calculation unit, 362 function value calculation unit, 365, 366 power unit, 67 product calculation unit, 370 encrypted search output unit, 371 threshold output unit, 372 search source output unit, 373 search random number source output unit, 380 search random number generation unit, 390 search random number source calculation unit, 391 power unit, 400 search device , 420 Encrypted index storage unit, 421 Index source storage unit, 422 Judgment source storage unit, 424 Random number source storage unit, 430 Encrypted search storage unit, 431 Threshold storage unit, 432 Search source storage unit, 433 Search random number source storage unit , 441 determination target selection unit, 442 interpolation coefficient value calculation unit, 450 mapping element calculation unit, 451, 453 pairing value calculation unit, 454 division unit, 455 power unit, 460 comparison source calculation unit, 461 total product unit, 470 determination , 800 search system, 810 decryption device, 820 encryption device, 830 server device, 840 data encryption device, 841 Main unit storage unit 842 Encryption key storage unit 843 Main unit encryption unit 850 Encrypted data storage unit 851 Encrypted main unit storage unit 852 Search result input unit 853 Search main unit output unit 860 Data decryption unit 861 Decryption Key storage unit, 862 body decryption unit, 863 decryption body output unit, 901 display device, 902 keyboard, 903 mouse, 904 FDD, 905 CDD, 906 printer device, 907 scanner device, 910 system unit, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication device, 920 magnetic disk device, 921 OS, 922 window system, 923 program group, 924 file group, 931 telephone, 932 facsimile machine, 940 Internet, 941 gateway, 9 2 LAN.

Claims (12)

An index encryption device, a search encryption device, and a search device;
The index encryption device includes a storage device that stores data, a processing device that processes data, an index storage unit, and an index encryption unit,
The index storage unit stores n index data corresponding to n integers of 1 to n (n is an integer of 1 or more) using the storage device,
The index encryption unit encrypts the index data stored in the index storage unit for each of n integers of 1 to n using the processing device to obtain n encrypted index data,
The search encryption device includes a storage device that stores data, a processing device that processes data, a search storage unit, a polynomial value calculation unit, and a search encryption unit,
The search storage unit stores n search data corresponding to n integers of 1 to n using the storage device,
The polynomial value calculation unit uses the processing device to convert the integer into a (d-1) -degree univariate polynomial (d is an integer of 1 to n) for each of n integers of 1 to n. Is calculated as n polynomial values,
The search encryption unit uses the processing device to set the search data stored in the search storage unit and the polynomial value calculated by the polynomial value calculation unit for each of n integers of 1 to n. Is encrypted into n pieces of encrypted search data,
The search device includes a processing device that processes data, a storage device that stores data, an encryption index storage unit, an encrypted search storage unit, a determination target selection unit, an interpolation coefficient value calculation unit, and a mapping calculation. Part, a comparison calculation part, and a determination part,
The encrypted index storage unit uses the storage device to store n encrypted index data encrypted by the index encryption device;
The encrypted search storage unit stores n encrypted search data encrypted by the search encryption device using the storage device,
The determination target selection unit uses the processing device to select d integers from n integers of 1 to n to obtain d determination target integers,
The interpolation coefficient value calculation unit calculates a Lagrange interpolation coefficient value based on the d determination target integers selected by the determination target selection unit using the processing device, and obtains d interpolation coefficient values. age,
The mapping calculation unit uses the processing device to store the encrypted index data stored in the encrypted index storage unit and the encrypted search storage for each of the d determination target integers selected by the determination target selection unit. A set of encrypted search data stored by the unit and the interpolation coefficient value calculated by the interpolation coefficient value calculation unit to obtain d mapped data;
The comparison calculation unit calculates comparison data based on the d pieces of mapping data mapped by the mapping calculation unit using the processing device,
The determination unit uses the processing device to determine the index data, the search data, and the search data for the d determination target integers selected by the determination target selection unit based on the comparison data calculated by the comparison calculation unit. A search system characterized by determining whether or not they match.   The interpolation coefficient value calculation unit uses the processing device to set one of the d determination target integers selected by the determination target selection unit as a target integer, and the d number of determination target selection units selected by the determination target selection unit. Among the determination target integers, (d−1) determination target integers other than the target integer are defined as (d−1) non-target integers, and for each of the (d−1) non-target integers, the non-target integers. The quotient obtained by dividing the non-target integer by the difference obtained by subtracting the target integer from is calculated, and the total product of the calculated (d-1) quotients is calculated as the interpolation coefficient value for the target integer. The search system according to claim 1, wherein:   3. The search according to claim 1, wherein the polynomial value calculation unit calculates the polynomial value using the processing device as a predetermined secret integer as a constant term of the univariate polynomial. system. The search system further includes a setting device,
The setting device includes a secret integer generation unit and a public source calculation unit,
The secret integer generation unit randomly generates an integer less than or equal to 1 and less than p (p is a prime number) using the processing device as a secret integer,
The public source calculation unit maps the secret integer generated by the secret integer generation unit using the processing device, by a first mapping that injects an integer of 0 or more and less than p onto a group of order p. Calculate the source, and make it a publisher,
The index encryption apparatus includes a public source storage unit, an index integer storage unit, an index source calculation unit, and a determination source calculation unit,
The publisher storage unit stores the publisher calculated by the setting device using the storage device,
The index integer storage unit stores n integers of 1 or more and less than p using the storage device as index integers corresponding to n integers of 1 or more and n or less,
The index source calculation unit uses the processing device to calculate an integer of 0 or more and less than p based on the index integer stored in the index integer storage unit for each of n integers of 1 to n. By calculating the element that maps the index integer by the second mapping that is injected into the group of
The determination source calculation unit uses the processing device to perform a third injection of the element of the group of order p to the element of the group of order p based on the publication source stored by the publication source storage unit. Based on the mapping, calculate the source that maps the above publisher, and use it as the judgment source.
The search encryption device includes a secret integer storage unit, a search integer storage unit, a polynomial coefficient generation unit, and a search source calculation unit,
The secret integer storage unit stores the secret integer generated by the setting device using the storage device,
The search integer storage unit stores n integers of 1 or more and less than p using the storage device as search integers corresponding to n integers of 1 or more and n or less,
The polynomial coefficient generation unit randomly generates (d−1) integers of 0 or more and less than p using the processing device to obtain (d−1) polynomial coefficients,
The polynomial value calculation unit uses the processing device to set the secret integer stored in the secret integer storage unit as a constant term of the univariate polynomial, and generates (d−1) pieces of polynomial coefficients generated by the polynomial coefficient generation unit. The polynomial value is calculated using the polynomial coefficient as the coefficient of each term from the first order to the (d-1) th order of the univariate polynomial,
The search source calculation unit uses the processing device to calculate a search integer stored in the search integer storage unit and a polynomial value calculated by the polynomial value calculation unit for each of n integers of 1 to n. Based on a fourth mapping that maps a set of integers greater than or equal to 1 and less than p and integers greater than or equal to 0 and less than p to a group of order p, an element obtained by mapping the set of the search integer and the polynomial value To obtain n search sources,
The search device includes an index source storage unit, a determination source storage unit, a search source storage unit, a mapping source calculation unit, and a comparison source calculation unit,
The index source storage unit stores n index sources calculated by the index encryption device using the storage device,
The determination source storage unit stores the determination source calculated by the index encryption device using the storage device,
The search source storage unit stores n search sources calculated by the search encryption device using the storage device,
The mapping source calculation unit stores the index source stored in the index source storage unit and the search source storage unit for each of the d determination target integers selected by the determination target selection unit using the processing device. Based on the obtained search source and the interpolation coefficient value calculated by the interpolation coefficient value calculation unit, the order of the group of the group of order p, the element of the group of order p, and an integer between 0 and less than p a fifth mapping that maps to the group of p, calculates a mapping element of the set of the index source, the search source, and the interpolation coefficient value, and sets it as d mapping sources,
The comparison source calculation unit calculates a source obtained by combining the d mapping sources calculated by the mapping source calculation unit by group operation using the processing device, and sets the comparison source as a comparison source,
The determination unit uses the processing device, and when the comparison source calculated by the comparison source calculation unit is equal to the determination source stored in the determination source storage unit, the determination unit selection unit selects d pieces The search system according to any one of claims 1 to 3, wherein the index integer and the search integer are determined to match with respect to the determination target integer. The determination source calculation unit, for an arbitrary integer of 0 or more and less than p, is obtained by mapping an element obtained by mapping the arbitrary integer by the first mapping by the third mapping to the arbitrary integer. A map that is equal to the element obtained by combining the predetermined elements of the number by the group operation is used as the third map.
The mapping element calculation unit, for any first integer less than or equal to 1 and less than p, the element obtained by mapping the first arbitrary integer by the second mapping, the first arbitrary integer, and the second The element obtained by mapping the set of integers by the fourth mapping and the set of third integers by the fifth mapping is the product of the second integer and the third integer. 5. The search system according to claim 4, wherein a map that is equal to a number obtained by combining the predetermined elements equal in number to a group operation is used as the fifth map. The setting device further includes a secret random number generation unit and a public random number source calculation unit,
The secret random number generation unit randomly generates an integer less than or equal to 1 and less than p for each of n integers greater than or equal to 1 and less than or equal to n using the processing device, and generates n secret random numbers,
The public element calculation unit uses the processing device to map a pair of elements of the first group and elements of the second group to elements of the third group (the first linear pairing map). The order of the group and the second group and the third group is p.), So that the first generator that is the generator of the first group and the second that is the generator of the second group Based on the third generator that is a mapping element and the secret integer generated by the secret integer generator, the number of the third generators equal to the secret integer is Calculate the combined element by group operation of the group, and make it a publisher,
The public random number source calculation unit, using the processing device, for each of n integers of 1 to n, based on the first generation source and the secret random number generated by the secret random number generation unit, Calculate the number of the first generators equal to the secret random number by combining the first group by the group operation of the first group to obtain n public random number sources,
The index encryption apparatus further includes a public random number source storage unit and an index random number generation unit,
The public random number source storage unit stores the n public random number sources calculated by the setting device using the storage device,
The index random number generation unit randomly generates an integer of 1 or more and less than p using the processing device as an index random number,
The determination source calculation unit uses the processing device to calculate a number of the public number equal to the index random number based on the public source stored by the public source storage unit and the index random number generated by the index random number generation unit. The element is calculated by combining the elements by the group operation of the third group, and is used as a determination source.
The index source calculation unit uses the processing device to store a public random number source stored in the public random number source storage unit and an index integer stored in the index integer storage unit for each of n integers of 1 to n. Based on the index random number generated by the index random number generator, the number of the public random number elements equal to the product of the index integer and the index random number is combined by the group operation of the first group. To calculate n index sources,
The search encryption apparatus further includes a secret random number storage unit,
The secret random number storage unit stores n secret random numbers generated by the setting device using the storage device,
The search source calculation unit uses the processing device to store the second generator, the secret random number stored in the secret random number storage unit, and the search integer storage unit for each of n integers of 1 to n. Based on the search integer stored by and the polynomial value calculated by the polynomial value calculation unit, the number of the second generators equal to the quotient obtained by dividing the polynomial value by the product of the secret random number and the search integer. , Calculate the combined element by the group operation of the second group, and make n search sources,
In the above search device,
The mapping source calculation unit stores the index source stored in the index source storage unit and the search source storage unit for each of the d determination target integers selected by the determination target selection unit using the processing device. Based on the retrieved search source, the bilinear pairing mapping is used to calculate the elements of the third group obtained by mapping the set of the index source and the search source to obtain d pairing values. For each of the d determination target integers selected by the target selection unit, the number of pairs equal to the interpolation coefficient value is calculated based on the calculated pairing value and the interpolation coefficient value calculated by the interpolation coefficient value calculation unit. Calculate ring elements by combining the ring values by the group operation of the third group to obtain d mapping elements,
The comparison source calculation unit calculates an element obtained by combining the d mapping sources calculated by the mapping source calculation unit by the group operation of the third group using the processing device, and sets the comparison source as a comparison source 6. The search system according to claim 4 or 5, wherein: The setting device further includes a public random number source calculation unit,
The publisher calculation unit uses the processing device to generate a first generator that is a generator of the first group (the order of the first group is p.) And the secret integer generator. Based on the secret integer, the number of the first generators equal to the secret integer is calculated by combining the first group by the group operation of the first group, and set as a public source,
The public random number element calculation unit uses the processing device to randomly generate a second group generator (the order of the second group is p.) For each of n integers of 1 to n. Generate n public random number sources,
The index encryption apparatus further includes a public random number source storage unit, a random number source calculation unit, and an index random number generation unit ,
The public random number source storage unit stores the n public random number sources calculated by the setting device using the storage device,
The index random number generation unit randomly generates an integer of 1 or more and less than p using the processing device as an index random number,
The determination source calculation unit uses the processing device to determine the first group based on a second generation source that is a generation source of the second group and a disclosure source stored in the disclosure source storage unit. A bilinear pairing map that maps a set of elements of the second group and elements of the second group to a third group of elements (the order of the third group is p.) Is Calculate the element of the third group to which the pair with the generator is mapped, and based on the calculated element of the third group and the index random number generated by the index random number generator, the index random number and An element obtained by combining an equal number of elements of the third group by the group operation of the third group is used as a determination source,
The random number source calculation unit, using the processing device, based on the first generation source and the index random number generated by the index random number generation unit, the number of the first generation source equal to the index random number, Calculate the combined element by the group operation of the first group, and make it a random number element,
The index source calculation unit uses the processing device to calculate an index integer stored in the index integer storage unit and a public random number source stored in the public random number source storage unit for each of n integers of 1 to n. Based on the above, a set of the index integer and the public random number element is mapped by a mapping function that maps a set of integers greater than or equal to 0 and less than p and elements of the second group to elements of the second group. The element of the second group is calculated as n index function values, and the calculated index function value and the index generated by the index random number generation unit for each of n integers of 1 to n. Based on the random number, calculate an element obtained by combining the index function values equal to the index random number by the group operation of the second group to obtain n index elements,
The search encryption device further includes a public random number source storage unit, a search random number generation unit, and a search random number source calculation unit,
The public random number source storage unit stores the n public random number sources calculated by the setting device using the storage device,
The search random number generation unit randomly generates an integer of 1 or more and less than p for each of n integers of 1 or more and n or less using the processing device as n search random numbers,
The search source calculation unit uses the processing device to store a search integer stored in the search integer storage unit and a public random number source stored in the public random number source storage unit for each of n integers of 1 to n. Based on the above, the set of the search integer and the public random number element is mapped by the mapping function, and the elements of the second group are calculated to obtain n search function values. For each of the n integers, the number of the search function values equal to the search random number is calculated based on the calculated search function value and the search random number generated by the search random number generation unit. The elements combined by the group operation are calculated, and based on the second generator and the polynomial value calculated by the polynomial value calculation unit, the number of the second generators equal to the polynomial value is calculated. Calculate the combined element by group operation of the group, The second of the two original groups by calculating the original bound by group operation of the second group, and n number of the search source,
The search random number source calculation unit uses the processing device to determine the number of 1 or more and n or less integers based on the first generation source and the search random number generated by the search random number generation unit. The number of the first generators equal to the search random number is calculated by combining the first group by the group operation of the first group to obtain n search random number sources,
The search device further includes a random number source storage unit and a search random number source storage unit,
The random number source storage unit stores the random number source calculated by the index encryption device using the storage device,
The search random number source storage unit stores n search random number sources calculated by the search encryption device using the storage device,
The mapping source calculation unit stores the random number source stored by the random number source storage unit and the search source storage unit for each of the d determination target integers selected by the determination target selection unit using the processing device. Based on the obtained search source, the bilinear pairing mapping is used to calculate the element of the third group that maps the set of the random number source and the search source to obtain d first pairing values. For each of the d determination target integers selected by the determination target selection unit, the bilinearity is determined based on the search random number source stored in the search random number source storage unit and the index source stored in the index source storage unit. Based on the pairing mapping, the elements of the third group obtained by mapping the set of the search random number element and the index element are calculated to obtain d second pairing values, and d selected by the determination target selection unit Calculated for each judgment target integer And said a first pairing value, the calculated and the inverse of the second pairing value by calculating the original bound by group operation of the third group, and d pieces of mapping source,
The comparison source calculation unit calculates an element obtained by combining the d mapping sources calculated by the mapping source calculation unit by the group operation of the third group using the processing device, and sets the comparison source as a comparison source 6. The search system according to claim 4 or 5, wherein: The index encryption apparatus further includes an index conversion unit,
The index conversion unit inputs n index character strings corresponding to n integers of 1 to n using the processing device, and has an arbitrary length for each of n integers of 1 to n The input index character string is converted into n index integers by a conversion map for converting the character string into an integer less than or equal to 1 and less than p,
The index integer storage unit stores n index integers converted by the index conversion unit using the storage device,
The search encryption apparatus further includes a search conversion unit,
The search conversion unit inputs n search character strings corresponding to n integers of 1 to n using the processing device, and converts the conversion map for each of the n integers of 1 to n. To convert the input search string into n search integers,
8. The search system according to claim 4, wherein the search integer storage unit stores n search integers converted by the search conversion unit using the storage device. A storage device for storing data, a processing device for processing data, a search storage unit, a polynomial value calculation unit, and a search encryption unit;
The search storage unit stores n search data corresponding to n integers (n is an integer of 1 or more) using the storage device.
The polynomial value calculation unit uses the processing device to convert the integer into a (d-1) -degree univariate polynomial (d is an integer of 1 to n) for each of n integers of 1 to n. Is calculated as n polynomial values,
The search encryption unit uses the processing device to set the search data stored in the search storage unit and the polynomial value calculated by the polynomial value calculation unit for each of n integers of 1 to n. Is encrypted to obtain n pieces of encrypted search data. A processing device that processes data, a storage device that stores data, an encryption index storage unit, an encrypted search storage unit, a determination target selection unit, an interpolation coefficient value calculation unit, a mapping calculation unit, and a comparative calculation And a determination unit,
The encrypted index storage unit encrypts n index data corresponding to n integers of 1 to n (n is an integer of 1 or more) using the storage device. Store indexing index data,
The encrypted search storage unit stores n encrypted search data obtained by encrypting n search data corresponding to n integers of 1 to n using the storage device,
The determination target selecting unit selects d integers (d is an integer not less than 1 and not more than n) from n integers not less than 1 and not more than n using the processing device, and determines d determinations. The target integer,
The interpolation coefficient value calculation unit calculates a Lagrange interpolation coefficient value based on the d determination target integers selected by the determination target selection unit using the processing device, and obtains d interpolation coefficient values. age,
The mapping calculation unit uses the processing device to store the encrypted index data stored in the encrypted index storage unit and the encrypted search storage for each of the d determination target integers selected by the determination target selection unit. A set of encrypted search data stored by the unit and the interpolation coefficient value calculated by the interpolation coefficient value calculation unit to obtain d mapped data;
The comparison calculation unit calculates comparison data based on the d pieces of mapping data mapped by the mapping calculation unit using the processing device,
The determination unit uses the processing device to determine the index data, the search data, and the search data for the d determination target integers selected by the determination target selection unit based on the comparison data calculated by the comparison calculation unit. A search device characterized by determining whether or not they match. A storage device for storing data, by a computer executing with a processing device for processing data, the computer functions as the search device according to the search encryption apparatus or claim 11 according to 請 Motomeko 10 A computer program characterized by the above. Using the encrypted index data obtained by encrypting the index data by the index encryption device and the encrypted search data obtained by encrypting the search data by the search encryption device, the search device matches the index data and the search data. In the search method for determining whether or not to
The index encryption device stores n index data corresponding to n integers of 1 to n (n is an integer of 1 or more);
The index encryption apparatus encrypts the stored index data for each of n integers of 1 to n to obtain n encrypted index data,
The search encryption device stores n search data corresponding to n integers of 1 to n,
The search encryption device calculates a value obtained by substituting the integer into a (d-1) degree univariate polynomial (d is an integer of 1 to n) for each of n integers of 1 to n. N polynomial values,
The search encryption device encrypts a set of stored search data and a calculated polynomial value for each of n integers of 1 to n to obtain n encrypted search data,
The search device stores n encrypted index data encrypted by the index encryption device,
The search device stores n encrypted search data encrypted by the search encryption device,
The search device selects d integers from n integers of 1 to n and sets them as d determination target integers,
The search device calculates Lagrange interpolation coefficient values based on the selected d determination target integers to obtain d interpolation coefficient values,
The search device maps a set of the stored encrypted index data, the stored encrypted search data, and the calculated interpolation coefficient value for each of the selected d determination target integers, and d mapped data age,
The search device calculates comparison data based on the d mapped data mapped,
The search method, wherein the search device determines, based on the calculated comparison data, whether or not the index data matches the search data for the selected d number of determination target integers.

Images