Group key method, device therefor and recording medium recorded with group key program

Description: TECHNICAL FIELD [Detailed description of the invention]

【0001】

[Technical field to which the invention belongs]

The present invention relates to a group key method and device for sharing information by sharing a key for encrypting / decrypting shared information with a group consisting of a plurality of users. The shared information is encrypted with a group key and shared by the group, and the user decrypts the encrypted shared information with the group key and uses the group key method and the recording medium in which the device and the group key program are recorded.

【0002】

[Conventional technology]

Businesses and workflows within a company are often performed by groups of organizations or businesses. For example, the department to which the information belongs, the position, etc. determine whether or not the confidential information can be operated and viewed. To protect such confidential information that is confidential to the group, create a group for each business, department, and job title, assign an encryption key (hereinafter referred to as the group key) to each group, and perform encryption. Is an effective method.

【0003】

Arai et al. Attach a destination list to the shared document of the group, compare this with the attribute information (name, department name, etc.) of the user stored in the IC card, etc., and perform access control for the shared information. We are proposing a method (see Masato Arai, Tadashi Forge, Hiromichi Ito, Toshiyuki Shibata: Group Cryptographic System for Corporate Information, Computer Security 1-3, p.11-16, May 29.1998). The name or department name of the user who can access the shared document is described in the destination list. However, in the workflow, groups can be created for each detailed business other than the department name, and it is generally easy to add / delete groups.

【0004】

In addition, Matsuzaki et al. Have proposed a method for updating the key of a new group on all the remaining terminals except the terminal specified by the center in the mobile communication system (Natsume Matsuzaki, Jun Ansai: For mobile communication). Suitable group key update method (II), suitable group key update method for mobile communication (III), see ISEC 97-73, p.51-62, Mar. 1998).

【0005】

[Problems to be Solved by the Invention]

In the method of Mr. Arai et al. Above, in order to add a new group, the IC card is collected and the attribute information is changed, or the names of the members of the group are listed in the destination list of the shared information of the newly added group. There is a problem that you have to do.

【0006】

Further, when the above-mentioned method of Mr. Matsuzaki et al. Is applied to encryption of shared information in a group, there are the following problems.

【0007】

In the case of the method of paying out the group key for each group, when the member X of the group leaves at a certain time t, the group key GK of that group_oldA new group key GK that member X does not know_newNeed to be updated to. The remaining members of the group are GK_newAnd after t, GK_newEncrypt with. However, to decrypt documents encrypted before time t, GK_oldThe remaining members of the group are GK_old, GK_newMust be retained. In this way, the number of keys held by the members remaining in the group increases each time the key is updated. In addition, the members who newly joined the group are the latest group key GK_newBesides the past group key GK_oldThere is also the problem of having to obtain it.

【0008】

On the other hand, in a plurality of groups having a hierarchical structure, the group members of the upper class generally have the authority to encrypt / decrypt the information of the lower class group. For example, in the model in which a department manager group, a section manager group, and a section chief group exist in a corporate organization as shown in Fig. 6, the members of the department manager group encrypt / decrypt the information of the department manager group, the section manager group, and the section chief group, and are members of the section manager group. Is generally able to encrypt / decrypt information in the section chief group and the chief group. In the case of the method of paying out the key for each group, there is a problem that the members of each group must hold the group key of the lower class in addition to their own group key.

【0009】

As described above, in the conventional method of issuing a group key for each group, (1) when the group key is updated, the past group key must be retained in addition to the latest group key (2). ) Members who newly join the group must obtain the past group key in addition to the latest group key. (3) Each member of multiple groups with a hierarchical structure has its own group key in addition to its own group key. There is a problem that the lower class group key must also be retained.

【0010】

The present invention has been made in view of the above, and an object of the present invention is to decrypt information encrypted in the past and information of a lower class group only by holding the latest group key. It is an object of the present invention to provide a group key method capable of decryption / encryption and a recording medium on which a device and a group key program are recorded.

【0011】

[Means for solving problems]

In order to achieve the above object, the present invention according to claim 1 encrypts the shared information of a group consisting of a plurality of users with a group key and shares the encrypted shared information with the group key. It is a group key method that is decrypted and used in, and the group key is a key of the common key cryptosystem, and each of n values created by using the unidirectional function f disclosed from the secret information S. t_n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the key (GK)_n, ..., GK_{k + 1}, GK_k, ..., GK₁), And every time the group key is updated, the key (GK)₁, ..., GK_{k + 1}, GK_k, ..., GK_n), Group key GK_kWhen updating, a new group key GK_{k + 1}The latest group key GK that has been updated by the user_kOnly keeps and uses this latest group key to encrypt the shared information of the group, decrypts the shared information encrypted with the group key with the group key, and the shared information encrypted with the past group key , The latest group key GK held by the user himself_kThe gist is to decrypt using the group key derived from the one-way function.

【0012】

In the present invention according to claim 1, the group key is a key of a common key cryptosystem, and n each value t created by using the one-way function f disclosed from the secret information S._n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the key (GK)_n, ..., GK_{k + 1}, GK_k, ..., GK₁), And every time the group key is updated, the key (GK)₁, ..., GK_{k + 1}, GK_k, ..., GK_n), Group key GK_kNew group key GK when updating_{k + 1}Is generated and the user has the latest group key GK_kOnly keeps and uses this latest group key to encrypt the shared information of the group, decrypts the shared information encrypted with the group key with the group key, and the shared information encrypted with the past group key The latest group key GK held by the user himself_kSince the decryption is performed using the group key derived from the one-way function, the user does not have to keep the past group key as in the past, and the newly joined member is also the latest. You only need to get the group key, not the past group key.

【0013】

Here, the group key is, for example, a key for encrypting / decrypting shared information, and is a key shared by a group.

【0014】

Further, in the present invention according to claim 2, the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the user decrypts the encrypted shared information with the group key and uses it. The group key method is a public key cryptosystem key, and each value t of n created by using the unidirectional function f disclosed from the secret information S_n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k +}₁), ..., t₁= f (t₂) Derived from the private key (SGK)_n, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_n, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And every time the group key is updated, the key (SGK)₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_n, PGK_n), And the group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated and the user can update the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kFor shared information decrypted with and encrypted with the past group key, the latest group key private key SGK_kThe gist is to decrypt using the private key derived from the one-way function.

【0015】

In the present invention according to claim 2, the group key is a key of public key cryptography, and each of n values t created by using the one-way function f disclosed from the secret information S._n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the private key (SGK)_n, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_n, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And every time the group key is updated, the key (SGK)₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_n, PGK_n), And the group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated and the user is updated with the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kThe shared information decrypted with and encrypted with the past group key is the secret key SGK of the latest group key._kSince the decryption is performed using the private key derived from the one-way function, the user does not have to keep the past group key as in the past, and the newly joined member is also the latest. You only need to get the group key, not the past group key.

【0016】

Further, the present invention according to claim 3 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users are encrypted. The group key is a group key method that allows each user to encrypt / decrypt information of his / her own class and classes lower than his / her own class while decrypting and using the shared information with the group key. , A key of the common key encryption method, and each value y of m created by using the unidirectional function g disclosed from the secret information S._m= g (S), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_m, ..., GK_{k + 1}, GK_k, ..., GK₁), And as a group key for each class from the top to each class, (GK₁, ..., GK_{k +}₁, GK_k, ..., GK_m), And the user is assigned the latest group key GK._kOnly is retained, and this group key is used to encrypt the shared information of the group, decrypt the shared information encrypted with the group key of its own class, and encrypt it with the group key of the lower class. To decrypt the information, the user himself / herself has his / her own group key GK._kThe gist is to use the key derived from the one-way function.

【0017】

In the present invention according to claim 3, the group key is a key of the common key cryptosystem in a plurality of groups having a hierarchical structure, and is created by using the one-way function g disclosed from the secret information S. Each value of m that is y_m= g (S), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_m, ..., GK_{k + 1}, GK_k, ..., GK₁), And as a group key for each class from the top to each class, (GK₁, ..., GK_{k + 1}, GK_k, ..., GK_m), And the user has the latest group key GK._kOnly retained, the shared information of the group was encrypted using this group key, the shared information encrypted with the group key of its own class was decrypted, and it was encrypted with the group key of the lower class than itself. To decrypt the information, the user himself has his own group key GK_kSince the key derived from the one-way function is used, the user does not have to keep the past group key as in the past, and the members of each group are lower class in addition to their own group key. There is no need to hold the group key of.

【0018】

The present invention according to claim 4 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users share the encrypted shared information. Is a group key method that allows the user to encrypt / decrypt information of his / her own class and classes lower than his / her own class while decrypting and using the group key, and the group key is the public key. Each of m values y, which is a cryptographic key and is created using the unidirectional function g disclosed by the secret information S._m= g (S), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_m, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_m, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And as a group key for each class from the top to each class, (SGK₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_m, PGK_m) Pairs are assigned to users in order, and the user assigns the latest group key (SGK)._k, PGK_k) Only, the public key PGK for this group key_kEncrypts the shared information of the group using the private key SGK_kUse the public key PGK of your class's group key_kIn order to decrypt the shared information encrypted with, and to decrypt the information encrypted with the group key of the lower class than itself, the user himself / herself has his / her own private key SGK._kThe gist is to use the key derived from the one-way function.

【0019】

In the present invention according to claim 4, the group key is a public key cryptosystem key in a plurality of groups having a hierarchical structure, and is created by using the one-way function g disclosed from the secret information S. Each value of m that is y_m= g (S), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_m, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_m, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And as a group key for each class from the top to each class, (SGK₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_m, PGK_m) Pairs are assigned to users in order, and users are assigned the latest group key (SGK)._k, PGK_k) Only, the public key PGK for this group key_kEncrypts the shared information of the group using the private key SGK_kUse the public key PGK of your class's group key_kIn order to decrypt the shared information encrypted with, and to decrypt the information encrypted with the group key of the lower class than itself, the user himself / herself has his / her own private key SGK._kSince the key derived from the one-way function is used, the user does not have to keep the past group key as in the past, and the members of each group are lower class in addition to their own group key. There is no need to hold the group key of.

【0020】

Further, the present invention according to claim 5 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users are encrypted. The group key is a group key method that allows each user to encrypt / decrypt information of his / her own class and classes lower than his / her own class while decrypting and using the shared information with the group key. , A common key encryption key, each of n values t created using the unidirectional function f published from the secret information S1._n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_r, ..., GK_{k + 1}, GK_k, ..., GK₁) And the group key GK_kWhen updating, a new group key GK_{k + 1}The latest group key GK that has been updated by the user_kOnly keeps and uses this latest group key to encrypt the shared information of the group and decrypt the shared information encrypted with the group key of its own class, and the shared encrypted with the past group key For information, the latest group key GK held by the user himself_kFor information that is decrypted using the group key derived from the one-way function f and encrypted with the group key of a lower class than itself, the user himself / herself is the one-way function from his / her own group key. The gist is that it is decrypted using the key derived in g.

【0021】

In the present invention according to claim 5, the group key is a key of the common key cryptosystem in a plurality of groups having a hierarchical structure, and is created by using the one-way function g disclosed from the secret information S1. Each of n values t_n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_r, ..., GK_{k + 1}, GK_k, ..., GK₁) And the group key GK_kWhen updating, a new group key GK_{k + 1}Is generated and the user has the latest group key GK_kOnly keeps and uses this latest group key to encrypt the shared information of the group and decrypt the shared information encrypted with the group key of its own class, and the shared encrypted with the past group key The information is the latest group key GK held by the user himself._kThe information decrypted from the group key derived from the unidirectional function f using the group key and encrypted with the group key of the lower class is the user himself / herself using the unidirectional function g from his / her own group key. Since it is decrypted using the derived key, the user does not need to keep the past group key as in the past, and the newly joined member only needs to obtain the latest group key. It is not necessary to obtain the past group key, and the members of each group do not need to hold the group key of the lower class in addition to their own group key.

【0022】

Further, the present invention according to claim 6 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users are encrypted. The group key is a group key method that allows each user to encrypt / decrypt information of his / her own class and classes lower than his / her own class while decrypting and using the shared information with the group key. , Public key Cryptographic key, n each value t created using the unidirectional function f published from secret information S1_n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_r, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_r, ..., PGK_{k + 1}, PGK_k, ..., PGK₁) Pair and group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated and the user can use the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kFor shared information decrypted with and encrypted with the past group key, the private key SGK of the latest group key_kFor information that is decrypted using the private key derived from the one-way function f and encrypted with a group key of a lower class than itself, the user himself / herself is one-way from his / her own group key. The gist is that it is decrypted using the private key derived by the function g.

【0023】

In the present invention according to claim 6, the group key is a key of public key cryptography, and each of n values t created by using the one-way function f disclosed from the secret information S1._n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_r, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_r, ..., PGK_{k + 1}, PGK_k, ..., PGK₁) Pair and group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated, and the user can use the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kThe shared information decrypted with and encrypted with the past group key is the secret key SGK of the latest group key._kDecrypted using the private key derived from the unidirectional function f, and the information encrypted with the group key of the lower class than itself is derived by the user himself from his own group key with the unidirectional function g. Since it is decrypted using the private key, the user does not need to keep the past group key as in the past, and new members who join the group only need to obtain the latest group key. It is not necessary to obtain the past group key, and the members of each group do not need to hold the group key of the lower class in addition to their own group key.

【0024】

The present invention according to claim 7 is the invention according to any one of claims 3 to 6, wherein the group key represents a hierarchical organization.₁, Y₂, ..., Y_mEach of the m values y created by the one-way function g using_m= g (STheY_m), ..., y_{k + 1}= g (y _{k + 1}TheY_{k + 1}), Y_k= g (y _kTheY_k), ..., y₁= g (y ₁TheY₁), Where y _kIs y_kThe gist is that it is a value in the upper hierarchy of.

【0025】

In the present invention according to claim 7, the group key is public information Y representing a hierarchical organization.₁, Y₂, ..., Y_mEach of m values y created by the one-way function g using_m= g (STheY_m), ..., y_{k + 1}= g (y _{k + 1}TheY_{k + 1}), Y_k= g (y _kTheY_k), ..., y₁= g (y ₁TheY₁) Derived from.

【0026】

Further, the present invention according to claim 8 is the invention according to any one of claims 1 to 7, wherein the shared information is encrypted with an arbitrary key generated by the user, and the key is encrypted with a group key. The gist is to attach to the encrypted shared information as attached information.

【0027】

In the present invention according to claim 8, the shared information is encrypted with an arbitrary key generated by the user, and the key encrypted with the group key is attached to the encrypted shared information as attached information.

【0028】

Furthermore, the gist of the present invention according to claim 9 is that the attached information is encrypted with the latest group key each time the group key is updated in the invention according to claim 8.

【0029】

In the present invention according to claim 9, the attached information is encrypted with the latest group key each time the group key is updated.

【0030】

The present invention according to claim 10 is a group in which shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the user decrypts the encrypted shared information with a group key and uses it. Each of n values t, which is a key device, a key of a common key cryptosystem, and is created by using a unidirectional function f disclosed from secret information S._n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the group key (GK)_n, ..., GK_{k + 1}, GK_k, ..., GK₁) Is generated, and the key (GK) is updated every time this generated group key is updated.₁, ..., GK_{k + 1}, GK_k, ..., GK_n), Group key GK_kWhen updating, a new group key GK_{k + 1}Group key update means to generate, and the latest group key GK provided and updated on the user terminal_kThe group key holding means that holds only the user's own group key and the latest group key held in this group key holding means are used to encrypt the shared information of the group and are encrypted with the group key. A user whose encryption / decryption means for decrypting shared information with a group key and a group key for decrypting shared information encrypted with a past group key are held in the group key holding means. Own latest group key GK_kThe gist is to have a group key derivation means for past information derived from from using a one-way function.

【0031】

In the present invention according to claim 10, the group key is a key of a common key cryptosystem, and n each value t created by using the one-way function f disclosed from the secret information S._n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the key (GK)_n, ..., GK_{k + 1}, GK_k, ..., GK₁), And every time the group key is updated, the key (GK)₁, ..., GK_{k + 1}, GK_k, ..., GK_n), Group key GK_kNew group key GK when updating_{k + 1}Is generated and the user has the latest group key GK_kOnly keeps and uses this latest group key to encrypt the shared information of the group, decrypts the shared information encrypted with the group key with the group key, and the shared information encrypted with the past group key The latest group key GK held by the user himself_kSince the decryption is performed using the group key derived from the one-way function, the user does not have to keep the past group key as in the past, and the newly joined member is also the latest. You only need to get the group key, not the past group key.

【0032】

Further, in the present invention according to claim 11, the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the user decrypts the encrypted shared information with the group key and uses it. A group key device that is a public key cryptosystem key, and n values t created by using a unidirectional function f disclosed from secret information S._n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the private key (SGK)_n, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_n, ..., PGK_{k + 1}, PGK_k, ..., PGK₁) Private key / public key generation means for generating a pair, and a key (SGK) every time the group key is updated._k, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_n, PGK_n), And the group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) And the latest group key (SGK) provided on the user terminal and updated._k, PGK_k) Only the group key holding means and the latest group key public key PGK held in this group key holding means_kEncrypts the shared information of the group and uses the public key PGK of the group key._kThe shared information encrypted with the group key private key SGK_kThe encryption / decryption means for decrypting with, and the latest group key held by the group key holding means with the private key of the group key for decrypting the shared information encrypted with the past group key. Private key SGK_kThe gist is to have a group key derivation means for past information derived from from using a one-way function.

【0033】

In the present invention according to claim 11, the group key is a key of public key cryptography, and each of n values t created by using the one-way function f disclosed from the secret information S._n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the private key (SGK)_n, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_n, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And every time the group key is updated, the key (SGK)₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_n, PGK_n), And the group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated and the user is updated with the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kThe shared information decrypted with and encrypted with the past group key is the secret key SGK of the latest group key._kSince the decryption is performed using the private key derived from the one-way function, the user does not have to keep the past group key as in the past, and the newly joined member is also the latest. You only need to get the group key, not the past group key.

【0034】

Further, the present invention according to claim 12 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users are encrypted. It is a group key device that can decrypt / decrypt shared information with a group key, and each user can encrypt / decrypt information of his / her own class and classes lower than his / her own class, and is a common key encryption. Each value y of m, which is the key of the method and is created by using the unidirectional function g published from the secret information S._m= g (S), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_m, ..., GK_{k + 1}, GK_k, ..., GK₁As a group key generation means to generate) and as a group key for each class from the top for each class, (GK₁, ..., GK_{k + 1}, GK_k, ..., GK_m), And the latest group key GK provided on the user terminal and assigned to the user._kThe group key holding means that holds only and the group key held by this group key holding means are used to encrypt the shared information of the group and decrypt the shared information encrypted by the group key of the own class. The user's own group key GK whose encryption / decryption means and the key for decrypting the information encrypted by the group key of the lower class than itself are held in the group key holding means._kThe gist is to have a key derivation means for lower class information derived from the above using a one-way function.

【0035】

In the present invention according to claim 12, the group key is a key of the common key cryptosystem in a plurality of groups having a hierarchical structure, and is created by using the one-way function g disclosed from the secret information S. Each value of m that is y_m= g (S), ..., y_{k + 1}= g (y_{k +}₂), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_m, ..., GK_{k + 1}, GK_k, ..., GK₁), And as a group key for each class from the top to each class, (GK₁, ..., GK_{k + 1}, GK_k, ..., GK_m), And the user has the latest group key GK._kOnly retained, the shared information of the group was encrypted using this group key, the shared information encrypted with the group key of its own class was decrypted, and it was encrypted with the group key of the lower class than itself. To decrypt the information, the user himself has his own group key GK_kSince the key derived from the one-way function is used, the user does not have to keep the past group key as in the past, and the members of the group are in the lower class in addition to their own group key. There is no need to hold a group key.

【0036】

The present invention according to claim 13 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users share the encrypted shared information. Is a group key device that can encrypt / decrypt information of its own class and classes lower than its own class while decrypting and using it with a group key, and is a key of public key cryptography. And each of m values y created using the unidirectional function g published from the secret information S_m= g (S), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_m, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_m, ..., PGK_{k + 1}, PGK_k, ..., PGK₁) Is generated as a private key / public key generation means for the group key, and as a group key for each class from the upper level to each class, (SGK₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_m, PGK_m) Pairs are assigned to users in order, and a group key (SGK) provided on the user terminal and assigned to the user._k, PGK_k) Only the group key holding means and the public key PGK of the group key held by this group key holding means_kEncrypts the shared information of the group using the private key SGK_kUse the public key PGK of your class's group key_kThe group key holding means holds an encryption / decryption means for decrypting the shared information encrypted in the above and a key for decrypting the information encrypted with the group key of the lower class than itself. The user himself is the private key SGK_kThe gist is to have a key derivation means for lower class information derived from the above using a one-way function.

【0037】

In the present invention according to claim 13, the group key is a key of public key cryptography in a plurality of groups having a hierarchical structure, and is created by using the one-way function g disclosed from the secret information S. Each value of m that is y_m= g (S), ..., y_{k + 1}= g (y_{k +}₂), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_m, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_m, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And as a group key for each class from the top to each class, (SGK₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_m, PGK_m) Pairs are assigned to the users in order, and the users are assigned the group key (SGK)._k, PGK_k) Only, the public key PGK for this group key_kEncrypts the shared information of the group using the private key SGK_kUse the public key PGK of your class's group key_kIn order to decrypt the shared information encrypted with, and to decrypt the information encrypted with the group key of the lower class than itself, the user himself / herself has his / her own private key SGK._kSince the key derived from the one-way function is used, the user does not have to keep the past group key as in the past, and the members of each group are lower class in addition to their own group key. There is no need to hold the group key of.

【0038】

Further, the present invention according to claim 14 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users are encrypted. It is a group key device that can decrypt / decrypt shared information with a group key, and each user can encrypt / decrypt information of his / her own class and classes lower than his / her own class, and is a common key encryption. Each of n values t, which is the key of the method and is created using the unidirectional function f published from the secret information S1._n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the group key (GK)_r, ..., GK_{k + 1}, GK_k, ..., GK₁) And the group key GK_kWhen updating, a new group key GK_{k + 1}The latest group key GK provided and updated on the user terminal and the group key generation means to generate_kThe group key holding means that holds only as the user's own group key and the latest group key held in this group key holding means are used to encrypt the shared information of the group and the group key of the own class. Utilization in which the encryption / decryption means for decrypting the shared information encrypted in the above and the group key for decrypting the shared information encrypted with the past group key are held in the group key holding means. Person's own latest group key GK_kThe group key derivation means for past information derived from the unidirectional function f and the key for decrypting the information encrypted by the group key of the lower class than itself are held in the group key holding means. The gist is that it has a group key derivation means for lower class information that is derived from the user's own group key with a unidirectional function g.

【0039】

In the present invention according to claim 14, the group key is a key of the common key cryptosystem in a plurality of groups having a hierarchical structure, and is created by using the one-way function f disclosed from the secret information S1. Each of n values t_n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_r, ..., GK_{k + 1}, GK_k, ..., GK₁) And the group key GK_kWhen updating, a new group key GK_{k + 1}Is generated and the user has the latest group key GK_kOnly keeps and uses this latest group key to encrypt the shared information of the group and decrypt the shared information encrypted with the group key of its own class, and the shared encrypted with the past group key The information is the latest group key GK held by the user himself._kThe information decrypted from the group key derived from the unidirectional function f using the group key and encrypted with the group key of the lower class is the user himself / herself using the unidirectional function g from his / her own group key. Since it is decrypted using the derived key, the user does not need to keep the past group key as in the past, and the newly joined member only needs to obtain the latest group key. It is not necessary to obtain the past group key, and the members of each group do not need to hold the group key of the lower class in addition to their own group key.

【0040】

The present invention according to claim 15 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users share the encrypted shared information. Is a group key device that can encrypt / decrypt information of its own class and classes lower than its own class while decrypting and using it with a group key, and is a public key cryptosystem. Each of n values t that is a key and is created using the unidirectional function f exposed from the secret information S1._n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_r, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_r, ..., PGK_{k + 1}, PGK_k, ..., PGK₁) Pairs and group keys (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated as a private key / public key generation means for the group key, and the latest group key (SGK) provided and updated on the user terminal._k, PGK_kA group key holding means that holds only) as the user's own group key, and the public key PGK of the latest group key held by this group key holding means._kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kThe latest group key of the user whose own encryption / decryption means and the private key for decrypting the shared information encrypted by the past group key are held in the group key holding means. Private key SGK_kThe group key holding means holds a secret key derivation means for past information derived from the unidirectional function f and a secret key for decrypting information encrypted with a group key of a lower class than itself. The gist is that it has a secret key derivation means for lower class information that is derived from the user's own group key by a unidirectional function g.

【0041】

In the present invention according to claim 15, the group key is a key of public key cryptography, and each of n values t created by using the one-way function f disclosed from the secret information S1._n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k +}₁), ..., y₁= g (y₂) Derived from the private key (SGK)_r, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_r, ..., PGK_{k + 1}, PGK_k, ..., PGK₁) Pair and group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated, and the user can use the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kThe shared information decrypted with and encrypted with the past group key is the secret key SGK of the latest group key._kDecrypted using the private key derived from the unidirectional function f, and the information encrypted with the group key of the lower class than itself is derived by the user himself from his own group key with the unidirectional function g. Since it is decrypted using the private key, the user does not need to keep the past group key as in the past, and new members who join the group only need to obtain the latest group key. It is not necessary to obtain the past group key, and the members of each group do not need to hold the group key of the lower class in addition to their own group key.

【0042】

The present invention according to claim 16 is the invention according to any one of claims 12 to 15, wherein the group key represents a hierarchical organization.₁, Y₂, ..., Y_mEach of the m values y created by the one-way function g using_m= g (STheY_m), ..., y_{k + 1}= g (y _{k + 1}TheY_{k + 1}), Y_k= g (y _kTheY_k), ..., y₁= g (y ₁TheY₁), Where y _kIs y_kThe gist is that it is a value in the upper hierarchy of.

【0043】

In the present invention according to claim 16, the group key is public information Y representing a hierarchical organization.₁, Y₂, ..., Y_mEach of m values y created by the one-way function g using_m= g (STheY_m), ..., y_{k + 1}= g (y _{k + 1}TheY_{k + 1}), Y_k= g (y _kTheY_k), ..., y₁= g (y ₁TheY₁) Derived from.

【0044】

Further, the present invention according to claim 17 is the invention according to any one of claims 10 to 16, wherein the shared information is encrypted with an arbitrary key generated by the user, and the key is encrypted with a group key. The gist is to attach to the encrypted shared information as attached information.

【0045】

In the present invention according to claim 17, the shared information is encrypted with an arbitrary key generated by the user, and the key encrypted with the group key is attached to the encrypted shared information as attached information.

【0046】

Further, the present invention according to claim 18 is the gist of the invention according to claim 17, wherein the attached information is encrypted with the latest group key each time the group key is updated.

【0047】

In the present invention according to claim 18, the attached information is encrypted with the latest group key each time the group key is updated.

【0048】

The present invention according to claim 19 is a group in which shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the user decrypts the encrypted shared information with a group key and uses the group. A recording medium on which a key program is recorded, a group key is a key of a common key cryptosystem, and n respective values t created by using a unidirectional function f disclosed from secret information S._n= f (S), ..., t_{k + 1}= f (t_{k +}₂), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the key (GK)_n, ..., GK₁, GK_k, ..., GK₁), And every time the group key is updated, the key (GK)₁, ..., GK_{k + 1}, GK_k, ..., GK_n), Group key GK_kWhen updating, a new group key GK_{k + 1}The latest group key GK that has been updated by the user_kOnly hold and use this latest group key to encrypt the shared information of the group, decrypt the shared information encrypted with the group key with the group key, and convert it to the shared information encrypted with the past group key. If there is, the latest group key GK held by the user himself_kThe gist is to record a group key program to be decrypted using a group key derived from the above using a one-way function on a recording medium.

【0049】

In the present invention according to claim 19, the group key is a key of a common key cryptosystem, and n each value t created by using the one-way function f disclosed from the secret information S._n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the key (GK)_n, ..., GK_{k + 1}, GK_k, ..., GK₁), And every time the group key is updated, the key (GK)₁, ..., GK_{k + 1}, GK_k, ..., GK_n), Group key GK_kNew group key GK when updating_{k + 1}Is generated and the user has the latest group key GK_kOnly keeps and uses this latest group key to encrypt the shared information of the group, decrypts the shared information encrypted with the group key with the group key, and the shared information encrypted with the past group key The latest group key GK held by the user himself_kSince the group key program to be decoded using the group key derived from the above using the one-way function is recorded on the recording medium, the distribution medium can be improved by using the recording medium.

【0050】

Further, in the present invention according to claim 20, the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the user decrypts the encrypted shared information with the group key and uses it. Group key A recording medium on which a program is recorded, in which the group key is a public key cryptographic key, and n each created by using a public unidirectional function f consisting of secret information S. Value t_n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the private key (SGK)_n, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_n, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And every time the group key is updated, the key (SGK)₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_n, PGK_n), And the group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated and the user can update the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kThe shared information decrypted with and encrypted with the past group key is the secret secret key SGK of the latest group key._kThe gist is to record a group key program to be decrypted using a private key derived from the above using a one-way function on a recording medium.

【0051】

In the present invention according to claim 20, the group key is a key of public key cryptography, and n each value t created by using the one-way function f disclosed from the secret information S._n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) Derived from the private key (SGK)_n, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_n, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And every time the group key is updated, the key (SGK)_k, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_n, PGK_n), And the group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated and the user is updated with the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kThe shared information decrypted with and encrypted with the past group key is the secret key SGK of the latest group key._kSince the group key program to be decrypted using the secret key derived from the above using the one-way function is recorded on the recording medium, the recording medium can be used to improve its circulation.

【0052】

Further, the present invention according to claim 21 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users are encrypted. It is a recording medium that records a group key program that allows each user to encrypt / decrypt information of his / her own class and classes lower than his / her own class while decrypting and using the shared information with a group key. The group key is a key of the common key encryption method, and each value y of m created by using the unidirectional function g disclosed from the secret information S._m= g (S), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_m, ..., GK_{k + 1}, GK_k, ..., GK₁), And as a group key for each class from the top to each class, (GK₁, ..., GK_{k + 1}, GK_k, ..., GK_m), And the user is assigned the latest group key GK._kOnly is retained, and this group key is used to encrypt the shared information of the group, decrypt the shared information encrypted with the group key of its own class, and encrypt it with the group key of the lower class. To decrypt the information, the user himself / herself has his / her own group key GK._kThe gist is to record a group key program using a key derived from a one-way function on a recording medium.

【0053】

In the present invention according to claim 21, the group key is a key of the common key cryptosystem in a plurality of groups having a hierarchical structure, and is created by using the one-way function g disclosed from the secret information S. Each value of m that is y_m= g (S), ..., y_{k + 1}= g (y_{k +}₂), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_m, ..., GK_{k + 1}, GK_k, ..., GK₁), And as a group key for each class from the top to each class, (GK₁, ..., GK_{k + 1}, GK_k, ..., GK_m), And the user has the latest group key GK._kOnly retained, the shared information of the group was encrypted using this group key, the shared information encrypted with the group key of its own class was decrypted, and it was encrypted with the group key of the lower class than itself. To decrypt the information, the user himself has his own group key GK_kSince a group key program using a key derived from a one-way function is recorded on a recording medium, the recording medium can be used to improve its circulation.

【0054】

The present invention according to claim 22 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users share the encrypted shared information. Is a recording medium that records a group key program that allows the user to encrypt / decrypt information of his / her own class and classes lower than his / her own class while decrypting and using the group with a group key. The key is a public key encryption key, and each of m values y created by using the unidirectional function g disclosed from the secret information S._m= g (S), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_m, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_m, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And as a group key for each class from the top to each class, (SGK₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_m, PGK_m) Pairs are assigned to users in order, and the user assigns the assigned group key (SGK)._k, PGK_k) Only, the public key PGK for this group key_kEncrypts the shared information of the group using the private key SGK_kUse the public key PGK of your class's group key_kIn order to decrypt the shared information encrypted with, and to decrypt the information encrypted with the group key of the lower class than itself, the user himself / herself has his / her own private key SGK._kThe gist is to record a group key program using a key derived from a one-way function on a recording medium.

【0055】

In the present invention according to claim 22, the group key is a key of public key cryptography in a plurality of groups having a hierarchical structure, and is created by using the one-way function g disclosed from the secret information S. Each value of m that is y_m= g (S), ..., y_{k + 1}= g (y_{k +}₂), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_m, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_m, ..., PGK_{k + 1}, PGK_k, ..., PGK₁), And as a group key for each class from the top to each class, (SGK₁, PGK₁), ..., (SGK_{k + 1}, PGK_{k + 1}), (SGK_k, PGK_k), ..., (SGK_m, PGK_m) Pairs are assigned to the users in order, and the users are assigned the group key (SGK)._k, PGK_k) Only, the public key PGK for this group key_kEncrypts the shared information of the group using the private key SGK_kUse the public key PGK of your class's group key_kIn order to decrypt the shared information encrypted with, and to decrypt the information encrypted with the group key of the lower class than itself, the user himself / herself has his / her own private key SGK._kSince a group key program using a key derived from a one-way function is recorded on a recording medium, the recording medium can be used to improve its circulation.

【0056】

Further, the present invention according to claim 23 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users are encrypted. It is a recording medium that records a group key program that allows each user to encrypt / decrypt information of his / her own class and classes lower than his / her own class while encrypting the shared information with a group key. The group key is a key of the common key encryption method, and each of n values t created by using the unidirectional function f disclosed from the secret information S1._n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_r, ..., GK_{k + 1}, GK_k, ..., GK₁) And the group key GK_kWhen updating, a new group key GK_{k + 1}The latest group key GK that has been updated by the user_kOnly keeps and uses this latest group key to encrypt the shared information of the group and decrypt the shared information encrypted with the group key of its own class, and the shared encrypted with the past group key For information, the latest group key GK held by the user himself_kFor information that is decrypted using the group key derived from the one-way function f and encrypted with the group key of a lower class than itself, the user himself / herself is one-way from his / her own group key. The gist is to record a group key program decrypted using the key derived by the sex function g on a recording medium.

【0057】

In the present invention according to claim 23, the group key is a key of a common key cryptosystem in a plurality of groups having a hierarchical structure, and is created by using the one-way function f disclosed from the secret information S1. Each of n values t_n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the key (GK)_r, ..., GK_{k + 1}, GK_k, ..., GK₁) And the group key GK_kWhen updating, a new group key GK_{k + 1}Is generated and the user has the latest group key GK_kOnly keeps and uses this latest group key to encrypt the shared information of the group and decrypt the shared information encrypted with the group key of its own class, and the shared encrypted with the past group key The information is the latest group key GK held by the user himself._kInformation that is decrypted using the group key derived from the one-way function f and encrypted with the group key of the lower class than itself is the information that the user himself uses from his own group key with the one-way function g. Since the group key program decrypted using the derived key is recorded on the recording medium, the recording medium can be used to improve its circulation.

【0058】

Further, the present invention according to claim 24 has a hierarchical structure composed of a plurality of classes, and the shared information of a group composed of a plurality of users is encrypted with a group key and shared by the group, and the users are encrypted. It is a recording medium that records a group key program that allows each user to encrypt / decrypt information of his / her own class and classes lower than his / her own class while encrypting the shared information with a group key. The group key is a public key encryption key, and each of n values t created by using the unidirectional function f published from the secret information S1._n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂) Derived from the private key (SGK)_r, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_r, ..., PGK_{k + 1}, PGK_k, ..., PGK₁) Pair and group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated and the user can update the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kFor shared information decrypted with and encrypted with the past group key, the private key SGK of the latest group key_kFor information that is decrypted using the private key derived from the one-way function f and encrypted with a group key of a lower class than itself, the user himself / herself is one-way from his / her own group key. The gist is to record the group key program decrypted using the private key derived by the function g on the recording medium.

【0059】

In the present invention according to claim 24, the group key is a key of public key cryptography, and each of n values t created by using the one-way function f disclosed from the secret information S1._n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂) And m each value y created using the one-way function g exposed from the secret information S2_m= g (S2), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k +}₁), ..., y₁= g (y₂) Derived from the private key (SGK)_r, ..., SGK_{k + 1}, SGK_k, ..., SGK₁) And public key (PGK)_r, ..., PGK_{k + 1}, PGK_k, ..., PGK₁) Pair and group key (SGK)_k, PGK_kWhen updating), a new group key (SGK)_{k + 1}, PGK_{k + 1}) Is generated, and the user can use the latest group key (SGK)._k, PGK_k) Only keeps this latest group key public key PGK_kEncrypts the shared information of the group using, and the public key PGK of the group key_kThe shared information encrypted with the group key private key SGK_kThe shared information decrypted with and encrypted with the past group key is the secret key SGK of the latest group key._kDecrypted using the private key derived from the one-way function f, and the information encrypted with the group key of the lower class than itself is derived by the user himself from his own group key with the one-way function g. Since the group key program decrypted using the private key is recorded on the recording medium, the recording medium can be used to improve its circulation.

【0060】

The present invention according to claim 25 is the invention according to any one of claims 21 to 24, wherein the group key represents a hierarchical organization.₁, Y₂, ..., Y_mEach of the m values y created by the one-way function g using_m= g (STheY_m), ..., y_{k + 1}= g (y _{k + 1}TheY_{k + 1}), Y_k= g (y _kTheY_k), ..., y₁= g (y ₁TheY₁), Where y _kIs y_kThe gist is to record the group key program, which is the value of the upper layer of, on the recording medium.

【0061】

In the present invention according to claim 25, the group key is public information Y representing a hierarchical organization.₁, Y₂, ..., Y_mEach of m values y created by the one-way function g using_m= g (STheY_m), ..., y_{k + 1}= g (y _{k + 1}TheY_{k + 1}), Y_k= g (y _kTheY_k), ..., y₁= g (y ₁TheY₁) Is recorded on a recording medium, so that the recording medium can be used to improve its circulation.

【0062】

Further, the present invention according to claim 26 is the invention according to any one of claims 19 to 25, in which the shared information is encrypted with an arbitrary key generated by the user, and the key is encrypted with a group key. The gist is to record the group key program attached to the encrypted shared information as the attached information on the recording medium.

【0063】

In the present invention according to claim 26, a group in which shared information is encrypted with an arbitrary key generated by a user, and the key encrypted with a group key is attached to the encrypted shared information as attached information. Since the key program is recorded on a recording medium, the recording medium can be used to improve its circulation.

【0064】

Further, in the invention of claim 27, in the invention of claim 26, every time the group key is updated, a group key program for encrypting the attached information with the latest group key is recorded on a recording medium. Is the gist.

【0065】

In the present invention according to claim 27, since the group key program that encrypts the attached information with the latest group key is recorded on the recording medium each time the group key is updated, the recording medium is used. Therefore, its distribution can be enhanced.

【0066】

BEST MODE FOR CARRYING OUT THE INVENTION

In the group key method of the present invention, the group key is derived from each of n values created by using the one-way function disclosed from the secret information to generate the group key, which is shown in FIG. The value obtained by applying the one-way function f to the initial value S k + 1 times is calculated as h._nkThen, due to the characteristics of the one-way function, h_nkFrom h_nk-1Is easy to calculate, but h_{n-k + 1}Is difficult to calculate.

【0067】

In the present invention, the above-mentioned features are utilized to facilitate the management of the group key for the user. As the unidirectional function, any method may be used as long as it is a unidirectional function having the above characteristics.

【0068】

First, an apparatus configuration for implementing the group key method according to the first embodiment of the present invention will be described. FIG. 1 is a diagram showing a configuration of a group key device that implements the group key method of the present embodiment, and the group key device shown in the figure encrypts shared information of a group composed of a plurality of users with a group key. The encrypted shared information is decrypted and used by the group key, and the group key generator 1 that generates the group key and this generated group key are used. It is composed of a plurality of user terminals 3a to 3n that encrypt / decrypt the shared information of the group and use it.

【0069】

The group key generation organization 1 is composed of a group key generation unit 11 that generates a group key and a group key transmission unit 13 that transmits the generated group key to each user terminal 3a to 3n. In addition, each of the plurality of user terminals 3a to 3n is a group key receiving unit 31 that receives the group key transmitted from the group key transmitting unit 13 of the group key generating organization 1, and the latest group held by the user himself / herself. Group key derivation unit 33 that derives the group key for decrypting the shared information encrypted with the past group key using a one-way function from the key, and the encryption unit that encrypts the shared information with the group key It consists of 35 and a decryption unit 37 that decrypts the shared information encrypted with the group key.

【0070】

Next, a group key method using the group key device of the present embodiment configured as described above will be described. In this embodiment, a group key is issued for each group, and the group members only hold the latest key, which enables decryption of a document encrypted in the past.

【0071】

Confidential information S is generated for each group, and n values (t) are used using the one-way function f published by S._n= f (S), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂)) Is generated. GK with each value converted by the function G1_n, ..., GK_{k + 1}, GK_k, ..., GK₁Is used as the group key, and GK is used every time the group key is updated.₁, ..., GK_{k + 1}, GK_k, ..., GK_nUse in the order of. The function G1 may be an identity function.

【0072】

The group key at a certain point is GK_kIf so, the group key generator will newly update the GK when the group key is updated._{k + 1}To generate. On the other hand, the user is the latest group key GK_{k + 1}And keep only that key. GK_kTo decrypt a past document encrypted with, do the following:

【0073】

(1) GK_{k + 1}From function G1 by t_{k + 1}Convert to.

【0074】

(2) t by the one-way function f_kAsk for (t_k= f (t_{k + 1}))。

【0075】

(3) t_kFrom the function G1^-1By GK_kConvert to.

【0076】

(4) GK_kDecrypt using.

【0077】

GK₁, ..., GK_k-1The document encrypted in is also decrypted by the same process.

【0078】

Next, the group key method according to the second embodiment of the present invention will be described. In this embodiment, in a group having a hierarchical structure, it is possible to encrypt / decrypt information of a lower class group only by holding its own group key.

【0079】

Generate secret information S and use n values (y) using the one-way function g exposed from S._n= g (S), ..., y_{k + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂)) Is generated. GK with each value converted by the function G2_n, ..., GK_{k + 1}, GK_k, ..., GK₁Is assigned to each class as a group key for each class from the top. The function G2 may be an identity function.

【0080】

A class of users has their own group key (GK)_kGK to keep only) and encrypt / decrypt your group shared information_kTo use. Also, GK_k-1To decrypt the information of the group lower than yourself encrypted in, do as follows.

【0081】

(1) GK_kFrom the function G2 by y_kConvert to.

【0082】

(2) y by the one-way function g_k-1Ask for (y_k-1= g (y_k))。

【0083】

(3) y_k-1From the function G2^-1By GK_k-1Convert to.

【0084】

(4) GK_k-1Decrypt using.

【0085】

GK₁, ..., GK_k-2The shared information encrypted in is also decrypted by the same process.

【0086】

Next, the group key method according to the third embodiment of the present invention will be described. In this embodiment, in a group having a hierarchical structure, group members only hold their own latest key, and can encrypt / decrypt information of lower class groups and documents encrypted in the past. Is what you do.

【0087】

Confidential information S1 is generated for each class, and n values (t) are generated using the one-way function f published from S1._n= f (S1), ..., t_{k + 1}= f (t_{k + 2}), t_k= f (t_{k + 1}), ..., t₁= f (t₂)) Is generated.

【0088】

Furthermore, secret information S2 is generated, and m values (y) are used using the one-way function g published from S2._m= g (S2), ..., y_{K + 1}= g (y_{k + 2}), Y_k= g (y_{k + 1}), ..., y₁= g (y₂)) Is generated.

【0089】

It is assumed that the group key of each class is converted by the function G3 by combining the values obtained from the one-way functions f and g. The function G3 may be an identity function. In the case of the model of FIG. 6, the group key is calculated from the intersection shown in FIG. The group key of the manager group at a certain point is GK₁If so, the members of the department manager group GK the document encrypted with the group key in the shaded area.₁Decrypt with the key generated from.

【0090】

Repeated updates of the group key in a particular group may result in holding a group key that cannot be derived from a group above that group (see the group key for the section chief group in Figure 4). This process always includes allocating a group key so that the upper group can derive the group key of the lower group.

【0091】

Next, a specific example will be described. The following cases will be described here.

【0092】

(1) It is possible to decrypt past ciphertext with only the latest group key.

【0093】

(2) The group key shall be public key cryptography (described using the ElGamal method as an example).

【0094】

(3) The shared document is encrypted with the temporary key SK, and the SK is further encrypted with the group key and attached to the ciphertext.

【0095】

The group key generator applies the one-way function f n times from the secret information (S), and t₁To calculate.

【0096】

t₁= fⁿ(S) Next, the prime number p and the multiplicative group Zp^*Produces the primitive element g of, t₁Is the private key of the group key, and (g^t1Let (mod p), p, g) be the public key of the group key. The private key may be distributed to the group members, or may be stored in the group key generator instead of being distributed every time the update is made, and may be distributed to the members when the group member requests the acquisition of the group key.

【0097】

When updating the group key due to the group member leaving, the group key generator again applies the one-way function f from the secret information (S) n-1 times, and t.₂Calculate and t₂= f^n-1(S) Private key t₂, Public key (g^t2Create (mod p), p, g).

【0098】

The private key of the group key at a certain point is t_k, The public key is (g^tkIf it is (mod p), p, g), the group members perform the cryptographic operation as follows.

【0099】

encryption: (1) Create a temporary key SK and encrypt the document.

【0100】

(2) Obtain the public key of the group key from the group key generator.

【0101】

(3) Encrypt SK with the public key of the group key and attach it to the ciphertext.

【0102】

Decryption: (1) If necessary, the private key of the group key t_kIs obtained from the group key generator.

【0103】

(2) SK in the attached information is g^tkIf encrypted with, the private key of the group key t_kDecrypt using. g^tkEarlier g^{tk -r}If encrypted with, the private key of the group key t_kBy applying the one-way function f r times to t_krCalculate and t_krDecrypt using.

【0104】

Also, when a group member is added, only the latest group key is assigned to the new member.

【0105】

Next, as another specific example, a diagram shows a case where a group having a hierarchical structure only holds its own group key to decrypt a document encrypted by a lower group and the group key is a common key cryptosystem. This will be explained with reference to 5.

【0106】

In FIG. 5, the group key generator applies the one-way function g from the secret information S, and the group key y of each class.₁, ..., y₅To generate.

【0107】

Development Department Group Key: y₁= g (S Development Department ) Lesson 1 Group Key: y₂= g (y₁ Lesson 1 ) Lesson 2 Group Key: y₃= g (y₂ Lesson 2 ) Group 1 key: y₄= g (y₂ 1st clerk ) 2nd group key: y₅= g (y₂ 2nd clerk ) Character strings such as "Development Department" are public information representing a hierarchical organization.

【0108】

Assign a group key to users who belong to each department. At this time, it may be distributed to the group members, or it may be stored in the group key generator instead of being distributed every time the update is made, and distributed to the members when the group member requests the acquisition of the group key.

【0109】

Group members perform cryptographic operations as follows.

【0110】

encryption: (1) Encrypt the text with your own group key.

【0111】

Decryption: (1) If necessary, obtain the group key from the group key generator.

【0112】

(2) If the ciphertext is encrypted with the group key to which it belongs, decrypt it using its own group key.

【0113】

When encrypted with a lower class group key, the lower group key is calculated and decrypted based on the public information representing the hierarchical structure.

【0114】

By recording the process of the above embodiment as a program on a recording medium, the recording medium can be used to improve its circulation.

【0115】

[Effect of the invention]

As described above, according to the present invention, the user is the latest group key GK._kOnly keep only, encrypt the shared information of the group with this latest group key, decrypt the shared information encrypted with the group key with the group key, and use the shared information encrypted with the past group key The latest group key GK held by the person himself / herself_kSince the decryption is performed using the group key derived from the one-way function, the user does not have to keep the past group key as in the past, and the newly joined member is also the latest. You only need to get the group key, not the past group key.

【0116】

Further, according to the present invention, the user is the latest group key GK._kOnly the group key is retained, the shared information of the group is encrypted using this group key, and the shared information encrypted with the group key of the own class is decrypted, and the user's own group key GK_kUsing the key derived from the one-way function, the information encrypted with the group key of the lower class than itself is decrypted, so that the user retains the past group key as before. It is not necessary, and members of each group do not need to hold a lower class group key in addition to their own group key.

【0117】

Further, according to the present invention, the user is the latest group key GK._kKeep only, use this latest group key to encrypt the shared information of the group, decrypt the shared information encrypted with the group key of your own class, and share encrypted with the past group key Information is the latest group key GK held by the user himself_kThe information decrypted from the group key derived from the group key using the unidirectional function f and encrypted with the group key of the lower class is the unidirectional function g from the group key held by the user. Since it is decrypted using the derived key, the user does not need to keep the past group key as in the past, and the newly joined member only needs to obtain the latest group key. It is not necessary to obtain the past group key, and the members of each group do not need to hold the group key of the lower class in addition to their own group key.

[Simple explanation of drawings]

[Figure 1]

It is a figure which shows the structure of the group key device which carries out the group key method which concerns on 1st Embodiment of this invention.

[Figure 2]

It is explanatory drawing for demonstrating the property of the one-way function used in the group key method of this invention.

[Fig. 3]

It is a figure which shows the range which a director in 3rd Embodiment of this invention can decode.

[Fig. 4]

It is a figure for demonstrating the group key which cannot be derived from a higher group when the group key is updated repeatedly in the 3rd Embodiment of this invention.

[Fig. 5]

It is explanatory drawing which shows the structure of the group which has a hierarchical structure as a specific example of the 2nd Embodiment of this invention.

[Fig. 6]

It is explanatory drawing which shows a plurality of groups having a hierarchical structure consisting of a department manager, a section manager, and a section chief.

[Explanation of symbols]

1 Group key generator 3a ~ 3n User terminal 11 Group key generator 13 Group key transmitter 31 Group key receiver 33 Group key derivation unit 35 Encryption Department 37 Decoding section