JP2023105065A - Access management device and program - Google Patents

Abstract

To reduce the number of keys to be managed in access control for managing a plurality of access rights having an inclusive relationship with respect to the number of access rights and the number of inclusive relationships.SOLUTION: An access management device includes an access right management unit that associates public identification information, secret identification information, and secret authentication information with each node of directed acyclic graph indicating an inclusive relation between access rights by associating the access rights with the node, an access right granting unit that grants the secret authentication information to an access target node to a user by a method in which the secret authentication information is hidden from a third party, and an access right inspection unit that inspects whether access right exercise information indicating a value obtained by inputting the secret authentication information and the public identification information of the upper node in the directed acyclic graph of the node corresponding to the secret authentication information to a one-way function and secret identification information associated with the access target node satisfy a predetermined relational expression.SELECTED DRAWING: Figure 3

Description

The present invention relates to an access management device and program.

Authority management is an important issue for ensuring the security of information systems. In the configuration and operation of today's general information systems, the types of authority granted are varied, and the complexity of authority management is increasing due to the nature of the organization and operation. In addition, with the spread of IoT (Internet of Things) devices, the number of objects on which authority is reflected is also becoming very large.

For example, consider a device with multiple sensors installed inside a building. A device manufacturer, a building administrator, a device installer, a occupant of the building floor, and the like can be considered as the authority holder. For example, a device manufacturer has the right to update the firmware embedded in the device regardless of the building, and a building administrator has the right to manage devices installed within that building. This requires complicated authority management with a large number of objects to be managed.

For example, in the data management system of Patent Literature 1, security after sharing encrypted data is ensured, data is shared only by relevant parties, and data update management is performed. In the data management system of Patent Document 1, for shared files and directories, an authentication module, a decompression module, and an upload module are encrypted together with the shared files and stored in the first area. An access right for a sharer is set (Patent Document 1).

JP 2015-194888 A

However, in a data management system such as that described in Patent Document 1, in a situation where complicated authority management with a large number of objects to be managed is required, for each device and according to the number of types of authority to be granted, If a method of allocating keys for access control is adopted, the number of required keys increases, and there is a problem that management and distribution of keys become difficult.

On the other hand, since the number of required keys increases, it is difficult to perform access control by key management in a situation where complicated authority management with a large number of objects to be managed is required. When performing complicated access control, a system for confirming access rights is separately prepared, and access rights are controlled by the system.
In a system prepared separately to confirm access rights, the system that controls access rights becomes a single point of failure, and if the security of the system is breached, all authentications will be destroyed. Existing.

The present invention deals with access control that handles a plurality of access rights having an inclusion relationship without separately preparing a system for confirming access rights. Here, as an example of multiple access rights that have an inclusion relationship, consider two access rights, a higher access right and a lower access right, and a user who can exercise the higher access right can exercise the lower access right. and In other words, higher access rights include lower access rights.

In the access control that manages these two access rights, users who can exercise higher access rights are given two keys: a key for exercising higher access rights and a key for exercising lower access rights. A user who is given a key and can exercise subordinate access rights must be given one key to exercise the subordinate access rights. In this access control, since there is an inclusion relationship in which a higher-level access right includes a lower-level access right, keys corresponding to the number of inclusion relationships are required in addition to the number of access rights.

The problem to be solved by the present invention is to reduce the number of keys to be managed with respect to the number of access rights and the number of inclusion relationships in access control that handles a plurality of access rights having inclusion relationships with each other.

The present invention has been made in view of the above points. To provide an access control device and a program which can be reduced.

The present invention has been made to solve the above-described problems, and one aspect of the present invention is a directed acyclic graph that indicates an inclusion relationship between access rights by associating access rights with each node. Each node is provided with public identification information that is disclosed to the user who exercises the access right, secret identification information that is essential information for exercising the access right, and secret authentication information that is given to the user. an access right management unit to be associated; An access right granting unit to be granted to the user, the secret authentication information granted by the access right granting unit, and the node corresponding to the secret authentication information by a method in which the secret authentication information is kept secret from a third party. Access right exercise information indicating a value obtained by inputting public identification information of a higher node in a directed acyclic graph into a one-way function, and the secret identification information associated with the access target node. and an access right checking unit for checking whether or not satisfies a predetermined relational expression.

Further, according to one aspect of the present invention, in the access management device described above, the one-way function has homomorphism, and the access right exercise information is obtained by inputting the secret authentication information into the one-way function. It is generated by performing a predetermined calculation procedure on the obtained value and the public identification information of the higher node.

Further, according to one aspect of the present invention, in the above-described access management device, in addition to the inclusion relationship indicated by the directed acyclic graph, a logical expression access right is an access right indicated by a plurality of logical expressions of the access right. , based on the secret identification information associated with the node associated with the plurality of access rights used to express the logical expression access right by the access right management unit and the public identification information and a logical secret identification information generation unit for generating logical secret identification information, which is the secret identification information for the logical access right.

Further, according to one aspect of the present invention, in the access management device described above, the object to be accessed by the access right is data, the data is encrypted using the secret identification information as a key, and is given to the user. The data can be accessed by decrypting the data using the secret identification information calculated from the secret authentication information as a key.

Further, according to one aspect of the present invention, in the above-described access management device, the access authorization unit records the secret authentication information in a tamper-resistant module, which is a module possessed by the user and has a tamper-resistant feature. provides the user with the secret authentication information, and at least part of the access right exercise information is calculated in the tamper resistance module.

Further, according to one aspect of the present invention, in the access management device described above, the secret authentication information for the access right to the user and the user identification information for identifying the user are used as at least part of the input. a ticket generation unit that generates a ticket that is the value of the one-way function, wherein the access right granting unit grants the ticket generated by the ticket generation unit to the user as the secret authentication information. and the access right checking unit obtains second access right exercise information obtained by inputting the ticket granted by the access right granting unit into the one-way function, and the second access right exercise information associated with the access target node. It is checked whether or not the secret identification information satisfies a predetermined relational expression.

Further, according to one aspect of the present invention, in the above-described access management apparatus, the user identification information used for generating the ticket is generated by the user based on the ticket generated by the ticket generation unit. and an unauthorized user determination unit that acquires from the second access right exercise information.

Further, according to one aspect of the present invention, a computer assigns access rights to each node of a directed acyclic graph that indicates an inclusion relationship between the access rights by associating access rights with each node. an access right management step of associating public identification information to be made public, secret identification information essential for exercising the access right, and secret authentication information given to the user, respectively; a method in which the secret authentication information associated with the access target node, which is the node corresponding to the access right exercised by the user, by the access right management step, is kept secret from a third party a step of granting an access right to the user; the secret authentication information granted by the step of granting the access right; identification information, access right exercise information indicating a value obtained by inputting the identification information into a one-way function, and whether or not the secret identification information associated with the access target node satisfies a predetermined relational expression. and an access right checking step to be checked.

According to the present invention, the number of keys to be managed in access control for managing a plurality of access rights having an inclusion relationship can be reduced with respect to the number of access rights and the number of inclusion relationships.

BRIEF DESCRIPTION OF THE DRAWINGS It is a figure which shows an example of the access management system which concerns on the 1st Embodiment of this invention. It is a figure which shows an example of the access right information which concerns on the 1st Embodiment of this invention. It is a figure which shows an example of a structure of the user terminal which concerns on the 1st Embodiment of this invention, and an access management apparatus. It is a figure which shows an example of the access management process of the access management apparatus which concerns on the 1st Embodiment of this invention. FIG. 4 is a diagram showing an example of processing for acquiring public information and secret authentication information of a user terminal according to the first embodiment of the present invention; FIG. 4 is a diagram showing an example of access execution processing of a user terminal according to the first embodiment of the present invention; It is a figure which shows an example of the access verification process of the access management apparatus which concerns on the 1st Embodiment of this invention. FIG. 7 is a diagram showing the configurations of a user terminal and an access management device according to the second embodiment of the present invention; It is a figure which shows an example of the access management process of the access management apparatus based on the 2nd Embodiment of this invention. FIG. 11 is a diagram showing an example of processing for acquiring public information and secret authentication information of a user terminal according to the second embodiment of the present invention; FIG. 10 is a diagram showing an example of access execution processing of a user terminal according to the second embodiment of the present invention; It is a figure which shows an example of the access verification process of the access management apparatus which concerns on the 2nd Embodiment of this invention. FIG. 10 is a diagram showing the configurations of a user terminal and an access management device according to a third embodiment of the present invention; It is a figure which shows an example of the access management process of the access management apparatus based on the 3rd Embodiment of this invention. It is a figure which shows an example of the ticket acquisition process of the user terminal which concerns on the 3rd Embodiment of this invention. FIG. 12 is a diagram showing an example of access execution processing of a user terminal according to the third embodiment of the present invention; It is a figure which shows an example of the access verification process of the access management apparatus based on the 3rd Embodiment of this invention. FIG. 14 is a diagram showing an example of unauthorized user determination processing of the access management device according to the third embodiment of the present invention;

(First embodiment)
(Configuration of access control system)
BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing an example of an access management system AS according to this embodiment. The access management system AS is a system for managing access to the access target R of the user UE. The access management system AS includes a user terminal 1 , an access management device 2 , an access right information server 3 and an access target server 4 .

A user terminal 1 is an example of a user UE. The user terminal 1 is, for example, a mobile communication terminal such as a smart phone or a personal computer. The user terminal 1 may be a dedicated terminal, such as a security card, which the user always wears and carries when receiving services from the environment.

The user terminal 1 includes a plurality of user terminals 1-i (i=1, 2, . . . , N: N is the number of user terminals). In the following, the user terminal 1 may refer to all of the plurality of user terminals 1-i, and the user terminal 1 may refer to one of the plurality of user terminals 1-i as a representative.
The user terminal 1 accesses the access target R stored in the access target server 4 via the access management device 2 . An access target R is, for example, data. Accessing the access target R in this embodiment includes reading, writing, and execution of the access target R, which is data, as defined in UNIX (registered trademark) access control, for example. In this embodiment, as an example, the access target R includes a plurality of access targets R1 to R9.

The access management device 2 stores in the access target server 4 of the user terminal 1 based on the access right information XI stored in the access right information server 3 and the user management information UL stored in the access right information server 3. It manages access to the access target R.
The access management device 2 is, for example, a gateway or gatekeeper.

In order to access the access targets R1 to R9 included in the access target R, access rights V1 to V9 corresponding to the access targets R1 to R9 are required, respectively. The access right information XI is information indicating the inclusive relationship between the access rights V1 to V9 and the key information required to exercise the access right V. FIG. Access rights V1 to V9 are collectively referred to as access rights V hereinafter.

The user management information UL is information indicating whether access rights V1 to V9 corresponding to access targets R1 to R9 may be granted to each of the plurality of user terminals 1-i. The user management information UL is, for example, two-dimensional tabular data. The user management information UL has columns for each of a plurality of user terminals 1-i, and indicates whether access rights V1 to V9 may be granted for each column.

The access right information server 3 stores access right information XI and user management information UL.
The access target server 4 stores the access target R. FIG. Here, the access target R is encrypted and stored.

Here, with reference to FIG. 2, the access right information XI will be described.
FIG. 2 is a diagram showing an example of access right information XI according to this embodiment. In the access right information XI, the inclusion relationship between the access rights V is indicated by a directed acyclic graph (DAG) OG. In this embodiment, the access rights V are, for example, nine access rights V1 to V9, which are defined in an inclusion relationship with each other.
including.
A directed acyclic graph OG has nine nodes N1 to N9. Nodes N1 to N9 are associated with access rights V1 to V9, respectively.

The nodes N1 to N9 are oriented sides L (in the example shown in FIG. 2, directional sides L12, directional sides L13, directional sides L24, directional sides L25, directional sides L35, and directional sides L36). , directed edge L47, directed edge L57, directed edge L58, directed edge L68, directed edge L79, and directed edge L89). For example, the node N1 and the node N2 are connected in the direction from the node N1 to the node N2 by the directed side L12.

Here, if there is a directed edge from one node Ni to the other node Nj, the access right Vi corresponding to the node Ni includes the access right Vj corresponding to the node Nj. An access right Vi includes an access right Vj means that an access target Rj corresponding to the access right Vj can be accessed by exercising the access right Vi. If access right Vi subsumes access right Vj, then access right Vi subsumes access right V subsumed by access right Vj in addition to access right Vj.

Hereinafter, when one node and another node are connected by a directed edge L in the direction from one node to the other node, one node is referred to as a higher node and the other node as a lower node. There is
Also, if an access right Vi subsumes an access right Vj and an access right Vj subsumes an access right Vk, then applying the transitive law, the access right Vi subsumes the access right Vk or the node of the access right Vi is an upper node of the node with access right Vk.

Each node N is associated with public identification information PK, secret identification information SK, and secret authentication information AI. For example, node N1 is associated with public identification information PK1, secret identification information SK1, and secret authentication information AI1, and node N2 is associated with public identification information PK2, secret identification information SK2, and secret authentication information AI2. be done. The public identification information PK, the secret identification information SK, and the secret authentication information AI are information necessary for exercising the access right V described above.

Let the number xi be the public identification information PKi of the node Ni. Let the number r be the common secret key of the access right V. Secret authentication information AIi corresponding to access right Vi is determined by equation (1).

Here the number p is a large prime number. The numbers r and xi are numbers belonging to the set shown by equation (2) and are randomly selected to be relatively prime to the number p−1.

When granting an access right Vi corresponding to a node Ni to a user terminal 1 among a plurality of user terminals 1-i (i=1, 2, . . . , N: N is the number of user terminals), The secret authentication information AIi represented by the formula (1) is given so that only the administrator of the access management device 2, including the user terminal 1, can access. For example, the secret authentication information AIi is transmitted to a device possessed by the user terminal 1 and has a tamper-resistant property using a cryptographic path, and is recorded in the device. The secret authentication information AIi is made inaccessible. In particular, the value of the secret authentication information AIi is kept secret even for users to whom the access right Vi is granted. Once the value of the secret authentication information AIi is known, the common secret key r is exposed by multiplying the number xi by the inverse modulo p.
However, in a third embodiment of the present invention, which will be described later, an example will be shown in which the tamper-resistant device is unnecessary by encoding the secret authentication information AIi so that only the administrator of the access management device 2 can understand it.

On the other hand, secret identification information SK is configured as follows. Let the group G be a cyclic group having the number p as the order, and the operation of the group G is described by multiplication. It is also assumed that the element g is the generator of the group G. Let the discrete logarithm problem for the group G be computationally insoluble. Therefore, let the function given by equation (3) be a one-way function with respect to the number x.

Hereinafter, the function represented by Equation (3) will be referred to as a one-way function F1. A one-way function F1 is a function with values in the group G. The one-way function F1 has homomorphism. As a method for constructing a one-way function, for example, a method using a discrete logarithm problem and a method using prime factorization such as RSA are known. In the construction method using the discrete logarithm problem, a one-way function having homomorphism can be constructed using a discrete logarithm problem on a finite field, a discrete logarithm problem on an elliptic curve, or the like. The one-way function F1 of this embodiment is, for example, a one-way function configured without limiting the group G by a configuration method using a discrete logarithm problem.
It should be noted that the one-way function F1 may be a one-way function configured by another configuration method such as a configuration method using prime factorization such as RSA, as long as it has homomorphism.

For a node Ni corresponding to an access right Vi, a set Ai is a set of subscripts of nodes N for which a path exists to the node Ni following the direction of the inclusion relationship indicated by the directed edge. Here, the subscript of the node N is, for example, the subscript i in the case of the node Ni. That is, the set Ai is a set of subscripts of nodes Nj that are higher than node Ni.
In the example shown in FIG. 2, for example, the set A4 for node N4 is a set of 2, which is the subscript of node N2, and 1, which is the subscript of node N1. In another example, the set A8 for node N8 is the subscript 5 for node N5, the subscript 2 for node N2, the subscript 1 for node N1, the subscript 6 for node N6, and the subscript for node N3. is a set consisting of 3, which is the subscript of .

The secret identification information SKi of the node Ni is defined as an element of the group G given by equation (4).

At the access target Ri corresponding to the node Ni, for example, the secret identification information SKi is used as follows for access control.

The access management device 2, which controls access to the access target Ri, performs Diffie-Hellman-Merkle authentication with the user terminal 1, and the user terminal 1 uses the formula (5 ) can generate the value of the one-way function F1, the access to the access target Ri is permitted. Here, the value of the one-way function F1 generated by the user terminal 1 is called access right exercise information GK.

As an example of the access control method, the access management device 2 transmits to the user terminal 1 the value of the generator g to the power of λ given by the equation (6), and the user terminal 1 sends the value of the equation (5) or its A possible method is to permit access to the access target Ri when a cryptographic hash value (for example, a value generated using SHA-1 or the like) is received.
As another example of the access control method, the access management device 2 encrypts the access target Ri using the value of equation (5) as a key, transmits the value of equation (6) to the user terminal 1, A method of decrypting the code only when 1 can calculate the value of the equation (5) is conceivable.

It is assumed that the user terminal 1 is granted the access right Vj for any subscript j included in the set Ai. Therefore, it is assumed that the user terminal 1 is capable of calculating the one-way function F1 given by Equation (3) using the private authentication information AIj given by Equation (7) as part of its input.

It is assumed that the user terminal 1 cannot access the secret authentication information AIj. For example, the secret authentication information AIj is recorded in a tamper-resistant device possessed by the user terminal 1, the tamper-resistant device incorporates a microcomputer, and is expressed by equation (8) in a secure calculation area within the tamper-resistant device. Calculate the value of the one-way function F1 and output only the result.

Here, in exercising the access right Vi included by the access right Vj, first, the value of the one-way function F1 given by Equation (8) is calculated.

The exercise of the access right Vi is then performed using the set of public identities PK given by equation (9), which is the set of public identities PK, and the number xi, which is the public identity PKi of the node Ni, using the access right Vi The secret identification information SKi for is calculated according to equation (10).

As described above, the user terminal 1 to which the higher access right Vj has been granted can exercise any lower access right Vi.

Next, with reference to FIG. 3, details of the configurations of the user terminal 1 and the access management device 2 will be described.
FIG. 3 is a diagram showing an example of the configuration of the user terminal 1 and the access management device 2 according to this embodiment. Since the functions of the plurality of user terminals 1-i (i=1, 2, . . . , N: N is the number of user terminals) shown in FIG. One of a plurality of user terminals 1-i (i=1, 2, . . . , N: N is the number of user terminals) is illustrated as a user terminal 1 as a representative.

The user terminal 1 includes a communication unit 10 , a public information acquisition unit 11 , a public information storage unit 12 , an access request unit 13 , a tamper resistance module 14 and an access execution unit 15 .

The communication unit 10 is a communication module, and performs transmission and reception of various types of information with the access management device 2 .
The public information acquisition unit 11 acquires public information PI supplied by the access management device 2 . The public information PI includes public identification information PK and group information GI. The group information GI is information indicating the group G, and includes the generator of the group G and the number p, which is the order of the group G. For example, when the group G is an elliptic curve, the group information GI may include its defining equation.
The public information storage unit 12 stores public information PI acquired by the public information acquisition unit 11 .

The access request unit 13 supplies access request information AR to the access management device 2 . The access request information AR is information indicating the access target node AN. Here, the access target node AN is a node Ni corresponding to the access target Ri accessed by the user terminal 1 among the nodes N of the directed acyclic graph OG.

The anti-tampering module 14 is a module with anti-tampering characteristics. In other words, the tamper-resistant characteristic module 14 has the property that the data and programs held inside its own device and the calculation processing executed inside its own device are not observed or interfered with from the outside.
The tamper-resistant property module 14 includes a secret authentication information acquisition unit 140 , a secret authentication information storage unit 141 , and an access right exercise information generation unit 142 .

The secret authentication information acquisition unit 140 acquires secret authentication information AI supplied from the access management device 2 .
The secret authentication information storage unit 141 stores secret authentication information AI acquired by the secret authentication information acquisition unit 140 .
The access right exercise information generation unit 142 generates access right exercise information GK based on the public information PI stored in the public information storage unit 12 and the secret authentication information AI stored in the secret authentication information storage unit 141. . In order to generate the access right exercise information GK, the access right exercise information generator 142 has a function of executing the one-way function F1.

The access executing unit 15 executes access to the access target R when the access management device 2 is permitted to access the access target R. FIG.

The access management device 2 includes a communication unit 20, a user management unit 21, an access right management unit 22, an access request acquisition unit 23, an access right grant unit 24, a random number generation unit 25, and an access right inspection unit 26. , and an access permission unit 27 .

The communication unit 20 is a communication module, and performs transmission and reception of various information with the user terminal 1 .
Based on the user management information UL stored in the access right information server 3, the user management unit 21 determines whether or not the access right V to the access target R may be granted to the user terminal 1. FIG.
The access right management unit 22 manages access right information XI stored in the access right information server 3 . Here, the access right management unit 22 associates each node N of the directed acyclic graph OG with public identification information PK, secret identification information SK, and secret authentication information AI.

The access request acquisition unit 23 acquires access request information AR supplied from the user terminal 1 .
The random number generation unit 25 generates a random number λ and supplies it to the access right granting unit 24 .

The access right checking unit 26 supplies the user terminal 1 with the secret authentication information AI. In addition, the access right granting unit 24, according to the access request information AR acquired by the access request acquiring unit 23, generates the random number λ generated by the random number generating unit 25. Diffie-Hellman-Merkle authentication is performed by calculating a random number to the power of λ and supplying the calculated value to the user terminal 1 .

As a result, the access right checking unit 26 determines the random number λ power of the access right exercise information GK supplied from the user terminal 1 and the secret identification information SK associated with the access target node AN indicated by the access request information AR. Check if the value of the λ power matches. That is, the access right checking unit 26 checks whether or not the access right exercise information GK and the secret identification information SK match.

Here, since the group G is configured such that it is computationally difficult to solve the discrete logarithm problem, it is impossible to know the random number λ from the value of the random number λ power of the generator g supplied to the user terminal 1. Impossible. Since the access right exercise information GK expected to match the secret identification information SK is masked by the random number λ, even if the communication between the user terminal 1 and the access management device 2 is intercepted, the content of the intercepted communication secret identification information SK is never leaked from the This authentication scheme is known as the Diffie-Hellman-Merkle authentication scheme.
The access permission unit 27 permits or prohibits access to the access target R of the user terminal 1 according to the determination result of the access right inspection unit 26 .

(Processing in access control system)
With reference to FIG. 4, access management processing, which is processing of the access management device 2 before access by the user terminal 1 is performed, will be described.
FIG. 4 is a diagram showing an example of access management processing of the access management device 2 according to this embodiment. The processing shown in FIG. 4 is started when the operation of the access management system AS is started.

Step S100: The access right management unit 22, via the communication unit 20, sends public identification information PK and , secret identification information SK and secret authentication information AI.

For example, the access right management unit 22 can encrypt the access target R using the secret identification information SK as a key by associating the node N corresponding to the access target R with the secret identification information SK. In order to prevent all the access targets R associated with the node N from being encrypted with the same key, a random number λ is generated for each access target R, and the secret identification information SK raised to the power of the random number λ is encrypted. and appending the value of the random number λ shown by the formula (5) of the generator g shown by the formula (6) to the encrypted access target R, Diffie-Hellman-Merkle authentication and cryptographic Combine with data confidentiality. This cryptosystem is known as the ElGamal cryptosystem.

As described above, the directed acyclic graph OG indicates the inclusion relationship between the access rights V by associating the access rights V with each node. The public identification information PK is information that is made public to the user UE who exercises the access right V. FIG. The secret identification information SK is information essential for exercising the access right V. The secret authentication information AI is information given to the user UE.

Therefore, the access right management unit 22 assigns the user UE who exercises the access right V to each node N of the directed acyclic graph OG that indicates the inclusive relationship between the access rights V by associating the access right V with each node. The public identification information PK disclosed to the public, the secret identification information SK that is essential information for exercising the access right V, and the secret authentication information AI given to the user UE are associated with each other.

The object of access by the access right V (access object R in this example) is data, and the data is encrypted using the secret identification information SK or the value of the secret identification information SK to the power of λ as a key. there is Here, access to the data becomes possible by decrypting the data using the random number λ power of the secret identification information SK calculated from the secret authentication information AI given to the user UE.

Here, by the method shown in equation (10), a secret identification associated with a node Ni that is a lower node that is associated with an access right Vi that is included in an access right Vj that is associated with a node Nj that is a higher node The information SKi is obtained by inputting the element of the random number λ power of the generator g and the secret authentication information AIj associated with the node Nj into the one-way function F1, and the set Ai of the public identification information PK. It is calculated from the public identification information PK and the public identification information PKi associated with the indicated node N via the one-way function F1.

That is, the access right management unit 22 assigns the access right management unit 22 The secret identification information SK associated with is composed of the secret authentication information AI associated with the upper node by the access right management unit 22, the predetermined public identification information PK out of the public identification information PK, and the random number of the generator g It is obtained using the one-way function F1 from the element of the λ power.

Step S110: The access right management unit 22 sends public identification information PK to each of a plurality of user terminals 1-i (i=1, 2, . . . , N: N is the number of user terminals), supply through.

Step S<b>120 : The user management unit 21 determines the user terminal 1 to which the access right V is granted based on the user management information UL stored in the access right information server 3 . The user management unit 21 supplies the determination result to the access right granting unit 24 .

Step S<b>130 : The access right granting unit 24 grants the access right V to the user terminal 1 . Here, the access right granting unit 24 grants the access right V to the user terminal 1 by supplying the secret authentication information AI to the user terminal 1 via the communication unit 20 . The secret authentication information AI given to the user terminal 1 by the access right granting unit 24 is the secret authentication information AI associated with the access target node AN indicated by the access request information AR acquired by the access request acquiring unit 23 .

Next, with reference to FIG. 5, processing of the user terminal 1 before access will be described.
FIG. 5 is a diagram showing an example of processing for acquiring public information and secret authentication information of the user terminal 1 according to this embodiment.
Step S<b>200 : The public information acquisition unit 11 acquires the public identification information PK supplied from the access management device 2 via the communication unit 10 . The public information acquisition unit 11 causes the public information storage unit 12 to store the acquired public identification information PK.

Step S<b>210 : The secret authentication information acquisition unit 140 acquires the secret authentication information AI supplied from the access management device 2 via the communication unit 10 . The secret authentication information acquisition unit 140 causes the secret authentication information storage unit 141 to store the acquired secret authentication information AI.

Here, since the secret authentication information acquisition unit 140 and the secret authentication information storage unit 141 are provided in the tamper-resistant property module 14, the secret authentication information AI stored in the secret authentication information storage unit 141 is stored in the tamper-resistant property module 14. It is not referred to by other functional units of the user terminal 1 provided externally.

Next, with reference to FIG. 6, processing when the user terminal 1 accesses the access target R will be described.
FIG. 6 is a diagram showing an example of access execution processing of the user terminal 1 according to this embodiment.
Step S300: The access requesting unit 13 requests access to the access target R from the access management device 2 . Here, the access request unit 13 requests access by supplying access request information AR to the access management device 2 via the communication unit 10 .

Step S310: The secret authentication information acquisition unit 140 acquires the random number λ-th power of the generator g of the group G represented by the formula (6) supplied from the access management device 2, and supplies it to the access right exercise information generation unit 142. .

Step S320: The access right exercise information generation unit 142 generates the secret authentication information AI stored in the secret authentication information storage unit 141 and the predetermined public identification information PK included in the public information PI stored in the public information storage unit 12. , and the value of the random number λ of the generator g supplied from the secret authentication information acquisition unit 140, the value of the access right exercise information GK to the power of λ is generated. Here, the access right exercise information GK is expressed by Equation (5) above.
That is, the access right exercise information GK is obtained by performing a predetermined calculation procedure on the value obtained by inputting the secret authentication information AI to the one-way function F1 and the public identification information PK of the upper node. generated.

The access right exercise information generator 142 is provided in the anti-tampering feature module 14 . That is, the access right exercise information GK is calculated within the tamper resistance characteristic module 14 . Since the access right exercise information GK is calculated within the tamper resistant characteristic module 14, the process of calculating the access right exercise information GK is referred to by other functional units of the user terminal 1 provided outside the tamper resistant characteristic module 14. not.

Since the one-way function F1 of the present embodiment satisfies homomorphism, the access right exercise information generator 142 calculates a portion of the access right exercise information GK that requires the secret authentication information AI, The remaining portion of the exercise information GK using the public identification information PK may be calculated by an external device.
That is, at least part of the access right exercise information GK is calculated within the tamper-resistant property module 14 .

In the present embodiment, the value of the random number λ power of the access right exercise information GK is generated from the secret authentication information AI, the predetermined public identification information PK, and the value of the random number λ power in modulo p of the generator g. Therefore, the secret authentication information AI will not be deciphered by a third party other than the administrator of the access management device 2 . The reason why the secret authentication information AI is not deciphered by a third party other than the administrator of the access management device 2 is based on the DDH (Decision Diffie Hellman) hypothesis.

Step S330: The access right exercise information generation unit 142 supplies the generated access right exercise information GK to the access management device 2 via the communication unit 10. FIG.

Step S340: The access request unit 13 determines whether or not the access management device 2 permits access to the access target R. Here, when the access request unit 13 acquires the access permission information AP supplied from the access management device 2, it determines that the access to the access target R is permitted. When the access prohibition information AD supplied from the access management device 2 is acquired, the access request unit 13 determines that access to the access target R is not permitted.

When the access request unit 13 determines that access to the access target R is permitted (step S340; YES), the access execution unit 15 executes the process of step S350. On the other hand, when the access request unit 13 determines that access to the access target R is not permitted (step S340; NO), the process ends.

Step S350: The access execution unit 15 executes access to the access target R via the communication unit 10. FIG.

Next, with reference to FIG. 7, the process of verifying access to the access target R of the user terminal 1 by the access management device 2 will be described.
FIG. 7 is a diagram showing an example of access verification processing of the access management device 2 according to this embodiment.

Step S<b>400 : The access request acquisition unit 23 acquires the access request information AR supplied from the user terminal 1 via the communication unit 20 . The access request acquisition unit 23 supplies the acquired access request information AR to the access right inspection unit 26 .

Step S<b>410 : The access right checking unit 26 supplies the user terminal 1 via the communication unit 20 with the random number λ-th power of the generator g of the group G. FIG. Here, the random number generation unit 25 generates a random number λ each time the access request acquisition unit 23 acquires the access request information AR in step S400.

Here, as described in step S210 of FIG. 5, the secret authentication information AI given to the user terminal 1 is stored in the secret authentication information storage unit 141 of the tamper-resistant characteristic module 14 held by the user terminal 1. That is, the access right granting unit 24 grants the secret authentication information AI to the user UE by recording the secret authentication information AI in the anti-tampering module 14, which is a module possessing anti-tampering properties held by the user UE.

Since the access right granting unit 24 grants the secret authentication information AI to the user terminal 1, which is the user UE, by recording the secret authentication information AI in the tamper-resistant property module 14, the secret authentication information AI is kept secret from a third party. be. Here, the third party means a user outside the access management system AS, a user terminal 1 other than the user terminal 1 that supplied the access request information AR to the access management device 2, and a user terminal 1 that supplies the access request information AR to the access management device 2. including the user terminal 1 that has The secret authentication information AI is referred to by the access management device 2 .

That is, the access right granting unit 24 assigns the secret authentication information AI associated by the access right managing unit 22 to the access target node AN, which is the node N corresponding to the access right V exercised by the user UE, among the nodes N. , the secret authentication information AI is given to the user UE in such a way that it is kept secret from a third party.

Step S<b>420 : The access right checking section 26 acquires the access right exercise information GK supplied from the user terminal 1 via the communication section 20 .

Step S430: The access right checking unit 26 checks whether the access right exercise information GK acquired in step S420 matches the secret identification information SK associated with the access target node AN indicated by the access request information AR to the power of the random number λ. determine whether or not
That is, matching between the access right exercise information GK and the random number λ power of the secret identification information SK means that the access right exercise information GK and a value including the random number λ shown by the above equation (5) match. be.
It should be noted that matching between the access right exercise information GK and the secret identification information SK raised to the power of λ is an example of the access right exercise information GK and the secret identification information SK satisfying a predetermined relational expression.

The access right checking unit 26 checks the secret authentication information AI granted by the access right granting unit 24, the public identification information PK of the node N corresponding to the secret authentication information AI, and in the directed acyclic graph OG of the node N The public identification information PK of the upper node of , the access right exercise information GK obtained using the one-way function F1, and the secret identification information SK associated with the access target node AN satisfy a predetermined relational expression Check whether or not

When the access right checking unit 26 determines that the access right exercise information GK and the secret identification information SK satisfy the above-described predetermined relational expression (step S430; YES), the access right is confirmed by the access permission unit 27. provides a determination result indicating After that, the access permitting unit 27 executes the process of step S440.
On the other hand, when the access right checking unit 26 determines that the access right exercise information GK and the secret identification information SK do not satisfy the above-described predetermined relational expression (step S430; NO), the access right checking unit 27 confirms the access right. provide a determination result indicating that the After that, the access permitting unit 27 executes the process of step S450.

Step S440: The access permitting unit 27 permits the user terminal 1 to access the access target R. The access permission unit 27 supplies access permission information AP to the user terminal 1 via the communication unit 20 .

Step S450: The access permitting unit 27 prohibits the user terminal 1 from accessing the access target R. The access permission unit 27 supplies access prohibition information AD to the user terminal 1 via the communication unit 20 .

In this embodiment, the access right exercising information GK is generated using a random number λ, and the access right inspecting unit 26 detects that the access right exercising information GK matches the value including the random number λ given by Equation (5). In other words, it is determined whether or not the access right exercise information GK matches the secret identification information SK to the power of the random number λ, but it is not limited to this.
The access right exercise information GK may be generated as a value represented by Equation (4) without using the random number λ for generating the access right exercise information GK. When the access right exercise information GK is generated as a value represented by the formula (4), in step S440 the access right checking unit 26 checks that the access right exercise information GK and the secret identification information SK represented by the formula (4) are Determine whether or not they match.

When the access right exercise information GK is generated as a value represented by the equation (4) without using the random number λ to generate the access right exercise information GK, the access management device 2 uses the random number generator 25 may not be provided. Also, in this case, the processing of step S310 in FIG. 6 and step S410 in FIG. 7 are omitted.

In this embodiment, the secret authentication information AI is given to the user terminal 1 from the access management device 2 in step S130 of FIG. 4, but it is not limited to this. The secret authentication information AI may be given to the user terminal 1 from the access management device 2 after acquiring the access request information AR supplied from the user terminal 1 in step S400 of FIG. For example, in step S410 of FIG. 7, the secret authentication information AI may be given from the access management device 2 to the user terminal 1 together with the random number λ-th power of the generator g of the group G.

As described above, the access management device 2 according to this embodiment includes the access right management unit 22 , the access right granting unit 24 , and the access right inspection unit 26 .
The access right management unit 22 discloses to the user UE who exercises the access right V to each node N of the directed acyclic graph OG that shows the inclusive relationship between the access rights V by associating the access right V with each node. The public identification information PK received, the secret identification information SK that is essential information for exercising the access right V, and the secret authentication information AI given to the user UE are associated with each other.
The access right granting unit 24 sends secret authentication information AI associated by the access right managing unit 22 to the access target node AN, which is the node N corresponding to the access right V exercised by the user UE, among the nodes N. The authentication information AI is given to the user UE by a method that keeps it secret from a third party.
The access right checking unit 26 receives the secret authentication information AI granted by the access right granting unit 24 and the public identification information PK of the upper node in the directed acyclic graph OG of the node N corresponding to the secret authentication information AI. is input to the one-way function F1, and the secret identification information SK associated with the access target node AN satisfies a predetermined relational expression. do.

With this configuration, in the access management device 2 according to the present embodiment, the secret identification information SK associated with the lower node is the secret authentication information AI associated with the higher node and the predetermined disclosure of the public identification information PK. Since the identification information PK is input to the one-way function F1, the number of keys to be managed in access control for managing a plurality of access rights having mutually inclusive relationships is defined by the number of access rights and the number of inclusive relationships. can be less than
The access management device 2 according to this embodiment can implement access control for a large number of complex objects while keeping the number of keys to be managed small.

Further, in the access management device 2 according to the present embodiment, the one-way function F1 has homomorphism, and the access right exercise information GK is obtained by inputting the secret authentication information AI into the one-way function F1. It is generated by executing a predetermined calculation procedure on the value and the public identification information PK of the higher nodes in the directed acyclic graph OG of the node N. FIG.
With this configuration, the input of the one-way function F1 calculated in the tamper-resistant property module 14 is only the secret authentication information AI for safety, and the output of the one-way function F1 and the By executing a predetermined calculation procedure on the public identification information PK of the upper node, it becomes possible to generate the necessary access right exercise information GK, inputting and outputting data to the tamper-resistant characteristic module 14, It is possible to reduce the amount of calculation in the tamper-resistant characteristic module 14 whose calculation capability is limited.

In addition, in the access management device 2 according to the present embodiment, the object of access by the access right V (access object R in this example) is data, and the data is encrypted using secret identification information SK as a key. The data is decrypted using the secret identification information SK calculated from the secret authentication information AI given to the user UE as a key, thereby making it possible to access the data.
With this configuration, in the access management device 2 according to the present embodiment, among the secret identification information SK, which is the key for encrypting data, the secret identification information SK associated with a lower node is associated with a higher node. Since the secret authentication information AI and the predetermined public identification information PK out of the public identification information PK are input to the one-way function F1, the number of keys to be managed when managing access rights to data can be reduced with respect to the number of access rights and the number of containment relations.

In addition, in the access management device 2 according to the present embodiment, the access right granting unit 24 allows the user UE to access the user by recording the secret authentication information AI in the tamper-resistant module 14, which is a module having a tamper-resistant characteristic held by the user UE. Give the UE a secret authentication information AI. Also, at least part of the access right exercise information GK is calculated within the tamper resistance characteristic module 14 .
With this configuration, the access management device 2 according to the present embodiment can provide the user with the secret authentication information AI by a method that is kept confidential from a third party, and can provide the access right exercise information GK by a method that is kept confidential from a third party. Since it can be calculated, access rights can be managed more safely than when the tamper-resistant characteristic module 14 is not used.
In the access control device 2 according to the present embodiment, when the one-way function F1 satisfies the homomorphism, the portion of the access right exercise information GK that requires the secret authentication information AI is calculated in the tamper resistance module 14. Calculation efficiency can be improved by having the external device calculate the remaining portion of the access right exercise information GK using the public identification information PK.

(Second embodiment)
A second embodiment of the present invention will be described in detail below with reference to the drawings.
In access control that handles a plurality of access rights that have mutually inclusive relationships, it is common for new access rights to be defined using logical relationships (logical expressions) of existing access rights. For example, a first table and a second table in a relational database
If independent access rights are set for each table, to access the join between the first table and the second table, both the first table and the second table must be must have access to In other words, access rights expressed by the AND of access rights in both the first table and the second table are required.

Conversely, in order to access the projection to the column commonly included in the first table and the second table, the access right to either the first table or the second table must be changed. It is enough to have The access rights are expressed by the OR of the access rights of both the first table and the second table.

In the first embodiment, a case has been described in which the access management device handles access rights whose inclusion relationship is indicated by a directed acyclic graph. In this embodiment, the access management device newly sets access rights expressed by an arbitrary logical expression between two or more access right groups that have already been defined. do.

For example, for simplicity, assume that the public root identity is 1, the private identity is the value given by equation (11), and the private authentication is the number r.

For simplicity of explanation, the access right V1 and the access right V2 directly below the root authority will be considered below, but this assumption is not essential. The public identification information of the access right Vi is the value shown by Equation (12), the secret identification information SKi is the value shown by Equation (13), and the secret authentication information is the value shown by Equation (14).
If the access authority Vi is not directly under the root authority, the secret identification information may be determined by equation (4), for example, as in the first embodiment described above. In fact, equation (13) is nothing but the value of equation (4) when Ai={1} and xi=1.

An access right represented by a logical expression of two or more access rights is called a logical access right LV. Also, secret authentication information associated with the logical access right LV is referred to as logical secret identification information LSK. The secret authentication information associated with the logical access right LV is referred to as logical secret authentication information LAI. Public identification information associated with the logical access right LV is referred to as logical public identification information LPK.

Assume that the logical expression access right LV described by the logical product (AND) of the access right V1 and the access right V2 is the logical expression access right _V1∧2 . Let the logical expression public identification information LPK of the logical expression access right _V1∧2 be the value indicated by the expression (15). In particular, when the Boolean access right _{V1 ∧ 2} is not explicitly granted to users, and access is permitted only to users granted both the access right V1 and the access right V2, the value of the Boolean public identification information LPK can be set to 1.

Let the logical secret identification information LSK of the logical access right _V1̂2 be the value shown by the formula (16), and let the logical secret authentication information LAI of the logical formula access right _V1̂2 be the value shown by the formula (17).

Here, a user to whom both the secret authentication information AI1 and the secret authentication information AI2 have been granted can calculate the logical formula secret identification information LSK of the logical formula access right _V1∧2 by the operation of the formula (18).

From the calculation of formula (18), it can be seen that there are two types of users who can exercise the logical expression access privilege _V1∧2 . The first user is the user who is granted access right V1 and access right V2, respectively, and thus can compute both the value given by equation (19) and the value given by equation (20).

A second user is a user who is granted the Boolean expression access right _V1∧2 and therefore can compute the value indicated by equation (21).

Only the first user or the second user can exercise the logical access right _V1Λ2 . The first user simultaneously has any access right included in the access right V1 and any access right included in the access right V2. The second one, on the other hand, only has the boolean access right _V1̂2 .

Here, the access right described by the logical sum (OR) of the access right V1 and the access right V2 is assumed to be a logical expression access right _V1∨2 . The logical secret identification information LSK of the logical access right _V1∨2 is defined by the value shown by the equation (22), and the logical secret authentication information LAI of the logical access right _V1∨2 is defined by the value shown by the equation (23). , the logical expression access privilege _V1∨2 can be constructed in the same manner as in the case of the logical product described above.

By recursively combining the above configurations, it is possible to configure access rights described by arbitrary logical expressions with existing access rights as arguments, using public identification information, secret identification information, and secret authentication information. becomes.

(Configuration of access control system)
The access management system according to this embodiment is called an access management system ASa. Further, the user terminal according to the present embodiment is called a user terminal 1a, the access control device is called an access control device 2a, and the access right information server is called an access right information server 3a.

FIG. 8 is a diagram showing the configurations of a user terminal 1a and an access management device 2a according to this embodiment.
Comparing the user terminal 1a (FIG. 8) according to the present embodiment with the user terminal 1 (FIG. 3) according to the first embodiment, public information acquisition unit 11a, public information storage unit 12a, access request unit 13a, and The tamper resistance module 14a is different. Here, other components (communication unit 1
0 and access execution unit 15) are the same as in the first embodiment.
Further, when comparing the access management device 2a (FIG. 8) according to the present embodiment with the access management device 2 (FIG. 3) according to the first embodiment, the user management unit 21a, the access right management unit 22a, the access request acquisition A section 23a, an access right granting section 24a, an access right checking section 26a, an access permitting section 27a, and a logical secret identification information generating section 28a are different. Here, functions of other components (the communication unit 20 and the random number generation unit 25) are the same as in the first embodiment.
Further, when the access right information server 3a (FIG. 8) according to the present embodiment and the access right information server 3 (FIG. 3) according to the first embodiment are compared, the stored access right information XIa is different. Information indicated by the user management information UL here is the same as in the first embodiment. The configuration of the access target server 4 (FIG. 8) according to this embodiment is the same as the configuration of the access target server 4 (FIG. 3).
The description of the same functions as those of the first embodiment will be omitted, and the description of the second embodiment will focus on the portions that differ from those of the first embodiment.

The user terminal 1a includes a communication unit 10, a public information acquisition unit 11a, a public information storage unit 12a, an access request unit 13a, a tamper resistance module 14a, and an access execution unit 15.

The public information acquisition unit 11 a acquires public information PIa supplied by the access management device 2 . The public information PIa includes public identification information PK, group information GI, and logical formula public identification information LPK.
The public information storage unit 12a stores the public information PIa acquired by the public information acquisition unit 11a.

The access request unit 13a supplies logical access request information LAR to the access management device 2a. Here, the logical access request information LAR is information indicating one or more access targets R indicated by a logical formula. The logical access request information LAR indicates, for example, the combination of the access target R1 and the access target R2. In another example, the logical access request information LAR indicates the common part of the access target R1 and the access target R2.

The tamper-resistant property module 14a includes a secret authentication information acquisition unit 140a, a secret authentication information storage unit 141a, and an access right exercise information generation unit 142a.
The secret authentication information acquisition unit 140a acquires secret authentication information AI and logical secret authentication information LAI supplied from the access management device 2a.
The secret authentication information storage unit 141a stores the secret authentication information AI acquired by the secret authentication information acquisition unit 140a and the logical secret authentication information LAI.

The access right exercise information generation unit 142a generates public information PIa stored in the public information storage unit 12, secret authentication information AI stored in the secret authentication information storage unit 141, and logic stored in the secret authentication information storage unit 141. Logical access right exercise information LGK is generated based on the formula secret authentication information LAI. Here, the value of the one-way function F1 generated by the user terminal 1a, for example, according to Equation (18) described above is referred to as logical access right exercise information LGK.

The access management device 2a includes a communication unit 20, a user management unit 21a, an access right management unit 22a, an access request acquisition unit 23a, an access right grant unit 24a, a random number generation unit 25, and an access right inspection unit 26a. , an access permitting section 27a, and a Boolean secret identification information generating section 28a.

Based on the user management information UL stored in the access right information server 3a, the user management unit 21a determines whether the user terminal 1a may be given the logical access right LV.
The access right management unit 22a associates each node N of the directed acyclic graph OG with public identification information PK, secret identification information SK, and secret authentication information AI. Further, the access right management unit 22a associates the logical formula access right _V1∧2 with the logical formula public identification information LPK, the logical formula secret identification information LSK, and the logical formula secret authentication information LAI.

The access request acquisition unit 23a acquires the logical access request information LAR supplied from the user terminal 1a.
The access right granting unit 24a supplies the logical secret authentication information LAI to the user terminal 1 when explicitly granting the logical access right LV.
The logical secret identification information generator 28a generates logical secret identification information LSK.

The access right checking unit 26a uses the random number λ generated by the random number generating unit 25 according to the logical expression access request information LAR obtained by the access request obtaining unit 23 to determine the generation element g of the group G by Equation (6). Supplying a random number to the power of λ to the user terminal 1a, logical access right exercise information LGK supplied from the user terminal 1a, and logic associated with the access target R represented by the logical expression indicated by the logical access request information LAR It is checked whether or not the formula secret identification information LSK to the power of λ matches.
The access permission unit 27a permits or prohibits access to the access target R represented by the logical expression of the user terminal 1 according to the determination result of the access right inspection unit 26a.

The access right information server 3a stores access right information XIa and user management information UL. Here, the access right information XIa includes the inclusive relation among the access rights V1 to V9, the information of the key required to exercise the access right V, and the information of the key required to exercise the logical access right LV. This is the information shown.

(Processing in access control system)
FIG. 9 is a diagram showing an example of access management processing of the access management device 2a according to this embodiment. The processing shown in FIG. 9 is started when the operation of the access management system ASa is started.

Step S500: The access right management unit 22a, via the communication unit 20, sends public identification information PK and , secret identification information SK and secret authentication information AI. Furthermore, the access right management unit 22a adds the logical formula public identification information LPK and the logical formula private identification information to the logical formula access right LV included in the access right information XIa stored in the access right information server 3a via the communication unit 20. Information LSK is associated with logical secret authentication information LAI.

Step S510: The logical secret identification information generation unit 28a generates logical secret identification information LSK.
Here, the logical formula secret identification information LSK is an access right represented by a logical formula of a plurality of access rights V, in addition to the inclusive relationship between the access rights V indicated by the directed acyclic graph OG. , based on the secret identification information SK associated with the node N associated with the plurality of access rights V used to express the logical expression access right LX and the public identification information PK by the access right management unit 22a, Logical secret identification information LSK, which is secret identification information SK for the logical access right LX, is generated.

Step S520: The access right management unit 22a sends public identification information PK to each of a plurality of user terminals 1-i (i=1, 2, . . . , M: M is the number of user terminals), supply through. Furthermore, the access right management unit 22a sends the logical formula public identification information LPK to each of a plurality of user terminals 1-i (i=1, 2, . . . , M: M is the number of user terminals).
0.

Step S530: Based on the user management information UL stored in the access right information server 3a, the user management unit 21a determines whether or not the access right V and the logical access right LV may be granted to the user terminal 1a. judge. The user management unit 21 a supplies the determination result to the access right granting unit 24 .

For example, when the user management unit 21a determines whether or not to grant the logical access right _V1∧2 , based on the user management information UL, the user management unit 21a provides the user terminal 1a with a combination of the access target R1 and the access target R2. Determines whether or not to allow access to

Further, for example, when the user management unit 21a determines whether or not to grant the logical access right _V1∨2 , the user management unit 21a assigns access target R1 and access target R2 to the user terminal 1a based on the user management information UL. determines whether or not to permit access to the common part of

Step S540: The access right granting unit 24a grants the access right V and the logical access right LV to the user terminal 1a. Here, the access right granting unit 24a grants the access right V to the user terminal 1a by supplying the secret authentication information AI and the logical secret authentication information LAI to the user terminal 1a via the communication unit 20. FIG.

Next, referring to FIG. 10, processing of the user terminal 1 before access will be described.
FIG. 10 is a diagram showing an example of processing for acquiring public information and secret authentication information of the user terminal 1 according to this embodiment.
Step S<b>600 : The public information acquisition unit 11 acquires the public identification information PK and the logical formula public identification information LPK supplied from the access management device 2 via the communication unit 10 . The public information acquisition unit 11 causes the public information storage unit 12 to store the acquired public identification information PK and logical formula public identification information LPK.

Step S610: If the access right that satisfies the logical expression is not granted, for example, if either the access right _V1 or the access right V2 is not granted for the logical expression access right V1∧2, secret authentication information acquisition The unit 140a acquires, via the communication unit 10, the logical secret authentication information LAI supplied from the access management device 2a. The secret authentication information acquisition unit 140a stores the acquired logical secret authentication information LAI in the secret authentication information storage unit 141a.

Next, with reference to FIG. 11, the processing when the user terminal 1a accesses the access target R indicated by the logical expression will be described.
FIG. 11 is a diagram showing an example of access execution processing of the user terminal 1a according to this embodiment. Note that the processing of steps S710, S740, and S750 is the same as the processing of steps S310, S340, and S350 in FIG. 6, and thus description thereof is omitted.

Step S700: The access request unit 13a requests the access management device 2a to access the access target R represented by the logical expression. Here, the access request unit 13a requests access by supplying logical access request information LAR to the access management device 2a via the communication unit 10. FIG.

Step S720: The access right exercising information generation unit 142a generates logical access information based on the public information PIa stored in the public information storage unit 12a and the logical secret authentication information LAI stored in the private authentication information storage unit 141a. Generate exercise information LGK.

Here, if necessary, the access right exercise information generation unit 142a generates the given secret authentication information including the logical secret authentication information LAI, the logical public identification information LPK included in the public information PIa, and the predetermined public identification information. PK and the random number λ-th power of the generator g of the group G supplied from the secret authentication information acquisition unit 140a are input into the one-way function F1 represented by the above-described formula (3) to obtain the logical expression access right Generate exercise information LGK. Here, for example, the logical access right exercise information LGK when the value of the random number λ for the logical access right _V1∧2 is 1 is expressed by the above-described formula (18).

Even if the logical secret authentication information LAI is not supplied from the access management device 2a, the access right exercise information generation unit 142a allows the secret authentication information acquisition unit 140a to obtain a plurality of access targets R (for example, access targets R1, and access target R2) (for example, secret authentication information AI1 for access target R1 and secret authentication information AI2 for access target R2) are acquired, the plurality of secret authentication information AI and , using the public identification information PK and the logical expression public identification information LPK, for example, in the case of the logical expression access right _V1∧2 , the logical expression access right exercise information LGK can be generated according to the formula (18). can.

Step S730: The access right exercise information generation unit 142a supplies the generated logical access right exercise information LGK to the access management device 2 via the communication unit .

Next, with reference to FIG. 12, the process of verifying access to the access target R represented by the logical expression of the user terminal 1a by the access management device 2a will be described.
FIG. 12 is a diagram showing an example of access verification processing of the access management device 2 according to this embodiment. Note that the processes of steps S810 and S850 are the same as the processes of steps S410 and S450 in FIG. 7, so description thereof will be omitted.

Step S800: The access request acquisition unit 23a acquires via the communication unit 20 the logical access request information LAR supplied from the user terminal 1a. The access request acquiring unit 23 supplies the acquired access request information AR to the access right granting unit 24 .

Step S820: The access right checking unit 26a acquires, via the communication unit 20, the logical access right exercise information LGK supplied from the user terminal 1a.

Step S830: The access right checking unit 26a performs the logical expression secret identification associated with the access target R represented by the logical expression indicated by the logical expression access right exercise information LGK acquired in step S830 and the logical expression access request information LAR. It is determined whether or not the information LSK coincides with the value of the random number λ.

When the access right checking unit 26a determines that the logical access right exercise information LGK and the value of the random number λ power of the logical secret identification information LSK match (step S830; YES), the access right checking unit 26a supplies the determination result to the access permission unit 27a. do. After that, the access permitting unit 27a executes the process of step S840. On the other hand, when it is determined that the logical access right exercise information LGK and the value of the random number λ power of the logical secret identification information LSK do not match (step S830; NO), the determination result is supplied to the access permitting section 27a. After that, the access permitting unit 27a executes the process of step S850.

Step S840: The access permitting unit 27a permits the user terminal 1a to access the access target R represented by the logical expression indicated by the logical access request information LAR.
For example, when the logical access request information LAR indicates the access right to the combination of the access target R1 and the access target R2, the access permitting unit 27a permits the access of the user terminal 1a to the access target R1 and the access target R2. Further, for example, when the logical access request information LAR indicates the access right to the common portion of the access target R1 and the access target R2, the access permitting unit 27a allows the user terminal 1a to the common portion of the access target R1 and the access target R2. to allow access.

As described above, the access management device 2a according to this embodiment includes the logical secret identification information generator 28a.
In addition to the inclusive relationship indicated by the directed acyclic graph OG, the logical expression secret identification information generation unit 28a applies the logical expression Based on secret identification information SK associated by the access-rights management unit 22 with a node N associated with a plurality of access rights V used to represent the access right LX, and public identification information PK, a logical expression access right LX Logical formula secret identification information LSK which is secret identification information SK for is generated.

With this configuration, in the access management device 2a according to the present embodiment, the logical formula secret identification information LSK is combined with the secret identification information SK associated with a plurality of access rights V used to express the logical formula access right LX, and the public Since it can be generated based on the identification information PK, access control that handles a plurality of access rights that have an inclusion relationship with each other, access control that handles access rights that are dynamically defined by a logical expression of access rights, and their The number of keys to be managed in access control having both functions can be reduced with respect to the number of access rights, the number of containment relations, and the number of logical expressions to be covered.

In the access management device 2a according to the present embodiment, for a user terminal to which secret authentication information of an access right that satisfies a logical expression has already been granted, corresponding logical secret authentication information LAI is newly issued to the user terminal. It is possible to reduce the trouble of issuing secret authentication information and reduce the number of secret authentication information to be managed in the user terminal. Since the number of logical access rights increases combinatorially with respect to the number of existing access rights, the effect of improvement by the access management device 2a according to this embodiment is extremely large. Also, when the logical formula public identification information is set to 1, the information managed by the access management device 2a does not increase at all.

(Third Embodiment)
A third embodiment of the present invention will be described in detail below with reference to the drawings.
In the above-described first and second embodiments, as a method for concealing secret authentication information from a third party, a case where secret authentication information is recorded in a tamper-resistant characteristic module for a user has been described. This embodiment shows a method of permitting a user specified by an identifier to exercise access rights without informing the user of either secret authentication information or secret identification information. In this embodiment, unlike the first and second embodiments, the secret authentication information is not recorded in a tamper-resistant device that is inaccessible to the user. After converting to the data format called, a ticket is issued to the user. Since the ticket is data in which secret authentication information is masked with random numbers, it is safe to transmit, receive, and record without using encryption or the like.
Furthermore, in the present embodiment, the access management device can restore the identifier of the user who should originally receive the ticket when the ticket is illegally circulated, for example, by illegally distributing the ticket.

First, let the order of the group G in the first and second embodiments be the product pr of two secret primes. Here the group G is a cyclic group. Let the elements represented by equation (24) be the generators of the group G.

Here, the element g of the order p is defined as shown in Equation (25).

Let the public identification information of the access right Vi be the value indicated by the above equation (12), and let the secret identification information be the value indicated by the equation (4). A ticket t issued to a user whose identifier is the value u is defined by equation (26).

In equation (26), PRF(.,.) is a keyed pseudo-random number function, for example, the HMAC-SHA1 function. It is assumed here that the header data h is header data that can uniquely identify the ticket t. For example, when the ticket t is generated, the identifier may be uniquely determined, and the determined identifier may be included in the header data h.
The public identities of access rights Vi are the elements of the multiplicative group of prime fields of characteristic p, as shown by equation (27).

The identifier value u is given by equation (29) for a suitable natural number U evaluated from above by a polynomial with parameters (called security parameters) defined as bit lengths given by equation (28) for prime p. choose as To be evaluated from above with a polynomial of ||p|| means that U≦||p|| ^k holds for an appropriate natural number k.

In this embodiment, as an example, it is assumed that an access management device, which is a resource gateway, authenticates access rights by Diffie-Hellman-Merkle authentication. The authentication procedure is described below.

First, the user requests access to the resource to the gateway of the resource subject to the access right Vi. The gateway then generates a random number that satisfies equation (30) and provides the value indicated by equation (31) to the user. Below, the value generated using the random number shown by Equation (31) is represented as value c.

The user then computes the value shown by equation (32) and supplies it to the gateway.

Finally, the gateway checks whether equation (33) holds with the values supplied by the user and only allows the user access if the check holds.

Since the two primes p and r are confidential information, PRF(p,h) is an uncomputable random number for those who do not know p. Therefore, since the ticket t is also a random number that cannot be calculated, it is impossible to forge the ticket.

On the other hand, if the ticket t is fraudulently used, the calculation indicated by the equation (34) is first performed for the fraudulently presented value R that results in the equation (32).

Next, an algorithm such as Baby-Step-Giant-Step is used to search for a value u that satisfies equation (35).

It is known that the search for the value u that satisfies the equation (35) can be performed with the amount of computation indicated by the equation (36). Equation (35) is hereinafter referred to as a user determination equation.

Since the upper limit of the natural number U is suppressed by the parameter polynomial represented by the equation (28), it is possible to search for the value u within a practical time.

As described above, in this embodiment, issuing a ticket t and header data h based on equation (26) makes it impossible for the user to know secret authentication information or secret identification information. Further, in the present embodiment, if the ticket t is illegally used, it is possible to identify the user to whom the ticket t was first issued.

(Configuration of access control system)
The access management system according to this embodiment is called an access management system ASb. Also, the user terminal according to this embodiment is referred to as a user terminal 1b, and the access management device is referred to as an access management device 2b.

FIG. 13 is a diagram showing the configurations of a user terminal 1b and an access management device 2b according to this embodiment.
Comparing the user terminal 1b (FIG. 13) according to the present embodiment with the user terminal 1 (FIG. 3) according to the first embodiment, the module 14b is different. Here, functions of other components (communication unit 10, public information acquisition unit 11, public information storage unit 12, access request unit 13, and access execution unit 15) are the same as in the first embodiment.
Further, when the access management device 2b (FIG. 13) according to the present embodiment and the access management device 2 (FIG. 3) according to the first embodiment are compared, ticket granting unit 24b, ticket inspection unit 26b, and ticket generation unit 29b are shown. , and the unauthorized user determination unit 30b. Here, functions of other components (the communication unit 20, the user management unit 21, the access right management unit 22, the access request acquisition unit 23, the random number generation unit 25, and the access permission unit 27) are the same as those of the first embodiment. are the same.
The configuration of the access right information server 3 (FIG. 8) according to this embodiment is the same as the configuration of the access right information server 3 (FIG. 3) according to the first embodiment. The configuration of the access target server 4 (FIG. 8) according to this embodiment is the same as the configuration of the access target server 4 (FIG. 3) according to the first embodiment.
The description of the same functions as those of the first embodiment will be omitted, and the description of the third embodiment will focus on the portions that differ from those of the first embodiment.

The user terminal 1 b includes a communication section 10 , a public information acquisition section 11 , a public information storage section 12 , an access request section 13 , a module 14 b and an access execution section 15 .

The module 14b includes a ticket acquisition unit 140b, a ticket storage unit 141b, and a ticket exercise information generation unit 142b. Although the module 14b does not have tamper resistance in this embodiment, the module 14b may have tamper resistance.

The ticket acquisition unit 140b acquires the ticket t supplied from the access management device 2b.
The ticket storage unit 141b stores the ticket t acquired by the ticket acquisition unit 140b.
The ticket exercise information generation unit 142b generates ticket exercise information TK based on the public information PI stored in the public information storage unit 12 and the ticket t stored in the ticket storage unit 141b. Here, the ticket exercise information TK is the value of the one-way function F1 generated by the user terminal 1b, and is expressed by the above equation (32).

The access management device 2b includes a communication unit 20, a user management unit 21, an access right management unit 22, an access request acquisition unit 23, a ticket grant unit 24b, a random number generation unit 25, a ticket inspection unit 26b, an access It includes an authorization unit 27, a ticket generation unit 29b, and an unauthorized user determination unit 30b.

The ticket granting unit 24b supplies the ticket t to the user terminal 1b.

The ticket inspection unit 26b supplies the value represented by the above-described formula (31) to the user terminal 1b according to the access request information AR acquired by the access request acquisition unit 23. FIG. In addition, the ticket inspection unit 26b sets a value between the ticket exercise information TK supplied from the user terminal 1b and the secret identification information SK associated with the access target node AN indicated by the access request information AR as indicated by Equation (33). It checks whether the relational expression

The ticket generation unit 29b generates the ticket t based on Equation (26) described above.
The unauthorized user determination unit 30b converts the user identification information UI used to generate the ticket t from the ticket exercise information TK generated by the user UE using the ticket t generated by the ticket generation unit 29b to the formula (35 ). The unauthorized user determination unit 30b determines an unauthorized user based on the acquired user identification information UI. Here, the user identification information UI is information indicating the identifier of the user terminal 1b.

(Processing in access control system)
Referring to FIG. 14, access management processing, which is processing of the access management device 2b before access by the user terminal 1b, will be described.
FIG. 14 is a diagram showing an example of access management processing of the access management device 2b according to this embodiment. The processing shown in FIG. 14 is started when the operation of the access management system ASb is started. Note that the processes of steps S900, S910, and S920 are the same as the processes of steps S100, S110, and S120 in FIG. 4, so description thereof will be omitted.

Step S930: The ticket generator 29b generates a ticket t based on Equation (26). The ticket generation unit 29b supplies the generated ticket t to the ticket granting unit 24b.
Equation (26) now involves operations on the numbers xi, ie on the secret authentication information AI. Equation (26) also includes operations for values u that include a secret prime p, ie user identities UI that include factors that are not exposed to the user UE.

In Equation (26), it is difficult to calculate the prime number p, the number xi, and the value u on the right side within a practical time by inverse operation from ticket t on the left side. That is, equation (26) represents a one-way function. The one-way function is called a one-way function F2.

A ticket t is thus the value of a one-way function F2 whose inputs are at least partly the secret authentication information AI of the access right V to the user UE and the user identification information UI identifying the user UE.
In other words, the ticket generation unit 29b generates a ticket that is a value of the one-way function F2, at least part of which is the secret authentication information AI of the access right V to the user UE and the user identification information UI that identifies the user UE. generate t.

Note that the one-way function F2 that is difficult to calculate the prime number p, the number xi, and the value u on the right side in a practical time by performing an inverse operation from the ticket t on the left side is A one-way function represented by the formula may be used.

Step S940: The ticket granting unit 24b grants the ticket t generated by the ticket generating unit 29b to the user terminal 1b indicated by the value u, which is the user identification information UI used to generate the ticket t. Here, the ticket granting unit 24b grants the ticket t by supplying the ticket t to the user terminal 1b via the communication unit 20. FIG.

Ticket t is information obtained by converting secret authentication information AI based on equation (26). That is, the ticket granting unit 24b grants the ticket t generated by the ticket generating unit 29b to the user UE as the secret authentication information AI.

Next, with reference to FIG. 15, processing of the user terminal 1b before access will be described.
FIG. 15 is a diagram showing an example of ticket acquisition processing of the user terminal 1b according to this embodiment. Note that the processing of step S1000 is the same as the processing of step S200 in FIG. 5, so description thereof will be omitted.

Step S1010: The ticket acquisition unit 140b acquires, via the communication unit 10, the ticket t supplied from the access management device 2b. The ticket acquisition unit 140b stores the acquired ticket t in the ticket storage unit 141b.

Next, with reference to FIG. 16, processing when the user terminal 1b accesses the access target R will be described.
FIG. 16 is a diagram showing an example of access execution processing of the user terminal 1b according to this embodiment. Note that the processes of steps S1100, S1140, and S1150 are the same as the processes of steps S300, S340, and S350 in FIG. 5, so description thereof will be omitted.

Step S1110: The ticket exercise information generation unit 142b acquires, via the communication unit 10, the value c generated using random numbers supplied from the access management device 2b.

Step S1120: The ticket exercise information generation unit 142b generates ticket exercise information TK based on the value c supplied from the access management device 2b and the ticket t stored in the ticket storage unit 141b.
Here, the ticket exercise information generation unit 142b generates the ticket exercise information TK based on the ticket t and the value c supplied from the ticket acquisition unit 140b, based on Equation (32) described above.

Step S1130: The ticket exercise information generation unit 142b supplies the generated ticket exercise information TK to the access management device 2b via the communication unit .

Next, with reference to FIG. 17, the process of verifying access to the access target R by the user terminal 1b by the access management device 2b will be described.
FIG. 17 is a diagram showing an example of access verification processing of the access management device 2b according to this embodiment. In the access verification processing shown in FIG. 17, a case where access is performed by the user terminal 1b indicated by the value u, which is the user identification information UI used to generate the ticket t, will be described.
Note that the processing of steps S1200, S1240, and S1250 is the same as the processing of steps S400, S440, and S450 in FIG. 7, and thus description thereof is omitted.

Step S1210: The ticket granting unit 24b supplies the user terminal 1 via the communication unit 20 with the value c generated using the random number. Here, the ticket granting unit 24b generates the value c based on the random number λ generated by the random number generating unit 25 and Equation (31). Here, the ticket granting unit 24b generates a value c each time the access request acquiring unit 23 acquires access request information AR in step S1200.

Step S1220: The ticket inspection unit 26b acquires the ticket exercise information TK supplied from the user terminal 1b via the communication unit 20. FIG.

Step S1230: The ticket inspection unit 26b determines whether or not the ticket exercise information TK obtained in step S1220 matches the secret identification information SK associated with the access target node AN indicated by the access request information AR.
In this embodiment, matching between the ticket exercise information TK and the secret identification information SK means that the ticket exercise information TK and the secret identification information SK satisfy Equation (33) described above.

Here, the value R in Equation (33) is a value obtained by inputting the ticket t into the one-way function F1. In other words, the ticket inspection unit 26b uses the ticket exercise information TK obtained by inputting the ticket t granted by the ticket granting unit 24b into the one-way function F1, and the secret identification information SK associated with the access target node AN. satisfies a given relation.

When the ticket inspection unit 26b determines that the ticket exercise information TK and the secret identification information SK match (step S1230; YES), the ticket inspection unit 26b indicates to the access permitting unit 27 that the ticket exercise information TK and the secret identification information SK match. Provides decision results. After that, the access permitting unit 27 executes the process of step S1240.
On the other hand, if the ticket inspection unit 26b determines that the ticket exercise information TK and the secret identification information SK do not match (step S1230; NO), the ticket inspection unit 26b tells the access permission unit 27 that the ticket exercise information TK and the secret identification information SK do not match. provide a determination result indicating that After that, the access permitting unit 27 executes the process of step S1250.

Here, with reference to FIG. 18, the unauthorized user determination processing of the access management device 2 when the ticket t is used unauthorizedly will be described. The unauthorized use of the ticket t means, for example, access using the ticket t by a user other than the user to whom the access management device 2b gave the ticket t. The user to whom the access management device 2b has issued the ticket t is the user indicated by the value u, which is the user identification information UI used to generate the ticket t.

FIG. 18 is a diagram showing an example of unauthorized user determination processing of the access management device 2b according to this embodiment. The unauthorized user determination process shown in FIG. 18 is started when access using ticket t is performed by a user other than the user to whom ticket t was granted by access management device 2b.

Step S1300: The unauthorized user determination unit 30b calculates the left side of the user determination formula of formula (35) using the ticket exercise information TK generated by the user terminal 1b according to formula (32) using the ticket t. Here, the unauthorized user determination unit 30b uses the header data h of the ticket t to calculate the left side of the user determination formula (35).
Step S1310: The unauthorized user determination unit 30b determines the user to whom the ticket t is assigned. Here, the unauthorized user determination unit 30b uses an algorithm such as Baby-Step-Giant-Step, for example, to calculate the value u that satisfies the user determination formula of formula (35). judge.

As described above, the access management device 2b according to this embodiment includes the ticket generation unit 29b.
The ticket generating unit 29b uses, as at least part of the input, the secret authentication information AI of the access right V to the user UE and the user identification information UI identifying the user UE as a second one-way function (in this example , generates a ticket t which is the value of the one-way function F2).
The access right granting unit 24 (in this example, the ticket granting unit 24b) grants the ticket t generated by the ticket generating unit 29b to the user UE as the secret authentication information AI.
The access right checking unit 26 (in this example, the ticket checking unit 26b) inputs the ticket t granted by the access right granting unit 24 (in this example, the ticket granting unit 24b) into the one-way function F1, and obtains It is checked whether or not the second access right exercise information (ticket exercise information TK in this example) and the secret identification information SK associated with the access target node AN satisfy a predetermined relational expression.

With this configuration, the access management device 2b according to the present embodiment can convert the secret authentication information AI into a ticket t and give it to the user. In some cases, a tamper-resistant module or the like becomes unnecessary.

The access management device 2b according to this embodiment also includes an unauthorized user determination unit 30b.
The unauthorized user determination unit 30b replaces the user identification information UI used to generate the ticket t with the second access right exercise information ( In this example, it is obtained from the ticket exercise information TK).

With this configuration, the access management device 2b according to the present embodiment can identify the user to whom the ticket t was first issued, so that the illegal leakage of the ticket t can be suppressed. If a user leaks the ticket t granted to him/herself, the user will be identified by the access management device 2b according to this embodiment.

Note that some of the access management devices 2, 2a, and 2b in the above-described embodiments, such as the communication unit 20, the user management units 21 and 21a, the access right management units 22 and 22a, the access request acquisition units 23 and 23a, the access right Granting units 24, 24a, random number generating unit 25, access right inspecting units 26, 26a, access permitting units 27, 27a, logical formula secret identification information generating unit 28a, ticket granting unit 24b, ticket inspecting unit 26b, ticket generating unit 29b, and the unauthorized user determination unit 30b may be realized by a computer. In that case, a program for realizing this control function may be recorded in a computer-readable recording medium, and the program recorded in this recording medium may be read into a computer system and executed. The "computer system" here is a computer system built into the access management devices 2, 2a, and 2b, and includes hardware such as an OS and peripheral devices. The term "computer-readable recording medium" refers to portable media such as flexible discs, magneto-optical discs, ROMs and CD-ROMs, and storage devices such as hard discs incorporated in computer systems. Furthermore, "computer-readable recording medium" means a medium that dynamically stores a program for a short period of time, such as a communication line for transmitting a program via a network such as the Internet or a communication line such as a telephone line. It may also include a volatile memory inside a computer system that serves as a server or client in that case, which holds the program for a certain period of time. Further, the program may be for realizing part of the functions described above, or may be capable of realizing the functions described above in combination with a program already recorded in the computer system.
Also, part or all of the access management devices 2, 2a, and 2b in the above-described embodiments may be realized as an integrated circuit such as LSI (Large Scale Integration). Each functional block of the access management devices 2, 2a, and 2b may be processorized individually, or may be partially or entirely integrated into a processor. Also, the method of circuit integration is not limited to LSI, but may be realized by a dedicated circuit or a general-purpose processor. In addition, when an integration circuit technology that replaces LSI appears due to advances in semiconductor technology, an integrated circuit based on this technology may be used.

Although one embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to the above-described one, and various design changes and the like can be made without departing from the gist of the present invention. It is possible to

AS, ASa, ASb... Access management system 1, 1a, 1b... User terminal 2, 2a, 2b... Access management device 3... Access right information server 4... Access target server 10, 20... Communication unit 11 12 public information storage unit 13 access request unit 14 tamper resistant characteristic module 140 secret authentication information acquisition unit 141 secret authentication information storage unit 142 access right exercise information generation unit , 15... Access execution unit 21... User management unit 22, 22a... Access right management unit 23... Access request acquisition unit 24, 24a... Access right granting unit 25... Random number generation unit 26, 26a... Access right Inspection unit 27, 27a Access permission unit 28a Logical formula secret identification information generation unit 14b Module 140b Ticket acquisition unit 141b Ticket storage unit 142b Ticket exercise information generation unit 11a Public information acquisition Part 12a... Public information storage part 13a... Access request part 14a... Tamper resistance module 140a... Secret authentication information acquisition part 141a... Secret authentication information storage part 142a... Access right exercise information generation part 15a... Access Execution unit 24b Ticket giving unit 26b Ticket inspection unit 29b Ticket generation unit 30b Unauthorized user determination unit OG Directed acyclic graph N, N1 Node V Access right PI Open to public information, PK... public identification information, SK... secret identification information, AI... secret authentication information, F1... one-way function, F2... one-way function, AN... access target node, UI... user identification information, LX... logical formula Access right, LSK... Logical secret identification information

Claims (1)

The invention described herein.

Images