Patent Document

CLAIM OF PRIORITY 
       [0001]    The present application claims priority from Japanese application JP 2013-165187 filed on Aug. 8, 2013, the content of which is hereby incorporated by reference into this application. 
       FIELD OF THE INVENTION 
       [0002]    The present invention relates to a searching system and a searching method where a server searches deposited encrypted data without decrypting the encrypted data according to a request of a client in a server/client model. 
       BACKGROUND OF THE INVENTION 
       [0003]    Attention is recently paid to application management configuration called a cloud and utilizing an information system not maintained by its own organization but provided by another organization so as to enhance the efficiency of management expenses for the development and the application of the information system. In the meantime, since an organization that manages the information system is different from an organization that utilizes the information system in the cloud, it is difficult to take measures to prevent information leakage and others, to find a cause after the occurrence of an accident, and to prevent recurrence in only its own organization. Therefore, for measures to prevent an unjust outflow of data beforehand, encrypting technique is required to be utilized and the confidentiality of data is required to be secured. 
         [0004]    In the server/client model, for technique for preventing the leakage of data deposited in a server while a client deposits data in the server, a method utilizing encryption technique is known. For example, in Dawn Xiaodong Song, David Wagner, Arian Perrig. “Practical Techniques for Searches on Encrypted Data”, In Proceedings of the 2000 IEEE Symposium on Security and Privacy, pages 44-55 (2000) and JP-A No. 2012-123614, a method of searching deposited encrypted data without decrypting the encrypted data according to a request of a client is described. In this search method, a stochastic encryption system which is more secure than a definite encryption system having the one-to-one simple correlation of unciphered text and ciphertext and which has the one-to-m complex correlation of unciphered text and ciphertext is adopted, and techniques for securely searching data deposited in a server while preventing information leakage to a server manager are disclosed. 
       SUMMARY OF THE INVENTION 
       [0005]    However, in the technique described in “Practical Techniques for Searches on Encrypted Data”, since the definite encryption system low in security is used for encrypting a search keyword from the client, the technique is vulnerable to unjust attack such as frequency analysis. In the meantime, in the technique disclosed in JP-A No. 2012-123614, both deposited unciphered data and a search keyword are stochastically encrypted and they are secure. However, the reduction of the size of ciphertext is not sufficiently examined. For example, when unciphered text of 128 bits is encrypted using Advanced Encryption Standard (AES) encryption (output length: 128 bits) which is a standard encryption system and Secure HashAlgorithm (SHA) 256 (output length: 256 bits) of 256 bits which is a standard encryption hash function, the size of encrypted data deposited in a server is 384 bits (128 bits+256 bits) or more acquired by summing respective output length of the AES encryption and the SHA256 hash function. That is, data size is three times larger than 128 bits before the encryption. Also, as for the encryption of a search keyword, the reduction of data size is not examined sufficiently. Concretely, when a search keyword is encrypted, ciphertext having the similar length is created. This ciphertext is transmitted/received via a network. Accordingly, when the size of the search keyword is large, a load is applied to the network between a client and a server. 
         [0006]    To settle the problem, in a searchable code processing system, a management server that deposits data, a registration client that deposits the data in the management server and a search client that requests the management server to search the data are linked via a network, the registration client deposits encrypted data acquired by compressing the size of a search tag created for a search in the server while using a stochastic encryption system using a mask by a hash value and an output value of a homomorphic function, the search client transmits a search keyword efficiently compressed and encrypted to the management server while similarly using stochastic encryption for encrypting a keyword for a search, the management server is requested to output data acquired by the search as a search result without making the management server release a mask by random numbers of the encrypted data and the encrypted keyword, the search client detects a wrong search in the search result, and the search client decrypts the search result. 
         [0007]    As the size of the encrypted data deposited in the management server by the client is small, a storage in the management server can be efficiently utilized. As the size of the search keyword encrypted for the search can also be reduced, traffic in the network can be inhibited. Further, even if the management server makes a wrong search, the client can detect an error in the search result. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0008]      FIG. 1  shows an outline of a searchable code processing system; 
           [0009]      FIG. 2  shows an outline of functions of a registration client; 
           [0010]      FIG. 3  shows an outline of functions of a search client; 
           [0011]      FIG. 4  shows an outline of functions of a management server; 
           [0012]      FIG. 5  shows the schematic configuration of a computer; 
           [0013]      FIGS. 6A and 6B  show a method of generating a random number and an encrypting method; 
           [0014]      FIG. 7  is a block diagram showing a procedure for generating secure data in the registration client; 
           [0015]      FIG. 8  is a block diagram showing a procedure for generating a secure keyword in the search client; 
           [0016]      FIG. 9  is a block diagram showing a procedure for searching the secure data in the management server; 
           [0017]      FIG. 10  is a block diagram showing a procedure for detecting the wrong search of the secure data in the search client; 
           [0018]      FIG. 11  is a block diagram showing a procedure for decrypting the secure data in the search client; 
           [0019]      FIG. 12  is a flowchart showing a procedure for registering the secure data in the management server and the registration client; 
           [0020]      FIG. 13  is a flowchart showing a procedure for searching the secure data in the management server and the search client; 
           [0021]      FIG. 14  shows a format of ciphertext; and 
           [0022]      FIG. 15  shows a process for detecting a search error. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
       [0023]    Referring to the drawings, an embodiment of the present invention will be described in detail below. 
         [0024]      FIG. 1  is a schematic drawing showing a searching system in this embodiment. As shown in  FIG. 1 , the searching system is provided with a registration client  100 , a search client  200  and a management server  300 , and a pair of the registration client  100  and the management server  300  and a pair of the search client  200  and the management server  300  are configured so that the pair can mutually transmit/receive information via a network  400 . 
         [0025]    In this case, the registration client  100  in this embodiment functions as a transmitter-receiver for registering data that transmits secure data to the management server  300 , the search client  200  functions as a transmitter-receiver for a search that transmits a secure keyword to the management server  300  and receives a result of a search, and the management server  300  functions as a transmitter-receiver that stores the secure data in a database  341  and searches data in the database  341 . 
         [0026]      FIG. 2  is a schematic diagram showing functions of the registration client  100 . As shown in  FIG. 2 , the registration client  100  is provided with a controller  110 , a storage device  120 , an input device  101 , an output device  102  and a communication device  103 . 
         [0027]    The storage device  120  is provided with a data storage  130 , a key storage  150  and a temporary storage  180 . 
         [0028]    In the data storage  130 , unciphered text which is data to be transmitted to the management server  300  is stored. In this embodiment, unciphered data  131  accepted via the input device  101  and secure data  132  to be registered in the management server  300  are stored. Besides, tag length  135  which means the data length of a part of the secure data  132  is stored. In addition, an initial vector  136  used in generating the secure data  132  is stored. The key storage  150  stores a secret key  151  for a random number and a data encryption key  152  which the registration client  100  should confidentially manage from a viewpoint of security. The temporary storage  180  stores information required for processing in the controller  110 . 
         [0029]    The controller  110  is provided with a whole processor  111 , an encryption unit  112 , a pseudo-random number generator  114 , an irreversible converter  115 , a homomorphic function unit  116  and a basic arithmetic unit  117 . 
         [0030]    The whole processor  111  controls all processing in the registration client  100 . For example, in this embodiment, the whole processor  111  stores information the input of which the whole processor accepts via the input device  101  in the data storage  130  as unciphered data  131 . Besides, in this embodiment, the whole processor  111  instructs the output device  102  to display the unciphered data  131 . 
         [0031]    In addition, in this embodiment, the whole processor  111  reads unciphered data  131  stored in the data storage  130 , respectively inputs it to the encryption unit  112 , the pseudo-random number generator  114 , the irreversible converter  115 , the homomorphic function unit  116  and the basic arithmetic unit  117 , and stores output data in the data storage  130  as secure data  132 . 
         [0032]    Moreover, in this embodiment, the whole processor  111  transmits the secure data  132  to the management server  300  via the communication device  103 . Further, in this embodiment, the whole processor  111  stores secure data  132  received from the management server  300  via the communication device  103  in the temporary storage  180  and instructs the output device  102  to display it. 
         [0033]    The encryption unit  112  outputs data acquired by encrypting input data. For example, in this embodiment, data and the data encryption key  152  are input from the whole processor  111  to the encryption unit and the encryption unit outputs encrypted data. For example, the encryption unit  112  is realized by installing standard encryption algorithm. 
         [0034]    The pseudo-random number generator  114  outputs a pseudo-random number. For example, the pseudo-random number generator  114  outputs a random number based upon a physical phenomenon such as temperature, time and electric energy. In this embodiment, the pseudo-random number generator  114  outputs a pseudo-random number using the secret key  151  for a random number input from the whole processor  111 . Besides, a data value of the secret key  151  for a random number is updated to a new data value and the new data value is stored in the key storage  150  by the whole processor ill again. For example, the pseudo-random number generator  114  is realized by installing a standard pseudo-random number generation algorithm. 
         [0035]    The irreversible converter  115  outputs data acquired by compressing input data. For example, in this embodiment, the irreversible converter converts data input from the whole processor  111  to different data of fixed length (h bits) and outputs it. For example, the irreversible converter  115  that converts input data of arbitrary length to data of 256 bits can be realized by installing an SHA-256 function which is standard cryptographic hash function algorithm. 
         [0036]    The homomorphic function unit  116  outputs a result of the output of a homomorphic function based upon input data as data. However, the homomorphic function means a function that meets the following mathematical expression 1 for a function F, an input variable x and an input variable y. 
         [0000]        F ( x·y )= F ( x )?  F ( y )   (Mathematical expression 1)
 
         [0037]    However, “·” and “?” denote an operation code, and an operation code for addition, “+”, an operation code for multiplication, “*”, an operation code for operating XOR (eXclusive OR) which is exclusive-OR every bit, “xor” and others are assigned. At this time, when the operation code for XOR, “xor” is assigned to “·” and “?” in the mathematical expression 1, the following mathematical expression 2 holds. 
         [0000]        F ( x  xor  y )= F ( x )xor  F ( y )   (Mathematical expression 2)
 
         [0038]    The basic arithmetic unit  117  executes processing related to basic arithmetic operation such as addition, subtraction, comparison operation, AND, OR and XOR. For example, in this embodiment, the basic arithmetic unit  117  outputs XOR operation which is exclusive-OR every bit of two data piece input from the whole processor  111  and a result of the verification of whether an equal sign holds in comparison operation or not as data. 
         [0039]    The abovementioned registration client  100  can be realized by a general computer  500  which is shown in  FIG. 5  (a schematic diagram showing the computer) for example and which is provided with a central processing unit (CPU)  501 , a memory  502 , an external storage  503  such as a hard disk drive (HDD), a reader-writer  507  that reads and writes information from/to a portable storage medium  508  such as a compact disk (CD) and a digital versatile disk (DVD), an input device  506  such as a keyboard and a mouse, an output device  505  such as a display, a communication device  504  such as a network interface card (NIC) for connecting to a communication network and an internal line  509  such as a system bus that connects these devices. 
         [0040]    For example, the storage device  120  can be realized when the CPU  501  utilizes the memory  502  or the external storage  503 , the controller  110  and each unit included in the controller  110  can be realized by loading a predetermined program stored in the external storage  503  into the memory  502  and executing it in the CPU  501 , the input device  101  can be realized when the CPU  501  utilizes the input device  506 , the output device  102  can be realized when the CPU  501  utilizes the output device  505 , and the communication device  103  can be realized when the CPU  501  utilizes the communication device  504 . 
         [0041]    The predetermined program is stored (downloaded) in/into the external storage  503  from the storage medium  508  via the reader-writer  507  or from a network via the communication device  504 , then, is loaded into the memory  502 , and may also be executed by the CPU  501 . Besides, the predetermined program is directly loaded into the memory  502  from the storage medium  508  via the reader-writer  507  or from the network via the communication device  504  and may also be executed by the CPU  501 . 
         [0042]      FIG. 3  is a schematic diagram showing functions of the search client  200 . As shown in  FIG. 3 , the search client  200  is provided with a controller  210 , a storage device  220 , an input device  201 , an output device  202  and a communication device  203 . 
         [0043]    The storage device  220  is provided with a data storage  230 , a key storage  250  and a temporary storage  280 . 
         [0044]    The data storage  230  stores information to specify a transmit sentence which is data to be transmitted to the management server  300  and information to specify data received via the communication device  203 . In this embodiment, information to specify an unciphered text keyword  241  accepted by the search client  200  via the input device  201 , a secure keyword  242  transmitted to the management server  300  and the unciphered text keyword  241  are stored. Besides, information to specify data received from the management server  300  via the communication device  203  is stored as secure data  232  and data acquired by removing security from the secure data  232  is stored in the data storage  230  as unciphered data  231 . In addition, an initial vector  236  used for generating secure data  232  is stored. 
         [0045]    The key storage  250  stores respective information to specify a secret key  251  for a random number (K 2 ), a data encryption key  252  (K 1 ), a data decryption key  253  (K 1 ) and a function value encryption key  254  (K 3 ) which the search client  200  is to respectively confidentially manage from a viewpoint of security. The data decryption key  253  may also be the same as the data encryption key  252  as described above and may also be different from it. 
         [0046]    The temporary storage  280  stores information required in processing in the controller  210 . 
         [0047]    The controller  210  is provided with a whole processor  211 , an encryption unit  212 , a decryption unit  213 , a pseudo-random number generator  214 , an irreversible converter  215 , a homomorphic function unit  216  and a basic arithmetic unit  217 . 
         [0048]    The whole processor  211  controls all processing in the search client  200 . For example, in this embodiment, the whole processor  211  stores information the input of which the whole processor accepts via the input device  201  in the data storage  230  as the unciphered text keyword  241 . 
         [0049]    Besides, in this embodiment, the whole processor  211  instructs the output device  202  to display the unciphered text keyword  241 . 
         [0050]    In addition, in this embodiment, the whole processor  211  reads the unciphered text keyword  241  stored in the data storage  230 , respectively inputs it to the encryption unit  212 , the pseudo-random number generator  214 , the irreversible converter  215 , the homomorphic function unit  216  and the basic arithmetic unit  217 , and stores respectively output data in the data storage  230  as a secure keyword  242 . 
         [0051]    Moreover, in this embodiment, the whole processor  211  transmits the secure keyword  242  to the management server  300  via the communication device  203 . In addition, in this embodiment, the whole processor  211  receives secure data  232  from the management server  300  via the communication device  203 . 
         [0052]    Further, in this embodiment, the whole processor  211  stores the secure data  232  received via the communication device  203  in the data storage  230  as secure data  232 . Furthermore, in this embodiment, the whole processor  211  reads the secure data  232  stored in the data storage  230 , respectively inputs it to the decryption unit  213 , the irreversible converter  215 , the homomorphic function unit  216  and the basic arithmetic unit  217 , and stores respectively output data in the data storage  230  as unciphered data  231 . 
         [0053]    Furthermore, in this embodiment, the whole processor  211  instructs the output device  202  to display the unciphered data  231 . Furthermore, the whole processor  211  stores data received from the management server  300  via the communication device  203  in the temporary storage  280  and instructs the output device  202  to display the data. 
         [0054]    The encryption unit  212  outputs data acquired by encrypting input data. For example, in this embodiment, data and the data encryption key  252  are input to the encryption unit from the whole processor  211  and the encryption unit outputs encrypted data. 
         [0055]    The decryption unit  213  outputs data acquired by decrypting input data. For example, in this embodiment, the encrypted data and a data decryption key  253  are input from the whole processor  211  and the decryption unit decrypts the data. 
         [0056]    The pseudo-random number generator  214  outputs a pseudo-random number. For example, the pseudo-random number generator  214  outputs a random number based upon a physical phenomenon such as temperature, time and electric energy. In this embodiment, the pseudo-random number generator  214  outputs a pseudo-random number using the secret key  251  for a random number input from the whole processor  211 . 
         [0057]    Besides, a data value of the secret key  251  for a random number is updated to a new data value and the new data value is stored in the key storage  250  by the whole processor  211  again. For example, in this embodiment, the pseudo-random number generator outputs a pseudo-random number using the secret key  251  for a random number input from the whole processor  211 . 
         [0058]    The irreversible converter  215  outputs data acquired by irreversibly converting input data. For example, in this embodiment, the irreversible converter converts data input from the whole processor  211  to different data of fixed length (h bits) and outputs it. For example, the irreversible converter  215  that converts input data of arbitrary length to data of 256 bits can be realized by installing SHA-256 which is standard cryptographic hash function algorithm. 
         [0059]    The homomorphic function unit  216  outputs a result of the output of a homomorphic function for input data as data. However, the homomorphic function denotes a case that the mathematical expression 2 holds for the function F, the input variable x and the input variable y. When homomorphism holds with an operation code except XOR operation which is exclusive-OR every bit, this embodiment can also be similarly executed. 
         [0060]    The basic arithmetic unit  217  executes processing related to basic arithmetic operation such as addition, subtraction, comparison operation, AND, OR and XOR. 
         [0061]    The abovementioned search client  200  can be realized by the general computer which is shown in  FIG. 5  (the schematic diagram showing the computer) for example and which is provided with the CPU  501 , the memory  502 , the external storage  503  such as HDD, the reader-writer  507  that reads and writes information from/to the portable storage medium  508  such as CD and DVD, the input device  506  such as a keyboard and a mouse, the output device  505  such as a display, the communication device  504  such as NIC for connecting a communication network and the internal line such as a system bus for connecting these devices. 
         [0062]    For example, the storage device  220  can be realized when the CPU  501  utilizes the memory  502  or the external storage  503 , the controller  210  and each unit included in the controller  210  can be realized by loading a predetermined program stored in the external storage  503  into the memory  502  and executing it in the CPU  501 , the input device  201  can be realized when the CPU  501  utilizes the input device  506 , the output device  202  can be realized when the CPU  501  utilizes the output device  505 , and the communication device  203  can be realized when the CPU  501  utilizes the communication device  504 . 
         [0063]    The predetermined program is stored (downloaded) in/into the external storage  503  from the storage medium  508  via the reader-writer  507  or from the network via the communication device  504 , then, is loaded into the memory  502 , and may also be executed by the CPU  501 . Besides, the predetermined program is directly loaded into the memory  502  from the storage medium  508  via the reader-writer  507  or from the network via the communication device  504  and may also be executed by the CPU  501 . 
         [0064]      FIG. 4  is a schematic diagram showing functions of the management server  300 . As shown in  FIG. 4 , the management server  300  is provided with a controller  310 , a storage device  320 , an input device  301 , an output device  302  and a communication device  303 . 
         [0065]    The storage device  320  is provided with a data storage  330  and a temporary storage  380 . 
         [0066]    The data storage  330  stores information to specify data received via the communication device  303 . In this embodiment, the data storage  330  stores information received from the registration client  100  via the communication device  303  as configuration information of the database  341 . Besides, the data storage  330  stores information to specify a keyword received via the communication device  303 . In this embodiment, the data storage  330  stores information received from the search client  200  via the communication device  303  as a secure keyword  342 . In addition, the data storage stores tag length  335  which means data length of a part of secure data. 
         [0067]    In the temporary storage  380 , information required for processing in the controller  310  is stored. 
         [0068]    The controller  310  is provided with a whole processor  311 , a decryption unit  313 , an irreversible converter  315 , a homomorphic function unit  316  and a basic arithmetic unit  317 . 
         [0069]    The whole processor  311  controls all processing in the management server  300 . For example, in this embodiment, the whole processor  311  receives secure data  132  from the registration client  100  via the communication device  303 . 
         [0070]    In this embodiment, the whole processor  311  stores the secure data  132  received via the communication device  303  as configuration information of the data storage  330  and the database  341 . Besides, in this embodiment, the whole processor  311  receives the secure keyword  342  from the search client  200  via the communication device  303 . In addition, in this embodiment, the whole processor  311  stores the secure keyword  342  received via the communication device  303  in the data storage  330  as a secure keyword  342 . 
         [0071]    Moreover, in this embodiment, the whole processor  311  reads the secure keyword  342  stored in the data storage  330 , respectively inputs it to the irreversible converter  315 , the homomorphic function unit  316  and the basic arithmetic unit  317 , and transmits respective output data to the search client  200  via the communication device  303 . 
         [0072]    Further, the whole processor  311  stores information of data received from the search client  200  or the registration client  100  via the communication device  303  in the temporary storage  380  and instructs the output device  302  to display the information. 
         [0073]    The decryption unit  313  outputs data acquired by decrypting input data. For example, in this embodiment, data having an encrypted function value and a function value decryption key  354  are input to the decryption unit from the whole processor  311  and the decryption unit decrypts the data having the function value. 
         [0074]    The irreversible converter  315  outputs data acquired by irreversibly converting input data. For example, in this embodiment, the irreversible converter converts the data input from the whole processor  311  to different data of fixed length (h bits) and outputs the data. For example, the irreversible converter  315  that converts input data of arbitrary length to data of 256 bits can be realized by installing an SHA-256 function which is standard cryptographic hash function algorithm. 
         [0075]    The homomorphic function unit  316  outputs a result of the output of a homomorphic function for input data as data. However, the homomorphic function denotes a case that the mathematical expression 2 holds for the function F, the input variable x and the input variable y. When homomorphism holds with an operation code except XOR operation which is exclusive-OR every bit, this embodiment can also be similarly executed. 
         [0076]    The basic arithmetic unit  317  executes processing related to basic arithmetic operation such as addition, subtraction, comparison operation, AND, OR and XOR. 
         [0077]    The registration client  100 , the search client  200  and the management server  300  respectively described above can be realized by the general computer which is shown in  FIG. 5  (the schematic diagram showing the computer) for example and which is provided with the CPU  501 , the memory  502 , the external storage  503  such as HDD, the reader-writer  507  that reads and writes information from/to the portable storage medium  508  such as CD and DVD, the input device  506  such as a keyboard and a mouse, the output device  505  such as a display, the communication device  504  such as NIC for connecting to the communication network and the internal line such as a system bus for connecting these devices. 
         [0078]    For example, the storage devices  120 ,  220 ,  320  can be realized when the CPU  501  utilizes the memory  502  or the external storage  503 , the controllers  110 ,  210 ,  310  and each unit included in the controllers  110 ,  210 ,  310  can be realized by loading the predetermined program stored in the external storage  503  into the memory  502  and executing it in the CPU  501 , the input devices  101 ,  201 ,  301  can be realized when the CPU  501  utilizes the input device  506 , the output devices  102 ,  202 ,  302  can be realized when the CPU  501  utilizes the output device  505 , and the communication devices  103 ,  203 ,  303  can be realized when the CPU  501  utilizes the communication device  504 . 
         [0079]    The predetermined program is stored (downloaded) in/into the external storage  503  from the storage medium  508  via the reader-writer  507  or from the network via the communication device  504 , then, is loaded into the memory  502 , and may also be executed by the CPU  501 . Besides, the predetermined program is directly loaded into the memory  502  from the storage medium  508  via the reader-writer  507  or from the network via the communication device  504  and may also be executed by the CPU  501 . 
       &lt;Flow for Registering Secure Data&gt; 
       [0080]      FIG. 12  is a sequence diagram showing a process in which the registration client  100  registers secure data  132  in the management server  300  via the network  400  in this embodiment. A sequence  1  is a step which the registration client  100  executes and a sequence  2  is a step which the management server  300  executes in synchronization with the sequence  1 . 
         [0081]    The registration client  100  stores information input from a user via the input device  101  in the storage device  120  as unciphered data  131  (S 1202 ). The controller  110  of the registration client  100  creates its secure data  132  and stores it in the storage device  120  (S 1203 ). The registration client  100  transmits the secure data  132  to the management server  300  via the network  400  from the communication device  103  (S 1204 ). 
         [0082]    The management server  300  receives the secure data  132  transmitted by the registration client  100  from the communication device  303  via the network  400  (S 1205 ). The controller  310  of the management server  300  stores the received secure data  132  in the storage device  320  as configuration information of the database  341  (S 1206 ). The management server  300  transmits whether the secure data  132  is registered or not to the registration client via the network  400  from the communication device  303  (S 1207 ). 
         [0083]    The registration client  100  receives whether the secure data  132  is registered or not transmitted by the is management server  300  from the communication device  103  via the network  400  (S 1208 ). The registration client  100  instructs the output device  102  to display registration information including whether the secure data is registered or not for the user (S 1209 ). 
         [0084]    The abovementioned procedure is not necessarily required to be all processed. For example, the step S 1203  may also be omitted. 
       &lt;Flow for Searching Secure Data&gt; 
       [0085]      FIG. 13  is a sequence diagram showing a process in which the management server  300  searches the database  341  using a secure keyword  242  transmitted via the network  400  by the search client  200  in this embodiment. A sequence  1  is a step which the search client  200  executes and a sequence  2  is a step which the management server  300  executes in synchronization with the sequence  1 . 
         [0086]    The search client  200  stores information input from the user via the input device  201  in the storage device  220  as an unciphered text keyword  241  (S 1302 ). The controller  210  of the search client  200  creates a secure keyword  242  and stores it in the storage device  220  (S 1303 ). The search client  200  transmits the secure keyword  242  to the management server  300  via the network  400  from the communication device  203  (S 1304 ). 
         [0087]    The management server  300  receives the secure keyword  242  transmitted by the search client  200  from the communication device  303  via the network  400  (S 1305 ). The controller  310  of the management server  300  searches the secure data related to the secure keyword  342  from the database  341  (S 1306 ). The management server  300  transmits a result of the search corresponding to the secure keyword  342  (there are a case that the secure data is included and a case that no secure data is included) to the search client via the network  400  from the communication device  303  (S 1307 ). 
         [0088]    The search client  200  receives the result of the search corresponding to the secure keyword  242  transmitted by the management server  300  from the communication device  203  via the network  400  (S 1308 ). 
         [0089]    When the secure data is included in the result of the search, the controller  210  of the search client  200  detects whether a wrong search is included in the result of the search or not (S 1309 ). The controller removes the secure data judged as the wrong search and data related to it from the result of the search (S 1310 ). 
         [0090]    When the secure data is included in the result of the search, the controller  210  of the search client  200  restores the unciphered data  231  based upon the result of the search corresponding to the secure keyword  242  (S 1311 ). The search client  200  stores the unciphered data  231  extracted via the output device  202  in the storage device  220 . Besides, the search client may also instruct the output device  202  to display the extracted unciphered data  231  (S 1312 ). 
         [0091]    The abovementioned procedure is not necessarily required to be all processed. For example, the steps S 1309  and S 1310  may also be omitted. 
       &lt;Method of Generating Secure Data&gt; 
       [0092]    A procedure for a method of generating secure data  132  in the registration client  100  will be described referring to  FIGS. 6 and 7  below. 
         [0093]    The whole processor  111  of the registration client  100  acquires the secret key  151  for a random number and the data encryption key  152  from the key storage  150 , the initial vector  136  and the tag length  135  from the data storage  130 . The whole processor  111  of the registration client  100  secures a working area required for generating secure data  132  in the temporary storage  180 . 
         [0094]    The whole processor  111  of the registration client  100  acquires unciphered data  131  and divides it into size in which the encryption unit  112  can process. For example, when a common key cryptosystem AES is installed in the encryption unit  112 , the unciphered data M is divided into M 1 , M 2 , - - - , Mn in blocks of 128 bits as shown in  FIG. 6B . 
         [0095]    The whole processor  111  of the registration client  100  inputs the initial vector  136 , the data encryption key  152  and the divided “n” pieces of unciphered data  131  to the encryption unit  112  and acquires output n pieces of intermediate encrypted data C 1 , C 2 , - - - , Cn. In the encryption of the unciphered data  131 , the next intermediate encrypted data is created utilizing the intermediate encrypted data created before. For example, as shown in  FIG. 6B , data acquired by calculating the former exclusive-OR (xor operation) of the intermediate encrypted data and the unciphered data  131  is encrypted and the next intermediate encrypted data is created. Accordingly, contents of the other blocks M 1 , M 2 , - - - , Mn−1 in unciphered text are reflected in the intermediate encrypted data Cn corresponding to the block Mn. 
         [0096]    The whole processor  111  of the registration client  100  inputs the initial vector  136  and the secret key for a random number to the pseudo-random number generator  114  and generates random numbers used for n pieces of intermediate encrypted data. For example, as shown in  FIG. 6A , data in which the initial vector  136  and a constant are connected is input to the pseudo-random number generator (RNG)  114  together with the secret key for a random number K 2  and n random numbers R 1 , R 2 , - - - , Rn per 128 bits are generated. 
         [0097]    The whole processor  111  of the registration client  100  inputs the n“th” random number Rn to the homomorphic function unit  116  and acquires output data as a function value X. For example, as shown in  FIG. 7 , the random number of 128 bits is input to the homomorphic function unit  116  and a function value of 96 bits is acquired. 
         [0098]    The whole processor  111  of the registration client  100  inputs the function value X to the irreversible converter  115  and acquires output data as an irreversible converted value H. For example, when hash function SHA256 is installed in the irreversible converter  115 , the function value of 96 bits is converted to a hash value of 256 bits (an irreversible converted value). For example, as shown in  FIG. 7 , the whole processor  111  extracts the least significant 32 bits of the hash value of 256 bits and acquires a search tag for the secure data Dn+1. As a result, data for a search the data size of which is smaller than the original data is acquired. 
         [0099]      FIG. 14  shows a format of ciphertext generated in the abovementioned processing. The ciphertext is configured by Nonce of 8 bits which is a header, a main body of the ciphertext acquired by encrypting each block that configures its unciphered text by a random number and a search tag which is a hash value of a homomorphic function value of the random number. 
         [0100]    The whole processor  111  of the registration client  100  acquires a bit length recorded in a field of the tag length  135  as the search tag for the secure data Dn+1 from the irreversible converted value H. For example, as shown in  FIG. 7 , the whole processor extracts the least significant 32 bits of the hash value of 256 bits and acquires collating data D′n+1. Bits to be extracted from the irreversible converted value H are not necessarily required to be the least significant bits, and they may also be extracted from the most significant bits. Fixed bits may also be extracted or each bit may also be extracted at random. Besides, the bit length may also be arbitrarily selected. 
         [0101]    The whole processor  111  of the registration client  100  inputs the n pieces of intermediate encrypted data and random numbers to the basic arithmetic unit  117 , the basic arithmetic unit  117  calculates respective exclusive-OR (the XOR operation) as shown in the following mathematical expression 3, and output results D 1 , D 2 , - - - , Dn are acquired as the main body of the ciphertext. 
         [0000]        Di=Ci  xor  Ri ( i= 1, - - - ,  n )   (Mathematical expression 3)
 
         [0102]    The whole processor  111  of the registration client  100  connects the initial vector  136 , the main body of the ciphertext D 1 , D 2 , - - - , Dn and the search tag Dn+1 and stores it in the data storage  130  as secure data  132 . 
         [0103]    The size of the secure data can be reduced by extracting the search tag Dn+1 for secure data from the irreversible converted value H and generating the secure data in the generation of the secure data as described above. For example, when secure data is generated from unciphered text of 128 bits according to  FIG. 7 , 128 bits of the main body of the ciphertext and 32 bits of the secure data are added to the size of the initial vector (shall be tentatively 32 bits) to be approximately 192 bits. 
         [0104]    In the meantime, when the size of the search tag for secure data is reduced, information volume in the search tag is not sufficient and side reaction that the probability of the occurrence of wrong searches in the management server increases also occurs. In this embodiment, means for detecting a wrong search for inhibiting the side reaction will be described referring to  FIG. 10  later. 
         [0105]    The abovementioned procedure for generating the secure data is not necessarily required to be processed in the order described above and may also be executed in a different order. 
       &lt;Method of Generating Secure Keyword&gt; 
       [0106]    A procedure for generating a secure keyword  242  in the search client  200  will be described referring to  FIG. 8  below. 
         [0107]    The whole processor  211  of the search client  200  acquires the secret key  251  for a random number, the data encryption key  252  and the function value encryption key  254  from the key storage  250  and acquires the initial vector  236  from the data storage  230 . The whole processor  211  of the search client  200  secures a working area required for the generation of the secure keyword  242  in the temporary storage  280 . 
         [0108]    The whole processor  211  of the search client  200  acquires an unciphered text keyword  241  and the encryption unit  212  divides it in processible size. For example, as in the encryption of the unciphered data  131  in  FIG. 6B , the unciphered text keyword M is divided into M 1 , M 2 , - - - , Mn per 128 bits. 
         [0109]    The whole processor  211  of the search client  200  inputs the initial vector  236 , the data encryption key  252  and the divided pieces of the unciphered text keyword  241  to the encryption unit  212  and acquires output n intermediate encrypted keywords C 1 , C 2 , - - - , Cn. 
         [0110]    In the encryption of the unciphered text keyword  241 , as in the encryption of the unciphered data  131 , the next intermediate encrypted keyword is created utilizing the previously created intermediate encrypted keyword. For example, as shown in  FIG. 6B , data acquired by the xor operation of the previous intermediate encrypted keyword and the unciphered text keyword  241  is encrypted and the next intermediate encrypted keyword is created. 
         [0111]    The whole processor  211  of the search client  200  inputs the initial vector (W 0 )  236  and the secret key for a random number (K 2 )  251  to the pseudo-random number generator  214  and the pseudo-random number generator generates one random number R′n used for the xor operation of it and the n“th” intermediate encrypted keyword Cn. 
         [0112]    The whole processor  211  of the search client  200  inputs the random number R′n to the homomorphic function unit  216  and acquires output data as a function value X. For example, as shown in  FIG. 8 , the whole processor inputs the random number R′n of 128 bits to the homomorphic function unit  216  and acquires a function value X of 96 bits. 
         [0113]    The whole processor  211  of the search client  200  inputs the function value encryption key (K 3 )  254  and the function value X to the encryption unit  212  and acquires output data as a search tag for a secure keyword Wn+1. For example, as shown in  FIG. 8 , the encryption unit  212  outputs ciphertext of 128 bits based upon the function value X of 96 bits using the data encryption key (K 1 )  252  and the initial vector (W 0 )  236  and the search tag for a secure keyword Wn+1 is acquired. 
         [0114]    The whole processor  211  of the search client  200  inputs the n“th” intermediate encrypted keyword Cn and the random number R′n to the basic arithmetic unit  217 , the basic arithmetic unit  217  calculates their exclusive-OR (XOR operation), and the whole processor acquires an output result Wn as a main body of an encrypted keyword. 
         [0115]    The whole processor  211  of the search client  200  connects the initial vector W 0 , the main body Wn of the encrypted keyword and the search tag for a secure keyword Wn+1 and stores this in the data storage  230  as a secure keyword  242 . 
         [0116]    The whole processor uses data acquired by the exclusive-OR (the XOR operation) of the n“th” intermediate encrypted keyword Cn and the random number R′n for the main body Wn of the encrypted keyword as shown in the following mathematical expression 4. 
         [0000]        Wn=Cn  xor  R′n    (Mathematical expression 4)
 
         [0117]    Data acquired by connecting a search tag for a secure keyword to the search tag for a secure keyword Wn+1 and the main body Wn of the encrypted keyword is used for a secure keyword  242 . 
         [0118]    Even if there are n blocks of the encrypted keyword in the generation of the secure keyword as described above, the secure keyword can be inhibited in size of the ciphertext for two blocks. For example, when a secure keyword is created from unciphered text of 12800 (n=100) bits according to  FIG. 7 , the secure keyword can be reduced to approximately 256 bits (for two groups of 128 bits). 
         [0119]    A procedure for creating the secure keyword is not necessarily required to be processed in order described above and may also be executed in different order. 
       &lt;Method of Searching Secure Data&gt; 
       [0120]    A procedure for a method of searching secure data in the management server  300  will be described referring to  FIG. 9  below. Concretely, a procedure for detecting whether the unciphered data and the unciphered text keyword  241  are the same or not in the management server  300  using the secure data and the secure keyword  342  will be described. 
         [0121]    The whole processor  311  of the management server  300  acquires a function value decryption key  354  from a key storage  350 , the secure keyword  342  and the tag length  335  from the data storage  330  and the secure data stored in the database  341 . The whole processor  311  of the management server  300  secures a working area required for a search for the secure data in the temporary storage  380 . 
         [0122]    The whole processor  311  of the management server  300  acquires a main body of ciphertext in the secure data and extracts the n“th” block of the blocks divided in the size processed by the encryption unit  112 . For example, the secure data D is regarded as a set of blocks divided into D 0 , D 1 , D 2 , - - - , Dn, Dn+1, and the data Dn is extracted. 
         [0123]    The whole processor  311  of the management server  300  acquires the main body of the encrypted keyword in the secure keyword  342 . For example, the secure keyword W is regarded as a set of blocks divided into W 0 , Wn, Wn+1 in 3, and the second data Wn is extracted. 
         [0124]    The whole processor  311  of the management server  300  inputs the main body Dn of the ciphertext and the encrypted keyword Wn to the basic arithmetic unit  317 , the basic arithmetic unit  317  calculates their exclusive-OR (XOR operation), and the whole processor  311  acquires an output result according to a mathematical expression 5. 
         [0000]        Dn  xor  Wn =( Cn  xor  Rn )xor( Cn  xor  R′n )   (Mathematical expression 5)
 
         [0125]    In this case, since a value of intermediate encrypted data and a value of intermediate ciphertext respectively acquired by encrypting them are equal when a value of the unciphered data and a value of the unciphered text keyword are the same, the following mathematical expression 6 can be led.
   (Based upon          (A xor B)=A·B+         A·         B, however, “         ” denotes negation or a complement)   
 
         [0000]        Dn  xor  Wn=Rn  xor  R′n    (Mathematical expression 6)
 
         [0127]    That is, only the information of the random numbers (Rn and R′n) is left in the mathematical expression 6. 
         [0128]    The whole processor  311  of the management server  300  inputs the output result from the basic arithmetic unit  317  to the homomorphic function unit  316  and acquires a function value Y which is an output result of the homomorphic function unit  316 . For example, as shown in  FIG. 9 , the exclusive-OR (XOR) of the n″th″ block Dn of 128 bits in the main body of encrypted data and the main body of the secure keyword of 128 bits is operated, the value is input to the homomorphic function unit  316 , and as shown in the following mathematical expression 7, the function value Y of 96 bits for example is acquired. 
         [0000]        Y=F ( Dn  xor  Wn )   (Mathematical expression 7)
 
         [0000]    When the mathematical expression 6 holds, the following mathematical expression 8 can be led from the mathematical expression 7. 
         [0000]        Y=F ( Rn  xor  R′n )   (Mathematical expression 8)
 
         [0129]    The whole processor  311  of the management server  300  acquires a search tag for a secure keyword in the secure keyword  342 . For example, the secure keyword W is regarded as a set of the blocks divided into W 0 , Wn, Wn+1 in three and the third data Wn+1 is extracted. 
         [0130]    The whole processor  311  of the management server  300  inputs the function value decryption key (K 3 )  354  and the search tag Wn+1 for a secure keyword to the decryption unit  313  and acquires a decrypted function value X. The function value X is expressed in the following mathematical expression 9 using the random number Rn and a homomorphic function F in the mathematical expression 2. 
         [0000]        X=F ( Rn )   (Mathematical expression 9)
 
         [0131]    The whole processor  311  of the management server  300  inputs the function value X and the function value Y to the basic arithmetic unit  317 , the basic arithmetic unit  317  calculates their exclusive-OR (XOR operation), and the whole processor acquires an output function value Z. The following mathematical expression 10 holds for the function value Z.
   (Original data (B) is acquired when the operation of exclusive-OR depending upon different data (A) is applied to the data (B) twice based upon “A xor(A xor B)=A·         (A xor B)+         A·(A xor B)=A·B+         A·B=B”)   
 
         [0000]    
       
         
           
             
               
                 
                   
                     
                       
                         Z 
                         = 
                           
                          
                         
                           X 
                            
                           
                               
                           
                            
                           xor 
                            
                           
                               
                           
                            
                           Y 
                         
                       
                     
                   
                   
                     
                       
                         = 
                           
                          
                         
                           F 
                            
                           
                               
                           
                            
                           
                             ( 
                             Rn 
                             ) 
                           
                            
                           
                               
                           
                            
                           xor 
                            
                           
                               
                           
                            
                           
                             ( 
                             
                               F 
                                
                               
                                   
                               
                                
                               
                                 ( 
                                 
                                   Rn 
                                    
                                   
                                       
                                   
                                    
                                   xor 
                                    
                                   
                                       
                                   
                                    
                                   
                                     R 
                                     ′ 
                                   
                                    
                                   n 
                                 
                                 ) 
                               
                             
                             ) 
                           
                         
                       
                     
                   
                   
                     
                       
                         
                           = 
                             
                            
                           
                             F 
                              
                             
                                 
                             
                              
                             
                               ( 
                               Rn 
                               ) 
                             
                              
                             
                                 
                             
                              
                             xor 
                           
                         
                          
                         
                             
                         
                       
                     
                   
                   
                     
                       
                           
                          
                         
                           ( 
                           
                             F 
                              
                             
                                 
                             
                              
                             
                               ( 
                               Rn 
                               ) 
                             
                              
                             
                                 
                             
                              
                             xor 
                              
                             
                                 
                             
                              
                             F 
                              
                             
                                 
                             
                              
                             
                               ( 
                               
                                 
                                   R 
                                   ′ 
                                 
                                  
                                 n 
                               
                               ) 
                             
                           
                           ) 
                         
                          
                         
                             
                         
                       
                     
                   
                   
                     
                       
                           
                          
                         
                           ( 
                           
                             
                               
                                 
                                   from 
                                    
                                   
                                       
                                   
                                    
                                   mathematical 
                                 
                               
                             
                             
                               
                                 
                                   expression 
                                    
                                   
                                       
                                   
                                    
                                   2 
                                 
                               
                             
                           
                           ) 
                         
                       
                     
                   
                   
                     
                       
                         = 
                           
                          
                         
                           F 
                            
                           
                               
                           
                            
                           
                             ( 
                             
                               
                                 R 
                                 ′ 
                               
                                
                               n 
                             
                             ) 
                           
                         
                       
                     
                   
                 
               
               
                 
                   ( 
                   
                     Mathematical 
                      
                     
                         
                     
                      
                     expression 
                      
                     
                         
                     
                      
                     10 
                   
                   ) 
                 
               
             
           
         
       
     
         [0133]    The whole processor  311  of the management server  300  inputs the function value Z to the irreversible converter  315  and acquires output data as an irreversible converted value H. For example, as shown in  FIG. 9 , when the hash function SHA256 is installed in the irreversible converter  315 , a value of the exclusive-OR of the function value X and the function value Y of respectively 96 bits is converted to a hash value of 256 bits (an irreversible converted value). 
         [0134]    The whole processor  311  of the management server  300  acquires bit length recorded in the tag length  335  from the irreversible converted value H as collating data S. For example, as shown in  FIG. 9 , the whole processor extracts the least significant 32 bits of the hash value of 256 bits and acquires collating data D′n+1. Bits to be extracted from the irreversible converted value H are not limited to the least significant bits, and they may also be the most significant bits. Fixed bits may also be extracted or each bit may also be extracted at random. Besides, bit length may also be arbitrarily selected. 
         [0135]    The whole processor  311  of the management server  300  acquires a search tag for secure data in the secure data. For example, the whole processor extracts data Dn+1 in the secure data D. 
         [0136]    The whole processor  311  of the management server  300  inputs collating data D and the search tag for secure data to the basic arithmetic unit  317 , the basic arithmetic unit  317  compares them, when they are the same, TRUE (=1) is output, and when they are not the same, FALSE (=0) is output. 
         [0137]    Finally, the search tag for the secure data Dn+1 and the collating data D′n+1 are compared. When they are the same, it is judged that a search should be made, and when they are different, it is judged that a search is not required to be made. 
         [0138]    A procedure for searching the secure data is not necessarily required to be executed in the order described above and may also be executed in a different order. 
       &lt;Method of Detecting Wrong Search of Secure Data&gt; 
       [0139]    Depending upon the size of a search tag, an error may be included in a result of a search. For example, since irreversible converted values conflict at the probability of 1/256 in a case that a search tag for secure data is 8 bits when data output by the irreversible converter  115  evenly distributes, it is wrongly judged that values of unciphered data and an unciphered text keyword are the same even if the values of the unciphered data and the unciphered text keyword are different. That is, a wrong search result (values of the unciphered data and the unciphered text keyword are different) is included in addition to correct search results (the values of the unciphered data and the unciphered text keyword are equal). Similarly, when a search tag is changed from 8 bits to 16 bits, the probability of a wrong search is reduced to 1/65536. When the irreversible converted value itself (for example, 256 bits) is utilized for a search tag for secure data, probability that a wrong search occurs is asymptotically approximately zero (0) (not truly zero), although secure data is enlarged and presses the storage of the management server. Then, a procedure for detecting a wrong search in the search client will be described below. 
         [0140]    The procedure for processing wrong detection of secure data  232  in the search client  200  will be described referring to  FIG. 10  below. Concretely, the procedure in which the search client  200  detects whether the unciphered data and the unciphered text keyword  241  are the same or not using the secure data  232  and the secure keyword  242  will be described below. 
         [0141]    The whole processor  211  of the search client  200  acquires the secret key for a random number (K 2 )  251  from the key storage  250 , the initial vector (DO)  236  from the data storage  230  and the intermediate encrypted keywords (C 1  to Cn) from the temporary storage  280 . 
         [0142]    The whole processor  211  of the search client  200  secures a working area required for the wrong detection of the secure data  232  in the temporary storage  280 . 
         [0143]    The whole processor  211  of the search client  200  acquires the initial vector  236  in the secure data  232 . For example, the whole processor regards the secure data D as a set of blocks divided into D 0 , D 1 , D 2 , - - - , Dn, Dn+1 and extracts an initial vector D 0 . 
         [0144]    The whole processor  211  of the search client  200  inputs the initial vector  236  and the secret key for a random number  251  to the pseudo-random number generator  214  and generates a random number used for a main body of ciphertext. For example, as shown in  FIG. 6A , the whole processor inputs data acquired by connecting the initial vector  236  and a constant to the pseudo-random number generator  214  together with the secret key for a random number (K 2 )  251  and generates n random numbers R 1 , R 2 , - - - , Rn per 128 bits. 
         [0145]      FIG. 15  shows an outline of a process for detecting a wrong search below. 
         [0146]    The whole processor  211  of the search client  200  inputs a main body of ciphertext and a random number to the basic arithmetic unit  217 , the basic arithmetic unit  217  calculates their exclusive-OR (XOR operation), and the whole processor acquires output results C′ 1 , C′ 2 , - - - , C′n as intermediate encrypted data. Relation shown in the following mathematical expression 11 is established among C′i, Di and Ri. 
         [0000]        C′i=Di  xor  Ri ( i= 1, - - - ,  n )   (Mathematical expression 11)
 
         [0147]    When values of the unciphered data and the unciphered text keyword are equal, values of their intermediate ciphertext and intermediate encrypted keyword are equal. 
         [0148]    Then, since Di=Ci xor Ri and C′i=Di xor Ri=(Ci xor Ri)xor Ri=Ci from the mathematical expressions 3 and 11, the values of the unciphered data and the unciphered text keyword can be regarded as equal if C′i=Ci. The search client  200  verifies this. 
         [0149]    The whole processor  211  of the search client  200  inputs the intermediate encrypted data and the intermediate encrypted keyword to the basic arithmetic unit  217  and the basic arithmetic unit  217  determines whether they are equal or not. The basic arithmetic unit  217  outputs TRUE (=1) if they are the same (C′i=Ci) and outputs FALSE (=0) if they are different. The whole processor judges that a wrong search occurs when the whole processor receives FALSE. 
         [0150]    The abovementioned procedure for detecting the wrong search is not necessarily required to be executed in the order described above and may also be executed in a different order. 
         [0151]    As described above, in the search in this embodiment, it is determined depending upon whether the search tags generated based upon random numbers used for encryption are coincident or not whether unciphered text and ciphertext corresponding to the unciphered text are coincident or not. The random numbers used when the unciphered text is encrypted and intermediate cipher is generated are a quantity that characterizes the coincidence of the unciphered text in the search executed in an encrypted state in this embodiment. That is, the search tag generated based upon the random number does not directly reflect the unciphered text, although the search tag is a quantity corresponding to the unciphered text. 
         [0152]    Besides, as described above, in the search using the search tag in this embodiment, a primary search is executed on the side of the server at the precision of ½ n  (precision (relevance factor of search result)&lt;1) using a search tag of n bits, and a secondary search in which data is decrypted and compared (comparable at intermediate cipher level) is executed on the sides of the clients (finally, precision should be 1). 
       &lt;Method of Decrypting Secure Data&gt; 
       [0153]    A procedure for decrypting secure data  232  in the search client  200  will be described referring to  FIG. 11  below. 
         [0154]    The whole processor  211  of the search client  200  acquires the secret key  251  for a random number and the data decryption key  253  from the key storage  250  and the initial vector  236  from the data storage  230 . The whole processor  211  of the search client  200  secures a working area required for decrypting the secure data  232  in the temporary storage  280 . 
         [0155]    The whole processor  211  of the search client  200  acquires the initial vector  236  in the secure data  232 . For example, the whole processor regards the secure data D as a set of blocks divided into D 0 , D 1 , D 2 , - - - , Dn, Dn+1 and extracts the initial vector D 0 . 
         [0156]    The whole processor  211  of the search client  200  inputs the initial vector  236  and the secret key  251  for a random number to the pseudo-random number generator  214  and generates n random numbers used for a main body of ciphertext. For example, as shown in  FIG. 6A , the whole processor  211  inputs data acquired by connecting the initial vector  236  and a constant to the pseudo-random number generator  214  together with the secret key  251  for a random number and generates n random numbers R 1 , R 2 , - - - , Rn every 128 bits. 
         [0157]    The whole processor  211  of the search client  200  inputs the main body of the ciphertext and the random numbers to the basic arithmetic unit  217 , the basic arithmetic unit  217  calculates their exclusive-OR (XOR operation), and the whole processor acquires output results C′ 1 , C′ 2 , - - - , C′n as intermediate encrypted data. 
         [0158]    The whole processor  211  of the search client  200  inputs the initial vector  236 , the data decryption key  253  and the n pieces of intermediate encrypted data to the decryption unit and acquires output n pieces of unciphered data M 1 , M 2 , - - - , Mn. In the decrypting of the intermediate encrypted data, data acquired by the xor operation of the previous intermediate encrypted data and unciphered data is stored in the data storage  230  as the unciphered data  231  as shown in  FIG. 11  for example. 
         [0159]    The procedure for decrypting the secure data is not necessarily required to be executed in the order described above and may also be executed in a different order.

Technology Category: g