JP3314900B2 - Information delivery method and system using zero knowledge proof protocol - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for providing information requested by a user using a telecommunications system, wherein the information provider authenticates the user by user authentication. In addition to ensuring that the information requested by the user is delivered to the user, and that the information provider will definitely send the requested information in response to an appeal such as not receiving the information requested by the user at a later date. The present invention relates to an information delivery method and system useful for a paid information providing service, a delivery proof service, and the like, for delivering to a user and proving the fact that the user is receiving the information.

[0002]

2. Description of the Related Art Conventionally, typical authentication methods include a user authentication method for checking the validity of a system user, a message authentication method for proving that information is valid, and a combination of these. There is a digital signature system in which an information creator guarantees that created information is valid. Here, the user authentication method, the message authentication method, and the digital signature method will be briefly described with reference to the drawings.

FIG. 1A shows a Fiat Shamir method (A. Fiat and A. Shamir: “How to
prove yourself, practical solutions to identificati
onand signature problems ”, Proc. of Crypto '86,19
86.5 and U.S. Pat. No. 4,748,668).

According to the Fiat Shamir method, secret information s
(Hereinafter referred to as a prover) tries to prove its validity to a verifier, and N (= pq:
p and q are mutually different large prime numbers) and I (= s ² (mod
N)) is the prover's public information, and s, p, and q are the prover's secret information, and authentication is performed as follows.

First, the prover generates a random number R, calculates an initial response sentence X = R ² (mod N), and sends X to the verifier. The verifier that has received the X randomly selects 0 or 1 as the check sentence e, and sends e to the prover. Prover having received the e calculates the response sentence ^{Y = Rs e (mod N)} ,
Send Y to verifier. The verifier receiving the Y verifies whether the verification formula Y ² = X × I ^e (mod N) holds.

[0006] By repeating the above procedure as one round and repeating t rounds, the probability that a third party who does not know the secret information s can clear the verification formula of the verifier is (1/2 ^t ).
Becomes Therefore, when the authentication is completed normally at a sufficiently large t, the verifier may determine that the verification partner (prover) is a valid certifier possessing the secret information s.

This authentication method is generally called an authentication method based on zero-knowledge proof, and the prover informs the verifier only of the fact that the confidential information s is possessed. There is a merit of not leaking at all.

However, the Fiat Shamir method has a problem that the communication history between the prover and the verifier does not prove that the verifier has authenticated the prover at a later date. Therefore, as a solution to this problem, Sakurai (JP-A-5-123)
No. 21) has been proposed. According to this authentication method, evidence that the verifier has truly authenticated the prover remains even after the verifier has authenticated the prover.

[0009] However, what remains as evidence here is only the fact that the verifier has authenticated the prover via communication. Other than this authentication fact, what kind of communication including communication contents is performed. It does not mention anything about that. In addition, since all communication sequences are recorded and stored as evidence of the authentication fact, there is also a disadvantage that the amount of information that the verifier must record and store is large.

Next, FIG. 1B is a conceptual diagram of an authentication method based on an authenticator method which is an example of message authentication. According to this authentication method, a prover who wants to transmit a message M creates an authenticator h _k (M) for the message M using a hash function h having a secret key K _h as a parameter, and together with the message M, Sends the child to the verifier that is the sender. Since the verifier shares the same secret key K _h as the prover in advance, the verifier creates an authenticator from the received message using the secret key K _h in the same manner as described above, and verifies the authenticator against the received authenticator. inspect. If this verification is successful, the validity of the received message is guaranteed. This is if you do not know the secret key K _h, the correct authenticator for any message is because you can not create.

However, both the user authentication and the message authentication described above are basically intended to prevent unauthorized actions by a third party, and are guaranteed by the successful completion of the user authentication. Only that the prover is the owner of the legitimate confidential information, that is, that the third party has not used it improperly, and is guaranteed by the successful verification of the message authentication. All that is required is that no fraudulent acts, such as falsification of messages, have been performed by third parties. Therefore, both of the above two authentication methods are basically effective only against third-party fraudulent activities, and have the disadvantage that they have no effect on fraudulent activities by certifiers or verifiers. is there.

Next, FIG. 1C shows an RSA signature method (RL Rivest, A. Shamir, L. Adlema) which is an example of a digital signature.
n, “A method for obtaining digital signatures and
public-key cryptosystem ”, Comm. ACM, vol.21, N
o.2, 1978.2).

According to the RSA signature method, e and N (= pq:
p and q are large prime numbers different from each other) and the signer's public information, d [e × d (mod (p-1) (q-1)) = 1] and p and q are the signer's secret information as follows. Will be authenticated.

First, the signer makes a signature statement C to ensure that the message M is indeed created by the signer.
= M ^d (mod N) and send C to the verifier. The verifier receiving the C calculates M = C ^e (mod N),
The validity of the obtained message M is determined. At this time, if the obtained message M is determined to be valid, it is assured that the received message M is definitely created by the signer.

This is because a correct signature sentence for an arbitrary message cannot be created without knowing the secret information d. Further, since the secret information d is unique to each individual and differs from one to another, the signer itself is also specified. Because it becomes. Therefore, it is considered that it is difficult for a third party or a verifier to falsify the message content or for a signer to deny the message content, for example.

However, this is effective only after the message exchange ends normally, and before that, that is, whether or not the sentence C transmitted from the signer has surely reached the verifier. Since there is no guarantee, if the verifier claims that the signature C has not been received, the disadvantage is that the signer has no means to counter the claim.

[0017]

When an information provider provides information requested by a user, the following four conditions are required: (1) user authentication for assuring that the user is a valid user; 2) The information provider surely provides the information requested by the user and guarantees that the user has received the provided information. (3) The provided information is legitimate and is falsified. Content lighting that can prevent misconduct such as
(4) It is necessary that the information provider can prove all of (1) to (3) by presenting evidence such as a communication history to the arbitrator as needed.

However, as described in the conventional method, Fiat S
In the hamir method, only (1) is used for Sakurai (Japanese Patent Laid-Open No. Hei 5-12321).
(1) and (4) (only for user authentication), message proof (3) only (for assurance that information is valid), and RSA signature method (3). ) Is only satisfied, so some unfair claims, especially if the user has received but not received the provided information as in (2) On the other hand, there is a disadvantage that the information provider cannot compete at all.

An object of the present invention is to satisfy all of the above four conditions which cannot be satisfied by the conventional method when a necessary message is transmitted from an information provider to a user (including a card, a user terminal, etc.). It is an object of the present invention to provide an information delivery method and system using a zero knowledge proof protocol.

[0020]

According to one aspect of the present invention, in a system including at least an information provider and a user, when the user requests the information provider to deliver information, the information provider A process of performing user authentication of the user according to the zero knowledge proof protocol, transmitting the information M delivered by the information provider to the user in the check sentence E in the zero knowledge proof protocol, and transmitting the information to the user by 1 An information delivery method is provided, wherein a step of delivering in units of bits or a plurality of bits and a step of recording and managing the communication history data H of the zero knowledge proof protocol by an information provider are performed simultaneously.

According to another aspect of the present invention, there is provided a system including at least a user terminal and an information provider terminal, wherein the user terminal controls communication with the information provider terminal. Communication control means, and user secret information storage means for storing secret information to be kept secret by the user;
Random number generating means for generating a random number, and a user computing means for generating an initial response sentence and a response sentence communicated via the user communication control means based on the secret information and the random number,
An information provider terminal, an information provider communication control means for controlling communication with the user terminal, an information database for storing information to be provided to the user via the information provider communication control means, There is provided an information delivery system comprising verification means for performing user authentication via the information provider communication control means.

According to another aspect of the present invention, there is provided a system including at least a user terminal and an information provider terminal, wherein the user terminal controls communication with the information provider terminal. Communication control means, and user secret information storage means for storing secret information to be kept secret by the user;
User common key encryption means for performing cryptographic communication with the information provider terminal via the user communication control means, random number generation means for generating a random number, and transmitted via the user communication control means An information provider terminal comprising: a user operation unit for generating an initial response sentence, a response sentence, and a secret key; and an information storage unit for storing information delivered from an information provider via the user communication control unit. Comprises: an information provider communication control means for controlling communication with the user terminal; an information database for storing information to be provided to the user via the information provider communication control means; Information provider computing means for generating a sentence, information provider common key encryption means for performing encrypted communication with the user terminal via the information provider communication control means, and information provider communication control means Authentication to authenticate users Information delivery system characterized by a means is provided.

[0023]

According to the present invention, first, the zero-knowledge proof protocol is used as a method of authenticating a user by an information provider. If the user does not use a valid card, it is almost impossible to continue to pass the information provider's verification and is almost completely rejected at the authentication stage.

Second, in the part where the delivery information is delivered from the information provider to the user, the delivery information is included in the check sentence of the zero knowledge proof protocol and the delivery is performed, so that the zero knowledge proof protocol ends normally. If this is the case, the inspection statement, that is, the delivery information, is definitely received and recorded on the card, and appropriate processing is performed. Also, if the verification of the information provider fails in the middle, the subsequent authentication will be terminated and the remaining inspection statements will not be delivered, so the delivery information that the user can know will be the one before the failure. Limited.

Third, by recording and managing the communication history, the information provider can confirm that normal authentication has been performed between the information provider and the user. Has received the delivery information, and the delivery information must be recorded in the storage means of the card. This means that the user can generate a secret key for information encryption by comparing the communication history disclosed by the information provider with the delivery information recorded on the card submitted by the user. Can be determined. In this case, if the user does not submit the card, it is determined that the information encryption private key can be generated.

Therefore, an unauthorized user cannot use the system or exploit all of the delivery information. In addition, the information provider discloses the communication history and submits a card to the user in response to an unjust claim that the user has not received the delivery information even though the authentication has been completed normally. Can be challenged by asking them to do so.

[0027]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 2 is a diagram showing a configuration example of the information delivery system according to the first embodiment of the present invention. In FIG.
1 is a card owned by the user, 11 is secret information storage means for storing secret information unique to the card, 12 is random number generation means used in the zero knowledge proof protocol, and 13 is an operation required for executing the protocol. Computing means for performing
Reference numeral 4 denotes storage means for recording information from an information provider.
All of these means are incorporated on a tamper-resistant device such as an IC and are physically safe.

Reference numeral 2 denotes a fixed user terminal used by the user, 21 is a card insertion unit, 22 is a storage unit for storing information from an information provider, 23 is a use unit that uses information, and 24 is a use unit that uses information. This is communication control means for communicating with an information provider.

Reference numeral 3 denotes an information provider terminal for delivering the delivery information to the user, 31 is an information storage means for storing the delivery information, 32 is an information dividing means for dividing the delivery information and creating a set of check statements, Reference numeral 33 denotes verification means for verifying the zero knowledge proof protocol, 34 denotes history management means for recording and managing a communication history and an authentication record, and 35 denotes communication control means for performing communication with a user terminal.

Next, an information delivery method using the zero-knowledge proof protocol in the system of FIG. 2 will be described based on the processing flowcharts shown in FIGS. 3 and 4 and examples of delivery information. Here, the Fiat Shamir method is used as the zero-knowledge proof protocol, and as a preparatory stage, a reliable center establishes P, Q, N,
I and s are set, N and I are made public as the user's public information, and s is stored in the secret information storage means 11 of the card 1 as the user's secret information and distributed to the user. Here, P and Q are large different prime numbers, and N = PQ
It is. Also, I = s ² (mod N) holds.

For a user who has already stored the message W (m) encrypted with the information encryption secret key W in the storage means 22 of the user terminal 2, the information encryption secret key W is sent to the user. An example in the case of delivery as delivery information will be described.

First, the user inserts his / her card 1 into the card insertion means 21, and then requests the information provider to deliver the information encryption private key W. (S1).

The information provider stores the information encryption secret key W stored in the information storage means 31 in the delivery information 5 shown in FIG.
The information dividing means 32 divides the data by g bits as in 0, and creates a check sentence _ji set composed of g bits (S2). Here, when the number of bits of information for encryption secret key W and L _w, set of inspection statement would be L _w / g pieces created, i is from 1 to g, j is from 1 L _w / Take values up to g.

Next, in the card 1, the random number generating means 12 generates g random numbers R _i (S3), and the calculating means 13 calculates X _i = R _i ² (mod N) for each of them, thereby obtaining X _i. Is transmitted to the information provider via the communication control means 24 (S4).

The information provider that has received Xi via the communication control means 35 transmits the j-th set of check statements eji to the card 1 via the communication control means 35 (S5).

In the card 1, for each bit i of the set of check statements eji received via the communication control means 24, the arithmetic means 13 accumulates Yi = Ri if 0 and accumulates it in the secret information accumulating means 11 if 1. Using the secret information s, Yi = sRi (mod N) is calculated, a set of check statements eji is recorded in the storage means 14, and then Yi is transmitted to the information provider via the communication control means 24 ( S6).

The information provider receives the Xi and Yi received via the communication control means 35 and the check sentence eji
From the set, the verification unit 33 verifies the verification formula Yi 2 = Xi (mod N) if the check bit is 0, and verifies the verification formula Yi if the check bit is 1.
It is verified whether each bit i satisfies 2 = Xi I (mod N) (S7). If the verification fails, the card 1 is regarded as invalid and the subsequent use is stopped (S8). If the verification is successful, the Xi, the Yi, and the check sentence ji are used as the communication history. Records are managed in the history management means 34 (S9). And the above S
Steps 3 and after are performed using Lw /
This processing is repeated until all the sets of g check statements eji have been transmitted (S10).
When the transmission of all the sets of Lw / g check statements eji created in step 2 is completed, it is considered that the delivery of the information encryption private key W has been completed (S11).

In the card 1, the L recorded in the storage means 14
_{All the w} / g sets of check statements _ji are combined, the information encryption secret key W is copied (S12), and then transferred to the use means 23 of the user terminal 2 (S13). The use unit 23 uses the transferred information encryption private key W to store the
2 can be decrypted to obtain the message m (S14).

In the above description, the necessary information is reliably delivered to the user, and the information provider can confirm that the information has been recorded on the user's card. For example, when the message m is paid information such as a copyrighted work, W (m) encrypted with the information encryption secret key W is transmitted to the user in advance, or is recorded on a medium such as a CD-ROM and distributed. After that, the information provider transmits the information encryption secret key W by the above-mentioned delivery method, and collects an information fee such as a copyright royalty fee from a user who has definitely purchased the message m. In this case, the information provider can use the communication history recorded and managed by the history management unit 34. Also, the mail content m is encrypted with the secret key W for information encryption in the e-mail, and W (m) is transmitted to the delivery destination in advance, and the e-mail administrator later sends the information encryption key to the delivery destination. By transmitting the secret key W by the above-described delivery method, the e-mail administrator can use the e-mail for various purposes, such as using it for e-mail delivery certification.

As described above, in the first embodiment, first, the zero-knowledge proof protocol is used as a method of authenticating a user by an information provider. According to the method, if the user does not use a valid card, it is almost impossible to continue to pass the verification of the information provider, and is almost completely rejected in the authentication stage.

Second, in the part where the delivery information is delivered from the information provider to the user, the delivery information is included in the check statement of the zero knowledge proof protocol and the delivery is performed, so that the zero knowledge proof protocol ends normally. If this is the case, the inspection statement, that is, the delivery information, is definitely received and recorded on the card, and appropriate processing is performed. Also, if the verification of the information provider fails in the middle, the subsequent authentication will be terminated and the remaining inspection statements will not be delivered, so the delivery information that the user can know will be the one before the failure. Limited.

[0043] Third communication history (the X _i, wherein Y _i, the test statement e _ji) providing information that a successful authentication has been performed between the information providers and users by recording managing Since the user can confirm the delivery information, the user should receive the delivery information together with the second effect, and the delivery information should be recorded in the storage means 14 of the card. This means that the user can generate the information encryption private key W by comparing the communication history disclosed by the information provider with the delivery information recorded on the card submitted by the user. Can be determined. In this case, if the user does not submit the card, it is determined that the information encryption private key W can be generated.

Therefore, an unauthorized user cannot use the system or exploit all the delivery information illegally. In addition, the information provider discloses the communication history and submits a card to the user in response to an unjust claim that the user has not received the delivery information even though the authentication has been completed normally. Can be challenged by asking them to do so.

As a matter of course, in the above embodiment, there is no need to divide all the delivery information to generate the check sentence _ji. A statement e _ji (j = 1,..., N) and an information delivery method in which the remaining part of the delivery information is transmitted collectively after the zero-knowledge proof protocol based on n sets of check statements e _ji is completed. Conceivable. In this case, by changing the value of n variously, the security level in the zero knowledge proof can be changed and the amount of communication can be reduced. For example, if n is set to half of L _w / g, the communication amount is also almost half.

Also, regarding the method of generating the check sentence e _ji ,
In addition to simply generating the distribution information by dividing it, the distribution information can be generated by adding dummy information or performing encryption. In this case, a function to restore the original delivery information by autonomously removing or decrypting the dummy information from the secret information set in advance in the card or the stored inspection statement _ji is provided. As a result, the delivery information cannot be taken out unless the zero knowledge proof is normally terminated. Therefore, a third party or a user illegally exploits the inspection sentence e _ji ,
After receiving most of the check statements e _ji , deliberately failing the authentication and performing fraudulent acts such as predicting the remaining parts of the check statement e _ji that have not been delivered, and the information provider has decided to deliver It is possible to prevent a third party or user from acquiring the delivery information before the failure is determined or noticed.

In the information delivery method and system according to the first embodiment, all information necessary for the zero-knowledge proof protocol is incorporated in the tamper-resistant device.
Since the actual information delivery is also performed using only the means incorporated in the tamper-resistant device, the information does not leak to the outside, and even the card owner cannot know the information. Therefore, it is possible to prevent fraudulent acts such as falsifying the card itself or rewriting recorded information on the card.

Next, a second embodiment of the present invention will be described.

FIG. 5 is a block diagram showing the configuration of an information delivery system according to a second embodiment of the present invention. Reference numeral 10 denotes a terminal (user terminal) of a user who receives information from the information provider terminal 20. , 100 are communication control means for controlling the communication line 30, 101 is user secret information storage means for storing user secret information, 102 is a temporary memory for temporarily storing information required by the user, 103 Is a random number generating means for the user to generate a random number, 104 is an arithmetic means having a function of performing a necessary operation by the user, and 105 is an encryption means for performing a cryptographic communication by a common key encryption method (for example, DES, FEAL). A common key encryption unit 106 is an information output / use unit that outputs or uses information received by the user.

Reference numeral 20 denotes an information provider terminal (information provider terminal) for providing information, and reference numeral 200 denotes a communication line 30.
Communication control means 201 for controlling the information provider secret information storage means for storing secret information of the information provider 202
Is an information database storing information to be provided, 20
3 is a temporary memory for temporarily storing information required by the information provider, 204 is an arithmetic unit having a function of performing an operation required by the information provider, and 205 is a common key for performing cryptographic communication using a common key encryption method. The encryption means 206 is a verification means for verifying the validity of the communication sequence based on the Fiat Shamir method. Reference numeral 30 denotes a communication line for connecting a user and an information provider by communication.

The operation procedure will be described below with reference to the flowchart of FIG.

First, as a reference stage, a reliable center sets p1, q1, I, and s for each user, among which N1 and I are disclosed as public information of the user, and s is secret information of the user. Is stored in the user secret information storage means 101 and distributed secretly to the user. Here, p1 and q1 are large prime numbers different from each other, and N1 = p1 ×
q1. Also, I = s ² (mod N1) holds.

Further, a system secret key SK is set between each information provider and each user, and registered in the user secret information storage means 101 and the information provider secret information storage means 201. It is needless to say that the system secret key SK is preferably different for each information provider and each user. However, in terms of system design, one or more types of system secret keys are used as a common key for the entire system. May be used by multiple users.

(1) Delivery Confirmation Step The user terminal 10 generates g random numbers R _i (i = 1, 2,..., G) by the random number generation means 103 and
02 (S101), and then, for each random number, the initial response sentence X _i = R
_i ² (mod N1) (i = 1, 2,..., g) is calculated (S
102), and transmits to the information provider terminal 20 via the communication line 30 (S103).

The information provider terminal 20 accumulates the received initial response sentence X _i (i = 1, 2,..., G) in the temporary memory 203 (S104), and thereafter transmits the information M to be delivered to the user terminal 10. From the information database 202 (S1
05), using the system secret key SK stored in the information provider secret information storage unit 201 as a secret key and using the ciphertext C = E _SK (M) encrypted by the common key encryption unit 205 via the communication line 30 To the user terminal 10 (S10
6).

The user terminal 10 stores the received cipher text C in the temporary memory 102 (S 107), and then checks the cipher text C using the hash function h, which is a g-bit information compression function, using the cipher text C in the arithmetic means 104. The sentence e = (e1, e
2,..., Eg) = h (C) (S108). For each bit i of the generated check sentence e, ei is calculated from the random number Ri stored in the temporary memory 102 and the user secret information s stored in the user secret information storage means 101.
= 0, Yi = Ri, ei = 1, Yi = sRi
(Mod N1) is calculated (S109), and the response sentence Yi (i =
, G) are transmitted to the information provider terminal 20 via the communication line 30 (S110).

The information provider terminal 20 receives the response sentence Y
i (i = 1, 2,..., g) are stored in the temporary memory 203 (S111). = (E1, e2, ..., eg) = h
(C) is generated (S112). Based on the public information I of the user and the initial response sentence Xi, the response sentence Yi and the check sentence ei stored in the temporary memory 203 by the verification means 206,
If ei = 0, the verification equation Yi2 = Xi (mod N1) is given by e
If i = 1, it is verified whether or not each of the bits i satisfies the verification formula Yi 2 = Xi × I (mod N1) (S113). If this verification fails, the user is deemed to be illegal and prohibits further use (S114).
A) If successful, it is determined that the delivery of the information M has been completed normally (S114B).

(2) Information Retrieval Step The user terminal 1 uses the ciphertext C stored in the temporary memory 102 as the secret key using the system secret key SK stored in the user secret information storage means 101 as a secret key. And the information M = D _SK (C), and the information M is output from the information output / use means 106 (S115).

The normal completion of the delivery confirmation step using the above information delivery method means that the user authentication by the zero-knowledge proof protocol has been normally performed, and that the check sentence e = (e1, e2, , Eg) are proof that they have been generated correctly. Also, the check sentence e = (e1, e2,...,
eg) is generated from the ciphertext C received by the user terminal 10 using a hash function, which is an information compression function. Therefore, if the correct ciphertext C is not received, the correct check text e =
(E1, e2, ..., eg) cannot be generated.
Therefore, the fact that the user can correctly generate the check sentence e = (e1, e2,..., Eg) is equivalent to the fact that the user has successfully received the cipher text C (and the information M). As is clear from the above description, the information provider can confirm that the information has been delivered to the user accurately and reliably.

In the above description, the encryption / decryption is performed using the common key encryption method, but the public key encryption method may be used. In addition, the explanation was based on the Fiat Shamir method, but this method has been extended to the extended Fiat Shamir method (Ota-Okamoto "Extension of the Fiat-Shamir method to a higher order", IEICE Technical Report ISEC88-13). It can be applied to any zero-knowledge interactive proof protocol that bases its security on the difficulty of factorization or discrete logarithm problem.

Next, a third embodiment of the present invention will be described.

FIG. 7 is a block diagram showing a configuration of an information delivery system according to a third embodiment of the present invention. Reference numeral 10 denotes a user terminal (user terminal) that receives information from an information provider 20. The components are the same as those of the second embodiment shown in FIG. Numeral 20 denotes an information provider terminal (information provider terminal) for providing information. The constituent means from 200 to 206 are the same as in the second embodiment, and 207 divides the information into a plurality of blocks having an arbitrary bit length. An information dividing means 208 for storing information is a communication history file which records and manages a communication history as proof that the information has been delivered to the user at a later date. Reference numeral 30 denotes a communication line as in the second embodiment.
Reference numeral 40 denotes an arbitrator's terminal (arbitrator terminal) that determines the validity of the communication history from a neutral standpoint with respect to the communication history recorded and managed by the information provider in the communication history file 208 at a later date. Arithmetic means having a function of performing various calculations; 402, a temporary memory for temporarily storing information required by the arbitrator; 403, verification means for verifying the validity of a communication history requested to be determined for validity; Is an information dividing means for dividing information into a plurality of blocks having an arbitrary bit length and storing the divided blocks.

Hereinafter, the operation procedure in the delivery confirmation step will be described according to the flowchart of FIG. 8, and the operation procedure in the arbitration will be described according to the flowchart of FIG.
The preparation stage is the same as in the second embodiment described above.

(1) Delivery Confirmation Step The information provider terminal 20 retrieves the information M to be delivered to the user terminal 10 from the information database 202 (S12).
1) The information dividing unit 207 divides the information M into a plurality of blocks having an arbitrary bit length, and
_j (i = 1, 2,..., m) (S12)
2). Here, for the sake of simplicity, it is assumed that the number of divided blocks is m and the bit length of all blocks is constant at g.

The following processing is for the j-th block, and the following processing is sequentially repeated (m times) for each block from the first block to the m-th block.

The user terminal 10 generates g random numbers R _ij (i = 1, 2,..., G) by the random number generating means 103 and then accumulates them in the temporary memory 102 (S123). By means 104, the initial response sentence X _ij = R
_ij ² (mod N1) (i = 1, 2,..., g) is calculated and then stored in the temporary memory 102 (S124). After that, the encrypted initial response sentence CX _ij = E _SK (X _ij ) encrypted by the common key encryption unit 105 using the system secret key SK stored in the user secret information storage unit 101 as a secret key.
(I = 1, 2,..., G) are transmitted to the information provider terminal 20 via the communication line 30 (S125).

The information provider terminal 20 transfers the received encrypted initial response sentence CX _ij (i = 1, 2,..., G) to the system secret key SK stored in the information provider secret information storage means 201. As a key, the common key encrypting means 205 decrypts the initial response sentence X _ij = D _SK (CX _ij ) (i = 1, 2,..., G) and stores it in the temporary memory 203 (S126).
Thereafter, the system secret key SK stored in the information provider secret information storage means 201 as secret key, common information block MB _j stored in the information dividing unit 207 key encryption unit 205 by encrypted ciphertext block CB _j = E
_SK (MB _j ) is transmitted to the user terminal 10 via the communication line 30 (S127).

The user terminal 10 uses the received ciphertext block CB _j as the system secret key SK stored in the user secret information storage unit 101 as a secret key, and the information block MB _j = D by the common key encryption unit 105. _SK (CB _j ), and outputs the information block MB _j from the information output / use means 106 (S128).

Further, at the same time that the information block MBj is output, the initial response sentence Xij (i = 1,
2,..., G) and a check sentence ej = (e1j, e2j,..., Egj) by a one-way random hash function h.
= H (MBj‖X1j‖X2j‖... ‖Xgj) (S1
29) For each bit i of the generated check statement ej, from the random number Rij stored in the temporary memory 102 and the user secret information s stored in the user secret information storage means 101, if eij = 0, then Yji = Rij, and if eij = 1, Yij = sRij (mod N1) is calculated (S130), and a response sentence Yij (i = 1, 2,..., G) is sent to the information provider terminal 20 via the communication line 30. (S131).

The information provider terminal 20 receives the response message Y
ij (i = 1, 2,..., g) are stored in the temporary memory 203 (S132), and thereafter, the initial response sentence Xij (i = 1, 2, 2,
, G) and the information block MBj stored in the information dividing means 207, the one-way random hash function h
The check sentence ej = (e1j, e2j,..., Egj) =
h (MBj‖X1j‖X2j‖... ‖Xgj) is generated and stored in the temporary memory 203 (S133).

Then, based on the public information I of the user and the initial response sentence Xij, the response sentence Yij and the check sentence eij stored in the temporary memory 203 by the verification means 206, if eij = 0, the verification expression Yij2 = Xij (mod N1), if eij = 1, it is verified for each bit i whether or not the verification formula Yij2 = Xij × I (mod N1) is satisfied (S13).
4). If this verification fails, the user deems that the user is invalid and immediately stops executing the protocol (S13).
5) If successful, the above processing is repeated until all blocks are completed (S136). When the verification is successful for all the blocks from the first block to the m-th block, the information M, the check sentence eij, and the response sentence Yij (i = 1, 2,.
g: j = 1, 2,..., m) is recorded and managed in the communication history file 208 as the communication history H (S137).

(2) Mediation If the user later claims that the information M has not been received, the information provider terminal 20 presents the communication history H recorded and managed in the communication history file 208, and It is stored in the temporary memory 402 of the terminal 40 (S141).

The arbitrator terminal 40 uses the information dividing means 404 to convert the information M in the communication history stored in the temporary memory 402 into a plurality of information blocks MB _j (j
= 1, 2, ..., m) and accumulate (S142).

For each block (j-th block), the check means eij in the public information I of the user terminal 10 and the communication history H stored in the temporary memory 402 by the calculating means 401
From the response sentence Yij, if eij = 0, then Yij = Yij2
(Mod N1), if eij = 1, Xij = Yij2 / I (mo
dN1) is calculated for each bit i, and the calculation result Xij (i = 1, 2,..., g) is stored in the temporary memory 402 (S143).

Next, the calculating means 401 is obtained from the information block MBj stored in the information dividing means 404 and the calculation result Xij (i = 1, 2,..., G) stored in the temporary memory 402.
The check sentence ej = by the one-way random hash function h
(E1j, e2j, ..., egj) = h (MBj {X1j}
X2j‖... {Xgj). (S144).

Thereafter, the verification statement ej = (e) in the communication history H stored in the temporary memory 402 by the verification means 403.
1j, e2j,..., Egj) is checked (S145). If all blocks (m blocks from the first block to the m-th block) match (S146), the validity of the communication history H is guaranteed (S147). Otherwise, the communication history H is invalid. (S148).

The fact that the delivery confirmation step has been normally completed using the above information delivery method means that the user authentication by the zero-knowledge proof protocol has been performed normally, and that the check sentence e _ij (i = 1, 2,..., G: j = 1, 2,..., M). Also, check statement e _ij
(I = 1, 2,..., G: j = 1, 2,..., M) is the information block MB _j (j = 1, 2,.
And the initial response sentence X _ij (i = 1, 2,...,
g: j = 1, 2,..., m) and the correct information block MB _j (j = 1, 2,..., m) must be received. If the correct check sentence e _ij (i = 1, 2,..., G: j = 1, 2,
, M) cannot be generated. Therefore, the user can correctly generate the check sentence e _ij (i = 1, 2,..., G: j = 1, 2,..., M) and the user can obtain the information block MB _j (j = 1, 2,. , M) has the same value as that received normally. Therefore, the information provider can confirm that the information has been accurately and reliably delivered to the user.

In the above description, an example in which encryption / decryption is performed using a common key encryption method has been described. However, a public key encryption method may be used. Also, Fiat Shami
This method was explained based on the r method, but this method is an extended Fiat Shamir
Security (such as Ota-Okamoto "Extension of Fiat-Shamir method to higher order", IEICE technical report ISEC88-13) and other difficulties such as difficulty in factorization or discrete logarithm problem. Compatible with all zero-knowledge interactive proof protocols on which grounds are based.

Next, the check sentence e _ij , the response sentence Y _ij , (i =
1, 2,..., G: j = 1, 2,..., M) and the communication history H composed of information M, are related to each other by the verification formula in the zero-knowledge proof protocol and the one-way random hash function. Therefore, it is impossible to forge the communication history H by falsifying part of the communication history H. Therefore, by recording and managing the communication history H, as evidence that the user has reliably received the information M,
It can be presented to a neutral third party, such as a mediator.

Further, since the communication between the information provider terminal and the user terminal is repeated as many times as the number m of the divided blocks of the information M, if the verification of the information provider fails in the middle, Is aborted and the remaining information blocks are not transmitted. That is, since the information blocks that the user can know are limited only to those before the verification fails, the user who fails the verification of the information provider cannot receive the entire information M correctly as a result. Becomes Therefore, when an unauthorized user who does not know the user's secret information s transmits an incorrect response text Y _ij (i = 1, 2,..., G), an unauthorized act that does not transmit the response text itself. The user may illegally obtain the entire information M even though the information provider cannot record and manage the communication history H proving that the information provider has delivered the information M to the user. It is possible not to.

In the above description, the blocks to be divided have the same bit length of g for each block. For example, the first block is 1 bit, the second block is 2 bits, and the third block is 3 bits.
Of course, the bit length size may be changed for each block such as 4 bits.

The above explanation can prove that the information provider has delivered the information M to the user accurately and reliably. For example, when pay information such as a copyrighted work is delivered as the information M, When distributing a key for decrypting the encrypted software as information M after distributing the encrypted software or the like on a CD-ROM or the like for free or for a fee, the information provider uses the above information distribution method to provide By delivering information M to
The communication history H recorded and managed by the information provider can be used in various ways, for example, it can be used as an information fee such as a royalty fee or as proof information when collecting a sales price of software.

Next, a fourth embodiment of the present invention will be described.

FIG. 10 is a block diagram showing the configuration of an information delivery system according to a fourth embodiment of the present invention. Reference numeral 10 denotes a terminal (user terminal) of a user who receives information from the information provider terminal 20. , 100 to 106 have the same configuration as in the second embodiment, 107 is a public key encryption means for performing encrypted communication by a public key encryption method (for example, RSA, ElGamal), and 108 is An information reconstructing unit 109 for reconstructing the original information is an information storage unit for storing information received from the information provider. 20
Is the terminal of the information provider that provides the information (information provider terminal)
200 to 208 have the same configuration as in the third embodiment, 209 is a random number generating means for the information provider to generate random numbers, and 210 is a public key for performing cryptographic communication by a public key encryption method. It is an encryption means. Reference numeral 30 is a communication line as in the second embodiment. 40 represents an arbitrator terminal;
The configuration from 01 to 404 is the same as that of the third embodiment.
Reference numeral 405 denotes a public key encryption unit for performing encryption by a public key encryption method.

Hereinafter, the operation procedure in the delivery confirmation step and the information extraction step will be described according to the flowchart of FIG. 11, and the operation procedure in arbitration will be described according to the flowchart of FIG.

First, as a preparatory stage, a reliable center establishes p1, q1, I, s, p2, q2, P for each user.
U and SU are set, N1, N2, I, and PU are disclosed as user's public information (public key), and s and SU are user's secret information storage means as user's secret information (secret key). It is stored in the server 101 and distributed to users in secret. Here, each set of (p1, q1) and (p2, q2) is a set of mutually different large prime numbers, and N1 = p1
× q1, N2 = p2 × q2. Also, I = s ² (mo
d N1), PU × SU = 1 (mod (p2-1) (q2-1)). Note that p1 = p2 and q1 = q2 may be set.

(1) Delivery Confirmation Step The user terminal 10 uses the random number generation means 103 to generate g × m random numbers R _jk (j = 1, 2,..., G: k = 1, 2 _,.
m) is generated and stored in the temporary memory 102 (S15).
1). The initial response sentence X _jk = R _jk ² (mod N1) (j = 1, 2,...,
g: k = 1, 2,..., m) (S152), and transmits it to the information provider via the communication line 30 (S153).

The information provider terminal 20 stores the received initial response sentence X _jk (j = 1, 2,..., G: k = 1, 2,..., M) in the temporary memory 203 (S154). The random number generation unit 209 randomly generates a random number sentence Z and stores it in the temporary memory 203 (S155).

Next, an initial response sentence Xjk (j = 1, 2,...,
g: k = 1, 2,..., m) and the random number sentence Z
04 using a one-way random hash function h, a g-bit sized information encryption secret key W = (W1, W2,..., W
g) = h (Z‖X11‖X21‖... ‖Xgm) is generated and stored in the temporary memory 203 (S156). Here, in general, the value of g is determined by the common key encrypting means 105 and the common key encrypting means 2.
05 is equal to or longer than the key length of the secret key used in step S05. After that, the information M to be delivered is stored in the information database 202.
(S157), the ciphertext C = Ew by the common key encryption unit 205 using the information encryption secret key W as a secret key.
After encryption to (M), the ciphertext C is transmitted to the user terminal 10 via the communication line 30 (S158).

After receiving / accumulating the ciphertext C in the information accumulating means 109, the user terminal 10 notifies the communication line 3 that the ciphertext C has been received.
0 to the information provider terminal 20 (S15).
9).

The information provider terminal 20 has a temporary memory 203
Secret key Wj (j = 1, 2, 2,
, G) are encrypted by the public key encryption means 210 using the user's public information PU, and the check sentence e = (e1, e2,
.., EL) = (W 1 ‖W 2 ‖... ‖W g) PU (mod N2)
Is generated (S160). Note that L is equal to the bit length of N2.

Next, the check sentence e = (e1, e2,..., EL) is divided into a plurality of blocks by the information dividing means 207 and stored as a check sentence block (S161). Here, for the sake of simplicity, the number of divided blocks is m, and the bit length of all blocks is constant at g.
The divided check statement is converted into a check statement block eBjk (j = 1, 2, 2, 3).
, G: k = 1, 2,..., M). That is, eB
jk = e (j + g (k-1)), for example, eB11 = e1, eBg1
= Eg, eB12 = eg + 1, eBLm = eL.

The following processing is for the k-th block, and the following processing is sequentially repeated (m times) for each block from the first block to the m-th block.

[0094] The information provider terminal 20 is
7, the check statement block eB _jk (j = 1, 2, 2,
, G) are transmitted to the user terminal 10 via the communication line 30 (S162).

The user terminal 10 stores the received check sentence block eBjk (j = 1, 2,..., G) in the temporary memory 102 (S163). Using, temporary memory 1
02 and the user secret information storage means 1
EBjk = 0 from the user secret information s stored in 01
If so, then Yjk = Rjk, if eBjk = 1, then Yjk = sRjk
(Mod N1) is calculated for each bit j (S164), and transmitted as a response sentence Yjk (j = 1, 2,..., G) to the information provider terminal 20 via the communication line 30 (S165).

The information provider terminal 20 receives the response sentence Y
jk (j = 1, 2,..., g) are stored in the temporary memory 203 (S166), and thereafter, the public information I of the user and the initial response text Xjk and the response text stored in the temporary memory 203 by the verification means 206. From Yjk and the check statement ejk, ejk = 0
Then, the verification equation Yjk2 = Xjk (mod N1) is verified for each bit i, and if ejk = 1, the verification equation Yjk2 = Xjk × I (mod N1) is verified for each bit i (S16).
7). If this verification fails, the user deems that the user is illegal and immediately stops executing the protocol (S16).
8) If successful, the above processing is repeated until all blocks are completed (S169). If the verification is successful for all the blocks from the first block to the m-th block, the random number sentence Z, the check sentence ejk, and the response sentence Yjk (j = 1, 2,.
g: k = 1, 2,..., m) is recorded and managed in the communication history file 208 as the communication history H (S170).

(2) Information Retrieval Step In the user terminal 10, the information reconstructing means 108 checks the check sentence block eBjk (j) stored in the temporary memory 102.
= 1, 2,..., G: k = 1, 2,.
i (i = 1, 2,..., L) is reconstructed (S171) and decrypted by the public key encryption means 107 using the user secret information SU stored in the user secret information storage means 101. Information encryption private key W = (W1, W2,..., Wg)
= (E1‖e2‖... ‖EL) SU (mod N2), and then accumulates in the information accumulating means 109 (S172).

Finally, the secret key for information encryption W = (W1, W2,..., Wg) stored in the information storage means 109 is stored in the information storage means 109 by the common key encryption means 105 as a secret key. Decrypt ciphertext C and obtain information M = Dw
(C) can be obtained from the information output / use means 106 (S173).

(3) Mediation If the user later claims that the information M has not been received, the information provider terminal 20 presents the communication history H recorded and managed in the communication history file 208, and It is stored in the temporary memory 402 of the terminal 40 (S181).

The arbitrator's terminal 40 calculates the arithmetic means 40 from the check sentence ejk and the response sentence Yjk in the communication history H stored in the temporary memory 402 for each block (k-th block).
If ejk = 0 in 1, Xjk = Yjk2 (mod N1)
Is calculated for each bit j, and if ejk = 1, Xjk = Yjk2 / I (mod N1) is calculated for each bit j, and the calculation result Xjk (j =
, G) are stored in the temporary memory 402 (S1).
82).

Next, using the calculation result Xjk (j = 1, 2,..., G) stored in the temporary memory 402 and the random number sentence Z, the g-bit size Information encryption private key W = (W1,
W2,..., Wg) = h (Z‖X11‖X21‖ ... ‖Xgm)
(J = 1, 2,..., G) are generated (S183), and are encrypted by the public key encrypting means 405 using the public information PU of the user, and the check statement e = (e1, e2,..., EL) = (W1
{W2}... {Wg) PU (mod N2) is generated (S18).
4).

After that, the check sentence e = (e1, e2,..., EL) is divided into a plurality of blocks by the information dividing means 404, and the check sentence block eBjk (j = 1, 2,.
g: k = 1, 2,..., m) (S185), and finally, for each block (k-th block), the verification unit 403
In step S186, it is checked whether the sentence matches the check sentence ejk (j = 1, 2,..., G) in the communication history H stored in the temporary memory 402. If all the blocks (m blocks from the first block to the m-th block) match (S187), the validity of the communication history H has been proved, and the user has received the information M. It is guaranteed (S188), otherwise the communication history H is invalidated (S189).

When the information delivery method described above is used, the information M itself is first encrypted into the ciphertext C and transmitted to the user. Therefore, when the user receives the ciphertext C, the information M is obtained. Never. Then, when the zero-knowledge proof protocol is normally completed, in addition to the fact that the user authentication by the zero-knowledge proof protocol has been normally performed, a check statement e
_This proves that the user has correctly received _jk (j = 1, 2,..., g: k = 1, 2,..., m).

The check sentence e _jk (j = 1, 2,..., G:
The user decrypts k = 1, 2,..., m) to generate an information encryption secret key W _j (j = 1, 2,..., g), and generates the generated information encryption secret key W _j (j = 1, 2,
, G) to decrypt the ciphertext C to obtain the information M. Therefore, the check statement e _jk (j = 1, 2, 2,
.., G: k = 1, 2,..., M) are equivalent to the fact that the user has correctly received the information M. Therefore, the information provider can confirm that the information has been accurately and reliably delivered to the user.

In the above description, the encryption / decryption is performed by using the public key encryption method. However, the common key encryption method may be used. In addition, the explanation was based on the Fiat Shamir method, but this method has been extended to the extended Fiat Shamir method (Ota-Okamoto, "Extension of the Fiat-Shamir method to higher orders", IEICE Technical Report ISEC88-13). It can be applied to any zero-knowledge interactive proof protocol that bases its security on the difficulty of factorization or discrete logarithm problem.

Next, the check sentence e _jk , the response sentence Y _jk , (j =
1, 2,..., G: k = 1, 2,..., M) and the communication history H composed of the random number sentence Z, are mutually related by the verification formula in the zero knowledge proof protocol and the one-way random hash function. Therefore, it is impossible to forge the communication history H by falsifying part of the communication history H. Therefore, by recording and managing the communication history H, the arbitrator will later provide proof that the user has received the information encryption private key W _j (j = 1, 2,..., G) reliably. Such can be presented to a neutral third party.

Furthermore, the communication between the information provider and the user is repeated as many times as the number m of divided blocks of the information encryption secret key W _j (j = 1, 2,..., G).
If the verification of the information provider fails on the way, the subsequent communication is terminated and the remaining check text is not transmitted. That is, since the check sentence that the user can know is limited only to the one before the verification failed, the user who failed the verification of the information provider can obtain one of the information necessary for decrypting the ciphertext C. Only the copy can be obtained, and as a result, it becomes impossible to generate a correct information encryption private key W _j (j = 1, 2,..., G). Therefore, an unauthorized user who does not know the user's confidential information s can _{send an} unauthorized response sentence Y _jk (j =
1, 2,..., G: k = 1, 2,..., M) as well as fraudulent acts not to transmit the response itself, and the information provider delivered the information M to the user. Inspection sentences e _jk (j = 1, 2,..., G: k = 1) necessary for the user to acquire the information M even though the information provider cannot record and manage the communication history H proving the fact. , 2,…,
m) to prevent the information M from being illegally decrypted / acquired. In the above description, the blocks to be divided are represented by the bit length g for each block.
, For example, the first block is 1 bit, the second block is
Of course, the bit length size may be changed for each block, such as 2 bits for the block and 4 bits for the third block.

The above description can prove that the information provider has delivered the large amount of information M accurately and reliably to the user. For example, the information M can be used as an “on-demand service” such as a copyrighted work. In the case of pay information, when the information provider delivers information M to the user according to the information delivery method described above, and the information provider collects the communication history H recorded and managed by the information provider, and collects information charges such as a copyright fee. It can be used in various ways, for example, it can be used as certification information.

As described above, the second to fourth embodiments of the present invention are described.
In the information delivery method using the zero-knowledge proof protocol of the embodiment, firstly, since the operation of the protocol itself is equivalent to the zero-knowledge proof protocol as user authentication, an illegal user It is almost impossible to pass the information provider's verification. Secondly, if the delivery confirmation step is completed successfully, it is equivalent to that the zero-knowledge proof protocol has been completed normally.
The information provider can determine that the correct user has correctly received the information.

Further, by encrypting the information and transmitting it as a ciphertext, it is possible to prevent eavesdropping on the information by a third party and prevent the third party from obtaining effective information for decrypting the information. Can also.

According to the second embodiment of the present invention, the decryption of the ciphertext can be executed separately from the delivery confirmation step.

According to the second and third embodiments of the present invention,
For example, by generating a check sentence from information (or a user-encryptable cipher text) using a hash function or the like, the size of the check sentence can be reduced, and the communication amount and processing time in the delivery confirmation step can be reduced. .

According to the third embodiment of the present invention, by generating a check sentence using a one-way function, information (or a ciphertext that can be decrypted by a user), a response sentence, and a check sentence Forgery of the communication history consisting of

If the protocol of the information provider fails during the delivery confirmation step due to, for example, use by an unauthorized user, the execution of the protocol is immediately stopped, and the blocks after the failure of the verification are replaced by the user. Therefore, it is possible to prevent the information (or the encrypted text that can be decrypted by the user) from being illegally acquired as a result.

According to the fourth embodiment of the present invention, when transmitting a large amount of information, the information is first encrypted by the information encryption private key generated by the information provider. Since the information is delivered to the user, the user cannot retrieve the information body before the user is authenticated. Second, by performing delivery confirmation as a check sentence only for the information encryption secret key, it is possible to greatly reduce the amount of communication and the processing time for delivery confirmation. Third, if the delivery confirmation step is completed normally, the user can confirm that the inspection sentence has been correctly received, and it is guaranteed that the information encryption private key will be obtained in the information retrieval step. Information can be retrieved without fail. Therefore, when the information delivery method is completed due to these effects, the information provider provides the information to an authorized user in an encrypted state, and then the user decrypts the encrypted information. The information provider can deliver the necessary information to the user and reliably confirm that the user has received the information, so that the information provider can determine that the information has been reliably delivered to the user.

Also, by generating a secret key for information encryption using a one-way function, it is possible to prevent unauthorized generation of a secret key for information encryption which is convenient for the information provider. Similarly, by using a one-way function, it becomes impossible to forge a communication history consisting of a random number sentence, a check sentence, and a response sentence. Capability to provide the user with the information necessary to decrypt the encrypted information after providing the encrypted information to the user, and to prove at a later date that the user has received the information reliably. Can have.

Also, performing the cryptographic communication on the check sentence has the same effect as performing the cryptographic communication on the information encryption private key. This prevents eavesdropping and prevents a third party from obtaining effective information for decrypting the secret key for information encryption.

Further, the decryption processing of the check sentence can be executed separately from the delivery confirmation step.

If the verification of the information provider fails during the delivery confirmation step due to, for example, an unauthorized user, the execution of the protocol is immediately stopped.
Blocks after the failed verification will not be sent to the user. Therefore, the user who fails the verification of the information provider can obtain only a part of the information necessary for decrypting the encrypted information, and as a result, the information itself or the secret key for information encryption can be obtained. Since it is impossible to generate the information, it is possible to prevent the information requested by the unauthorized user from being illegally obtained.

According to the third and fourth embodiments of the present invention,
The communication history that cannot be forged can be recorded and managed as evidence of the actual delivery of information, and can be presented as needed. Furthermore, the amount of information that must be recorded and managed as evidence of the fact that the information provider has delivered the information can be significantly reduced as compared with the method of Sakurai (Japanese Patent Laid-Open No. 5-12321).

When it is necessary to arbitrate whether information is provided between the information provider and the user, the information provider presents the communication history to a neutral arbitration organization such as a court, and the arbitration organization determines By examining the validity of the communication history having the evidential ability, it is possible to determine which of the information provider and the user is valid. In other words, the arbitrator can later confirm that the information provider has transmitted the information (or a ciphertext that can be decrypted by the user) to the user and that the user has received the information without fail. (Or a ciphertext that can be decrypted by the user), it is possible to prevent an unjust assertion that the user has not received information.

Further, according to these embodiments, there is provided a system which enables an information provider to reliably deliver requested information to a user and to confirm that the user has received the information reliably. Become. Further, the zero-knowledge proof protocol as a user authentication method in which the information provider authenticates the user can be used alone as needed.

In addition, a system is provided in which encrypted communication can be performed between the information provider and the user.

According to the fourth embodiment of the present invention, there is provided a system in which information provided by an information provider is stored, and the user can use the information as needed.

Further, the system has a function of generating a secret key for information encryption, and can deliver information using the secret key for information encryption.

According to the third and fourth embodiments of the present invention,
This is a system that can present a communication history having an evidential ability as necessary.

[0127] Further, when a system detects that the user is an unauthorized user, the execution of the protocol is immediately stopped to prevent the information requested by the unauthorized user from being illegally obtained. Become.

Also, a neutral arbitration body such as a court examines the validity of the communication history having evidential ability,
This is a system that can determine which of the information provider and the user is valid.

Next, a fifth embodiment of the present invention will be described.

FIG. 13 is a block diagram showing the configuration of an information delivery system according to the fifth embodiment of the present invention. Reference numeral 10 denotes a user (terminal) that needs to deliver information to an information provider; Is a communication control means for controlling the communication line 30, 101 is a user secret information storage means which is created by the center and stores user secret information, and 105 is a cryptographic communication by a common key encryption method (for example, DES, FEAL). , A public key encryption unit for performing encrypted communication by a public key encryption method (for example, RSA), an information storage unit for storing information delivered from an information provider, and Is a temporary memory for temporarily storing information required by the user, 103 is a random number generating means for the user to generate random numbers, 104 is a calculating means for performing necessary calculations, and 106 is a use means. There is information output / utilization means for outputting or utilizing the requested information.

Reference numeral 20 denotes an information provider (terminal) for providing information; 200, communication control means for controlling the communication line 30; 201, information for storing secret information of the information provider created by the center; Provider secret information storage means, 20
Reference numeral 5 denotes a common key encryption unit for performing encrypted communication by a common key encryption method, 210 denotes a public key encryption unit for performing encryption communication by a public key encryption method, 202 denotes an information database storing information to be provided, 203 Is a temporary memory for temporarily storing information required by the information provider, 209 is a random number generating means for the information provider to generate random numbers, 204 is an arithmetic means for performing necessary calculations, and 206 is based on the Fiat Shamir method. Verification means for verifying the validity of the communication sequence. 3
0 represents a communication line that connects the user and the information provider by communication.

The operation procedure of the information delivery step, delivery confirmation step, and information retrieval step will be described below with reference to the flowchart of FIG.

First, as a reference stage, a reliable center is assigned to each user by p1, q1, I, s, p2, q2, P
U and SU are set, N1, N2, I, and PU are disclosed as user's public information (public key), and s and SU are user's secret information storage means as user's secret information (secret key). It is stored in the server 101 and distributed to users in secret. Here, each set of (p1, q1) and (p2, q2) is a set of mutually different large prime numbers, and N1 = p1
× q1, N2 = p2 × q2. Also, I = s ² (mod
N1), PU × SU = 1 (mod (p2-1) (q2-1)). Note that p1 = p2 and q1 = q2 may be set.

Furthermore, p, q, P for each information provider
C and SC are set, of which N and PC are made public as the information provider's public information (public key), and SC is used as the information provider's secret information (secret key).
01 and secretly distributed to the information provider. Here, p and q are large prime numbers different from each other, and N = pq
It is. Also, PC × SC = 1 (mod (p−1) (q−1)) holds.

(1) Information Delivery Step The information provider generates a g-bit sized information encryption private key W _i (i = 1, 2,..., G) by the random number generation means 209 and stores it in the temporary memory 203. It accumulates (S201). Here, the value of g is generally equal to or longer than the key length of the secret key used in the common key encryption means 105, 205. In addition,
Here, the information encryption secret key W _i (i = 1, 2,...,
Although g) is generated by the random number generation means 209, it may actually be generated using a function or a specific secret key may be used uniquely.

Next, the information M to be delivered to the user is extracted from the information database 202 (S202), and the secret key for information encryption W = (W1, W2,..., Wg) is used as a secret key by the common key encryption means 205. After encrypting the ciphertext C = Ew (M) (S203), the ciphertext C is transmitted to the user via the communication line 30 (and the communication control means 100 and 200) (S204).

The user stores the ciphertext C in the information storage means 109
Then, the information provider is notified of the reception via the communication line 30 (S205).

(2) Delivery Confirmation Step The user uses the random number generation means 103 to generate g random numbers R
_i (i = 1, 2,..., g) are generated and the temporary memory 102
After that, the initial response sentence X _i = R _i ² (mod N
1) (i = 1, 2,..., G) is calculated (S207), and the encrypted initial response text CX _i = X _i ^PC (mod N ) (I =
, G) (S208) and transmitted to the information provider via the communication line 30 (S209).

[0139] Information providers, initial response sentence encryption initial response sentence CX _i received by the public key encryption unit 210 using the secret key SC accumulated in the information provider secret information storage unit 201 X _i = CX _i ^SC (mod N) (i = 1, 2,...,
g), and is stored in the temporary memory 203 (S2).
10).

Next, the secret key for information encryption Wi (i = 1, 2,..., G) stored in the temporary memory 203 is transferred to the secret key delivery statement Vi and the check statement ei (i = 1, 2,. g) is stored in the temporary memory 203 (S211), and the encryption check sentence Ce = (Ce1, Ce2,..., Ce | N2 |) by the public key encryption means 210 using the user's public key PU.
= (E1‖e2‖... ‖Eg) PU (mod N2) is encrypted (S212) and transmitted via the communication line 30 (S2).
13). Here, | N2 | represents the number of bits of N2.

The user can store the user secret information storage means 101
Using the private key SU stored in the public key encryption unit 107
, The encrypted check sentence Cei (i = 1, 2,...,
g) to the check sentence e = (e1, e2,..., eg) = (Ce1
{Ce2}... {Ce | N2 |) SU (mod N2), and then store it in the temporary memory 102 (S214).

Next, the arithmetic unit 104 checks the check sentence ei.
From the random number Ri stored in the temporary memory 102 and the user secret information s stored in the user secret information storage means 101, if ei = 0, Yi = Ri, and if ei = 1, Yi = Ri. sRi (mod N1) is calculated for each bit i (S215), and the response sentence Yi (i = 1, 2, 2) is calculated.
, G) to the information provider via the communication line 30 (S216).

The information provider receives the response text Yi (i =
, G) are stored in the temporary memory 203 (S2
17) After that, the public information I of the user is
From the initial response sentence Xi, the response sentence Yi, and the check sentence ei stored in the temporary memory 203, the verification expression Yi 2 = Xi (mod N1) if ei = 0, and the verification expression Y if ei = 1.
It is verified whether each bit i satisfies i 2 = Xi × I (mod N1) (S218). If the verification fails, the user is considered to be illegal and the subsequent use is prohibited (S219A), otherwise the process ends normally (S219B).

(3) Information Retrieval Step The user can check the check sentence e stored in the temporary memory 102.
_{i (i = 1,2, ...,} g) a secret key delivery statements in the operation unit 104 from V _i and information encrypted secret key W _i (i =
, G) are taken out and stored in the information storage means 109 (S220).

Finally, the secret key W = (W1, W2,..., Wg) for information encryption stored in the information storage means 109 is used as a secret key and stored in the information storage means 109 by the common key encryption means 105. The ciphertext C is decrypted (S221), and the requested information M = Dw (C) is output to the information output / use unit 106.
More can be obtained (S222).

If the above information delivery method is used, the information M is first encrypted into the cipher text C and transmitted to the user, so that the information M is obtained when the user receives the cipher text C. Never. When the zero-knowledge proof protocol ends normally, the user sentence is normally verified by the zero-knowledge proof protocol, and the check sentence e _i
It can be seen that the user has received (i = 1, 2,..., G) normally and is performing appropriate processing.

Further, the user can check the check sentence e _i (i = 1, 2, 2, 3)
.., G) are correctly received, the information encryption private key W
_{i (i = 1,2, ...,} g) to generate, it is possible to acquire information M by decrypting the ciphertext C of information requested by the user, the test statement e _{i (i} = 1,2 ,..., G) are equivalent to the fact that the user has normally received the information requested by the user. Therefore, the information provider can confirm that the requested information has been accurately and reliably delivered to the user.

In the above description, the part which performs encryption / decryption using the public key encryption method is described below.
Of course, a common key encryption method may be used. Although the above description is based on the Fiat Shamir method, the present method is based on the extended Fiat Shamir method (Ota-Okamoto, "Extension of Fiat-Shamir method to higher order", IEICE Technical Report ISE).
The present invention can be applied to any zero-knowledge interactive proof protocol based on security such as C88-13) or other difficulties such as the difficulty of factorization or the discrete logarithm problem.

Next, a sixth embodiment of the present invention will be described.

FIG. 15 is a block diagram showing the configuration of an information delivery system according to the sixth embodiment of the present invention. The system configuration is such that the information provider secret information storage means 201 of the information provider (terminal) 20 is not required. Except for this, the configuration is the same as that of the fifth embodiment.

The operation procedure of the information delivery step, delivery confirmation step, and information retrieval step will be described below with reference to the flowchart of FIG.

First, as a preparatory stage, a reliable center establishes p1, q1, I, s, p2, q2, P for each user.
U and SU are set, N1, N2, I, and PU are disclosed as user's public information (public key), and s and SU are user's secret information storage means as user's secret information (secret key). It is stored in the server 101 and distributed to users in secret. Here, each set of (p1, q1) and (p2, q2) is a set of mutually different large prime numbers, and N1 = p1
× q1, N2 = p2 × q2. Also, I = s ² (mo
d N1), PU × SU = 1 (mod (p2-1) (q2-1)). Note that p1 = p2 and q1 = q2 may be set.

(1) Information distribution step This is the same as the fifth embodiment (S231 to 235). (2) Delivery Confirmation Step The user generates | N2 | random numbers R _i (i = 1, 2,..., | N2 |) by the random number generation means 103 and stores them in the temporary memory 102 (S236). , The initial response sentence X _i = R
_i ² (mod N1) (i = 1, 2,..., | N2 |) is calculated (S237), and transmitted to the information provider via the communication line 30. (S238). Here, | N2 | represents the number of bits of N2.

The information provider sends the received initial response sentence Xi
(I = 1, 2,..., | N2 |) are stored in the temporary memory 203 (S239). Next, the secret key for information encryption Wi stored in the temporary memory 203 is stored in the secret key delivery statement Vi (i =
.., G) are encrypted by the public key encryption means 210 using the user's public key PU, and the check sentence e = (e
, E | N2 |) = (V1２V2 ＝... ‖Vg
) After generating the PU (mod N2), the PU (mod N2) is stored in the temporary memory 203 (S240). Then, check sentence ei (i = 1,
, | N2 |) are transmitted via the communication line 30 (S241).

The user checks the received check sentence ei (i = 1,
, | N2 |) are stored in the temporary memory 102 (S
242) Thereafter, the arithmetic means 104 uses the check sentence ei to determine the random number Ri stored in the temporary memory 102 and the user secret information s stored in the user secret information storage means 101, and if ei = 0, Yi = Ri is defined as Yi if ei = 1.
= SRi (mod N1) is calculated for each bit i (S243), and the response sentence Yi (i = 1, 2,..., G)
To the information provider via the communication line 30 (S
244).

The information provider receives the response sentence Yi (i =
, | N2 |) are stored in the temporary memory 203 (S245), and the verification means 206 examines the public information I of the user and the initial response sentence Xi and the response sentence Yi stored in the temporary memory 203. From the statement ei, it is verified whether each bit i satisfies the verification formula Yi 2 = Xi (mod N1) if ei = 0, and whether the verification formula Yi 2 = Xi × I (mod N1) if ei = 1. (S246). If the verification fails, the user is considered to be illegal and the subsequent use is prohibited (S247A), otherwise the process ends normally (S247B).

(3) Information Retrieval Step The user can check the check text ei stored in the temporary memory 102.
(I = 1, 2,..., | N2 |) by the public key encryption means 107 using the secret key SU stored in the user secret information storage means 101 by the secret key delivery statement V = (V1, V2,. V
g) = (e1‖e2‖... ‖e | N2 |) SU (mod N2), and then decrypted by the arithmetic means 104 (S248), and then the information encrypting secret key Wi (i = 1, 2,. Is taken out and stored in the information storage means 109 (S249).

Finally, the secret key for information encryption W = (W1, W2,..., Wg) stored in the information storage means 109 is stored in the information storage means 109 by the common key encryption means 105 as a secret key. The ciphertext C is decrypted (S250), and the requested information M = Dw (C) is output to the information output / use unit 106.
More can be obtained (S251).

When the above information delivery method is used, the same effects as in the fifth embodiment can be obtained. Although the amount of information that must be stored in a temporary memory or the like is larger than that of the fifth embodiment, the number of times of using the public key encryption method having a low processing speed is only one, so that the processing time is reduced. Shortening can be expected.

In the above description, the common key encryption method may be used for the portion where encryption / decryption is performed using the public key encryption method. Although the above description has been made based on the Fiat Shamir method, this method is based on the extended Fiat Shamir method (Ota-Okamoto, "Extension of Fiat-Shamir method to higher order", IEICE Technical Report ISEC).
It can be applied to all zero-knowledge interactive proof protocols based on security such as difficulty of factorization or discrete logarithm problem such as 88-13).

Next, a seventh embodiment of the present invention will be described.

FIG. 17 is a block diagram showing the configuration of an information delivery system according to the seventh embodiment of the present invention. Reference numeral 10 denotes a user (terminal), which is 100 except that the public key encryption means 107 is not required. The configuration means from to
As in the embodiment, reference numeral 110 denotes an input unit for creating an information delivery request statement. Reference numeral 20 denotes an information provider (terminal),
The components of 200 to 206 and 209 are the same as those of the sixth embodiment except that the public key encryption unit 210 is not required, and 208 is communication at a later date as proof that the information has been delivered to the user. This is a communication history file for recording and managing the history H. Reference numeral 30 denotes a communication line for connecting a user and an information provider by communication. Reference numeral 40 denotes an arbitrator (terminal) that determines the validity of the communication history H from a neutral standpoint with respect to the communication history H recorded and managed by the information provider in the communication history file 208 at a later date. Temporary memory for temporarily storing necessary information, 401 is an operation unit for performing necessary operations, and 403 is a verification unit for verifying the validity of the communication history H requested to be determined.

The operation procedure of the information delivery step, the delivery confirmation step, and the information retrieval step will be described below with reference to the flowchart of FIG. 18, and the operation procedure of the arbitration will be described with reference to the flowchart of FIG.

First, as a preparation stage, a reliable center sets p1, q1, I, and s for each user, among which N1 and I are disclosed as public information of the user, and s is a secret of the user. The information is stored in the user secret information storage unit 101 and distributed to the user in secret. Here, p1 and q1
Represents large prime numbers different from each other, and N1 = p1 × q1. Also, I = s ² (mod N1) holds.

(1) Information Delivery Step The user creates an information delivery request sentence RS from the input means 110 for information desired to be provided to the information provider and stores it in the temporary memory 102 (S261). (S262). Here, the information delivery request statement RS includes, for example, a request date and time, a user identification number, a request information name, a request information code, and the like as shown in FIG. FIG. 20 shows the configuration of the information delivery request statement RS.

Here, the information delivery request statement RS is transmitted from the user to the information provider. However, in practice, the user transmits only the requested information code to the information provider, and the information delivery request statement RS is transmitted to the information provider. The same information delivery request statement RS
May be created.

The information provider randomly generates a random number sentence Z by the random number generation means 209 (S263), and stores the information delivery request sentence RS and the generated random number sentence Z in the temporary memory 203 (S264). Delivery request statement RS and random number statement Z
Then, a g-bit sized information encryption secret key W = (W1, W2,..., Wg) = f1 (RS, Z) is generated by the first one-way random hash function f1 in the arithmetic means 204. It is stored in the temporary memory 203 (S265). Here, the value of g is generally equal to or longer than the key length of the secret key used in the common key encryption means 105, 205. Next, based on the request information code in the information delivery request statement RS,
The information M corresponding to the code is stored in the information database 202.
(S266), and the information encryption secret key W =
(W1, W2,..., Wg) are encrypted as a secret key by the common key encryption unit 205 into the ciphertext C = Ew (M) (S
267) Then, the ciphertext C is transmitted to the user via the communication line 30 (S268).

The user stores the cipher text C in the information storage means 109
After receiving / accumulating the information, the information provider is notified of the reception via the communication line 30 (S269).

(2) Delivery Confirmation Step The user uses the random number generation means 103 to generate g random numbers R
_i (i = 1, 2,..., g) and then the temporary memory 10
2 (S270), and the initial response sentence X _i = R _i ² (mod N1) for each random number by the arithmetic means 104.
(I = 1, 2,..., G) and then the temporary memory 102
(S271), and the initial response sentence X _i (i = 1, 2, 2)
, G) are transmitted to the information provider via the communication line 30 (S272).

The information provider receives the initial response sentence Xi.
After storing (i = 1, 2,..., G) in the temporary memory 203 (S273), the information delivery request sentence RS and the initial response sentence Xi (i = 1, 2,. )
From the above, the secret key K for key encryption having a g-bit size is K = (K1, K2,..., Kg) = f2 (RS, (X1‖) by the second one-way random hash function f2 in the arithmetic means 204.
X2 ‖... ‖Xg)) is generated and stored in the temporary memory 203 (S274). Note that f1 and f2 may be the same function.

Next, the secret key for information encryption Wi and the secret key for key encryption Ki stored in the temporary memory 203 (i = 1,
2,..., G) to calculate the third function f3
Generates a secret key delivery statement Vi (i = 1, 2,..., G) and accumulates it in the temporary memory 203 as a check statement ei (i = 1, 2,..., G) (S275). Check sentence e
i (i = 1, 2,..., g) are transmitted via the communication line 30 (S276). This

[Outside 1] The user checks the received inspection sentence ei (i = 1, 2,..., G)
Is stored in the temporary memory 102 (S277), and the arithmetic means 104 uses the check sentence ei to store the temporary
2 and the user secret information storage means 10
From the user's secret information s stored in 1, if ei = 0, Yi = Ri, and if ei = 1, Yi = sRi (mod N
1) is calculated for each bit i (S27).
8) A response sentence Yi (i = 1, 2,..., G) is transmitted to the information provider via the communication line 30 (S279).

The information provider receives the response sentence Yi (i =
, G) are stored in the temporary memory 203 (S2
80) Then, the public information I of the user is
From the initial response sentence Xi, the response sentence Yi, and the check sentence ei stored in the temporary memory 203, the verification expression Yi 2 = Xi (mod N1) if ei = 0, and the verification expression Y if ei = 1.
It is verified whether each bit i satisfies i 2 = Xi × I (mod N1) (S281). If the verification fails, the user is considered to be illegal and the subsequent use is prohibited (S282). If the verification succeeds, the information delivery request stored in the temporary memory 203 is stored as shown in FIG. Statement RS, random number statement Z, check statement ei, response statement Yi
(I = 1, 2,..., G) is recorded and managed in the communication history file 208 as the communication history H (S283). Note that FIG.
1 shows the configuration of the communication history H.

(3) Information Retrieval Step The user uses the information delivery request statement RS stored in the temporary memory 102 and the initial response statement Xi (i = 1, 2,..., G) The key encryption secret key K = g bits by the one-way random hash function f2
(K1, K2,..., Kg) = f2 (RS, (X1‖X2
... Xg)) is generated and stored in the temporary memory 102 (S284). Next, the secret key delivery sentence Vi is obtained from the check sentence ei (i = 1, 2,..., G) stored in the temporary memory 102.
(I = 1, 2,..., G), and the generated secret key delivery statement Vi and the secret key for key encryption Ki (i = 1, 2,..., G).
And the inverse function f of the third function f3 in the calculating means 104
3 ', the information encryption secret key Wi (i = 1, 2,...,
g) is taken out and stored in the information storage means 109 (S2).
8

[Outside 2] You.

Finally, the common key encrypting means 105 uses the information encrypting secret key W = (W1, W2,..., Wg) stored in the information storing means 109 as a secret key.
The ciphertext C stored in 09 is decrypted (S286), and the requested information M = Dw (C) can be obtained from the information output / use means 106 (S287).

(4) After arbitration, if the user claims that the information requested by the user has not been received or denies the information delivery request itself, the information provider is recorded and managed in the communication history file 208. The communication history H is presented and stored in the arbitrator's temporary memory 402 (S291).

The arbitrator determines from the public information I of the user in the arithmetic means 401 and the inspection sentence ei and the response sentence Yi in the communication history H stored in the temporary memory 402 that if ei = 0, Xi = Yi 2 ( mod N1) is changed to Xi = if ei = 1.
Yi 2 / I (mod N1) is calculated for each bit i and stored in the temporary memory 402 (S292).

Next, the calculation means 4 is calculated from the delivery request statement RS and the random number statement Z in the communication history H stored in the temporary memory 402.
01, a secret key for information encryption W = (W1, W2,..., Wg) =
f1 (RS, Z) is calculated as (S293), and the second one-way random hash function f in the calculating means 401 is calculated from the information delivery request statement RS and the calculation result Xi (i = 1, 2,..., g).
2, the key encryption secret key K = (K1, K2,..., K
g) = f2 (RS, (X 1 ‖X 2 ‖... ‖X g)) are generated and stored in the temporary memory 402 (S29).
4). Then, the calculating means 401 is obtained from the secret key for information encryption Wi and the secret key for key encryption Ki (i = 1, 2,..., G).
The secret key distribution statement Vi (i = 1,
,..., G) are generated (S295), and the check sentence ei (i =
The check text ei (i) in the communication history H stored in the temporary memory 402 by the verification means 403 as 1, 2,.
= 1, 2,..., G) is checked (S
296). If they match, the validity of the communication history H is proved (S297), and it is guaranteed that the user has requested the information delivery and has received the requested information. Otherwise, the communication history H is invalidated (S29).
8).

If the information delivery method described above is used, the information M is first encrypted into the cipher text C and transmitted to the user. Therefore, when the user receives the cipher text C, the information M is obtained. Never. When the zero-knowledge proof protocol ends normally, the user sentence is normally verified by the zero-knowledge proof protocol, and the check sentence e _i
(I = 1, 2,..., G) is proof that the user has received normally.

The check sentence e _i (i = 1, 2,..., G)
Of other information delivery request the user himself has created sentence RS and the initial response sentence _{X i (i = 1,2, ...} , g) because the information encrypted secret key _{W i (i = 1,2, ...} , g), and the user can decrypt the ciphertext C to obtain the requested information M, so that the user normally receives the check sentence e _i (i = 1, 2,..., g). And that the information requested by the user has been received normally has the same value. Therefore, the information provider can confirm that the information has been accurately and reliably delivered to the user.

Although the above description has been made based on the Fiat Shamir method, this method is based on the extended Fiat Shamir method (Ota-
Okamoto, "Extension of Fiat-Shamir method to higher order", IEICE Technical Report ISEC88-13)
It can be applied to any zero-knowledge interactive proof protocol that bases its security on the difficulty of factorization or discrete logarithm problems.

Next, information request statement RS, random number statement Z, check statement e
_i and the communication history H composed of the response sentence Y _i (i = 1, 2,..., g), the mutual relation is obtained by the verification formula in the zero knowledge proof protocol and the first and second one-way random hash functions. Since they are related to each other, it is impossible to forge the communication history H by falsifying a part of the communication history H or the like. Therefore, by recording and managing the communication history H, the information encryption secret key W _i (i = 1, 2, 2) for decrypting the ciphertext C and obtaining the information M requested by the user.
, G) can be presented to a neutral third party, such as a mediator, at a later date as evidence that the user has received it reliably.

In the above description, the user makes a request for information delivery to the information provider, and it can be proved that the information provider has delivered the requested information accurately and reliably to the user. If M is paid information such as copyrighted work,
By transmitting the information M to the user by the information provider according to the information delivery method described above, the communication history H recorded and managed by the information provider can be used as proof information for collecting information charges such as a royalty fee. Various uses are possible.

Next, an eighth embodiment of the present invention will be described.

FIG. 22 is a block diagram showing the configuration of an information delivery system according to the eighth embodiment of the present invention. Reference numeral 10 denotes a user terminal (terminal).
Reference numeral 09 denotes a configuration similar to that of the fifth embodiment. Reference numeral 110 denotes an input unit for creating an information delivery request statement, and reference numeral 108 denotes an information reconstructing unit for reconstructing divided block information into original information. Reference numeral 20 denotes an information provider (terminal).
6, 209, and 210 have the same configuration as in the fifth embodiment. 208 is a communication history file that records and manages a communication history H as proof that the information has been delivered to the user at a later date. Is divided into a plurality of blocks having an arbitrary bit length and stored. Reference numeral 30 denotes a communication line for connecting a user and an information provider by communication. 40
Represents the arbitrator (terminal), and 401 to 403 are the seventh
The configuration is the same as that of the embodiment. Reference numeral 404 denotes an information dividing unit that divides information into a plurality of blocks having an arbitrary bit length and stores the information.

The information delivery step, delivery confirmation step,
The operation procedure of the information extraction step and the operation procedure in arbitration will be described with reference to the flowchart of FIG.

First, as a preparation stage, a reliable center sets p1, q1, I, and s for each user, among which N1 and I are disclosed as public information of the user, and s is a secret of the user. The information is stored in the user secret information storage unit 101 and distributed to the user in secret. Here, p1 and q1
Represents large prime numbers different from each other, and N1 = p1 × q1. Also, I = s ² (mod N1) holds.

Further, p, q, P for each information provider
C and SC are set, of which N and PC are made public as the information provider's public information (public key), and SC is used as the information provider's secret information (secret key).
01 and secretly distributed to the information provider. Here, p and q are large prime numbers different from each other, and N = pq
It is. Also, PC × SC = 1 (mod (p−1) (q−1)) holds.

(1) Information Delivery Step The user creates an information delivery request statement RS from the input unit 110 for information input desired to be provided to the information provider, and stores it in the temporary memory 102 (S301). Using the public key PC of the user, the public key encrypting means 107 encrypts the encrypted information delivery request statement CR = RS ^PC (mod N) (S302), and transmits it to the information provider via the communication line 30 (S303). . Here, the information delivery request statement RS includes, for example, a request date and time, a user identification number, a request information name, a request information code, and the like, as in the seventh embodiment.

Using the secret key SC stored in the information provider secret information storage means 201, the information provider converts the encrypted information delivery request text CR received by the public key encryption means 210 into an information delivery request text RS = CR After being decoded to ^SC (mod N), it is stored in the temporary memory 203 (S304), and a random number sentence Z is randomly generated by the random number generation means 209 and then stored in the temporary memory 203 (S305).

Next, the information encryption secret key W of g-bit size is calculated from the information delivery request statement RS and the random number statement Z by the first one-way random hash function f1 in the arithmetic means 204.
= (W1, W2,..., Wg) = f1 (RS, Z) is generated and stored in the temporary memory 203 (S306). Here, the value of g is generally equal to or longer than the key length of the secret key used in the common key encryption means 105, 205. Then, based on the request information code in the information delivery request statement RS,
The information M corresponding to the code is stored in the information database 202.
(S307), and the information encryption secret key W =
(W1, W2,..., Wg) are encrypted as a secret key by the common key encryption unit 205 into the ciphertext C = Ew (M) (S
308) Then, the ciphertext C is transmitted to the user via the communication line 30 (S309).

The user stores the ciphertext C in the information storage means 109
Then, the information provider is notified of the reception via the communication line 30 (S310).

(2) Delivery Confirmation Step The information provider decides that the information encryption secret key W = (W1, W
,..., Wg) are divided into a plurality of blocks each having an arbitrary bit length and stored as a block secret key for information encryption (S311). Here, for the sake of simplicity, the number of divided blocks is m, the bit length of all blocks is constant at L, and the divided information encryption secret key is an information encryption block secret key WBij (i = 1, 2, ..., L: j =
1, 2,..., M). That is, WBij = W (i + L (j
-1)), for example, WB11 = W1, WBL1 = WL, WB
12 = WL + 1, WBLm = Wg.

The following processing is for the j-th block. In the delivery confirmation step, the following processing is sequentially repeated (m times) for each block from the first block to the m-th block.

First, the user generates L random numbers R _ij (i = 1, 2,..., L) by the random number generating means 103 and then accumulates them in the temporary memory 102 (S312). Initial response sentence X _ij = R _ij ² (mod
N1) (i = 1, 2,..., L) is calculated and then stored in the temporary memory 102 (S313), and the initial response sentence X _ij (i =
, L) are transmitted to the information provider via the communication line 30 (S314).

The information provider receives the initial response sentence Xij
After storing (i = 1, 2,..., L) in the temporary memory 203 (S315), the information delivery request sentence RS and the initial response sentence Xij (i = 1, 2,. )
From the above, the L-bit sized key encryption secret key K = (K1j, K2j,..., KLj) = f2 (RS,
(X1j‖X2j‖... ‖XLj)) and generate the temporary memory 20
No. 3 (S316). Note that f1 and f2 may be the same function.

Next, the information encryption block secret key WBij (i) of the j-th block stored in the information dividing means 207
= 1, 2,..., L) and the key encryption secret key Kij (i = 1, 2,..., L) stored in the temporary memory 203 by the third function f3 in the arithmetic means 204. Delivery statement Vij
(I = 1, 2,..., L), and the check sentence eij (i =
After being stored in the temporary memory 203 as (1, 2,..., L) (317), the check text eij (i = 1, 2,.
L) is transmitted via the communication line 30 (S318).

[Outside 3] The user checks the received check sentence eij (i = 1, 2,..., L)
Is stored in the temporary memory 102 (S319), and the arithmetic means 104 uses the check sentence eij to store the temporary
2 and the user secret information storage means 10
From the secret information s of the user stored in 1, Yij = Rij if eij = 0, and Yij = sRij (mod
N1) is calculated for each bit i (S32)
0), and transmits the response sentence Yij (i = 1, 2,..., L) to the information provider via the communication line 30 (S321).

The information provider receives the response sentence Yij (i =
, L) are stored in the temporary memory 203 (S3
22) Then, the public information I of the user is
From the initial response sentence Xij, response sentence Yij, and check sentence eij stored in the temporary memory 203, the verification expression Yij2 = Xij (mod N1) if eij = 0, and the verification expression Y if eij = 1.
It is verified whether each bit i satisfies ij2 = Xij × I (mod N1) (S323). If the verification fails, the user deems that the user is illegal, and immediately stops the execution of the protocol (S324). If the verification is successful, the above process is repeated until all blocks are completed (S325). If the verification is successful for all the blocks from the first block to the m-th block, the information delivery request sentence RS, the random number sentence Z, the check sentence eij, and the response sentence Yij (i =
, L: i = 1, 2,..., M) are recorded and managed in the communication history file 208 as the communication history H (S32).
6).

(3) Information Retrieval Step The user sends the information delivery request sentence RS and the initial response sentence Xij (i = 1,
2,..., L: j = 1, 2,.
04 using the second one-way random hash function f2 in FIG. 04, an L-bit sized key encryption secret key K = (K11, K
12, KLm) = f2 (RS, (X1j‖X2j‖...)
XLj)) is generated and stored in the temporary memory 102 (S3).
27).

Next, from the check sentence e _ij (i = 1, 2,..., L: j = 1, 2,..., M) stored in the temporary memory 102, the secret key delivery sentence V _ij (i = 1, 2,..., L: j = 1,
, M) (S328), and the generated secret key distribution statement V _ij and key encryption secret key K _ij (i = 1, 2,...,
L: j = 1, 2,..., M) and the block encryption key WB _ij (i = 1, 2,..., L) for information encryption by the inverse function f3 ′ of the third function f3 in the arithmetic means 104. j = 1,2,
.., M) are taken out and stored in the information reconstructing means 108 (S329). Here, for example, V _{ij of} the third function f3 =
f3 (W _ij , K _ij )

[Outside 4] Indicates exclusive OR.

Thereafter, the block secret key for information encryption WB _ij (i = 1,
2,..., L: j = 1, 2,..., M) to reconstruct the information encryption secret key W _i (i = 1, 2,. (S330).

Finally, the common encryption means 105 uses the information encryption private key W = (W1, W2,..., Wg) stored in the information storage
The ciphertext C stored in 09 is decrypted (S331), and the requested information M = Dw (C) can be obtained from the information output / use means 106 (S332). (4) After the arbitration, if the user claims that the information requested by the user has not been received or denies the information delivery request itself, the information provider makes the communication history H recorded and managed in the communication history file 208. Is stored in the temporary memory 402 of the arbitrator (S341).

The arbitrator determines from the check information eij and the response text Yij in the communication history H stored in the temporary memory 402 by the computing means 401 that the public information I and the response text Yij, if eij = 0, Xij = Yij2 (mod N1) is Xij = if eij = 1
Yij2 / I (mod N1) is calculated for each bit i and stored in the temporary memory 402 (S342). Next, from the information delivery request statement RS and the random number statement Z in the communication history H stored in the temporary memory 402, the information encryption secret key W = (W1, W2, ..., Wg) = f1 (R
After generating (S, Z) (S343), the information dividing means 40
4, the information encryption block secret key WBij (i =
1, 2,..., L: j = 1, 2,..., M) and store them (S344).

For each block (j-th block), an operation means 401 is obtained from the information delivery request statement RS stored in the temporary memory 402 and the calculation result Xij (i = 1, 2,..., L).
Using the second one-way random hash function f2, the secret key for key encryption K = (K1j, K2j,..., KLj) =
f2 (RS, (X1j‖X2j‖... ‖XLj) is generated and stored in the temporary memory 402 (S345), and the information encryption block secret key Wij stored in the information dividing means 404 and the temporary memory 402 are stored in the temporary memory 402. The secret key distribution statement Vij (i = 1, 2,...) Is calculated from the accumulated key encryption secret key Kij (i = 1, 2,...
, L) (S346), and the check sentence eij (i = 1,
2,..., L) in the communication history H stored in the temporary memory 402 by the verification unit 403 in the check sentence eij (i =
, L) is checked (S3).
47). If all blocks (m blocks from the first block to the m-th block) match (S34)
8) The validity of the communication history H is proved (S
349) It is guaranteed that the user has requested information delivery and has received the requested information. Otherwise, the communication history H is invalidated (S350).

If the above information delivery method is used, the same effect as that of the seventh embodiment can be obtained. In addition, since the information delivery request message RS is encrypted and communicated between the information provider and the user, the third Even if a person eavesdrops on the communication sequence, the information transmission request statement RS and the key encryption secret key K _ij (i = 1, 2,..., L: j = 1, 2,. )
Can not ask. Also, the information encryption secret key W
_i (i = 1, 2,..., g) is a check sentence e _ij and a key encryption private key K _ij (i = 1, 2,..., L: j = 1, 2,.
And the information encryption secret key W
_{Since i} (i = 1, 2,..., g) is equivalent to the fact that the third party cannot obtain it, it is possible to prevent the third party from decrypting the ciphertext C and illegally acquiring the information M. It becomes possible.

Furthermore, the communication between the information provider and the user is repeated as many times as the number m of divided blocks of the secret key W _i (i = 1, 2,..., G) for encrypting information.
If the verification of the information provider fails on the way, the subsequent communication is terminated and the remaining check text is not transmitted. That is, since the check sentence that the user can know is limited only to the one before the verification failed, the user who failed the verification of the information provider can obtain one of the information necessary for decrypting the ciphertext C. Only the copy can be obtained, and as a result, it becomes impossible to generate a correct information encryption private key W _i (i = 1, 2,..., G).

Therefore, an unauthorized user who does not know the user's secret information s receives an incorrect response text Yij (i = 1, 2,...,
L: j = 1, 2,..., M)
Despite the fact that the information provider cannot record and manage the communication history H that proves the fact that the information provider has delivered the requested information M to the user by performing an illegal act that does not transmit the response statement itself, Check text e _ij ((i = 1, 2,..., L: j = 1, necessary for obtaining the information M requested by
2,..., M) to prevent the information M from being illegally decoded / acquired.

Further, in the above description, the blocks to be divided have the same bit length of L for each block. For example, the first block is 1 bit, the second block is 2 bits, and the third block is 3 bits.
Of course, the bit length size may be changed for each block such as 4 bits.

Finally, of the cipher communication described above, the cipher communication by the public key cryptosystem may be performed by the cipher communication by the common key cryptosystem. Also,
Although the explanation was based on the FiatShamir method, this method is an extended Fia
t-Shamir method (Ota-Okamoto "Extension of Fiat-Shamir method to higher order", IEICE technical report ISEC88-
The present invention can be applied to all zero-knowledge interactive proof protocols based on security such as 13) and other difficulties such as the difficulty of factorization or the discrete logarithm problem.

As described above, the fifth to eighth aspects of the present invention
According to the embodiment, in the information delivery method using the zero knowledge proof protocol, first, in the information delivery step, the information requested by the user is encrypted by the information provider and delivered to the user. At this point, the user cannot retrieve the requested information itself. Second, since the protocol operation itself performed in the delivery confirmation step is equivalent to the zero knowledge proof protocol as user authentication,
As with the zero-knowledge proof protocol, it is almost impossible for an unauthorized user to clear the verification of the information provider.
Third, if the delivery confirmation step is completed successfully, the information provider has the same value as that the zero-knowledge proof protocol has been completed normally.
It can be determined that proper processing is being performed. Fourth, in the information retrieval step, if the user can correctly receive the inspection statement, the user can create a secret key delivery statement and an information encryption secret key. At this point, the user can encrypt the information using the information encryption secret key. The requested information can be decrypted and the requested information can be extracted. Therefore, due to these effects,
When all the steps of the information delivery method are completed, the information provider provides the requested information to the authorized user in an encrypted state, and then the user decrypts the encrypted information. For this reason, it is possible to deliver the necessary information to the user and to surely confirm that the user has received the information. Therefore, the information provider can determine that the information requested by the user has been reliably delivered to the user.

According to the fifth and sixth embodiments of the present invention,
Performing cryptographic communication on the inspection statement has the same effect as performing cryptographic communication on the secret key for information encryption, and even if a third party eavesdrops on the communication path, these secrets will be protected. The key is never known. Further, it is also possible to prevent information that is valid for decrypting the secret key for information encryption from being obtained.

According to the seventh and eighth embodiments of the present invention,
It is possible to prevent a secret key for information encryption convenient for the information provider from being illegally created.

Further, since it is impossible to forge the communication history, the information provider provides the required information to the authorized user in an encrypted state, and then the information is encrypted. The information necessary for decoding the information can be delivered to the user, and the user can have the evidential ability to prove that the user has received the information at a later date.

[0213] Further, it becomes possible to present a communication history having an evidence ability as needed. Further, the amount of information that must be recorded and managed as evidence of the fact that the information provider has delivered the information can be significantly reduced as compared with the method of Sakurai (Japanese Patent Laid-Open No. 5-12321).

When it is necessary to arbitrate whether information is provided between the information provider and the user, a neutral arbitration body such as a court checks the validity of the communication history having an evidential ability. This makes it possible to determine which of the information provider and the user is valid.

According to the eighth embodiment of the present invention, the information delivery request sentence is encrypted and transmitted, thereby preventing a third party from eavesdropping on the information delivery request sentence and utilizing information such as what information is requested. Privacy can be protected.

Further, the secret key for key encryption and the secret key for information encryption are scrambled by secret information of only the information provider and the user. Secret key is not known, and no information is available to decrypt the secret key. Therefore, the information requested by the user cannot be illegally acquired by a third party.

If the verification of the information provider fails in the middle of the delivery confirmation step due to, for example, an unauthorized user, the execution of the protocol is immediately stopped,
Blocks after the failed verification will not be sent to the user. Therefore, the user who fails the verification of the information provider can obtain only a part of the information necessary for decrypting the encrypted information, and as a result, the secret key for key encryption or information encryption. Since it becomes impossible to generate a secret key for use, it is possible to prevent the information requested by an unauthorized user from being illegally obtained.

Further, according to these embodiments, there is provided a system which enables an information provider to reliably deliver requested information to a user and to confirm that the user has received the information reliably. Become. Further, the zero-knowledge proof protocol as a user authentication method in which the information provider authenticates the user can be used alone as needed.

[0219] Further, a system in which a random number statement can be used when generating an information encryption private key is provided.

According to the fifth and eighth embodiments of the present invention,
The system has an information provider secret information storage unit that can store information that the information provider should keep secret.

According to the fifth, sixth, and eighth embodiments of the present invention, there is provided a system in which an information provider and a user can perform encrypted communication by a public key encryption method.

According to the seventh and eighth embodiments of the present invention,
The user terminal is provided with input means for easily creating an information delivery request statement.

Further, the system has a function of generating a secret key for key encryption and a secret key distribution statement, and enables information distribution using the secret key for information encryption and the secret key for key encryption. .

[0224] Further, the present invention provides a system in which a communication history having an evidence ability can be presented as needed.

Also, a neutral arbitration body such as a court checks the validity of a communication history having an evidential ability,
This is a system that can determine which of the information provider and the user is valid.

Further, according to the eighth embodiment of the present invention, when it is detected that there is an unauthorized user, the execution of the protocol is immediately stopped, and the information requested by the unauthorized user is illegally obtained. It is a system that will not be done.

Next, a ninth embodiment of the present invention will be described.

FIG. 26 is a block diagram showing the configuration of an information delivery system according to the ninth embodiment of the present invention. Reference numeral 10 denotes a user (terminal) receiving information delivery, and reference numeral 100 denotes a communication for controlling the communication line 30. Control means 101; user secret information storage means 105 for storing user secret information;
Is a common key encryption means using a common key encryption method (for example, DES, FEAL), 107 is a public key encryption means using a public key encryption method (for example, RSA), and 109 is information delivered from an information provider. Information storage means for storing
102 is a temporary memory for temporarily storing information required by the user, 103 is a random number generating means for the user to generate random numbers, 104 is a calculating means for performing necessary calculations, and 106 is an information output or use. Information output / use means.
Reference numeral 20 denotes an information provider (terminal) that provides information;
0 is communication control means for controlling the communication line 30, 201 is information provider secret information storage means for storing secret information of the information provider, 205 is a common key encryption means using a common key encryption method, and 210 is public information. Public key encryption means using a key encryption method; 202, an information database storing information to be provided; 203, a temporary memory for temporarily storing information required by an information provider; 204, an operation for performing necessary operations Means 206, verification means for verifying the validity of information, 208
Is a communication history file for recording and managing communication history data H as proof that the information has been delivered to the user at a later date, and 209 is a random number generating means for the information provider to generate a random number. Reference numeral 30 denotes a communication line that connects the information provider as a user by communication. Reference numeral 40 denotes an arbitrator (terminal) that determines the validity of the communication history data H from a neutral standpoint with respect to the communication history data H recorded and managed by the information provider in the communication history file 208 at a later date. Temporary memory for temporarily storing necessary information
05 is a public key encryption means using a public key encryption method, 40
Numeral 1 denotes an arithmetic unit for performing necessary arithmetic operations, and numeral 403 denotes a verification unit for verifying the validity of the communication history data H for which the determination of the validity has been requested.

An information delivery step, a delivery confirmation step,
The operation procedure of the information extraction step and the operation procedure in arbitration will be described with reference to the flowchart of FIG.

The alphabetic characters except the random number R, the initial response sentence X, and the response sentence Y represent the entire information, and the subscripted alphabetic characters represent the bit information of the information. For example, the information encryption secret key W represents the entire information encryption secret key having a g-bit length, and the information encryption secret key W _i (i = 1, 2,..., G) Represents the bit information of the i-th bit of the secret key for encryption. The subscripts of the random number R, the initial response sentence X, and the response sentence Y represent one of a plurality of pieces of information of the same type generated. For example, a random number R
_i (i = 1, 2,..., g) represents the i-th random number information among the g random numbers generated.

(0) Preparatory stage A reliable center establishes p1, q1, ID,
S, p2, q2, PU, SU are set, and N1,
Publish N2, ID and PU as public information of the user,
S and SU are stored in the user secret information storage means 101 as user secret information and distributed secretly to the user. Here, each set of (p1, q1) and (p2, q2) is a set of mutually different large prime numbers, and N1 = p1
× q1, N2 = p2 × q2. Also, ID = S
² (mod N1), PU × SU = 1 (mod (p2-1) (q2-1))
Holds. Note that p1 = p2 and q1 = q2 may be set.

Further, p, q, P for each information provider
C and SC are set, of which N and PC are made public as the information provider's public key, and the SC is stored in the information provider secret information storage means 201 as the information provider's secret key, and the information provider is secretly provided. Distribute to Here, p and q are mutually different large prime numbers, and N = pq. PC × SC = 1
(Mod (p-1) (q-1)) holds.

(1) Information Delivery Step The information provider arbitrarily generates a g-bit length information encryption private key W with the random number generation means 209 and stores it in the temporary memory 203 (S361). Here, the value of g is generally equal to or longer than the key length of the secret key used in the common key encryption means 105 and 205. Thereafter, the information M is extracted from the information database 202 (S362), and the ciphertext C is generated by the common key encryption unit 205 using the information encryption secret key W as a secret key.
= E _w (M) (S363), and then transmits the ciphertext C to the user via the communication line 30 (S36).
4).

The user stores the ciphertext C in the information storage means 109
Then, the information provider is notified of the reception via the communication line 30 (S365).

In this case, the communication line 30 is used for transmitting the cipher text C in S364.
-It may be recorded on a physical medium such as a ROM and distributed to the general public without using a communication line. In that case, the operation of S365 is often omitted.

(2) Delivery Confirmation Step The information provider encrypts the information encryption private key W with the information provider's public key PC using the public key encryption means 210 (S3).
66), the encrypted information encryption secret key CW = W ^PC (mo
dN) to the user via the communication line 30 (S3).
67).

The user digitally signs the information encryption private key CW encrypted by the public key encryption means 107 using the user's secret information SU (S368), and the signed information encryption private key. SW = CW ^SU (mod N2) is transmitted to the information provider via the communication line 30 (S36).
9).

The information provider accumulates the signed information encryption private key SW in the temporary memory 203 (S370).
The verification unit 206 verifies whether the signature verification formula CW = SW ^PU (mod N2) is satisfied using the user's public key PU (S371). If this verification fails, the user deems that the user is illegal and immediately stops executing the protocol (S372). If the verification is successful, the arithmetic means 204 divides the information encryption secret key W into a plurality of blocks having an arbitrary bit length to generate an information encryption block secret key WB (S373). Here, for the sake of simplicity, the number of divided blocks is assumed to be b, the bit length of all blocks is fixed to L, and the divided information encryption secret key is used as the information encryption block secret key WB _ij.
(I = 1, 2,..., L: j = 1, 2,..., B).
That is, WB _ij = W _{(i + L (j−1))} , for example, WB _{11
= W 1, W L1 = W} L, so that the _{WB 12 = W L + 1,} WB Lb = W g.

The user generates g random numbers R _ij (i = 1, 2,..., L: j = 1, 2,.
After generating b), it is stored in the temporary memory 102 (S37).
4) For each, the initial response sentence X _ij = R _ij ² (mod N1) (i = 1, 2,..., L: j)
= 1, 2,..., B) are stored in the temporary memory 102 (S375), and the initial response sentence X _ij (i = 1, 2 _,.
L: j = 1, 2,..., B) are transmitted to the information provider via the communication line 30 (S376).

The information provider sets the initial response sentence Xij (i = 1,
2,..., L: j = 1, 2,.
(S377), and a g-bit long secret key K = (K11, K12,..., KLb) = by the one-way random hash function h (·) in the arithmetic means 204.
h (X1j‖X2j‖... ‖XLj) (S378), and a block secret key for information encryption WBij and a secret key for key encryption K
ij (i = 1, 2,..., L: j = 1, 2,..., b) and the check sentence eij (i)
= 1, 2,..., L: j = 1, 2,..., B) and store them in the temporary memory 203 (S379). Here, the function f includes eij = f (W

[Outside 5] Accordingly, the following processing is for the j-th block, and the delivery confirmation step repeats the following processing for each block from the first block to the b-th block sequentially (b times).

The information provider informs the user of the check sentence e _ij (i =
, L) are transmitted via the communication line 30 (S
380).

The user checks the check sentence eij (i = 1, 2,...,
L) is stored in the temporary memory 102 (S381), and then the arithmetic means 104 uses the check sentence eij to determine from the random number Rij and the user secret information S that if eij = 0, then Yji = Rij
If eij = 1, Yij = S × Rij (mod N1) is calculated for each bit i (S382), and the response sentence Y
ij (i = 1, 2,..., L) is transmitted to the information provider via the communication line 30 (S383).

The information provider sends the response sentence Yij (i = 1, 2, 2,
.., L) are stored in the temporary memory 203 (S384).
After that, the verification means 206 derives e from the user's public information ID, the initial response sentence Xij, the response sentence Yij and the check sentence eij.
If ij = 0, the verification equation Yij2 = Xij (mod N1) is calculated as eij
If = 1, it is verified whether or not each of the bits i satisfies the verification formula Yij2 = Xij × ID (mod N1) (S385). If this verification fails, the user is deemed to be invalid and immediately stops executing the protocol (S386), and if successful, returns to S380.
The above processing is repeated until all the blocks are completed (S387). If the verification is successful for all the blocks from the first block to the b-th block, the secret key W for encrypting information, the secret key SW for encrypting signed information, the check sentence eij, and the response sentence Yij (i = 1,2,…,
L: j = 1, 2,..., B) is recorded and managed as communication history data H in the communication history file 208 (S388).

(3) Information Retrieval Step The user is required to enter the initial response sentence Xij (i = 1, 2,..., L: j =
, B), a g-bit long secret key K = (K11, K12,..., KLb) = h (X) by a one-way random hash function h (·) in the arithmetic means 104.
1j {X2j}... {XLj) is generated (S389), and the check statement e is generated.
ij and a key encryption secret key Kij (i = 1, 2,..., L: j =
The function f in the arithmetic means 104 is obtained from
The block secret key for information encryption WBij (i = 1, 2,..., L: j = 1, 2,.
b) is taken out (S390). Here, for example,

[Outside 6] Represents a logical sum. After that, the arithmetic means 104 gives the information encryption block secret key WBij (i = 1, 2,..., L: j = 1,
, B), the information encryption secret key W = (W1,
, Wg) are generated and stored in the information storage unit 109 (S391). Finally, the common encryption unit 105 uses the information encryption secret key W as a secret key to
9 (S392), and decrypts the information M
= Dw (C) can be obtained from the information output / use means 106 (S393).

(4) Mediation If the user later claims that the information has not been received, the information provider presents the communication history data H recorded and managed in the communication history file 208, and the arbitrator's temporary Memory 4
02 (S401).

The arbitrator generates the information encryption secret key CW = W ^PC (mod N) in which the information encryption secret key W is encrypted by the information provider's public key PC in the public encryption means 405 (S402). The verification unit 403 verifies whether the secret key SW for encrypting the signed information satisfies the signature verification formula CW = SW ^PU (mod N2) using the user's public key PU. (S403). If the verification fails, the communication history data H is invalidated (S404).

If the signature verification is successful, the arithmetic means 401 determines from the public information ID of the user and the check sentence eij and the response sentence Yij in the communication history data H that if eij = 0, Xij = Yij2 (mod N1) is changed to Xij if eij = 1.
= Yij2 / ID (mod N1) is calculated for each bit i and stored in the temporary memory 402 (S405).
The information encrypting block secret key WBij (i = 1, 2,..., L:
j = 1, 2,..., b) are generated (S406). next,
From the calculation result Xij (i = 1, 2,..., L), the calculating means 40
G by the one-way random hash function h (•) in 1
Bit-length secret key for key encryption K = (K11, K12,
.., KLb) = h (X1j‖X2j‖... JXLj) (S407), and a block secret key WBij for information encryption and a secret key Kij for key encryption (i = 1, 2,..., L: j). = 1
2,..., B) and the check statement eij (i = 1, 2,..., L: j = 1, 2,.
, B) are generated (S408), and the check sentence eij (i = 1, 2,..., L: j = 1, 2,...) In the communication history data H stored in the temporary memory 402 by the verification means 403. ,
It is checked whether or not b) matches all the bits (S409). If all the bits match, the validity of the communication history data H is proved, and it is guaranteed that the user has received the information M (S41).
0). Otherwise, the communication history data H is invalidated (S411).

When the above information delivery method is used, the information M is first encrypted into the cipher text C and transmitted to the user or distributed by the physical medium. You won't get M. Then, when the protocol ends normally, it can be confirmed that the user has normally received the check sentence e in addition to the fact that the user authentication by the zero knowledge proof protocol has been normally performed. In addition to the check sentence e, an initial response sentence X _ij (i = 1, 2,..., L: j = 1, 2,.
Generates a secret key W for information encryption from the
Can be decoded to obtain the information M, so that the user has successfully received the check sentence e and the user has received the information M normally have the same value. Therefore, the information provider can confirm that the information M has been delivered to the user accurately and reliably.

Since the communication between the information provider and the user is repeatedly performed the same number of times as the number of divided blocks b of the information encryption secret key W, if the verification of the information provider fails in the middle, The communication after that is aborted, and the remaining check statements are not transmitted. That is, since the check sentence that the user can know is limited only to the one before the verification failed, the user who failed the verification of the information provider can obtain one of the information necessary for decrypting the ciphertext C. Only the copy can be obtained, and as a result, it becomes impossible to generate a correct information encryption private key W. Therefore, when an unauthorized user who does not know the user's secret information S sends an incorrect response message, he or she performs an illegal act not to send the response message itself, and the information provider sends the information M to the user. In spite of the fact that the information provider cannot record the communication history data H proving the fact of delivery, the user receives all the check statements e necessary for acquiring the information M and illegally decrypts the information M /
It is possible to prevent it from being acquired. In the above description, the bit length of each divided block is fixed at L. For example, the first block is 1 bit, the second block is 2 bits, and the third block is 4 bits. Of course, you can change the length.

Next, since the signed information encryption private key SW can be created only by the user, the information provider must not illegally modify the information encryption private key W or the signed information encryption private key SW. Can not. Further, the secret key W for information encryption, the initial response sentence X _ij , the check sentence e _ij , and the response sentence Y
_ij (i = 1, 2,..., L: j = 1, 2,..., b), the relationship between the communication sequence and the verification formula in the zero-knowledge proof protocol and the one-way random hash function h (·) Therefore, it is impossible to alter or forge the communication sequence by illegally falsifying some of them. Therefore, as evidence that the user has received the information encryption private key W for the user to obtain the information M by decrypting the ciphertext C by recording and storing the communication history data H Later it can be presented to a neutral third party, such as a mediator.

The above description can prove that the information provider has accurately and reliably delivered the information M to the user. For example, when the information M is paid information such as a copyrighted work,
The information provider transmits the information M to the user according to the information delivery method described above, so that the communication history data H recorded and managed by the information provider is used as proof information when collecting information fees such as a royalty fee. Various uses are possible.

Although the above description has been made based on the Fiat Shamir method, this method is based on the extended Fiat Shamir method (Ota-Okamoto, "Extension of Fiat-Shamir Method to Higher Orders", IEICE technical report. The present invention can be applied to any zero-knowledge interactive proof protocol based on security, such as research report ISEC88-13) and difficulties such as prime factorization difficulty or discrete logarithm problem.

As described above, according to the ninth embodiment of the present invention, in the information delivery method using the zero-knowledge proof protocol, first, in the information delivery step, the information requested by the user is determined by the information provider. Since the encrypted information is delivered to the user, the user cannot retrieve the requested information itself at this time. Second, since the protocol operation itself performed in the delivery confirmation step is equivalent to the zero-knowledge proof protocol as user authentication, an unauthorized user must clear the information provider's verification in the same way as the zero-knowledge proof protocol. Is almost impossible. Third, if the delivery confirmation step is completed successfully, it is equivalent to the successful completion of the zero-knowledge certification protocol. Can be determined to be. Fourth, in the information extracting step, the user can create the information encryption private key if the inspection statement can be received correctly. At this point, the user decrypts the information encrypted by the information encryption private key. , The requested information can be retrieved. Therefore, due to these effects, when all the steps of the information delivery method are completed, the information provider provides the requested information to the authorized user in an encrypted state, and then the user The information provider delivers the information required to decrypt the coded information to the user and ensures that the user has received it, so the information provider can reliably deliver the information requested by the user to the user. It can be determined that it has been done.

In addition, it is possible to prevent an information provider from illegally falsifying a private key for information encryption which is convenient for him / her. Furthermore, since the encrypted information encryption private key cannot be decrypted by anyone other than the information provider, the user does not know the information encryption private key at the time of signing.

Since it is impossible to forge the communication history, the information provider provides the requested information to the authorized user in an encrypted state, and then the The information necessary for decoding the information can be delivered to the user, and the user can have the evidential ability to prove that the user has received the information at a later date.

Further, a communication history having an evidential ability can be presented as needed. Further, the amount of information that must be recorded and managed as evidence of the fact that the information provider has delivered the information can be significantly reduced as compared with the method of Sakurai (Japanese Patent Laid-Open No. 5-12321).

When it is necessary to arbitrate whether or not information is provided between the information provider and the user, a neutral arbitration body such as a court examines the validity of the communication history having an evidential ability. This makes it possible to determine which of the information provider and the user is valid.

If the verification of the information provider fails during the delivery confirmation step due to, for example, an unauthorized user, the execution of the protocol is immediately stopped.
Blocks after the failed verification will not be sent to the user. Therefore, the user who fails the verification of the information provider can obtain only a part of the information necessary for decrypting the encrypted information, and as a result, generates the information encryption private key. Therefore, it is possible to prevent unauthorized acquisition of information requested by an unauthorized user.

According to this embodiment, the information provider can reliably deliver the requested information to the user, and the information provider can confirm that the user has received the information without fail. . Further, the zero-knowledge proof protocol as a user authentication method in which the information provider authenticates the user can be used alone as needed.

In addition, a system in which a random number statement can be used when generating an information encryption private key is provided.

In addition, a system having information provider secret information storage means capable of storing information to be kept secret by the information provider is provided.

[0262] Further, a system is provided in which encrypted communication can be performed between an information provider and a user by a public key encryption method.

Also, it has a secret key for key encryption and a generation function,
A system that enables information delivery using a secret key for information encryption and a secret key for key encryption is provided.

[0264] Further, a system is provided in which a communication history having an evidential ability can be presented as needed.

Also, a neutral mediation organization such as a court examines the validity of a communication history having an evidential ability,
This is a system that can determine which of the information provider and the user is valid.

Further, when it is detected that there is an unauthorized user, the execution of the protocol is immediately stopped to prevent the information requested by the unauthorized user from being illegally obtained. Become.

The present invention is not limited to the above-described embodiments, but can be implemented in various modifications without departing from the scope of the invention.

[0268]

As described above, in the first embodiment, first, the zero-knowledge proof protocol is used as a method of authenticating a user by an information provider. However, it is almost impossible to continue to pass the information provider's verification unless the user uses a valid card, and the user is almost completely rejected at the authentication stage.

Secondly, in the part where the delivery information is delivered from the information provider to the user, the delivery information is included in the check sentence of the zero knowledge proof protocol and the delivery is performed, so that the zero knowledge proof protocol ends normally. If this is the case, the inspection statement, that is, the delivery information, is definitely received and recorded on the card, and appropriate processing is performed. Also, if the verification of the information provider fails in the middle, the subsequent authentication will be terminated and the remaining inspection statements will not be delivered, so the delivery information that the user can know will be the one before the failure. Limited.

Third, by recording and managing the communication history (the X _i , the Y _i , and the check sentence e _ji ), it is possible to provide information that normal authentication has been performed between the information provider and the user. Since the user can confirm the delivery information, the user should receive the delivery information together with the second effect, and the delivery information should be recorded in the storage means 14 of the card. This means that the user can generate the information encryption private key W by comparing the communication history disclosed by the information provider with the delivery information recorded on the card submitted by the user. Can be determined. In this case, if the user does not submit the card, it is determined that the information encryption private key W can be generated.

[0271] Therefore, an unauthorized user cannot use the system or exploit all the delivery information illegally. In addition, the information provider discloses the communication history and submits a card to the user in response to an unjust claim that the user has not received the delivery information even though the authentication has been completed normally. Can be challenged by asking them to do so.

In the first embodiment, there is no need to divide all the delivery information to generate the check sentence _ji .
For example, the test statement e _ji from the beginning of the delivery information to gn bit (j = 1, ..., n ) and, after the zero-knowledge proof protocol according n sets of test statement e _ji is finished, the rest of the delivery information , The security level in the zero-knowledge proof can be changed and the amount of communication can be reduced by changing the value of n in various ways. For example, if n is set to half of L _w / g, the communication amount is also almost half.

Also, regarding the method of generating the check sentence e _ji ,
In addition to simply generating the distribution information by dividing it, the distribution information can be generated by adding dummy information or performing encryption. In this case, a function to restore the original delivery information by autonomously removing or decrypting the dummy information from the secret information set in advance in the card or the stored inspection statement _ji is provided. As a result, the delivery information cannot be taken out unless the zero knowledge proof is normally terminated. Therefore, a third party or a user illegally exploits the inspection sentence e _ji ,
After receiving most of the check statements e _ji , deliberately failing the authentication and performing fraudulent acts such as predicting the remaining parts of the check statement e _ji that have not been delivered, and the information provider has decided to deliver It is possible to prevent a third party or user from acquiring the delivery information before the failure is determined or noticed.

In the information delivery method and system according to the first embodiment, all information necessary for the zero-knowledge proof protocol is incorporated in the tamper-resistant device. Since the information is executed using only the selected means, the information does not leak to the outside, and even the card owner cannot know the information. Therefore, it is possible to prevent fraudulent acts such as falsifying the card itself or rewriting recorded information on the card.

On the other hand, in the information delivery method using the zero-knowledge proof protocol of the second to fourth embodiments, firstly, since the operation itself of the protocol is equivalent to the zero-knowledge proof protocol as user authentication, the Similar to the knowledge proof protocol, it is almost impossible for an unauthorized user to clear the verification of the information provider. Secondly, when the delivery confirmation step is completed normally, the information provider can determine that the correct user has correctly received the information because the value is equivalent to that the zero knowledge proof protocol has been completed normally.

Also, by encrypting the information and transmitting it as a ciphertext, it is possible to prevent eavesdropping on the information by a third party and to prevent the third party from obtaining effective information for decrypting the information. You can also.

According to the second embodiment, the ciphertext decryption process can be executed separately from the delivery confirmation step.

According to the second and third embodiments, the size of the check sentence is reduced by generating the check sentence from information (or a user-encryptable cipher text) using, for example, a hash function. And the amount of communication and the processing time in the delivery confirmation step can be reduced.

According to the third embodiment, by generating a check sentence using a one-way function, information (or a ciphertext that can be decrypted by a user), a response sentence, and a check sentence are obtained. Forgery of the communication history becomes impossible.

If the protocol of the information provider fails during the delivery confirmation step due to, for example, use by an unauthorized user, the execution of the protocol is immediately stopped, and the blocks after the failure of the verification are replaced by the user. Therefore, it is possible to prevent the information (or the encrypted text that can be decrypted by the user) from being illegally acquired as a result.

According to the fourth embodiment, when transmitting a large amount of information, first, the information is first encrypted by the information encryption secret key generated by the information provider, and the information is encrypted by the user. The information body is not delivered to the user before the user is authenticated. Second, by performing delivery confirmation as a check sentence only for the information encryption secret key, it is possible to greatly reduce the amount of communication and the processing time for delivery confirmation. Third, if the delivery confirmation step is completed normally, the user can confirm that the inspection sentence has been correctly received, and it is guaranteed that the information encryption private key will be obtained in the information retrieval step. Information can be retrieved without fail. Therefore, when the information delivery method is completed due to these effects, the information provider provides the information to an authorized user in an encrypted state, and then the user decrypts the encrypted information. The information provider can deliver the necessary information to the user and reliably confirm that the user has received the information, so that the information provider can determine that the information has been reliably delivered to the user.

In addition, by generating a secret key for information encryption using a one-way function, it is possible to prevent unauthorized generation of a secret key for information encryption which is convenient for an information provider. Similarly, by using a one-way function, it becomes impossible to forge a communication history consisting of a random number sentence, a check sentence, and a response sentence. Capability to provide the user with the information necessary to decrypt the encrypted information after providing the encrypted information to the user, and to prove at a later date that the user has received the information reliably. Can have.

Also, performing cryptographic communication on a check sentence has the same effect as performing cryptographic communication on an information encryption private key. This prevents eavesdropping and prevents a third party from obtaining effective information for decrypting the secret key for information encryption.

In addition, the decryption processing of the check sentence can be executed separately from the delivery confirmation step.

If the verification of the information provider fails during the delivery confirmation step due to, for example, an unauthorized user, the execution of the protocol is immediately stopped.
Blocks after the failed verification will not be sent to the user. Therefore, the user who fails the verification of the information provider can obtain only a part of the information necessary for decrypting the encrypted information, and as a result, the information itself or the secret key for information encryption can be obtained. Since it is impossible to generate the information, it is possible to prevent the information requested by the unauthorized user from being illegally obtained.

According to the third and fourth embodiments, a communication history that cannot be forged can be recorded and managed as evidence that information has been actually delivered, and can be presented as necessary. Furthermore, the amount of information that must be recorded and managed as evidence of the fact that the information provider has delivered the information can be significantly reduced as compared with the method of Sakurai (Japanese Patent Laid-Open No. 5-12321).

When it becomes necessary to arbitrate whether information is provided between the information provider and the user, the information provider presents the communication history to a neutral arbitration organization such as a court, and the arbitration organization By examining the validity of the communication history having the evidential ability, it is possible to determine which of the information provider and the user is valid. In other words, the arbitrator can later confirm that the information provider has transmitted the information (or a ciphertext that can be decrypted by the user) to the user and that the user has received the information without fail. (Or a ciphertext that can be decrypted by the user), it is possible to prevent an unjust assertion that the user has not received information.

According to the above-described second to fourth embodiments, the information provider surely delivers the requested information to the user, and the information provider confirms that the user has received the information without fail. The system can be confirmed. Further, the zero-knowledge proof protocol as a user authentication method in which the information provider authenticates the user can be used alone as needed.

[0289] In addition, a system is provided that enables encrypted communication between an information provider and a user.

According to the fourth embodiment, a system is provided in which information provided by an information provider is accumulated, and the user can use the information as needed.

Further, the system has a function of generating a secret key for information encryption, and can deliver information using the secret key for information encryption.

Further, according to the third and fourth embodiments, there is provided a system in which a communication history having an evidential ability can be presented as needed.

[0293] Further, when the system detects that the user is an unauthorized user, the system immediately stops the execution of the protocol so that the information requested by the unauthorized user is not illegally obtained. Become.

Also, a neutral mediation organization such as a court examines the validity of a communication history having an evidential ability,
This is a system that can determine which of the information provider and the user is valid.

On the other hand, according to the fifth to eighth embodiments, in the information delivery method using the zero knowledge proof protocol, first, in the information delivery step, the information requested by the user is encrypted by the information provider. At this time, the requested information itself cannot be taken out by the user. Second, since the protocol operation itself performed in the delivery confirmation step is equivalent to the zero-knowledge proof protocol as user authentication, an unauthorized user must clear the information provider's verification in the same way as the zero-knowledge proof protocol. Is almost impossible. Third, if the delivery confirmation step is completed successfully, it is equivalent to the successful completion of the zero-knowledge certification protocol. Can be determined to be. Fourth, in the information retrieval step, if the user can correctly receive the inspection statement, the user can create a secret key delivery statement and an information encryption secret key. At this point, the user can encrypt the information using the information encryption secret key. The requested information can be decrypted and the requested information can be extracted. Therefore, due to these effects, when all the steps of the information delivery method are completed, the information provider provides the requested information to the authorized user in an encrypted state, and then the user The information provider delivers the information required to decrypt the coded information to the user and ensures that the user has received it, so the information provider can reliably deliver the information requested by the user to the user. It can be determined that it has been done.

According to the fifth and sixth embodiments, the cryptographic communication of the check sentence has the same effect as the cryptographic communication of the information encryption private key. Therefore, even if a third party eavesdrops on the communication path, these secret keys are not known. Further, it is also possible to prevent information that is valid for decrypting the secret key for information encryption from being obtained.

According to the seventh and eighth embodiments, it is possible to prevent unauthorized creation of a secret key for information encryption which is convenient for the information provider.

Since it is impossible to forge the communication history, the information provider provides the required information to the authorized user in an encrypted state, and then the information provider The information necessary for decoding the information can be delivered to the user, and the user can have the evidential ability to prove that the user has received the information at a later date.

Further, a communication history having an evidence ability can be presented as needed. Further, the amount of information that must be recorded and managed as evidence of the fact that the information provider has delivered the information can be significantly reduced as compared with the method of Sakurai (Japanese Patent Laid-Open No. 5-12321).

When it is necessary to arbitrate whether information is provided between the information provider and the user, a neutral arbitration body such as a court checks the validity of the communication history having an evidential ability. This makes it possible to determine which of the information provider and the user is valid.

According to the eighth embodiment, by encrypting and transmitting the information delivery request message, eavesdropping of the information delivery request message by a third party can be prevented, and the information of the user such as what information has been requested can be prevented. Privacy can be protected.

[0302] The secret key for key encryption and the secret key for information encryption are scrambled by the secret information of only the information provider and the user. Secret key is not known, and no information is available to decrypt the secret key. Therefore, the information requested by the user cannot be illegally acquired by a third party.

If the verification of the information provider fails during the delivery confirmation step due to, for example, an unauthorized user, the execution of the protocol is immediately stopped,
Blocks after the failed verification will not be sent to the user. Therefore, the user who fails the verification of the information provider can obtain only a part of the information necessary for decrypting the encrypted information, and as a result, the secret key for key encryption or information encryption. Since it becomes impossible to generate a secret key for use, it is possible to prevent the information requested by an unauthorized user from being illegally obtained.

According to the fifth to eighth embodiments, the information provider surely delivers the requested information to the user, and the information provider confirms that the user has received the information without fail. The system can be confirmed. Further, the zero-knowledge proof protocol as a user authentication method in which the information provider authenticates the user can be used alone as needed.

[0305] Further, a system in which a random number statement can be used when generating an information encryption private key is provided.

Further, according to the fifth and eighth embodiments, a system having information provider secret information storage means capable of storing information to be kept secret by the information provider is provided.

Further, according to the fifth, sixth, and eighth embodiments, a system is provided in which encrypted communication can be performed between an information provider and a user by a public key encryption method.

According to the seventh and eighth embodiments, the user terminal is provided with an input means for easily creating an information delivery request sentence.

Further, the system has a function of generating a secret key for key encryption and a secret key delivery statement, so that information can be delivered using the secret key for information encryption and the secret key for key encryption. .

[0310] Further, a system is provided in which a communication history having an evidence ability can be presented as needed.

[0311] Also, a neutral arbitration body such as a court examines the legitimacy of the communication history having evidential ability,
This is a system that can determine which of the information provider and the user is valid.

According to the eighth embodiment, when it is detected that there is an unauthorized user, the execution of the protocol is immediately stopped, and the information requested by the unauthorized user is illegally acquired. It is a system that does not get lost.

On the other hand, according to the ninth embodiment, in the information delivery method using the zero-knowledge proof protocol, first, in the information delivery step, the information requested by the user is encrypted by the information provider and used. To be delivered to
At this point, the user cannot retrieve the requested information itself. Second, since the protocol operation itself performed in the delivery confirmation step is equivalent to the zero-knowledge proof protocol as user authentication, an unauthorized user must clear the information provider's verification in the same way as the zero-knowledge proof protocol. Is almost impossible. Third, if the delivery confirmation step is completed successfully, it is equivalent to the successful completion of the zero-knowledge certification protocol. Can be determined to be. Fourth, in the information extracting step, the user can create the information encryption private key if the inspection statement can be received correctly. At this point, the user decrypts the information encrypted by the information encryption private key. , The requested information can be retrieved. Therefore, due to these effects, when all the steps of the information delivery method are completed, the information provider provides the requested information to the authorized user in an encrypted state, and then the user Deliver the information necessary to decrypt the coded information to the user,
In addition, since the user can surely confirm that the information has been received, the information provider can determine that the information requested by the user has been reliably delivered to the user.

Also, it is possible to prevent an information provider from illegally falsifying a private key for information encryption which is convenient for him / her. Furthermore, since the encrypted information encryption private key cannot be decrypted by anyone other than the information provider, the user does not know the information encryption private key at the time of signing.

Also, since it is impossible to forge the communication history, the information provider provides the required information to the authorized user in an encrypted state, and then the information is encrypted. The information necessary for decoding the information can be delivered to the user, and the user can have the evidential ability to prove that the user has received the information at a later date.

Further, it becomes possible to present a communication history having an evidential ability as necessary. Further, the amount of information that must be recorded and managed as evidence of the fact that the information provider has delivered the information can be significantly reduced as compared with the method of Sakurai (Japanese Patent Laid-Open No. 5-12321).

If it is necessary to arbitrate whether information is provided between the information provider and the user, a neutral arbitration body such as a court checks the validity of the communication history having an evidential ability. This makes it possible to determine which of the information provider and the user is valid.

If the verification of the information provider fails during the delivery confirmation step due to, for example, an unauthorized user, the execution of the protocol is immediately stopped.
Blocks after the failed verification will not be sent to the user. Therefore, the user who fails the verification of the information provider can obtain only a part of the information necessary for decrypting the encrypted information, and as a result, generates the information encryption private key. Therefore, it is possible to prevent unauthorized acquisition of information requested by an unauthorized user.

According to the ninth embodiment, the information provider can reliably deliver the requested information to the user, and can confirm that the user has received the information reliably. Becomes Further, the zero-knowledge proof protocol as a user authentication method in which the information provider authenticates the user can be used alone as needed.

[0320] Further, a system in which a random number sentence can be used when generating an information encryption private key is provided.

[0321] Further, a system having information provider secret information storage means capable of accumulating information to be kept secret by the information provider is provided.

[0322] Further, a system is provided in which encrypted communication can be performed between the information provider and the user by the public key encryption method.

[0323] Also, it has a secret key for key encryption and a generation function,
A system that enables information delivery using a secret key for information encryption and a secret key for key encryption is provided.

[0324] Further, a system is provided in which a communication history having an evidential ability can be presented as needed.

Also, a neutral mediation organization such as a court checks the validity of a communication history having an evidential ability,
This is a system that can determine which of the information provider and the user is valid.

Further, when it is detected that there is an unauthorized user, the execution of the protocol is immediately stopped to prevent the information requested by the unauthorized user from being illegally obtained. Become.

[Brief description of the drawings]

FIG. 1 is a conceptual diagram showing a conventional user authentication method based on a Fiat Shamir method, a message authentication method based on a conventional authenticator method, and a digital signature method based on a conventional RSA signature method.

FIG. 2 is a block diagram illustrating a configuration example of an information delivery system according to the first embodiment of the present invention.

FIG. 3 is a flowchart showing an operation procedure of the information delivery system shown in FIG.

FIG. 4 is a schematic diagram showing an example of delivery information used in the information delivery system shown in FIG.

FIG. 5 is a block diagram illustrating a configuration example of an information delivery system according to a second embodiment of the present invention.

6 is a flowchart showing an operation procedure of the information delivery system shown in FIG.

FIG. 7 is a block diagram illustrating a configuration example of an information delivery system according to a third embodiment of the present invention.

8 is a flowchart showing an operation procedure relating to delivery confirmation of the information delivery system shown in FIG.

9 is a flowchart showing an operation procedure regarding arbitration of the information delivery system shown in FIG.

FIG. 10 is a block diagram illustrating a configuration example of an information delivery system according to a fourth embodiment of the present invention.

11 is a flowchart showing an operation procedure regarding delivery confirmation and information retrieval of the information delivery system shown in FIG.

12 is a flowchart showing an operation procedure regarding arbitration of the information delivery system shown in FIG.

FIG. 13 is a block diagram illustrating a configuration example of an information delivery system according to a fifth embodiment of the present invention.

14 is a flowchart showing an operation procedure of the information delivery system shown in FIG.

FIG. 15 is a block diagram illustrating a configuration example of an information delivery system according to a sixth embodiment of the present invention.

16 is a flowchart showing an operation procedure of the information delivery system shown in FIG.

FIG. 17 is a block diagram illustrating a configuration example of an information delivery system according to a seventh embodiment of the present invention.

FIG. 18 shows information delivery of the information delivery system shown in FIG.
It is a flowchart which shows the operation | movement procedure regarding delivery confirmation and information extraction.

19 is a flowchart showing an operation procedure regarding arbitration of the information delivery system shown in FIG.

20 is a schematic diagram showing a configuration of an information delivery request sentence used in the information delivery system shown in FIG.

21 is a schematic diagram showing a configuration of a communication history used in the information delivery system shown in FIG.

FIG. 22 is a block diagram illustrating a configuration example of an information delivery system according to an eighth embodiment of the present invention.

FIG. 23 shows information delivery of the information delivery system shown in FIG. 22;
It is a flowchart which shows the first half of the operation | movement procedure regarding delivery confirmation and information extraction.

FIG. 24 shows information delivery of the information delivery system shown in FIG. 22;
It is a flowchart which shows the latter half of the operation procedure regarding delivery confirmation and information extraction.

25 is a flowchart showing an operation procedure regarding arbitration of the information delivery system shown in FIG.

FIG. 26 is a block diagram illustrating a configuration example of an information delivery system according to a ninth embodiment of the present invention.

FIG. 27 shows information delivery of the information delivery system shown in FIG. 26;
It is a flowchart which shows the first half of the operation | movement procedure regarding delivery confirmation and information extraction.

FIG. 28 shows information delivery of the information delivery system shown in FIG. 26;
It is a flowchart which shows the latter half of the operation procedure regarding delivery confirmation and information extraction.

FIG. 29 is a flowchart showing an operation procedure relating to arbitration of the information delivery system shown in FIG. 26;

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 card 11 secret information storage means 12 random number generation means 13 calculation means 14 storage means 2 user terminal 21 card insertion means 22 storage means 23 usage means 24 communication control means 3 information provider terminal 31 information storage means 32 information division means 33 verification Means 34 History management means 35 Communication control means 50 Delivery information 10 User terminal 20 Information provider terminal 30 Communication line 40 Arbitrator terminal 100 Communication control means 101 User secret information storage means 102 Temporary memory 103 Random number generation means 104 Calculation means 105 Common key encryption means 106 Information output / use means 107 Public key encryption means 108 Information reconstruction means 109 Information storage means 110 Input means 41 Operation means 42 Temporary memory 43 Verification means 44 Information division means 45 Public key encryption means 200 Communication control means 201 Provision of information Secret information storage means 202 Information database 203 Temporary memory 204 Calculation means 205 Common key encryption means 206 Verification means 207 Information division means 208 Communication history file 209 Random number generation means 210 Public key encryption means 401 Calculation means 402 Temporary memory 403 Verification means 404 Information division Means 405 Public key encryption means

Continuation of the front page (56) References JP-A-63-101987 (JP, A) Zero-Knowledge AUTH Scheme Scheme with Secret Key Exchange, Lecture Notes in Computer Sci. 403, p. 583-588 (58) Field surveyed (Int. Cl. ⁷ , DB name) H04L 9/32 JICST file (JOIS)

Claims (43)

(57) [Claims] In a system including at least an information provider device and a user device, when the user device requests the information provider device to deliver information, the information provider device uses the information provider device according to a zero knowledge proof protocol. Performing the user device authentication of the user device, the information provider device transmits the information M delivered to the user device in the check sentence E in the zero knowledge proof protocol, and transmits the information to the user device by one bit. Or a process in which the information provider device records and manages the communication history data H of the zero-knowledge proof protocol, and a process in which the user device authentication is performed. In the delivering step, the user device transmits an initial response sentence X to the information provider device, and the information provider device transmits information M to be delivered to the user device to the user device. The user device transmits the information M as the check sentence E and the initial response sentence X
A response sentence Y is created by using the check sentence E, the check sentence E, and the secret information S of the user device, and transmitted to the information provider device.
Checks whether the response is correct to the initial response sentence X, the check sentence E, and the public information I of the user device, and the user device transmits the secret information S without leaking the secret information S of the user device. An information delivery method, which includes a delivery confirmation process that authenticates the knowledge and confirms that the user device has reliably received the information M. 2. The information delivery method according to claim 1, wherein in the step of performing the user device authentication and the step of delivering, the user device transmits an initial response sentence X to the information provider device. The provider device transmits to the user device an encrypted text C obtained by encrypting the information M to be delivered to the user device, and the user device sets the encrypted text C as the check text E, and the initial response text X and the check text E And a secret sentence S of the user device to create a response sentence Y and transmit it to the information provider device. The information provider device uses the transmitted ciphertext C as a check sentence E, and the response sentence Y The user device knows the secret information S without leaking the secret information S of the user device by checking whether the response is correct to the sentence X, the check sentence E, and the public information I of the user device. Authentication, and the user device surely receives the ciphertext C. Information delivery method to the delivery confirmation process consists of confirming that is, the user device, characterized by comprising a process information retrieval consists of acquiring information by decrypting the ciphertext C M. 3. The information delivery method according to claim 1, wherein the information M transmitted from the information provider device to the user device is encrypted, and the initial response sentence X transmitted from the user device to the information provider device is transmitted. An information delivery method characterized by performing cryptographic communication for (1). 4. The information delivery method according to claim 1, wherein the user device and the information provider device include at least a ciphertext C.
An information delivery method characterized in that a check sentence E is created by an information compression function by using an information compression function. 5. The information delivery method according to claim 1, wherein the user device and the information provider device use a one-way function using at least the information M and the initial response sentence X. An information delivery method characterized by creating a check sentence E. 6. The information delivery method according to claim 5, wherein, in the step of recording and managing, the information provider device records and manages communication history data H including at least information M, check text E and response text Y. An information delivery method characterized by: 7. The information delivery method according to claim 6, further comprising: the information provider device transmits the communication history data H to the arbitrator device.
The arbitrator device calculates an initial response sentence X from the inspection sentence E, the response sentence Y, and the public information I of the user device, and uses a one-way function using at least the initial response sentence X and information M. Check sentence E
And checks whether the created check statement E matches the check statement E included in the communication history data H. If the check statement E matches, the information provider device authenticates the user device, and Acknowledging that the information M has been delivered by using the information delivery method. 8. The information delivery method according to claim 1, wherein the step of performing authentication of the user device and the step of delivering are performed by an information provider device transmitting to the user device. An information delivery method, comprising dividing information M or ciphertext C into a plurality of blocks each having an arbitrary bit length and performing a delivery confirmation process for each block. 9. In a system including at least an information provider device and a user device, when the user device requests the information provider device to deliver information, the information provider device uses the information provider device according to a zero knowledge proof protocol. Performing the user device authentication of the user device, the information provider device transmits the information M delivered to the user device in the check sentence E in the zero knowledge proof protocol, and transmits the information to the user device by one bit. Or a process in which the information provider device records and manages the communication history data H of the zero-knowledge proof protocol; and a process in which the user device authentication is performed. In the delivering step, the user device transmits an initial response sentence X to the information provider device, the information provider device generates a secret key W for information encryption, and the user device The ciphertext C obtained by encrypting the information M to be delivered to the user using the secret key W for information encryption by the common key cryptosystem is transmitted to the user device, and the user device receives the ciphertext C after receiving the ciphertext C. To the information provider device, the information provider device generates a check sentence E using at least the information encryption secret key W and sends it to the user device. A response sentence Y is created by using the response sentence Y, the check sentence E, and the secret information S of the user device, and transmitted to the information provider device.
The user device verifies that the user device knows the secret information S without leaking the secret information S of the user device by checking whether the response is correct to the public information I of the user device. A delivery confirmation process for confirming that the user device has reliably received the check sentence E; and a user device extracting the information encryption private key W using at least the check sentence E and performing information encryption. An information retrieval process comprising decrypting a ciphertext C by a common key cryptosystem using a decryption secret key W to obtain information M. 10. The information delivery method according to claim 9, wherein the information provider device includes at least an initial response sentence X and a random number sentence Z.
An information distribution method, wherein an information encryption secret key W is generated by a one-way function using 11. The information delivery method according to claim 10, wherein, in the recording management step, the information provider device records communication history data H including at least a random number sentence Z, a check sentence E, and a response sentence Y. An information delivery method characterized by management. 12. The information delivery method according to claim 11, further comprising: the information provider device transmits the communication history data H to the arbitrator device.
The arbitrator device calculates an initial response sentence X from the inspection sentence E, the response sentence Y, and the public information I of the user device, and uses a one-way function using at least the initial response sentence X and the random number sentence Z. Generates a check key E for information encryption, generates a check statement E using at least the secret key W for information encryption, and confirms whether the check string E thus created matches the check statement E included in the communication history data H. And the information provider device authenticates the user device if they match,
Acknowledging that the information M has been delivered to the user device. 13. The information delivery method according to claim 9, wherein the step of performing the user device authentication and the step of delivering include the steps of: an information provider device generating an information encryption secret key W; Is transmitted to the user device using the secret key W for information encryption by the common key encryption method, and the user device receives the ciphertext C, and then notifies the information provider that the ciphertext C has been received. An information delivery process of notifying the device, the user device transmits an initial response sentence X to the information provider device, and the information provider device transmits the check statement E using at least the information encryption secret key W. The user device creates a response sentence Y using the initial response sentence X, the inspection sentence E, and the secret information S of the user device, and transmits the response sentence Y to the information provider device. The information provider device determines that the response sentence Y is an initial response sentence X and a check sentence E
The user device authenticates that it knows the secret information S without leaking the secret information S of the user device by checking whether the response is correct to the public information I of the user device. A delivery confirmation process consisting of confirming that the user device has received the check sentence E reliably; and a user device acquiring the information encryption private key W using at least the check sentence E, An information retrieving process comprising: decrypting a ciphertext C using a secret key W for encryption by a common key cryptosystem to obtain information M. 14. The information delivery method according to claim 13, wherein the information provider device generates a secret key W for information encryption by a one-way function using at least a random number sentence Z generated by the information provider. The information delivery method you want. 15. The information delivery method according to claim 14, wherein in the delivery confirmation process, the information provider device generates a secret key K for key encryption by using a one-way function using at least the initial response sentence X. , Using at least the information encryption secret key W and the key encryption secret key K to generate a check sentence E and transmitting the check sentence to the user device; Generating a secret key K for key encryption by means of a one-way function, and extracting a secret key W for information encryption using at least the check statement E and the secret key K for key encryption. Shipping method. 16. The information delivery method according to claim 15, wherein in the recording management step, the information provider device records communication history data H including at least a random number sentence Z, a check sentence E, and a response sentence Y. An information delivery method characterized by management. 17. The information delivery method according to claim 16, wherein the information provider device presents the communication history data H to the arbitrator device, and the arbitrator device checks the inspection sentence E, the response sentence Y and the user. An initial response sentence X is calculated from the public information I of the device, and a secret key K for key encryption is calculated by a one-way function using at least the initial response sentence X,
Further, a secret key W for information encryption is generated by a one-way function using at least the random number sentence Z, and a check sentence E is created using at least the secret key K for key encryption and the secret key W for information encryption. It is checked whether the created inspection statement E matches the inspection statement E included in the communication history data H, and if they match, the information provider device authenticates the user device and sends the information M to the user device. An information delivery method, comprising the step of: acknowledging that the information has been delivered. 18. The information delivery method according to claim 14, wherein in the delivery confirmation process, the information provider device includes at least an initial response sentence X and secret information that is secretly shared between the user device and the information provider device. A key encryption private key K is generated by a one-way function using CS, and a check statement E is generated using at least the information encryption private key W and the key encryption private key K, and In the information retrieval process, the user device generates a secret key K for key encryption by a one-way function using at least the initial response sentence X and the secret information CS, and at least the check sentence E and the key An information delivery method characterized by extracting an information encryption secret key W using an encryption secret key K. 19. The information delivery method according to claim 18, wherein, in the record management step, the information provider device includes at least a user device and a secret information CS secretly shared by the information provider device and a random number. An information delivery method characterized by recording and managing communication history data H including a sentence Z, a check sentence E, and a response sentence Y. 20. The information delivery method according to claim 19, wherein the information provider device presents the communication history data H to the arbitrator device, and the arbitrator device checks the inspection sentence E, the response sentence Y, and the user. An initial response sentence X is calculated from the public information I of the device, and key encryption is performed by a one-way function using at least the initial response sentence X and secret information CS secretly shared by the user device and the information provider device. A secret key K for information encryption and a secret key W for information encryption are generated by a one-way function using at least the random number sentence Z, and at least the secret key K for key encryption and the secret key W for information encryption are generated. A check sentence E is created, and it is checked whether the created check sentence E matches the check sentence E included in the communication history data H. If the check sentence E matches, the information provider device authenticates the user device, and Confirm that information M has been delivered to the device. Information delivery method characterized by comprising the step consisting Rukoto. 21. The information delivery method according to claim 13, wherein the user device transmits a request text R to the information provider device, and the information provider device transmits at least the request text R and the random number text Z generated by the user device. And generating a secret key W for information encryption by a one-way function using the information distribution method. 22. The information delivery method according to claim 21, wherein the request message R transmitted from the user device to the information provider device is encrypted. 23. The information delivery method according to claim 21, wherein in the delivery confirmation process, the information provider device uses a one-way function using at least an initial response sentence X to encrypt the secret for key encryption. Generates a key K and at least a secret key W for information encryption
And generating a check sentence E using the key encryption secret key K and transmitting the check sentence to the user device. In the information retrieval process, the user device uses at least the initial response sentence X by a one-way function. An information delivery method comprising: generating a key encryption secret key K; and extracting an information encryption secret key W using at least the check sentence E and the key encryption secret key K. 24. The information delivery method according to claim 23, wherein, in the recording management step, the information provider device includes a communication history including at least a random number sentence Z, a check sentence E, a response sentence Y, and a request sentence R. An information delivery method characterized by recording and managing data H. 25. The information delivery method according to claim 24, further comprising the information provider device transmitting communication history data H to the arbitrator device.
The arbitrator device calculates an initial response sentence X from the inspection sentence E, the response sentence Y, and the public information I of the user device, and uses at least the initial response sentence X for a key encryption by a one-way function. Secret key K
And a secret key W for information encryption is generated by a one-way function using at least a random number sentence Z and a request sentence R, and at least a secret key K for key encryption and a secret key W for information encryption are used. Inspection statement E is created by checking whether the created inspection statement E matches the inspection statement E included in the communication history data H, and if they match, the information provider device authenticates the user device and uses it. An information delivery method, comprising the step of acknowledging that information M has been delivered to a user device. 26. The information delivery method according to claim 21, wherein in the delivery confirmation process, at least the initial response sentence X and the user device and the information provider device are secretly shared by the information provider device. A secret key K for key encryption is generated by a one-way function using the secret information RS and the check statement E using at least the secret key W for information encryption and the secret key K for key encryption. In the information retrieval process, the user device generates a secret key K for key encryption by a one-way function using at least the initial response sentence X and the secret information RS, An information delivery method characterized by extracting an information encryption secret key W using at least a check sentence E and a key encryption secret key K. 27. The information delivery method according to claim 26, wherein, in the step of recording and managing, the information provider device includes at least a user device and a secret information RS secretly shared by the information provider device and a random number. An information delivery method characterized by recording and managing communication history data H including a sentence Z, a check sentence E, a response sentence Y, and a request sentence R. 28. The information delivery method according to claim 27, further comprising: the information provider device transmits communication history data H to the arbitrator device.
The arbitrator device calculates an initial response sentence X from the inspection sentence E, the response sentence Y, and the public information I of the user device, and at least the initial response sentence X, the user device, and the information provider device are kept secret. , A secret key K for key encryption using a one-way function using the secret information RS shared by the
, A secret key W for information encryption is respectively generated by a one-way function, and a check sentence E is created using at least the secret key K for key encryption and the secret key W for information encryption, and the created check The sentence E checks whether it matches the check sentence E included in the communication history data H, and if it matches, the information provider device has authenticated the user device and has delivered the information M to the user device. An information delivery method, comprising the step of: 29. The information delivery method according to claim 13, further comprising: transmitting the information encryption private key CW to the user device encrypted by a method that cannot be decrypted by the user device. The user device transmits a signed information encryption private key SW digitally signed to the encrypted information encryption secret key CW to the information provider device, and the information provider device transmits the signed information encryption secret. An information delivery method comprising a step of verifying whether a signature of a key SW is correct. 30. The information delivery method according to claim 29, wherein in the delivery confirmation process, the information provider device generates a secret key K for key encryption by using a one-way function using at least an initial response sentence X. And at least a secret key W for information encryption.
And generating a check sentence E using the key encryption secret key K and transmitting the check sentence to the user device. In the information retrieval process, the user device uses at least the initial response sentence X by a one-way function. An information delivery method comprising: generating a key encryption secret key K; and extracting an information encryption secret key W using at least the check sentence E and the key encryption secret key K. 31. The information delivery method according to claim 30, wherein in the recording management step, the information provider device includes at least an information encryption secret key W, a signed information encryption secret key SW, a check statement E, An information delivery method characterized by recording and managing communication history data H including a response sentence Y. 32. The information delivery method according to claim 31, further comprising: the information provider device transmits the communication history data H to the arbitrator device.
After the arbitrator device verifies whether the signed information encryption secret key SW is a correct signature for the information encryption secret key W, the arbitrator device checks the inspection statement E, the response statement Y, and the public information of the user device. I
To calculate the initial response sentence X, and at least the initial response sentence X
, A secret key K for key encryption is generated by a one-way function, and a check statement E is created using at least the secret key K for key encryption and the secret key W for information encryption. Inspect whether it matches the check sentence E included in the communication history data H, and if they match, the information provider device authenticates the user device and acknowledges that the information M has been delivered to the user device. An information delivery method characterized by including a process consisting of: 33. The information delivery method according to claim 29, wherein in the delivery confirmation process, the information provider device includes at least an initial response sentence X and secret information that is secretly shared between the user device and the information provider device. A user key is generated by using RS to generate a secret key K for key encryption by a one-way function, and generating a check text E using at least a secret key W for information encryption and a secret key K for key encryption. In the information retrieval process, the user device uses at least the initial response sentence X and secret information RS that is secretly shared by the user device and the information provider device to perform key encryption by a one-way function. An information delivery method, comprising: generating a secret key K; and extracting an information encryption secret key W using at least a check sentence E and a key encryption secret key K. 34. The information delivery method according to claim 33, wherein, in the recording management step, the information provider device includes at least an information encryption secret key W, a signed information encryption secret key SW, a check statement E, An information delivery method characterized by recording and managing response history Y and communication history data H comprising secret information RS secretly shared between a user device and an information provider device. 35. The information delivery method according to claim 34, further comprising: the information provider device presenting the communication history data H to the arbitrator device, wherein the arbitrator device transmits the signed information encryption secret key SW to the arbitrator device. After verifying whether the signature is correct for the encryption secret key W, an initial response sentence X is calculated from the check sentence E, the response sentence Y, and the public information I of the user device, and at least the initial response sentence X and the user A secret key K for key encryption is generated by a one-way function using secret information RS secretly shared between the device and the information provider device, and at least a secret key K for key encryption and a secret key W for information encryption are generated. Is used to check whether the created check sentence E matches the check sentence E included in the communication history data H, and if they match, the information provider device authenticates the user device, And deliver the information M to the user device. Information delivery method characterized by comprising the step consisting in admit. 36. The information delivery method according to claim 9, wherein the check sentence E transmitted from the information provider device to the user device is encrypted. . 37. The information delivery method according to claim 36, wherein the initial response sentence X transmitted from the user device to the information provider device.
An information delivery method characterized by performing cryptographic communication for (1). 38. The information delivery method according to any one of claims 9 to 35, wherein in the delivery confirmation process, the information provider device encrypts at least the check sentence E and transmits it to the user device; An information delivery method, wherein the user device decrypts the check sentence E in the information retrieval process. 39. The information delivery method according to claim 9, wherein the step of performing authentication of the user device and the step of delivering include a plurality of check statements E each having a size of an arbitrary bit length. An information delivery method characterized by dividing the data into blocks and performing a delivery confirmation process on each block. 40. The information delivery method according to claim 1, wherein the operation of the user device is executed by a card of the portable user device. . 41. The information delivery method according to any one of claims 1 to 40, further comprising information M or a secret key W for information encryption received by the user device on a card of the portable user device. Recording an information distribution method. 42. In a system including at least an information provider device and a user device, when the user device requests information delivery to the information provider device, the information provider device uses the information provider device according to a zero knowledge proof protocol. Means for performing user device authentication of the user device, and the information provider device transmits the information M to be delivered to the user device in the check sentence E in the zero-knowledge proof protocol and transmits the information to the user device by one bit. Or an information delivery system comprising: means for delivering in units of a plurality of bits; and means for recording and managing the communication history data H of the zero-knowledge proof protocol, wherein the information provider apparatus comprises means for performing the user device authentication. And the delivery means, wherein the user device transmits an initial response sentence X to the information provider device, and the information provider device transmits the information M to be delivered to the user device to the user. The user device transmits the information M as the inspection sentence E to the initial response sentence X
A response sentence Y is created by using the check sentence E, the check sentence E, and the secret information S of the user device, and transmitted to the information provider device.
Checks whether the response is correct to the initial response sentence X, the check sentence E, and the public information I of the user device, and the user device transmits the secret information S without leaking the secret information S of the user device. An information delivery system, wherein the information delivery system performs a delivery confirmation process that authenticates the knowledge and confirms that the user device has reliably received the information M. 43. In a system including at least an information provider device and a user device, when the user device requests information delivery to the information provider device, the information provider device uses the information provider device according to a zero knowledge proof protocol. Means for performing user device authentication of the user device, and the information provider device transmits the information M to be delivered to the user device in the check sentence E in the zero-knowledge proof protocol and transmits the information to the user device by one bit. Or an information delivery system comprising: means for delivering in units of a plurality of bits; and means for recording and managing the communication history data H of the zero-knowledge proof protocol, wherein the information provider apparatus comprises means for performing the user device authentication. And the delivering means, wherein the user device transmits an initial response sentence X to the information provider device, and the information provider device generates an information encryption private key W A ciphertext C obtained by encrypting the information M to be delivered to the user device using the secret key W for information encryption by a common key cryptosystem is transmitted to the user device, and after the user device receives the ciphertext C, The information provider device notifies the information provider device of the reception, the information provider device generates a check sentence E using at least the information encryption private key W, and transmits the check statement E to the user device. A response sentence Y is created by using the sentence X, the check sentence E, and the secret information S of the user device and transmitted to the information provider device. E
The user device authenticates that it knows the secret information S without leaking the secret information S of the user device by checking whether the response is correct to the public information I of the user device. A delivery confirmation process consisting of confirming that the user device has reliably received the check sentence E; and a user device taking out the information encryption private key W using at least the check sentence E, An information delivery system, comprising: performing a process of decrypting a ciphertext C by a common key cryptosystem using a secret key W for encryption to obtain information M.