JP5006750B2 - Attribute authentication system, attribute authentication method and program in the same system - Google Patents

Description

  The present invention relates to an attribute authentication system, an attribute authentication method and a program in the system, and in particular, ensures safety even when a tamper-resistant device is not provided on the user side without making an inquiry to a third party. The present invention also relates to an attribute authentication system that enables revocation confirmation, and an attribute authentication method and program in the system.

In recent years, various services have been provided electronically through the Internet. When providing such a service, it is essential to authenticate the user. Here, a method for authenticating a user is generally classified into authentication for specifying an individual and authentication for not specifying an individual such as attribute authentication (for example, see Patent Document 1).
Japanese Patent Publication No. 8-2051

  By the way, in the conventional attribute authentication, the anonymity of attribute information was not considered. In addition, some research for anonymization has been made, but the content is insufficient, and further, communication with a third party is required when performing attribute authentication. For this reason, since attribute information cannot be transformed, communication may be observed by a third party, and user behavior may be traced, and a problem regarding privacy protection remains as a technical problem.

On the other hand, in the anonymous authentication method considering the anonymity of the attribute information, it is necessary to provide a tamper resistant device on the user terminal side. Furthermore, the revocation confirmation process is difficult, and there has been a problem that it is necessary to make an inquiry to a third party at the time of revocation confirmation.

  Therefore, the present invention has been made in view of the above circumstances, and without being inquired to a third party, even if a tamper-resistant device is not provided on the user side, it is invalidated while ensuring safety. An object of the present invention is to provide an attribute authentication system that enables confirmation, and an attribute authentication method and program in the system.

The present invention proposes the following items in order to solve the above-described problems.
(1) The present invention includes a user terminal (for example, equivalent to the user terminal 1 of FIG. 1), an attribute certificate issuing server (for example, equivalent to the attribute authentication server 2 of FIG. 1), and a service providing server (for example, FIG. And the user terminal generates two secret keys x1 and x2 and generates a public key y1 from these secret keys. , Y2 and another secret key Y (for example, equivalent to the key generation unit 11 in FIG. 2), and first transmission means for transmitting a service provision request to the service providing server (for example, FIG. 2), transformation means for transforming the attribute certificate issued by the attribute certificate issuing server (for example, equivalent to the attribute certificate modification section 12 in FIG. 2), and the generated two secrets. Key x1, x And processing means for calculating two signature values for the random number r received from the service providing server using the modified secret keys fx1 and fx2 (for example, corresponding to the processing unit 13 in FIG. 2), A second transmission unit (for example, corresponding to the transmission unit 14 in FIG. 2) that transmits the attribute certificate modified by the transformation unit and the signature value calculated by the processing unit to the service providing server. A certificate issuing server for signing with public signatures y1, y2, and Y generated by the generating means of the user terminal with a signature key possessed (for example, corresponding to the signature unit 31 of FIG. 4); {Y1, zy1}, {y2, zy2}, {Y, zY, where z is a signature secret key and zP is a corresponding secret key (P is a generation source). } As an attribute certificate Issuing means (for example, equivalent to the attribute certificate issuing unit 32 in FIG. 4), and the service providing server generates a random number r and transmits it to the user terminal (for example, FIG. 4). 3), first verification means for verifying the attribute certificate received from the user terminal (for example, equivalent to the attribute certificate verification unit 21 in FIG. 3), and received from the user terminal Two verification means for verifying two signature values (for example, equivalent to signature value verification section 22 in FIG. 3) and revocation confirmation execution means for executing revocation confirmation (for example, corresponding to revocation confirmation execution section 23 in FIG. 3) ) And the validity of the attribute certificate is confirmed by the first verification means, the validity of the two signature values is confirmed by the second verification means, and the revocation confirmation is completed by the revocation confirmation execution means. When the user terminal, An attribute authentication system characterized by comprising service providing means (for example, corresponding to the service providing unit 24 in FIG. 3) for providing a service based on attribute information is proposed.

  According to the present invention, the generation means of the user terminal generates two secret keys x1 and x2, and also generates public keys y1 and y2 and another secret key Y from these secret keys, and the first transmission The means transmits a service provision request to the service provision server. The transforming means transforms the attribute certificate issued by the attribute certificate issuing server, and the processing means transforms the generated two secret keys x1 and x2, and uses the modified secret keys fx1 and fx2 to provide the service providing server. The two signature values for the random number r received from are calculated. The second transmitting unit transmits the attribute certificate modified by the transforming unit and the signature value calculated by the processing unit to the service providing server. In addition, the signing means of the attribute certificate issuing server signs the public keys y1, y2, and Y generated by the generating means of the user terminal with the signature key held, and the issuing means If the signature private key is z and the corresponding private key is zP (P is the generation source), {y1, zy1}, {y2, zy2}, {Y, zY} are issued as attribute certificates To do. Further, the third transmission unit of the service providing server generates a random number r and transmits the random number r to the user terminal, and the first verification unit verifies the attribute certificate received from the user terminal, and the second verification unit Verifies the two signature values received from the user terminal. Then, the revocation confirmation execution means executes revocation confirmation, the service providing means confirms the validity of the attribute certificate by the first verification means, and the validity of the two signature values by the second verification means. When the revocation confirmation is completed by the revocation confirmation execution means, a service based on the attribute information is provided to the user terminal. Therefore, without making an inquiry to a third party, even if the tamper resistant device is not provided on the user side, it is possible to confirm the revocation while ensuring safety.

  (2) In the attribute authentication system according to (1), the attribute certificate issuing server uses a signature key with the longest validity period among signature keys currently valid in the signature by the signature unit. We have proposed an attribute authentication system characterized by

  According to the present invention, the signature key having the longest validity period is used among the currently valid signature keys. Therefore, the inconvenience that the user can receive the service for a very short period can be prevented.

  (3) In the attribute authentication system according to (1), the modification unit of the user terminal generates one random number f and issues the attribute certificate issuing server using the random number f. An attribute authentication system is proposed in which all attribute certificates are transformed into {fy1, fzy1}, {fy2, fzy2}, and {fY, fzY}.

  According to this invention, the deforming means of the user terminal generates one random number f, and using this random number f, all attribute certificates issued by the attribute certificate issuing server are {fy1, fzy1}, {fy2 , Fzy2}, {fY, fzY}. Therefore, since all attribute certificates issued by the attribute certificate issuing server are transformed using the same random number f, fraud can be prevented.

  (4) In the attribute authentication system according to (3), when the first verification unit of the service providing server uses zP as the attribute issuing public key, the pairing calculation is performed. e (fy1, zP) = e (zfy1, P), e (fy2, zP) = e (fzy2, z), e (zfy1, zP) e (zfy2, zP) = e (zfY, P) An attribute authentication system has been proposed in which the validity of an attribute certificate is verified based on whether or not a conditional expression is satisfied.

  According to this invention, when the first verification means of the service providing server uses zP as the attribute issuing public key, e (fy1, zP) = e (zfy1, P) using pairing calculation. E (fy2, zP) = e (fzy2, P), e (zfy1, zP) e (zfy2, zP) = e (zfY, P), depending on whether or not the three conditional expressions are satisfied, Verify the validity of. Therefore, since verification regarding the validity of the attribute certificate is performed by using the characteristics of pairing calculation, accurate verification processing can be performed in a short time.

  (5) In the attribute authentication system according to (1), the revocation check execution unit of the service providing server may use e (fy1, y2) for all public keys y1, y2 listed in the revocation list. ) = E (fy2, y1), an attribute authentication system is proposed in which it is determined that the public key has expired.

  According to this invention, when the revocation confirmation execution means of the service providing server holds that e (fy1, y2) = e (fy2, y1) is established for all public keys y1, y2 listed in the revocation list. Judge that the public key has expired. Therefore, since the verification related to the revocation check is performed by using the characteristics of the pairing calculation, an accurate check process can be performed in a short time.

  (6) The present invention is an attribute authentication method in an attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network, wherein the user terminal has two secrets. First step of generating keys x1 and x2 and generating public keys y1 and y2 and another secret key Y from these secret keys (corresponding to steps S201 in FIG. 5 and steps S301 and S302 in FIG. 6) A second step in which the attribute certificate issuing server signs the public keys y1, y2, and Y generated by the user terminal with a signature key possessed by the attribute certificate issuing server; {Y1, zy1}, {y2, zy2}, {Y, zY}, where z is the signature private key and zP is the corresponding private key (P is the source) The A third step (corresponding to steps S202, S203, S204 in FIG. 5 and step S303 in FIG. 6) issued as a personality certificate, and a fourth step in which the user terminal transmits a service provision request to the service provision server. 5 (corresponding to step S205 in FIG. 5 and step S304 in FIG. 6), and a fifth step in which the service providing server generates a random number r and transmits it to the user terminal (step S206 in FIG. 5, FIG. 6). 6) (corresponding to step S207 in FIG. 5 and step S306 in FIG. 6) in which the user terminal transforms the attribute certificate issued by the attribute certificate issuing server, The user terminal modifies the generated two secret keys x1 and x2, and uses the deformed secret keys fx1 and fx2 to provide the service A seventh step of calculating two signature values for the random number r received from the server (corresponding to step S208 in FIG. 5), and providing the service by the user terminal with the modified attribute certificate and the calculated signature value. An eighth step (corresponding to step S209 in FIG. 5 and step S307 in FIG. 6) to be transmitted to the server, and a ninth step in which the service providing server verifies the attribute certificate received from the user terminal (FIG. 5). Step S210 of FIG. 6 and step S308 of FIG. 6), and the service providing server verifies the two signature values received from the user terminal (step S211 of FIG. 5 and step S308 of FIG. 6). And the service providing server executes the revocation confirmation in an eleventh step (step S212 in FIG. 5 and step S309 in FIG. 6). When the validity of the attribute certificate is confirmed, the validity of the two signature values is confirmed, and the revocation confirmation is completed, the service providing server notifies the user terminal of the attribute information. Proposed an attribute authentication method comprising a twelfth step (corresponding to step S213 in FIG. 5 and step S310 in FIG. 6) for providing a service based on the above.

  According to this invention, the user terminal generates two secret keys x1 and x2, and also generates public keys y1 and y2 and another secret key Y from these secret keys. The public keys y1, y2, and Y generated by the user terminal are signed with the signature keys that are held. The attribute certificate issuing server sets {y1, zy1}, {y2, zy2 to the user terminal when the signature private key is z and the corresponding private key is zP (P is a generation source). }, {Y, zY} are issued as attribute certificates, and the user terminal transmits a service provision request to the service provision server. The service providing server generates a random number r, transmits it to the user terminal, and the user terminal transforms the attribute certificate issued by the attribute certificate issuing server. The user terminal modifies the generated two secret keys x1 and x2, uses the modified secret keys fx1 and fx2, calculates two signature values for the random number r received from the service providing server, and modifies the attribute certificate And the calculated signature value are transmitted to the service providing server. The service providing server verifies the attribute certificate received from the user terminal, verifies the two signature values received from the user terminal, and then executes revocation confirmation. Then, when the validity of the attribute certificate is confirmed, the validity of the two signature values is confirmed, and the revocation confirmation is completed, the service providing server sends a service based on the attribute information to the user terminal. To provide. Therefore, without making an inquiry to a third party, even if the tamper resistant device is not provided on the user side, it is possible to confirm the revocation while ensuring safety.

  (7) The present invention is a program for causing a computer to execute an attribute authentication method in an attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network. The user terminal generates two secret keys x1 and x2, and also generates a public key y1 and y2 and another secret key Y from these secret keys (step S201 in FIG. 5, FIG. 6). Step S301 and S302), and the attribute certificate issuance server signs the public keys y1, y2, and Y generated by the user terminal with a signature key possessed, When the attribute certificate issuing server sets the signature private key to z and the corresponding private key to zP (P is a generation source), {y1, a third step (corresponding to steps S202, S203, S204 in FIG. 5 and step S303 in FIG. 5) for issuing y1}, {y2, zy2}, {Y, zY} as attribute certificates; A fourth step of transmitting a service provision request to the service providing server (corresponding to step S205 in FIG. 5 and step S304 in FIG. 6), and the service providing server generates a random number r and sends it to the user terminal. A fifth step of transmission (corresponding to step S206 in FIG. 5 and step S305 in FIG. 6) and a sixth step in which the user terminal transforms the attribute certificate issued by the attribute certificate issuing server (FIG. 5) Step S207, which corresponds to step S306 in FIG. 6), and the user terminal modifies the generated two secret keys x1 and x2, and the modified secret A seventh step (corresponding to step S208 in FIG. 5) for calculating two signature values for the random number r received from the service providing server using fx1 and fx2, and the user terminal An eighth step (corresponding to step S209 in FIG. 5 and step S307 in FIG. 6) for transmitting the calculated signature value to the service providing server, and the attribute certificate received from the user terminal by the service providing server. A ninth step (corresponding to step S210 in FIG. 5 and step S308 in FIG. 6) to be verified, and a tenth step (in FIG. 5) that the service providing server verifies the two signature values received from the user terminal. Step S211, corresponding to Step S308 in FIG. 6), and an eleventh step (FIG. 5) in which the service providing server executes revocation confirmation. Step S212, corresponding to Step S309 in FIG. 6), and when the service providing server confirms the validity of the attribute certificate, confirms the validity of the two signature values, and completes the revocation confirmation, Proposing a program for causing a computer to execute a twelfth step (corresponding to step S213 in FIG. 5 and step S310 in FIG. 6) for providing a service based on attribute information to the user terminal. Yes.

  According to this invention, the user terminal generates two secret keys x1 and x2, and also generates public keys y1 and y2 and another secret key Y from these secret keys. The public keys y1, y2, and Y generated by the user terminal are signed with the signature keys that are held. The attribute certificate issuing server sets {y1, zy1}, {y2, zy2 to the user terminal when the signature private key is z and the corresponding private key is zP (P is a generation source). }, {Y, zY} are issued as attribute certificates, and the user terminal transmits a service provision request to the service provision server. The service providing server generates a random number r, transmits it to the user terminal, and the user terminal transforms the attribute certificate issued by the attribute certificate issuing server. The user terminal modifies the generated two secret keys x1 and x2, uses the modified secret keys fx1 and fx2, calculates two signature values for the random number r received from the service providing server, and modifies the attribute certificate And the calculated signature value are transmitted to the service providing server. The service providing server verifies the attribute certificate received from the user terminal, verifies the two signature values received from the user terminal, and then executes revocation confirmation. Then, when the validity of the attribute certificate is confirmed, the validity of the two signature values is confirmed, and the revocation confirmation is completed, the service providing server sends a service based on the attribute information to the user terminal. To provide. Therefore, without making an inquiry to a third party, even if the tamper resistant device is not provided on the user side, it is possible to confirm the revocation while ensuring safety.

  According to the present invention, there is an effect that it is possible to confirm the revocation while ensuring safety even when a tamper-resistant device is not provided on the user side without making an inquiry to a third party. Therefore, even if the user terminal is not equipped with a tamper resistant device, privacy protection when exchanging attribute information is realized. Further, there is an effect that only a specific service provider can perform attribute verification.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<System configuration of attribute authentication system>
FIG. 1 is a diagram illustrating an example of a system configuration of an attribute authentication system according to an embodiment of the present invention.
As shown in FIG. 1, the attribute authentication system according to the present embodiment includes a user terminal 1, a service providing server (hereinafter simply referred to as an SP server 2) managed and operated by a service provider, and an attribute certificate authority (CA). The attribute certificate authority server 3 that is managed and operated is connected via the network 4.

  The user terminal 1 includes an attribute authentication client module 10, the SP server 2 includes an attribute authentication server module 20, and the attribute authentication server 3 includes an attribute certificate issuance module 30.

  Further, the attribute authentication client module 10 includes a key generation unit 11, an attribute certificate transformation unit 12, a processing unit 13, and a transmission unit 14, as shown in FIG.

  The key generation unit 11 generates two secret keys x1 and x2, and generates a public key y1 and y2 and another secret key Y from these secret keys. The attribute certificate transformation unit 12 transforms the attribute certificate issued by the attribute certificate issuing server.

  The processing unit 13 modifies the two secret keys x1 and x2 generated by the key generation unit 11, and calculates two signature values for the random number r received from the SP server 2 using the modified secret keys fx1 and fx2. . The transmission unit 14 transmits a service provision request, the attribute certificate transformed by the attribute certificate transformation unit 12, and the signature value calculated by the processing unit 13 to the SP server 2.

  Further, as shown in FIG. 3, the attribute authentication server module 20 includes an attribute certificate verification unit 21, a signature value verification unit 22, a revocation check execution unit 23, a service provision unit 24, a transmission unit 25, a random number, The generating unit 26 is configured.

  The attribute certificate verification unit 21 verifies the attribute certificate received from the user terminal 1. The signature value verification unit 22 verifies two signature values received from the user terminal 1. The revocation confirmation execution unit 23 executes revocation confirmation.

  When the validity of the attribute certificate is confirmed, the validity of the two signature values is confirmed, and the revocation confirmation is completed, the service providing unit 24 provides the service based on the attribute information to the user terminal 1 To provide. The transmission unit 25 generates a random number r and transmits it to the user terminal 1. The random number generation unit 26 generates a random number r to be transmitted as a challenge to the user terminal 1.

  As shown in FIG. 4, the attribute certificate issuance module 30 includes a signature unit 31, an attribute certificate issuance unit 32, and a transmission unit 33.

  The signature unit 31 signs the public keys y1, y2, and Y generated by the key generation unit 11 of the user terminal 1 with the signature keys that are held. The attribute certificate issuing unit 32 gives {y1, zy1}, {y2 to the user terminal 1 where z is a secret key for signature and zP (P is a generation source) corresponding to the signature secret key. , Zy2}, {Y, zY} are issued as attribute certificates. The transmitting unit 33 transmits the attribute certificate issued by the attribute certificate issuing unit 32 to the user terminal 1.

<Operation sequence of attribute authentication system>
FIG. 5 is an operation sequence diagram showing the operation flow of the entire attribute authentication system according to the embodiment of the present invention in time series, and FIG. 6 is a flowchart showing the operation flow of the user terminal. . The operation sequence diagram shown in FIG. 5 also shows the procedure of the attribute information anonymization method in the attribute authentication system of the present invention.
The operation of the attribute authentication system shown in FIG. 1 will be described in detail below with reference to FIGS.

First, the key generation unit 11 of the user terminal 1 generates user secret keys x1 and x2 and public keys y1 = x1 * P and y2 = x2 * P, calculates x1 + x2, and uses Y as a public key. = (X1 + x2) P
(Step S201 in FIG. 5, Steps S301 and S302 in FIG. 6). Here, P is a generation source. Then, the transmission unit 14 of the user terminal 1 transmits an attribute certificate issuance request to the attribute certificate authority server 3 (step S202 in FIG. 5).

  The attribute certificate authority server 3 signs the public keys y1, y2, and Y with the attribute signature key possessed by the attribute certificate authority server 3. Note that the signature key with the longest validity period is used (see FIG. 7). The signature is zy1, zy2, and zY, where z is the private key for signature and zP is the corresponding public key.

  Then, {y1, zy1}, {y2, zy2}, and {Y, zY} are issued to the user terminal 1 as certificates. Further, as long as the issued user's private keys x1 and x2 are within the validity period, y1, y2 and Y are stored (steps S203 and S204 in FIG. 5 and step S303 in FIG. 6).

  FIG. 7 conceptually shows how to manage the effective period. In FIG. 7, t on the horizontal axis indicates the flow of time. According to the present invention, since the attribute information is only key information, it is necessary to manage a new effective period. For this reason, as shown in FIG. 4, the attribute certificate issuing module 31 of the attribute authority server 3 assigns a plurality of signature keys for each attribute, and manages the validity period by periodically updating the combination. I have decided. At that time, a plurality of title keys assigned for each attribute are managed in parallel so that a user who can enjoy the service only for a very short period does not occur.

  In order to assign the signature key having the longest valid period, for example, as shown in FIG. 7, if the key is to be assigned in the latter half of the usage period of the key A, the attribute certification authority server 3 The attribute certificate issuing module 31 assigns the signature key D or the signature key E to the attribute authentication client module 11 of the user terminal 1. Thereby, the inconvenience that the user can receive the service for a very short period can be prevented.

  Next, the transmission unit 14 of the user terminal 1 transmits a service provision request to the SP server 2 (step S205 in FIG. 5 and step S304 in FIG. 6). In response to this, the SP server 2 generates a random number r and transmits it as a challenge from the transmission unit 25 to the user terminal 1 (step S206 in FIG. 5 and step S305 in FIG. 6).

  The attribute certificate transformation unit 12 of the user terminal 1 transforms the received attribute certificate (step S207 in FIG. 5 and step S306 in FIG. 6). Specifically, a random number f is generated and transformed into {fy1, fzy1}, {fy2, fzy2}, {fY, fzY}. In this calculation, all use the same f. Thereby, fraudulent acts can be prevented.

At this time, the secret key is also transformed into fx1 and fx2. Then, two signature values for r are calculated using fx1 and fx2 (step S208 in FIG. 5). Here, for each signature process, for example, the ElGamal signature performs the following calculation.
u = g ^k
s = k ⁻¹ (h (r) −x1fu) modp−1

  The transmission unit 14 of the user terminal 1 returns the modified attribute certificate and the calculated signature value to the SP server 2 (step S209 in FIG. 5 and step S306 in FIG. 6).

  The attribute certificate verification unit 21 of the SP server 2 verifies the sent attribute certificate (step S210 in FIG. 5 and step S308 in FIG. 6). Here, Pairing calculation is used for verification. Specifically, when the pairing calculation is represented by e (*, *), e (fy1, zP) = e (zfy1, P), e (fy2, zP) = e (fzy2, P), e ( It is verified whether three conditions of zfy1, zP) e (zfy2, zP) = e (zfY, P) are satisfied.

  Here, zP is a public key for issuing attributes. As a result, since the verification regarding the validity of the attribute certificate is performed by using the characteristics of the pairing calculation, an accurate verification process can be performed in a short time.

Next, the signature value verification unit 22 of the SP server 2 verifies the two sent signatures (step S211 in FIG. 5 and step S308 in FIG. 6). At this time, for example, the ElGamal signature performs the following calculation.
g ^{h (r)} ≡ y ^r r ^s

  Further, the revocation confirmation execution unit 23 of the SP server 2 performs revocation confirmation (step S212 in FIG. 5 and step S309 in FIG. 6). Here, when revocation confirmation is performed, a revocation list is acquired from the attribute authority server 3 in advance or on the spot. The revocation list is generated by the attribute certificate authority server 3, and public keys y1 and y2 of revoked users are disclosed.

  If the user wants to revoke his / her public key, he / she applies to the attribute authority server 3 and has y1 and y2 disclosed. The revocation list is given a signature by the attribute certificate authority server 3, and its validity can be confirmed. The revocation check verifies whether e (fy1, y2) = e (fy2, y1) holds for all y1, y2 on the revocation list. When this equation is established, it is determined that the key has expired. Therefore, since the verification related to the revocation check is performed by using the characteristics of the pairing calculation, an accurate check process can be performed in a short time.

  The SP server 2 determines that the authentication is successful when the certificate validity check, the signature validity check, and the revocation check are completed, and the service providing unit 24 of the SP server 2 The service is provided based on the attribute information (step S213 in FIG. 5 and step S310 in FIG. 6).

  The specific use of the attribute authentication system and the anonymization method in the system is as follows. In the disclosure of medical information, confirmation of medical qualification or publicly issued by public transportation. It can be used for confirming qualifications such as Silver Pass.

  As described above, in the present embodiment, it is possible to check the revocation while ensuring safety even if the tamper resistant device is not provided on the user side without inquiring a third party. be able to.

  The attribute authentication client module 10, the attribute authentication server module 20, and the attribute certificate issuance module 30 shown in FIG. 1 are programs executed by the user terminal 1, the SP server 2, and the attribute certificate authority server 3, respectively. These programs are recorded on a computer-readable recording medium, and the programs recorded on the recording medium are read into the user terminal 1, the SP server 2, and the attribute certification authority server 3 (all are computer systems) and executed. Thus, the attribute authentication system of the present invention can be realized. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention. For example, in the present embodiment, the mode in which the attribute certification authority server 3 executes the revocation checking process has been described. However, a server that performs the revocation checking process may be provided separately from the attribute certification authority server 3.

It is a figure which shows an example of the system configuration | structure of the attribute authentication system which concerns on embodiment of this invention. It is a block diagram of the attribute authentication client module which concerns on embodiment of this invention. It is a block diagram of the attribute authentication server module which concerns on embodiment of this invention. It is a block diagram of the attribute certificate issuing module which concerns on embodiment of this invention. It is a figure which shows the operation sequence of the whole attribute authentication system which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the user terminal in the attribute authentication system which concerns on embodiment of this invention. It is the operation | movement conceptual diagram quoted in order to demonstrate the management method of the effective period of the attribute information of the attribute authentication system which concerns on embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... User terminal, 2 ... Service provision server (SP server), 3 ... Attribute certification authority server, 4 ... Network, 10 ... Attribute authentication client module, 11 ... Key generation part , 12 ... attribute certificate transformation unit, 13 ... processing unit, 14 ... transmission unit, 20 ... attribute authentication server module, 21 ... attribute certificate verification unit, 22 ... signature value Verification unit, 23 ... Revocation confirmation execution unit, 24 ... Service providing unit, 25 ... Transmission unit, 26 ... Random number generation unit, 30 ... Attribute certificate issuing module, 31 ... Signature Part, 32 ... attribute certificate issuing part, 33 ... transmission part

Claims (7)

An attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network,
The user terminal is
Generating means for generating two secret keys x1 and x2 and generating public keys y1 and y2 and another secret key Y from these secret keys;
First transmission means for transmitting a service provision request to the service provision server;
Deformation means for deforming the attribute certificate issued by the attribute certificate issuing server;
Processing means for modifying the generated two secret keys x1, x2 and calculating two signature values for the random number r received from the service providing server using the modified secret keys fx1, fx2;
Second transmission means for transmitting the attribute certificate modified by the modification means and the signature value calculated by the processing means to the service providing server;
With
The attribute certificate issuing server is
Signing means for signing with the signature key possessed against the public keys y1, y2, Y generated by the generating means of the user terminal;
{Y1, zy1}, {y2, zy2}, {Y, zY, where z is a signature secret key and zP is a corresponding secret key (P is a generation source). } Issuing means as an attribute certificate;
With
The service providing server is
Third transmission means for generating a random number r and transmitting it to the user terminal;
First verification means for verifying the attribute certificate received from the user terminal;
Second verification means for verifying two signature values received from the user terminal;
Revocation check execution means for executing revocation check;
When the validity of the attribute certificate is confirmed by the first verification means, the validity of the two signature values is confirmed by the second verification means, and the revocation confirmation is completed by the revocation confirmation execution means Service providing means for providing a service based on attribute information to the user terminal;
An attribute authentication system characterized by comprising:   2. The attribute authentication system according to claim 1, wherein the attribute certificate issuing server uses a signature key having the longest validity period among signature keys currently valid in the signature by the signing means.   The deforming means of the user terminal generates one random number f, and using this random number f, all the attribute certificates issued by the attribute certificate issuing server are {fy1, fzy1}, {fy2, fzy2}, The attribute authentication system according to claim 1, wherein the attribute authentication system is modified as {fY, fzY}.   When the first verification means of the service providing server uses zP as the attribute issuing public key, e (fy1, zP) = e (zfy1, P), e (fy2, The validity of the attribute certificate is verified based on whether or not three conditional expressions of zP) = e (fzy2, P), e (zfy1, zP) e (zfy2, zP) = e (zfY, P) are satisfied. The attribute authentication system according to claim 3, wherein:   When the revocation confirmation executing means of the service providing server establishes e (fy1, y2) = e (fy2, y1) for all public keys y1, y2 listed in the revocation list, The attribute authentication system according to claim 1, wherein the attribute authentication system is determined to have expired. An attribute authentication method in an attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network,
A first step in which the user terminal generates two secret keys x1 and x2, and generates a public key y1 and y2 and another secret key Y from these secret keys;
A second step in which the attribute certificate issuing server signs a public key y1, y2, Y generated by the user terminal with a signature key possessed;
When the attribute certificate issuing server sets z as a signature private key and zP (P is a generation source) corresponding to the signature private key for the user terminal, {y1, zy1}, {y2 , Zy2}, {Y, zY} as attribute certificates,
A fourth step in which the user terminal transmits a service provision request to the service provision server;
A fifth step in which the service providing server generates a random number r and transmits it to the user terminal;
A sixth step in which the user terminal transforms the attribute certificate issued by the attribute certificate issuing server;
The user terminal modifies the generated two secret keys x1 and x2, and uses the modified secret keys fx1 and fx2 to calculate two signature values for the random number r received from the service providing server. And the steps
An eighth step in which the user terminal transmits the transformed attribute certificate and the calculated signature value to the service providing server;
A ninth step in which the service providing server verifies the attribute certificate received from the user terminal;
A tenth step in which the service providing server verifies two signature values received from the user terminal;
An eleventh step in which the service providing server executes revocation confirmation;
When the service providing server confirms the validity of the attribute certificate, confirms the validity of the two signature values, and completes the revocation confirmation, a service based on the attribute information is provided to the user terminal. A twelfth step of providing
An attribute authentication method comprising: A program for causing a computer to execute an attribute authentication method in an attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network,
A first step in which the user terminal generates two secret keys x1 and x2, and generates a public key y1 and y2 and another secret key Y from these secret keys;
A second step in which the attribute certificate issuing server signs a public key y1, y2, Y generated by the user terminal with a signature key possessed;
When the attribute certificate issuing server sets z as a signature private key and zP (P is a generation source) corresponding to the signature private key for the user terminal, {y1, zy1}, {y2 , Zy2}, {Y, zY} as attribute certificates,
A fourth step in which the user terminal transmits a service provision request to the service provision server;
A fifth step in which the service providing server generates a random number r and transmits it to the user terminal;
A sixth step in which the user terminal transforms the attribute certificate issued by the attribute certificate issuing server;
The user terminal modifies the generated two secret keys x1 and x2, and uses the modified secret keys fx1 and fx2 to calculate two signature values for the random number r received from the service providing server. And the steps
An eighth step in which the user terminal transmits the transformed attribute certificate and the calculated signature value to the service providing server;
A ninth step in which the service providing server verifies the attribute certificate received from the user terminal;
A tenth step in which the service providing server verifies two signature values received from the user terminal;
An eleventh step in which the service providing server executes revocation confirmation;
When the service providing server confirms the validity of the attribute certificate, confirms the validity of the two signature values, and completes the revocation confirmation, a service based on the attribute information is provided to the user terminal. A twelfth step of providing
A program that causes a computer to execute.

Images