JP5139030B2 - Attribute authentication system, attribute authentication method and program in the same system - Google Patents

Description

  The present invention relates to an attribute authentication system, an attribute authentication method and a program in the system, and in particular, ensures safety even when a tamper-resistant device is not provided on the user side without making an inquiry to a third party. In addition, the present invention relates to an attribute authentication system that enables revocation confirmation and achieves Forward Security while reducing the calculation load, and an attribute authentication method and program in the system.

In recent years, various services have been provided electronically through the Internet. When providing such a service, it is essential to authenticate the user. Here, a method for authenticating a user is generally classified into authentication for specifying an individual and authentication for not specifying an individual such as attribute authentication (for example, see Patent Document 1).
Japanese Patent Publication No. 8-2051

  By the way, in the conventional attribute authentication, the anonymity of attribute information was not considered. In addition, some research for anonymization has been made, but the content is insufficient, and further, communication with a third party is required when performing attribute authentication. For this reason, since attribute information cannot be transformed, communication may be observed by a third party, and user behavior may be traced, and a problem regarding privacy protection remains as a technical problem.

  On the other hand, in the anonymous authentication method considering the anonymity of the attribute information, it is necessary to provide a tamper resistant device on the user terminal side. Furthermore, the revocation check process is difficult, and it is necessary to make an inquiry to a third party at the time of revocation check. Furthermore, once the revocation information is disclosed, all communication histories are stored. There was a problem that an attacker could trace user behavior.

  Therefore, the present invention has been made in view of the above circumstances, and without being inquired to a third party, even if a tamper-resistant device is not provided on the user side, it is invalidated while ensuring safety. An object of the present invention is to provide an attribute authentication system, an attribute authentication method and a program in the system, which enable confirmation and reduce the calculation load while achieving Forward Security.

The present invention proposes the following items in order to solve the above-described problems.
(1) The present invention is an attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network, and the user terminal has two secret keys x1, x2 And a first key generation means (for example, corresponding to the key generation unit 11 in FIG. 2) for generating public keys y1 and y2 from these secret keys and a service provision request to the service provision server First transmission means (for example, corresponding to the transmission unit 14 in FIG. 2), and a deformation means for generating a random number f and transforming the attribute certificate issued by the attribute certificate issuing server using the random number f (For example, equivalent to the attribute certificate transformation unit 12 in FIG. 2), the two secret keys x1 and x2 are transformed into fx1 and fx2 by a random number f, and the service provision is performed using the transformed fx1 and fx2 server Processing means (e.g., corresponding to the processing unit 13 of FIG. 2) for the received challenge, the attribute certificate transformed by the transformation means, and the signature value computed by the processing means A second transmission means (for example, corresponding to the transmission unit 14 in FIG. 2), and the attribute certificate issuing server holds the public key generated by the user terminal generation means A signing means (for example, corresponding to the signing unit 31 in FIG. 4) for signing with a signing key, and z for the user terminal, and zP (P is a generator) ), Issuing means (e.g., equivalent to the attribute certificate light emitting unit 32 in FIG. 4) that issues {y1, y2, z (y1 + y2)} as attribute certificates. , Own secret a second key generation unit (e.g., corresponding to the key generation unit 25 in FIG. 3) that generates x3 and public key y3 (= x3 * P), and a challenge calculated based on the generated random number r to the user terminal Third transmitting means for transmitting (for example, corresponding to the transmitting section 27 in FIG. 3) and first verifying means for verifying the attribute certificate received from the user terminal (for example, the attribute certificate verifying section 21 in FIG. 3). ), Second verification means for verifying the signature value received from the user terminal (for example, equivalent to the signature value verification unit 22 in FIG. 3), and revocation confirmation execution means for executing revocation confirmation (for example, FIG. 3), the validity of the attribute certificate is confirmed by the first verification means, the validity of the signature value is confirmed by the second verification means, and the revocation confirmation is confirmed. When the revocation check is completed by the execution means, Proposing an attribute authentication system comprising service providing means (for example, corresponding to the service providing unit 22 in FIG. 3) for providing a service based on attribute information to the user terminal. Yes.

  According to this invention, the first key generation means of the user terminal generates two secret keys x1 and x2, and generates public keys y1 and y2 from these secret keys. The first transmission means transmits a service provision request to the service provision server. The deformation means generates a random number f and uses the random number f to deform the attribute certificate issued by the attribute certificate issuing server. The processing means transforms the two secret keys x1 and x2 into fx1 and fx2 using the random number f, and calculates the signature value for the challenge received from the service providing server using the modified fx1 and fx2. The second transmitting unit transmits the attribute certificate deformed by the deforming unit and the signature value calculated by the processing unit to the service providing server. The signing means of the attribute certificate issuing server signs the public key generated by the generating means of the user terminal with the signature key held. The issuing means, for the user terminal, uses {y1, y2, z (y1 + y2)} as the attribute proof when the signature private key is z and the corresponding public key is zP (P is the generation source). Issue as a certificate. The second key generation means of the service providing server generates its own private key x3 and public key y3 (= x3 * P). The third transmission means transmits the challenge calculated based on the generated random number r to the user terminal. The first verification unit verifies the attribute certificate received from the user terminal. The second verification unit verifies the signature value received from the user terminal. The revocation confirmation execution means executes revocation confirmation. When the validity of the attribute certificate is confirmed by the first verification means, the validity of the signature value is confirmed by the second verification means, and the revocation confirmation is completed by the revocation confirmation execution means The service based on the attribute information is provided to the user terminal. Therefore, without making an inquiry to a third party, even if a tamper-resistant device is not provided on the user side, it is possible to check the revocation while ensuring safety. In addition, since the service provider generates individual secret keys and public keys, the information returned from the user terminal can be made different for each service provider. Therefore, it is possible to prevent a third party from tracing the user's behavior from the communication history before the time when the revocation information is disclosed.

  (2) In the attribute authentication system according to (1), the attribute certificate issuing server uses a signature key with the longest validity period among signature keys currently valid in the signature by the signature unit. We have proposed an attribute authentication system characterized by

  According to the present invention, the signature key having the longest validity period is used among the currently valid signature keys. Therefore, the inconvenience that the user can receive the service for a very short period can be prevented.

  (3) In the attribute authentication system according to (1), the signing unit of the attribute certificate issuing server adds the public keys y1 and y2 generated by the first key generating unit of the user terminal. We have proposed an attribute authentication system characterized by signing things with a signature key.

  According to this invention, the signature means of the attribute certificate issuing server signs the public key y1, y2 generated by the first key generation means of the user terminal with the signature key that is held. Thereby, only necessary and sufficient information can be given to the user, and the user's fraud can be prevented. In addition, since the calculation load can be reduced, the calculation speed can be increased.

  (4) In the attribute authentication system according to (1), the service providing server generates a random number r and calculates r * y3 obtained by multiplying the random number r by the generated public key y3. An attribute authentication system characterized in that the challenge is generated.

  According to this invention, the service providing server generates a random number r and calculates a challenge by calculating r * y3 obtained by multiplying the random number r by the generated public key y3. That is, a public key y3 (= x3 * P) that is different for each service provider is embedded in the challenge, and a signature is returned from the user terminal in response to this challenge. An unknown third party cannot trace the user's behavior from the communication history before the time when the revocation information is disclosed.

  (5) In the attribute authentication system according to (4), the processing unit of the user terminal uses the secret keys fx1 and fx2 transformed by the random number f generated by the transformation unit, and the challenge r An attribute authentication system is proposed in which a signature value for * y3 is calculated by s1 = f * x1 * r * y3 and s2 = f * x2 * r * y3.

  According to the present invention, the processing means of the user terminal uses the secret keys fx1 and fx2 transformed by the random number f generated by the transformation means to set the signature value for the challenge r * y3 to s1 = f * x1 * r * y3. , S2 = f * x2 * r * y3. Therefore, since the signature value is calculated using the simple calculation formula as described above, the calculation load can be reduced.

  (6) In the attribute authentication system according to (1), when the first verification unit of the service providing server uses zP as a public key for issuing an attribute, e (f (y1 + y2), We have proposed an attribute authentication system characterized by calculating zP) = e (fz (y1 + y2), P) and verifying the validity of the attribute certificate depending on whether or not the calculation formula is satisfied.

  According to the present invention, when the first verification unit of the service providing server uses zP as a public key for attribute issuance, e (f (y1 + y2), zP) = e (fz (y1 + y2), P) The validity of the attribute certificate is verified based on whether or not the arithmetic expression is satisfied. Therefore, since the attribute certificate consisting of {y1, y2, z (y1 + y2)} transmitted from the user terminal can be collectively verified by the above arithmetic expression, the calculation load can be reduced.

(7) The present invention provides the attribute authentication system according to (5), wherein the second verification unit of the service providing server is e (s1, P) e (s2,
P) = e (f * (y1 + y2), r * y3) is calculated, and an attribute authentication system is proposed that verifies the validity of a signature based on whether or not the calculation formula is satisfied. .

  According to the present invention, the second verification unit of the service providing server calculates e (s1, P) e (s2, P) = e (f * (y1 + y2), r * y3), and the arithmetic expression is The validity of the signature is verified depending on whether it is established. Therefore, since the signature value is calculated using the simple calculation formula as described above, the calculation load can be reduced.

  (8) According to the present invention, in the attribute authentication system according to (5), the revocation check execution means of the service providing server calculates r * x3 * y1 for all y1 listed in the revocation list. , E (z (y1 + y2), s1) = e (f * z * (y1 + y2), r * x3 * y1), and the revocation check is executed depending on whether the arithmetic expression is satisfied. An attribute authentication system is proposed.

  According to this invention, the revocation confirmation execution means of the service providing server calculates r * x3 * y1 for all y1s listed in the revocation list and e (z (y1 + y2), s1) = e ( By calculating f * z * (y1 + y2), r * x3 * y1), revocation confirmation is executed depending on whether or not the arithmetic expression is satisfied. Therefore, the revocation list cannot be traced by a third party who does not know the service provider's private key x3 and can easily trace the user's behavior from the communication history before the revocation information was disclosed. Confirmation processing can be realized.

  (9) In the attribute authentication system according to (1), the attribute certificate issuing server publishes y1, z (y1 + y2) or y2, z (y1 + y2) of the revoked user in the revocation list. We have proposed an attribute authentication system characterized by

  According to this invention, the attribute certificate issuance server publishes y1, z (y1 + y2) or y2, z (y1 + y2) of the revoked user in the revocation list. As a result, y1, z (y1 + y2) or y2, z (y1 + y2) is not disclosed, but the past history is prevented from being traced from the disclosed information. Can be secured.

  (10) The present invention is an attribute authentication method in an attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network, wherein the user terminal has two secrets. A first step of generating keys x1 and x2 and public keys y1 and y2 from these secret keys (e.g., corresponding to step S201 in FIG. 5 and step S301 in FIG. 6), and issuing the attribute certificate A second step (for example, corresponding to step S302 in FIG. 6) in which the server signs the public key generated by the user terminal with the signature key that is held, and the attribute certificate issuing server is the user {Y1, y2, z (y1 + y2)} is an attribute certificate, where z is a signature private key and zP is a public key corresponding to the terminal (P is a generation source). The third step issued (for example, corresponding to steps S203 and S204 in FIG. 5 and step S303 in FIG. 6), and the service providing server has its own private key x3 and public key y3 (= x3 * P) A fourth step (for example, corresponding to step S205 in FIG. 5) and a fifth step (for example, step S208 in FIG. 5) in which the user terminal transmits a service provision request to the service provision server. 6) (corresponding to step S304 in FIG. 6) and a sixth step (for example, step S209 in FIG. 5, step S209 in FIG. 6) in which the service providing server transmits a challenge calculated based on the generated random number r to the user terminal. S305), and the user terminal generates a random number f and uses the random number f to issue an attribute certificate issued by the attribute certificate issuing server. A seventh step (for example, equivalent to step S210 in FIG. 5 and step S306 in FIG. 6) to be transformed, and the user terminal transforms the two secret keys x1 and x2 into fx1 and fx2 by the random number f. The eighth step (for example, corresponding to step S211 in FIG. 5) for calculating the signature value for the challenge received from the service providing server using the modified fx1 and fx2, and the modified attribute by the user terminal A ninth step (for example, corresponding to step S212 in FIG. 5 and step S307 in FIG. 6) for transmitting the certificate and the calculated signature value to the service providing server, and the service providing server receives from the user terminal A tenth step (for example, equivalent to step S213 in FIG. 5 and step S308 in FIG. 6) for verifying the attribute certificate The service providing server verifies the signature value received from the user terminal (for example, equivalent to step S214 in FIG. 5 and step S308 in FIG. 6), and the service providing server performs revocation confirmation. The validity of the attribute certificate is confirmed by the twelfth step (e.g., corresponding to step S215 of FIG. 5 and step S309 of FIG. 6) and the tenth step, and the signature value is validated by the eleventh step. 13th step (for example, step S216 in FIG. 5 and step in FIG. 6) for providing a service based on the attribute information to the user terminal when the validity is confirmed and the revocation confirmation is completed. And an attribute authentication method characterized by comprising

  According to the present invention, the user terminal generates two secret keys x1 and x2, and generates public keys y1 and y2 from these secret keys. The attribute certificate issuing server signs the public key generated by the user terminal with the signature key that it holds. The attribute certificate issuing server gives {y1, y2, z (y1 + y2)} to the user terminal, where z is a signature private key and zP is a public key corresponding thereto (P is a generation source). Is issued as an attribute certificate. The service providing server generates its own secret key x3 and public key y3 (= x3 * P). The user terminal transmits a service provision request to the service provision server. The service providing server transmits a challenge calculated based on the generated random number r to the user terminal. The user terminal generates a random number f and uses the random number f to transform the attribute certificate issued by the attribute certificate issuing server. The user terminal transforms the two secret keys x1 and x2 into fx1 and fx2 using the random number f, and calculates a signature value for the challenge received from the service providing server using the modified fx1 and fx2. The user terminal transmits the modified attribute certificate and the calculated signature value to the service providing server. The service providing server verifies the attribute certificate received from the user terminal. The service providing server verifies the signature value received from the user terminal. The service providing server performs revocation confirmation. When the validity of the attribute certificate is confirmed, the validity of the signature value is confirmed, and the revocation confirmation is completed, a service based on the attribute information is provided to the user terminal. Therefore, without making an inquiry to a third party, even if a tamper-resistant device is not provided on the user side, it is possible to check the revocation while ensuring safety. In addition, since the service provider generates individual secret keys and public keys, the information returned from the user terminal can be made different for each service provider. Therefore, it is possible to prevent a third party from tracing the user's behavior from the communication history before the time when the revocation information is disclosed.

  (11) The present invention is a program for causing a computer to execute an attribute authentication method in an attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network. The user terminal generates two secret keys x1 and x2, and also generates a public key y1 and y2 from these secret keys (for example, corresponding to step S201 in FIG. 5 and step S301 in FIG. 6). ), A second step (for example, corresponding to step S302 in FIG. 6) in which the attribute certificate issuing server signs a public key generated by the user terminal with a signature key possessed, and the attribute When the certificate issuing server sets the signature private key to z and the corresponding public key to zP (P is a generation source) for the user terminal, { 1, y 2, z (y 1 + y 2)} as an attribute certificate (for example, equivalent to steps S 203 and S 204 in FIG. 5 and step S 303 in FIG. 6), and the service providing server has its own secret A fourth step of generating the key x3 and the public key y3 (= x3 * P) (for example, corresponding to step S205 in FIG. 5), and the user terminal transmitting a service provision request to the service provision server And a sixth step (for example, corresponding to step S208 in FIG. 5 and step S304 in FIG. 6) and a challenge calculated by the service providing server based on the generated random number r to the user terminal ( For example, it corresponds to step S209 in FIG. 5 and step S305 in FIG. 6), and the user terminal generates a random number f and uses the random number f to A seventh step (for example, equivalent to step S210 in FIG. 5 and step S306 in FIG. 6) for transforming the attribute certificate issued by the attribute certificate issuing server, and the user terminal uses the random number f to The secret key x1, x2 is transformed into fx1, fx2, and the signature value for the challenge received from the service providing server is calculated using the transformed fx1, fx2 (for example, in step S211 in FIG. 5). And a ninth step (for example, corresponding to step S212 in FIG. 5 and step S307 in FIG. 6) in which the user terminal transmits the deformed attribute certificate and the calculated signature value to the service providing server; The tenth step in which the service providing server verifies the attribute certificate received from the user terminal (for example, step S2 in FIG. 5). 13 and corresponding to step S308 in FIG. 6) and the eleventh step in which the service providing server verifies the signature value received from the user terminal (for example, corresponding to step S214 in FIG. 5 and step S308 in FIG. 6). Then, the service providing server confirms the validity of the attribute certificate by the twelfth step (for example, corresponding to step S215 in FIG. 5 and step S309 in FIG. 6) for executing revocation confirmation and the tenth step. When the validity of the signature value is confirmed in the eleventh step and the revocation confirmation is completed, a thirteenth step (providing a service based on attribute information) to the user terminal ( For example, a program for causing a computer to execute step S216 in FIG. 5 and step S310 in FIG. 6) is proposed.

  According to the present invention, the user terminal generates two secret keys x1 and x2, and generates public keys y1 and y2 from these secret keys. The attribute certificate issuing server signs the public key generated by the user terminal with the signature key that it holds. The attribute certificate issuing server gives {y1, y2, z (y1 + y2)} to the user terminal, where z is a signature private key and zP is a public key corresponding thereto (P is a generation source). Is issued as an attribute certificate. The service providing server generates its own secret key x3 and public key y3 (= x3 * P). The user terminal transmits a service provision request to the service provision server. The service providing server transmits a challenge calculated based on the generated random number r to the user terminal. The user terminal generates a random number f and uses the random number f to transform the attribute certificate issued by the attribute certificate issuing server. The user terminal transforms the two secret keys x1 and x2 into fx1 and fx2 using the random number f, and calculates a signature value for the challenge received from the service providing server using the modified fx1 and fx2. The user terminal transmits the modified attribute certificate and the calculated signature value to the service providing server. The service providing server verifies the attribute certificate received from the user terminal. The service providing server verifies the signature value received from the user terminal. The service providing server performs revocation confirmation. When the validity of the attribute certificate is confirmed, the validity of the signature value is confirmed, and the revocation confirmation is completed, a service based on the attribute information is provided to the user terminal. Therefore, without making an inquiry to a third party, even if a tamper-resistant device is not provided on the user side, it is possible to check the revocation while ensuring safety. In addition, since the service provider generates individual secret keys and public keys, the information returned from the user terminal can be made different for each service provider. Therefore, it is possible to prevent a third party from tracing the user's behavior from the communication history before the time when the revocation information is disclosed.

  According to the present invention, it is possible to realize privacy protection when exchanging attribute information without a tamper-resistant device. Further, there is an effect that only a specific service provider can verify the attribute. Furthermore, there is an effect that it is possible to realize Forward Security that prevents a risk that the past history is traced to a third party even if the revocation information is disclosed. Further, there is an effect that the calculation load can be reduced as compared with the conventional case.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<System configuration of attribute authentication system>
FIG. 1 is a diagram illustrating an example of a system configuration of an attribute authentication system according to an embodiment of the present invention.
As shown in FIG. 1, the attribute authentication system according to the present embodiment includes a user terminal 1, a service providing server (hereinafter simply referred to as an SP server 2) managed and operated by a service provider, and an attribute certificate authority (CA). The attribute certificate authority server 3 that is managed and operated is connected via the network 4.

  The user terminal 1 includes an attribute authentication client module 10, the SP server 2 includes an attribute authentication server module 20, and the attribute authentication server 3 includes an attribute certificate issuance module 30.

  Further, the attribute authentication client module 10 includes a key generation unit 11, an attribute certificate transformation unit 12, a processing unit 13, and a transmission unit 14, as shown in FIG.

  The key generation unit 11 generates two secret keys x1 and x2, and generates public keys y1 and y2 from these secret keys. The attribute certificate transformation unit 12 generates a random number f and uses the random number f to transform the attribute certificate issued by the attribute certificate issuing server.

  The processing unit 13 transforms the two secret keys x1 and x2 generated by the key generation unit 11 into fx1 and fx2 using the random number f, and uses the modified fx1 and fx2 to sign the challenge received from the service providing server. Calculate the value. Specifically, using the private keys fx1 and fx2 deformed by the random number f generated by the attribute certificate deforming unit 12, the signature values for the challenge r * y3 are expressed as s1 = f * x1 * r * y3 and s2 = f. * X2 * r * y3 is calculated. Thereby, since the signature value is calculated by a simple calculation formula, the calculation load can be reduced. The transmission unit 14 transmits a service provision request, the attribute certificate transformed by the attribute certificate transformation unit 12, and the signature value calculated by the processing unit 13 to the SP server 2.

  As shown in FIG. 3, the attribute authentication server module 20 includes an attribute certificate verification unit 21, a signature value verification unit 22, a revocation confirmation execution unit 23, a service provision unit 24, a key generation unit 25, The challenge generation unit 26 and the transmission unit 27 are included.

  The attribute certificate verification unit 21 verifies the attribute certificate received from the user terminal 1. Specifically, when zP is used as a public key for issuing an attribute, e (f (y1 + y2), zP) = e (fz (y1 + y2), P) is calculated to determine whether or not this calculation formula is satisfied. Thus, the validity of the attribute certificate is verified. Thereby, since the attribute certificate consisting of {y1, y2, z (y1 + y2)} transmitted from the user terminal can be verified together, the calculation load can be reduced.

  The signature value verification unit 22 verifies the signature value received from the user terminal 1. Specifically, e (s1, P) e (s2, P) = e (f * (y1 + y2), r * y3) is calculated, and the validity of the signature is verified based on whether the arithmetic expression is satisfied. To do. Thereby, since the signature value is calculated by the simple calculation formula as described above, the calculation load can be reduced.

  The revocation confirmation execution unit 23 executes revocation confirmation. Specifically, r * x3 * y1 is calculated for all y1s on the revocation list, and e (z (y1 + y2), s1) = e (f * z * (y1 + y2), r * x3 * Y1) is calculated, and revocation confirmation is executed depending on whether or not the calculation formula is satisfied. Therefore, the revocation list cannot be traced by a third party who does not know the service provider's private key x3 and can easily trace the user's behavior from the communication history before the revocation information was disclosed. Confirmation processing can be realized.

  The service providing unit 24 provides the service based on the attribute information to the user terminal 1 when the validity of the attribute certificate is confirmed, the validity of the signature value is confirmed, and the revocation confirmation is completed. I do.

  The key generation unit 25 generates its own private key x3 and public key y3 (= x3 * P). The challenge generation unit 26 generates a random number r, calculates r * y3, and generates a challenge to be transmitted to the user terminal 1. The transmission unit 27 transmits the challenge generated by the challenge generation unit 26 to the user terminal 1.

  As shown in FIG. 4, the attribute certificate issuance module 30 includes a signature unit 31, an attribute certificate issuance unit 32, and a transmission unit 33.

  The signature unit 31 signs the public key generated by the key generation unit 11 of the user terminal 1 with the signature key that is held. Specifically, a signature is performed with a signature key that is held on the sum of public keys y1 and y2 generated by the key generation unit 11 of the user terminal 1. Thereby, only necessary and sufficient information can be given to the user, and the user's fraud can be prevented. In addition, since the calculation load can be reduced, the calculation speed can be increased.

  The attribute certificate issuing unit 32 gives {y1, y2, z (y1 + y2) to the user terminal 1 where z is a private key for signature and zP is a public key corresponding thereto (P is a generation source). )} As an attribute certificate. The transmitting unit 33 transmits the attribute certificate issued by the attribute certificate issuing unit 32 to the user terminal 1.

<Operation sequence of attribute authentication system>
FIG. 5 is an operation sequence diagram showing the operation flow of the entire attribute authentication system according to the embodiment of the present invention in time series, and FIG. 6 is a flowchart showing the operation flow of the user terminal. . The operation sequence diagram shown in FIG. 5 also shows the procedure of the attribute information anonymization method in the attribute authentication system of the present invention.
The operation of the attribute authentication system shown in FIG. 1 will be described in detail below with reference to FIGS.

  First, the key generation unit 11 of the user terminal 1 generates user secret keys x1 and x2 and public keys y1 = x1 * P and y2 = x2 * P (step S201 in FIG. 5 and steps S301 and S302 in FIG. 6). ). Here, P is a generation source. Then, the transmission unit 14 of the user terminal 1 transmits an attribute certificate issuance request to the attribute certificate authority server 3 (step S202 in FIG. 5).

  The attribute certificate authority server 3 calculates y1 + y2 with respect to the public keys y1 and y2, and signs the y1 + y2 with the attribute signature key held by the attribute certificate authority server 3 (step S302 in FIG. 6). . Note that the signature key with the longest validity period is used (see FIG. 7). The signature is z (y1 + y2) where z is the private key for signature and zP is the corresponding public key.

  Then, {y1, y2, z (y1 + y2)} is issued to the user terminal 1 as a certificate. Further, as long as the issued user's private keys x1 and x2 are within the validity period, y1 and z (y1 + y2) or y2 and z (y1 + y2) are stored (steps S203 and S204 in FIG. 5 and FIG. 6). Step S303).

  FIG. 7 conceptually shows how to manage the effective period. In FIG. 7, t on the horizontal axis indicates the flow of time. According to the present invention, since the attribute information is only key information, it is necessary to manage a new effective period. For this reason, as shown in FIG. 7, the attribute certificate issuing module 31 of the attribute authority server 3 assigns a plurality of signature keys for each attribute, and manages the validity period by periodically updating the combination. I have decided. At that time, a plurality of title keys assigned for each attribute are managed in parallel so that a user who can enjoy the service only for a very short period does not occur.

  In order to assign the signature key having the longest valid period, for example, as shown in FIG. 7, if the key is to be assigned in the latter half of the usage period of the key A, the attribute certification authority server 3 The attribute certificate issuing module 31 assigns the signature key D or the signature key E to the attribute authentication client module 11 of the user terminal 1. Thereby, the inconvenience that the user can receive the service for a very short period can be prevented.

  Next, the key generation unit 25 of the SP server 2 generates its own private key x3 and public key y3 = x3 * P (step S205 in FIG. 5). Similarly, the public key certificate zy3 is issued from the attribute authority server 3. The SP server 2 transmits a certificate issuance request to the attribute certification authority server 3 (step S206 in FIG. 5), and the attribute certification authority server 3 responds to the SP server 2 in response to the issuance request. Then, a certificate is issued (step S207 in FIG. 5). The transmission unit 14 of the user terminal 1 transmits a service provision request to the SP server 2 (step S208 in FIG. 5 and step S304 in FIG. 6).

  The challenge generation unit 26 of the SP server 2 generates a random number r, calculates r * y3, generates a challenge, and transmits the challenge from the transmission unit 27 to the user terminal 1 (steps S209 and 6 in FIG. 5). Step S305).

  The attribute certificate modification unit 12 of the user terminal 1 transforms the received attribute certificate (step S210 in FIG. 5 and step S306 in FIG. 6). Specifically, a random number f is generated and transformed to fz (y1 + y2).

  At this time, the secret key is also transformed into fx1 and fx2. Then, the processing unit 13 of the user terminal 1 calculates a signature value for r * y3 using fx1 and fx2. Specifically, s1 = f * x1 * r * y3 and s2 = f * x2 * r * y3 are calculated. (Step S211 in FIG. 5).

  The transmission unit 14 of the user terminal 1 returns the modified attribute certificate and the calculated signature value to the SP server 2 (step S212 in FIG. 5 and step S307 in FIG. 6).

  The attribute certificate verification unit 21 of the SP server 2 verifies the sent attribute certificate (step S213 in FIG. 5 and step S308 in FIG. 6). Here, Pairing calculation is used for verification. Specifically, it is verified whether or not e (f (y1 + y2), zP) = e (fz (y1 + y2), P) is satisfied when the pairing calculation is represented by e (*, *). Here, zP is a public key for issuing attributes.

  Next, the signature value verification unit 22 of the SP server 2 verifies the sent signature (step S214 in FIG. 5 and step S308 in FIG. 6). Specifically, it is verified whether or not e (s1, P) e (s2, P) = e (f * (y1 + y2), r * y3) holds.

  Further, the revocation confirmation execution unit 23 of the SP server 2 performs revocation confirmation (step S215 in FIG. 5 and step S309 in FIG. 6). Here, when revocation confirmation is performed, a revocation list is acquired from the attribute authority server 3 in advance or on the spot. The revocation list is generated by the attribute certificate authority server 3, and public keys y1 and (y1 + y2) or y2 and (y1 + y2) of revoked users are disclosed.

  If the user wants to revoke his / her public key, he / she applies to the attribute authority server 3 to have y1 and (y1 + y2) or y2 and (y1 + y2) disclosed. The revocation list is given a signature by the attribute certificate authority server 3, and its validity can be confirmed. The revocation check calculates r * x3 * y1 for all y1s on the revocation list, and e (z (y1 + y2), s1) = e (f * z * (y1 + y2), r * x3 * y1) It is verified whether or not holds. When this equation is established, it is determined that the key is invalid (has expired).

  The SP server 2 determines that the authentication is successful when the certificate validity check, the signature validity check, and the revocation check are completed, and the service providing unit 24 of the SP server 2 The service is provided based on the attribute information (step S216 in FIG. 5 and step S310 in FIG. 6).

  The specific use of the attribute authentication system and the anonymization method in the system is as follows. In the disclosure of medical information, confirmation of medical qualification or publicly issued by public transportation. It can be used for confirming qualifications such as Silver Pass.

  As described above, in the present embodiment, it is possible to check the revocation while ensuring safety even if the tamper resistant device is not provided on the user side without inquiring a third party. be able to. In addition, since the service provider generates individual secret keys and public keys, the information returned from the user terminal can be made different for each service provider. Therefore, it is possible to prevent a third party from tracing the user's behavior from the communication history before the time when the revocation information is disclosed.

  The attribute authentication client module 10, the attribute authentication server module 20, and the attribute certificate issuance module 30 shown in FIG. 1 are programs executed by the user terminal 1, the SP server 2, and the attribute certificate authority server 3, respectively. These programs are recorded on a computer-readable recording medium, and the programs recorded on the recording medium are read into the user terminal 1, the SP server 2, and the attribute certification authority server 3 (all are computer systems) and executed. Thus, the attribute authentication system of the present invention can be realized. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention. For example, in the present embodiment, the mode in which the attribute certification authority server 3 executes the revocation checking process has been described. However, a server that performs the revocation checking process may be provided separately from the attribute certification authority server 3.

It is a figure which shows an example of the system configuration | structure of the attribute authentication system which concerns on embodiment of this invention. It is a block diagram of the attribute authentication client module which concerns on embodiment of this invention. It is a block diagram of the attribute authentication server module which concerns on embodiment of this invention. It is a block diagram of the attribute certificate issuing module which concerns on embodiment of this invention. It is a figure which shows the operation sequence of the whole attribute authentication system which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the user terminal in the attribute authentication system which concerns on embodiment of this invention. It is the operation | movement conceptual diagram quoted in order to demonstrate the management method of the effective period of the attribute information of the attribute authentication system which concerns on embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... User terminal, 2 ... Service provision server (SP server), 3 ... Attribute certification authority server, 4 ... Network, 10 ... Attribute authentication client module, 11 ... Key generation part , 12 ... attribute certificate transformation unit, 13 ... processing unit, 14 ... transmission unit, 20 ... attribute authentication server module, 21 ... attribute certificate verification unit, 22 ... signature value Verification unit, 23 ... Revocation confirmation execution unit, 24 ... Service providing unit, 25 ... Key generation unit, 26 ... Random number generation unit, 27 ... Transmission unit, 30 ... Attribute certificate Issuing module, 31 ... signature part, 32 ... attribute certificate issuing part, 33 ... sending part

Claims (11)

An attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network,
The user terminal is
A first key generating means for generating two secret keys x1 and x2 and generating public keys y1 and y2 from these secret keys;
First transmission means for transmitting a service provision request to the service provision server;
Deforming means for generating a random number f and transforming the attribute certificate issued by the attribute certificate issuing server using the random number f;
Processing means for transforming the two secret keys x1 and x2 into fx1 and fx2 using a random number f, and calculating a signature value for the challenge received from the service providing server using the transformed fx1 and fx2;
Second transmission means for transmitting the attribute certificate modified by the modification means and the signature value calculated by the processing means to the service providing server;
With
The attribute certificate issuing server is
Signing means for signing with a signature key possessed with respect to the public key generated by the generating means of the user terminal;
Issuing {y1, y2, z (y1 + y2)} as an attribute certificate to the user terminal when the signature private key is z and the corresponding public key is zP (P is the source) Issuing means to
With
The service providing server is
A second key generation means for generating its own private key x3 and public key y3 (= x3 * P);
Third transmission means for transmitting a challenge calculated based on the generated random number r to the user terminal;
First verification means for verifying the attribute certificate received from the user terminal;
Second verification means for verifying a signature value received from the user terminal;
Revocation check execution means for executing revocation check;
When the validity of the attribute certificate is confirmed by the first verification means, the validity of the signature value is confirmed by the second verification means, and the revocation confirmation is completed by the revocation confirmation execution means, Service providing means for providing a service based on attribute information to the user terminal;
An attribute authentication system characterized by comprising:   2. The attribute authentication system according to claim 1, wherein the attribute certificate issuing server uses a signature key having the longest validity period among signature keys currently valid in the signature by the signing means.   The signing means of the attribute certificate issuing server signs the public key y1 and y2 generated by the first key generating means of the user terminal with the signature key held by the signing means. The attribute authentication system according to claim 1.   2. The attribute according to claim 1, wherein the service providing server generates the challenge by generating a random number r and calculating r * y3 obtained by multiplying the random number r by the generated public key y3. Authentication system.   The processing means of the user terminal uses the secret keys fx1 and fx2 transformed by the random number f generated by the transformation means to change the signature value for the challenge r * y3 to s1 = f * x1 * r * y3, s2 = 5. The attribute authentication system according to claim 4, wherein the attribute authentication system is calculated by f * x2 * r * y3.   The first verification means of the service providing server calculates e (f (y1 + y2), zP) = e (fz (y1 + y2), P) when zP is a public key for attribute issuance, The attribute authentication system according to claim 1, wherein the validity of the attribute certificate is verified based on whether or not the arithmetic expression is established.   Whether or not the second verification means of the service providing server calculates e (s1, P) e (s2, P) = e (f * (y1 + y2), r * y3) The attribute authentication system according to claim 5, wherein the validity of the signature is verified.   The revocation confirmation execution means of the service providing server calculates r * x3 * y1 for all y1s on the revocation list and e (z (y1 + y2), s1) = e (f * z * ( 6. The attribute authentication system according to claim 5, wherein y1 + y2) and r * x3 * y1) are calculated, and revocation confirmation is executed depending on whether or not the calculation formula is satisfied.   The attribute authentication system according to claim 1, wherein the attribute certificate issuing server publishes y1, z (y1 + y2) or y2, z (y1 + y2) of a user who has been revoked in a revocation list. An attribute authentication method in an attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network,
A first step in which the user terminal generates two secret keys x1 and x2 and generates public keys y1 and y2 from these secret keys;
A second step in which the attribute certificate issuing server signs a public key generated by the user terminal with a signature key possessed;
When the attribute certificate issuing server sets z as a private key for signature and zP (P is a generation source) corresponding to the private key for signature, {y1, y2, z (y1 + y2) )} Is issued as an attribute certificate;
A fourth step in which the service providing server generates its own private key x3 and public key y3 (= x3 * P);
A fifth step in which the user terminal transmits a service provision request to the service provision server;
A sixth step in which the service providing server transmits a challenge calculated based on the generated random number r to the user terminal;
A seventh step in which the user terminal generates a random number f and uses the random number f to transform the attribute certificate issued by the attribute certificate issuing server;
The user terminal transforms the two secret keys x1 and x2 into fx1 and fx2 using the random number f, and calculates a signature value for the challenge received from the service providing server using the modified fx1 and fx2. An eighth step;
A ninth step in which the user terminal transmits the modified attribute certificate and the calculated signature value to the service providing server;
A tenth step in which the service providing server verifies the attribute certificate received from the user terminal;
An eleventh step in which the service providing server verifies the signature value received from the user terminal;
A twelfth step in which the service providing server executes revocation checking;
When the validity of the attribute certificate is confirmed by the tenth step, the validity of the signature value is confirmed by the eleventh step, and the revocation confirmation is completed, the attribute is given to the user terminal. A thirteenth step of providing information-based services;
An attribute authentication method comprising: A program for causing a computer to execute an attribute authentication method in an attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network,
A first step in which the user terminal generates two secret keys x1 and x2 and generates public keys y1 and y2 from these secret keys;
A second step in which the attribute certificate issuing server signs a public key generated by the user terminal with a signature key possessed;
When the attribute certificate issuing server sets z as a private key for signature and zP (P is a generation source) corresponding to the private key for signature, {y1, y2, z (y1 + y2) )} Is issued as an attribute certificate;
A fourth step in which the service providing server generates its own private key x3 and public key y3 (= x3 * P);
A fifth step in which the user terminal transmits a service provision request to the service provision server;
A sixth step in which the service providing server transmits a challenge calculated based on the generated random number r to the user terminal;
A seventh step in which the user terminal generates a random number f and uses the random number f to transform the attribute certificate issued by the attribute certificate issuing server;
The user terminal transforms the two secret keys x1 and x2 into fx1 and fx2 using the random number f, and calculates a signature value for the challenge received from the service providing server using the modified fx1 and fx2. An eighth step;
A ninth step in which the user terminal transmits the modified attribute certificate and the calculated signature value to the service providing server;
A tenth step in which the service providing server verifies the attribute certificate received from the user terminal;
An eleventh step in which the service providing server verifies the signature value received from the user terminal;
A twelfth step in which the service providing server executes revocation checking;
When the validity of the attribute certificate is confirmed by the tenth step, the validity of the signature value is confirmed by the eleventh step, and the revocation confirmation is completed, the attribute is given to the user terminal. A thirteenth step of providing information-based services;
A program that causes a computer to execute.

Images