JP5457856B2 - Multi-attribute authentication system, multi-attribute authentication method, revocation checking method and program - Google Patents

Description

  The present invention is a multi-attribute authentication system, a multi-attribute authentication method, a revocation confirmation method, and a multi-attribute authentication method for simultaneously authenticating possession of a plurality of attributes while realizing complete anonymization by which a user can arbitrarily blind attribute information. Regarding the program.

  In recent years, various services have been provided electronically through the Internet. When providing such a service, it is essential to authenticate the user. Here, a method for authenticating a user is generally classified into authentication for specifying an individual and authentication for not specifying an individual such as attribute authentication (for example, see Patent Document 1).

Japanese Patent Publication No. 8-2051

  However, in the conventional technique, anonymity is not considered in attribute authentication. In recent years, research on anonymization has been carried out, but there are problems that anonymization is insufficient or that communication with a third party is required for attribute authentication. Further, since the attribute information cannot be transformed, it is possible to track the user using the attribute information by a third party. In the conventional technology, a method of simultaneously authenticating a plurality of attributes has not been realized.

  Therefore, the present invention has been made in view of the above-described problems, and can simultaneously authenticate possession of a plurality of attributes while realizing complete anonymization that allows a user to arbitrarily blind attribute information. An object of the present invention is to provide a multi-attribute authentication system, a multi-attribute authentication method, a revocation checking method, and a program for realizing multi-attribute authentication.

  The present invention proposes the following items in order to solve the above-described problems. In addition, in order to make an understanding easy, although the code | symbol corresponding to embodiment of this invention is attached | subjected and demonstrated, it is not limited to this.

  (1) The present invention includes a user terminal (for example, equivalent to the user terminal 1 in FIG. 1), an attribute certificate issuing server (for example, equivalent to the attribute authentication server 3 in FIG. 1), and a service providing server (for example, FIG. 1 is equivalent to one SP server 2) via a network, and the user terminal uses the secret key of a plurality of users and the public key paired with the number of attributes. A first key generation unit (for example, equivalent to the key generation unit 12 of FIG. 2) that generates one more than the public key corresponding to the number of generated attributes is transmitted to the attribute certificate issuing server. First transmission means (for example, equivalent to the transmission unit 14 in FIG. 2), second transmission means for transmitting a service provision request to the service providing server (for example, equivalent to the transmission unit 14 in FIG. 2), Generate a random number f, and use the random number f, A transformation means for transforming the attribute certificate issued by the attribute certificate issuance server (for example, equivalent to the attribute certificate transformation section 13 in FIG. 2), a private key corresponding to the number of the attributes is transformed by the random number f, Processing means (for example, corresponding to the processing unit 15 in FIG. 2) for calculating a signature value for the service provider's public key received from the service providing server by multiplying a random number by using the modified secret key; A third transmission unit (for example, corresponding to the transmission unit 14 in FIG. 2) that transmits the attribute certificate modified by the transformation unit and the signature value calculated by the processing unit to the service providing server, A signature means (for example, the signature shown in FIG. 4) in which the attribute certificate issuing server signs the public key corresponding to the number of attributes generated by the key generation means of the user terminal with the signature keys z1 and z2 Part 1) and issuing means for issuing {y1, y2, z1y1, z2y2, z3y3,... Ziii} as attribute certificates to the user terminal (for example, the attribute certificate issuing unit 32 in FIG. 4). 2), and the service providing server generates second secret key xs and public key ys (= xs * P), for example, corresponding to key generation unit 25 in FIG. ) And the generated random number r and the public key ys as a challenge, a fourth transmitting means (for example, corresponding to the transmitting unit 27 in FIG. 3) that transmits the challenge to the user terminal, and the user terminal First verification means for verifying the attribute certificate (for example, equivalent to the attribute certificate verification unit 21 in FIG. 3) and second verification means for verifying the signature value received from the user terminal (for example, in FIG. 3) Equivalent to the signature verification unit 22) and The validity of the attribute certificate is confirmed by the revocation confirmation execution means (e.g., corresponding to the revocation confirmation execution unit 23 in FIG. 3) that performs confirmation, and the first verification means, and the signature value is confirmed by the second verification means Service providing means for providing a service based on attribute information to the user terminal when the revocation confirmation is completed by the revocation confirmation executing means (for example, the service shown in FIG. 3). And a multi-attribute authentication system characterized in that the multi-attribute authentication system is provided.

  According to the present invention, the first key generating means of the user terminal generates one private key of a plurality of users and the public key paired therewith, one more than the number of attributes. The first transmission means transmits a public key corresponding to the number of generated attributes to the attribute certificate issuing server. The second transmission means transmits a service provision request to the service provision server. The deformation means generates a random number f and uses the random number f to deform the attribute certificate issued by the attribute certificate issuing server. The processing means modifies a secret key corresponding to the number of attributes with a random number f, and uses the deformed secret key to obtain a signature value for a product obtained by multiplying the public key of the service provider received from the service providing server by the random number. calculate. The third transmission unit transmits the attribute certificate modified by the transformation unit and the signature value calculated by the processing unit to the service providing server. The signature unit of the attribute certificate issuing server signs the public key corresponding to the number of attributes generated by the key generation unit of the user terminal with the signature keys z1 and z2 that are held. The issuing means issues {y1, y2, z1y1, z2y2, z3y3,... Ziii} as attribute certificates to the user terminal. The second key generation means of the service providing server generates its own secret key xs and public key ys (= xs * P). The fourth transmission means transmits information including the generated random number r and the public key ys to the user terminal as a challenge. The first verification unit verifies the attribute certificate received from the user terminal. The second verification unit verifies the signature value received from the user terminal. The revocation confirmation execution means executes revocation confirmation. When the validity of the attribute certificate is confirmed by the first verification means, the validity of the signature value is confirmed by the second verification means, and the revocation confirmation is completed by the revocation confirmation execution means The service based on the attribute information is provided to the user terminal. Therefore, a plurality of attributes can be simultaneously authenticated in any combination. In addition, anonymity is guaranteed during attribute authentication. Moreover, the attribute used for attribute authentication cannot be transferred or lent to another person. Further, in attribute authentication, communication with a third party is not required. Further, any modification of the attribute information is possible without communication with a third party. Furthermore, secure attribute authentication can be realized without a tamper-resistant device on the user side.

  (2) According to the present invention, in the multi-attribute authentication system according to (1), the service providing server generates a random number r, and r * ys from the random number r and its own public key ys (= xs * P). We have proposed a multi-attribute authentication system characterized by calculating and sending this as a challenge.

  According to the present invention, the service providing server generates a random number r, calculates r * ys from the random number r and its own public key ys (= xs * P), and transmits this as a challenge. That is, a public key ys (= xs * P) that is different for each service provider is embedded in the challenge, and a signature is returned from the user terminal in response to this challenge. An unknown third party cannot trace the user's behavior from the communication history before the time when the revocation information is disclosed.

  (3) The present invention provides the multi-attribute authentication system according to (2), wherein the processing means of the user terminal has a secret key fx1, fx2,... For the attribute transformed by the random number f generated by the transformation means. A multi-characteristic characterized in that, using fxm, a signature value for r * ys is calculated by s1 = fx1 * r * ys, s2 = fx2 * r * ys,..., Si = fxi * r * ys. An attribute authentication system is proposed.

  According to this invention, the processing means of the user terminal uses the secret keys fx1, fx2,..., Fxm for the attribute transformed by the random number f generated by the transformation means to set the signature value for r * ys to s1 = fx1 * r * ys, s2 = fx2 * r * ys,..., si = fxi * r * ys. Therefore, since the signature value is calculated using the simple calculation formula as described above, the calculation load can be reduced.

  (4) The present invention provides the multi-attribute authentication system according to (1), wherein the first verification unit of the service providing server uses z1P, z2P,..., ZiP as public keys for issuing attributes. E (fy1, z1P) e (fy2, z2P)... E (fyi, ziP) = e (fz1y1, P) e (fz2y2, P)... E (fziyi, P) We have proposed a multi-attribute authentication system characterized by verifying the validity of an attribute certificate depending on whether or not an arithmetic expression holds.

  According to this invention, when the first verification means of the service providing server uses z1P, z2P,..., ZiP as public keys for issuing attributes, e (fy1, z1P) e (fy2, z2P). ..E (fii, ziP) = e (fz1y1, P) e (fz2y2, P)... E (fziyi, P) is calculated, and the validity of the attribute certificate depends on whether or not the calculation formula is satisfied. Verify sex. Therefore, since the attribute certificates transmitted from the user terminal can be collectively verified by the above arithmetic expression, the calculation load can be reduced.

  (5) The present invention provides the multi-attribute authentication system according to (3), wherein the second verification unit of the service providing server is e (s1, P) e (s2, P)... E (si, P) = e (fy1, r * ys) e (fy2, r * ys)... E (fyi, r * ys) is calculated, and the validity of the signature is determined depending on whether the arithmetic expression is satisfied. A multi-attribute authentication system characterized by verification is proposed.

  According to this invention, the second verification means of the service providing server is e (s1, P) e (s2, P)... E (si, P) = e (fy1, r * ys) e (fy2 , R * ys)... E (fyi, r * ys) is calculated, and the validity of the signature is verified depending on whether or not the arithmetic expression is satisfied. Therefore, since the signature value is calculated using the simple calculation formula as described above, the calculation load can be reduced.

  (6) The present invention provides the multi-attribute authentication system according to (2) or (3), wherein the revocation confirmation execution means of the service providing server applies r * xs * for all y1s listed in the revocation list. In addition to calculating y1, e (z1y1, s1) = e (f * z1 * y1, r * xs * y1) is calculated, and revocation confirmation is executed depending on whether the arithmetic expression is satisfied. A multi-attribute authentication system is proposed.

  According to this invention, the revocation confirmation execution means of the service providing server calculates r * xs * y1 for all y1s listed in the revocation list and e (z1y1, s1) = e (f * z1 * Y1, r * xs * y1) is calculated, and revocation confirmation is executed depending on whether or not the calculation formula is satisfied. Therefore, the revocation list cannot be traced by a third party who does not know the service provider's private key x3 and can easily trace the user's behavior from the communication history before the revocation information was disclosed. Confirmation processing can be realized.

  (7) The present invention is a revocation checking method executed by a service providing server in a multi-attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network. The first step of obtaining a revocation list from the attribute certificate issuing server, and for all y1 listed in the revocation list, r * xs * y1 is calculated, and e (z1y1, s1) = e (f * Z1 * y1, r * xs * y1), a second step that verifies whether or not, if only one of the attributes is to be revoked, a third step that exposes yn and znyn, and a revocation list Calculate r * xs * yn for all the listed yns to see if e (znyn, sn) = e (f * zn * yn, r * xs * yn) holds Proposes the revocation confirmation method characterized by comprising a fourth step of verifying, the.

  According to the present invention, a revocation list is acquired from the attribute certificate issuing server, r * xs * y1 is calculated for all y1 listed in the revocation list, and e (z1y1, s1) = e (f * It is verified whether z1 * y1 and r * xs * y1) hold. When only one of the attributes is revoked, yn and znyn are made public, r * xs * yn is calculated for all yns on the revocation list, and e (znyn, sn) = e It is verified whether (f * zn * yn, r * xs * yn) holds. Therefore, revocation processing and revocation confirmation processing are possible without inquiring a third party. Moreover, it is a system which cannot trace a user's action from the communication history before the time when revocation information was disclosed. In addition, the user possesses a plurality of attributes, but the revocation process can be performed collectively. Furthermore, only one attribute of the user can be revoked.

  (8) The present invention is a multi-attribute authentication method in a multi-attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network, wherein the user terminal includes a plurality of user terminals. A first step (for example, corresponding to steps S201 in FIG. 5 and steps S301 and S302 in FIG. 6) that generates one more private key and a public key that is paired therewith than the number of attributes; A second step in which the user terminal transmits a public key corresponding to the number of generated attributes to the attribute certificate issuing server (for example, corresponding to step S202 in FIG. 6); However, a third step (for example, corresponding to step S302 in FIG. 6) for signing the public key corresponding to the number of the attributes with the signature keys z1 and z2 held therein, The attribute certificate issuance server issues a fourth step (for example, step S203 in FIG. 5) to issue {y1, y2, z1y1, z2y2, z3y3,. S204, corresponding to step S303 in FIG. 6) and the fifth step in which the user terminal transmits a service provision request to the service providing server (for example, corresponding to step S208 in FIG. 5 and step S304 in FIG. 6). The service providing server generates its own private key xs and public key ys (= xs * P) (for example, corresponding to step S205 in FIG. 5), and the service providing server generates A seventh step (for example, step S2 in FIG. 5) for transmitting information including the random number r and the public key ys to the user terminal as a challenge 09, which corresponds to step S305 in FIG. 6), and the user terminal generates a random number f and uses the random number f to transform an attribute certificate issued by the attribute certificate issuing server ( For example, in step S210 in FIG. 5 and step S306 in FIG. 6), the user terminal modifies a secret key corresponding to the number of attributes with a random number f, and uses the modified secret key to A ninth step (e.g., corresponding to step S211 in FIG. 5) for calculating a signature value for the service provider's public key received from the providing server multiplied by a random number; A tenth step (for example, corresponding to step S212 in FIG. 5 and step S307 in FIG. 6) for transmitting the certificate and the calculated signature value to the service providing server; The service server receives from the user terminal an eleventh step (for example, equivalent to step S213 in FIG. 5 and step S308 in FIG. 6) for verifying the attribute certificate received from the user terminal. A twelfth step (for example, equivalent to step S214 in FIG. 5 and step S308 in FIG. 6) and a thirteenth step (for example, in FIG. Step S215, corresponding to Step S309 in FIG. 67), and when the service providing server confirms the validity of the attribute certificate, confirms the validity of the signature value, and completes the revocation confirmation, the user Fourteenth step of providing a service based on attribute information to the terminal (for example, step S216 in FIG. 5, step in FIG. 6) And equivalent) to 310, it proposes a multi-attribute authentication method comprising the.

  According to the present invention, the user terminal generates one private key of a plurality of users and a public key paired therewith, one more than the number of attributes, and sends the generated number of attributes to the attribute certificate issuing server. Send a public key corresponding to. On the other hand, the attribute certificate issuing server signs the public key corresponding to the number of attributes with the signature keys z1 and z2 that it holds, and {y1, y2, z1y1, z2y2, z3y3,... ziyyi} are issued. Next, the user terminal transmits a service provision request to the service provision server. The service providing server generates its own private key xs and public key ys (= xs * P), and transmits information including the generated random number r and public key ys to the user terminal as a challenge. The user terminal generates a random number f, transforms the attribute certificate issued by the attribute certificate issuing server using the random number f, transforms the secret key corresponding to the number of attributes with the random number f, and transforms the transformed Using the secret key, a signature value is calculated for the service provider's public key received from the service providing server multiplied by a random number. Then, the user terminal transmits the deformed attribute certificate and the calculated signature value to the service providing server. The service providing server verifies the attribute certificate received from the user terminal and verifies the signature value received from the user terminal. In addition, the service providing server performs revocation confirmation. The service providing server provides the service based on the attribute information to the user terminal when the validity of the attribute certificate is confirmed, the validity of the signature value is confirmed, and the revocation confirmation is completed. I do. Therefore, a plurality of attributes can be simultaneously authenticated in any combination. In addition, anonymity is guaranteed during attribute authentication. Moreover, the attribute used for attribute authentication cannot be transferred or lent to another person. Further, in attribute authentication, communication with a third party is not required. Further, any modification of the attribute information is possible without communication with a third party. Furthermore, secure attribute authentication can be realized without a tamper-resistant device on the user side.

  (9) In the multi-attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network, the present invention provides a computer with a revocation checking method executed by the service providing server. A program for executing the first step of obtaining a revocation list from the attribute certificate issuing server, and calculating r * xs * y1 for all y1s listed in the revocation list, e ( a second step of verifying whether z1y1, s1) = e (f * z1 * y1, r * xs * y1) holds, and if only one of the attributes is revoked, yn and znyn are disclosed Step 3 and for every yn on the revocation list, calculate r * xs * yn, e (znyn, sn) = e (f * z * Yn, we propose a program to execute a fourth step of verifying whether r * xs * yn) holds, to the computer.

  According to the present invention, a revocation list is acquired from the attribute certificate issuing server, r * xs * y1 is calculated for all y1 listed in the revocation list, and e (z1y1, s1) = e (f * It is verified whether z1 * y1 and r * xs * y1) hold. When only one of the attributes is revoked, yn and znyn are made public, r * xs * yn is calculated for all yns on the revocation list, and e (znyn, sn) = e It is verified whether (f * zn * yn, r * xs * yn) holds. Therefore, revocation processing and revocation confirmation processing are possible without inquiring a third party. Moreover, it is a system which cannot trace a user's action from the communication history before the time when revocation information was disclosed. In addition, the user possesses a plurality of attributes, but the revocation process can be performed collectively. Furthermore, only one attribute of the user can be revoked.

  (10) The present invention causes a computer to execute a multi-attribute authentication method in a multi-attribute authentication system in which a user terminal, an attribute certificate issuing server, a service providing server, and a reliable server are connected via a network. A first step (for example, step S201 in FIG. 5) in which the user terminal generates a plurality of private keys of a plurality of users and a public key paired therewith, one more than the number of attributes. 6 and corresponding to steps S301 and S302 in FIG. 6 and a second step in which the user terminal transmits a public key corresponding to the number of generated attributes to the attribute certificate issuing server (for example, FIG. 6). Corresponding to step S202), and the attribute certificate issuing server signs a signature with the signature keys z1 and z2 held for the public key corresponding to the number of attributes. The third step (e.g., corresponding to step S302 in FIG. 6), and the attribute certificate issuing server sends {y1, y2, z1y1, z2y2, z3y3,. A fourth step (e.g., corresponding to steps S203 and S204 in FIG. 5 and step S303 in FIG. 6) for issuing ziyyi, and a fifth step in which the user terminal transmits a service provision request to the service provision server. Step (for example, corresponding to step S208 in FIG. 5 and step S304 in FIG. 6), and a sixth step in which the service providing server generates its own private key xs and public key ys (= xs * P) ( For example, this corresponds to step S205 in FIG. 5), and the service providing server uses the generated random number r and the public key ys as a challenge. The seventh step (for example, corresponding to step S209 in FIG. 5 and step S305 in FIG. 6) transmitted to the user terminal, and the user terminal generates a random number f and uses the random number f to generate the attribute proof. And an eighth step (for example, corresponding to step S210 in FIG. 5 and step S306 in FIG. 6) for transforming the attribute certificate issued by the certificate issuing server, and the user terminal sets a secret key corresponding to the number of attributes. A ninth step (for example, FIG. 5) is performed by transforming with a random number f and calculating a signature value for the service provider's public key received from the service providing server by multiplying the random number by the random number f. (Corresponding to step S211) and the user terminal transmits the modified attribute certificate and the calculated signature value to the service providing server in a tenth step (for example, FIG. 5). Step S212, which corresponds to Step S307 in FIG. 6), and an eleventh step (for example, Step S213 in FIG. 5 and Step S308 in FIG. 6) in which the service providing server verifies the attribute certificate received from the user terminal. The service providing server verifies the signature value received from the user terminal (e.g., equivalent to step S214 in FIG. 5 and step S308 in FIG. 6), and the service providing server A thirteenth step (for example, corresponding to step S215 in FIG. 5 and step S309 in FIG. 67) for executing the revocation check, and the service providing server confirms the validity of the attribute certificate and confirms the validity of the signature value. When it is confirmed and the revocation confirmation is completed, a service based on the attribute information is provided to the user terminal. 14 step (e.g., step S216 in FIG. 5, corresponding to step S310 of FIG. 6) has proposed a program for executing a, to the computer.

  According to the present invention, the user terminal generates one private key of a plurality of users and a public key paired therewith, one more than the number of attributes, and sends the generated number of attributes to the attribute certificate issuing server. Send a public key corresponding to. On the other hand, the attribute certificate issuing server signs the public key corresponding to the number of attributes with the signature keys z1 and z2 that it holds, and {y1, y2, z1y1, z2y2, z3y3,... ziyyi} are issued. Next, the user terminal transmits a service provision request to the service provision server. The service providing server generates its own private key xs and public key ys (= xs * P), and transmits information including the generated random number r and public key ys to the user terminal as a challenge. The user terminal generates a random number f, transforms the attribute certificate issued by the attribute certificate issuing server using the random number f, transforms the secret key corresponding to the number of attributes with the random number f, and transforms the transformed Using the secret key, a signature value is calculated for the service provider's public key received from the service providing server multiplied by a random number. Then, the user terminal transmits the deformed attribute certificate and the calculated signature value to the service providing server. The service providing server verifies the attribute certificate received from the user terminal and verifies the signature value received from the user terminal. In addition, the service providing server performs revocation confirmation. The service providing server provides the service based on the attribute information to the user terminal when the validity of the attribute certificate is confirmed, the validity of the signature value is confirmed, and the revocation confirmation is completed. I do. Therefore, a plurality of attributes can be simultaneously authenticated in any combination. In addition, anonymity is guaranteed during attribute authentication. Moreover, the attribute used for attribute authentication cannot be transferred or lent to another person. Further, in attribute authentication, communication with a third party is not required. Further, any modification of the attribute information is possible without communication with a third party. Furthermore, secure attribute authentication can be realized without a tamper-resistant device on the user side.

  According to the present invention, there is an effect that a plurality of attributes can be simultaneously authenticated in an arbitrary combination. In addition, there is an effect that anonymity is guaranteed in attribute authentication. In addition, there is an effect that an attribute used for attribute authentication cannot be transferred or lent to another person. In addition, there is an effect that communication with a third party is not required in attribute authentication. Also, there is an effect that any modification of the attribute information is possible without communication with a third party. In addition, there is an effect that secure attribute authentication can be realized without a tamper resistant device on the user side.

  Furthermore, there is an effect that revocation processing and revocation confirmation processing can be performed without inquiring a third party. In addition, there is an effect that the user's behavior cannot be traced from the communication history before the time when the revocation information is disclosed. In addition, although the user possesses a plurality of attributes, the revocation process can be performed collectively. Moreover, there is an effect that only one attribute of the user can be invalidated.

It is a figure which shows an example of the system configuration | structure of the multi-attribute authentication system which concerns on embodiment of this invention. It is a block diagram of the attribute authentication client module which concerns on embodiment of this invention. It is a block diagram of the attribute authentication server module which concerns on embodiment of this invention. It is a block diagram of the attribute certificate issuing module which concerns on embodiment of this invention. It is a figure which shows the operation sequence of the whole multi-attribute authentication system which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the user terminal in the multi-attribute authentication system which concerns on embodiment of this invention. It is the operation | movement conceptual diagram quoted in order to demonstrate the management method of the effective period of the attribute information of the multi-attribute authentication system which concerns on embodiment of this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<System configuration of multi-attribute authentication system>
FIG. 1 is a diagram illustrating an example of a system configuration of a multi-attribute authentication system according to an embodiment of the present invention.
As shown in FIG. 1, a multi-attribute authentication system according to this embodiment includes a user terminal 1 (U), a service providing server (hereinafter simply referred to as an SP server 2) managed and operated by a service provider, an attribute certificate authority (CA) and an attribute authentication server 3 managed and operated, both of which are connected via a network 4.

  The user terminal 1 includes an attribute authentication client module 10, the SP server 2 includes an attribute authentication server module 20, and the attribute authentication server 3 includes an attribute certificate issuance module 30.

<Configuration of attribute authentication client module>
Further, as shown in FIG. 2, the attribute authentication client module 10 includes a key generation unit 12, an attribute certificate transformation unit 13, a transmission unit 14, and a processing unit 15.

  The key generation unit 12 generates user secret keys x1, x2, x3,..., Xi and public keys y1 = x1 * P, y2 = x2 * P, y3 = x3P,..., Yi = xiP. . Note that one key pair is prepared for the number of attributes + 1.

  The attribute certificate modification unit 13 generates a random number f and uses the random number f to transform the attribute certificate issued by the attribute authentication server (CA) 3. For example, when presenting attribute 2 (corresponding keys are x2, y2) and attribute 3 (corresponding keys are x3, y3), it is transformed into fzy1, fzy2, and fzy3.

  The transmission unit 14 transmits the service provision request, the attribute certificate modified by the attribute certificate modification unit 13, and the signature value calculated by the processing unit 15 to the SP server 2. Further, the generated public keys y1, y2, y3,..., Yi are transmitted to the attribute authentication server (CA) 3.

  For example, when presenting attribute 2 (corresponding keys are x2 and y2) and attribute 3 (corresponding keys are x3 and y3), the processing unit 15 generates two secret keys x1 generated by the key generation unit 12. , X2, and x3 are transformed into fx1, fx2, and fx3 by a random number f, and a signature value for r * ys is calculated using the transformed fx1, fx2, and fx3. Specifically, using the secret keys fx1, fx2, and fx3 transformed by the random number f generated by the attribute certificate transformation unit 13, the signature value for the challenge r * ys is s1 = f * x1 * r * ys, s2. = F * x2 * r * ys, s3 = f * x3 * r * ys. Thereby, since the signature value is calculated by a simple calculation formula, the calculation load can be reduced.

<Configuration of attribute authentication server module>
As shown in FIG. 3, the attribute authentication server module 20 includes an attribute certificate verification unit 21, a signature value verification unit 22, a revocation confirmation execution unit 23, a service provision unit 24, a key generation unit 25, The challenge generation unit 26 and the transmission unit 27 are included.

  The attribute certificate verification unit 21 verifies the attribute certificate received from the user terminal 1. Specifically, when presenting attribute 2 (corresponding keys are x2, y2) and attribute 3 (corresponding keys are x3, y3), z1P, z2P, and z3P are set as public keys for issuing attributes. When e (fy1, z1P) e (fy2, z2P) e (fy3, z3P) = e (fz1y1, P) e (fz2y2, P) e (fz3y3, P) is satisfied, this equation is established. Whether the attribute certificate is valid or not is verified. Thereby, since the attribute certificates transmitted from the user terminal can be verified together, the calculation load can be reduced.

  The signature value verification unit 22 verifies the signature value received from the user terminal 1. Specifically, when presenting attribute 2 (corresponding key is x2, y2) and attribute 3 (corresponding key is x3, y3), e (s1, P) e (s2, P) e ( s3, P) = e (fy1, r * ys) e (fy2, r * ys) e (fy3, r * ys) is calculated, and the validity of the signature is verified based on whether the arithmetic expression is satisfied. . Thereby, since the signature value is calculated by the simple calculation formula as described above, the calculation load can be reduced.

  The revocation confirmation execution unit 23 executes revocation confirmation. First, the revocation list is acquired from the attribute authentication server 3 in advance or on the spot. The revocation list is generated by the issuing authority, and y1 and z1y1 of revoked users are disclosed. The revocation list is signed by the issuing authority, and its validity can be confirmed.

  Specifically, in the case of presenting attribute 2 (corresponding keys are x2, y2) and attribute 3 (corresponding keys are x3, y3), for all y1s on the revocation list, r * xs * y1 is calculated, and it is verified whether e (z1y1, s1) = e (f * z1 * y1, r * xs * y1) holds. When this expression is established, it is determined that the key (all attributes of the user) is invalid (has expired).

  Further, when only one attribute is revoked, for example, when only attribute 2 is revoked, y2 and z2y2 are disclosed. Then, r * xs * y2 is calculated for all y2s on the revocation list, and it is verified whether e (z2y2, s2) = e (f * z2 * y2, r * xs * y2) holds. . Therefore, the revocation list cannot be traced by a third party who does not know the service provider's private key x3 and can easily trace the user's behavior from the communication history before the revocation information was disclosed. Confirmation processing can be realized.

  The service providing unit 24 provides the service based on the attribute information to the user terminal 1 when the validity of the attribute certificate is confirmed, the validity of the signature value is confirmed, and the revocation confirmation is completed. I do.

  The key generation unit 25 generates its own private key xs and public key ys (= xs * P). At this time, the public key certificate zys is issued from the attribute authentication server 3 in advance. The challenge generation unit 26 generates a random number r, calculates r * ys, and generates the calculated value as a challenge. The transmission unit 27 transmits the challenge generated by the challenge generation unit 26 to the user terminal 1.

<Configuration of attribute certificate issuing module>
As shown in FIG. 4, the attribute certificate issuance module 30 includes a signature unit 31, an attribute certificate issuance unit 32, a transmission unit 33, a user information storage unit 34, and a data table generation unit 35. Yes.

  The signature unit 31 signs the public keys y1, y2, y3,..., Yi generated by the key generation unit 12 of the user terminal 1 with the signature keys z1 and z2 that are held. As shown in FIG. 7, the signature key having the longest validity period is used among the existing ones. Specifically, when the signature private key is zi and the corresponding public key is ziP (P is a generation source), the signature is ziyy. Thereby, only necessary and sufficient information can be given to the user, and the user's fraud can be prevented. In addition, since the calculation load can be reduced, the calculation speed can be increased.

  The attribute certificate issuing unit 32 issues {y1, y2, z1y1, z2y2, z3y3,..., Ziyi} to the user terminal 1 as attribute certificates. The transmitting unit 33 transmits the attribute certificate issued by the attribute certificate issuing unit 32 to the user terminal 1.

  The user information storage unit 34 stores y1, z1y1, z2y2, z3y3,..., Ziyy as long as the issued user's private keys x1, x2, x3,. deep.

<Operation sequence of multi-attribute authentication system>
FIG. 5 is an operation sequence diagram showing the operation flow of the entire multi-attribute authentication system according to the embodiment of the present invention in time series, and FIG. 6 is a flowchart showing the operation flow of the user terminal. is there. The operation sequence diagram shown in FIG. 5 also shows the procedure of the attribute information anonymization method in the multi-attribute authentication system of the present invention.
The operation of the multi-attribute authentication system shown in FIG. 1 will be described in detail below with reference to FIGS.

  First, the key generation unit 12 of the user terminal 1 includes the user's private keys x1, x2, x3,..., Xi and the public key y1 = x1 * P, y2 = x2 * P, y3 = x3P,. yi = xiP is generated (step S201 in FIG. 5 and steps S301 and S302 in FIG. 6). Here, P is a generation source. Then, the transmission unit 14 of the user terminal 1 transmits a public key y1, y2, y3,..., Yi and an attribute certificate issuance request to the attribute authentication server 3 (step S202 in FIG. 6).

  The attribute authentication server 3 signs y1, y2, y3,..., Yi with the attribute signature keys z1 and z2 held (step S302 in FIG. 6). Note that the signature key with the longest validity period is used (see FIG. 7). The signature is ziyi when the signature private key is zi and the corresponding public key is ziP.

  Then, {y1, y2, z1y1, z2y2, z3y3,..., Ziyi} are issued as certificates to the user terminal 1. Further, as long as the issued user's private keys x1, x2, x3,..., Xi are within the validity period, y1, z1y1, z2y2, z3y3,. Steps S203 and S204, step S303 in FIG. 6).

  FIG. 7 conceptually shows how to manage the effective period. In FIG. 7, t on the horizontal axis indicates the flow of time. According to the present invention, since the attribute information is only key information, it is necessary to manage a new effective period. For this reason, as shown in FIG. 6, the attribute certificate issuing module 30 of the attribute authentication server 3 manages a validity period by assigning a plurality of signature keys for each attribute and periodically updating the combination. I have to. At that time, a plurality of title keys assigned for each attribute are managed in parallel so that a user who can enjoy the service only for a very short period does not occur.

  In order to assign the signature key having the longest validity period, for example, as shown in FIG. 7, if the key is to be assigned in the latter half of the usage period of the key A, the attribute authentication server 3 The attribute certificate issuing module 30 assigns a signature key D or a signature key E to the attribute authentication client module 10 of the user terminal 1. Thereby, the inconvenience that the user can receive the service for a very short period can be prevented.

  Next, the transmission unit 14 of the user terminal 1 transmits a service provision request to the SP server 2 (step S208 in FIG. 5 and step S304 in FIG. 6). The key generation unit 25 of the SP server 2 generates its own secret key xs and public key ys = xs * P (step S205 in FIG. 5). Similarly, the attribute authentication server 3 receives the public key certificate zys. The SP server 2 transmits a certificate issuance request to the attribute authentication server 3 (step S206 in FIG. 5). In response to this issuance request, the attribute authentication server 3 A certificate is issued (step S207 in FIG. 5).

  The challenge generation unit 26 of the SP server 2 generates a random number r, calculates r * ys, and transmits the calculated value as a challenge to the user terminal 1 from the transmission unit 27 (step S209 in FIG. 5). Step S305 in FIG. 6).

  The attribute certificate modification unit 13 of the user terminal 1 transforms the received attribute certificate (step S210 in FIG. 5 and step S306 in FIG. 6). Specifically, for example, when attribute 2 (corresponding keys are x2, y2) and attribute 3 (corresponding keys are x3, y3), a random number f is generated, and fzy1, fzy2, fzy3 and Deform.

  At this time, the secret key is also transformed into fx1, fx2, and fx3. Then, the processing unit 15 of the user terminal 1 calculates a signature value for r * ys using fx1, fx2, and fx3. Specifically, s1 = f * x1 * r * ys, s2 = f * x2 * r * ys, and s3 = f * x3 * r * ys are calculated (step S211 in FIG. 5).

  The transmission unit 14 of the user terminal 1 returns the modified attribute certificate and the calculated signature value to the SP server 2 (step S212 in FIG. 5 and step S307 in FIG. 6).

  The attribute certificate verification unit 21 of the SP server 2 verifies the sent attribute certificate (step S213 in FIG. 5 and step S308 in FIG. 6). Here, Pairing calculation is used for verification. Specifically, when the pairing calculation is represented by e (*, *), when attribute 2 (corresponding key is x2, y2) and attribute 3 (corresponding key is x3, y3) is presented , Z1P, z2P, z3P are e (fy1, z1P) e (fy2, z2P) e (fy3, z3P) = e (fz1y1, P) e (fz2y2, P) e (Fz3y3, P) is calculated, and the validity of the attribute certificate is verified depending on whether or not this calculation formula is satisfied. It is verified whether or not e (f (y1 + y2), zP) = e (fz (y1 + y2), P) holds.

  Next, the signature value verification unit 22 of the SP server 2 verifies the sent signature (step S214 in FIG. 5 and step S308 in FIG. 6). Specifically, when presenting attribute 2 (corresponding key is x2, y2) and attribute 3 (corresponding key is x3, y3), e (s1, P) e (s2, P) e ( s3, P) = e (fy1, r * ys) e (fy2, r * ys) e (fy3, r * ys) is calculated, and the validity of the signature is verified based on whether the arithmetic expression is satisfied. .

  Further, the revocation confirmation execution unit 23 of the SP server 2 performs revocation confirmation (step S215 in FIG. 5 and step S309 in FIG. 67). Here, when revocation confirmation is performed, a revocation list is acquired from the attribute authentication server 3 in advance or on the spot. The revocation list is generated by the attribute authentication server 3, and public keys y1 and z1y1 of revoked users are disclosed. The revocation list is given a signature by the attribute authentication server 3, and its validity can be confirmed.

  The revocation check calculates r * x3 * y1 for all y1 on the revocation list, specifically, attribute 2 (corresponding key is x2, y2), attribute 3 (corresponding key is When presenting x3, y3), r * xs * y1 is calculated for all y1s on the revocation list, and e (z1y1, s1) = e (f * z1 * y1, r * xs * It is verified whether y1) holds. When this expression is established, it is determined that the key (all attributes of the user) is invalid (has expired).

  Further, when only one attribute is revoked, for example, when only attribute 2 is revoked, y2 and z2y2 are disclosed. Then, r * xs * y2 is calculated for all y2s on the revocation list, and it is verified whether e (z2y2, s2) = e (f * z2 * y2, r * xs * y2) holds. .

  The SP server 2 determines that the authentication is successful when the certificate validity check, the signature validity check, and the revocation check are completed, and the service providing unit 24 of the SP server 2 sets the attribute to the user terminal 1. Service provision based on information is performed (step S216 in FIG. 5 and step S310 in FIG. 6).

  In addition, specific uses of the multi-attribute authentication system described above include the confirmation of medical qualifications in the disclosure of medical information, or qualifications such as Silver Pass issued publicly in public transportation. The use such as confirming is conceivable.

  As described above, in this embodiment, a plurality of attributes can be simultaneously authenticated in any combination. In addition, anonymity is guaranteed during attribute authentication. Moreover, the attribute used for attribute authentication cannot be transferred or lent to another person. Further, in attribute authentication, communication with a third party is not required. Further, any modification of the attribute information is possible without communication with a third party. Furthermore, secure attribute authentication can be realized without a tamper-resistant device on the user side.

  The attribute authentication client module 10, the attribute authentication server module 20, and the attribute certificate issuance module 30 shown in FIG. 1 are programs that are executed by the user terminal 1, the SP server 2, and the attribute authentication server 3, respectively. The program is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read by the user terminal 1, the SP server 2, and the attribute authentication server 3 (all computer systems) and executed. The multi-attribute authentication system of the invention can be realized. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention. For example, in the present embodiment, the mode in which the attribute authentication server 3 executes the revocation checking process has been described. However, a server that performs the revocation checking process may be provided separately from the attribute authentication server 3.

1 User terminal (U)
2. Service providing server (SP server)
3 ... Attribute authentication server (CA server)
DESCRIPTION OF SYMBOLS 4 ... Network 10 ... Attribute authentication client module 12 ... Key generation part 13 ... Attribute certificate transformation part 14 ... Transmission part 15 ... Processing part 20 ... Attribute authentication server module 21 ... Attribute certificate verification unit 22 ... Signature value verification unit 23 ... Revocation check execution unit 24 ... Service provision unit 25 ... Key generation unit 26 ... Random number generation unit 27 ... Transmission Unit 30... Attribute certificate issuing module 31... Signature unit 32... Attribute certificate issuing unit 33.

Claims (8)

A multi-attribute authentication system comprising a user terminal, an attribute certificate issuing server, and a service providing server connected via a network,
The user terminal is
The user's private keys x1, x2, x3,..., Xi and public keys y1 = x1 * P, y2 = x2 * P, y3 = x3P,. source) and one multi have number than the number j of the attribute and (i = j + 1) the first key generating means for generating,
First transmitting means for transmitting the generated public key to the attribute certificate issuing server;
Second transmission means for transmitting a service provision request to the service provision server;
Deforming means for generating a random number f and transforming the attribute certificate issued by the attribute certificate issuing server using the random number f;
A secret key corresponding to the number of attributes is transformed with a random number f, and a signature value for the service provider's public key ys received from the service providing server is multiplied by a random number r using the transformed secret key. Processing means for calculating;
Third transmitting means for transmitting the attribute certificate modified by the modifying means and the signature value calculated by the processing means to the service providing server;
With
The attribute certificate issuing server is
Signing means for signing with the signature keys z1, z2 ,..., Zi possessed by the public key generated by the key generation means of the user terminal;
Issuing means for issuing {y1, y2, z1y1, z2y2, z3y3,..., Ziyi} as attribute certificates to the user terminal;
With
The service providing server is
Second key generation means for generating its own private key xs and public key ys (= xs * P, P; generation source ) ;
Fourth transmission means for transmitting the information including the generated random number r and the public key ys to the user terminal as a challenge;
First verification means for verifying the attribute certificate received from the user terminal;
Second verification means for verifying a signature value received from the user terminal;
Revocation check execution means for executing revocation check;
When the validity of the attribute certificate is confirmed by the first verification means, the validity of the signature value is confirmed by the second verification means, and the revocation confirmation is completed by the revocation confirmation execution means, Service providing means for providing a service based on attribute information to the user terminal;
A multi-attribute authentication system characterized by comprising:   The service providing server generates a random number r, calculates r * ys from the random number r and its public key ys (= xs * P), and transmits it as a challenge. The described multi-attribute authentication system.   The processing means of the user terminal uses the secret keys fx1, fx2,..., Fxm for the attribute transformed by the random number f generated by the transformation means, and sets the signature value for r * ys to s1 = fx1 * r The multi-attribute authentication system according to claim 2, wherein calculation is performed using * ys, s2 = fx2 * r * ys,..., Si = fxi * r * ys.   When the first verification means of the service providing server uses z1P, z2P,..., ZiP as public keys for issuing attributes, e (fy1, z1P) e (fy2, z2P)... E (fyi , ZiP) = e (fz1y1, P) e (fz2y2, P)... E (fziyi, P), and verifying the validity of the attribute certificate depending on whether the arithmetic expression holds. The multi-attribute authentication system according to claim 1.   The second verification means of the service providing server is e (s1, P) e (s2, P)... E (si, P) = e (fy1, r * ys) e (fy2, r * ys) ... The multi-attribute authentication system according to claim 3, wherein e (fyi, r * ys) is calculated, and the validity of the signature is verified based on whether or not the calculation formula is satisfied.   The revocation confirmation execution means of the service providing server calculates r * xs * y1 for all y1s on the revocation list and e (z1y1, s1) = e (f * z1 * y1, r * The multi-attribute authentication system according to claim 2 or 3, wherein xs * y1) is calculated, and revocation confirmation is executed depending on whether or not the calculation formula is satisfied. A multi-attribute authentication method in a multi-attribute authentication system in which a user terminal, an attribute certificate issuing server, and a service providing server are connected via a network,
, Xi and public keys y1 = x1 * P, y2 = x2 * P, y3 = x3P,..., Yi = the user's private keys x1, x2, x3 ,. XIP; a first step of (P origin) one multi have number than the number j of the attribute (i = j + 1) generating,
A second step in which the user terminal transmits the generated public key to the attribute certificate issuing server;
The attribute certificate issuing server, and a third step to be performed on the received public key, the signature key z1, z2 held, ..., a signature Zi,
A fourth step in which the attribute certificate issuing server issues {y1, y2, z1y1, z2y2, z3y3,... Ziii} as attribute certificates to the user terminal;
A fifth step in which the user terminal transmits a service provision request to the service provision server;
A sixth step in which the service providing server generates its own private key xs and public key ys (= xs * P, P; generation source ) ;
A seventh step in which the service providing server transmits information including the generated random number r and the public key ys to the user terminal as a challenge;
An eighth step in which the user terminal generates a random number f and uses the random number f to transform the attribute certificate issued by the attribute certificate issuing server;
The user terminal modifies a secret key corresponding to the number of attributes with a random number f and uses the modified secret key to multiply the service provider's public key received from the service providing server by a random number. A ninth step of calculating a signature value;
A tenth step in which the user terminal transmits the modified attribute certificate and the calculated signature value to the service providing server;
An eleventh step in which the service providing server verifies the attribute certificate received from the user terminal;
A twelfth step in which the service providing server verifies a signature value received from the user terminal;
A thirteenth step in which the service providing server executes a revocation check;
The service providing server provides the service based on the attribute information to the user terminal when the validity of the attribute certificate is confirmed, the validity of the signature value is confirmed, and the revocation confirmation is completed. A fourteenth step of performing
A multi-attribute authentication method comprising: A program for causing a computer to execute a multi-attribute authentication method in a multi-attribute authentication system in which a user terminal, an attribute certificate issuing server, a service providing server, and a reliable server are connected via a network,
, Xi and public keys y1 = x1 * P, y2 = x2 * P, y3 = x3P,..., Yi = the user's private keys x1, x2, x3 ,. XIP; a first step of (P origin) one multi have number than the number j of the attribute (i = j + 1) generating,
A second step in which the user terminal transmits the generated public key to the attribute certificate issuing server;
The attribute certificate issuing server, and a third step to be performed on the received public key, the signature key z1, z2 held, ..., a signature Zi,
A fourth step in which the attribute certificate issuing server issues {y1, y2, z1y1, z2y2, z3y3,... Ziii} as attribute certificates to the user terminal;
A fifth step in which the user terminal transmits a service provision request to the service provision server;
A sixth step in which the service providing server generates its own private key xs and public key ys (= xs * P, P; generation source ) ;
A seventh step in which the service providing server transmits information including the generated random number r and the public key ys to the user terminal as a challenge;
An eighth step in which the user terminal generates a random number f and uses the random number f to transform the attribute certificate issued by the attribute certificate issuing server;
The user terminal modifies a secret key corresponding to the number of attributes with a random number f and uses the modified secret key to multiply the service provider's public key received from the service providing server by a random number. A ninth step of calculating a signature value;
A tenth step in which the user terminal transmits the modified attribute certificate and the calculated signature value to the service providing server;
An eleventh step in which the service providing server verifies the attribute certificate received from the user terminal;
A twelfth step in which the service providing server verifies a signature value received from the user terminal;
A thirteenth step in which the service providing server executes a revocation check;
The service providing server provides the service based on the attribute information to the user terminal when the validity of the attribute certificate is confirmed, the validity of the signature value is confirmed, and the revocation confirmation is completed. A fourteenth step of performing
A program that causes a computer to execute.

Images