JP6267658B2 - Signature generation apparatus, signature system, signature generation method, and program - Google Patents

Description

  The present invention relates to information security application technology, and more particularly to proxy signature technology.

  One of the electronic signature methods is a proxy signature method (see Non-Patent Document 1, for example). In a general proxy signature method, a signature generation device acting as a proxy for generation of a signature holds a signature key such as a secret key. A terminal device (client device) entrusting signature generation transmits plaintext and authentication information (certificate, ID, password, etc.) to the signature generation device. The signature generation device performs an authentication process using the authentication information. If the authentication is successful, the signature generation device generates a signature for the plaintext using the signature key, and sends the signature to the terminal device. The terminal device sends the plaintext and the signature to the verification device, and the verification device performs signature verification using a verification key such as a public key.

D. Chaum, “Blind signatures for untraceable payments,” Proc. Of CRYPTO, 1982.

  However, in the conventional method, authentication processing and management of information necessary for the authentication processing must be individually performed for each terminal device or user.

  An object of the present invention is to reduce authentication processing in proxy signature technology and management of information necessary for the authentication processing.

  Registration information corresponding to line information of any line that can be line-authenticated is stored in the signature generation apparatus. The signature generation device receives information corresponding to the signature target information and line correspondence information corresponding to the line information of the used line that has been successfully authenticated, and when the line correspondence information corresponds to the registration information, the signature information for the signature target information Outputs response information corresponding to.

  In the present invention, the presence / absence of output of response information is determined for each used line based on the line correspondence information corresponding to the line information of the used line that has been successfully authenticated, so that authentication processing and management of information necessary for it can be reduced. .

FIG. 1 is a block diagram illustrating a functional configuration of the signature system according to the embodiment. FIG. 2 is a flowchart for explaining the signature generation method of the embodiment. FIG. 3 is a block diagram illustrating a functional configuration of the signature system according to the embodiment. FIG. 4 is a flowchart for explaining the signature generation method of the embodiment. FIG. 5 is a block diagram illustrating a functional configuration of the signature system according to the embodiment. FIG. 6 is a flowchart for explaining the signature generation method of the embodiment.

Embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
A first embodiment of the present invention will be described.
<Configuration>
The configuration of this embodiment will be described. As illustrated in FIG. 1, the signature system 1 of this embodiment includes a terminal device 11 and a signature generation device 12. The terminal device 11 and the signature generation device 12 are configured to be able to communicate through a public line having a line authentication function and a line information notification function.

  The line authentication (network based authentication) is a user authentication technique for confirming that “this user has surely communicated from this line”. Line authentication itself is well known. For example, Reference 1 ("NTT Data, NGN Line Information Utilizing Line Information Development-Establishing a Mechanism for Ensuring Security Easily", [online], stock Company NTT Data, [Search on December 31, 2014], Internet <http://www.nttdata.com/en/news/release/2009/091600.html>) and US Patent Application Publication No. US2007- [0234] It is disclosed in the specification of A1 and the like. When the terminal apparatus 11 communicates with the signature generation apparatus 12 using a specific public line, line information (network based identification) corresponding to the line used by the terminal apparatus 11 is sent to the authentication apparatus. Examples of line information can be found in, for example, Reference 2 (Nir Yosef, Roded Sharan, and William Stafford Noble, “Improved network-based identification of protein orthologs,” Oxford Journals, Science & Mathematics Bioinformatics, Volume 24, Issue 16, pp. i200-i206, http://bioinformatics.oxfordjournals.org/content/24/16/i200.). If the line authentication in the authentication apparatus is successful, the terminal apparatus 11 can communicate with the signature generation apparatus 12 through this line. If the line authentication in the authentication apparatus fails, the terminal apparatus 11 cannot communicate with the signature generation apparatus 12 through this line. Specific examples of the line authentication include NGN (next generation network) line authentication and EAP-SI authentication. Specific examples of the line information include an identifier unique to a device connected to the line, a MAC address of a gateway (home gateway, etc.), a FLET'S number (registered trademark), an IMSI (International Mobile Subscriber Identity), an e-mail address, a department name It is.

  The line information notification function is a function for notifying the communication destination apparatus of line information of the line in communication using a certain line. The line information notification function is also known. For example, Reference 3 (“Line Information Notification Function”, [online], East Nippon Telegraph and Telephone Corporation, FLET'S Official Homepage, [December 31, 2014 Search], Internet <http </flets.com/asc/s_outline.html>). When the terminal apparatus 11 communicates with the signature generation apparatus 12 via a certain line, the signature generation apparatus 12 is notified of the line information of the line or information uniquely determined for the line information.

  As illustrated in FIG. 1, the terminal device 11 of this embodiment includes a storage unit 111, an output unit 113, an input unit 114, and a signature generation entrusting unit 115. The signature generation apparatus 12 includes storage units 121 and 122, an input unit 123, an output unit 124, a determination unit 125, and a signature processing unit 126. Each device is predetermined in a general-purpose or dedicated computer including a processor (hardware processor) such as a CPU (central processing unit) and a memory such as RAM (random-access memory) and ROM (read-only memory). This program is configured by reading the program. The computer may include a single processor and memory, or may include a plurality of processors and memory. This program may be installed in a computer, or may be recorded in a ROM or the like in advance. In addition, some or all of the processing units are configured using an electronic circuit that realizes a processing function without using a program, instead of an electronic circuit (circuitry) that realizes a functional configuration by reading a program like a CPU. May be. In addition, an electronic circuit constituting one device may include a plurality of CPUs. Information output from each processing unit is stored in a temporary memory (not shown), read out as necessary, and used for processing of each processing unit. For convenience of description, FIG. 1 shows one terminal device 11 and one signature generation device 12, but two or more terminal devices 11 and signature generation devices 12 may exist. At this time, two or more terminal devices 11 and signature generation devices 12 may be connected to the same line.

<Pre-processing>
In this embodiment, a key pair (sk, pk) of the signature key sk and the verification key pk corresponding thereto is set in advance. The key pair (sk, pk) may be, for example, a key pair (secret key, public key) of a secret key of a public key cryptosystem (RSA cryptosystem, etc.) and a public key corresponding thereto, or an ID-based cryptosystem ( Reference 4 “D. Boneh, M. Franklin,“ Identity based encryption from the Weil pairing, ”Crypto 2001, Lecture Notes in Computer Science, Vol. 2139, Springer-Verlag, pp.213-229, 2001 etc.) It may be a pair of a private key and a corresponding identifier (secret key, identifier), or a functional encryption method (reference 5 “Tatsuaki Okamoto, Katsuyuki Takashima,“ Fully Secure Functional Encryption with General Relations from the Decisional Linear Assumption ” , CRYPTO 2010, pp.191-208 (2010), etc.) and a corresponding attribute vector (secret key, attribute vector). Only one set of key pairs (sk, pk) may be set, or a plurality of different key pairs (sk, pk) may be set. The set signature key sk is stored in the storage unit 121 of the signature generation apparatus 12 in association with the verification key pk (information for specifying the signature key) corresponding to the signature key sk. When only one key pair (sk, pk) is set, one signature key sk and a corresponding verification key pk are stored in association with each other. When a plurality of different key pairs (sk, pk) are set, a plurality of different verification keys pk and their corresponding verification keys pk are stored in association with each other. A list including such signature keys sk and verification keys pk associated therewith is denoted as “sk-List”.

  As pre-registration processing, “registration information” corresponding to the line information of the line for which the signature generation apparatus 12 performs signature substitution is preset and stored in the storage unit 122 (registration information storage unit) of the signature generation apparatus 12. . Here, the “line on which the signature generation apparatus 12 performs signature substitution” means a line used for the request by the terminal apparatus 11 entrusting signature generation to the signature generation apparatus 12. In addition, the authority that can receive a signature proxy is called “signature proxy authority”. The “registration information” in this embodiment corresponds to line information of any line that can be authenticated. The “registration information” may be the line information itself of the line for which the signature generation apparatus 12 performs signature substitution, or may be information uniquely determined for the line information. In addition, depending on the type of line information, it may be difficult for the signature generation apparatus 12 to identify the user from the line information for line authentication due to reasons such as non-disclosure. In some cases, it may be difficult to manage whether or not there is a signature proxy authority. For example, when a mobile phone is used as a terminal device, line information such as IMEI or IMSI is used for line authentication, but it may be difficult for the signature generation apparatus 12 to perform such management using IMEI or IMSI. . Further, when a FLET'S number is used for line information for NGN line authentication, it may be difficult for the signature generation apparatus 12 to perform such management using the FLET's number. In many cases, the signature generation device 12 is easier to manage using general line information such as a highly versatile telephone number. Therefore, when a plurality of pieces of line information are associated with one line, a part of the line information (for example, IMEI, IMSI, FLET'S number, MAC address, etc.) is used for line authentication. Other line information (general line information or the like) associated with (corresponding to) the line information used for line authentication may be used for management. The other line information associated with the line information used for line authentication will be referred to as “unique information”. The “unique information” may be public information or non-public information. After all, the “registration information” may be the line information itself used for line authentication of the line for which the signature generation apparatus 12 performs the signature substitution, or may be information uniquely determined for the line information. The signature generation device 12 may be unique information of a line that performs signature substitution, may be information that is uniquely determined with respect to this unique information, or a line that the signature generation device 12 performs signature substitution. It may be a set of line information used for line authentication and unique information associated therewith, or may be information uniquely determined for the set, or includes any of these information It may be information. Hereinafter, a list including “registration information” is referred to as “List”.

  Furthermore, the plain text m (signature target information) to be signed and any signature key sk included in the sk-List are stored in the storage unit 111 of the terminal device 11 that uses the line on which the signature generation device 12 performs signature substitution. A corresponding verification key pk is stored.

<Signature generation processing>
The signature generation process according to this embodiment will be described with reference to FIG. The signature generation entrusting unit 115 of the terminal device 11 (FIG. 1) reads the plaintext m and the verification key pk from the storage unit 111, and outputs the plaintext m and the verification key pk. The plaintext m and the verification key pk are input to the output unit 113. The output unit 113 outputs the plaintext m and the verification key pk to a predetermined line (used line) of the public line with the signature generation device 12 as a destination (proxy signature request: step S101).

  The line information dx of the line (used line) from which the plaintext m and the verification key pk are output is sent to an authentication device (not shown) that provides a line authentication function, and this authentication device uses line information dx for line authentication. Is performed (step S102). If the line authentication has failed (step S103), error information is transmitted to the terminal device 11. The transmitted error information is input to the input unit 114 and sent to the signature generation entrusting unit 115, and the signature generation entrusting unit 115 ends the signature generation process (step S104).

  On the other hand, when the line authentication is successful (step S103), the plaintext m and the verification key pk are transmitted to the signature generation apparatus 12, and a notification apparatus (not shown) that provides a line information notification function is further connected to the line information dx. The line correspondence information x corresponding to is transmitted to the signature generation device 12. The line correspondence information x may be the line information dx itself, information that is uniquely determined for the line information dx, or a unique information id associated with the line information dx. Alternatively, it may be information uniquely determined with respect to this unique information id, or may be a combination of the line information dx and the unique information id associated therewith. The information may be determined automatically, or may be information including any of these pieces of information (step S105). Plain text m (information corresponding to signature target information), verification key pk (information for specifying a signature key), and line correspondence information x (line correspondence information corresponding to line information of a used line) Are input (accepted). The line correspondence information x input to the input unit 123 is information corresponding to a line (used line) that has been successfully authenticated. The line correspondence information x is sent to the determination unit 125, and the plaintext m and the verification key pk are sent to the signature processing unit 126 (step S106). The determination unit 125 determines whether the line correspondence information x corresponds to any “registration information” in the list List stored in the storage unit 122. For example, when the “registration information” included in the list List is the line information itself used for line authentication and the line correspondence information x is also the line information dx itself, the determination unit 125 determines that “the list List matches the line correspondence information x”. "Do you include" registration information "?" Even when the “registration information” included in the list List is “unique information” and the line correspondence information x is “unique information” associated with the line information dx, the determination unit 125 also determines that the “list list is line correspondence”. It is determined whether or not “registration information” matching the information x is included. When the “registration information” included in the list List is the line information itself used for line authentication, and the line correspondence information x is “unique information” associated with the line information dx, the determination unit 125 displays “list”. It is determined whether “List includes“ registration information ”corresponding to the line correspondence information x”. In addition, it may be determined whether the line correspondence information x corresponds to “registration information” by a method according to the type of information used for “registration information” and line correspondence information x (step S107). When the line correspondence information x does not correspond to any “registration information” in the list List (for example, when the list List does not include “registration information” that matches the line correspondence information x) (step S108), from the output unit 124 Error information is sent. The transmitted error information is input to the input unit 114 of the terminal device 11 and sent to the signature generation entrusting unit 115, and the signature generation entrusting unit 115 ends the signature generation process (step S109). On the other hand, when the line correspondence information x corresponds to any “registration information” in the list List (for example, when the list List includes “registration information” that matches the line correspondence information x) (step S108), the signature processing unit 126 searches the sk-List stored in the storage unit 121 using the input verification key pk, and extracts the signature key sk corresponding to the verification key pk. The signature processing unit 126 uses the extracted signature key sk (signature key specified by the information for specifying the signature key), and the signature (signature information, ie, electronic signature) of the input plaintext m s = sig (sk , M) is generated and output. For example, the signature processing unit 126 encrypts information (hash value or the like) corresponding to the plaintext m using the signature key sk, and outputs the ciphertext as the signature s (step S110). The signature s is input to the output unit 124. The output unit 124 outputs the signature s (response information corresponding to the signature information for the signature target information) to the line corresponding to the line correspondence information x with the terminal device 11 as the destination (step S111).

  The signature s is input to the input unit 114 of the terminal device 11 and sent to the signature generation entrusting unit 115 (step S112). The signature generation entrusting unit 115 extracts the verification key pk and the plaintext m from the storage unit 111, outputs the verification key pk, the plaintext m, and the signature s, and ends the signature generation process (step S113).

  The verification key pk, the plaintext m, and the signature s are sent to a verification device (not shown), and the verification device performs signature verification using these.

<Features of First Embodiment>
In this embodiment, the authentication process is not managed for each individual terminal device 11 having a large absolute number or its user, but is managed for each line having a small absolute number. Therefore, authentication processing and management costs can be reduced.

  In this embodiment, registration is not performed for each terminal device 11 or its user, but registration is performed for each line on which the signature generation device 12 performs signature substitution. Therefore, it is possible to allow the signature generation device 12 to generate a signature for a plurality of terminal devices 11 that have the authority to use the registered line properly without registering the individual terminal devices 11 or their users. , Can simplify the registration procedure. Further, since the signature substitution authority is given to the line, the signature substitution authority can be given to the terminal device 11 before the setting dedicated to this system is performed. That is, even before the program for executing the signature generation processing function of this embodiment is installed in the terminal device 11, the line information corresponding to the line used by the terminal device 11 can be specified. Can be stored in the signature generation device 12. In addition, when the registered unique information or the information uniquely determined for the specific information is used as “registration information” and “line correspondence information x”, the above management can be realized without using non-public information. it can.

  In this embodiment, the validity of the terminal device 11 is secured by line authentication in the public line. Therefore, it is not necessary for the terminal device 11 or its user to separately perform a special authentication process for generating a signature, and it is not necessary to separately hold secret information necessary for it.

  In the case where sk-List is stored in the storage unit 121 of the signature generation device 12 and the signature generation device 12 is configured to specify the secret key sk used for signature generation using the input public key pk, a plurality of types of secret keys sk are used. The signature generation device 12 can be entrusted to the signature generation device 12.

[Modification of First Embodiment]
The signature s may be generated using the signature key sk corresponding to the line correspondence information x. In this modification, for example, instead of the list sk-List including the signature key sk and the verification key pk associated therewith, the list sk- including the signature key sk and “registration information” associated therewith. List is used. When the line correspondence information x corresponds to any “registration information” in the list List (step S108), the signature processing unit 126 is stored in the storage unit 121 using the line correspondence information x instead of the verification key pk. Search sk-List, extract the signature key sk corresponding to the line correspondence information x, and generate the signature s. Alternatively, sk-List may be omitted, and List may include a signature key sk and “registration information” associated with them. In this configuration, when the line correspondence information x corresponds to any “registration information” in the list List (step S108), the signature processing unit 126 extracts the key sk associated with the “registration information”, and Generate a signature s. In these modified examples, the verification key pk corresponding to the signature key sk corresponding to the line correspondence information x of the line used by the terminal device 11 is stored in the storage unit 111. Alternatively, when the signature s is transmitted from the signature generation device 12 to the terminal device 11, a verification key pk corresponding to the signature key sk used for the generation may be attached.

  In the first embodiment, an example in which the verification key pk is used as “information for identifying a signature key” has been described. However, the key ID and other information may be “information for identifying a signature key”. In addition, when only one signature key sk is stored in the storage unit 121 of the signature generation apparatus 12, “information for identifying the signature key” can be omitted. In addition, the plaintext m is not transmitted in step S101, and it is determined in step S108 that the line correspondence information x corresponds to any “registration information” in the list List, and then the plaintext m is transmitted from the terminal device 11 to the signature generation device 12. The process after step S110 may be executed.

[Second Embodiment]
This embodiment is a modification of the first embodiment and is a method for generating a signature key after a proxy signature request based on an ID-based encryption method. Below, it demonstrates centering around difference with 1st Embodiment, About the already demonstrated matter, description is simplified by diverting the reference number used so far.

<Configuration>
The configuration of this embodiment will be described. As illustrated in FIG. 3, the signature system 2 of this embodiment includes a terminal device 21, a signature generation device 22, and a key generation device 23. The terminal device 21 and the signature generation device 22 are configured to be able to communicate through a public line having a line authentication function and a line information notification function. The signature generation device 22 and the signature generation device are configured to be communicable through a public line or a private line. For convenience of description, FIG. 2 also shows one terminal device 21 and one signature generation device 22, but two or more terminal devices 21 and signature generation devices 22 may exist. At this time, two or more terminal devices 21 and signature generation devices 22 may be connected to the same line. Similarly, a plurality of key generation devices 23 may exist.

  As illustrated in FIG. 3, the terminal device 21 of this embodiment includes a storage unit 211, an output unit 213, an input unit 114, and a signature generation entrusting unit 215. The signature generation device 22 includes a storage unit 122, an input unit 223, an output unit 124, a determination unit 125, and a signature processing unit 226. Each device may be configured, for example, by reading a predetermined program into the computer described above, or a part or all of the processing units may be configured using an electronic circuit.

<Pre-processing>
In this embodiment, the master secret key msk and parameter P of the ID-based encryption method are generated, the master secret key msk is securely stored in the key generation device 23, and P and msk · P are disclosed as public parameters. For example, msk is an element of the remainder ring, and P is a point on the elliptic curve (see Reference 4). Also, as pre-registration processing, “registration information” corresponding to the line information of the line for which the signature generation apparatus 22 performs signature substitution is preset and stored in the storage unit 122 (registration information storage unit) of the signature generation apparatus 22. . A specific example of “registration information” is the same as that described in the first embodiment except that “signature generation device 12” is replaced with “signature generation device 22”. Further, the plain text m (signature target information) to be signed and the identifier ID are stored in the storage unit 211 of the terminal device 21 that uses the line on which the signature generation apparatus 22 performs signature substitution. Examples of the identifier ID are a telephone number and a mail address.

<Signature generation processing>
The signature generation processing according to this embodiment will be described with reference to FIG. The signature generation entrusting unit 215 of the terminal device 21 (FIG. 3) reads the plain text m and the identifier ID from the storage unit 211, and outputs the plain text m and the identifier ID. The plaintext m and the identifier ID are input to the output unit 213. The output unit 213 outputs the plain text m and the identifier ID to a predetermined line (used line) of the public line with the signature generation device 22 as a destination (proxy signature request: step S201).

  Next, as described in the first embodiment, line authentication is performed (steps S102 to S104). When the line authentication is successful, the plaintext m and the identifier ID are transmitted to the signature generation apparatus 22 and the notification apparatus ( (Not shown) transmits the line correspondence information x corresponding to the line information dx to the signature generation apparatus 22. A specific example of the line correspondence information x is as described in the first embodiment (step S205). Plain text m (information corresponding to signature target information), identifier ID (information for specifying a signature key), and line correspondence information x (line correspondence information corresponding to line information of a used line) are stored in the signature generation device 22. It is input (accepted) to the input unit 223. The line correspondence information x is sent to the determination unit 125, and the plaintext m and the identifier ID are sent to the signature processing unit 126 (step S206). The determination unit 125 determines whether the line correspondence information x corresponds to any “registration information” in the list List stored in the storage unit 122 (steps S107 and S108). When the line correspondence information x does not correspond to any “registration information” in the list List, error information is transmitted from the output unit 124. The transmitted error information is input to the input unit 114 of the terminal device 21 and sent to the signature generation entrusting unit 215, and the signature generation entrusting unit 215 ends the signature generation process (step S109). On the other hand, when the line correspondence information x corresponds to any “registration information” in the list List, the signature processing unit 226 sends the input identifier ID to the key generation device 23. The key generation device 23 generates a signature key sk using the identifier ID and the master secret key msk. For example, the key generation device 23 maps the identifier ID to the point E (ID) on the elliptic curve, and calculates sk = msk · E (ID). The signature key sk is transmitted to the signature processing unit 226 (step S209). The signature processing unit 226 uses the signature key sk (signature key specified by the information for specifying the signature key) to generate and output a signature s = sig (sk, m) of the input plaintext m. (Step S210). The signature s is input to the output unit 124. The output unit 124 outputs the signature s (response information corresponding to the signature information for the signature target information) to the line corresponding to the line correspondence information x with the terminal device 21 as the destination (step S111).

  The signature s is input to the input unit 114 of the terminal device 21 and sent to the signature generation entrusting unit 215 (step S112). The signature generation entrusting unit 215 extracts the identifier ID and the plaintext m from the storage unit 211, outputs the identifier ID, the plaintext m, and the signature s, and ends the signature generation process (step S213).

  The identifier ID, plaintext m, and signature s are sent to a verification device (not shown), and the verification device performs signature verification using these and the public parameters described above.

<Features of Second Embodiment>
This embodiment also has the same characteristics as the first embodiment. Furthermore, in this embodiment, since the signature key is generated after the proxy signature request, the management of the sk-List as in the first embodiment becomes unnecessary.

[Modification of Second Embodiment]
Also in this embodiment, the signature s may be generated using the signature key sk corresponding to the line correspondence information x. For example, the signature key sk may be set using the line correspondence information x instead of the identifier ID, and the signature s may be generated. In the case of this configuration, it is not necessary to store the identifier ID in the storage unit 211 of the terminal device 21, and the identifier ID for the processing in steps S201 to S206 is also unnecessary. When the line correspondence information x corresponds to any “registration information” in the list List (step S108), the signature processing unit 126 sends the line correspondence information x instead of the identifier ID to the key generation device 23, and the key generation device. 23 generates a signature key sk using the line correspondence information x and the master signature key msk and sends it to the signature processing unit 126. The signature processing unit 126 generates a signature s using this signature key sk. In this modified example, the line correspondence information x is required for signature verification. Therefore, when the signature s is transmitted from the signature generation device 22 to the terminal device 21, the line correspondence information x corresponding to the signature key sk used for generation of the signature s. May be attached. In addition, the plaintext m is not transmitted in step S201, and the plaintext m is transmitted from the terminal device 21 to the signature generation device 22 after it is determined in step S108 that the line correspondence information x corresponds to any “registration information” in the list List. The process after step S209 may be executed. In the second embodiment, every time the terminal device 21 requests the signature generation device 22 for signature substitution, the signature generation device 22 requests the key generation device 23 to generate a signature key sk corresponding to the identifier ID. As a modified example, when the terminal device 21 requests the signature generation device 22 for the first time as a signature substitution, the signature generation device 22 requests the key generation device 23 to generate a signature key, and the signature key sk obtained thereby. May be stored in the storage unit of the signature generation device 22 in association with the identifier ID. As a result, when the terminal device 21 requests the signature generation device 22 for signature substitution again, the key generation device 23 searches the storage unit of the signature generation device 22 using the identifier ID, and the identifier ID obtained thereby. The signature may be generated using the signature key sk corresponding to. Thereby, the number of requests to the key generation device 23 can be reduced.

[Third Embodiment]
This embodiment is a modification of the first embodiment, and is a form for performing a signature substitution for a blind signature. Below, it demonstrates centering around difference with 1st Embodiment, About the already demonstrated matter, description is simplified by diverting the reference number used so far.

<Configuration>
The configuration of this embodiment will be described. As illustrated in FIG. 4, the signature system 3 of this embodiment includes a terminal device 31 and a signature generation device 32. The terminal device 31 and the signature generation device 32 are configured to be able to communicate through a public line having a line authentication function and a line information notification function. For convenience of description, FIG. 3 also shows one terminal device 31 and one signature generation device 32, but two or more terminal devices 31 and signature generation devices 32 may exist. At this time, two or more terminal devices 31 and signature generation devices 32 may be connected to the same line.

  As illustrated in FIG. 5, the terminal device 31 of this embodiment includes a storage unit 111, an output unit 313, an input unit 314, and a signature generation entrusting unit 315. The signature generation device 32 includes storage units 122 and 121, an input unit 323, an output unit 324, a determination unit 125, and a signature processing unit 326. Each device may be configured, for example, by reading a predetermined program into the computer described above, or a part or all of the processing units may be configured using an electronic circuit.

<Pre-processing>
The same as in the first embodiment.

<Signature generation processing>
The signature generation processing according to this embodiment will be described with reference to FIG. The signature generation entrusting unit 315 of the terminal device 31 (FIG. 5) reads the plaintext m and the verification key pk from the storage unit 111. The signature generation entrusting unit 315 generates a random number R and stores it in a temporary memory (not shown), and obtains disturbance information m ′ (disturbance information of signature target information) obtained by disturbing the plaintext m using the random number R. For example, the signature generation entrusting unit 315 inputs the random number R and the plaintext m to the homomorphism function F, and obtains disturbance information m ′ = F (R, m). The signature generation entrusting unit 315 outputs the disturbance information m ′ and the verification key pk. The disturbance information m ′ and the verification key pk are input to the output unit 313. The output unit 313 outputs the disturbance information m ′ and the verification key pk to a predetermined public line (used line) with the signature generation device 32 as a destination (proxy signature request: step S301).

  Next, as described in the first embodiment, line authentication is performed (steps S102 to S104). When the line authentication is successful, the disturbance information m ′ and the verification key pk are transmitted to the signature generation device 32, A notification device (not shown) transmits line correspondence information x corresponding to the line information dx to the signature generation device 32. A specific example of the line correspondence information x is as described in the first embodiment (step S305). Disturbance information m ′ (information corresponding to signature target information), verification key pk (information for specifying a signature key), and line correspondence information x (line correspondence information corresponding to line information of a used line) are generated as signatures. The data is input (accepted) to the input unit 323 of the device 32. The line correspondence information x is sent to the determination unit 125, and the disturbance information m 'and the verification key pk are sent to the signature processing unit 326 (step S306). Thereafter, the processing in steps S107 to S108 described in the first embodiment is executed, and when the line correspondence information x corresponds to any “registration information” in the list List (step S108), the signature processing unit 326 performs input. The sk-List stored in the storage unit 121 is searched using the verification key pk, and the signature key sk corresponding to the verification key pk is extracted. Using the extracted signature key sk, the signature processing unit 326 generates and outputs a concealment signature s ′ = bsig (sk, m ′) for the input disturbance information m ′. For example, the signature processing unit 326 encrypts the disturbance information m ′ using the signature key sk in accordance with the homomorphic encryption method, and outputs the ciphertext as a concealed signature s ′ (information for obtaining signature information). (Step S310). The concealment signature s ′ is input to the output unit 324. The output unit 324 outputs the concealment signature s ′ (response information corresponding to the signature information for the signature target information) to the line corresponding to the line correspondence information x with the terminal device 31 as the destination (step S311).

  The ciphered signature s ′ is input to the input unit 314 of the terminal device 31 and sent to the signature generation entrusting unit 315 (step S312). The signature generation entrusting unit 315 extracts the random number R used in step S301 from a temporary memory (not shown), and restores the signature s using the random number R and the concealed signature s ′. Further, the signature generation entrusting unit 315 extracts the verification key pk and the plaintext m from the storage unit 111, outputs the verification key pk, the plaintext m, and the signature s, and ends the signature generation process (step S313).

  The verification key pk, the plaintext m, and the signature s are sent to a verification device (not shown), and the verification device performs signature verification using these.

<Features of Third Embodiment>
This embodiment also has the same characteristics as the first embodiment. Further, in this embodiment, since the disturbance information of the plaintext m is sent to the signature generation device 32, the terminal device 31 can entrust signature generation without the content of the plaintext m being known to the signature generation device 32.

[Modification of Third Embodiment]
Blind signatures may be implemented using self-correcting techniques. Self-correction technology means that the correct calculation results are always output using a computer or system that does not necessarily output the correct calculation results (when using a computer that outputs the correct calculation results, the correct calculation results are output, and the correct results are not always output. When a computer that does not always output is used, a correct calculation result is obtained or a result indicating that the calculation cannot be obtained is obtained). The self-correction technique itself is a known technique. For example, Reference 6 (International Publication WO / 2012/057134), Reference 7 (International Publication WO / 2011/086992), and Reference 8 (International Publication WO). / 2012/121152) and the like. In this example, the disturbance information m ′ is the disturbance information of the plaintext m (signature target information), and the concealed signature s ′ (response information) is information for obtaining the signature s (signature information) by self-correction processing. is there.

In this modification, a signature s = f (m) = sig (sk, m) εG of plaintext mεH is obtained using G and H as a group, plaintext m as an element of the group H, and f as a signature key sk. Function, X ₁ , X ₂ is a random variable having a value in group G, x ₁ is a real value of random variable X ₁ , x ₂ is a real value of random variable X ₂ , and a and b are relatively prime Natural number. One of a and b may be a constant such as 1.

In step S301, the signature generation entrusting unit 315 outputs τ ₁ and / or τ ₂ that are elements of the group H corresponding to the plaintext m as disturbance information m ′. In step S310, the signature processing unit 326 outputs z ₁ and / or z ₂ as the cipher signature s ′. However, z ₁ = f (τ ₁ ) or z ₁ ≠ f (τ ₁ ), and z ₂ = f (τ ₂ ) or z ₂ ≠ f (τ ₂ ). Sometimes z ₁ = f (τ ₁ ) or not z ₁ = f (τ ₁ ), sometimes z ₂ = f (τ ₂ ) or not z ₂ = f (τ ₂ ) In some cases. That is, the signature processing unit 326 correctly calculates f (τ ₁ ) with a probability larger than a certain probability, sets the obtained calculation result as z _1, and correctly calculates f (τ ₂ ) with a probability larger than a certain probability. and, a calculation result obtained and z _2. The “certain probability” is a probability of less than 100%. The example of “certain probability” is a probability that cannot be ignored, and the example of “probability that cannot be ignored” is a case where a polynomial ψ (k) is a polynomial that is a broad monotone increasing function for the security parameter k. Of 1 / ψ (k) or more. That is, the signature processing unit 326 outputs a calculation result including an intentional or unintentional error. In step S313, the signature generation entrusting unit 315 sets u ^{b ′} v ^{a ′} corresponding to u = f (x) ^b x ₁ and v = f (x) ^a x ₂ satisfying u ^a = v ^b as ^a signature s. Output. However, a ′ and b ′ are integers satisfying a′a + b′b = 1. If z ₁ and / or z ₂ satisfying u ^a = v ^b is not obtained, the signature generation entrusting unit 315 outputs error information indicating that the signature s cannot be obtained. Alternatively, when z ₁ and / or z ₂ satisfying u ^a = v ^b are not obtained, the disturbance information m ′ newly generated by the signature generation entrusting unit 315 is output again, and the output unit 313 is output by the disturbance information m. 'Is transmitted to the signature generation device 32, the signature processing unit 326 calculates the ciphered signature s', the output unit 324 transmits the ciphered signature s' to the terminal device 31, and whether u ^a = v ^b is satisfied. Such a determination may be made. Here, when u ^a = v ^b is satisfied, u ^{b ′} v ^{a ′} is output as a signature s, and z ₁ and / or z ₂ satisfying u ^a = v ^b is obtained even if this process is repeated a predetermined number of times. If not, the signature generation entrusting unit 315 may output error information indicating that the signature s cannot be obtained.

<< Specific Example ₁ of τ ₁ , τ ₂ , u, v >>
For example, G and H are groups, h ₁ and h ₂ are non-unit elements of group H (eg, generators), r1 and r2 are random natural numbers of 0 or more, and f is plaintext m using a signature key sk. ∈H signature s = f (m) = sig (sk, m) ∈G homomorphism function for ^{_{obtaining, τ 1 = (h 1 -r1}} , h 1 r1 m b), τ 2 = (h 2 ^{_{-r2, h 2 r2 m a)}} , u = f (τ 1) = f (h 1 -r1) f (h 1 r1 m b), v = f (τ 2) = f (h 2 -r2) f (H ₂ ^r2 m ^a ).

<< Specific Example ₂ of τ ₁ , τ ₂ , u, v >>
For example, G, H is a cyclic group, μ _h is a generator of group H, ν = f (μ _h ), f is a signature key sk, and a signature s = f (m) = sig (sk , M) Homomorphism function for obtaining ∈ G, r1 and r2 are random natural numbers of 0 or more, τ ₁ = μ _h ^r1 m ^b , τ ₂ = μ _h ^r2 m ^a , u = z ₁ v ^−r1 , V = z ₂ v ^−r2 .

<< Specific Example 3 of τ ₁ , τ ₂ , u, v >>
For example, G is a cyclic group, H is a Cartesian product group G × G of group G, m = (c ₁ , c ₂ ) ∈H, f is a signature s = f (m ) = Sig (sk, m) εG to obtain a homomorphism function, (V, W) is an element of group H, f (V, W) = Y, r _{4 to} r ₇ are natural numbers of 0 or more random ^{_{number, τ 1 = (c 2 b}} W r4, c 1 b V r4 μ g r5), τ 2 = (c 2 a W r6, c 1 a V r6 μ g r7), u = z 1 Y -r4 μ _g ^-r5, and ^{_{v = z 2 Y -r6 μ g}} -r7.

  The disturbance information m ′ is not transmitted in step S301, and it is determined in step S108 that the line correspondence information x corresponds to any “registration information” in the list List, and then the disturbance information m is transmitted from the terminal device 31 to the signature generation device 32. 'May be transmitted, and the processing after step S310 or the above-described self-correction processing may be executed.

  Further, in the present embodiment, the configuration in which the signature generation of the first embodiment is performed using the blind signature technique is illustrated, but the signature generation of the second embodiment may be performed using the blind signature technique. In this case, the identifier ID is used instead of using the verification key pk for specifying the signature key sk, and instead of the signature processing unit 326 extracting the signature key sk from the sk-List, the signature generation apparatus A signature key sk corresponding to the identifier ID is generated and given to the signature processing unit 326. Others are as described in the third embodiment. Also in this case, a self-correction technique may be applied.

[Other variations]
The present invention is not limited to the embodiment described above. For example, the various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  When the above configuration is realized by a computer, the processing contents of the functions that each device should have are described by a program. By executing this program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded on a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium are a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like.

  This program is distributed, for example, by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads a program stored in its own recording device and executes a process according to the read program. As another execution form of the program, the computer may read the program directly from the portable recording medium and execute processing according to the program, and each time the program is transferred from the server computer to the computer. The processing according to the received program may be executed sequentially. The above-described processing may be executed by a so-called ASP (Application Service Provider) type service that realizes a processing function only by an execution instruction and result acquisition without transferring a program from the server computer to the computer. Good.

  In the above embodiment, the processing functions of the apparatus are realized by executing a predetermined program on a computer. However, at least a part of these processing functions may be realized by hardware.

1-3 Signature systems 11-31 Terminal devices 12-32 Signature generation device

Claims (6)

A registration information storage unit that stores registration information corresponding to the line information of any line that can be authenticated;
An input unit for receiving information corresponding to the signature target information and line correspondence information corresponding to the line information of the used line that has been successfully authenticated;
An output unit for outputting response information corresponding to signature information for the signature target information when the line correspondence information corresponds to the registration information;
I have a,
The information corresponding to the signature target information is disturbance information of the signature target information,
The signature generation apparatus , wherein the response information is information for obtaining the signature information by self-correction processing . The signature generation device according to claim 1,
The registration information is publicly determined first specific information corresponding to the line information or information uniquely determined for the first specific information,
The signature generation apparatus, wherein the line correspondence information is publicly disclosed second unique information corresponding to the line information of a used line that has been successfully authenticated in the previous period, or information that is uniquely determined with respect to the second unique information. A terminal device including an output unit that outputs information corresponding to the signature target information to the line used;
A registration information storage unit that stores registration information corresponding to the line information of any line that can be authenticated, and a line that corresponds to the information corresponding to the signature target information and the line information of the used line that has been successfully authenticated. A signature generation device comprising: an input unit that receives information; and an output unit that outputs response information corresponding to signature information for the signature target information when the line correspondence information corresponds to the registration information;
I have a,
The information corresponding to the signature target information is disturbance information of the signature target information,
The signature system , wherein the response information is information for obtaining the signature information by self-correction processing .   A terminal device including an output unit that outputs information corresponding to the signature target information to the line used;
  An authentication device for performing line authentication using the line information of the used line;
  A registration information storage unit that stores registration information corresponding to the line information of any line that can be line-authenticated; information corresponding to the signature object information; and line information of the used line that has been successfully line-authenticated by the authentication device An input unit that accepts line correspondence information corresponding to, and when the line correspondence information corresponds to the registration information, a signature key corresponding to the line correspondence information among a plurality of signature keys is used, and the signature target information A signature generation device including: a signature processing unit that generates signature information; and an output unit that outputs the signature information or response information corresponding to the signature information;
Having a signature system. Registration information corresponding to the line information of any line that can be authenticated is stored in the registration information storage unit,
An input unit receiving information corresponding to signature target information and line correspondence information corresponding to line information of a used line that has been successfully authenticated;
When the line interface information corresponding to the registration information, the output unit, have a, and outputting the response information corresponding to the signature information for the signature target information,
The information corresponding to the signature target information is disturbance information of the signature target information,
The signature generation method , wherein the response information is information for obtaining the signature information by self-correction processing . Program for causing a computer to function as the signature generating apparatus according to claim 1 or 2.

Images