JP2006270342A - System and method for digital signature verification using biometrics information, and program for them - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system for generating a digital signature, without carrying a closed key and for guaranteeing authenticity of the digital signature, by preventing theft or forgery of biometrics information, and when digitally signing by using the biometrics information. <P>SOLUTION: Public keys 32, 42, the closed keys 33, 43, and digital certificates 34, 44 issued by the certificate authority (CA) are previously incorporated into biometrics information input devices 30, 40 in the digital signature-verification system. When imparting the digital signature to digital contents, the digital signature by the biometrics information input device is imparted, after imparting a hash value by the biometrics information. When verifying the digital signature, verification of the digital signature by the biometrics information input device 10 is executed. When validity is guaranteed, the verification of the digital signature is executed by comparing the hash value by the biometrics information and that imparted to the digital contents. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a digital signature / verification system and method for verifying the creator of digital content and ensuring that the digital content has not been tampered with, and a program therefor.

  The security of electronic documents distributed via the Internet is considered to become more and more important in the future, and has been actively researched. For example, the following technologies have been announced as conventional technologies related to digital signatures.

(A) “http://www.ipa.go.jp/security/pki/012.html” (searched on March 11, 2005), Information Processing Promotion Association of Japan Security Center (Non-Patent Document 1) "With the widespread use of networks such as the Internet, various information is digitized and exchanged through the network. (Omitted) However, the network is not necessarily secure and there are various threats. As a countermeasure against threats such as tampering and denial, digital signatures are now an effective technology.

(B) On the other hand, in authentication technology, interest in biometric authentication is increasing. Biometrics authentication is an authentication method that performs identity verification based on physical characteristics such as fingerprints, irises behind the eyeballs, or voices.

For example, `` http://www.ipa.go.jp/security/fy14/reports/authentication/
"authentication2002.pdf" (investigation on the current state of personal authentication technology) (searched on March 11, 2005), the Information Processing Promotion Association of Japan Security Center (Non-Patent Document 2) states that "In biometrics authentication, passwords etc. are stored. It is generally said that problems such as “forget” and “known to others” in authentication based on ID, and “lost”, “theft”, and “left behind” in authentication based on possession of a card etc. are avoided. . Is described.

  The digital signature is encrypted signature information given to guarantee the validity of the digital document. The digital signature mechanism is as follows. The signer encrypts the digest of the digital content with the signer's own private key, generates a digital signature, and attaches it to the message to be signed.

  The signature verifier first decrypts the digital signature using the signer's public key. This confirms that the person who generated the digest is indeed the signer. Next, it is possible to confirm that the digital content has not been tampered with by generating a digest of the digital content and comparing it with the digest decrypted from the digital signature.

  A digital signature can verify the creator of the digital content and ensure that the digital content has not been tampered with.

(C) “http://www.ipa.go.jp/security/pki/031.html” (certificate authority and electronic certificate) (searched on March 11, 2005), Information Processing Promotion Corporation Security Center (Non-Patent Document 3) describes that “when using the public key cryptosystem, it is necessary to confirm whether the public key to be used is really the correct counterpart”.

  As a method of confirming the owner of the public key, there is a method of assuring the owner of the public key by a certificate authority (CA). The certificate authority (CA) confirms the identity of the owner of the public key by some method, and issues a digital certificate that guarantees the public key and its owner. By attaching the digital certificate to the digital signature, the owner of the public key (creator of the digital content) can be certified through a certificate authority (CA).

  Further, in order to solve the problem that the electronic certificate issued by the certificate authority cannot be used from other PCs because it is stored in the client PC, as disclosed in JP-A-2003-114617 In addition, each time an electronic certificate is used, there is a technique for verifying the identity with biometric information when an authentication server issues an electronic certificate to a client as a system to issue. Further, it is possible to further enhance security by authenticating using a biometric key.

JP 2003-114617 A http://www.ipa.go.jp/security/pki/012.html (Threat on the network) (searched on March 11, 2005), Information Processing Promotion Corporation Security Center http://www.ipa.go.jp/security/fy14/reports/authentication/authentication2002.pdf (Survey on the current status of personal authentication technology) (searched on March 11, 2005), Information Processing Promotion Corporation Security Center http://www.ipa.go.jp/security/pki/031.html (certificate authority and electronic certificate) (searched on March 11, 2005), Information Processing Promotion Corporation Security Center

(Problems of conventional technology)
The first problem to be solved is that, in the prior art, in order to generate a digital signature and prove the authenticity of the digital signature, each person needs to obtain a digital certificate from a certificate authority (CA). And it takes time and effort to obtain the digital certificate.

  The second problem to be solved is that, in the prior art, the entity of the private key for generating the digital signature is a data file. When the digital signature is performed on another computer, the private key (Data file) must be carried around.

  As a solution to the above two problems, it is conceivable to generate a digital signature using biometric information as a key. The biometric information is kept by the signer as it is born, and the authenticity of the digital signature is guaranteed.

  However, biometric information is just digital information on a computer, and there is a possibility of theft or counterfeiting. If biometric information is transferred to a third party by theft or forgery, the digital signature may be forged by the third party, and the digital content may be altered or impersonated.

  The third problem to be solved is that the digital signature may be forged by a third party, and the authenticity of the digital signature cannot be proved.

(Object of the present invention)
A first object of the present invention is to provide a system capable of generating a digital signature without having an individual issue a digital certificate from a certificate authority (CA) and proving its authenticity. It is to be.

  A second object of the present invention is to provide a system that makes it possible to generate a digital signature without having to carry around a private key.

  The third object of the present invention is to provide a system that prevents theft or forgery of biometric information and guarantees the authenticity of the digital signature when performing digital signature using biometric information.

  In order to achieve the above object, the present invention incorporates a public key, a private key, and a digital certificate issued by a certificate authority (CA) in advance into a biometric information input device.

  When a digital signature is added to the digital content, a “hash value by biometric information (first hash value)” is added, and then a “digital signature by the biometric information input device” is further added.

  When verifying a digital signature, first, “digital signature by a biometric information input device” is verified. Since the public key of the biometric information input device is registered in advance with the certificate authority (CA), it can be assured that the biometric information is input from the legitimate biometric information input device.

  When the validity is guaranteed, the digital signature is compared by “comparing the hash value (second hash value) by the biometric information with the hash value (first hash value) given to the digital content”. Perform verification.

  The first effect of the present invention is that it is not necessary for an individual to issue a digital certificate from a certificate authority (CA) in advance in order to generate a digital signature and prove its authenticity. It is a point that can be omitted.

  The second effect of the present invention is that there is no possibility of the private key being stolen or lost because it is not necessary to carry around the private key in order to generate a digital signature.

  For example, when the digital signature / verification system to which the present invention is applied is installed at the site A and the site B, the digital signature can be verified at the site B with respect to the digital signature given at the site A. At this time, it is not necessary to carry a private key (data file) for granting a digital signature.

  The third effect of the present invention is that the digital signature can be prevented from being counterfeited by a third party and the authenticity of the digital signature can be proved.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram showing a configuration of a biometric signature / verification system to which the present invention is applied.

  The biometric signature / verification systems 30 and 40 include biometric information input devices 31 and 41, biometric key generation means 36 and 46, biometric signature assignment means 37 and 47, and biometric signature verification means 38 and 48. Has been.

  Biometric key generation means 36, 46, biometric signature assigning means 37, 47, and biometric signature verification means 38, 48 are realized by a computer. That is, a function corresponding to each means is realized by installing a computer program for realizing the function corresponding to each means in a memory, storing it, reading it into the CPU and executing it sequentially.

  The biometric information input devices 31 and 41 are devices that read biometric information used for assigning a digital signature and creating a verification key in the present invention. The public keys 32 and 42 and the private keys 33 and 43 are generated in advance for each individual biometric information input device and registered in the certificate authority (CA) 10, and the corresponding digital certificate 34 , 44 in a storage device such as a ROM and incorporated in advance in a biometric information input device. Further, confidentiality is secured by tamper resistant devices 35 and 45 for preventing reading of confidential data by unauthorized means.

  The biometric key generation means 36 and 46 are means for generating a biometric key from the biometric information input from the biometric information input devices 31 and 41. Any key generation algorithm used in the biometric key generation means 36 and 46 can be used.

  However, it is necessary to unify the key generation algorithm in the system that assigns the digital signature and the system that performs the verification. Thereby, the same biometric key can be generated for the same biometric information input by different biometric signature / verification systems.

  The biometric signature giving means 37, 47 uses the biometric key generated by the biometric key generation means 36, 46 and the private key 33, 43 incorporated in the biometric information input device 31, 41, to generate digital data. It is a means for giving a digital signature to content.

  The biometric signature verification means 38 and 48 are means for verifying the digital signature assigned by the biometric signature assignment means 37 and 47.

  The functions realized by the biometric signature giving means 37 and 47 will be described with reference to the flowchart of FIG. In the following description, it is assumed that the biometric signature / verification system 30 performs biometric signature assignment. Digital content to be digitally signed is selected (step S101).

  Biometric information is input from the biometric information input device 31 (step S102). A biometric key is generated by the biometric key generation means 36 (step S103).

  The biometric signature providing unit 37 generates a hash value (first hash value) for the digital content selected in (step S101) using the biometric key generated by the biometric key generation unit 36 (step S104). .

  Note that any hash generation algorithm can be used. However, it is necessary to use the same hash algorithm for a system that assigns a digital signature and a system that performs verification.

  The calculated hash value (first hash value) is assigned to the digital content (step S105). At this time, the digital content to which the hash value is assigned is referred to as hashed digital content.

  A digital signature and a digital certificate are assigned to the hashed digital content using the private key 33 (step S106). Note that any algorithm can be used as the algorithm used to assign the digital signature.

  Next, functions realized by the biometric signature verification means 38 and 48 will be described with reference to the flowchart of FIG. In the following description, it is assumed that biometric signature verification is performed by the biometric signature / verification system 40.

  Digital contents to be verified are selected (step S201). A digital certificate is acquired from the digital content selected in step S201 (step S202). If acquisition of the digital certificate fails, the process ends as verification failure (step S210).

  When acquisition of the digital certificate is successful, the certificate authority is inquired and the validity of the acquired digital certificate is verified (step S203). If the certificate is invalid, the verification ends as failure (step S210).

  If the certificate is valid, the digital signature is verified using the digital certificate (step S204). If the result of step S204 is NG, the verification ends as failure (step S210).

  In the case of OK, biometric information is input from the biometric information input device 41 (step S205). A biometric key is generated by the biometric key generation means 46 (step S206).

  Next, a hash value (second hash value) for the digital content is generated using the biometric key (step S207).

  Next, the hash value (first hash value) given to the digital content in step S105 is compared with the hash value (second hash value) generated in step S207 (step S208).

  If the hash values are different as a result of the comparison, the verification ends as a verification failure (step S210). If the hash values are the same, the verification ends as successful (step S209).

  A program for realizing the functions of the biometric key generation means 36, 46, the biometric signature assigning means 37, 47, and the biometric signature verification means 38, 48 by a computer is created in advance, and a network such as the Internet. Alternatively, it can be distributed to users via a computer-readable recording medium such as a CD-ROM, FD, or DVD.

  The distributed program is read into a storage device of a computer that implements the user's biometric signature / verification system, and further read into the CPU for execution, thereby realizing desired functions corresponding to each program.

  The present invention is effective when the creator of digital content proves that the creator of the digital content is himself and confirms that the digital content has not been tampered with.

1 is a configuration diagram of a biometric signature / verification system to which the present invention is applied. FIG. It is a flowchart which shows the function which a biometrics signature provision means implement | achieves. It is a flowchart which shows the function which a biometrics signature verification means implement | achieves.

Explanation of symbols

10: Certificate Authority (CA)
30, 40: Biometric signature / verification system 32, 42: Public key 33, 43: Private key 34, 44: Digital certificate 35, 45: Tamper resistant device 36, 46: Biometric key generation means 37, 47: Biometric signature adding means 38, 48: Biometric signature verification means

Claims (6)

A digital signature / verification system including a biometric information input device that incorporates a public key, a private key, and a corresponding digital certificate that are generated for each individual biometric information input device and registered with a certificate authority (CA) Because
Biometric key generation means for generating a biometric key based on the biometric information input from the biometric information input device;
Biometric signature giving means for generating a first hash value using the biometric key and giving it to the content, and giving a digital signature and a digital certificate to the content using the private key;
When verifying the assigned digital signature, a digital certificate is obtained from the content, the certificate authority is inquired, the digital signature is verified using the digital certificate whose validity has been verified, and the verification result is OK And generating a biometric key by a biometric key generation unit based on the biometric information input from the biometric information input device, generating a second hash value using the generated biometric key, and generating the second hash value A digital signature / verification system comprising biometric signature verification means for verifying a digital signature by comparing the second hash value and the first hash value attached to the content.   2. The digital signature / verification system according to claim 1, wherein the first hash value and the second hash value are based on the same hash algorithm. A digital signature / verification method provided with a biometric information input device incorporating a public key, a private key, and a corresponding digital certificate that are generated for each biometric information input device and registered with a certificate authority (CA) Because
A biometric key generation step of generating a biometric key based on the biometric information input from the biometric information input device;
Generating a first hash value using the biometric key and assigning it to the content, and applying a digital signature and a digital certificate to the content using the private key;
When verifying the assigned digital signature, a digital certificate is obtained from the content, the certificate authority is inquired, the digital signature is verified using the digital certificate whose validity has been verified, and the verification result is OK And generating a biometric key based on the biometric information input from the biometric information input device, generating a second hash value using the generated biometric key, and generating the generated second hash value. And a first hash value attached to the content, a biometric signature verification step for verifying the digital signature is provided.   4. The digital signature / verification method according to claim 3, wherein the first hash value and the second hash value are based on the same hash algorithm. A digital signature / verification system including a biometric information input device that incorporates a public key, a private key, and a corresponding digital certificate that are generated for each individual biometric information input device and registered with a certificate authority (CA) A digital signature / verification program at
Computer
Biometric key generation means for generating a biometric key based on biometric information input from the biometric information input device;
Biometric signature giving means for generating a first hash value using the biometric key and giving the content a digital signature and a digital certificate using the private key;
When verifying the assigned digital signature, a digital certificate is obtained from the content, the certificate authority is inquired, the digital signature is verified using the digital certificate whose validity has been verified, and the verification result is OK And generating a biometric key by a biometric key generation unit based on the biometric information input from the biometric information input device, generating a second hash value using the generated biometric key, and generating the second hash value A digital signature / verification program for functioning as a biometric signature verification means for verifying a digital signature by comparing the second hash value and the first hash value attached to the content.   6. The digital signature / verification program according to claim 5, wherein the first hash value and the second hash value are based on the same hash algorithm.

Images