JP2010171600A - Apparatus for generation and verification of signature data - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To eliminate the need for using other plain text data when one plain text data is verified, while reducing the signature generation time using an electronic signature for a plurality of plain text data, or the total volume of data required for verification or the verification time. <P>SOLUTION: A plurality of plain text data are input, Hash computation is performed, respectively, for the plurality of plain text data to generate Hash data, the exclusive OR of all Hash data other than the Hash data corresponding to the plain data thus generated is computed, respectively, for the plurality of plain text data and the auxiliary data of the plain data are generated, a bit stream for signature is generated by computing the exclusive OR of all Hash data, the bit stream for signature is signed using a signature generation key to generate the signature data, and then the signature data, the plurality of plain text data, and the auxiliary data which are matched with the plain text data are output. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a signature data generation technique for generating data for electronic signature by encryption processing, and a verification technique for performing verification using the generated data for electronic signature.

  Generates electronic signature data (hereinafter referred to as “signature data”) for the target electronic data (hereinafter referred to as “plaintext data”) for the purpose of verifying the identity of any electronic data and preventing counterfeiting / falsification. An electronic signature technique for verifying using signature data has been proposed. Conventionally, one signature data is generated from one plaintext data, and the plaintext data and the signature data are handled in a one-to-one correspondence. For this reason, the signature generation time is proportional to the number of plaintext data. In order to verify multiple plaintext data with such conventional digital signature technology, the same number of signature data as the plaintext data is verified. As the number of plaintext data increases, the size of data required for verification and the verification time increase.

  For example, when the size of plaintext data is 100 bytes and the size of signature data is 128 bytes, when the number of plaintext data becomes n, the total amount of signature data becomes 128 × n (bytes) accordingly, and n plaintext data The data size necessary for verifying all of the above was (100 + 128) × n (bytes). Also, the time required to generate the data required for verification of the electronic signature is signature generation time × n + hash data generation time × n, and if the hash data generation time is about 1 millisecond, the signature generation time is It was about 500 milliseconds.

  To solve such a problem, a technique for generating one signature data for a plurality of plaintext data has been proposed (see Patent Document 1). According to this technique, one signature data is generated using a plurality of plain text data. Therefore, even if the number of plaintext data increases, the required number of signature data remains one and does not increase. For example, as described above, when the size of plaintext data is 100 bytes and the size of signature data is 128 bytes, the total amount of signature data is 128 bytes even if there are n plaintext data, and all of the n pieces of plaintext data The data size required for verifying is 100 × n + 128 (bytes).

JP 2006-060724 A

  However, in the above-described conventional technology, when one plaintext data is verified using the signature data, it is necessary to use other plaintext data used when generating the signature data. Therefore, it is necessary to disclose other plaintext data even to an apparatus that does not require other plaintext data for purposes other than verification, and this causes a problem of reducing the security of other plaintext data.

  In view of the above circumstances, the present invention reduces the signature generation time using electronic signatures for a plurality of plaintext data, the total amount of data required for verification, and the verification time, and other plaintext data when verifying one plaintext data Signature data generation technology, signature data recording medium, verification technology for verification using signature data generated by this signature data generation technology, and system using such technology The purpose is to provide.

  One aspect of the present invention is a signature data generation apparatus, which includes a signature generation key storage unit that stores a signature generation key for generating a signature, a plaintext data input unit that inputs a plurality of plaintext data, For each plaintext data, a hash data generation unit that performs hash calculation and generates hash data, and for each of the plurality of plaintext data, other than the hash data corresponding to the plaintext data generated by the hash data generation unit An auxiliary data generation unit that calculates exclusive OR of all hash data and generates auxiliary data of the plaintext data, and a signature by calculating exclusive OR of all hash data generated by the hash data generation unit A signature bit string is generated using a signature generation key stored in the signature generation key storage unit. Comprising a signature data generating unit for generating data, and the signature data, the plurality of plaintext data, and a data output unit for outputting the auxiliary data corresponding to the plaintext data.

  One aspect of the present invention is a verification apparatus, and a data input unit that inputs the signature data and the auxiliary data generated by the signature data generation apparatus, and the plaintext data corresponding to the auxiliary data; A signature verification key storage unit that stores a signature verification key corresponding to the signature generation key stored by the signature data generation device, and a hash calculation by performing a hash calculation on the plaintext data input by the data input unit A comparison bit string by calculating an exclusive OR of the hash data generation unit for generating data, the auxiliary data input by the data input unit, and the hash data generated by the hash data generation unit A comparison bit string generation unit for generating the signature data input by the data input unit, Performing a restoration process using a signature verification key stored in the signature verification key storage unit, generating a verification bit string, comparing the verification bit string and the comparison bit string, and A verification unit that verifies relevance between the data and the signature data.

  One aspect of the present invention is a signature data recording medium, the signature data storage area storing the signature data generated by the signature data generation device, and the plurality of auxiliary data generated by the signature data generation device An actual data storage area for storing each data in association with the corresponding plaintext data.

  One aspect of the present invention is a signature verification system including a signature data recording medium for storing signature data and a plurality of verification devices for verifying the signature data, wherein the signature data recording medium is the signature data generation device described above The signature data generated by the signature data storage area for storing the signature data so as to be readable from any verification device, and each of the auxiliary data generated by the signature data generation device corresponds to the corresponding plaintext data. And an actual data storage area that allows each plaintext data to be read only from a predetermined verification device, and the verification device includes the signature data and the plaintext data that can be read by the device itself, A data input unit for inputting the auxiliary data corresponding to the plaintext data from the signature data recording medium; and the signature data A signature verification key storage unit that stores a signature verification key corresponding to the signature generation key stored by the generation device, and a hash that generates hash data by performing a hash calculation on the plaintext data input by the data input unit For comparison, a bit string for comparison is generated by calculating an exclusive OR between the data generation unit, the auxiliary data input by the data input unit, and the hash data generated by the hash data generation unit Bit string generation unit and verification bit string generation for generating a verification bit string by performing restoration processing using the signature verification key stored in the signature verification key storage unit on the signature data input by the data input unit The verification bit string and the comparison bit string, and the plaintext data and the signature data And a verification unit for verifying the communication properties.

  One aspect of the present invention is a signature verification system including a signature data recording medium for storing signature data and a plurality of verification devices for verifying the signature data, wherein the signature data recording medium is the signature data generation device described above A signature data storage area for storing the signature data generated by the verification device so that the signature data can be read from any verification device, and the verification device stores the plaintext data previously read from the signature data generation device and the plaintext data. The plaintext data / auxiliary data storage unit for storing the corresponding auxiliary data, the signature data is input from the signature data recording medium, and the plaintext data and the auxiliary data corresponding to the plaintext data are A data input unit input from the plaintext data / auxiliary data storage unit and the signature stored by the signature data generation device A signature verification key storage unit that stores a signature verification key corresponding to the generated key; a hash data generation unit that generates hash data by performing a hash calculation on the plaintext data input by the data input unit; and the data input A comparison bit string generation unit that generates a comparison bit string by calculating an exclusive OR of the auxiliary data input by the unit and the hash data generated by the hash data generation unit, and the data input A verification bit string generation unit that performs a restoration process using a signature verification key stored in the signature verification key storage unit and generates a verification bit string, and the verification bit string; A verification unit that compares the bit string for comparison and verifies the relationship between the plaintext data and the signature data.

  The present invention may be specified as a computer program for causing a computer to operate as the signature data generation device or the verification device described above. The present invention may also be specified as a signature data generation method or verification method performed by a computer functioning as the signature data generation device or verification device described above.

  According to the present invention, since the number of signature data to be generated is one, it is possible to reduce the signature generation time using the digital signature for a plurality of plaintext data, the total amount of data required for verification, and the verification time. It is possible to make it unnecessary to use other plaintext data when verifying the plaintext data.

It is a schematic block diagram showing the function structure of a signature data generation apparatus. It is a flowchart showing the operation example of a signature data generation apparatus. It is a flowchart showing the content of auxiliary data generation processing. It is the schematic showing the specific example of an auxiliary data generation process. It is a flowchart showing the content of signature data generation processing. It is the schematic showing the example of signature data generation processing. It is a figure showing the specific example of the total amount of data required for verification of an electronic signature. It is a schematic block diagram showing the function structure of a verification apparatus. It is a flowchart showing the operation example of a verification apparatus. It is the schematic showing the outline of the process of a verification apparatus. It is a system configuration figure showing an example of composition of a signature verification system. It is a figure showing the outline | summary of access control of each data memorize | stored in the recording medium. It is a system block diagram showing the other structural example of a signature verification system.

[Signature data generator]
FIG. 1 is a schematic block diagram illustrating a functional configuration of the signature data generation device 1. The signature data generation apparatus 1 includes a plaintext data input unit 101, a hash data generation unit 102, an auxiliary data generation unit 103, a signature generation key storage unit 104, a signature data generation unit 105, and a data output unit 106.

  The plaintext data input unit 101 inputs a plurality of pieces of data (hereinafter referred to as “plaintext data”) to be subjected to an electronic signature to the signature data generation apparatus 1.

  The hash data generation unit 102 generates hash data for each plaintext data. Specifically, hash data of each plaintext data can be generated by applying an algorithm such as MD2 (Message Digest Algorithm 2), MD4, MD5, or SHA (Secure Hash Algorithm).

  The auxiliary data generation unit 103 generates auxiliary data corresponding to each plaintext data based on the hash data calculated by the hash data generation unit 102. Specifically, when calculating auxiliary data of certain plaintext data, the auxiliary data generation unit 103 calculates an exclusive OR of hash data of all plaintext data except the plaintext data, and supports the calculated value. Data. Note that all plaintext data represents a set of plaintext data input by the plaintext data input unit 101. Details of the auxiliary data generation processing will be described later.

  The signature generation key storage unit 104 is configured using a storage device such as a magnetic hard disk device or a semiconductor storage device, and is used for generating signature data (hereinafter referred to as “signature data”). Remember. Here, the signature generation key is, for example, a secret key that is one key of the public key cryptosystem.

  The signature data generation unit 105 generates signature data common to all plaintext data based on the hash data of all plaintext data and the signature generation key stored in the signature generation key storage unit 104. Specifically, the signature data generation unit 105 calculates exclusive OR of hash data of all plaintext data, and generates signature data by performing signature generation processing using a signature generation key on the calculation result. . The signature generation process can be performed by applying an algorithm such as RSA (Rivest Shamir Adleman), DSA (Digital Signature Algorithm), or ECDSA (Elliptic Curve Digital Signature Algorithm). Details of the signature data generation process will be described later.

  The data output unit 106 outputs plaintext data, signature data generated by the signature data generation unit 105, and a plurality of auxiliary data generated by the auxiliary data generation unit 103. At this time, the data output unit 106 outputs each plaintext data and each auxiliary data in association with each other.

  FIG. 2 is a flowchart showing an operation example of the signature data generation apparatus 1. Hereinafter, an operation example of the signature data generation apparatus 1 will be described with reference to FIG. First, the plaintext data input unit 101 inputs n pieces of plaintext data M (i) (step S101). Note that i is an integer of 1 to n, and n is an integer of 2 or more.

  Next, the hash data generation unit 102 generates hash data m (i) of each input plaintext data M (i) (step S102). Next, the auxiliary data generation unit 103 executes auxiliary data generation processing to generate auxiliary data corresponding to each plaintext data (step S103).

  FIG. 3 is a flowchart showing the contents of the auxiliary data generation process. Hereinafter, auxiliary data generation processing executed by the auxiliary data generation unit 103 will be described with reference to FIG.

  First, the auxiliary data generation unit 103 generates a variable j and initializes it by substituting “1” (step S201). Next, the auxiliary data generation unit 103 generates and initializes a variable k and a bit string x (step S202). Specifically, the auxiliary data generation unit 103 substitutes 1 for the variable k and initializes it. Further, the auxiliary data generation unit 103 generates a bit string x having the same number of digits as the hash data generated by the hash data generation unit 102, and initializes by substituting “0” for all bits.

  Next, the auxiliary data generation unit 103 determines whether or not the values of the variable j and the variable k match (step S203). When the values of the variable j and the variable k do not match (step S203—YES), the auxiliary data generation unit 103 calculates the exclusive OR of the bit string x and the hash data m (k), and the calculation result is the bit string x. (Step S204).

  After the process of step S204, or when the values of variable j and variable k match in step S203 (step S203—NO), auxiliary data generating unit 103 increments the value of variable k (step S205). Next, the auxiliary data generation unit 103 determines whether or not the value of the variable k is larger than the number n of input plaintext data (step S206). When the value of the variable k is n or less (step S206—NO), the auxiliary data generation unit 103 repeatedly executes the processes of step S203 to step S206 until the value of the variable k becomes larger than n.

  On the other hand, when the value of the variable k is larger than n in step S206 (step S206—YES), the auxiliary data generation unit 103 sets the value of the bit string x at this time to the auxiliary data N (corresponding to the plaintext data M (j) ( j), and the bit string x is substituted into the auxiliary data N (j) (step S207). Next, the auxiliary data generation unit 103 increments the value of the variable j (step S208). Next, the auxiliary data generation unit 103 determines whether or not the value of the variable j is larger than n (step S209). When the value of the variable j is n or less (step S209—NO), the auxiliary data generation unit 103 repeatedly executes the processing of step S202 to step S209 until the value of the variable j becomes larger than n, and each plaintext data Auxiliary data N (i) corresponding to M (i) is calculated. If the value of the variable j is larger than n in step S209 (step S209—YES), the auxiliary data generation unit 103 ends the auxiliary data generation process.

  FIG. 4 is a schematic diagram illustrating a specific example of auxiliary data generation processing. FIG. 4A shows the relationship between the three plaintext data and the hash data. When the auxiliary data generation process is executed, hash data m (1) to m (3) are generated by the hash data generation unit 102 from the plaintext data M (1) to M (3), respectively. FIG. 4B is a diagram illustrating a specific example of auxiliary data corresponding to each of the three plaintext data. The auxiliary data N (1) corresponding to the plaintext data M (1) is the exclusive OR of the hash data m (2) and m (3) of all the other plaintext data M (2) and M (3). Is calculated as Similarly, the auxiliary data N (2) corresponding to the plaintext data M (2) and the auxiliary data N (3) corresponding to the plaintext data M (3) are respectively the hash data m (3), the hash data m (1), and Is calculated as the exclusive OR of the hash data m (1) and the hash data m (2).

  Returning to FIG. 2, the processing flow of the signature data generation apparatus 1 will be described. When the auxiliary data generation unit 103 ends the auxiliary data generation process in step S103, the signature data generation unit 105 executes the signature data generation process to generate one signature data common to the plurality of input plaintext data (step S103). S104).

  FIG. 5 is a flowchart showing the contents of the signature data generation process. Hereinafter, the signature data generation process executed by the signature data generation unit 105 will be described with reference to FIG. First, the signature data generation unit 105 generates a variable j and initializes it by substituting “1” (step S301). Next, the signature data generation unit 105 generates and initializes a bit string y (step S302). Specifically, the signature data generation unit 105 generates a bit string y having the same number of digits as the hash data generated by the hash data generation unit 102, and initializes by assigning “0” to all bits.

  Next, the signature data generation unit 105 calculates an exclusive OR of the bit string y and the hash data m (j), and substitutes the calculation result for the bit string y (step S303). Next, the signature data generation unit 105 increments the value of the variable j (step S304). Next, the signature data generation unit 105 determines whether the value of the variable j is larger than n (step S305). When the value of the variable j is n or less (step S305—NO), the signature data generation unit 105 repeatedly executes the processes of steps S302 to S305 until the value of the variable j becomes larger than n. If the value of the variable j is larger than n in step S305 (step S305-YES), that is, if the value of the bit string y is exclusive OR of all the hash data m (i), the signature data generation unit 105 determines the value of the bit string y at this time as the value of the signature bit string A, and substitutes the bit string y into the signature bit string A (step S306). At this time, padding processing for concatenating the specifying bit string B may be performed to match the length of the bit string of the signature generation key as necessary to obtain the signature bit string A.

  The signature data generation unit 105 generates signature data by performing a signature generation process using the signature generation key stored in the signature generation key storage unit 104 for the signature bit string A (step S307). The signature data generation process ends.

  FIG. 6 is a schematic diagram illustrating a specific example of the signature data generation process. FIG. 6A is a diagram illustrating the relationship between three plaintext data and hash data. When the signature data generation process is executed, hash data m (1) to m (3) are generated by the hash data generation unit 102 from the plaintext data M (1) to M (3), respectively. FIG. 6B is a diagram illustrating a specific example of the signature bit string A corresponding to the three plaintext data M (1) to M (3). In this case, the signature bit string A is calculated as an exclusive OR of hash data m (1) to m (3) of all plaintext data M (1) to M (3). FIG. 6C is a diagram illustrating a specific example of signature data common to the three plaintext data M (1) to M (3). In this figure, padding processing is performed to connect specific bit strings B.

  Returning to FIG. 2, the processing flow of the signature data generation apparatus 1 will be described. When the signature data generation unit 105 ends the signature data generation process in step S104, the data output unit 106 outputs plain text data, signature data, and auxiliary data (step S105), and the process of the entire flowchart shown in FIG. 2 ends. To do.

  In the signature data generation device 1 configured as described above, the number of signature data generated for a plurality of plaintext data is one. In addition, auxiliary data is generated for each plaintext data, but the data size of the auxiliary data is smaller than the data size of the signature data. Therefore, according to the signature data generation device 1, the rate of increase in the total amount of data required for verification of the electronic signature accompanying the increase in the number of plaintext data is compared with the case where signature data is generated for each plaintext data as in the past. Since it is only necessary to perform verification using a single signature data for a plurality of plaintext data, there is no need to perform signature data restoration processing a plurality of times according to each of the plurality of plaintext data. The time required to verify the plaintext data is also shortened.

  FIG. 7 is a diagram illustrating a specific example of the total amount of data required for verification of an electronic signature. In the case of FIG. 7, the amount of plaintext data is 100 bytes, the amount of hash data is 20 bytes (corresponding to the amount of data when the SHA1 algorithm is applied), the amount of signature data is 128 bytes (standard data amount in RSA) Equivalent). In FIG. 7, when the number of plaintext data is three, the total amount of data required for verification of the electronic signature by the signature data generation apparatus 1 according to the present invention is plaintext data (100 bytes) × 3 + auxiliary data (20 bytes) × 3 + signature data (128 bytes). ) × 1 = 488 bytes. On the other hand, the total amount of data required for verification of the electronic signature according to the prior art is plaintext data (100 bytes) × 3 + signature data (128 bytes) × 3 = 684 bytes. Thus, according to the signature data generation device 1, the total amount of data required for verification of the electronic signature is reduced by 196 bytes, and the reduction rate (data amount reduction rate) in the total data amount is 28.65%. As apparent from FIG. 7, since the amount of auxiliary data generated for each plaintext data is smaller than the amount of signature data, the data amount reduction rate increases as the number of plaintext data increases. Thus, according to the signature data generation device 1, it is possible to reduce the total amount of data required for verification using a digital signature for a plurality of plaintext data.

  In the signature data generating apparatus 1, one signature data is generated in common for a plurality of plaintext data, but other plaintext data is not required when verifying one plaintext data. Therefore, it is possible to configure the apparatus for verifying one plaintext data so that other plaintext data cannot be read, and it is possible to suppress a decrease in security of the other plaintext data. The details of the verification process will be described later together with the description of the verification device. When verifying the electronic signature of one plaintext data, hash data generated from other plaintext data is used. However, as described above, the original plaintext data cannot be generated from the hash data. The decrease in the security of plaintext data is prevented.

  In the signature data generation device 1, the time required to generate data required for verification of the electronic signature is signature generation time × 1 + hash data generation time × n + exclusive OR calculation time × n × n. On the other hand, when signature data is generated for each plaintext data as in the prior art, the time required to generate data required for verification of an electronic signature is signature generation time × n + hash data generation time × n. . In general, the signature generation time is tens of thousands times the exclusive OR calculation time. For example, if the exclusive OR calculation time is about 0.1 milliseconds and the hash data generation time is about 1 millisecond, the signature generation time is about 500 milliseconds. For this reason, the signature data generation apparatus 1 does not generate signature data for each of a plurality of plaintext data, but generates one common signature data. Therefore, the generation time of data required for verification of electronic signatures of a plurality of plaintext data is reduced. It becomes possible to reduce significantly compared with the past.

[Verification equipment]
FIG. 8 is a schematic block diagram showing a functional configuration of the verification apparatus 2 that verifies the electronic signature using the signature data generated by the signature data generation apparatus 1. The verification device 2 includes a data input unit 201, a hash data generation unit 202, a comparison bit string generation unit 203, a signature verification key storage unit 204, a verification bit string generation unit 205, and a verification unit 206.

The data input unit 201 inputs plaintext data to be verified, auxiliary data corresponding to the plaintext data, and signature data to the verification device 2.
The hash data generation unit 202 generates hash data of plain text data to be verified using the same algorithm as the hash data generation unit 102 of the signature data generation device 1.

  The comparison bit string generation unit 203 calculates an exclusive OR of the auxiliary data corresponding to the plaintext data to be verified and the hash data of the plaintext data to be verified as the comparison bit string.

  The signature verification key storage unit 204 is configured using a storage device such as a magnetic hard disk device or a semiconductor storage device, and the signature verification key corresponding to the signature generation key stored in the signature generation key storage unit 104 of the signature data generation device 1 Remember.

The verification bit string generation unit 205 performs a restoration process on the signature data corresponding to the plain text data to be verified using the signature verification key stored in the signature verification key storage unit 204, and generates a verification bit string. . As is clear from the processing of the verification bit string generation unit 205, the generated verification bit string is the same bit string as the signature bit string generated by the signature data generation device 1.
The verification unit 206 verifies the digital signature of the target plaintext data by comparing the comparison bit string generated by the comparison bit string generation unit 203 with the verification bit string generated by the verification bit string generation unit 205. And output the verification result.

  FIG. 9 is a flowchart illustrating an operation example of the verification apparatus 2. Hereinafter, an operation example of the verification apparatus 2 will be described with reference to FIG. In FIG. 9, first, the data input unit 201 inputs plaintext data M ′ (i) to be verified, auxiliary data N (i) corresponding to this plaintext data, and signature data to the verification device 2 (step S401). ).

  Next, the hash data generation unit 202 generates hash data m ′ (i) of the plaintext data M ′ (i) to be verified (step S402). Next, the comparison bit string generation unit 203 calculates an exclusive OR of the hash data m ′ (i) and the auxiliary data N (i) corresponding to the plaintext data M ′ (i) to be verified. The comparison bit string A ′ is generated (step S403).

  Next, the verification bit string generation unit 205 obtains the verification bit string A by performing restoration processing on the signature data corresponding to the plaintext data M ′ (i) to be verified using the signature verification key (step S404). At this time, if the padding process is performed at the time of signature generation, the specific bit string B is canceled from the restored bit string, and the verification bit string A is acquired.

  Next, the verification unit 206 determines whether or not the verification bit string A matches the comparison bit string A ′ (step S405). When the verification bit string A matches the comparison bit string A ′ (step S405—YES), the verification unit 206 determines that the signature verification for the plaintext data M ′ and the signature data is successful (step S406). In other words, in this case, the verification unit 206 determines that the plaintext data M ′ (i) is the plaintext data M (i) signed by the valid signature data generation apparatus 1 and has not been tampered thereafter. On the other hand, if the verification bit string A and the comparison bit string A ′ do not match (step S405—NO), the verification unit 206 determines that the signature verification for the plaintext data M ′ and signature data has failed (step S407). In other words, in this case, the verification unit 206 determines that the plaintext data M ′ (i) has not been signed by the valid signature data generation device 1 or that the data has been tampered with after the signature. Then, the verification unit 206 outputs a determination result (step S408).

  FIG. 10 is a schematic diagram illustrating an outline of the processing of the verification apparatus 2. FIG. 10A shows the relationship between plain text data and hash data. The hash data generation unit 202 calculates hash data m ′ (1) from the plaintext data M ′ (1). FIG. 10B is a diagram illustrating an outline of the comparison bit string A ′. The exclusive OR of the auxiliary data N (i) corresponding to the plaintext data M ′ (1) and the hash data m ′ (i) becomes the comparison bit string A ′. FIG. 10C shows the relationship between the signature data and the verification bit string A. Here, an example in which padding processing has been performed is shown, and the verification bit string A is extracted from the signature data by decoding the signature data and releasing the connection of the specific bit string B.

  As apparent from FIGS. 4, 6, and 10, the plaintext data M (i) and M ′ (i) match, the hash data calculation algorithms match, and the signature generation key / signature verification key is If they correspond, the verification bit string A and the comparison bit string A ′ match. That is, if the plaintext data is not falsified and the signature data and auxiliary data are generated by the valid signature data generation device 1, the verification bit string A and the comparison bit string A 'match. Therefore, according to the verification device 2 that performs the processing as described above, the signature data common to a plurality of plaintext data is used to verify the digital signature of one plaintext data without using other plaintext data. Is possible.

[Application example]
FIG. 11 is a system configuration diagram illustrating a configuration example of the signature verification system 4 using the signature data and auxiliary data generated by the signature data generation device 1. The signature verification system 4 includes three verification apparatuses A to C configured using the verification apparatus 2 described above, and a recording medium 3. For example, the verification device A is an ATM device installed in a bank, the verification device B is a kiosk terminal installed in a convenience store, and the verification device C is a ticket gate device installed in a station.

FIG. 12 is a diagram illustrating an outline of access control of each data stored in the recording medium 3. Hereinafter, the storage medium 3 will be described. The recording medium 3 is configured using a portable recording medium such as an IC card, a mobile phone equipped with RFID (Radio Frequency IDentification), and the like, and includes a signature data storage area and an actual data storage area. The signature data storage area stores signature data generated by the signature data generation device 1 and is configured to be accessible (readable) by any of the verification devices A to C. The actual data storage area includes a plurality of plaintext data M (A) to M (C) and auxiliary data N (A) to N (C) generated by the signature data generation device 1 corresponding to each plaintext data. Remember. The read authority is set in the actual data storage area, the plaintext data M (A) and the auxiliary data N (A) can be read only by the verification device A, and the plaintext data M (B) and the auxiliary data N (B ) Can be read only by the verification device B, and only the verification device C can read the plaintext data M (C) and the auxiliary data N (C).
For example, the plaintext data M (A) is data representing the bank name, branch name, and account number related to the bank account of the owner of the recording medium 3, and the plaintext data (B) is the name of the owner of the recording medium 3. The plaintext data (C) is data representing balance information of electronic money.

  In the signature verification system 4, the data input unit 201 of each of the verification apparatuses A to C reads and inputs the signature data, auxiliary data, and plain text data from the recording medium 3. It should be noted that the data input unit 201 reads only plaintext data that is permitted to be read by the own device among the plurality of plaintext data stored in the recording medium 3.

  In the signature verification system 4 configured in this way, the total amount of data required for verification of a plurality of plaintext data and the electronic signature can be reduced as compared with the prior art. Therefore, the memory usage of the recording medium 3 for storing these data is reduced. It becomes possible to reduce. Further, in the signature verification system 4, since the signature data generation device 1 generates data required for verification of the electronic signature, the generation time of data required for verification of the digital signatures of a plurality of plaintext data is significantly longer than that in the past. It becomes possible to reduce. Furthermore, since the signature verification system 4 only needs to perform verification using a single signature data for a plurality of plaintext data, there is no need to perform a signature data restoration process a plurality of times according to each of the plurality of plaintext data. The time required to verify the plaintext data is also shortened.

  In addition, since other plaintext data is not required for signature verification of one plaintext data, it is possible to configure a recording medium so that a plurality of plaintext data can be read only by a verification device set to be readable. It becomes. For this reason, it is possible to improve the security of plaintext data. For example, when verifying data representing a bank name, a branch name, and an account number, an ATM device (verification device A) represents data (M (B)) representing name and address and balance information of electronic money. Since verification can be performed without reading data (M (C)), the security of each plaintext data is set by setting a read restriction so that the verification apparatus A cannot access M (B) and M (C). Can be increased.

  FIG. 13 is a system configuration diagram illustrating a configuration example of the signature verification system 7 using the signature data and auxiliary data generated by the signature data generation device 1. The signature verification system 7 includes three verification devices A to C configured using the verification device 2 described above, a plaintext data / auxiliary data storage unit 6 connected to each verification device, and a recording medium 5. . In the signature verification system 7, as in the signature verification system 4, for example, the verification device A is an ATM device installed in a bank, the verification device B is a kiosk terminal installed in a convenience store, and the verification device C is a station It is a ticket gate device installed in

  The recording medium 5 is configured using a portable recording medium such as an IC card, a mobile phone equipped with an RFID, and the like, and includes a signature data storage area. The signature data storage area stores signature data generated by the signature data generation device 1 and is configured to be accessible to any of the verification devices A to C.

  The plaintext data / auxiliary data storage unit 6 stores plaintext data M (A) to M (C) and auxiliary data N (A) to N (C) read from the signature data generation device 1 in advance. Specifically, the plaintext data / auxiliary data storage unit 6 connected to the verification device A stores plaintext data M (A) and auxiliary data N (A), and plaintext data / auxiliary data connected to the verification device B. The storage unit 6 stores plaintext data M (B) and auxiliary data N (B), and the plaintext data / auxiliary data storage unit 6 connected to the verification device C has plaintext data M (C) and auxiliary data N (C). Remember. Each of the verification devices A to C performs signature verification by reading plaintext data and auxiliary data from the plaintext data / auxiliary data storage unit 6 connected to itself, and further reading signature data from the recording medium 5.

  In the signature verification system 7, the data input unit 201 of each of the verification apparatuses A to C reads the signature data from the recording medium 3 and inputs it. The data input unit 201 reads out and inputs auxiliary data and plaintext data from the plaintext data / auxiliary data storage unit 6 connected to the device itself.

  Since the signature verification system 7 configured as described above requires only one signature data corresponding to a plurality of plaintext data, it is possible to reduce the amount of memory used for the recording medium storing the signature data.

  In addition, since other plaintext data is not required for signature verification of one plaintext data, each of the plurality of plaintext data can be individually recorded in the plaintext data / auxiliary data storage unit 6 connected to the verification device. . For this reason, it is possible to improve the security of plaintext data.

The function of the signature data generation device or the verification device in the above-described embodiment may be realized by an IC card that can execute a program. In that case, a program for realizing this function may be recorded on the IC card, and the program recorded on the IC card may be executed on the IC card.
The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes designs and the like that do not depart from the gist of the present invention.

DESCRIPTION OF SYMBOLS 1 ... Signature data generation apparatus, 101 ... Plain text data input part, 102 ... Hash data generation part, 103 ... Auxiliary data generation part, 104 ... Signature generation key memory | storage part, 105 ... Signature data generation part (signature data generation part), 106 DESCRIPTION OF SYMBOLS ... Data output part, 2 ... Verification apparatus, 201 ... Data input part, 202 ... Hash data generation part, 203 ... Comparison bit string generation part, 204 ... Signature verification key storage part, 205 ... Verification bit string generation part, 206 ... Verification , 3, 5 ... recording medium (signature data recording medium), 4, 7 ... verification system (signature verification system), 6 ... plaintext data / auxiliary data storage unit

Claims (9)

A signature generation key storage unit for storing a signature generation key for generating a signature;
A plaintext data input unit for inputting a plurality of plaintext data;
A hash data generation unit that performs hash calculation and generates hash data for each of the plurality of plaintext data,
For each of the plurality of plaintext data, an exclusive OR of all the hash data other than the hash data corresponding to the plaintext data generated by the hash data generation unit is calculated, and auxiliary data of the plaintext data is generated. An auxiliary data generation unit;
A signature bit string is generated by calculating an exclusive OR of all hash data generated by the hash data generation unit, and the signature bit string is converted using the signature generation key stored in the signature generation key storage unit. A signature data generation unit for signing and generating signature data;
A data output unit that outputs the signature data, the plurality of plaintext data, and auxiliary data associated with the plaintext data;
A signature data generation apparatus comprising: A data input unit for inputting the signature data and the auxiliary data generated by the signature data generation device according to claim 1 and the plaintext data corresponding to the auxiliary data;
A signature verification key storage unit that stores a signature verification key corresponding to the signature generation key stored by the signature data generation device according to claim 1;
A hash data generation unit that generates hash data by performing a hash calculation on the plaintext data input by the data input unit;
A comparison bit string generation unit that generates a comparison bit string by calculating an exclusive OR of the auxiliary data input by the data input unit and the hash data generated by the hash data generation unit;
A verification bit string generation unit that performs a restoration process using a signature verification key stored in the signature verification key storage unit and generates a verification bit string for the signature data input by the data input unit;
A verification unit that compares the verification bit string with the comparison bit string and verifies the relevance between the plaintext data and the signature data;
A verification apparatus comprising: A signature data storage area for storing the signature data generated by the signature data generation device according to claim 1;
Each of the plurality of auxiliary data generated by the signature data generation device is stored in association with the corresponding plain text data,
A signature data recording medium. In a signature verification system including a signature data recording medium for storing signature data and a plurality of verification devices for verifying the signature data,
The signature data recording medium is
A signature data storage area for storing the signature data generated by the signature data generation device according to claim 1 so as to be readable from any verification device;
Each of the plurality of auxiliary data generated by the signature data generation device is stored in association with the corresponding plaintext data, and each plaintext data can be read only from a predetermined verification device;
Have
The verification device includes:
A data input unit for inputting the signature data, the plaintext data readable by the device itself, and the auxiliary data corresponding to the plaintext data from the signature data recording medium;
A signature verification key storage unit that stores a signature verification key corresponding to the signature generation key stored by the signature data generation device according to claim 1;
A hash data generation unit that generates hash data by performing a hash calculation on the plaintext data input by the data input unit;
A comparison bit string generation unit that generates a comparison bit string by calculating an exclusive OR of the auxiliary data input by the data input unit and the hash data generated by the hash data generation unit;
A verification bit string generation unit that performs a restoration process using a signature verification key stored in the signature verification key storage unit and generates a verification bit string for the signature data input by the data input unit;
A verification unit that compares the verification bit string with the comparison bit string and verifies the relevance between the plaintext data and the signature data;
A signature verification system comprising: In a signature verification system including a signature data recording medium for storing signature data and a plurality of verification devices for verifying the signature data,
The signature data recording medium is
A signature data storage area for storing the signature data generated by the signature data generation device according to claim 1 so as to be readable from any verification device;
The verification device includes:
Plaintext data / auxiliary data storage unit for storing plaintext data read from the signature data generation device in advance and the auxiliary data corresponding to the plaintext data;
A data input unit that inputs the signature data from the signature data recording medium, and inputs the plaintext data and the auxiliary data corresponding to the plaintext data from the plaintext data / auxiliary data storage unit;
A signature verification key storage unit that stores a signature verification key corresponding to the signature generation key stored by the signature data generation device according to claim 1;
A hash data generation unit that generates hash data by performing a hash calculation on the plaintext data input by the data input unit;
A comparison bit string generation unit that generates a comparison bit string by calculating an exclusive OR of the auxiliary data input by the data input unit and the hash data generated by the hash data generation unit;
A verification bit string generation unit that performs a restoration process using a signature verification key stored in the signature verification key storage unit and generates a verification bit string for the signature data input by the data input unit;
A verification unit that compares the verification bit string with the comparison bit string and verifies the relevance between the plaintext data and the signature data;
A signature verification system comprising: A signature data generation device including a signature generation key storage unit that stores a signature generation key for generating a signature, and a plaintext data input step for inputting a plurality of plaintext data;
A hash data generation step in which the signature data generation device performs hash calculation on each of the plurality of plaintext data to generate hash data;
The signature data generation device calculates, for each of the plurality of plaintext data, an exclusive OR of all hash data other than the hash data corresponding to the plaintext data generated in the hash data generation step. An auxiliary data generation step for generating auxiliary data of the data;
The signature data generation apparatus generates a signature bit string by calculating an exclusive OR of all hash data generated in the hash data generation step, and stores the signature generation key stored in the signature generation key storage unit A signature data generation step of signing a signature bit string using, and generating signature data;
A data output step in which the signature data generation device outputs the signature data, the plurality of plaintext data, and auxiliary data associated with the plaintext data;
A signature data generation method comprising: A verification apparatus comprising a signature verification key storage unit that stores a signature verification key corresponding to the signature generation key used in the signature data generation method according to claim 6 is generated by the signature data generation method according to claim 6. A data input step for inputting the signature data and the auxiliary data, and the plaintext data corresponding to the auxiliary data;
A hash data generation step in which the verification device performs hash calculation on the input plaintext data to generate hash data;
A comparison bit string generation step in which the verification device generates a comparison bit string by calculating an exclusive OR of the input auxiliary data and the hash data generated by the hash data generation step;
A verification bit string generation step in which the verification device performs a restoration process using the signature verification key stored in the signature verification key storage unit on the input signature data, and generates a verification bit string;
A verification step in which the verification device compares the verification bit string with the comparison bit string and verifies the relevance between the plaintext data and the signature data;
A verification method comprising: For a computer having a signature generation key storage unit for storing a signature generation key for generating a signature,
A plaintext data input step for inputting a plurality of plaintext data;
For each of the plurality of plaintext data, a hash data generation step of performing hash calculation and generating hash data;
For each of the plurality of plaintext data, an exclusive OR of all the hash data other than the hash data corresponding to the plaintext data generated in the hash data generation step is calculated, and auxiliary data of the plaintext data is generated. An auxiliary data generation step;
A signature bit string is generated by calculating an exclusive OR of all the hash data generated in the hash data generation step, and the signature bit string is converted using the signature generation key stored in the signature generation key storage unit. A signature data generation step for signing and generating signature data;
A data output step of outputting the signature data, the plurality of plaintext data, and auxiliary data associated with the plaintext data;
A program for running A computer including a signature verification key storage unit that stores a signature verification key corresponding to the signature generation key used in the program according to claim 8.
A data input step of inputting the signature data and the auxiliary data generated by executing the program according to claim 8, and the plaintext data corresponding to the auxiliary data;
A hash data generation step for generating hash data by performing a hash calculation on the input plaintext data;
A comparison bit string generation step for generating a comparison bit string by calculating an exclusive OR of the input auxiliary data and the hash data generated by the hash data generation step;
A verification bit string generation step of performing a restoration process using a signature verification key stored in the signature verification key storage unit on the input signature data, and generating the verification bit string;
A verification step of comparing the verification bit string with the comparison bit string and verifying the relevance between the plaintext data and the signature data;
A program for running

Images