JP2017059872A - Bidding system and bidding method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a bidding system in a demand response system on a smart grid which bidding system enables an electric power consumer, a bidder, to communicate with the demand response system under anonymity and can keep security and privacy of the electric power consumer and the bidder.SOLUTION: A bidding system includes a bidder terminal 10, a registration management device 20, and a bidding management device 30, and a bidder Bregisters a bidder registration key with the registration management device 20 first. Thereafter, the registration management device 20 generates a bidding key for each bidding session. The bidding management device 30 generates a bidding certificate on the basis of the bidding key generated by the registration management device 20 for each bidding session, thereby communicates with the bidding terminal 10 under anonymity, and performs a bidding process capable of keeping security and privacy of the bidder.SELECTED DRAWING: Figure 1

Description

  The present invention guarantees anonymity and untrackability of a bid participant when bidding via a network, particularly in a bid in an incentive-based demand response system of a smart grid. The present invention relates to a bidding method and system that are guaranteed not to leak and can maintain the security and privacy of each bid participant.

Smart grids are emerging as the next generation power grid. In particular, as an important element of the smart grid, the demand response system can maintain the balance between supply and demand and reduce the customer's electricity bill (see Patent Document 1).
At the same time, however, maintaining the security of demand response systems and protecting the privacy of customers is an important issue.
For example, Hongwei and others have proposed an adaptive key evolution technique using private demand aggregation and homomorphic encryption (Non-Patent Document 1).
In addition, Defeng and others designed a demand response protocol that protects privacy based on attribute-based encryption (Non-Patent Document 2).
Yanmin and others have proposed a scheme for an incentive-based demand response system that allows individual demand reduction and demand response rewards to be calculated while maintaining customer privacy (Non-Patent Document 3).
However, a method that can handle the complete bidding process of an incentive based demand response system has not yet been invented.

US Patent Publication No. 2014/0324507

Hongwei Li, et al. “EPPDR: An Efficient Privacy-Preserving Demand Response Scheme with Adaptive Key Evolution in Smart Grid.” IEEE Transactions on Pard. 25, no. 8, 2014. Depend Li, et al. “No peeking: privacy-preserving demand system in smart grids.” International Journal of Parallel, Emergent and Distributed Systems. Taylor & Francis. Yanmin Gong, et al. “A Privacy-Preserving Scheme for Incentive-Based Demand Response in the Smart Grid.” IEEE Transactions on Smart Grid, vol. pp, issue. 99, 2015.

When bidding via a network, for example, bidding in an incentive-based demand response system of a smart grid, the following problems exist.
(1) Anonymity: Ensuring that unauthorized entities cannot identify bidders when bidding.
(2) Untraceable: At the end of a bid, the winning bidder is not identified by an untrusted entity. However, the validity of the winning bidder shall be verifiable. Also, no individual can be tracked during the bidding session.
(3) Impossibility of impersonation: Nobody can participate in bidding by giving the ID of another bidder.
(4) Impossibility of falsification: No one can falsify a valid bid price.
(5) Non-repudiation: The bidder cannot deny his bid after the successful bidder is announced.
(6) Possibility of proof: Anyone can prove the effectiveness of bidding.
(7) Bidder inability to link between different bid sessions: Inability to access results that allow the bidder to identify that he / she participated in various different bid sessions.
(8) Linkability within a single bidding session: During a single bidding session, the number of bidder bids can be determined.
(9) Privacy: Untrusted entities cannot link bids to individual consumers. Also, untrusted entities cannot infer personal information about individual consumers from the system.
(10) Certainty and integrity: The ability to verify the authenticity and completeness of all bid notifications and bids.
(11) Single registration: A bidder can participate in all bids by registering once.
(12) Incentive distribution: The successful bidder must be able to claim incentives without revealing his or her identity to the supplier.

  In order to solve the above-mentioned problems, the present invention provides (1) anonymity, (2) untraceability, (3) impersonability, (4) unfalsification, (5) ) Non-repudiation, (6) verifiability, (7) bidder unlinkability between different bidding sessions, (8) linkability within a single bidding session, (9) privacy, (10) It is an object of the present invention to provide a bidding system and a bidding method capable of ensuring certainty and integrity, (11) single registration, and (12) incentive distribution.

  The present invention provides the following solutions.

In order to solve the above-described problem, the bidder registration method according to the present invention includes a plurality of bidder terminals for a plurality of n bidders B _i (1 ≦ i ≦ n) to participate in bidding, and the bidder B. _A bidder registration method in a system in which a registration management device for registering _i is connected via a network, wherein a prime number q is a divisor of an integer (p-1) obtained by subtracting 1 from a prime number p, Two prime values p and prime q, and elements of a multiplicative group Z _p ^* modulo the prime p, the element g of which the order is a prime q are set in advance. The bidder terminal uses an integer randomly selected from the multiplicative group Z _q ^* modulo the prime number q as the bidder secret key SK _i of the bidder B _i and uses the bidder secret key SK _i as an exponent. by calculating the powers of g, the bidder registration key RK _i bidder B _i A bidder's private key and registration key generating step of forming, by calculating the power of the element g as exponent identification information id _i bidder B _i, bidder ID key to generate a bidder ID key parameter gamma _i An association parameter for generating an association parameter φ _i by adding a value obtained by multiplying the bidder B _i identification information id _i by the bidder secret key SK _i and the bidder ID key parameter γ _i to the parameter generation step. a generation step, transmits a bid registration key RK _i bidder B _i and bidder ID key parameter gamma _i associated with parameter phi _i securely to the registration management system, bidders registration request for requesting the bidder registration a step, a run, the registration management apparatus, a bidder ID key parameters and bidder registration key RK _i bidder B _i from the bidder terminal gamma _i and associated parameters φ Receiving the door to secure the received association parameters φ a value obtained by exponentiation of the element g as _i exponent of the inverse of the bidder registration key RK _i received as received bidder ID key parameter gamma _i should exponential RK _i ^When the value obtained by multiplying the power of ^-1 by the bidder ID key parameter γ _{i received} is equal to the bidder registration key RK _i received from the bidder terminal and the bidder ID key parameter γ _i And a bidder registration step of registering in the bidder registration table.

In order to solve the above-described problem, the bidding method according to the present invention includes a plurality of bidder terminals for a plurality of n bidders B _i (1 ≦ i ≦ n) to participate in bidding, and the bidder B. _A bidding method in a system in which a registration management apparatus for registering _i and a bid management apparatus for executing the bidding are connected via a network, wherein the registration is performed by the bidder registration method described above. A bidder registration of the bidder B _i (1 ≦ i ≦ n) is made in the management device, and a collision collision hash function h is preset, and the bid management device uses a multiplicative group Z modulo the prime number q. A bid that generates a bid management public key PK _BM by calculating a power of the original g by using a randomly selected integer as a bid management secret key SK _BM from _q ^* and using the bid management secret key SK _BM as a power index Management secret key The public key generation step is executed, and the registration management device further transmits a request for requesting a j-th (1 ≦ j) bid to all registered bidders via the bidder terminal. A request transmission step, and when the bidder terminal further receives the request from the registration management device, the bidder terminal randomly selects an integer k _{i, j} from the multiplicative group Z _q ^* for the bidder B _i , A first hash value h (k _{i, j} ) is calculated using the hard-to-collision hash function h, and the first hash value h (k _{i, j} ) and the bidder registration key RK _i are stored in the registration management device. And securely executing a bid key generation request step for requesting the registration management device to generate a bid key Y _{i, j} of the bidder B _i. The registration management device further includes: First hash value h (ki _{, j} ) And the bidder registration key RK _i are securely received, and the received bidder registration key RK _i is raised to the power by using the received first hash value h (ki _{, j} ) as a power index. A bid key generating step for generating a bid key Y _{i, j} in the j th bid session of B _i , and the bid management device further executes the j th bid generated by the bid key generation step. A bidding certificate generation step of generating a bidding certificate C _{i, j} of the j-th bidding session for each bidding key Y _{i, j} based on all the bidding keys Y _{i, j} in the session, wherein the multiplicative group Z The power of the original g is calculated by using an integer r _j randomly selected from _q ^* as a power index to generate a j-th bid public parameter δ _j , and the bid management secret key _SKBM is used as a power index Y _By calculating the power of _j, secret parameters of the j-th bid _{S i,} to generate a _j tender key _{Y i,} for each _j, the secret parameters of the j-th bid and parameters _{r j} of the j-th bid _{S i, j} as exponent the product of the bid key Y _i, by calculating the power of _j, running tender key Y _i, tender certificate C _i for each _j, the bid certificate generation step of generating a _j, a The bidder terminal further executes a bid step for transmitting bid information of the bidder B _i including the bid certificate C _{i, j} and the encrypted bid amount bid _{i, j} to the bid management apparatus. To do.

Further, the bid step, the bidders terminal, the bid price bid i, a _j, the bid management public key PK _BM by generating data C ₃ encrypted, randomly selected from the multiplicative group Z _q ^* An integer t _i is determined, and the product s _i = (SK _i · h (k _i ) of the bidder secret key SK _i , the first hash value h (k _{i, j} ) and the secret parameter S _{i, j} of the j th bid. _{, J} ) · S _{i, j} ) as a signing key, the signing key bid _{i, j} is encrypted using the signing key s _i as a power index and a value obtained by raising the power of the j-th bid public parameter δ _j as a verification key. for the data _{C 3,} an electronic signature by signature method Schnorr _{{α i, j, β i} , j} to generate a bid certificate _{C i, j} and the bid amount _{bid i,} data obtained by encrypting _j C ₃ and a digital signature {α _{i, j} , β _{i, j} bid information _{{C i} bidder _{B i} comprising}, j, _{C 3,} alpha _{i, j,} be configured to include a step, to be transmitted to the bid management unit of beta _{i, j}} Can do.

The bidder terminal further selects an arbitrary integer x belonging to the multiplicative group Z _q ^* according to the instruction of the successful bidder, and uses a value z calculated by exponentiating the element g with x as a power index. The registration management device extracts a bidder ID key parameter γ _i corresponding to the successful bidder B _i in the j-th bid session from the j-th bid session participating bidder table. , Executing a step of transmitting a random challenge b to the bidder terminal, wherein the bidder terminal further generates a response a = x + b · id _i in response to the challenge b and responds to the registration management device. Then, the registration management device further designates x to a value obtained by raising the power of the original g with the response a as an exponent and a value obtained by raising the power of γ _i with the exponent of the challenge b as a power. As a number, it is confirmed whether or not the value obtained by multiplying the value z calculated by raising the element g to the power is equal, and if both values are equal, a step of determining that the value is a valid successful bidder is executed. .

Integer k _{i, j} described above can be obtained from the multiplicative group Z _q ^* the integer k _i selected at random and configured to be raised to the power value of the integer k _i as an index to the j.

The registration management device further uses an integer randomly selected from the multiplicative group Z _q ^* modulo the prime number q as a registration management secret key SK _RM , and the registration management secret key SK _RM as a power exponent, A registration management private key / public key generation step for generating a registration management public key PK _RM is performed by calculating a power, and secure transmission of data from the bidder terminal to the registration management device is performed by transmitting the data, encrypted data encrypted using the registration management public key PK _RM, by sending to the registration management device, which transmits to the secure, from the bidder terminals of the registration management device secure reception of data, by decrypting the said encrypted data received from the bidder terminal the registration management secret key SK _RM, be configured to receive secure Can.

A bidder registration system according to the present invention includes a plurality of bidder terminals for a plurality of n bidders B _i (1 ≦ i ≦ n) to participate in a bid, and a registration management for registering the bidder B _i. 2 is a bidder registration system in which a device is connected via a network, and the prime number q has two large values such that the prime number q is a divisor of an integer (p-1) obtained by subtracting 1 from the prime number p. p and a prime q, and an element g of a multiplicative group Z _p ^* modulo the prime p, the order of which is a prime q, and the bidder terminal modulo the prime q A bidder secret key SK _i of the bidder B _i is a randomly selected integer from the multiplicative group Z _q ^* to be calculated, and the power of the original g is calculated by using the bidder secret key SK _i as a power index. bidder secret key and registration key generation unit for generating a bidder registration key RK _i of B _i By calculating the power of the element g as identification information id _i to the index bidder B _i, and bidder ID key parameter generating unit for generating a bidder ID key parameter gamma _i, identity of bidder B _i An association parameter generation unit that generates an association parameter φ _i by adding a value obtained by multiplying id _i by a bidder secret key SK _i and a bidder ID key parameter γ _i, and bidder registration of the bidder B _i A bidder registration request unit that securely transmits a key RK _i , a bidder ID key parameter γ _i and an association parameter φ _i to the registration management device and requests bidder registration, the registration management device comprising: wherein receiving from the bidders terminal and bidder registration key RK _i bidder B _i and bidder ID key parameter gamma _i associated with parameter phi _i securely, to the association parameter phi _i received A value obtained by exponentiation of the element g as a number, a value obtained by exponentiation of the inverse RK _i ^-1 bidders registration key RK _i received as exponent a bidder ID key parameter gamma _i received, the value obtained by multiplying the reception A bidder registration unit for registering the bidder registration key RK _i received from the bidder terminal and the bidder ID key parameter γ _i in the bidder registration table when the bidder ID key parameter γ _i is equal to .

A bid system according to the present invention includes a plurality of bidder terminals for a plurality of n bidders B _i (1 ≦ i ≦ n) to participate in a bid, and a registration management device for registering the bidder B _i. A bidding system connected to a bidding management apparatus for executing the bidding via a network, wherein the bidder B _i (1 ≦ i ≦ n) the bidder registration is performed, and the collision difficult hash function h is set in advance, and the registration management apparatus further sends all registered bidders to the jth ( A request transmitting unit that transmits a request for requesting a bid of 1 ≦ j), and the bidder terminal further receives a multiplicative group Z _q ^* for the bidder B _i when receiving the request from the registration management device ^. To integer _i, and _j is selected at random, using a collision-resistant hash function h, the first hash value h _{(k i, j)} is calculated, and the first hash value h _{(k i, j)} and the bidder registration key RK and _i, the transmitted securely to the registration management system, to the registration management unit, bid key Y _i bidder B _i, with the tender key generation request unit for requesting generation of _j, the registration management device Further receives securely the first hash value h (k _{i, j} ) and the bidder registration key RK _i from the bidder terminal, and uses the received first hash value h (k _{i, j} ) as the exponent. as, by exponentiation bidders registration key RK _i received, it includes a bid key generating unit for generating a bid key Y _{i, j} in the j-th bid session bidder B _i, the bid management unit may further , The j-th bid set generated by the bid key generation unit. Based on all of the bid key Y _{i, j} in Deployment, tender key Y _i, tender certificate C _i of the j-th bid session for each _j, a bid certificate generation unit that generates a _j, multiplicative group Z The power of the original g is calculated by using an integer r _j randomly selected from _q ^* as a power index to generate a j-th bid public parameter δ _j , and the bid management secret key _SKBM is used as a power index By calculating the power of Y _{i, j} , a j-th bid secret parameter S _{i, j} is generated for each bid key Y _{i, j} , and the j-th bid parameter r _j and j-th bid secret parameter S _i are generated. _, as an index to the product of _j, tender key Y _i, by calculating the power of _j, tender key Y _i, tender certificate C _i for each _j, the bid certificate generation unit that generates a _j, a wherein the bidders terminal further bidding certificate C _{Includes j,} and encrypted bid amount bid i, a bid generator that transmits bid information bidder B _i comprising _j against bid management unit.

The bid generation unit further generates data C ₃ obtained by encrypting the bid amount bid _{i, j} with the bid management public key PK _BM, and determines an integer t _i randomly selected from the multiplicative group Z _q ^*. The product of the bidder secret key SK _i , the first hash value h (k _{i, j} ) and the secret parameter S _{i, j} of the j th bid s _i = (SK _i · h (k _{i, j} ) · S _i, and the signature key to _j), as the signature key s _i to the index, a value obtained by exponentiation of the j-th bid public parameter [delta] _j as a verification key, to bid bid i, data C ₃ obtained by encrypting _j The electronic signature {α _{i, j} , β _{i, j} } according to the Schnorr signature method is generated, the bid certificate C _{i, j} , the data C ₃ obtained by encrypting the bid amount bid _{i, j} , signature scheme electronic signature by _{{α i, j, β i} , j} entry including Person _{B i} bid information and _{{C i, j, C 3} , α i, j, β i, j}, can be configured to be transmitted to the bid management unit.

The integer k _{i, j} can be obtained from the multiplicative group Z _q ^* the integer k _i selected at random and configured to be raised to the power value of the integer k _i as an index to the j.

Further, the registration management device further uses an integer randomly selected from the multiplicative group Z _q ^* modulo the prime number q as a registration management secret key SK _RM , and uses the registration management secret key SK _RM as a power exponent. a registration management private key / public key generation unit that generates a registration management public key PK _RM by calculating a power of g, and the secure transmission of data from the bidder terminal to the registration management device includes: the data, encrypted data encrypted using the registration management public key PK _RM, by sending to the registration management device, which transmits to the secure, from the bidder terminals of the registration management device secure reception of data, by decrypting by the registration management secret key SK _RM said encrypted data received from the bidder terminal, child configured to receive secure You can.

  According to the present invention, when bidding over a network, for example, in a bid in a smart grid incentive-based demand response system, (1) anonymity, (2) untraceability, (3) impersonability, (4) Impossibility of tampering, (5) Non-repudiation, (6) Proof of possibility, (7) Inability to link bidders between different bidding sessions, (8) Linkable within a single bidding session (9) Privacy, (10) Certainty and integrity, (11) Single registration, (12) Incentive allocation can be secured, and the successful bidder does not reveal his identity to the supplier. Incentives can be charged.

1 is an overall configuration diagram in a bid system or a bid method according to an embodiment of the present invention. It is a subsystem block diagram which shows the subsystem structure of the bid system which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the bidder terminal 10 which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the registration management apparatus 20 which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the bid management apparatus 30 which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the verification terminal 40 which concerns on embodiment of this invention. In the embodiment of the present invention, it is a flow chart for explanation of pre-processing in the registration management device 20 and the input management device. In embodiment of this invention, it is a flowchart with which it uses for description about bidder registration in the bidder terminal 10 and the registration management apparatus 20. FIG. In embodiment of this invention, it is a flowchart with which it uses for description about the bid key production | generation process in the bidder terminal 10 and the registration management apparatus 20. FIG. 5 is a flowchart for explaining a bid certificate creation process in the bidder terminal 10 and the registration management device 20 in the embodiment of the present invention. In embodiment of this invention, it is a flowchart with which it uses for description about the bid process in the bidder terminal 10 and the bid management apparatus 30. FIG. In embodiment of this invention, it is a flowchart with which it uses for description about the incentive distribution process in the bidder terminal 10 and the registration management apparatus 20. FIG.

<First Embodiment>
Hereinafter, a first embodiment, which is an example of an embodiment of the present invention, will be described. As shown in FIG. 1, a bid system 1000 according to the present embodiment includes a plurality of bidder terminals 10, a registration management device 20, a bid management device 30, a verification terminal 40, and a communication network.

  When the bidding system 1000 according to the present embodiment is applied to bidding in a smart grid incentive-based demand response system, the demand response system communicates anonymously and shows the amount to be reduced in order to reduce the power demand in a specific period A power consumer who makes a bid corresponds to a bidder. Further, the power supplier corresponds to a registration manager who manages the registration management apparatus 20. The demand response system corresponds to the bid management apparatus 30.

The bidder terminal 10, the registration management device 20, the bid management device 30, and the verification terminal 40 include, for example, a control unit such as a CPU, a storage unit such as a RAM, a ROM, and a hard disk storage device, a display unit, an input unit, and a communication unit. Including known computers including, for example, personal computers, notebook computers, portable terminals such as tablet terminals, smartphones, and mobile phones, servers, and clouds.
The registration management device 20 and the bid management device 30 may be a server, a cloud, or the like.

  The control unit is configured by a processor having a CPU, I / O, and the like, and controls each component. The CPU executes the application program read from the storage unit, reads information from the storage unit at the time of execution, writes information to the storage unit, and exchanges signals with the communication unit.

The communication unit implements a communication protocol that can be connected to a network such as an Internet line, and a communication protocol that performs transmission and reception (data communication) of packet data and the like through a wireless base station (not shown).
The bidder terminal 10, the registration management device 20, the bid management device 30, and the verification terminal 40 each have a communication unit and can transmit and receive information to and from each other via a network. In addition, an electronic bulletin board described later can be accessed.

  The storage unit includes a semiconductor memory, a hard disk drive, and the like, and stores various information necessary for the bidding system 1000, such as an operating system (OS) and software called an application, such as an encryption key. The

The control unit causes the computer to function as predetermined means by executing the program of the bidding system 1000.
Details will be described later.

The description of the bidding system 1000 is divided into several subsystems for convenience.
As shown in FIG. 2, the bidding system 1000 includes a pre-processing subsystem 1001, a bidder registration subsystem 1002, a bid key generation subsystem 1003, a bid certificate creation subsystem 1004, a bid processing subsystem 1005, and a verification subsystem 1006. , And an incentive distribution subsystem 1007.

Hereinafter, functional units of the bidding system 1000 will be described.
First, the preprocessing subsystem 1001 will be described.

<Preprocessing Subsystem 1001>
In the pre-processing subsystem 1001, the registration management device 20 and the bid management device 30 generate system parameters necessary for generating various data and exchanging messages in the bid system 1000.
As described below, in the present invention, an asymmetric encryption key and an electronic signature that use the difficulty of the discrete logarithm problem are used.
That is, for the prime number p and the two integers g and h, the problem of obtaining the solution x of the following equation, that is, the problem of obtaining the logarithm (discrete logarithm) x of the integer g of the integer h under the modulus p. Take advantage of the difficulty of the discrete logarithm problem.
Equation h = g ^ x mod p
Here, g ^ x means the power of g where x is an exponent.
In such a case, even if the prime number p and the integers g and h are made public, it is difficult to obtain the integer x, so that h is treated as a public key and x is treated as a secret key.

<Pre-processing in Registration Management Device 20>
For pre-processing, as shown in FIG. 4, the registration management device 20 includes a prime number generation unit 201, a residue group element selection unit 202, a hash function selection unit 203, a registration management private key / public key generation unit 204, A registration management electronic signature key pair generation unit 205, a registration management electronic bulletin board creation unit 206, and a registration parameter publication unit 207 are provided.

  The prime number generation unit 201 generates two large prime numbers p and prime number q such that the prime number q is a divisor of an integer (p−1) obtained by subtracting 1 from the prime number p.

The remainder group element selection unit 202 selects an element g that is an element of a multiplicative group Z _p ^* modulo a prime number p and whose order is a prime number q.

  The hash function selection unit 203 selects the collision difficulty hash function h. Here, the collision-resistant hash function h is a one-way function in which it is difficult to search for two different messages m1 and m2 such that h (m1) = h (m2).

The registration management private key / public key generation unit 204 randomly selects an integer SK _RM from the multiplicative group Z _q ^* modulo the prime number q and sets it as the registration management secret key SK _RM .
The registration management public key / public key generation unit calculates the power of the element g selected by the remainder group element selection unit 202 using the registration management secret key _SKRM as a power index, as shown in Equation 1, and performs registration management. A public key PK _RM is generated.
PK _RM = g ^ SK _RM mod p (Formula 1)
The registration management secret key SK _RM and registration management public key PK _RM are in a relationship of the decryption key and the encryption key in the El Gamal encryption.
As will be described later, the registration management public key PK _RM is mainly used to encrypt a message transmitted from the bidder terminal 10 when transmitting a message from the bidder terminal 10 to the registration management apparatus 20.
A message encrypted with the registration management public key PK _RM can be decrypted only by a person having the registration management secret key SK _RM , that is, the registration manager (or the registration management apparatus 20), and the registration manager (or registration). No entity other than the management device 20) can decrypt the message.
Accordingly, the message encrypted by the bidder terminal 10 using the registration management public key PK _RM is decrypted even if it is assumed that a third party other than the registration manager (or the registration management device 20) has illegally acquired the message. It is not possible. By doing so, it becomes possible to ensure security.

Here, an example of the encryption function EncPK _RM () using the registration management public key PK _RM and the decryption conversion using the registration management private key SK _RM will be described.
As the encryption function EncPK _RM (), encryption conversion and decryption conversion in El Gamal encryption can be applied.
Specifically, for example, the message m is encrypted as follows.
First, a random number k is generated.
Next, as shown in Expression 2, a value C obtained by multiplying the message m by a value PK _RM ^ k mod p obtained by multiplying the registration management public key PK _RM by k.
C = m · PK _RM ^ k mod p (Formula 2)
And as shown in Equation 3, a value C ′ obtained by raising the element g to the power of k
C ′ = g ^ k mod p (Formula 3)
And the integer pair (C, C ′) is used as the ciphertext of the message m by the encryption function EncPK _RM () as shown in Equation 4.
EncPK _RM (m) = (C, C ′) (Formula 4)

The message m encrypted by the encryption function EncPK _RM () can be decrypted by the registration management secret key SK _RM in the registration management device 20 as follows.
Integer pair (C, C') in, as shown in Equation 5, the C, by dividing by a power value of C'to RM secret key SK _RM the exponent, it is possible to recover the message m.
m = C / (C ′ ^ SK _RM ) mod p (Formula 5)
As can be seen from the above description, the message encrypted by EncPK _RM () cannot be decrypted by an entity other than the registration manager (or registration management apparatus 20) who does not know the registration management secret key SK _RM .

When the registration management electronic signature key pair generation unit 205 transmits a message from the registration management device 20, the registration management electronic signature key pair generation unit 205 ensures that the message has been created by the registration manager (or the registration management device 20). A key pair (Sig _RM , Ver _RM ) of Sig _RM and verification key Ver _RM is generated. The electronic signature key pair (Sig _RM , Ver _RM ) is generated based on, for example, a Schnor signature (hereinafter referred to as “Schnor's signature”) or the like.
As will be described later, when the request req is transmitted from the registration management device 20 to the bidder terminal 10, the request req is signed with the signature key Sig _RM . By doing so, it is possible to prevent a third party from impersonating the registration manager (or the registration management device 20) and performing unauthorized processing in advance.

The registration management electronic bulletin board creation unit 206 establishes a registration management bulletin board in which only the registration manager has the write authority, and will be described later with respect to the bid manager (or the bid management apparatus 30), the bidder, the verifier, and the like. Thus, the bid key Y _{i, j} in the j-th bid session of the bidder B _i can be posted.
In addition, since only the registration manager has the write authority in the registration management bulletin board, an unauthorized entity cannot falsify information posted on the registration management bulletin board.

  The registration parameter publication unit 207 includes the prime numbers p and q generated by the prime number generation unit 201, the element g selected by the remainder group element selection unit 202, the collision-resistant hash function h selected by the hash function selection unit 203, and the like. announce.

<Pre-processing in bid management apparatus 30>
As shown in FIG. 5, the bid management apparatus 30 includes a bid management private key / public key generation unit 301 and a bid management electronic bulletin board creation unit 302 for pre-processing.

The bid management private key / public key generation unit 301 randomly selects an integer from the multiplicative group Z _q ^* modulo the prime number q published by the registration management device 20 and sets it as the bid management private key _SKBM .
As shown in Equation 6, the bid management private key / public key generation unit 301 calculates the power of the original g bid management private key SK _BM published by the RM, and generates a bid management public key PK _BM .
PK _BM = g ^ SK _BM mod p (Formula 6)

The bid management private key SK _BM and the bid management public key PK _BM are in the relationship between the decryption key and the encryption key in the ElGamal cipher, like the registration management private key SK _RM and the registration management public key PK _RM described above.
The bid management public key PK _BM is mainly used when the bid information bid _{i, j} is presented to the bid management device 30 via the bidder terminal 10 from the bidder B _i in the j-th bid session, as will be described later. Used to encrypt bid information bid _{i, j} .
By doing so, the message encrypted with the bid management public key PK _BM can be decrypted only by the person having the bid management secret key SK _BM , that is, the bid manager (or the bid management apparatus 30). Entities other than the manager (or bid management device 30) cannot decrypt the message.
Therefore, even if it is assumed that the message transmitted from the bidder terminal 10 and encrypted with the bid management public key PK _BM is illegally acquired by a third party other than the bid manager (or the bid management device 30). Can not be decrypted. By doing so, it becomes possible to ensure security.
Note that the encryption function EncPK _BM () using the bid management public key PK _BM applies the encryption conversion and decryption conversion in the El Gamal encryption in the same manner as the encryption function EncPK _RM () using the registration management public key PK _RM. Can do.
For example, as described later, the bid information bid _{i, j} in the j-th bid session encrypted by the bid management public key PK _BM is the person who has the bid management secret key SK _BM , that is, the bid manager (or the bid manager). Only the management device 30) can decrypt, and no entity other than the bid manager (or the bid management device 30) can decrypt the bid information bid _{i, j} .

The bid management electronic bulletin board creation unit 302 establishes a bid management bulletin board in which only the bid manager has the write authority, and for example, a bid certificate corresponding to every bid participant B _i in the j-th bidding session to be described later. A letter C _{i, j} is posted.
As will be described later, the bid management device 30 posts successful bid information after the completion of each j-th bid session.
In addition, since only the bid manager has the write authority in the bid management bulletin board, an unauthorized entity cannot falsify information posted on the bid management bulletin board.

  Next, with reference to FIG. 7, the flow of pre-processing in the registration management apparatus 20 and the input management apparatus according to an embodiment of the present invention will be described. FIG. 7 is a flowchart illustrating an example of pre-processing.

  In step ST201, the registration management apparatus 20 generates two large prime numbers p and prime number q such that the prime number q is a divisor of an integer (p-1) obtained by subtracting 1 from the prime number p.

In step ST202, the registration management apparatus 20 selects an element g that is an element of the multiplicative group Z _p ^* for the number p and whose order is a prime number q.

  In step ST203, the registration management device 20 selects the collision-resistant hash function h.

In step ST 204, the registration management apparatus 20, the multiplicative group modulo prime q _Z ^{q *,} the integer randomly selects a registration management secret key _{SK RM.}

In step ST205, registration management apparatus 20, the exponent register management secret key _{SK RM,} calculates the power of the element g which has been selected by the remainder group element selection unit 202, generates a registration management public key _{PK RM.}

In step ST 206, the registration management unit 20 generates a signature key _{Sig RM} and the verification key _{Ver RM} key pair _{(Sig RM, Ver} RM).

  In step ST207, the registration management device 20 establishes a registration management bulletin board in which only the registration manager has the write authority.

  In step ST208, the registration management apparatus 20 publishes a prime number p, a prime number q, an element g, a collision collision hash function h, and the like.

In step ST 301, the bid management unit 30, based on the published parameters in step ST208, the multiplicative group _Z ^{q *,} and the bid management secret key _{SK BM} by selecting an integer randomly. In addition, bid management unit 30 calculates the power of the bid management secret key _{SK BM} of the original g, to generate a bid management public key _{PK BM.}

In step ST302, the bid management apparatus 30 establishes a bid management bulletin board in which only the bid manager has write authority.
As described above, the registration management device 20 and the bid management device 30 can generate system parameters necessary for generating various data and performing secure message exchange in the preprocessing subsystem 1001.

<Bidder registration subsystem 1002>
Next, bidder registration will be described.
In bidder registration, a bidder who desires to participate in a bid session requests bidder registration from the registration management device 20, and the registration management device 20 performs bidder registration.
By doing so, the bidder can register in the registration management device 20 once and can participate in all bids, so-called single registration is possible.
Further, by deleting the registration of the bid participation applicant once registered, it is possible that the bid participation applicant who has been deleted from registration cannot participate in any bid session thereafter.

<Bidder terminal 10>
As shown in FIG. 3, each bidder terminal 10 includes a bidder electronic signature key pair generation unit 101, a bidder private key / registration key generation unit 102, a bidder ID key parameter generation unit 103, An association parameter generation unit 104 and a bidder registration request unit 105 are provided.

The bidder electronic signature key pair generation unit 101 generates a signature verification key (Sig _i , Ver _i ) composed of a signature key Sig _i and a verification key Ver _i for verifying the signature of the bidder B _i. . Here, the signature verification key (Sig _i , Ver _i ) may be generated based on, for example, the Schnorr signature method.

The bidder secret key / registration key generation unit 102 selects an integer at random from the multiplicative group Z _q ^* modulo the prime number q published by the registration management device 20 and selects the bidder secret key SK of the bidder B _{i. i} .
The bidder secret key / registration key generation unit 102 calculates the power of the element g using the bidder secret key SK _i as a power index as shown in Equation 7, and obtains the bidder registration key RK _i of the bidder B _i. Generate.
RK _i = g ^ SK _i mod p (Formula 7)
The bidder secret key SK _i and the bidder registration key RK _i are in a relationship between a decryption key and an encryption key in El Gamal encryption.

As shown in Equation 8, the bidder ID key parameter generation unit 103 calculates the power of the original g using the identification information id _i of the bidder B _i as a power index, so that the bidder ID key parameter of the bidder B _i is calculated. γ _i is generated. By doing so, the bidder's identification information id _i can be concealed.
γ _i = g ^idi mod p (Equation 8)
The bidder identification information id _i and the bidder ID key parameter γ _i are in a relationship between a decryption key and an encryption key in El Gamal encryption.

The association parameter generation unit 104 generates the bidder B _i identification information id _i , the bidder secret key / registration key generation unit 102 generated by the bidder B _i , the bidder secret key SK _i, and the bidder ID key parameter generation. based on the bidder ID key parameter gamma _i bidder B _i generated by the section 103, as shown in equation 9, to create an association parameter phi _i bidders B _i.
φ _i = id _i + SK _i · γ _i (Equation 9)
Since the bidder secret key SK _i is secret information that only the bidder B _i knows, the bidder registration key RK _i and the identification information id _i are valid according to the association parameter φ _i as described later. It can be confirmed. Further, the bidder registration key RK _i and the identification information id _i can be related by the association parameter φ _i .

Thus, the bidder's anonymity and tracking in the bidding system of the present invention is performed by masking the identification information id _i of the bidder B _i by the bidder ID key parameter generation unit 103 and the association parameter generation unit 104. Impossibility, privacy, etc. can be guaranteed.

The bidder registration request unit 105 uses the registration management public key PK _RM of the registration manager (or the registration management device 20) acquired from the registration management device 20 via the communication unit to register the bidder B _{i for} the bidder. A message (RK _i || γ _i || φ _i ) obtained by concatenating the key RK _i , the bidder ID key parameter γ _i, and the association parameter φ _i is encrypted and encrypted as shown in Expression 10. reduction has been the data C ₁ transmits the bid registration part 208 described later of the registration management device 20 via the communication unit to request a bid registration. At this time, the verification key Ver _i of the bidder B _i generated by the bidder electronic signature key pair generation unit 101 is transmitted to the bidder registration unit 208.
C ₁ = EncPK _RM (RK _i || γ _i || φ _i ) (Formula 10)

  By doing so, a person who wishes to bid can register once in the registration management device 20 and participate in all bids executed thereafter.

<Registration management device 20>
As shown in FIG. 4, the registration management device 20 includes a bidder registration unit 208.

Bidder registration unit 208, bidders terminal 10 (hereinafter, a terminal used by a bidder B _i as "bidder terminals 10i") from bidder B _i received from the bidder registration request unit 105 of the bidders B the encrypted data _{C 1} of the associated _i bidders registration key RK _i and bidder ID key parameter gamma _i coupling a parameter phi _i (concatenate) message _{(RK i || γ i || φ} i), registered _{Decrypt with the} management secret key (SK _RM ).

Then, the bid registration part 208, based on the message decode the _{γ'i (RK i || γ i} || φ i), is calculated according to the formula 11.
γ ′ _i = (g ^ φ _i ) · RK _i ^ (− γ _i ) mod p (Formula 11)
Then, the bidder registration unit 208 checks whether γ ′ _i and the bidder ID key parameter γ _i are equal.

When the bidder ID key parameter generation unit 103 and the association parameter generation unit 104 have legitimately masked the bidder identification information id _i ,
γ ′ _i = (g ^ φ _i ) · RK _i ^ (− γ _i ) mod p
= (G ^ (id _i + SK _i · γ _i )) · RK _i ^ (− γ _i ) mod p
= G ^ (id _i ) · g ^ (SK _i · γ _i ) · RK _i ^ (− γ _i ) mod p
= G ^ (id _i ) · RK _i ^ (γ _i ) · RK _i ^ (− γ _i ) mod p
= Γ _i
From the fact that the, _γ'i is seen to be equal to the bidder ID key parameter γ _i.

gamma prime _i bidders ID key parameter when gamma _i are equal, the bid registration part 208, and accepts the registration request via the bidders terminal 10i from bidders B _i, tender bidder B _i The bidder registration key RK _i and the bidder ID key parameter γ _i are registered in the bidder registration table.
A person who wishes to bid once registers with the registration management device 20 and can participate in all bid sessions executed after registration with the registration management device 20, as will be described later.

In the case where the gamma prime _i and bidder ID key parameter gamma _i is different, the bid registration part 208 rejects the registration request of the new bidder B _i.

Thus, registration management device 20 is not able to know the identity id _i bidders, the bidder registration key RK _i bidder B _i, but a bidder ID key parameter gamma _i legitimate It is possible to confirm that there is a registration. By doing so, it is possible to maintain anonymity of each bidder B _i, disguised impossibility, the privacy and the like.
As described above, in the bidder registration, the registration management device 20 registers bidder and registration key RK _i bidder B _i, a bidder ID key parameter gamma _i bidders B _i.

  Next, referring to FIG. 8, bidder registration in the bidder terminal 10 and the registration management device 20 according to an embodiment of the present invention will be described. FIG. 8 is a flowchart showing an example of bidder registration.

In step ST101, the bidder terminal 10 generates a signature verification key (Sig _i , Ver _i ) composed of the signature key Sig _i and the verification key Ver _i for verifying the signature of the bidder B _i .

In step ST102, the bidder terminal 10 randomly selects an integer from the multiplicative group Z _q ^* modulo the prime number q and sets it as the bidder secret key SK _i of the bidder B _i .

In step ST103, the bidder terminal 10 calculates the power of the element g using the bidder secret key SK _i as an exponent, and generates the bidder registration key RK _i of the bidder B _i .

In step ST104, the bidder terminal 10 calculates the power of the element g using the identification information id _i of the bidder B _i as a power index, and generates a bidder ID key parameter γ _i .

In step ST105, the bidders terminal 10, bidders and a private key SK _i bidder _{B i,} based on the bidder ID key parameter gamma _i, create an association parameter phi _i bidders _{B i.}

In step ST 106, bidders terminal 10 requests a registration management public key _{PK RM} to the registration management device 20.

In step ST209, the registration management device 20 transmits the registration management public key _PKRM to the bidder terminal 10.

In step ST 107, bidders terminal 10, Bidder _{B i} bidders registration key RK _i and bidder ID key parameter gamma _i bidders _{B i} association parameter phi _i coupling and (concatenate) message (RK _i || γ _i || φ _i ) is encrypted using the registration management public key PK _RM received from the registration management device 20, and the encrypted data C ₁ is transmitted to the registration management device 20. Also, the verification key Ver _i of the bidder B _i is transmitted to the bidder registration unit 208.

In step ST210, the registration management unit 20 decodes the registration management secret key _{(SK RM)} encrypted data _{C 1} received from the bidder terminal 10.

In step ST211, the registration management apparatus 20 verifies whether or not the decrypted data secures integrity using the association parameter φ _i . If integrity is ensured (Yes), the process proceeds to ST212. When integrity is not secured (No), the decrypted data is discarded and the process returns to step ST210.

In step ST212, registration management device 20 registers bidder and registration key RK _i bidder _{B i,} and bidder ID key parameter gamma _i, the bidders registration table.
Thus, registration management device 20 registers bidder and registration key RK _i bidder _{B i,} a bidder ID key parameter gamma _i bidders _{B i.}

<Bid Key Generation Subsystem 1003 in Each Bid Session>
Next, generation processing of the bid key Y _{i, j} required when the bidder B _i registered in the registration management device 20 participates in the j-th (1 ≦ j) bid session will be described.
Hereinafter, for the sake of simplicity, the registered bidders are _denoted as {B ₁ , B ₂ , B ₃ ,... B _n }.
The bidder B _i who wishes to participate in the j-th bid session needs to generate a new bid key Y _{i, j} in the registration management device 20.
That is, in each bid session, the bidder B _i needs to newly generate his / her bid key Y _{i, j} in the registration management apparatus 20 for each bid session.
By doing so, the third party can determine that the same bidder who has bid in the j-th bid session and bidder B _i who has bid in the j-th bid session in the j-th and k-th different bid sessions (j ≠ k). B _i cannot be associated.
As described above, it is possible to distinguish the bidder B _i who bids in the j-th bidding session while ensuring the anonymity of the bidder B _i and the inability to link the bidder between different bidding sessions. It is possible to verify the legitimacy of the person.

<Bidder terminal 10>
As shown in FIG. 3, the bidder terminal 10 includes a request verification unit 106, a bid key generation request unit 107, and a bid key confirmation unit 108 for bid key generation processing.

The request verification unit 106 verifies whether the request req of the bid request message {req, λ} transmitted from the request transmission unit 209 of the registration management device 20 described later is transmitted from the valid registration management device 20. To do. Here, λ is a request req signed with the signature key Sig _RM of the registration management apparatus 20.
Specifically, the bidder terminal 10 _i corresponding to each bid participant B _i verifies whether λ is an electronic signature for the request req using the verification key Ver _RM of the registration management device 20.
If the verification fails, the bidder B _i (or the bidder terminal 10 _i ) determines that the request req is not transmitted from the valid registration management device 20 and aborts the process.

When the request verification unit 106 verifies that the request req transmitted from the registration management device 20 is transmitted from the valid registration management device 20, the bid key generation request unit 107 determines the integer k from the multiplicative group Z _q ^*. The first hash value h (k _i ^ j) of the bidder B _i is calculated by selecting _i at random and applying a value obtained by exponentiating k _i with j as the exponent to the collision hard hash function h.
The bidding key generation requesting unit 107 concatenates the first hash value h (k _i ^ j) of the bidder B _i and the bidder registration key RK _i (h (k _i ^ j) || RK) _i ) is encrypted with the registration management public key PK _RM as shown in Expression 12 to generate the encrypted information C ₂ , and as shown in Expression 13, using the signature key Sig _i of the bidder B _i The signature data σ _i of the first hash value h (k _i ^ j) is generated, and the encryption information C ₂ and the signature data σ _i are transmitted to the registration management device 20. By doing so, the registration management device 20 is requested to generate bid keys Y _{i, j} . The bid key generation request unit 107 keeps the first hash value h (k _i ^ j) secret.
C ₂ = EncPK _RM (h (k _i ^ j) || RK _i ) (Formula 12)
σ _i = Sig _i (h (k _i ^ j)) (Formula 13)

As will be described later, the bid key Y _{i, j} in the j-th bidding session of the bidder B _i has the first hash value h (k _i ^ j) as a power index as shown in Equation 14, and the bidder B _i the bidder registration key RK _i of _i be to power, is generated.
Y _{i, j} = RK _i ^ (h (k _i ^ j)) mod p (Formula 14)

The bid key confirmation unit 108 calculates the bid key Y _{i, j} of the bidder B _i itself based on the equation (14).
As will be described later, the bid key confirmation unit 108 generates its own bid key Y _{i, j} when all the bid keys {Y _{i, j} } generated by the registration management device 20 are posted on the registration management bulletin board. It can be confirmed whether or not. When the bid key confirmation unit 108 has its own bid key Y _{i, j} posted on the registration management bulletin board, it determines that the bid key for the j-th bid session has been generated and made public.
When the bid key Y _{i, j} is not posted on the registration management bulletin board, the bid key confirmation unit 108 can transmit a message to that effect to the registration management apparatus 20.

In this way, since a new bid key is generated for each bidding session, an unauthorized third party bids for the j-th bidding session in j-th and k-th different bidding sessions (j ≠ k). it is not possible to associate the person B _i and the k-th same bidder B _i was a bid to bid session. By doing so, it is possible to secure anonymity of bidder B _i, untraceable property, the bidder link impossibility, etc. between different bid sessions.

<Registration management device 20>
As shown in FIG. 4, the registration management apparatus 20 includes a request transmission unit 209, a bid key generation unit 20A, and a bid key posting unit 20B.

The request transmission unit 209 sends a request req requesting a bid to all the registered bidders {B _i (1 ≦ i ≦ n)} and the request req of the registration manager (or the registration management device 20). Signature data λ = Sig _RM (req) is created using the signature key Sig _RM , and a bid request message {req, λ} is transmitted.
The verification key Ver _RM corresponding to the signature key Sig _RM of the registration manager (or the registration management device 20) is open to all bidders {B _i (1 ≦ i ≦ n)} registered in advance. Shall.

Bid key generating unit 20A decodes the registration management secret key _{SK RM} bidders encrypted information _{C 2} from a bidder terminal 10i has received via the communication unit corresponding to the _{B i,} the plaintext _{(h (k} i ^ j) || Obtain RK _i ). The bid key generation unit 20A verifies the signature data σ _i with the verification key Ver _i .

Bid key generating unit 20A based on the first hash value h obtained by decoding by the registration management secret key _{SK RM} encrypted information _{C 2 (k i ^ j)} , verification key Ver _i bidder _{B i} Is used to verify whether the signature data σ _i is an electronic signature for the first hash value h (k _i ^ j).
When the signature data σ _i is an electronic signature for the first hash value h (k _i ^ j), the bid key generation unit 20A accepts the bid key generation request message from the bidder B _i as valid, As shown in Equation 14, the first hash value h (k _i ^ j) is used as an exponent, and the bidder registration key RK _i of the bidder B _i is raised to the power, so that the j-th bid session of the bidder B _i A bid key Y _{i, j} necessary for participating in is generated.
If the two values are different, the bid key generation unit 20A discards the bid key generation request message from the bidder B _i as an invalid one and does not generate the bid key Y _{i, j} .
In this way, no one can scold others and participate in the bid.

In this way, the bid key generation unit 20A only accepts the bid key generation request message received from the registered bidder B _i (1 ≦ i ≦ n) as a valid bid key generation request message. ) Generate a bid key Y _{i, j} in the j-th bid session of bidder B _i .
Thereafter, the bid key generation unit 20A uses the first hash value h (k _i ^ j) of the bidder B _i , the bidder registration key RK _i, and the bidder ID key parameter γ _i to participate in the jth session participation bid. To the person table.
By doing so, the registration management device 20 can store a list of bidders participating in the j-th bid session among the bidders registered in the bidder registration table.

The bid key posting unit 20B posts the bid key Y _{i, j} of the bidder B _i in the j-th bid session generated by the bid key generation unit 20A on the registration management bulletin board and makes it public.
By doing so, each bidder B _i that transmitted the bid key generation request message uses the first hash value h (k _i ^ j) that he / she has as a power index, and the power of the bidder registration key RK _i that he / she has. It can be confirmed that the bid key Y _{i, j} obtained by doing so is posted on the registration management bulletin board.
By doing so, the bidder B _i (or the bidder terminal 10 _i ) determines whether or not the registration management device 20 has generated the bid key Y _{i, j} necessary for participating in the j-th bid session. It becomes possible to judge.
In addition to the bidder B _i , only the registration management device 20 knows the correspondence relationship between the bid key Y _{i, j} and the bidder registration key RK _i and the bidder ID key parameter γ _i .

In this way, by newly generating the bid key Y _{i, j} for each bid session, it is determined for the third party which bid key Y _{i, j} corresponds to the same bidder for each bid session. And the association between the bidder participating in the jth bid session and the bidder participating in the kth bid session is not possible. In doing so, each bid session ensures each bidder's anonymity, untrackability, and bidder's inability to link between different bid sessions. Thus, unauthorized entities are unable to link each bid information with the bid participant's identification information, ensuring that the personal information of the bid participant is not leaked, and ensuring the security and privacy of each bid participant. Can be maintained.

  Next, with reference to FIG. 9, a bid key generation process in the bidder terminal 10 and the registration management device 20 according to an embodiment of the present invention will be described. FIG. 9 is a flowchart illustrating an example of a bid key generation process.

In step ST 213, the registration management device 20, to the registered bidders all _{B i,} via the bidders terminal 10i, a request req to request bids, signature data using the signature key _{Sig RM} request req λ = Sig _RM (req) is created, and a bid request message {req, λ} is transmitted.

  In step ST108, the bidder terminal 10 receives the j-th bid request message {req, λ} from the registration management device 20.

In step ST109, the bidder terminal 10 uses the verification key Ver _RM of the registration management device 20 to transmit the bid request message {req, λ} received from the registration management device 20 from the valid registration management device 20. It is verified whether it is. If the bid request message is valid (Yes), the process proceeds to step ST110. If the bid request message is not valid (No), the process is aborted, and the process returns to step ST108.

In step ST110, the bidder terminal 10i randomly selects an integer k _i from the multiplicative group Z _q ^*, and calculates a first hash value h (k _i ^ j) using the collision-resistant hash function h.

In step ST111, the bidder terminal 10i uses the plaintext (h (k _i ^ j) || RK _i ) obtained by concatenating the first hash value h (k _i ^ j) and the bidder registration key RK _i. Encrypted with the registration management public key PK _RM to generate the encrypted information C _2, and the signature data σ _i of the first hash value h (k _i ^ j) is generated using the signature key Sig _i of the bidder B _i Then, the encryption information C ₂ and the signature data σ _i are transmitted to the registration management apparatus 20.

In step ST 214, the registration management device 20 receives the encrypted information _{C 2} from the bidders terminal 10i, and the signature data sigma _i, a.

In step ST215, registration management apparatus 20, encrypted information _{C 2} is decrypted by the registration management secret key _{SK RM,} to obtain plaintext _{(h (k i ^ j)} || RK i), the signature data sigma _i Verification is performed using the verification key Ver _i of the bidder B _i . If the verification result is valid (Yes), the process proceeds to step ST216. If the verification result is not valid (No), the process returns to step ST214.

In step ST216, registration management apparatus 20, the exponent of the first hash value h _(k i ^ j), by power bidders registration key RK _i bidder _{B i,} j-th bidder _{B i} Bidding keys Y _{i, j} in the bidding session are generated.

In step ST217, the registration management device 20 registers {first hash value h (k _i ^ j), bidder registration key RK _i , bidder ID key parameter γ _i } in the jth session participation bidder table.

In step ST218, the registration management device 20 posts all the bid keys {Y _{i, j} } generated in step ST216 on the registration management bulletin board.

In step ST112, the bidder B _i (or the bidder terminal 10i) checks whether or not its bid key Y _{i, j} is posted on the registration management bulletin board. When its own bid key Y _{i, j} is posted on the registration management bulletin board (Yes), the process proceeds to step ST113 described later. If its own bid key Y _{i, j} is not posted on the registration management bulletin board (No), that fact is reported to the registration manager (or registration management apparatus 20), and the process returns to step ST111.

<Bid certificate creation subsystem 1004>
Next, the bid certificate creation process will be described. The bid certificate creation process is a bid preparation process in the bid management apparatus 30.
In the present invention, the bid process is executed by a bid management device 30 different from the registration management device 20. For this reason, the bid management apparatus 30 newly generates a bid certificate {C _{i, j} } based on the bid key {Y _{i, j} } generated by the registration management apparatus 20.

In response to the fact that the registration management device 20 has posted the bid key {Y _{i, j} } in the j-th bid session on the registration management bulletin board, the bid management device 30 is j for participating in the j-th bid session. A bid certificate C _{i, j} for the th bid session is generated, and the generated j th bid certificate {C _{i, j} } is posted on the bid management bulletin board.
By displaying the j-th bid certificate C _{i, j} of the bidder B _i itself on the bid management bulletin board, the bidder B _i can receive the j-th bid in the bid management device 30 via the bidder terminal 10 _i. It will be possible to enter the bid process for the session.

<Bid management device 30>
For this reason, as shown in FIG. 5, the bid management apparatus 30 includes a bid certificate generation unit 303 and a bid certificate posting unit 304.

The bid certificate generation unit 303 generates a bid certificate C _{i, j} for _{the jth} bid session based on the bid key Y _{i, j} for _{the jth} bid session posted on the registration management bulletin board.
Specifically, the bid certificate generation unit 303 randomly selects an integer r _j from the multiplicative group Z _q ^* and sets it as a j-th bid parameter r _j. The power of the original g is calculated by using r _j as a power index, and the j-th bid public parameter δ _j is generated.
δ _j = g ^ r _j mod p (Formula 15)
As will be described later, δ _j is a source selected from the multiplicative group Z _q ^* when the electronic signature is applied to the bid information by the Schnorr signature method (see Equations 22 and 23).

Next, as shown in Equation 16, the bid certificate generation unit 303 uses the bid management secret key _SKBM as a power index and raises the bid key Y _{i, j} to the power, thereby the secret parameter S _{i, j} is generated for each bid key Y _{i, j} .
S _{i, j} = Y _{i, j} ^ SK _BM mod p (Equation 16)

Next, as shown in Expression 17, the bid certificate generation unit 303 uses the product of the parameter r _j for the j-th bid and the secret parameter S _{i, j} for the j-th bid as a power index, and the bid key Y _{i, j} To generate a bid certificate C _{i, j} for each bid key Y _{i, j} .
C _{i, j} = Y _{i, j} ^ (r _j · S _{i, j} ) modp (Equation 17)

In this way, the bid certificate generation unit 303 uses the bid key Y _{i, j} generated by the registration management device 20 as a power exponent with parameters that only the bid management device 30 knows as the bid certificate C _{i, j.} Generated by exponentiation.
The bid management apparatus 30 obtains the bid certificate C _{i, j} of the j-th bid session for each bid key Y _{i, j} based only on the bid key Y _{i, j} posted on the registration management bulletin board. Generate.
Therefore, the bid manager (or the bid management apparatus 30) cannot know the information regarding the bidder corresponding to the bid certificate C _{i, j} . In this way, at the bidding stage, each bidder's anonymity, untrackability, privacy, and bidder's inability to link between different bidding sessions are fully guaranteed.

Further, an unauthorized third party cannot associate the bid key Y _{i, j} generated by the registration management device 20 with the bid certificate C _{i, j} generated by the bid management device 30. In this way, at the bidding stage, the bidding certificate C _{i, j} further increases the bidder's anonymity, untrackability, privacy, and non-linkability of bidders between different bidding sessions. Is fully guaranteed.

On the other hand, the secret parameter S _{i, j} of the j-th bid can also be calculated according to Equation 18, as is apparent from Equation 6, Equation 7, and Equation 14.
S _{i, j} = RK _i ^ (h (k _i ^ j) · SK _BM ) modp
= G ^ (SK _i · h (k _i ^ j) · SK _BM ) modp
= PK _BM ^ (h (k _i ^ j) · SK _i ) modp (Equation 18)
Further, the j-th bid certificate C _{i, j} can also be calculated by Expression 19, as is clear from Expression 6, Expression 7, Expression 14, and Expression 15.
C _{i, j} = RK _i ^ (h (k _i ^ j) · r _j · S _{i, j} ) modp
= G ^ (SK _i · h (k _i ^ j) · r _j · S _{i, j} ) modp
= Δ _j ^ (SK _i · h (k _i ^ j) · S _{i, j} ) (Equation 19)
As described above, since the j-th bid disclosure parameter δ _j is disclosed, the bidder B _i (or the bidder terminal 10 _i ) can calculate the j-th bid certificate C _ij itself.

<Sign of Chenor>
As shown in Expression 15, δ _j (= g ^ r _j modp) is an element of the multiplicative group Z _p ^* modulo the prime number p, and its order is the prime number q.
If s _i = (SK _i · h (k _i ^ j) · S _{i, j} ), as shown in Equation 20, s _i is the signature key in the Schnorr signature scheme, and the j-th bid certificate C _{i and j} are verification keys in the Schnorr signature scheme (see Equations 22 and 23 described later).
C _{i, j} = δ _j ^ s _i mod p (Equation 20)

The bid certificate posting unit 304 posts the jth bid disclosure parameter δ _j and the jth bid certificate C _{i, j} in the jth bid session on the bid management bulletin board and makes them public.

<Bidder terminal 10>
Biddler B _i (or bidder terminal 10 _i ) confirms whether or not bidder Bi's own bid certificate has been posted on the bid management bulletin board in order to perform a bid procedure in the j-th bidding session in the j th bidding session in order to check whether or not bidder B _i own As shown in FIG. 3, a bid certificate confirmation unit 109 is included.

The bid certificate confirmation unit 109 generates the secret parameter S _{i, j} of the j-th bid based on Equation 18 using the first hash value h (k _i ^ j) and the bidder secret key SK _i that the bid certificate confirmation unit 109 has. Then, the j-th bid certificate C _{i, j} is calculated based on Equation 19.
The bid certificate confirmation unit 109 can confirm that the j-th bid certificate C _{i, j} obtained by the calculation is posted on the bid management bulletin board.
By doing so, the bidder B _i (or the bidder terminal 10 _i ) can participate in the j-th bid session in the bid management device 30 and can enter the bid procedure.

  Next, with reference to FIG. 10, a bid certificate creation process in the bidder terminal 10 and the bid management apparatus 30 according to an embodiment of the present invention will be described. FIG. 10 is a flowchart illustrating an example of a bid certificate creation process.

In step ST303, the bid management apparatus 30 randomly selects an integer r _j from the multiplicative group Z _q ^* , calculates the power r of the original g, using r _j as the exponent and r _j as the parameter r _j of the j th bid. , J-th bid release parameter δ _j is generated (Formula 15).

In step ST 304, the bid management unit 30, the exponent a bid management secret key _{SK BM,} tender key _{Y i,} secret parameters of the j-th bid by power of _{j S i,} to generate a _j (Equation 16).
In step ST305, the bid management apparatus 30 generates the bid certificate C _{i, j} of the j-th bid session based on all the bid keys Y _{i, j} posted on the registration management bulletin board (Equation 17 and Equation 19).

In step ST306, the bid management apparatus 30 posts {jth bid disclosure parameter δ _j , {jth bid certificate C _{i, j} }} on the bid management bulletin board. In ST303, the j-th bid disclosure parameter δ _j may be posted on the bid management bulletin board.

In step ST113, the bidder B _i (or the bidder terminal 10i) checks whether or not its j-th bid certificate C _{i, j} is posted on the bid management bulletin board. When the j-th bid certificate C _{i, j} is posted (Yes), the process proceeds to ST114 described later. If the j-th bid certificate C _{i, j} is not posted (No), the fact is reported to the bid manager (or the bid management apparatus 30), and the process returns to step ST113.

<Bid processing subsystem 1005>
Next, bidding processing will be described. Bid processing includes bid processing to bid management device 30 by bidder B _i via bidder terminal 10 _i , bid opening processing by bid management device 30, processing for releasing the winning bid amount of the successful bidder, and registration management device 20 includes a process of posting successful bid information at 20.
The bidder B _i (or the bidder terminal 10i) confirms that the j-th bid certificate C _{i, j} is posted on the bid management bulletin board, and the bidder terminal 10i bids the bid information. It can be transmitted to the management device 30. The bid management device 30 receives bid information of the bidder B _i from each bidder terminal 10 _i and executes a bid process for determining the winning bidder.

<Bidder terminal 10>
Therefore, as shown in FIG. 3, the bidder terminal 10 includes a bid generation unit 10 </ b> A in order to place a bid in the j-th bid session.

The bid generation unit 10A performs a bid process on the bid management apparatus 30 in the j-th bid session.
Specifically, the bid generation unit 10A performs the following process.

First, the bid generation unit 10A encrypts the bid amount bid _{i, j} determined by the bidder B _i with the bid management public key PK _BM as shown in Expression 21. Encrypted bid amount _{bid i,} the _j and _{C 3.}
C ₃ = EncPK _BM (bid _{i, j} ) (Formula 21)
By doing so, the encrypted bid amount bid _{i, j} can be decrypted only by the person having the bid management secret key SK _BM , that is, the bid manager (or the bid management apparatus 30).

Then, the bid generator 10A selects an integer _{t i} from the multiplicative group _Z ^{q *,} bidders secret key SK _i bidders _{B i} first hash value h of the _(k i ^ j) and Bidder _{B i} The product s _i = (SK _i · h (k _i ^ j) · S _{i, j} ) with the secret parameter S _{i, j} of the j-th bid of the encrypted data C of the bid amount bid _{i, j 3} is used as a message to generate an electronic signature {α _{i, j} , β _{i, j} } according to Schnor's signature scheme for C _{3 as} shown in Equation 22 and Equation 23.
As described above (Equation 20), δ _j is an element selected from the multiplicative group Z _q ^* when electronically signing the message using the Schnorr signature scheme, s _i is the signature key, and the j th bid The certificate C _{i, j} is a verification key.
C _{i, j} = δ _j ^ s _i mod p (Equation 20)
α _{i, j} = h (δ _j ^ t _i modp || C ₃ ) (Formula 22)
β _{i, j} = (t _i + α _{i, j} · s _i ) (Equation 23)
Therefore, it is verified that the digital signature is valid only when Expression 24 holds.
α _{i, j} = h (δ _j （(β _{i, j} ) · C _{i, j} （(−α _{i, j} ) modp || C ₃ ) (Equation 24)

The bid generation unit 10A includes a bid certificate C _{i, j as} a verification key, a message C ₃ that is an encrypted bid amount bid _{i, j} , and an electronic signature {α _{i, j} , β using a Schnorr signature scheme. _i, bid information consisting _{j} {C i, j,} C 3, α i, j, to bid against bid management unit 30 beta _{i, j}.}
For example, you may comprise so that it may post on a bid management bulletin board.

<Bid management device 30>
The bid management device 30 receives a bid of the bidder B _i who participates in the j-th bid session and executes bid opening processing for determining the winning bidder.
Therefore, as shown in FIG. 5, the bid management apparatus 30 includes a bid opening processing unit 305.

Tender opening processing unit 305, bidders terminal 10i from bidding certificate _{C i, j} and the encrypted bid amount _{bid i,} a message _{C 3} is _j, the signature of Schnorr Message _{C 3} {alpha _i, j, beta _{i, j}} consists bid information _{{C i, j, C 3} , α i, j, β i, receives the _j}, the electronic signature by signature method Schnorr message _{C 3 {α i, j,} β _{i, j} } is verified.
Specifically, the bid opening processing unit 305 verifies according to the above-described equation 24.

More specifically, [alpha] 'the value calculated on the basis of the right formula of the formula 24 _i, when the _j, bid opening processing unit 305, [alpha]' _i, if _j is equal to alpha _{i, j,} bid message It determines that the legitimate from bidders B _{i (or} bidder terminals 10i), the encrypted bid amount bid i by bid management secret key SK _BM, decodes the message C ₃ is _j, the bidder terminals The bid amount bid _{i, j} from 10i is acquired.
On the other hand, bid opening processing unit 305, [alpha] _{'i, if j} is different from the alpha _{i, j,} the tender message is determined to be illegal, discarded.
In this way, it is impossible to impersonate (no one can beat the others and participate in bidding), no tampering (no one can tamper with the bid price), non-repudiation (the bidder after the successful bidder is announced) Can not deny their bids), certainty and integrity (allowing to verify the authenticity and completeness of all bids).

The bid opening processing unit 305 announces the highest bid amount as a successful bid amount from the bid amounts {bid _{i, j} } (1 ≦ i ≦ n). Specifically, it may be configured to post on a bid management bulletin board.
By doing so, Bidder B _i other than the winning bidder and the amount of the successful bid as a reference, it is possible to participate in the next (j + 1) th bidding session.

Specifically, the bid opening processing unit 305 determines the bid certificate C _{i, j} of the successful bidder B _i , the product of the parameter r _j of the j th bid and the secret parameter S _{i, j} of the j th bid, the j th bid. A message (C _{i, j} , (r _j · S _{i, j} ), Y _{i, j} , bid _{i, j} ) including the key Y _{i, j} and the successful bid amount bid _{i, j} is posted on the bid management bulletin board.
In this way, an arbitrary verifier can confirm that the successful bid is valid by confirming that Equation 25 holds between the bid certificate C _{i, j} of the successful bidder B _i and the bid key Y _{i, j.} It can be determined that
C _{i, j} = Y _{i, j} ^ (r _j · S _{i, j} ) modp (Equation 25)

<Posting on the registration management bulletin board>
On the other hand, as shown in FIG. 4, the registration management apparatus 20 includes a successful bid information posting unit 20 </ b> C in order to support the validity of the successful bidder.
The successful bid information posting unit 20C includes the successful bid information (C _{i, j} , (r _j · S _{i, j} ) of the successful bidder B _i in the j th bid session posted by the bid manager (or the bid management apparatus 30), Y _{i, j} , bid _{i, j} ), the registration management device 20 can determine the bidder registration key RK _i of the successful bidder B _i .
The successful bid information posting unit 20C then sends a message (Y _{i, j} , j) including the bid key Y _{i, j} of the successful bidder B _i , the first hash value h (k _i ^ j), and the bidder registration key RK _i . h (k _i ^ j), RK _i ) can be posted on the registration management bulletin board.
The verifier can confirm whether or not the bidder registration key RK _i of the successful bidder B _i and the bid key Y _{i, j} satisfy the relationship described in Expression 14. By doing so, by posting to the registration management bulletin board, as seen from the registration management unit 20, it is possible to determine the validity of the successful bidder B _i.

  Next, with reference to FIG. 11, a bid process in the bidder terminal 10 and the bid management apparatus 30 according to an embodiment of the present invention will be described. FIG. 11 is a flowchart illustrating an example of a bid process.

In step ST114, the bidders terminal 10i is Bidder _{B i} bid _bid entered by _i, is encrypted by _j the bid management public key _{PK BM,} and _{C 3.}

In step ST115, the bidder terminal 10i selects an integer t _i from the multiplicative group Z _q ^* , uses s _i = (SK _i · h (ki _i j) · S _{i, j} ) as a signature key, and C ₃ The electronic signature {α _{i, j} , β _{i, j} } by the Schnorr signature scheme is generated (Equation 22 and Equation 23).

In step ST116, the bidder terminal 10i determines the bid information of the bidder B _i {bid certificate C _{i, j} , encrypted data C _{3 of} the bid amount bid _{i, j} , electronic signature {α _{i, j} , β _{i, j} }} is transmitted to the bid management apparatus 30.

In step ST307, the bid management apparatus 30 uses the Schnorr signature scheme for the bid information {C _{i, j} , C ₃ , {α _{i, j} , β _{i, j} }} received from the bidder terminal 10i {α _{i, j} , β _{i, j} } is verified (Equation 24). If the verification result is valid (Yes), the process proceeds to step ST308. If the verification result is not valid (No), the bid information is discarded.

In step ST 308, the bid management unit 30, the bid amount _{bid i,} and decoded by the bid management secret key _{SK BM} encrypted data _{C 3} of _j, to obtain a bid _{bid i, j} from the bidders terminal 10i.

In step ST 309, the bid management unit 30, {bid _{bid i, j}} from among, as a successful bid the highest bid, the bid certificate _{C i} of successful bidder _{B i,} and _j, the parameters of the j-th bid A message (C _{i, j} , (r _j · S) comprising the product of r _j and the secret parameter S _{i, j} of the j th bid, the j th bid key Y _{i, j,} and the bid amount bid _{i, j i, j} ), Y _{i, j} , bid _{i, j} ) are posted on the bid management bulletin board.

In step ST219, the registration management device 20 uses the bid management device 30 to confirm the successful bid information (C _{i, j} , (r _j · S _{i, j} ), Y _i of the successful bidder B _i in the posted j th bid session. _{, j, bid i,} based on the _j), to determine the bidder registration key RK _i of the successful bidder _{B i.}

In step ST220, registration management apparatus 20, the tender key _{Y i} of successful bidder _{B i, j} and a first hash value h _(k i ^ j), the bid registration key RK _i and consists of a message _{(Y i , J} , h (k _i ^ j), RK _i ) are posted on the registration management bulletin board.

In step ST117, the bidder B _i (or the bidder terminal 10i) determines whether or not the bidder B _i is a successful bidder. In the case of a successful bidder (Yes), the process proceeds to step ST117. When it is not a successful bidder (No), the process returns to step ST108. By doing so, it is possible to proceed to the (j + 1) th bidding session.

<Verification subsystem 1006>
An arbitrary verifier can verify whether the bid is valid, for example, before the successful bid, via the verification terminal 40. That is, the possibility of proof can be ensured.
For this purpose, the verification terminal 40 includes a verification unit 401 as shown in FIG.

The verification unit 401 confirms that Expression 24 is established from the bid information {C _{i, j} , C _3, {α _{i, j} , β _{i, j} }}.
The verification unit 401 can determine that the bid information is valid from the bidder terminal 10 i when Expression 24 is satisfied. That is, it is determined that the bid certificate C _{i, j} and the encrypted bid amount bid _{i, j} C ₃ are valid.
Note that the verification unit 401 can determine that the bid information is invalid if Expression 24 is not satisfied.
In this way, any verifier can verify the authenticity and completeness (certainty and integrity) of all bid notifications and bids.

<Incentive distribution subsystem 1007>
The successful bidder B _i can request an incentive from the registration manager without revealing his / her identity.

  Therefore, as shown in FIG. 3, the bidder terminal 10 includes a successful bid claim unit 10B. As shown in FIG. 4, the registration management device 20 includes a successful bidder confirmation unit 20D.

The winning bidder B _i uses the bidder terminal 10 (successful bid claiming unit 10B) to prove zero knowledge using the bidder ID key parameter γ _i shown in Equation 8 together with the winning bid amount bid _{i, j} in the j th bid session. Is shown in the registration management apparatus 20 as follows.
First, the successful bidder B _i selects an arbitrary integer x belonging to the multiplicative group Z _q ^* via the bidder terminal 10 and sets the power z (= g ^ x modp) of the element g with x as a power exponent. It transmits to the registration management device 20.
Next, the registration management device 20 (successful bidder confirmation unit 20D) searches the storage unit (jth bid session participation bidder table), and bidder ID key parameter γ _i corresponding to the successful bidder in the jth bid session. And a random challenge b (a non-zero value) is transmitted to the bidder terminal 10.
The bidder terminal 10 (successful bid claim unit 10B) calculates a response a that is a value obtained by adding the product of the challenge b and the identification information id _i of the bidder B _i to x.
a = x + b · id _i (Formula 26)
The bidder terminal 10 (successful bid claim unit 10B) responds the calculated response a to the registration management device 20 (successful bidder confirmation unit 20D).
The registration management device 20 (successful bidder confirmation unit 20D) calculates a power of an element g having a response a as a power and a product of a power of a bidder ID key parameter γ _i having a power as a challenge b and z. It can be determined that the successful bid is valid by confirming that Formula 27 is satisfied.
_{g ^ a = z · γ i} ^ b ( Equation 27)
When Expression 27 is satisfied, the registration management device 20 (successful bidder confirmation unit 20D) can determine that the successful bidder _Bi is a valid successful bidder.
In this way, the successful bidder B _i can request an incentive without revealing his identity (eg, identification information id _i ) to the supplier.
Then, the registration management apparatus 20, it is possible to give an incentive to mutually agreed to the highest bidder B _i.

  Next, an incentive distribution process in the bidder terminal 10 and the registration management device 20 according to an embodiment of the present invention will be described with reference to FIG. FIG. 11 is a flowchart illustrating an example of the incentive distribution process.

In step ST118, the successful bidder B _i selects an arbitrary integer x belonging to the multiplicative group Z _q ^* via the bidder terminal 10, and the power value z (= g ^) of the element g having x as the exponent. x modp) is transmitted to the registration management device 20.

  In step ST221, the registration management apparatus 20 receives z (= g ^ x modp).

  In step ST222, the registration management device 20 transmits a challenge b (a non-zero value) to the bidder terminal 10.

In step ST119, the successful bidder B _i sends a response a which is a value obtained by adding the product of the challenge b and the identification information id _i of the bidder B _i to the registration management apparatus 20 via the bidder terminal 10. It responds (formula 26).

  In step ST223, the registration management device 20 determines whether or not Expression 27 is satisfied. When it is established (Yes), the process proceeds to step ST224. If not established (No), the process returns to step ST221.

In step ST224, registration management device 20, give incentives to the highest bidder _{B i.}

In step ST <b> 120, the successful bidder B _i receives an incentive via the bidder terminal 10. Then, it returns to step ST108. By doing so, it is possible to proceed to the (j + 1) th bidding session.

  In step ST225, the registration management apparatus 20 adds 1 to j, and returns to step ST213. By doing so, it is possible to proceed to the (j + 1) th bidding session.

As described above, by applying this embodiment to the bid system in the demand response system of the smart grid, the power consumer can (1) anonymize and (2) not trackable with the demand response system. (3) Impossibility of impersonation, (4) Impossibility of tampering, (5) Non-repudiation, (6) Proof of possibility, (7) Inability of bidders to link between different bidding sessions, (8) It is possible to communicate while ensuring linkability within a single bidding session, (9) privacy, (10) certainty and integrity, (11) single registration, and (12) incentive allocation.
By doing so, power consumers can send bids indicating the amount they are willing to reduce in order to maintain security and privacy and reduce demand in a specific time period.
For example, bid requests generated by power consumers for demand response and energy reduction will only be performed by legitimate entities that can prove the authenticity and completeness of such messages.
In addition, an untrusted entity (an entity that is not trusted by the consumer) cannot read the bid information nor link the bid to a specific power consumer, so the individual consumer's personal Information (for example, information on residents living in a mansion, rate plan information, home appliances, automobile usage information, etc.) is not leaked.
In addition, since the power consumer only needs to register with the system once, the overall method is easy to manage, and if necessary, the system can cancel the power consumer's bid right All you have to do is delete the consumer registration information.

As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.
Further, the bidding system described in the embodiment of the present invention can be applied not only to the demand response system of the smart grid but also to other bidding.

In the present embodiment, the registration management device 20 generates a prime p and a prime q with the prime generation unit 201, selects the element g with the remainder group element selection unit 202, and uses the hash function selection unit 203 with a collision-resistant hash The function h or the like is selected to publish these system parameters in the bidding system, but is not limited to this.
For example, these system parameters in the bidding system may be created in advance by a predetermined device or system.

In the present embodiment, for example, in the bid key generation subsystem 1003, the bid key generation request unit 107 randomly selects an integer k _i from the multiplicative group Z _q ^* and sets the j power of k _i to a collision-resistant hash function. Although the first hash value h (k _i ^ j) is calculated as the input value to h, the present invention is not limited to this.
For example, at the time of j-th bid session bidder B _i, for each bidder B _i, the multiplicative group Z _q ^*, integer k _i, a _j may be selected at random.

Note that the bidding system of the present invention can be realized using a normal computer system, not a dedicated system. For example, a computer-readable recording medium (a removable medium such as a CD, DVD, or Blu-ray disc) storing a program for executing the above-described operation may be distributed to the computer, or the server may be distributed via a network. Or you may distribute by downloading to a computer from a cloud.
Then, by installing the distributed program, the bidder terminal 10, the registration management device 20, the bid management device 30, the verification terminal 40, and the like can be configured.
Then, by starting the program and executing it under the control of the OS, the computer can be caused to function as the functional unit described above.

DESCRIPTION OF SYMBOLS 10 Bidder terminal 100 Control part 101 Bidder electronic signature key pair generation part 102 Bidder private key / registration key generation part 103 Bidder ID key parameter generation part 104 Association parameter generation part 105 Bidder registration request part 106 Request verification part DESCRIPTION OF SYMBOLS 107 Bid key generation | occurrence | production request part 108 Bid key confirmation part 109 Bid certificate confirmation part 10A Bid generation part 10B Successful bid assertion part 110 Storage part 120 Communication part 130 Operation part 140 Display part 20 Registration management apparatus 201 Prime number generation part 202 Remainder group element selection Unit 203 hash function selection unit 204 registration management private key / public key generation unit 205 registration management digital signature key pair generation unit 206 registration management electronic bulletin board creation unit 207 registration parameter release unit 208 bidder registration unit 209 request transmission unit 20A bid key Generation unit 20B Bid key posting unit 20C Successful bid information posting unit 20D Successful bidder confirmation unit 210 Storage unit 220 Communication unit 230 Operation unit 240 Display unit 30 Bid management device 301 Bid management private key / public key generation unit 302 Bid management electronic bulletin board creation unit 303 Bid certificate generation unit 304 Bid Certificate posting unit 305 Bid opening processing unit 40 Verification terminal 401 Verification unit 50 Communication network

Claims (11)

A plurality of bidder terminals for a plurality of n bidders B _i (1 ≦ i ≦ n) to participate in a bid and a registration management device for registering the bidder B _i are connected via a network. A bidder registration method in the system,
The prime number p and prime number q, which are two large values such that the prime number q is a divisor of an integer (p-1) obtained by subtracting 1 from the prime number p, and a multiplicative group Z _p ^* modulo the prime number p An element g whose order is a prime number q is preset,
The bidder terminal
From multiplicative group Z to a prime number q modulo _q ^*, the integer randomly selected and bidders secret key SK _i bidder B _i, to calculate the power of the element g as exponent bidders secret key SK _i in, and the bidder secret key and registration key generation step of generating a bidder registration key RK _i bidders B _i,
By calculating the power of the element g as identification information id _i to the index bidder B _i, and bidder ID key parameter generating step of generating a bidder ID key parameter gamma _i,
An association parameter generation step of generating an association parameter φ _i by adding a value obtained by multiplying the bidder secret key SK _i and the bidder ID key parameter γ _i to the identification information id _i of the bidder B _i ;
Sends a bidder registration key RK _i bidder B _i and bidder ID key parameter gamma _i and associated parameter phi _i securely to the registration management apparatus, a bidder registration request step of requesting a bid registration, the Run,
The registration management device includes:
Wherein receiving from the bidders terminal and bidder registration key RK _i bidder B _i bidder and ID key parameter gamma _i and associated parameter phi _i securely, power the element g as received association parameter phi _i should exponents were The value obtained by multiplying the received bidder ID key parameter γ _i by the exponent of the inverse RK _i ⁻¹ of the bidder registration key RK _i received as the exponent is the received bidder ID key parameter. A bidder registration method for executing a bidder registration step of registering a bidder registration key RK _i received from the bidder terminal and a bidder ID key parameter γ _i in a bidder registration table when equal to γ _i. . A plurality of bidder terminals for n bidders _Bi (1 ≦ i ≦ n) to participate in a bid, a registration management device for registering the bidder B _i, and for executing the bid A bidding method in a system in which a bid management apparatus is connected via a network,
The bidder registration method according to claim 1, wherein the bidder B _i (1 ≦ i ≦ n) is registered in the registration management device,
The collision hard hash function h is preset,
The bid management device includes:
Bidding is performed by calculating the power of the original g by using a randomly selected integer as the bid management secret key SK _BM from the multiplicative group Z _q ^* modulo the prime number q and using the bid management secret key SK _BM as a power index. A bid management private key / public key generation step for generating a management public key PK _BM is executed,
The registration management device further includes:
A request sending step for sending a request for requesting a j-th (1 ≦ j) bid to all registered bidders via the bidder terminal;
The bidder terminal further includes:
When the request is received from the registration management device, an integer k _{i, j} is randomly selected from the multiplicative group Z _q ^* for the bidder B _i and the first hash value h ( k _{i, j} ) and securely transmits the first hash value h (k _{i, j} ) and the bidder registration key RK _i to the registration management device. Performing a bid key generation request step for requesting generation of bid keys Y _{i, j} of B _i ;
The registration management device further includes:
The first hash value h (k _{i, j} ) and the bidder registration key RK _i are securely received from the bidder terminal, and the received first hash value h (k _{i, j} ) is received as an exponent. by power bidders registration key RK _i, running tender key Y _i in the j-th bid session bidder B _i, the tender key generating step of generating a _j, a,
The bid management device further includes:
Based on all the bid keys Y _{i, j} in the j-th bid session generated by the bid key generation step, the bid certificate C _{i, j} of the j-th bid session is obtained for each bid key Y _{i, j.} A bid certificate generation step to generate,
By calculating the power of the element g using an integer r _j randomly selected from the multiplicative group Z _q ^* as a power index, the j th bid public parameter δ _j is generated,
By using the bid management secret key SK _BM as a power index and calculating the power of the bid key Y _{i, j} , a secret parameter S _{i, j} of the j-th bid is generated for each bid key Y _{i, j} ,
By calculating the power of the bid key Y _{i, j using} the product of the parameter r _j of the jth bid and the secret parameter S _{i, j} of the _jth bid as a power index, the bid proof is obtained for each bid key Y _{i, j.} A bid certificate generating step for generating a document C _{i, j} ,
The bidder terminal further includes:
A bid method for executing a bid step of transmitting bid information of a bidder B _i including a bid certificate C _{i, j} and an encrypted bid amount bid _{i, j} to a bid management apparatus. The bidding step includes:
The bidder terminal is
Generating the data C ₃ obtained by encrypting the bid amount bid _{i, j} with the bid management public key PK _BM ;
An integer t _i selected at random from the multiplicative group Z _q ^* is determined _, and the product s of the bidder secret key SK _i , the first hash value h (k _{i, j} ) and the secret parameter S _{i, j} of the j th bid _i = (SK _i · h (k _{i, j} ) · S _{i, j} ) as a signature key, the sign key s _i as a power index, and a value obtained by raising the j-th bid public parameter δ _j to a power as a verification key, An electronic signature {α _{i, j} , β _{i, j} } by a Schnorr signature scheme is generated for the data C ₃ obtained by encrypting the bid amount bid _{i, j} ,
Bid certificate _{C i,} and _j, the bid amount _{bid i,} and data _{C 3} obtained by encrypting _j, tender bidder _{B i} comprising an electronic signature by signature method Schnorr _{{α i, j, β i} , j} The bidding method according to claim 2, further comprising: transmitting information {C _{i, j} , C ₃ , α _{i, j} , β _{i, j} } to the bid management apparatus. The bidder terminal further includes:
In accordance with the successful bidder's instruction, an arbitrary integer x belonging to the multiplicative group Z _q ^* is selected, and a step of transmitting a value z calculated by raising the element g to a power with x as a power exponent is executed. ,
The registration management device extracts a bidder ID key parameter γ _i corresponding to the successful bidder B _i in the j-th bid session from the j-th bid session participating bidder table, and sends a random challenge b to the bidder terminal. Perform the steps to send to
The bidder terminal further includes:
For the challenge b, generate a response a = x + b · id _i and execute a step of responding to the registration management device,
The registration management device further
A value obtained by exponentiating the element g with the response a as a power exponent, and a value obtained by multiplying a value obtained by raising the power of γ _i with the exponent of the challenge b as a power exponent and the value z calculated by raising the power of the element g with the power as x , Are equal and
If both values are equal, the step of determining that it is a valid successful bidder,
The bidding method according to claim 3 to be executed. The integer k _{i, j} randomly selects an integer k _i from the multiplicative group Z _q ^*, a value obtained by exponentiation of an integer k _i as an index to the j, any one of claims 2 to 4 Bidding method described in. The registration management device further includes:
Registration is performed by calculating a power of the element g using a randomly selected integer as a registration management secret key SK _RM from the multiplicative group Z _q ^* modulo the prime number q, and using the registration management secret key SK _RM as a power exponent. A registration management private key / public key generation step for generating a management public key PK _RM is executed,
Secure transmission of data from the bidder terminal to the registration management device includes:
The data to be transmitted is securely transmitted by transmitting the encrypted data obtained by encrypting the data using the registration management public key PK _RM to the registration management device.
Secure reception of data from the bidder terminal of the registration management device,
By decoding by the registration management secret key SK _RM said encrypted data received from the bidder terminal receives the secure method of claim 1 or claim 2. A plurality of bidder terminals for a plurality of n bidders B _i (1 ≦ i ≦ n) to participate in a bid and a registration management device for registering the bidder B _i are connected via a network. A bidder registration system,
The prime number p and prime number q, which are two large values such that the prime number q is a divisor of an integer (p-1) obtained by subtracting 1 from the prime number p, and a multiplicative group Z _p ^* modulo the prime number p An element g whose order is a prime number q is preset,
The bidder terminal
An integer selected at random from the multiplicative group Z _q ^* modulo the prime number q is used as the bidder secret key SK _i of the bidder B _i , and the power of the element g is calculated using the bidder secret key SK _i as a power exponent. that is, a bidder secret key and registration key generation unit for generating a bidder registration key RK _i bidders B _i,
By calculating the power of the element g as identification information id _i to the index bidder B _i, and bidder ID key parameter generating unit for generating a bidder ID key parameter gamma _i,
An association parameter generator for generating an association parameter φ _i by adding a value obtained by multiplying the bidder secret key SK _i and the bidder ID key parameter γ _i to the identification information id _i of the bidder B _i ;
Sends a bidder registration key RK _i bidder B _i and bidder ID key parameter gamma _i associated with parameter phi _i securely to the registration management apparatus, a bidder registration request unit for requesting the bidder registration, the Prepared,
The registration management device includes:
Wherein receiving from the bidders terminal and bidder registration key RK _i bidder B _i bidder and ID key parameter gamma _i and associated parameter phi _i securely, power the element g as received association parameter phi _i should exponents were The value obtained by multiplying the received bidder ID key parameter γ _i by the exponent of the inverse RK _i ⁻¹ of the bidder registration key RK _i received as the exponent is the received bidder ID key parameter. a bidder registration unit comprising: a bidder registration unit for registering a bidder registration key RK _i received from the bidder terminal and a bidder ID key parameter γ _i in a bidder registration table when equal to γ _i. system. A plurality of bidder terminals for n bidders _Bi (1 ≦ i ≦ n) to participate in a bid, a registration management device for registering the bidder B _i, and for executing the bid A bid system in which a bid management apparatus is connected via a network,
The bidder registration system according to claim 7, wherein the bidder B _i (1 ≦ i ≦ n) is registered in the registration management device,
The collision hard hash function h is preset,
The registration management device further includes:
A request transmitting unit that transmits a request for a j-th (1 ≦ j) bid to all registered bidders via a bidder terminal;
The bidder terminal further includes:
When the request is received from the registration management device, an integer k _{i, j} is randomly selected from the multiplicative group Z _q ^* for the bidder B _i and the first hash value h ( k _{i, j} ) and securely transmits the first hash value h (k _{i, j} ) and the bidder registration key RK _i to the registration management device. A bid key generation requesting unit that requests generation of bid keys Y _{i, j} of B _i ;
The registration management device further includes:
The first hash value h (k _{i, j} ) and the bidder registration key RK _i are securely received from the bidder terminal, and the received first hash value h (k _{i, j} ) is received as an exponent. by power bidders registration key RK _i, provided with a tender key generating unit for generating a bid key Y _{i, j} in the j-th bid session bidder B _i,
The bid management device further includes:
Based on all the bid keys Y _{i, j} in the j-th bid session generated by the bid key generation unit, the bid certificate C _{i, j} of the j-th bid session is obtained for each bid key Y _{i, j.} A bid certificate generation unit to generate,
By calculating the power of the element g using an integer r _j randomly selected from the multiplicative group Z _q ^* as a power index, the j th bid public parameter δ _j is generated,
By using the bid management secret key SK _BM as a power index and calculating the power of the bid key Y _{i, j} , a secret parameter S _{i, j} of the j-th bid is generated for each bid key Y _{i, j} ,
By calculating the power of the bid key Y _{i, j using} the product of the parameter r _j of the jth bid and the secret parameter S _{i, j} of the _jth bid as a power index, the bid proof is obtained for each bid key Y _{i, j.} A bid certificate generating unit for generating a document C _{i, j} ,
The bidder terminal further includes:
A bid system including a bid generation unit that transmits bid information of a bidder B _i including a bid certificate C _{i, j} and an encrypted bid amount bid _{i, j} to a bid management apparatus. The bid generation unit further includes:
Generating the data C ₃ obtained by encrypting the bid amount bid _{i, j} with the bid management public key PK _BM ;
An integer t _i selected at random from the multiplicative group Z _q ^* is determined _, and the product s of the bidder secret key SK _i , the first hash value h (k _{i, j} ) and the secret parameter S _{i, j} of the j th bid _i = (SK _i · h (k _{i, j} ) · S _{i, j} ) as a signature key, the sign key s _i as a power index, and a value obtained by raising the j-th bid public parameter δ _j to a power as a verification key, An electronic signature {α _{i, j} , β _{i, j} } by a Schnorr signature scheme is generated for the data C ₃ obtained by encrypting the bid amount bid _{i, j} ,
Bid certificate _{C i,} and _j, the bid amount _{bid i,} and data _{C 3} obtained by encrypting _j, tender bidder _{B i} comprising an electronic signature by signature method Schnorr _{{α i, j, β i} , j} The bidding system according to claim 8, wherein information {C _{i, j} , C ₃ , α _{i, j} , β _{i, j} } is transmitted to the bid management apparatus. The integer k _{i, j} randomly selects an integer k _i from the multiplicative group Z _q ^*, which is a power value of the integer k _i as an index to the j, bidding system of claim 8 or claim 9 . The registration management device further includes:
Registration is performed by calculating a power of the element g using a randomly selected integer as a registration management secret key SK _RM from the multiplicative group Z _q ^* modulo the prime number q, and using the registration management secret key SK _RM as a power exponent. A registration management private key / public key generation unit for generating a management public key PK _RM ;
Secure transmission of data from the bidder terminal to the registration management device includes:
The data to be transmitted is securely transmitted by transmitting the encrypted data obtained by encrypting the data using the registration management public key PK _RM to the registration management device.
Secure reception of data from the bidder terminal of the registration management device,
Wherein the encrypted data received from the bidders terminal by decoding by the registration management secret key SK _RM, receives a secure, according to claim 7 or claim 8 system.

Images