JP4194745B2 - Electronic signature system and electronic signature method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a key information distribution terminal, an IC card, and a store terminal that can improve the confidentiality of a secret key for generating an electronic signature.
[0002]
[Prior art]
In recent years, instead of a seal, a signature private key is written on a recording medium (hereinafter referred to as an IC card) equipped with an IC chip, and the user carries the IC card at the time of purchasing or contracting a product at a store or the like. Using this secret key, an electronic signature is generated to establish a contract. If the IC card is lost or stolen, there is a risk that it is illegally used by a malicious third party. In order to prevent this danger, there has been the following method.
(1) How to set a PIN (personal identification number) on an IC card
When a PIN, which is a password or a 4-digit password, is set in the IC card and this PIN is entered, the signature can be performed with the secret key set in the IC card.
(2) A method using a CRL (key revocation list).
The secret key set in the IC card has a certificate for proving the identity of the user who uses the secret key, and this certificate is managed by a certification authority. When the IC card user loses the IC card, the IC card user contacts this certification body and reports that the private key is invalidated. As a result, the secret key becomes invalid, and unauthorized use of the IC card can be prevented.
[0003]
[Problems to be solved by the invention]
However, the conventional method described above has the following problems. That is, in the method (1), if the physical security of the IC card is broken, the secret key may be read out and used illegally. Furthermore, since it is necessary to input a PIN every time the IC card is used, it takes time for the card user and the card handling store.
On the other hand, in the method (2), since the card user notices the loss of the card and then performs a procedure for invalidating the secret key of the IC card, the user after the card is actually lost. Between the time when the card is lost and the time when the procedure for revoking the private key is completed, there is a possibility that it will be misused by a malicious third party.
Furthermore, in the method (2), if the private key is invalidated by the notification of the user, it is necessary to newly perform a procedure for using the private key to the certification authority in order to use the IC card. This procedure was complicated for the card user.
[0004]
The present invention has been made in view of such circumstances, and an object of the present invention is to provide a key information distribution terminal and an IC card capable of improving the confidentiality of key information even if a secret key is lost or stolen. And providing a store terminal.
[0006]
[Means for Solving the Problems]
  To achieve the above objective,The present inventionAn electronic signature system comprising a key information distribution device, an arithmetic device, and a signature verification device, wherein the key information distribution device isWhen the key information for generating an electronic signature is divided into n pieces (n is a natural number of 2 or more) and k pieces of the divided key information (k is a natural number satisfying 1 <k ≦ n) are collected. A first distribution unit that generates first partial key information generated by the first distribution unit and at least one first key information among the first partial key information generated by the first distribution unit (M is a natural number equal to or greater than 2), and when the divided pieces of key information are collected j (1 <j ≦ m), second partial key information is generated in which the first partial key information is generated. Of the second partial key information generated by the second distribution means, the second partial key information generated by the second distribution means, and less than j second partial key information and the first part generated by the first distribution means Control for storing (k−1) pieces of first partial key information in the key information in the arithmetic unit that generates the electronic signature.and,Control of transmitting less than j pieces of partial key information among other second partial key information to the signature verification apparatus by communication meansTheControl means to perform;The arithmetic device received from the key information distribution deviceFirst partial key informationTheFirst storage means for storing;Received from the key information distribution deviceSecond partial key informationTheA second storage means for storing; a third storage means for storing a message which is information relating to the content of the electronic signature to be transmitted from the signature verification apparatus; and a second storage means stored in the second storage means. Information for generating second partial signature information by combining with the first partial signature information of the signature verification device based on the partial key information of 2 and the message stored in the third storage means; Generate partial signature informationFirstTo perform a signature with the electronic signature based on the partial signature generation means, the second partial signature information transmitted from the signature verification device, and the first partial key information stored in the first storage means Signature information generating means for generating an electronic signature ofThe abovesignatureinformationAn electronic signature generated by the generation unit is transmitted to the signature verification device.Electronic signature transmission means, and the signature verification apparatusSecond partial key informationTheRemember first4Storage means, MSG generation means for generating a message as information on the content of the document to be digitally signed, and a message for storing a message generated by the MSG generation means5Storage means, and4Second partial key information stored in the storage means and the first5The electronic signature when combined with the first partial key information stored in the arithmetic device by combining with the partial signature information transmitted from the arithmetic device based on the message stored in the storage means Is generatedThe secondGenerate partial signature informationSecondPartial signature generation means;An electronic signature system comprising:
[0007]
The present invention also provides:An electronic signature system comprising a key information distribution device, an arithmetic device, and a signature verification device, wherein the key information distribution device includes n pieces of key information (n is 2 or more) for generating an electronic signature. A distribution unit for generating partial key information for generating the electronic signature when k pieces of divided key information (k is a natural number satisfying 1 <k ≦ n) are collected, and a predetermined program Control for storing less than k pieces of partial key information among the partial key information generated by the distribution unit and less than k pieces of other partial key information for the arithmetic device that generates an electronic signature based on Control means for performing control to transmit the partial key information to the signature verification apparatus by the communication means, and the arithmetic device stores first partial means for storing the partial key information received from the key information distribution apparatus, From the signature verification device, the communication A second storage unit that stores a message that is information about the content of the electronic signature sent via the unit, a partial key information stored in the first storage unit, and a second storage unit First partial signature generation means for generating first partial signature information that becomes information for generating the electronic signature by combining with the partial signature information of the signature verification device based on the stored message; And a partial signature information transmitting means for transmitting the partial signature information generated by the first partial signature generating means to the signature verification apparatus, wherein the signature verification apparatus stores the partial key information. Storage means, MSG generation means for generating a message as information on the contents of the document to be digitally signed, and a message for storing the message generated by the MSG generation means And the partial key information stored in the third storage unit and the message stored in the fourth storage unit are combined with the partial signature information transmitted from the arithmetic unit. Second partial signature generation means for generating second partial signature information as information for generating the electronic signature, first partial signature information and second partial signature generation means transmitted from the arithmetic device Signature generating means for generating the electronic signature based on the second partial signature information generated by the key information distribution device, wherein the key information distribution device receives a unique code input; A random number generating means for generating a random number; a random number transmitting means for storing the random number in the arithmetic unit; and the key information obtained by dividing the distributing means by using the random number, the unique code, and a hash function. First partial key information generating means for generating the partial key information using the arithmetic unit, the arithmetic unit using the unique code received from the signature verification apparatus, the random number, and the other hash value using the hash function. Second partial key information generating means for generating the partial key information of the first signature code, wherein the signature verification device stores the unique code in the second unique code acceptance means for accepting the input of the unique code. An electronic signature system comprising a unique code storage means.
[0008]
The present invention also provides:The electronic signature system described above has a joint center terminal for storing the partial key information, and the signature verification apparatus receives the partial key information via the joint center terminal..
[0010]
  The present invention also provides:An electronic signature method in an electronic signature system comprising a key information distribution device, an arithmetic device, and a signature verification device, wherein the first distribution means of the key information distribution device generates a digital signature A first part in which the electronic signature is generated when information is divided into n pieces (n is a natural number of 2 or more) and k pieces of divided key information are collected (k is a natural number satisfying 1 <k ≦ n). The key information is generated, and the second distribution unit of the key information distribution apparatus further generates at least one first key information among the first partial key information generated by the first distribution unit (m ( m is a natural number of 2 or more), and when the divided key information is collected j (1 <j ≦ m), the second partial key information is generated, and the first partial key information is generated, Second partial key information generated by the second distribution means by the control means of the key information distribution apparatus Of these, less than j second partial key information and (k−1) first partial key information out of the first partial key information generated by the first distribution means generate an electronic signature. Control for storing in the apparatus and control for transmitting less than j pieces of partial key information to the signature verification apparatus by the communication means among other second partial key information, and the first storage means of the arithmetic device comprises: Storing the first partial key information received from the key information distribution device, wherein the second storage means of the arithmetic device stores the second partial key information received from the key information distribution device; A third storage unit of the arithmetic device stores a message that is information about the content of the document to be digitally transmitted from the signature verification device, and the first partial signature generation unit of the arithmetic device is the second Second partial key information stored in the storage means Based on the message stored in the third storage means, the partial signature information that is the information for generating the second partial signature information is generated by combining with the first partial signature information of the signature verification device And the signature information generation means of the arithmetic device is configured to generate the electronic information based on the second partial signature information transmitted from the signature verification apparatus and the first partial key information stored in the first storage means. An electronic signature for performing a signature is generated by a signature, and an electronic signature transmission unit of the arithmetic device transmits an electronic signature generated by the signature information generation unit to the signature verification device, and a fourth of the signature verification device The storage means stores the second partial key information, and the MSG generation means of the signature verification apparatus generates a message that is information relating to the content of the document to be digitally signed. Storage means stores the message generated by the MSG generation means, and the second partial signature generation means of the signature verification apparatus includes the second partial key information stored in the fourth storage means and the second partial key information Based on the message stored in the fifth storage means, when combined with the first partial key information stored in the arithmetic device by combining with the partial signature information transmitted from the arithmetic device, The electronic signature method is characterized in that the second partial signature information for generating an electronic signature is generated.
[0011]
  The present invention also provides:An electronic signature method in an electronic signature system comprising a key information distribution device, an arithmetic device, and a signature verification device, wherein the distribution means of the key information distribution device converts key information for generating an electronic signature into n When the divided key information is collected into k pieces (k is a natural number satisfying 1 <k ≦ n), partial key information for generating the electronic signature is generated. The control unit of the key information distribution device stores less than k pieces of partial key information among the partial key information generated by the distribution unit for the arithmetic unit that generates an electronic signature based on a predetermined program. Control, and control for transmitting less than k pieces of partial key information among other pieces of partial key information to the signature verification apparatus by the communication means, and the first storage means of the arithmetic device receives from the key information distribution apparatus Stored partial key information The second storage means of the arithmetic device stores a message that is information relating to the content of the electronic signature to be transmitted from the signature verification device via the communication means, and the first part of the arithmetic device The signature generation means combines the partial signature information of the signature verification apparatus with the partial signature information based on the partial key information stored in the first storage means and the message stored in the second storage means. First partial signature information that is information for generating an electronic signature is generated, and a partial signature information transmission unit of the arithmetic device converts the partial signature information generated by the first partial signature generation unit into the signature verification device. And the third storage means of the signature verification apparatus stores the partial key information, and the MSG generation means of the signature verification apparatus becomes information relating to the contents of the document to be digitally signed. A message is generated, the fourth storage means of the signature verification apparatus stores the message generated by the MSG generation means, and the second partial signature generation means of the signature verification apparatus is the third storage means The electronic signature is generated by combining with the partial signature information transmitted from the arithmetic unit based on the partial key information stored in the fourth storage means and the message stored in the fourth storage means. Second partial signature information, and the signature generation means of the signature verification device generates the first partial signature information transmitted from the arithmetic device and the second partial signature generated by the second partial signature generation means. The electronic signature is generated based on the signature information, and the first unique code receiving means of the key information distribution device receives the input of the unique code, and the random number generation of the key information distribution device Means generates a random number, a random number transmission means of the key information distribution apparatus stores the random number in the arithmetic unit, and a first partial key information generation means of the key information distribution apparatus divides the distribution means The partial key information is generated using the random number, the unique code, and a hash function as key information, and the second unique code receiving means of the signature verification device receives the input of the unique code, and the signature verification device unique Code storage means stores the unique code in the arithmetic device, and the second partial key information generation means of the arithmetic device uses the unique code received from the signature verification device, the random number, and the hash function. And generating the other partial key information.
[0012]
  The present invention also provides:In the above-described electronic signature method, the digital signature method has a joint center terminal for storing the partial key information, and the signature verification apparatus receives the partial key information via the joint center terminal.
[0014]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, a key information distribution terminal, an IC card, and a store terminal according to an embodiment of the present invention will be described with reference to the drawings. Here, a case where a user who owns an IC card goes to a store and makes a transaction contract using an electronic signature will be described as an example. FIG. 1 is a schematic block diagram showing a configuration of an electronic signature system according to an embodiment of the present invention. In this figure, the electronic signature system includes a user terminal 100, a certification authority terminal 200, a store terminal 300, a network 400, and an IC card 500.
[0015]
In the user terminal 100, a storage unit 110, an input unit 120, a distribution unit 140, and a communication unit 150 are connected by a bus 160, and various data are controlled by the control unit 130 between each unit of the apparatus via the bus 160. Are sent and received based on The user terminal 100 is provided at the user's home, for example.
[0016]
The control unit 130 controls the distribution unit 140 to distribute the secret key SK to n + 1 with a predetermined threshold k, and transfers data of each unit via the bus 160. Here, the distribution of the secret key SK will be described. The distribution of the secret key SK is performed by secret sharing. In this secret share, as shown in FIG. 2, the secret key SK is distributed to n partial secret keys SK1 to SKn with a threshold value k. Then, partial signatures S1 to Sn are generated based on the distributed partial secret keys SK1 to SKn and the message. The signature S is generated when k of the partial signatures Sn to Sn are collected.
[0017]
  Next, returning to FIG. 1, the distribution unit 140 generates (n + 1) partial secret keys with a threshold value k (= 2) in which the secret key SK is set based on an instruction from the control unit 130. The partial secret key generated by the distribution unit 140 is output as one partial secret key SKa and n partial secret keys SKb1 to SKbn. The storage unit 110 stores the public key certificate of the certification authority.bookThe information of the public key PK and the secret key SK that have been certified in the above is stored. In addition, the storage unit 110 stores the partial secret key SKa and the partial secret keys SKb1 to SKbn generated by the distribution unit 140. The storage unit 110 stores various data.
[0018]
The communication unit 150 communicates with the certification authority terminal 200 and the store terminal 300 via the network 400. The input unit 120 outputs a signal corresponding to an input from a user who uses the user terminal 100.
Further, an input / output device (hereinafter referred to as “R / W”) 170 that transmits and receives data between the IC card 500 and the bus 160 is connected to the outside of the user terminal 100.
[0019]
The certification authority terminal 200 includes a storage unit 210 and a communication unit 220. The storage unit 210 stores a public key PK owned by the user of the user terminal 100. The communication unit 220 communicates with the user terminal 100 or the store terminal 300 via the network 400, and transmits and receives the user's public key PK as necessary. This certification authority terminal 200 is provided, for example, in a certification authority that stores public keys.
[0020]
The store terminal 300 includes an input unit 310, a storage unit 320, an MSG generation unit 330, a partial signature generation unit 340, a signature generation unit 350, a signature verification unit 360, a communication unit 370, and a bus 380. Is done. Each part of the store terminal 300 is connected by a bus 380, and data transmission / reception is controlled by the control part. The store terminal 300 is provided, for example, in a store i such as a merchandise store or a financial institution (where 1 ≦ i ≦ n, where n is the number of store terminals 300 to be used).
[0021]
  The input unit 310 outputs a signal corresponding to an instruction input from the user. The storage unit 320 stores a public key PK and a partial secret key SKbi. The storage unit 320 stores various data. The MSG generation unit 330 generates a message (hereinafter referred to as “Msg”) that is a contract for making a contract with a user who is a contractor. The partial signature generation unit 340 generates a partial secret key SKbiAnd partial signature SK based on MsgiIs generated. The signature generation unit 350 generates partial signatures Sa to S.bA signature S that is an electronic signature for establishing a contract is generated when k pieces of n are collected.
[0022]
The signature verification unit 360 verifies whether the signature S can be guaranteed based on the signature S generated by the signature generation unit 340 and the public key PK. The communication unit 370 communicates with the user terminal 100 or the certification authority terminal 200 via the network 400. Further, an R / W 390 that transmits and receives data between the bus 380 and the IC card 500 is connected to the outside of the store terminal 300.
[0023]
Next, the operation of the electronic signature system of FIG. 1 will be described using the flowchart of FIG. First, a user generates a public key PK and a secret key SK using the user terminal 100, transmits the public key PK to the certification authority terminal 200 via the network 400, registers it, and stores the secret key SK in the storage unit 110. To remember.
On the other hand, the store clerk of the store i reads the user's public key PK from the authentication institution 200 via the network 400 by the store terminal 300 and stores it in the storage unit 320 (step S1).
Next, the user inputs an instruction for dividing the secret key SK from the input unit 120. When the input unit 120 instructs to divide the secret key SK, the control unit 130 reads out the secret key SK from the storage unit 110 and outputs the secret key SK to the distribution unit 140 and divides the secret key SK into (n + 1) values with a threshold value 2. An instruction is given (step S2).
[0024]
Upon receiving the division instruction, the distribution unit 140 divides the secret key SK output from the storage unit 110 into (n + 1) pieces with a threshold value of 2, and the divided result is a partial secret key SKa and partial secret keys SKb1 to SKbn. Is stored in the storage unit 110 (step S3).
After the partial secret key SKa and the partial secret keys SKb1 to SKbn are stored in the storage unit 110, when the IC card 500 is inserted into the R / W 170 by the user, the control unit 130 stores the part stored in the storage unit 110. The secret key SKa is read and output to the R / W 170 via the bus 160. The R / W 170 outputs the partial secret key SKa output from the user terminal 100 to the IC card 500. When receiving the partial secret key SKa from the R / W 170 via the communication unit 510, the IC card 500 stores the partial secret key SKa in the storage unit 530 (step S4).
[0025]
  Next, the user is a store that uses an IC card, and the user himself / herself enters the partial secret key SKb.iIs selected from the input unit 120, and an instruction to transmit the partial secret key SKbi to the store terminal 300 of the selected store i is input. When an instruction to transmit the partial secret key SKbi is input from the input unit 120 to the store terminal 300, the control unit 130 sends the partial secret key to the communication unit 370 of the store terminal 300 via the bus 160, the communication unit 150, and the network 400. SKbi is transmitted (step S5). When the partial secret key SKbi is received from the user terminal 100 by the communication unit 370, the received partial secret key SKbi is stored in the storage unit 320 and registered in the user list (step S6).
[0026]
Next, when making a transaction contract, the user carries the IC card 500 and goes to the store i where the store terminal 300 is installed. Then, the user requests the employee of the store terminal 300 to create a contract for making a transaction contract. The employee inputs information necessary for making a contract from the input unit 310 and instructs generation of Msg. The MSG generation unit 330 generates Msg based on the information input from the input unit 310 (step S8), and stores the generated Msg in the storage unit 320.
[0027]
Next, after the user and the employee negotiate about the transaction, when the user makes a contract for the transaction, the user inserts the IC card 500 into the R / W 390 of the store terminal 300. After the IC card 500 is inserted into the R / W 390, when an employee instructs the Msg transfer from the input unit 310, the storage unit 320 outputs the stored Msg to the R / W 390. The R / W 390 transfers the Msg output from the store terminal 300 to the communication unit 510 of the IC card 500 in which it is inserted (step S9). The communication unit 510 outputs the Msg transferred from the R / W 390 to the storage unit 530. The storage unit 530 stores Msg output from the communication unit 510.
[0028]
Next, when Msg is stored in the storage unit 530, the partial signature generation unit 520 reads the stored Msg and the partial secret key SKa, and based on the read Msg and the partial secret key SKa, the partial signature Sa Is generated (step S10). Then, the partial signature generation unit 520 outputs the partial signature generation unit Sa generated in the store terminal 300 to the communication unit 510. The communication unit 510 transfers the partial signature generation unit Sa output from the partial signature generation unit 520 to the store terminal 300 via the R / W 390 (step S11). When the partial signature generation unit Sa is transmitted, the storage unit 320 of the store terminal 300 stores the partial signature generation unit Sa transferred from the IC card 500 (step S12).
[0029]
  On the other hand, when the transfer of the Msg to the IC card is completed, the partial signature generation unit 340 of the store terminal 300 reads the Msg stored in the storage unit 320 and the partial secret key SKbi of the user, and the partial signature in the store i. Sbi is generated (step S13). When the partial signature Sbi is generated, the signature generation unit 350 is stored in the storage unit 320.Partial signatureSa is read and thisPartial signatureBased on Sa and the partial signature Sbi generated by the partial signature generation unit 340, a signature S is generated (step S14). When the signature S is generated, the signature verification unit 360 reads the user's public key PK from the storage unit 320, and verifies the generated signature S (step S15).
[0030]
  In the above embodiment, the partial secret key SKbi is transmitted from the partial secret keys SKb1 to SKbn to the store terminal 300 in accordance with an instruction from the user input from the input unit 120 of the user terminal 100. The user himself / herself can select and transmit a store that can trust the management of the partial secret key SKbn. As a result, since the IC card 500 cannot be used in a store that does not have any of the partial secret keys SKb1 to SKbn, the usage range of the IC card 500 can be limited. Information of partial secret key SKa stolenMaretaIn such a case, there is an effect that the possibility that the partial secret key SKa is misused by a third party can be reduced.
[0031]
Next, a second embodiment of the present invention will be described with reference to the drawings.
FIG. 4 is a schematic block diagram showing the configuration of the electronic signature system in the second embodiment. In the figure, portions corresponding to the respective portions in FIG. The distribution unit 141 of the user terminal 100 divides the secret key SK into a partial secret key SKa and a partial secret key SKb. Further, the distribution unit 141 generates (n + 1) partial secret keys with a threshold value k (= 2) based on an instruction from the control unit 130 based on the partial secret key SKb. The partial secret key generated by the distribution unit 141 is output as one partial secret key SKb0 and n partial secret keys SKb1 to SKbn.
[0032]
The signature generation unit 351 of the store terminal 300 generates a partial signature Sb based on the partial signature Sbi and the partial signature Sb0 and instructs the IC card 500 to transmit the generated partial signature Sb. The signature generation unit 540 of the IC card 500 generates a signature S based on the partial signature Sb and the partial secret key SKa.
[0033]
Next, the operation of each part of the apparatus in the configuration of FIG.
First, as in the process of step S1 of FIG. 1, the public key PK is registered in the certification authority terminal 200 by the user terminal 100, the secret key SK is stored in the storage unit 110, and the authentication authority The public key PK of the user is read from 200 and stored in the storage unit 320 (step S51).
[0034]
Next, the user inputs an instruction for dividing the secret key SK from the input unit 120. When the input unit 120 instructs to divide the secret key SK, the control unit 130 reads out the secret key SK from the storage unit 110 and outputs the secret key SK to the distribution unit 141 and divides the secret key SK into (n + 1) values with a threshold value 2. Give instructions.
[0035]
When receiving the division instruction, the distribution unit 141 first divides the secret key SK output from the storage unit 110 into the partial secret key SKa and the partial secret key SKb (step S52), and the partial secret key SKa is stored in the storage unit. 110. Next, based on an instruction from the control unit 130, the distribution unit 141 divides the partial secret key SKb into (n + 1) pieces with a threshold value 2 (step S53), and stores the division result as partial secret keys SKb0 to SKbn. 110.
After the partial secret key SKa and the partial secret keys SKb0 to SKbn are stored in the storage unit 110, when the IC card 500 is inserted into the R / W 170 by the user, the control unit 130 stores the part stored in the storage unit 110. The secret key SKa and the partial secret key SKb0 are read and output to the IC card 500 via the bus 160 and the R / W 170. When receiving the partial secret key SKa and the partial secret key SKb0 from the R / W 170 via the communication unit 510, the IC card 500 stores them in the storage unit 530 (step S54).
[0036]
Next, the user selects a store i in which the IC card is used and the user himself can trust the management of the partial secret key SKbn. The partial secret key SKbi is stored in the store terminal 300 of the selected store i. An instruction to transmit is input from the input unit 120. When an instruction to transmit the partial secret key SKbi is input from the input unit 120 to the store terminal 300, the control unit 130 sends the partial secret key to the communication unit 370 of the store terminal 300 via the bus 160, the communication unit 150, and the network 400. SKbi is transmitted (step S55). When the partial secret key SKbi is received from the user terminal 100 by the communication unit 370, the received partial secret key SKbi is stored in the storage unit 320 and registered in the user list (step S56).
[0037]
Next, as in the first embodiment, the user carries the IC card 500, goes to the store i where the store terminal 300 is installed, and requests the creation of a contract. The employee generates Msg to be signed by the store terminal 300 (step S56), and stores the generated Msg in the storage unit 320.
[0038]
Next, after the negotiation about the transaction between the user and the employee, when the user makes a contract for the transaction, the IC card 500 is inserted into the R / W 390 by the user and then input by the employee. When the transfer of Msg is instructed from the unit 310, the storage unit 320 outputs the stored Msg to the R / W 390. The R / W 390 transfers the Msg output from the store terminal 300 to the communication unit 510 of the IC card 500 in which it is inserted (step S59). The communication unit 510 outputs the Msg transferred from the R / W 390 to the storage unit 530. The storage unit 530 stores Msg output from the communication unit 510.
[0039]
  Next, when Msg is stored in the storage unit 530, the partial signature generation unit 520 reads the Msg and the partial secret key SKb0 stored from the storage unit 530, and based on the read Msg and the partial secret key SKb0. The partial signature Sb0 is generated (step S60). Then, the partial signature generation unit 520 generatesPartial signatureSb0 is output to the communication unit 510. The communication unit 510 receives the partial signature output from the partial signature generation unit 520.Sb0Is transferred to the store terminal 300 via the R / W 390 (step S61). Partial signatureSb0Is transmitted, the storage unit 320 of the store terminal 300 is transferred from the IC card 500.Partial signatureSb0 is stored (step S62).
[0040]
  On the other hand, after the Msg transfer to the IC card is completed, the partial signature generation unit 340 of the store terminal 300 reads the Msg stored in the storage unit 320 and the partial secret key SKbi of the user, A signature Sbi is generated (step S63). When the partial signature Sbi is generated, the signature generation unit 351 is stored in the storage unit 320.Partial signatureRead Sb0Partial signatureA partial signature Sb is generated based on Sb0 and the partial signature Sbi generated by the partial signature generation unit 340 (step S64), and an instruction to transmit the generated partial signature Sb to the IC card 500 is given to the R / W 390. Do.
[0041]
The R / W 390 receives the instruction from the signature generation unit 351 and transfers the partial signature Sb to the IC card 500 (step S65). When the partial signature Sb is transferred, the communication unit 510 of the IC card 500 outputs the transferred partial signature Sb to the storage unit 530 and stores it. When the partial signature Sb is stored in the storage unit 530, the signature generation unit 540 reads the partial signature Sb and the private key SKa stored in the storage unit 530, and generates a signature S (step S66). Then, after generating the generated signature S in the storage unit 530, the signature generation unit 540 instructs the communication unit 510 to transmit it to the store terminal 300. In response to the instruction from the signature generation unit 540, the communication unit 510 transmits the signature S to the store terminal 300 via the R / W 390 (step S67).
[0042]
The storage unit 320 of the store terminal 300 stores the signature S transmitted from the IC card 500 via the R / W 390 (step S68). After the signature S is stored, the signature verification unit 360 reads the signature S and the user's public key PK from the storage unit 320, and verifies the signature S using the public key PK (step S69).
[0043]
In the above embodiment, after the secret key SK is divided into the partial secret key SKa and the partial secret key SKb, the partial secret key SKb is further divided into the partial secret key SKb0 to the partial secret key SKbn, and the partial secret key SKa. And the partial secret key SKb0 are stored in the IC card 500, and the partial secret key SKb1 to the partial secret key SKbn are respectively transmitted to the store. As a result, even when the stores collide and collect two partial secret keys SKbn, only the partial secret key SKb can be generated, that is, it is impossible to generate the secret key SK. It is possible to prevent unauthorized use.
In the above embodiment, the secret key SK is divided into the partial secret key SKa and the partial secret key SKb. However, the secret key SK is divided into m pieces (m is a natural number of 2 or more), and the divided key information is The first partial key information may be generated when j (1 <j ≦ m) are collected.
[0044]
Next, a third embodiment of the present invention will be described with reference to the drawings.
FIG. 6 is a schematic block diagram showing the configuration of the electronic signature system in the third embodiment. In this figure, parts corresponding to those in FIG. 1 are denoted by the same reference numerals, and description thereof is omitted.
The control unit 131 of the user terminal 100 has a function of instructing the random number generation unit 180 to generate a random number in addition to the function of the control unit 130 of FIG. 1, and controls the operation of each unit of the user terminal 100. The random number generation unit 180 generates a random number based on an instruction from the control unit 130.
[0045]
The partial secret key calculation unit 190 calculates the partial secret key SKbi based on the partial secret key SKb, the random number R, and f (i) using the following equation (1).
SKb + H (f (i) ‖R) (1)
However, H (f (i) ‖R) is calculated by a hash function. f (i) is a unique code, and a different value is set for each store terminal 300 installed in the store. The unique code f (i) is a value arbitrarily determined by the user, for example, and is determined based on, for example, information on the user, information such as the name of the store i to use, a telephone number, and an address. Is done.
[0046]
The partial secret key calculation unit 550 of the IC card 500 calculates the partial secret key SKai based on the partial secret key SKa, the random number R, and the unique code f (i) using the following equation (2).
SKa-H (f (i) ‖R) (2)
[0047]
The partial signature generation unit 520 generates a partial signature Sa using the following expression (3) based on Msg and the partial secret key SKai.
Sa = MSG^SKaimod (n) (3)
The partial signature generation unit 340 generates the partial signature Sb using the following equation (4) based on Msg and the partial secret key SKbi.
Sb = MSG^SKbimod (n) (4)
[0048]
Based on the partial signature Sa and the partial signature Sb, the signature generation unit 350 generates a signature S using the following equation (5).
S = Sai × Sbi × mod (n) (5)
[0049]
Next, the operation of the apparatus in the configuration of FIG. 6 will be described using the flowcharts of FIGS. FIG. 7 is a flowchart for explaining the operation of the apparatus in the configuration of FIG. 6, and FIG. 8 is a flowchart for explaining the operation for setting the partial secret key SKa and the partial secret key SKbi in the IC card 500 and the store terminal 300. .
[0050]
First, the operation of the apparatus in the configuration of FIG. 6 will be described using the flowchart of FIG. The public key PK is registered in the certification authority terminal 200 by the user terminal 100, the secret key SK is stored in the storage unit 110, and the public key PK of the user is read from the certification authority 200 by the store terminal 300, It is stored in the storage unit 320.
[0051]
Next, the user inputs a unique code f (i) and an instruction for dividing the secret key SK from the input unit 120. When the input unit 120 instructs to divide the secret key SK, the control unit 131 stores the unique code f (i) in the storage unit 110, divides the secret key SK, and uses the divided partial secret key as an IC card. 500 and the control which sets to the shop terminal 300 are performed (step S101). Here, the operation of the apparatus in step S101 will be described with reference to the flowchart of FIG.
[0052]
First, the control unit 131 instructs the random number generation unit 180 to generate a random number. The random number generation unit 180 generates a random number R based on an instruction from the control unit 131 (step S201), outputs the generated random number R to the storage unit 110, and stores it in the storage unit 110 (step S202). Next, the control unit 131 instructs the distribution unit 140 to divide the secret key SK. The distribution unit 140 divides the secret key SK into two based on an instruction from the control unit 131 (step S203), and stores the secret key SK as the partial secret key SKa and the partial secret key SKb in the storage unit 110 (step S204).
[0053]
After the partial secret key SKa is stored in the storage unit 110, when the IC card 500 is inserted into the R / W 170 by the user, the control unit 131 reads the partial secret key SKa and the random number R from the storage unit 110, and the bus Control to transfer to the IC card 500 via the 160 and the R / W 170 is performed. When receiving the partial secret key SKa and the random number R output from the R / W, the communication unit 510 of the IC card 500 stores the received partial secret key SKa and the random number R in the storage unit 530 (step S205).
[0054]
  Furthermore, the control unit 131 reads the partial secret key SKb, the random number R, and the unique code f (i) from the storage unit 110,secretWhile outputting to the key calculating part 190, the instruction | indication which produces | generates the partial secret key SKbi is given. portionsecretThe key calculation unit 190 generates a partial secret key SKbi based on the equation (1), the partial secret key SKb, the random number R, and the unique code f (i) (step S205), and the generated partial secret key SKbi is transmitted to the communication unit. The instruction to output to 150 and to the store terminal 300 is sent. Communication unit 150 is partsecretBased on the instruction from the key calculation unit 190, the information is transmitted to the store terminal 300 via the network 400 (step S206). The communication unit 370 of the store terminal 300 receives the partial secret key SKbi received from the user terminal 100 via the network 400 (step S207) and outputs it to the storage unit 320. The storage unit 320 stores the partial secret key SKbi output from the communication unit 370 (step S208).
[0055]
  Next, returning to FIG. 7, the IC card 500 has a partial secret key SK.aIs stored (step S102) After the partial secret key SKbi is stored in the store terminal 300 (step S103), the user carries the IC card 500 and goes to the store i where the store terminal 300 is installed, and between the employees Negotiate transactions with When a user makes a transaction contract after negotiation between the user and the employee, after the IC card 500 is inserted into the R / W 390 by the user, the user is unique. The code f (i) is input from the input unit 310 of the store terminal 300 (step S103). The unique code f (i) input from the input unit 310 is output to the IC card 500 via the bus 380 and the R / W 390. Then, the unique code f (i) is received by the communication unit 510 input of the IC card 500 (step S104), and is output and stored in the storage unit 530.
[0056]
Next, when an employee of store i is instructed to generate Msg, the MSG generation unit 330 generates Msg to be signed (step S105), and the generated Msg is stored in the storage unit 320. It is transmitted to the IC card 500 via the R / W 390 (step S106). The communication unit 510 of the IC card 500 receives Msg (step S107), outputs Msg to the storage unit 530, and stores it. When Msg is stored in the storage unit 530, the partial secret key generation unit 550 generates the above formula (2) based on the partial secret key SKa, the unique code f (i), and the random number R stored in the storage unit 530. To generate a partial secret key SKai (step S108). Then, the partial secret key generation unit 550 stores the generated partial secret key SKai in the storage unit 530.
[0057]
When the partial secret key SKai is stored in the storage unit 530, the partial signature generation unit 520 uses the above equation (3) based on the partial secret key SKai and Msg stored in the storage unit 530 to generate the partial signature Sa. Is generated (step S109) and stored in the storage unit 530. When the partial signature Sa is stored in the storage unit 530, the communication unit 510 reads the partial signature Sa from the storage unit 530 and transmits it to the store terminal 300 via the R / W 390 (step S110).
[0058]
  On the other hand, the partial signature generation unit 340 of the store terminal 300 stores the partial secret key SKbi and Msg.320The partial signature Sb is generated using the above equation (4) (step S111), and the storage unit320To remember. Next, when the partial signature Sa is received from the IC card 500 via the R / W 390 (step S112), the storage unit 320 stores the partial signature Sa. When the partial signature Sa is stored in the storage unit 320, the signature generation unit 350 reads the partial signature Sa and the partial signature Sb stored in the storage unit 320, and generates the signature S using the above equation (5). (Step S113). When the signature S is generated, the signature S is stored in the storage unit 320, and then the signature verification unit 360 reads the signature S and the public key PK of the user, and the signature S is the public key. It is verified by PK (step S114).
[0059]
In the third embodiment described above, the unique code f (i) may be a value that only the user can know or may be a value that the store i can know. The unique code f (i) may be a value common to all stores i.
[0060]
Next, a fourth embodiment will be described. In this embodiment, the case where the unique code f (i) is set to Msg will be described with reference to the drawings.
FIG. 9 is a schematic block diagram showing the configuration of the electronic signature system in the fourth embodiment. In this figure, parts corresponding to those in FIG. 6 are given the same reference numerals, and explanation thereof is omitted.
In this embodiment, the use code IDi is set as the unique code f (i). This use destination code IDi is a value determined based on the unique information of the store i at the use destination, and for example, data of the name of the store i is used.
[0061]
Next, the partial secret key calculation unit 190 calculates the partial secret key SKbi using the above equation (1) based on the partial secret key SKb, the random number R, and f (i). In this embodiment, Since the unique code f (i) becomes the usage code IDi, the partial secret key SKbi is calculated based on the following (6).
SKb + H (IDi‖R) (6)
[0062]
The partial secret key calculation unit 550 of the IC card 500 calculates the partial secret key SKai using the above equation (2) based on the partial secret key SKa, the random number R, and the unique code f (i). In the embodiment, since the unique code f (i) becomes the use destination code IDi, the partial secret key SKai is calculated based on the following (7).
SKa-H (IDi‖R) (7)
[0063]
In the function of the partial signature generation unit 520, the partial signature generation unit 521 further reads the use destination code IDi from the storage unit 530, adds the use destination code IDi to Msg, and generates the partial signature Sa. The partial signature generation unit 521 generates a partial signature Sa based on the following equation (8).
Sa = IDi / MSG^SKaimod (n) ...... (8)
In the function of the partial signature generation unit 340, the partial signature generation unit 341 further reads the use destination code IDi from the storage unit 320, adds the use destination code IDi to Msg, and generates the partial signature Sb. The partial signature generation unit 341 generates a partial signature Sb based on the following equation (9).
Sb = IDi · MSG^SKbimod (n) ...... (9)
In such a configuration, each part of the apparatus operates in the same manner as described with reference to FIGS. As described above, when the use code IDi is added to Msg, the partial signature Sa and the partial signature Sb are generated, and when the signature S is generated by the signature generation unit 350 based on the partial signature Sa and the partial signature Sb. As shown by reference numeral 600 in FIG. 10, information related to the usage code IDi is set in Msg (reference numeral 610). Thereby, the user can perform an electronic signature with respect to Msg which can be generated only at the store i where the partial secret key SKbi is transmitted. Therefore, the contractor name (symbol 620) in the contract with the electronic signature (symbol 630) set by a third party is altered to the contractor name when the user does not actually make a contract. In this case, the falsified contractor name and the contractor name (symbol 600) preset in Msg are different, so it is possible to detect falsification, and the signature S is stored in the partial secret key SKbi. It is possible to prevent diversion.
[0064]
In the third embodiment and the fourth embodiment described above, the unique code f (i) may be transmitted simultaneously when the partial secret key SKb is transmitted to the store terminal 300.
[0065]
Next, a fifth embodiment will be described with reference to the drawings. FIG. 11 is a schematic block diagram for explaining a configuration of an electronic signature system according to the fifth embodiment. In this embodiment, the case where the threshold value k is set to 3 and the partial secret key is set in the user terminal 100, the IC card 500, and the store terminal 300 will be described as an example. In FIG. 11, parts corresponding to those in FIG.
The partial signature generation unit 195 reads the usage code IDi from the storage unit 110, adds the usage code IDi to Msg, and generates a partial signature Sc. The partial signature generation unit 195 generates a partial signature Sc based on the following expression (10).
Sc = IDi · MSG^SKcimod (n) (10)
[0066]
Next, the operation of the apparatus in the configuration of FIG. 11 will be described using the drawings. FIG. 12 is a flowchart for explaining the operation of the apparatus in the configuration of FIG. First, as in the process of step S1 of FIG. 1, the public key PK is registered in the certification authority terminal 200 by the user terminal 100, the secret key SK is stored in the storage unit 110, and the authentication authority The user's public key PK is read from 200 and stored in the storage unit 320. Further, the usage code IDi set by the employee is stored in the storage unit 320.
Next, when the user is instructed by the input unit 120 to divide the secret key SK from the input unit 120, the control unit 130 reads out the secret key SK from the storage unit 110 and outputs it to the distribution unit 140. Instruction to divide into three at threshold value 3 is given. Furthermore, the control unit 131 instructs the random number generation unit 180 to generate a random number.
[0067]
The distribution unit 140 receives the instruction from the control unit 131, divides the secret key SK into three, and generates a partial secret key SKa, a partial secret key SKb, and a partial secret key SKc (step S301). Then, the distribution unit 140 stores the generated partial secret key SKa, partial secret key SKb, and partial secret key SKc in the storage unit 110 (step S302).
[0068]
On the other hand, the random number generation unit 180 generates a random number R based on an instruction from the control unit 131 and stores it in the storage unit 110. Next, the control unit 131 reads the partial secret key SKa and the random number R stored in the storage unit 110 and transmits them to the IC card 500 via the R / W 170 (step S303). The communication unit 510 of the IC card 500 receives the partial secret key SKa and the random number R transmitted from the user terminal 100, and stores them in the storage unit 530 (step S304).
[0069]
Next, the control unit 131 reads out the partial secret key SKb, the random number R, and IDi from the storage unit 110, outputs the partial secret key SKb, the random number R, and IDi to the partial secret key calculation unit 190, and instructs the generation of the partial secret key SKbi. The partial secret key calculation unit 190 generates a partial secret key SKbi based on an instruction from the control unit 131, stores it in the storage unit 110, and then transmits it to the store terminal 300 via the communication unit 150 and the network 400. (Step S305). Upon receiving the partial secret key SKbi, the communication unit 370 of the store terminal 300 stores it in the storage unit 320 (step S306).
[0070]
Next, the user carries the IC card 500 and sets the user terminal 100 in a communicable state via the network 400 and goes to the store i. When the user negotiates with the employee and makes a contract, the user requests the employee to generate Msg as a contract. The employee generates an Msg by the store terminal 300 and instructs the user terminal 100 to transmit the generated Msg and the usage code IDi.
[0071]
  The MSG generation unit 330 of the store terminal 300 is an input unit310Msg is generated in response to an instruction from the employee input from, and the generated Msg is stored in the storage unit 320 and transmitted to the user terminal 100 via the communication unit 370 and the network 400. At this time, the usage code IDi is read from the storage unit 320 in accordance with the transmission instruction of the usage code IDi input from the input unit 310, and transmitted to the user terminal 100 in the same manner as the Msg (step). S308).
[0072]
Next, when Msg and the usage code IDi are transmitted from the store terminal 300, the communication unit 150 receives the Msg and the usage code IDi and stores them in the storage unit 110 (step S309).
When Msg and the usage code IDi are stored in the storage unit 110, the partial signature generation unit 195 reads the Msg, the partial secret key SKc, and the usage code IDi from the storage unit 110, and based on these, the usage code IDi Is added to Msg to generate a partial signature Sc. The generated partial signature Sc is transmitted to the store terminal 300 via the network 400 by the communication unit 150 (step S311).
[0073]
In the store terminal 300, when receiving the partial signature Sc, the communication unit 370 stores the partial signature Sc in the storage unit 320 (step S312). When the user inserts the IC card 500 into the R / W 390, the Msg and the usage code IDi stored in the storage unit 320 are read and transmitted to the IC card 500 (step S313).
The communication unit 510 of the IC card 500 outputs the received Msg and the usage code IDi to the storage unit 530 for storage (step S314). When Msg and the usage code IDi are stored, the partial secret key generation unit 550 generates a partial secret key SKai based on the partial secret key SKa, the random number R, and the usage code IDi (step S315), and stores them. Store in the unit 530. When the partial secret key SKai is generated, the partial signature generation unit 521 generates the partial signature Sa using the partial secret key SKai by adding the usage code IDi to Msg (step S316), and the communication unit 510 and R / W390 is transmitted to the store terminal 300 (step S317) and stored in the storage unit 530.
[0074]
When the store terminal 300 receives the partial signature Sa (step S318), the received partial signature Sa is stored in the storage unit 320. After receiving the partial signature Sa, the partial signature generation unit 341 reads the partial secret key SKbi, the random number R, and the usage code IDi from the storage unit 320, and generates the partial signature Sb (step S319). When the partial signature Sb is generated, the signature generation unit 350 generates a signature S from the partial signatures Sa, Sb, and Sc (step S320), and stores the generated signature S in the storage unit 320. The signature verification unit 360 reads the user's public key PK from the storage unit 320 and verifies the signature S generated by the public key PK (step S321).
[0075]
In the fifth embodiment, the secret key SK, the partial secret key SKa, the partial secret key SKb, the partial secret key SKc, and the random number R are recorded on a recording medium other than the user terminal 100 and the IC card 500 and used for backup. It may be stored.
[0076]
In the above embodiment, the access history may be stored in the log every time the user terminal 100 is accessed. As a result, even if the user loses the IC card or the partial secret key of the IC card is copied and the finder or a malicious third party tries to illegally use the IC card, the user terminal 100 can be accessed. History is recorded. Therefore, the user who is the owner of the user IC card can grasp that the user IC card is illegally used, and by stopping the user terminal 100, it is possible to prevent subsequent illegal use. Further, by referring to the access history recorded in the user terminal 100, the user can grasp the situation of unauthorized use. Thus, by storing the partial secret key SKc also in the user terminal 100 at home, the user can detect unauthorized use of the partial secret key and grasp the situation of unauthorized use.
[0077]
In the above embodiment, the communication unit 110 in the user terminal 100 is provided with a function for communicating with a mobile phone carried by the user, and whenever the user terminal 100 is accessed, a call is made to the mobile phone or an e-mail is used. You may make it transmit to a person. Thereby, since the user can grasp the access status to the user terminal 100, it is possible to find an unexpected access earlier.
[0078]
In the above embodiment, the partial secret key is stored and accessed in the user terminal 100. However, a joint center terminal for storing the partial secret key of the user is provided, and the partial secret key is stored in the joint center terminal. It may be stored and accessed from the store terminal 300.
[0079]
In the above embodiment, a password may be set for the user terminal 100 so that the user terminal 100 cannot be accessed if the input passwords do not match when accessed from the store terminal 300. Thereby, unauthorized access to the user terminal 100 can be prevented.
[0080]
Next, the update of the partial secret key will be described using FIG. 13 as an example of the electronic signature system in the configuration of FIG. FIG. 13 is a flowchart for explaining the operation of updating the partial secret key. First, in the user terminal 100, the control unit 131 reads the partial secret key SKa and the partial secret key SKc from the storage unit 110 (step S401) and temporarily holds them. Next, the control unit 131 causes the random number generation unit 180 to generate the random number a, obtains the generated random number a, and temporarily holds it (step S402). Next, the control unit 131 generates new partial secret keys SKa ′ and partial secret keys SKc ′ based on the following formulas (11) and (12).
SKa '= SKa + a (11)
SKc ′ = SKc−a (12)
The control unit 131 stores the generated partial secret key SKa ′ and the partial secret key SKc ′ in the storage unit 110 and performs control for storing the partial secret key SKa ′ in the storage unit 530 of the IC card 500. Thereby, the partial secret key SKa ′ of the user terminal 100 and the partial secret key SKc ′ of the IC card 500 can be updated.
[0081]
  When the IC card is lost or stolen by updating the partial secret key of the IC card and the user terminal 100 as described above, or when the partial secret key of the IC card is taken out by copying or the like However, since the partial secret key of the IC card can be invalidated, it is possible to stop the IC card. In addition, since the partial secret key can be updated in the user terminal 100, the public keyTestimonyIt is possible to save the trouble of re-acquisition of the certificate and re-registering the partial secret key in the store.
[0082]
1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed to perform construction management. May be. Here, the “computer system” includes an OS and hardware such as peripheral devices.
Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a portable medium such as a floppy disk, a magneto-optical disk, a ROM, or a CD-ROM, and a storage device such as a hard disk built in the computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.
The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design and the like within a scope not departing from the gist of the present invention.
[0083]
【The invention's effect】
As described above, according to the present invention, since the key information for generating the electronic signature is divided and stored in the IC card and the store terminal, in the store having no divided partial key information, Since electronic signatures cannot be generated, stores where IC cards can be used can be limited, and the secret key can be misused by a malicious third party even if the private key is lost, stolen, or eavesdropped. Can be reduced, and the confidentiality of the key information can be improved.
[0084]
Further, according to the present invention, the key information is divided to generate partial key information, the once divided partial key information is further divided and transmitted to each store terminal, and the once divided partial key information and twice divided Since part of the partial key information that has been stored is stored in the IC card, the stores that will be used together collaborate, create a signature using the partial key information, and use the partial key information The effect that can prevent the illegal use of is obtained.
[0085]
Further, according to the present invention, since the usage code is added to the message to generate the partial signature, and the partial signature is collected to generate the electronic signature, the IC card user can select the partial key information. It is possible to apply an electronic signature to a message that can be generated only at a store that is to transmit the message. Therefore, if the name of the contractor in the contract of the message with the electronic signature set by a third party is altered to the name of the contractor when the user does not actually contract, Because the contractor name and the contractor name preset in the message are different, it is possible to detect falsification, and it is possible to prevent the electronic signature from being diverted to other than the partial key information depositor. It is.
[Brief description of the drawings]
FIG. 1 is a schematic block diagram showing a configuration of an electronic signature system according to an embodiment of the present invention.
FIG. 2 is a conceptual diagram for explaining secret sharing.
3 is a flowchart for explaining the operation of the electronic signature system in the configuration of FIG. 1;
FIG. 4 is a schematic block diagram illustrating a configuration of an electronic signature system according to a second embodiment.
FIG. 5 is a flowchart for explaining the operation of the electronic signature system in the configuration of FIG. 4;
FIG. 6 is a schematic block diagram illustrating a configuration of an electronic signature system according to a third embodiment.
7 is a flowchart for explaining the operation of the apparatus in the configuration of FIG. 6;
FIG. 8 is a flowchart for explaining an operation of setting a partial secret key SKa and a partial secret key SKbi in the IC card 500 and the store terminal 300.
FIG. 9 is a schematic block diagram illustrating a configuration of an electronic signature system according to a fourth embodiment.
FIG. 10 is a conceptual diagram for explaining a state where a use destination code IDi is set in Msg.
FIG. 11 is a schematic block diagram for explaining a configuration of an electronic signature system according to a fifth embodiment.
12 is a flowchart for explaining the operation of the apparatus in the configuration of FIG.
FIG. 13 is a flowchart for explaining an operation of updating a partial secret key.
[Explanation of symbols]
100 user terminal, 110 storage unit, 130, 131 control unit,
140, 141 distribution unit, 150 communication unit, 180 random number generation unit,
190 partial secret key calculation unit, 195 partial signature generation unit,
300 store terminals, 320 storage unit, 330 MSG generation unit,
340, 341 Partial signature generation unit, 350, 351 Signature generation unit,
370 communication unit, 500 IC card,
520, 521 partial signature generation unit, 530 storage unit,
540 Signature generation unit, 550 Partial secret key generation unit

Claims (6)

An electronic signature system comprising a key information distribution device, an arithmetic device, and a signature verification device,
The key information distribution device
When the key information for generating an electronic signature is divided into n pieces (n is a natural number of 2 or more) and k pieces of the divided key information (k is a natural number satisfying 1 <k ≦ n) are collected. First distribution means for generating first partial key information for generating
Of the first partial key information generated by the first distribution means, at least one first key information is further divided into m (m is a natural number of 2 or more), and j pieces of divided key information ( 1 <j ≦ m) a second distribution unit for generating second partial key information for generating the first partial key information when collected;
Of the second partial key information generated by the second distribution means, less than j second partial key information and of the first partial key information generated by the first distribution means (k− 1) Control of storing pieces of first partial key information in an arithmetic device that generates an electronic signature, and among other second partial key information, less than j pieces of partial key information are transmitted to a signature verification device by communication means. Control means for performing control to transmit ,
The arithmetic unit is
First storage means for storing the first partial key information received from the key information distribution apparatus ;
Second storage means for storing the second partial key information received from the key information distribution device ;
Third storage means for storing a message that is information relating to the contents of a document to be digitally transmitted from the signature verification apparatus;
Based on the second partial key information stored in the second storage means and the message stored in the third storage means, the second partial key information is synthesized with the first partial signature information of the signature verification apparatus. First partial signature generation means for generating partial signature information that is information for generating the partial signature information of 2;
Based on the second partial signature information transmitted from the signature verification apparatus and the first partial key information stored in the first storage means, an electronic signature for performing a signature with the electronic signature is generated. Signature information generating means ;
And an electronic signature transmitting means for transmitting an electronic signature the signature information generation means generates the signature verification device,
The signature verification device comprises:
A fourth storage means for storing the second partial key information,
MSG generation means for generating a message as information on the content of the document to be digitally signed;
Fifth storage means for storing a message generated by the MSG generation means;
Based on the second partial key information stored in the fourth storage means and the message stored in the fifth storage means, the calculation is performed by combining with the partial signature information transmitted from the calculation device. when combined with the first partial key information storage device, and a second partial signature generating means for generating said second partial signature information in which the digital signature is generated
An electronic signature system characterized by that. An electronic signature system comprising a key information distribution device, an arithmetic device, and a signature verification device,
The key information distribution device
When the key information for generating an electronic signature is divided into n pieces (n is a natural number of 2 or more) and k pieces of the divided key information (k is a natural number satisfying 1 <k ≦ n) are collected. Distribution means for generating partial key information for generating
To said computing device for generating an electronic signature based on a predetermined program, among the partial key information generated by the dispersion means, the control and stores the partial key information less than k pieces, among other partial key information control means for performing control of transmitting less than k pieces of partial key information to the signature verification apparatus by communication means ,
The arithmetic unit is
First storage means for storing partial key information received from the key information distribution apparatus ;
Second storage means for storing a message serving as information relating to the content of the electronic signature to be transmitted from the signature verification apparatus via the communication means;
Based on the message stored in the first partial key information and the second storage means stored in the storage means, the digital signature is generated by combining the partial signature information the signature verification device has First partial signature generation means for generating first partial signature information to be information ,
Partial signature information transmission means for transmitting the partial signature information generated by the first partial signature generation means to the signature verification device ,
The signature verification device comprises:
Third storage means for storing the partial key information;
MSG generation means for generating a message as information on the content of the document to be digitally signed;
Fourth storage means for storing a message generated by the MSG generation means;
Based on the partial key information stored in the third storage unit and the message stored in the fourth storage unit, the electronic signature is generated by combining with the partial signature information transmitted from the arithmetic unit Second partial signature generation means for generating second partial signature information to be information to be generated;
Based on the second partial signature information generated by the first partial signature information and the second partial signature generating means transmitted from the arithmetic unit, a signature generating means for generating the electronic signature, the Prepared,
The key information distribution device
A first unique code receiving means for receiving an input of a unique code;
Random number generating means for generating a random number;
Random number transmitting means for storing the random number in the arithmetic unit;
First partial key information generating means for generating the partial key information by using the random number, the unique code, and a hash function for the key information divided by the distributing means,
The arithmetic unit is
A second partial key information generating unit configured to generate the other partial key information using the unique code received from the signature verification device, the random number, and the hash function;
The signature verification device comprises:
Second unique code receiving means for receiving input of the unique code;
Unique code storage means for storing the unique code in the arithmetic unit.
An electronic signature system characterized by that. A common center terminal for storing the partial key information; and the signature verification apparatus receives the partial key information via the common center terminal.
  3. The electronic signature system according to claim 1, wherein the electronic signature system is a digital signature system. An electronic signature method in an electronic signature system comprising a key information distribution device, an arithmetic device, and a signature verification device,
The first distribution means of the key information distribution apparatus divides key information for generating an electronic signature into n pieces (n is a natural number of 2 or more), and k pieces of divided pieces of key information (k is 1 <k). ≦ n natural number) generating first partial key information in which the electronic signature is generated when collected,
The second distribution unit of the key information distribution apparatus further adds m pieces (m is a natural number of 2 or more) of at least one first key information among the first partial key information generated by the first distribution unit. ) And generating second partial key information that generates the first partial key information when j pieces of the divided key information (1 <j ≦ m) are collected,
The control means of the key information distribution apparatus includes less than j second partial key information among the second partial key information generated by the second distribution means and the first distribution means generated by the first distribution means. 1 Control of storing (k−1) first partial key information in the partial key information in the computing device for generating an electronic signature, and less than j partial keys in the other second partial key information Control to send information to the signature verification device by communication means,
  A first storage means of the arithmetic device stores the first partial key information received from the key information distribution device;
A second storage means of the arithmetic device stores the second partial key information received from the key information distribution device;
A third storage unit of the arithmetic device stores a message serving as information relating to the content of the document to be digitally transmitted from the signature verification device;
Based on the second partial key information stored in the second storage unit and the message stored in the third storage unit, the first partial signature generation unit of the arithmetic unit performs the signature verification apparatus Generating partial signature information that is information that is generated by combining the first partial signature information with the second partial signature information;
Based on the second partial signature information transmitted from the signature verification apparatus and the first partial key information stored in the first storage means, the signature information generation means of the arithmetic device uses the electronic signature. Generate an electronic signature for signing,
The electronic signature transmission means of the arithmetic device transmits the electronic signature generated by the signature information generation means to the signature verification device,
  A fourth storage means of the signature verification device stores the second partial key information;
MSG generation means of the signature verification device generates a message that is information about the content of the document to be digitally signed,
A fifth storage means of the signature verification device stores the message generated by the MSG generation means;
Based on the second partial key information stored in the fourth storage unit and the message stored in the fifth storage unit, the second partial signature generation unit of the signature verification apparatus is configured to calculate the arithmetic unit. Generating the second partial signature information for generating the electronic signature when combined with the first partial key information stored in the arithmetic unit by combining with the partial signature information transmitted from
An electronic signature method characterized by the above. An electronic signature method in an electronic signature system comprising a key information distribution device, an arithmetic device, and a signature verification device,
The distribution means of the key information distribution apparatus divides key information for generating an electronic signature into n pieces (n is a natural number of 2 or more), and k pieces of divided pieces of key information (k is 1 <k ≦ n). Generate partial key information for generating the electronic signature when collected)
The control means of the key information distribution apparatus stores less than k pieces of partial key information among the partial key information generated by the distribution means for the arithmetic unit that generates an electronic signature based on a predetermined program. Control and control of transmitting less than k pieces of partial key information among other pieces of partial key information to the signature verification apparatus by communication means,
  The first storage means of the arithmetic device stores the partial key information received from the key information distribution device;
A second storage unit of the arithmetic device stores a message serving as information relating to a content of the electronic signature to be transmitted from the signature verification device via the communication unit;
A portion of the signature verification device based on partial key information stored in the first storage unit and a message stored in the second storage unit by the first partial signature generation unit of the arithmetic device Generating first partial signature information that becomes information to generate the electronic signature by combining with the signature information;
A partial signature information transmission unit of the arithmetic device transmits the partial signature information generated by the first partial signature generation unit to the signature verification device;
  A third storage means of the signature verification device stores the partial key information;
The MSG generation means of the signature verification apparatus includes information on the content of the document to be digitally signed; Produces a message
A fourth storage means of the signature verification device stores the message generated by the MSG generation means;
The second partial signature generation means of the signature verification device is transmitted from the arithmetic device based on the partial key information stored in the third storage means and the message stored in the fourth storage means. Generating the second partial signature information that becomes the information for generating the electronic signature by combining with the partial signature information.
Based on the first partial signature information transmitted from the arithmetic device and the second partial signature information generated by the second partial signature generation means, Generate a signature,
A first unique code receiving means of the key information distributing apparatus receives an input of a unique code;
  The random number generation means of the key information distribution device generates a random number,
The random number transmission means of the key information distribution device stores the random number in the arithmetic device,
  A first partial key information generating unit of the key information distributing apparatus generates the partial key information by using the random number, the unique code, and a hash function for the key information divided by the distributing unit;
  A second unique code receiving means of the signature verification device receives the input of the unique code;
  The unique code storage means of the signature verification device stores the unique code in the arithmetic device,
  Second partial key information generation means of the arithmetic device generates the other partial key information using the unique code received from the signature verification device, the random number, and the hash function.
An electronic signature method characterized by the above. A common center terminal for storing the partial key information; and the signature verification apparatus receives the partial key information via the common center terminal.
  6. The electronic signature method according to claim 4, wherein the electronic signature method is a digital signature method.

Images