KR100732233B1 - Id based proxy signature apparatus with restriction on signing capability by bilinear map and method thereof - Google Patents

Abstract

The present invention relates to a personal identification information-based guarantee authority delegation surrogate signature method that provides a verifiable safety using a double-line function and has an effective surrogate signature ability limitation, as in the conventional personal identification information-based proxy signature method,

The present invention is an algorithm in which the original signature constituting the guarantee delegation surrogate signature method delegates the signature authority to the surrogate signature in a personal identification information-based authentication model having a structure of issuing a private key using each individual identification information to each user. And the algorithm that the surrogate signature generates signatures, and the surrogate verifier verifies the surrogate signature,

According to the present invention, it is possible to reduce the computation time and storage space required for generation of the surrogate signature key, to guarantee verifiable security, and to limit the number of signatures of the surrogate signature.

Surrogate Signature Method, Surrogate Signature Method, Double Line Function based on Personally Identifiable Information

Description

Representation apparatus based on personally identifiable information with limitation of surrogate signature ability using overlapping function and its method

1 is a block diagram illustrating the interaction between participants of the personal signature information-based proxy signature method using the fold linear function according to a preferred embodiment of the present invention;

2 is a block diagram illustrating a process in which an original signature delegates a proxy signature authority to a proxy signature in a personal signature information-based proxy signature method according to an exemplary embodiment of the present invention.

3 is a block diagram illustrating a process in which a surrogate signer delivers information required for verification of a signature to a verifier in a surrogate signature method based on personal identification information using an overlapping function according to a preferred embodiment of the present invention;

4 is a flowchart illustrating the operation of a proxy signature method based on personal identification information using an overlapping function according to a preferred embodiment of the present invention;

5 is a block diagram illustrating a process of limiting the number of surrogate signatures of a surrogate signer in the surrogate signature method based on personal identification information using an overlapping function according to a preferred embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: private key generator (or trust authority)

200: original signature

300: proxy signer

400: validator

The present invention relates to an electronic signature system, and more particularly, to an apparatus and method for guarantee authority delegation surrogate signature based on personal identification information having limitations of surrogate signature capability using an overlapping function.

 The public key cryptosystem has its own public key and private key pair and can link its public key and personal identification information with a digital certificate generated by a trusted third party. In this public key infrastructure, if someone wants to encrypt information using another person's public key, the person's digital certificate must first be verified. Therefore, when the number of users is large, this public key infrastructure requires a large amount of computation time and storage space.

In order to solve the problem of certificate management in the existing public key infrastructure, Shamir introduced the concept of ID-based cryptosystem in 1984 (A. Shamir, Identity). -based cryptosystems and signature schemes, Advances in Cryptology-CRYPTO'84, LNCS 196, pp.47-53, Springer-Verlag, 1984.). The basic concept is to use the user's public personal identification information, such as an e-mail address, as a public key, and a trusted third party, Private Key Generator (PKG), uses his private key and the user's personal identification information. The private key is generated by the user, and the user receives and uses the key. This means that information identifying each user is used directly as the user's public key. Therefore, it is possible to solve various problems related to the management of certificates in the existing public key infrastructure. In addition, since the user receives the private key from the private key generator, the user can reduce the storage space and the calculation amount.

After the introduction of this concept, a number of signature methods were proposed, while designing a cryptographic method that could be considered practical enough was an unsolved task. Recently, however, Boneh and Franklin have been using bilinear maps to create a practical, personally identifiable encryption method (D. Boneh and M. Franklin, Identity-based encryption from the Weil pairing, SIAM). J. Computing, Vol. 32, No. 3, pp.586-615, 2003.), is creating a new research atmosphere on personal identification information based authentication model. Since then, various types of signature methods and application protocols that can be applied to an authentication model such as Bonne-Franklin's encryption method have been proposed.

Among them, the surrogate signature method was first proposed by Mambo, Usuda, and Okamoto in 1996 (M. Mambo, K. Usuda, and E. Okamoto, Proxy signature: Delegation). of the power to sign messages, IEICE Trans.Fundamentals, Vol.E79-A, No. 9, pp. 1338-1353, 1996.). The surrogate signature method consists of the original signer, the proxy signer, and the verifiers, and the surrogate signer securely delegates his or her signature authority to the surrogate signer so that the surrogate signer acts on behalf of the original signer. When a signature is generated for a message and the signature generated is verified, the verifier can verify the original signature of the signature.

The proxy signature method can be divided into full delegation, partial delegation, and delegation by certificate (warrant) depending on the delegation method. Assurance authority delegation method is that the original signature conveys the certificate and the signature to the surrogate for delegation of the signature authority, and the surrogate signed the signature of the power of attorney and his private key. Use this to generate a surrogate signature key, and use it to generate a surrogate signature. Of course, in the process of verifying the surrogate signature, the verifier reviews the contents of the power of attorney and the surrogate signed message to verify the validity of the exercise of the power delegated to the surrogate signer. Eventually, two verification procedures are required, but the verifier can confirm the original signature of the original signature by the original signature of the original signature used in the verification process and also prevent the abuse of delegated authority. Although partial delegation by authorization (or partial delegation by certificate (warrant)) combines partial delegation and guarantee authority delegation, it has the advantages of guarantee authority delegation. When creating a surrogate signature key, create a new key rather than the private key of the existing surrogate signature.

The personal signature based proxy signature method is a proxy signature method defined in the personal identification information based authentication model. This method is composed of a private key generator (PKG), an original signer, a surrogate signer, and a verifier. As with the method, requirements such as Verifiability, Strong unforgeability, Strong identifiability, Strong undeniability, and Prevention of misuse Must be satisfied.

A signature method based on personally identifiable information that satisfies this safety was first proposed by Zhang Fang Guo and Kim Kwang-jo (F. Zhang and K. Kim, Efficient ID-based blind signature and proxy signature from bilinear pairings, ACISP 2003, LNCS 2727, Springer-Verlag, pp.223-232, 2003.), Domestic Patent (Application No. 10-2003-0045217, Deputy Signature Apparatus and Method based on Personally Identifiable Information using Overlapping Pairs, Applicant: Korea Information and Communications Institute) It has been filed as. Independently, a personal signature information-based surrogate signature method has been proposed by Lee Jung-yeon and three others (Lee Jung-yeon, Cheon Jung-hee, Tae-sung Kim, Seung-heon Jin, and ID-based surrogate signature method using Bilinear functions). , Vol. 13 (2), pp. 3-11, 2003.).

If the original signator wants to delegate the limited signing capability to the surrogate signer, as mentioned earlier, you can use the relevant information in the certificate. However, the above method is not sufficient if the original signator wants to delegate the authority to the surrogate signer to generate only a certain number of signatures. This is because no one except the proxy signer can verify that the signature has been generated within a limited number of times. In this regard, in 1994, Delos and Quisquater proposed a 'bounded-life span' signature method (O. Delos and J.-J. Quisquater, An identity-based signature scheme with bounded life-span, Advances). in Cryptology-CRYPTO'94, LNCS 839, Springer-Verlag, pp. 83-94, 1994.), which explicitly states that after a predetermined number of signatures have been generated, the user can no longer generate signatures. As a way of restricting the authority of the signer, there is a drawback to always communicating online with a third party, not a private key generator, which acts as a kind of certificate authority (CA) during signature generation and verification. As an application for this signature, we introduced a full-signature proxy representation method that allowed the original signator to perform some of the limited number of signatures on his behalf.

Most of the surrogate signature methods proposed so far have independently suggested that they satisfy requirements such as verifiability, strong anti-counterfeiting, strong non-identifiability, strong non-repudiation, and prevention of abuse of authority. As a result, the safety of the complex attack model that could occur for the proxy signature method was not accurately verified. This is also the case with the surrogate signature method based on personal identification information of Jang Fang Guo and Kim Kwang-jo, or the surrogate signature method of three others.

Accordingly, an object of the present invention is to solve the above problems of the prior art, the object of the present invention is to provide a demonstrable safety and efficient surrogate using a fold-like function as in the conventional personal identification information-based surrogate signature method The present invention provides a personal identification information based assurance authority delegation signature apparatus and method having limited signature ability.

The present invention is an algorithm in which the original signature constituting the guarantee delegation surrogate signature method delegates the signature authority to the surrogate signature in a personal identification information-based authentication model having a structure of issuing a private key using each individual identification information to each user. It consists of the algorithm that the surrogate signature generates signatures and the surrogate validator verifies the surrogate signature. The present invention proposes a method of configuring a surrogate signature method in which the original signature can implicitly limit the number of signatures of the surrogate signature by adding an index concept based on the general structure of the guarantee delegation surrogate signature method.

The present invention aims to provide a safety proof for a complex attack model that the existing surrogate signature methods do not provide in terms of safety. To this end, the present invention formulates a complex attack model for the guarantee authority delegation signature method defined in the existing public key infrastructure proposed by Boldyreva et al. (A. Boldyreva, A. Pacacio and B. Warinschi, Secure proxy signature schemes for delegation of signing rights, Cryptology ePrint Archive, Report 2003/096). In line with this formal model, we design a new delegation authority signature method using the previously proposed security-based signature-based signature method, and prove its safety in a random Oracle model.

The proposed method of the present invention is a method proposed by Cheon Jung-hee and two others who support the secure aggregation of generated signatures among signature methods based on the surrogate signature in terms of efficiency (hereinafter, CKY signature method). , HJ Yoon, JH Cheon and Y. Kim.Batch Verifications with ID-Based Signatures, ICISC 2004, LNCS 3506, Springer-Verlag, pp. 233-248, 2005). In the existing Delegation by Certificate Proxy Signature Scheme, the verifier of the signature validates the proxy signature generated by the proxy signer whose signature authority is delegated from the original signer. In order to verify, not only the verification of the surrogate signature itself, but also the verification of the signature on the power of attorney conveyed with the surrogate signature as evidence of the delegate authority's delegation of authority, requires two independent signature verifications. According to the present invention, by using the CKY signature method, the signature generated by the surrogate signer and the signature of the power of attorney are generated together so that the verifier can verify both the signature and the power of attorney in one signature verification process. Can be. This provides a shorter signature length and reduces the amount of computation required for signature verification compared to conventional signature-based surrogate signature methods.

In addition, since the existing surrogate signature methods use a partial delegation by certificate (warrant) method, a step of generating a surrogate signature key that is different from the surrogate's private key is required. Since the signer's private key is used as the surrogate signature key, it reduces the amount of computation required to generate the surrogate signature key, and allows the original signer to use a public channel instead of a secure channel when transmitting the power of attorney and signature to the surrogate. Have

In addition, the surrogate signature method proposed in the present invention is intended to solve the problem of the surrogate signature method of Delos-Quisquater by applying an indexing concept to the surrogate signature method of the guarantee delegation type proposed above. This method proposed by Cho Nam-soo et al. (2004) share the random number elements used in the root signature based on a single root signature and insert a different index for each signature so that these signatures form a signature loop along the index. It is. In particular, in this method, if the signer generates a signature with the same index for two different messages, the signer can extract the signer's private key from the two signatures, preventing the signer from committing this fraud. Implicitly limit. In the present invention, the signing authority of the surrogate signer can be restricted by applying to the surrogate signature method that proposes the index concept.

In order to achieve the above object, a personal signature information-based surrogate signature device using a layered function of the present invention generates a system parameter and a master key in a personal signature information-based surrogate device using a layered function. Private key generation means for generating a public key and a private key pair of the original signature means and the surrogate signature means, and using the personal identification information, including information related to the proxy signature authority using the generated private key. A proxy signature in the form of a merge signature that combines the signature of the signature of the proxy and the signature of the signature of the signature of the signature and the generated private key of the signature of the signature of the signature of the signature; Generating the surrogate signature means and the public system parameters and the public key of the original signature means and the surrogate signature means. And it is characterized in that it is determined whether a bilinear function value after calculating the hash value matches made of verifying section for verifying the validity of a proxy signature of the signature merged form.

On the other hand, the personal signature information-based proxy signature method using the bilinear function of the present invention is a personal signature information-based proxy signature method using a bilinear function having a private key generation means, an original signature means, a proxy signature means, and verification means as participants. In the private key generating means for generating and publishing a system parameter and a master key, wherein the private key generating means generates each private key using the personal identification information of the original signature means and the proxy signature means. Step, the original signing means generates a power of attorney, and generates an electronic signature for the power of attorney to delegate the authority of the surrogate signature by transmitting the power of attorney and the electronic signature to the surrogate signature means, the surrogate signature means is electronic for the power of attorney Generating a surrogate signature using the surrogate signature key after validating the signature; And performing a surrogate signature on the delegated message using the surrogate signature key and verifying the validity of the surrogate signature by the verification means.

In addition, the surrogate signature method based on personal identification information for limiting the number of signatures of the surrogate signature using the double line function of the present invention, the surrogate signature means having a private key generating means, the original signature means, surrogate signature means and verification means as a participant In the surrogate signature method based on the personal identification information using the double line function for limiting the number of signatures, the private key generating means generates a system parameter, and generates a master key of the private key generating means, the original name Delegating the proxy signature authority which receives the route signature generated for the power of attorney from the surrogate signature means to limit the number of signatures of the surrogate signature means, and generates a signature for these values and transmits the signature to the surrogate signature means; The surrogate signature means has an index using the surrogate signature key after validating the signed power of attorney. Generating a surrogate signature, wherein the surrogate signature means performs surrogate signature on a message delegated within a limited number of times using the surrogate signature key, and the verification means verifies the validity of the surrogate signature and the surrogate signature; And when the signature means generates two different surrogate signatures having the same index, extracting the private key of the surrogate signature means from the two signatures.

1 is a block diagram illustrating the interaction between participants in the surrogate signature method based on personal identification information using an overlapping function according to a preferred embodiment of the present invention. The surrogate signature method has a primary participant of the private key generator 100, the original signer 200, the surrogate signer 300, and the verifier 400. Here each participant of the method may be a computer system and may communicate remotely by any kind of communication network or other technology. The information to be transmitted between the participants can be stored or stored in various forms of storage media.

2 is a block diagram illustrating a process in which the original signer 200 delegates the surrogate signature authority to the surrogate signer 300 in the surrogate signature method based on personal identification information using the double line function according to the preferred embodiment of the present invention. . The original signer 200 generates a power of attorney including information related to the surrogate signing authority, generates a signature, and transmits the signature to the surrogate signer 300. The surrogate signer 300 verifies the validity of the power of attorney through signature verification.

3 is a signature of a delegate signature based on the personal identification information based on the personal identification information using the overlap function in accordance with a preferred embodiment of the present invention after generating a signature for the message delegated using its private key, A proxy signature in the form of an aggregate signature combined with the signature for the power of attorney received from the signer 200 is generated and sent to the verifier 400, and the verifier 400 verifies the validity of the proxy signature.

Referring now to Figure 4, it will be described in detail with respect to the surrogate signature method based on personal identification information using the overlapping function according to the present invention. The following description includes all the descriptions of FIGS. 1, 2, and 3.

First, the basics of the signature method are explained. G ₁ is a group of addition cycles having a degree of q generated by the constructor, and G ₂ is a group of multiplication cycles having the same rank (q). Element P, the addition operation for G ₁ G ₁ is the value of Q denoted by P + Q, and P n obtained by adding the time is denoted by nP. Therefore, the form of G ₁ can be expressed as {0, P, 2P, ..., (q-1) P}, where 0 means the identity of the addition operation defined in G ₁ . Multiplication operation of the G ₂ for the elements g, h of the G ₁ are denoted by g · h, and expressed in g of n-order product of g ^n. Therefore, the form of G ₂ can be expressed as {1, g, g ² , ..., g ^q-1 }, where 1 means the identity of the multiplication operation defined in G ₂ . Here, let Z _q ^{* be} a set of integer k, where 0 <k <q. At this time, e: G ₁ × G ₁ → G ₂ is an overlap linear function satisfying the following condition.

1.Overlapping to satisfy e (aP, bQ) = e (P, Q) ^ab

2. Presence of P, Q∈G ₁ that satisfies e (P, Q) ≠ 1

3. Efficiency of e (P, Q) calculation for all P, Q∈G ₁

In practice, in order to efficiently implement such a double-linear function, in the present invention, G ₁ is a subgroup of a supersingular curve, G ₂ is a multiplication cycle group (F _q ^* ), and e is a Weil pairing. Alternatively, the data is generated using Tate pairing.

The process of generating a system parameter and generating a master key of the private key generator 100 (step 401) follows Bone-Franklin's personal identification information based authentication structure. First bilinear function (e produced a number q of cyclic groups (G ₁ and G ₂₎ above, and defined in the cyclic group generator of a (G ₁₎ (P) and two cyclic group (G ₁ and G _2): G ₁ × G ₁ → G ₂ ). It is assumed that the discrete algebra problem in G ₁ and G ₂ is difficult. In addition, the cryptographic hash function H ₁ : {0,1} ^* → G ₁ and H ₂ : {0,1} × G ₁ → Z _q ^* are selected. Here, {0,1} ^* means a set of bit strings having an arbitrary length. Next, the private key generator 100 selects an arbitrary integer s belonging to Z _q ^* as its master key and calculates P _pub = sP. The private key generator 100 is params = <G ₁ , G ₂ , e, q, P, P _pub , H ₁ , H ₂ to be shared by the original signer 200, the surrogate signer 300, and the verifier 400. Publish> as a system parameter.

The private key generator 100 also generates and delivers the private key of each of the original signer and the surrogate signer (step 402) according to Bone-Franklin's personal identification information based authentication structure. The private key generator 100 generates each public key and private key pair using system parameters and master keys, and personal identification information of the original signer 200 and the surrogate signer 300. The public key of the original signer 200 having the personal identification information A is Q _A = H ₁ (A) and the private key is S _A = sQ _A. In addition, the public key of the surrogate signer 300 having the personal identification information (B) is Q _B = H ₁ (B) and the private key is S _B = sQ _B. The private key generator 100 transmits the private keys of the original signer 200 and the surrogate signer 300 to each user through a secure channel.

In the process of delegation of authority for the surrogate signature (step 403), in order for the original signer 200 to delegate the signing authority to the surrogate signer 300, first, the information of the original signer and the surrogate signer and the authority of the surrogate signature (m) _w ), then create a signature for the power of attorney using the CKY signature method. This process is described in detail as follows. Original signer 200 may select a random integer (r) belonging to the concatenated Z _q ^* and the personal identification information (B) of the bit string to the proxy "00" and the proxy signer (concatenation), the value _w 00∥B∥m Calculate U _C = rP, h _c = H ₂ (00∥B∥m _w , U _C ) and V _C = rQ _A + h _C S _A to generate a signature for the surrogate signer 300 <m _w , (U _C , V _C )> The concatenation of the surrogate's personal identification information (B) to the power of attorney is to identify the surrogate signer to whom the power of attorney will be delivered. It is assumed to be used for both creation and creation of the default signature used by each user of the system.

In the step of the proxy signer 300 validating the power of attorney (step 404), the proxy signer 300 checks the power of e (P, V _C ) to verify the power of attorney (m _w ) and its signature value (U _C , V _C ). Calculate V) and e (Q _A , U _C + hP _pub ), respectively, and validate the signature only if the two values are equal. After the signature for the mandate (mw) has been validated, the surrogate signature generates the surrogate signature key skp = (S _B , A, B∥m _w , (U _C , V _C )). The surrogate signature key (skp) is created by including the private key (S _B ) and other public information (A, B∥m _w , (U _C , V _C )), which are secret information that only the surrogate signer knows. No calculation is required. Here meaning it does not require a separate calculation is A, B is a user's personal identification information, m _w is Book Review self proxy passed to proxy signer, (U _C, V _C) is given by Book Review self generated for the proxy m _w The result value calculated by the signature technique by inputting the message and the user's private key. It is the value previously known to the surrogate signer or received from the original signer. In the end, the secret information required for the surrogate signature to be generated by the surrogate signature by the surrogate signature key (skp) is unique to his private key (S _B ), and the rest includes information necessary for the convenience of signature generation. It is just made.

In the step of generating the surrogate signature using the surrogate signature key (step 404), the surrogate signature 300 has the surrogate signature key (skp) and uses the CKY signature method for any delegated message (m). Create a signature. To this end, the delegate signer selects a random integer (k) belonging to Z _q ^* and concatenates the bit string '01', the proxy letter (m _w ), and the delegate signer's personal identification information (B). to generate a signature for the 01∥B∥m _w ∥m value calculates _{U = kP, h = H 2} (01∥B∥m w ∥m, U) , and V = _B + kQ hS _B. The delegate signer then combines the signature value (U _C , V _C ) contained in the proxy signature key with the signature value (U, V) for the delegated message (U _C , U, V _C + V). And pass (B, m _w , (U _C , U, V _C + V)) as the surrogate signature for message m. The calculation performed by the surrogate signature for calculating the surrogate signature is
(1) calculating the CKY signature values (U, V) for message m and
(2) With V _C + V, use all the information contained in the surrogate signature key (skp).
The actual surrogate signature key (skp) is configured so that the surrogate signature contains all the information needed to calculate the surrogate signature.

In the step of verifying the received surrogate signature (step 405), the verifier 400 publishes the delegated message, the system parameters published by the private key generator 100, the original signer 200 and the surrogate signer 300. Calculate the hash values h _C = H ₂ (00 ∥B ∥ m _w , U _C ) and h = H ₂ (01 ∥B∥ m _w ∥m, U) using public information such as keys. P, V _C + V) and e (Q _A , U _C + h _C P _pub ) · e (Q _B , U + hP _pub ) are checked to have the same value and are recognized as valid signatures only when they are equal.

The present invention does not require a secure channel in the process of delivering the power of attorney and its signature to the surrogate. In more detail, when the original signer 200 sends <m _w , (U _C , V _C )> to the surrogate signer, it can be sent using a public channel. Therefore, any attacker can obtain a signature for the power of attorney (m _w ), but forging the surrogate signature for the message on behalf of the proxy signer 300 and the original signer 200 means that a CKY signature for any public key is obtained. It becomes like forging.

The security of a proxy attack's complex attack model depends on the security of the CKY signature. Assuming that an attacker takes over all other users of the cryptographic system and attacks one given honest user, the attacker obtains the necessary information by asking various types of queries to the honest user and uses it to sign the CKY signature. Forgery), forgery of an authorized user delegated by an attacker entrusted to an attacker, or forgery of an unauthorized user for an unauthorized user. These attempts represent theoretically the safety requirements for the surrogate signatures, which are validity of verification, strong anti-counterfeiting, strong non-identifiable, strong non-repudiation, and prevention of abuse of authority. The method can mathematically prove that a CKY signature can be forged if such an attacker attempts to forge a signature. However, the CKY signature method proves secure in the random oracle model for the strongest attack method against signatures called adaptive chosen-message attacks, thus ensuring the security of the proxy signature. . This fact can be easily proved because the CKY signature method is used in all procedures for generating the surrogate signature.

5 illustrates in detail a method of limiting the number of signatures of a surrogate signer in a surrogate signature method based on personal identification information using an overlapping function according to a preferred embodiment of the present invention. The concept of index is included as a method for limiting the number of signatures. The basic signature method itself used in this manner follows the procedure of the basic proxy signature method shown in FIG. In order to limit the authority of the signature, the steps of the change in FIG. 4 include the step of delegation of the surrogate signature (step 403), the generation of the surrogate signature (step 404), and the verification of the surrogate signature (step). 405).

Generating the system parameters and generating the master key of the private key generator 100 follows the Bone-Franklin's personal identification information based authentication structure, similar to the basic proxy signature method of FIG. 4, but with a new hash function H ₃ : G ₁ × G ₁ × N → G ₁ is additionally required. Accordingly, the private key generator 100 may share params = <G ₁ , G ₂ , e, q, P, P _pub , H ₁ , which will be shared by the original signer 200, the surrogate signer 300, and the verifier 400. Publish H ₂ , H ₃ > as system parameters.

In the delegation authority delegation authority, the basic surrogate method described in FIG. 4 is sufficient for the original signature generator to generate and transmit the power of attorney and signature to the surrogate signature, whereas the surrogate signature is generated when the surrogate signature is generated. In order to create a signature loop, you need to first create a root signature as the basis. To this end, the original signer first sends a proxy (m _w ) to the surrogate, in order to delegate the surrogate's authority to the surrogate, the surrogate selects a random integer k _R belonging to Z _q ^* , and U _R = k _R Calculate P, h _R = H ₂ (01∥B∥ m _w , U) and V _R = k _R Q _B + h _R P _pub and return <m _w , (U _R , V _R )> to the original signer. send. This (U _R , V _R ) serves as the root signature to create the signature ring. The original signature is then sent to the alternate signature by a signature (U _C , V _C ) generated by the CKY signature method with the message 00∥B∥m _w ∥ (U _R , V _R ).

When the proxy signer validates the power of attorney, the proxy signer verifies the signature (U _C , V _C ) for the power of attorney and the root signature received from the original signer using the signature verification algorithm of the CKY signature method. Only the surrogate signature key skp = (S _B , A, _B ∥ m _w ∥ (U, V), (U _C , V _C )).

In the step of generating the surrogate having the index using the surrogate signature key, the surrogate signer first generates the root signature (U _R , V _R ) and the random number used in the process of generating the root signature. Using element (k _R ∈ Z _q ^* ), index (t), delegated message (m), and delegate signer's private key (S _B ), h ^(t) = H ₂ (01∥B∥m _w ∥) m, H ₃ ((U _R , V _R ), t)) and V ^(t) = k _R H ₃ ((U _R , V _R ), t) + h ^(t) S _B , and V ^(t) Calculate + V _C. The surrogate signature conveys (B, m _w ∥ (U _R , V _R ), t, (U _C , V _C + V) as the surrogate signature for message (m).

In order to verify the surrogate signature (B, m _w ∥ (U _R , V _R ), t, (U _C , V _C + V)) as the surrogate signature for the given message (m) in verifying the surrogate signature First h _C = H ₂ (00 ∥ _B ∥ m _w , U _C ) and h ^(t) = H ₂ (01 ∥ B ∥ m _w ∥ m, H ₃ ((U _R , V _R ), t)) E (P, V _C + V ^(t) ) and e (Q _A , U _C + h _C P _pub ) · e (Q _B , h ^(t) P _pub ) · e (U _R , U ^{( t)} checks if) have the same value and accepts the validity only if it is the same value.

If the index (t) is greater than the upper limit of the number of signatures specified in the mandate, the verifier has no reason to believe the signature. Therefore, suppose that the surrogate signature has generated more than one t-th surrogate signature less than the upper limit of the number of surrogate signatures specified in the power of attorney. Then the different parts of two signatures with the same index from the same root signature are respectively V ^(t) = k _R H ₃ ((U _R , V _R ), t) + h ^(t) S _B and V ^{(t) '} = Since k _R H ₃ ((U _R , V _R ), t) + h ^{(t) '} S _B , we have different hash values h ^(t) and h ^(t)' The private key S _B = (h ^(t) -h ^{(t) '} ) ^-1 (V ^(t) -V ^(t)' ) can be extracted.

As described above, the apparatus and method for personal signature information-based proxy signature using the double-line function having the limited surrogate signature capability according to the present invention ensures the efficiency aspect and the demonstrable safety to reduce the computation time and storage space, and the proxy signature. It is possible to limit the number of signatures.

Claims (12)

In the surrogate signature device based on personal identification information using an overlapping function, Private key generation means for generating system parameters and master keys to disclose system parameters, and generating public and private key pairs of the original signature means and the surrogate signature means using private identification information; Original signature means for generating a power of attorney including information related to proxy authority by using the private key pair generated by the private key generation means, and generating and transmitting a signature of the power of attorney; The signature means, Power of attorney generation module for generating a power of attorney (m _w ) including a description of the delegation relationship; The signature (U _C , V _C ) for the power of attorney (m _w ) is selected as an arbitrary integer (r _C ) belonging to Z _q ^* so that U _C = r _C P, h _C = H ₂ (00∥B∥m _w , U _C ) and V _C = r _C Q _A + h _C S _A , and the validity of the digital signature for the power of attorney (m _w ) is e (P, V _C ) and e (Q _A , U _C + h _C P _pub ) is verified only when the two values are the same, and the surrogate signature key has only the private signature (S _B ) of the surrogate signer as secret information skp = (S _B , A, B∥m _w , Consisting of (U _C , V _C )) A surrogate signature means for generating a surrogate signature in a merge signature form combining the signature of the power of attorney of the original signature means and the signature of the delegated message generated by using the generated private key; And Verifying the validity of the surrogate signature in the merge signature form by calculating a hash value using the published system parameter and the public key of the original signature means and the surrogate signature means, and then determining whether the overlapping linear function value is identical. Way Personal signature information-based surrogate signature device using a double-linear function, characterized in that consisting of. (Where e is an overlapping function, skp = (S _B , A, B∥m _w , (U _C , V _C )) is the surrogate signature key of the surrogate signature, and Z _q ^* is 0 <k <q Denotes a set of integer k, where P is an element of G ₁ , Q _A and S _A are the public and private keys of the original signature means having the personal identification information A, and H ₂ is the cryptographic hash function. ) delete delete The method of claim 1, wherein the surrogate signature means, A selection module for selecting any integer k belonging to Z _q ^* for the delegated message m; For the signature (U, V) obtained by calculating U = kP, h = H ₂ (01∥B∥ m _w ∥m, U) and V = kQ _B + hS _B , and the power of attorney (m _w ) of the original signing means. Consists of a merge signature generation module that integrates signatures (U _C , V _C ) to generate (U _C , U, V _C + V), The effective signature of the delegated message (m) is (B, m _w , (U _C , U, V _C + V)), characterized in that the personal signature information based proxy signature device using a linear function. (Where Z _q ^* denotes a set of integers k where 0 <k <q, B is personal identification information of the surrogate signature means, and Q _B , S _B are of the surrogate signature means having personal identification information (B)). Public key, private key, and H ₂ is a cryptographic hash function.) According to claim 1, Verification means for verifying the validity of the proxy signature of the merge signature form, The validity of the surrogate signature in the merge signature form is calculated by calculating the hash values h _C = H ₂ (00 ∥B ∥ m _w , U _C ) and h = H ₂ (01 ∥B∥m _w ∥m, U), An individual using a fold function, characterized in that it is validated only when e (P, V _C + V) = e (Q _A , U _C + h _C P _pub ) · e (Q _B , U + hP _pub ) Proxy signature device based on identification information. Where P is an element of G ₁ , h and h _C are hash values, Q _A , Q _B is the public key of the original and surrogate signature means, respectively.) In the surrogate signature method based on personal identification information using an overlapping function having the private key generation means, the original signature means, the surrogate signature means, and the verification means as participants, A publishing step in which the private key generating means generates and discloses a system parameter, a master key; A private key generation step, wherein the private key generation means generates each private key using the personal identification information of the original signature means and the proxy signature means; The original signature means generates a power of attorney, generates an electronic signature for the power of attorney, and transmits the power of attorney and the digital signature to the proxy signature means, wherein the original signature means first limits the signature authority of the proxy signature means. a proxy (m _w) to send the proxy signature means Z _q ^* selected an arbitrary integer (k _R) belonging to, and _{U R = k R P, h} R = h 2 (01∥B∥m w ∥ m, U) and V _R = k _R Q _B + h _R P _pub , then send the power of attorney (m _w ) and the route signature (U _R , V _R ) back to the original signator, and the original signator is Z Select any integer (k _C ) belonging to _q ^* , U _C = k _C P, h _C = H ₂ (01∥B∥m _w ∥ (U _R , V _R ), U _C ) and V _C = Delegation step of delegating authority authority by generating a signature (U _C , V _C ) for the power of attorney by calculating k _C Q _B + h _C P _pub ; A surrogate signature generation step of the surrogate signature means generating a surrogate signature using a surrogate signature key after verifying the validity of the electronic signature for the power of attorney; And The verification means calculates the hash value and then calculates the double-line function values e (P, V _C ) and e (Q _A , U _C + h _C P _pub ), respectively, and is verified only when the two values are equal to each other. Validation step to validate the Personal signature information-based surrogate signature method using a bilinear function including a. (Where Z _q ^* is a set of integers k where 0 <k <q, P is an element of G ₁ , h, h _C is a hash value, Q _B is the public key of the surrogate signature means, e Is an overlapping function, and skp = (S _B , A, B∥m _w ∥ (U, V), (U _C , V _C )) is the surrogate signature key of the surrogate signature.) delete delete The method of claim 6, wherein in generating the proxy signature, For the delegated message m, the surrogate signature means first uses the given route signature (U _R , V _R ) and the random number element (k _R ∈ Z _q ^* ) and index (t) used in the generation of the route signature. ^(t) = H ₂ (01 ∥B ∥ m _w ∥m, H ₃ ((U _R , V _R ), t)) and V ^(t) = k _R H ₃ ((U _R , V _R ), t ) + h ^(t) S _B , and V ^(t) + V _C , and then substitute (B, m _w ∥ (U _R , V _R ), t, (U _C , V _C + V) Personal signature information based surrogate signature method using an overlapping function, characterized in that outputting). (Where Z _q ^* means a set of integers k where 0 <k <q, m is a delegated message, m _w is a power of attorney, B is a personal identification of the surrogate signature, and H ₂ is cryptographic) Hash function, S _B is the private key of the surrogate signature.) The method of claim 6, wherein the validating of the proxy signature comprises: First h _C = H ₂ (00 ∥ _B ∥ m _w , U _C ) and h ^(t) = H ₂ (01 ∥ B ∥ m _w ∥ m, H ₃ ((U _R , V _R ), t)) E (P, V _C + V ^(t) ) = e (Q _A , U _C + h _C P _pub ) · e (Q _B , h ^(t) P _pub ) · e (U _R , U ^{( t)} A surrogate signature method based on personally identifiable information using an overlapping function, characterized in that it is verified only when the ^t) is satisfied. (Where e is a parallel function, h, h _C is a hash value, m is a delegated message, m _w is a proxy, B is a personal signature of a surrogate signature, and H ₂ is a cryptographic hash function) T is the index.) In the surrogate signature method based on personal identification information using an overlapping function for limiting the number of signatures of the surrogate signature means having the private key generation means, the original signature means, the surrogate signature means, and the verification means as participants, Generating, by the private key generating means, a system parameter and a master key of the private key generating means; Delegating the surrogate signature authority that receives the route signature generated for the power of attorney from the surrogate signature means to limit the number of signatures of the surrogate signature means, and generates signatures for these values and transmits them to the surrogate signature means. ; Generating a surrogate signature having an index by using the surrogate signature key after the surrogate signature means verifies the signed power of attorney; The proxy signing means performing a proxy signature on a message delegated within a limited number of times using the proxy signature key; Verifying validity of the surrogate signature by calculating a hash value and determining whether a fold-linear function value is identical; And Extracting the private key of the surrogate signature means from the two signatures when the surrogate signature means generates two different surrogate signatures having the same index; Personal signature information-based surrogate signature method using a bilinear function including a. 12. The method of claim 11, wherein generating a surrogate signature having an index by using the surrogate signature key, If the surrogate signature generates at least one t-th surrogate signature that is less than the upper limit of the number of surrogate signatures specified in the power of attorney, then the value obtained from the two signatures is V ^(t) = k _R H ₃ ((U _R , V _R ) , t) + h ^(t) S _B and V ^{(t) '} = k _R H ₃ ((U _R , V _R ), t) + h ^(t)' S _B , and different hash values h ^(t) And h ^{(t) '} from which the private key S _B = (h ^(t) -h ^(t)' ) ^-1 (V ^(t) -V ^{(t) '} ) can be extracted. A proxy signature method based on personally identifiable information using an overlapping function. (Where t is the index, S _B is the private key of the surrogate signature, h is a hash value, k _R is any integer, and V is the signature for the delegated message.)

Images