JP2003152709A - Structure of electronic signature, and method and system for verifying information with the signature - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a structure of electronic signatures capable of warranting so-called information quantitative security where the electronic signature cannot be counterfeited by using a computer with any excellent performance. SOLUTION: The task can be attained by the structure of the electronic signature that is to be attached to message information (m) to be a source of a finite field Fq generated by respective terminals Uj (j=1 to n) of a plurality of users belonging to a prescribed group; and has a set of a random number rj being a source of the finite field Fq and a value F1(rj)+mF2(tj)} calculated by using values F1(rj), F2(rj) obtained by assigning the random number rj to polynomials F1(x), F2(x) on the finite field Fq generated at random.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a structure of an electronic signature that can be used in electronic voting, electronic questionnaires, etc., and more specifically, it is a finite number created in each terminal of a plurality of users belonging to a predetermined group. It relates to the structure of the electronic signature to be added to the message information m which is the source of the field Fq.

Further, according to the present invention, the signed information created by adding the electronic signature as described above to the message information m is created by any of a plurality of users belonging to a predetermined group. The present invention relates to a signed information verification method and system for verifying the existence.

[0003]

2. Description of the Related Art For example, in a system that performs electronic voting or electronic questionnaire for users who belong to a certain group, it is guaranteed that the votes and answers of users who belong to the group are guaranteed. There are cases where it is required that the users who have voted or answered cannot be specified, that is, so-called anonymity be ensured. In such a system, for example, common secret information is given to a plurality of users belonging to a certain group, and each user makes a vote or reply with a signature using the common secret information.
Then, by checking the confidential information in the signature attached to the vote or answer from each user, while maintaining the anonymity of each user, the vote or answer can be sent from a legitimate user who belongs to the group. It can be confirmed that it was done.

[0004]

However, in the system as described above, in order to give common secret information to each user, the user needs to use the secret information, such as leaving the group. Every time the situation disappears, the confidential information must be invalidated in order to prevent fraud. Moreover, since common secret information is given to all users who belong to the group, it is relatively difficult to ensure sufficient security.

In order to solve such a problem, a technique called group signature has been proposed in recent years. In such a technique, for example, a method of ensuring safety (computationally secure) is taken on the assumption that it is impossible to compute a prime factorization or a discrete logarithm problem in terms of computational complexity.
In other words, it guarantees that any high-performance computer currently conceivable cannot decipher confidential information in a realistic time.

[0006]

However, even if the security of the computational complexity can be guaranteed at present, it will not be possible to sufficiently secure the security in the future by improving the performance of the computer. .

Therefore, a first object of the present invention is to provide a so-called electronic signature structure capable of ensuring the so-called quantitative security of information, which cannot be fraudulently used by a computer of any performance. .

A second object of the present invention is to provide a method and system for verifying signed information created by applying such an electronic signature to message information.

[0009]

In order to solve the above-mentioned first problem, according to the present invention, as described in claim 1, each of a plurality of users belonging to a predetermined group Uj (j).
= 1, ... N) the finite field Fq created in the terminal
In the structure of the electronic signature to be added to the message information m which is the source of the random number rj, which is the source of the finite field Fq generated differently corresponding to each user Uj, and randomly generated A value {F1 (rj) calculated using the values F1 (rj) and F2 (rj) obtained by substituting the random numbers rj into the polynomials F1 (x) and F2 (x) on the finite field Fq. + MF2 (rj)}.

In such a digital signature structure, the value s =
Even if {F1 (rj) + mF2 (rj)}, the message information m and the random number rj are acquired by a malicious third party, two values (F1 (rj) and mF2 (rj)) that are the value s Since there are innumerable combinations, the values F1 (rj) and F2
(Rj) cannot be specified. Therefore, a malicious third party cannot impersonate a user who belongs to the above predetermined group.

In order to solve the above-mentioned second problem, according to the present invention, as described in claim 2, each of a plurality of users belonging to a predetermined group Uj (j = 1, ...
In the signed information verification method for verifying that the signed information created in the terminal n) is created by any user who belongs to the specified group, And a step of randomly generating polynomials F1 (x) and F2 (x) on a finite field Fq, and Uj (j = 1, ..., N) of each of a plurality of users belonging to a predetermined group. The step of generating a random number rj which is a source of the finite field Fq different from each other correspondingly, and the first value F1 (rj) and the Second value F2
(Rj) calculation step, and the polynomial F1 (x),
F2 (x) is issued to the verifier, and the random number rj, the first value F1 (rj) and the second value F2 (rj) are sent to the user Uj.
Created in the terminal of the user Uj, which is executed on the terminal of the verifier,
In the message information m which is the source of the finite field Fq, the random number rj, the first value F1 (rj) and the second value F2 (r
j) obtaining the signed information {m, rj, F1 (rj) + F2 (rj)} to which a pair of the value {F1 (rj) + mF2 (rj)} calculated from j is added; Using the message information m and the random number rj included in the information and the polynomials F1 (x) and F2 (x) issued to the verifier, F1 (x) | x = rj + mF2 (x) | x = rj There is a step of calculating a value, and a step of determining whether or not the value matches the value {F1 (rj) + mF2 (rj)} included in the signed information, and the determination result is added with the signature. The verification result that the information is created by any user belonging to the above-mentioned predetermined group is configured.

In such a signed information verification method, the verifier uses the polynomial F1 (x) issued by the center,
The value {F1 (rj) + mF2 is obtained by using F2 (x) and the random number rj and the message information m included in the signed information.
(Rj)} is created and it is determined whether the created value and the value {F1 (rj) + mF2 (rj)} included in the signed information match. It is verified that it was created by any user who belongs to the above-mentioned predetermined group.

From the viewpoint of not allowing the user to deny creation of the message information m, the present invention provides the signed information verification method as described in claim 3.
The step of generating the random number rj assigned to the user Uj is the random number r i (i = 1, ...
, N, i ≠ j), a random number rj that satisfies F1 (rj) ≠ F1 (ri) is generated, and at the same time, the first value F1 (rj) and the random number rj are executed in the center. A first value F1 (rj) is provided by the verifier, which has a step of issuing information indicating a correspondence relationship with the corresponding user Uj to a predetermined institution and is executed in the predetermined institution. Sometimes, the first value F1 (r
It can be configured to have a step of identifying the user Uj corresponding to the first value F1 (rj) based on the information indicating the relationship between j) and the user Uj.

In the signed information verification method as described above,
Although only the information possessed by the verifier can verify that the user who created the signed information is one of the users belonging to the predetermined group, the created user cannot be specifically specified. Therefore, the center issues information representing the relationship between the first value F1 (rj) and the user Uj to a predetermined institution in advance. Thereby, the verifier provides the above-mentioned value F1 (rj) to the predetermined institution,
The user Uj who created the signed information can be specified. That is, the user U who created the signed information
j can be specified by the cooperation of the verifier and the prescribed organization. User Uj identified in this way
Cannot deny having created the signed information.

In order to solve the above-mentioned first problem, according to the present invention, as described in claim 4, each of a plurality of users belonging to a predetermined group Uj (j = 1, ...).
In the structure of the electronic signature to be added to the message information m which is the source of the finite field Fq created in the terminal n), the finite field Fq generated differently corresponding to each user Uj. The random number rj that is the source of
And a polynomial F1 (rj, y obtained by substituting the random number rj into one variable x of the two-variable polynomials F1 (x, y) and F2 (x, y) on the finite field Fq generated at random. ),
A polynomial {F1 (rj, y) calculated using F2 (rj, y)
y) + mF2 (rj, y)}.

In such a digital signature structure, the polynomial s (y) = {F, as in the above-described digital signature structure.
1 (rj, y) + mF2 (rj, y)}, message information m
And the random number rj are acquired by a malicious third party, two polynomials (F1 (rj,
y) and mF2 (rj, y)) exist in innumerable combinations, and therefore polynomials F1 (rj, y) and F2 (rj,
y) cannot be specified.

In order to solve the above-mentioned second problem with regard to the information with a signature using such a digital signature, the present invention sets forth a plurality of users belonging to a predetermined group as described in claim 5. In order to verify this, the signed information created in each terminal of Uj (j = 1, ..., N) is created by any user who belongs to the predetermined group. In the signed information verification method, a step of randomly generating bivariate polynomials F1 (x, y) and F2 (x, y) on a finite field Fq, which is executed at a predetermined center, and a verifier are specified. The identifier Vk that is the source of the finite field Fq and the bivariate polynomial F1
Using (x, y) and F2 (x, y), the polynomial F1 (x, y
Vk), F2 (x, Vk), and a plurality of users Uj (j = 1, ...
n) corresponding to each of the different finite field Fq, which is a source of the random number rj, and the bivariate polynomials F1 (x, y), F2 (x, y) and the random number r.
calculating the polynomials F1 (rj, y) and F2 (rj, y) using j, and the above polynomials F1 (x, Vk) and F2
(X, Vk) is issued to the verifier Vk, and the random number r
j, and the step of issuing the polynomial F1 (rj, y) and F2 (rj, y) to the user Uj.
The message information m, which is the source of the finite field Fq created in the terminal of the user Uj and is executed in the terminal of, the random number rj and the polynomials F1 (rj, y) and F2 (rj, y). ) Polynomial {F1 (rj, y)
+ MF2 (rj, y)} is added to the signed information {m, rj, F1 (rj, y) + F2 (rj, y)}, and the polynomial {included in the signed information. Using F1 (rj, y) + mF2 (rj, y)}, {F1 (rj, y) + mF2 (rj, y)} | y = Vk and the polynomial F1 (i) issued to the verifier Vi. x, V
k), F2 (x, Vk) and the message information m and the random number rj included in the signed information, F1 (x, Vk) | x = rj + mF2 (x, Vk) | x = rj There is a step of calculating and a step of judging whether or not the above respective values match, and the judgment result is one in which the signed information is created by any user who belongs to the predetermined group. It is configured to be the verification result of something.

In such a signed information verification method, signed information {m, rj, F1 (rj, y) created by adding the electronic signature to the message information m at the terminal of the verifier Vk. It is possible to verify that + mF2 (rj, y)} is created by any user who belongs to a predetermined group.

In the verification method as described above, since the identifier Vk for identifying the verifier is used, the verifier Vk is used.
May be any verifier of a plurality of verifiers.

Further, in the above-described signed information verification method, from the viewpoint of not allowing the user to reject the creation of the message information m, the present invention provides the user Uj as described in claim 6. Random number rj assigned to
To generate a random number r i for all other users.
For (i = 1, ..., N, i ≠ j), F1 (rj,
y) ≠ F1 (ri, y), a random number rj is generated, and the polynomial F1 (rj,
y) and the user Uj corresponding to the random number rj are issued to a predetermined institution, and the verifier Vi to F1 (x,
Vk) | x = rj When the value F1 (rj, Vk) obtained by the calculation is provided, the polynomial F1 (rj, y) and the user U
A user U corresponding to a polynomial F1 (rj, y) such that F1 (rj, Vk) = F1 (rj, y) | y = Vi based on the information indicating the correspondence with j.
It can be configured to have the step of identifying j.

In order to solve the second problem, according to the present invention, as described in claim 7, each of a plurality of users belonging to a predetermined group Uj (j = 1, ...
In the signed information verification system that verifies that the signed information created in the terminal n) is created by any user who belongs to the specified group, the specified center is Means for randomly generating polynomials F1 (x) and F2 (x) on the field Fq, and Uj of each of a plurality of users belonging to a predetermined group
By using means for generating different random numbers rj that are elements of the finite field Fq corresponding to (j = 1, ..., N) and the polynomials F1 (x), F2 (x) and the random numbers rj, Means for calculating the first value F1 (rj) and the second value F2 (rj), and issuing the polynomials F1 (x), F2 (x) to the verifier, and the random number rj, first value F1 (rj) and means for issuing the second value F2 (rj) to the user Uj, and the verifier's terminal is the source of the finite field Fq created in the terminal of the user Uj. In the message information m, a value {F1 (rj) + m calculated from the random number rj and the first value F1 (rj) and the second value F2 (rj).
F2 (rj)}-added signed information {m, rj, F1 (rj) + F2 (rj)}, and message information m and random number rj included in the signed information, A means for calculating the value of F1 (x) | x = rj + mF2 (x) | x = rj using the polynomials F1 (x) and F2 (x) issued to the verifier, and the above value is the signature Means for determining whether or not the value {F1 (rj) + mF2 (rj)} included in the attached information matches, and the result of the determination is any user whose signed information belongs to the predetermined group. It is configured to be the verification result that it was created in.

Further, similarly, in order to solve the second problem,
According to the present invention, as described in claim 9, each of a plurality of users belonging to a predetermined group Uj (j = 1, ...
.., n) the signed information created by the terminal is created by any user who belongs to the specified group, and in the signed information verification system that verifies this, a predetermined center Is a means for randomly generating bivariate polynomials F1 (x, y) and F2 (x, y) on a finite field Fq, an identifier Vk which is a source of the finite field Fq for specifying a verifier, and the two variables Polynomial F1 (x,
y) and F2 (x, y), the polynomial F1 (x, V
k), a means for calculating F2 (x, Vk) and a plurality of users Uj (j = 1, ..., N) belonging to a predetermined group, which are different finite fields Fq. Means for generating a random number rj, and the above-mentioned bivariate polynomial F1
(X, y), F2 (x, y) and means for calculating polynomials F1 (rj, y) and F2 (rj, y) using the random numbers rj, and polynomials F1 (x, Vk) and F2 ( x, Vk) is issued to the verifier Vk, and the random number rj and the polynomial F1 are issued.
(Rj, y) and F2 (rj, y) are issued to the user Uj, and the terminal of the verifier Vk is an element of the finite field Fq created in the terminal of the user Uj. In the message information m, the random number rj and the polynomial F1
Signed information {m, rj, F1 (rj, rj, y)} with a pair of polynomial {F1 (rj, y) + mF2 (rj, y)} calculated from (rj, y) and F2 (rj, y) y) + F2 (rj, y)} and a polynomial {F1 (rj, y) + mF2 (rj, y)} included in the signed information, {F1 (rj, y) + mF2 ( rj, y)} | y = Vk and the polynomial F1 (x, V) issued to the verifier Vi.
k), F2 (x, Vk) and the message information m and the random number rj included in the signed information, F1 (x, Vk) | x = rj + mF2 (x, Vk) | x = rj It has a means for calculating and a means for judging whether or not the respective values match, and the result of the judgment is one in which the signed information is created by any user who belongs to the predetermined group. It is configured to be the verification result of something.

[0023]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings.

A system to which the signed information verification method according to the embodiment of the present invention is applied is configured, for example, as shown in FIG.

In FIG. 1, user Uj (j = 1, ..., N) belonging to a predetermined group should be used by user terminals 10 ₁ to 10 _n and a verifier V (Verifier). Person terminal 20 and a trusted third party (Trusted Au)
A center 100 (computer) managed by a network is connected to a predetermined network NW. In addition, in the above predetermined group or users other than that group,
For example, a user terminal 10i that is managed by a person who collects electronic voting and electronic questionnaire responses and an Escrow Agent 200 (computer) that is a predetermined institution are connected to the network NW.

In the above system, for example,
When a plurality of users Uj belonging to the above-mentioned predetermined group make an electronic vote, the process is performed according to the procedure shown in FIGS. 3 and 4.

In FIG. 3, the center 100 is a finite field F.
The polynomials F1 (x) and F2 (x) on q are randomly generated (S1), and the polynomials F1 (x) and F2 (x) are sent to the verifier terminal 20 via the network NW (S).
2). Upon receiving the polynomials F1 (x) and F2 (x) from the center 100 (S11), the verifier terminal 20 stores the set of polynomials in the storage device (S12).

The center 100 is further provided with Uj (j = j = n) of each of a plurality of users belonging to the predetermined group.
1, ..., N), and generate different random numbers rj that are the origins of the different finite fields Fq (S3). Specifically, first, one random number r1 that is the source of the finite field Fq is selected. Next, using the above polynomial F1 (x), F1
R2 'is randomly selected from all the sets of possible values of r2' satisfying (r2 ') ≠ F1 (r1). Furthermore, F1
(R3 ') ≠ F1 (r1) and F1 (r3') ≠ F1 (r2)
R3 is randomly selected from all the sets of possible values of r3 'that satisfy Hereinafter, similarly, each user U1 ~
N random numbers r1 to rn corresponding to Un are generated. That is, the random number rj assigned to the user Uj is F1 (r ') ≠ F1 (ri) with respect to the random numbers r i (i = 1, ..., N, i ≠ j) of all other users. 'Is randomly selected from the set of possible values. As a result, the random number rj corresponding to the user Uj is F1 with respect to the random numbers r i (i = 1, ..., N, i ≠ j) corresponding to all the other users.
(Rj) ≠ F1 (ri).

The center 100 substitutes the random number rj generated as described above into x of the polynomial equations F1 (x) and F2 (x) to generate a first value F1 (rj) and a second value F2 ( rj)
To generate. Then, the center 100 transmits the first value F1 (rj) and the second value F2 (rj) together with the random number rj to the user terminal 10j of the user Uj corresponding to the random number rj (S4).

The user terminal 10j receives the random number rj transmitted from the center 100 as described above and the first value F1 (r
j) and the second value F2 (rj) are received (S31). User Uj sends a message about the voting content to user terminal 1
When input to 0j, the user terminal 10j converts the message into the message information m which is the source of the finite field Fq, and the message information m and the received first value F
Using 1 (rj) and the second value F2 (rj), the value {F1
(Rj) + mF2 (rj)} is created. Then, the user terminal 10j further uses the random number rj and its value {F1 (rj).
+ MF2 (rj)}, an electronic signature {rj, F1 (rj) + mF2 (rj)} is created, and the electronic signature is added to the message information m. ) + MF2 (rj)} is created (S32).

The user terminal 10j transmits the signed information created as described above via the network NW to the user terminal 10i managed by the user who collects votes (S33). When the signed information is sent like this,
The process for voting on the user terminal 10j ends.

When the user terminal 10i receives the signed information from the user terminal 10j of the user Uj (S4).
1) It is determined whether the signed information needs to be verified (S42). This criterion can be set arbitrarily. For example, the signed information to be verified can be randomly determined. It is also possible to decide to verify all signed information.

When it is determined that it is not necessary to verify the received signed information (NO in S42), the message information m included in the signed information is stored in the user terminal 10i as the voting content. On the other hand, if it is determined that the received signed information needs to be verified (Yes in S42), the user terminal 10i requests the verification and the signed information {m, rj, received from the user terminal 10j. F1 (rj), F2 (rj)} is transmitted to the verifier terminal 20 (S43).

The verifier terminal 20 receives the request for verification and the signed information from the user terminal 10i (S1).
3), the value s1 = {F1 (r
j) + mF2 (rj)} is extracted. Further, the verifier terminal 20 further issues the polynomials F1 (x) and F2 (x) issued from the center 100 and stored in the storage device as described above.
Substituting the random number rj included in the above-mentioned signed information for x, and the message information m included in the signed information
Is used to calculate s2 = F1 (x) | x = rj + mF2 (x) | x = rj (S14) The verifier terminal 20 uses the two values s obtained as described above.
It is determined whether 1 and s2 match (S15). Since the verifier terminal 20 does not hold the information indicating the correspondence between the random number rj and the user, when the two values s1 and s2 match, the signed information {m, rj, F1 (rj) + mF2 Although it is not possible to specify the user who created (rj)}, it can be determined that it was created by any of the legitimate users belonging to the above group.

On the other hand, of the signed message, the message information m, the random number rj, and the value {F1 (rj) + mF2
If at least one of (rj)} is tampered with, the values s1 and s2 do not match. Therefore, when the values s1 and s2 do not match, it can be determined that the signed information has been tampered with.

Therefore, when it is determined that the values s1 and s2 match (yes in S15), the verifier terminal 20 generates a verification result that the signed information is valid (S).
16), and transmits the verification result to the user terminal 10i, which is the source of the verification request (S17). On the other hand, if it is determined that the values s1 and s2 do not match (no in S15), a verification result that the signed information is invalid is generated (S1).
8), the user terminal 1 that requests the verification result
0i (S19).

A verification request was made as described above (S
43) The user terminal 10i receives the verification result via the network NW (S44). When the verification result that the signed information is valid is received, the user terminal 10i processes the voting content represented by the message information m included in the signed information as a valid vote. On the other hand, when the verification result that the signed information is not valid is received, the user terminal 10i processes the voting content represented by the message information m included in the signed information as an invalid vote.

The verifier terminal 20 obtains a verification result that the signed information is valid (yes at S15).
s, S16), and after transmitting the verification result to the user terminal 10i (S17), in step S20 shown in FIG. 3, it is determined whether the user who created the signed information should be specified. The criterion can be set arbitrarily. For example, the user may be identified with respect to the verification result randomly determined. Further, the user can be specified for all the verification results (valid).

When it is determined that the user who created the signed information should be specified (Yes in S20), the verifier terminal 20 determines the random number rj included in the signed information and the polynomial stored in the storage device. The value F1 (rj) calculated using F1 (x) is transmitted to the exclusivity agent 200 (S21). As described above, the exclusivity agent 200, which has obtained the information indicating the correspondence between the value F1 (rj) and the user Uj from the center 100 (S51), is transmitted from the verifier terminal 20 in step S52 shown in FIG. Value F1 (rj) is received.

The exclusivity agent 200 searches the user Uj corresponding to the value F1 (rj) received from the verifier terminal 20 from the information indicating the correspondence between the value F1 (rj) and the user Uj (S53). . As a result of that search,
When the user Uj corresponding to the value F1 (rj) is obtained,
The exclusivity agent 200 transmits the identifier Uj that identifies the user to the verifier terminal 20 (S5).
4). Then, the verifier terminal 20 receives the identifier Uj that identifies the user from the exclusivity agent 200 (S22).

The verifier terminal 20 notified by the user Uj who created the signed information {m, rj, F1 (rj) + mF2 (rj)} in this way.
Manages the correspondence between the message information m included in the signed information and the user Uj who is the creator of the message information m. As a result, when it is necessary to specify the user who created the message information m for some reason, the relationship between the message information m managed by the verifier terminal 20 and the user who creates the message information m can be used. It will be possible. As a result, the user cannot deny that he or she created the message information m.

According to the system as described above, the verifier can verify that the person who created the signed information is any user who belongs to a predetermined group. Further, as described above, the signed information {m, rj, F1 (rj) + mF (rj)} is illegally acquired when the user terminal 10j transmits it to the user terminal 10i, and the message information m, the random number rj, and the value are acquired. When at least one of {F1 (rj) + mF (rj)} is tampered with, the verifier can detect the tampering. That is, it is not possible to tamper with the legitimate signed information while maintaining its legitimacy, using a computer of any computing capacity.

Furthermore, even if the message information m, the random number rj, and the value {F1 (rj) + mF2 (rj)} are illegally acquired, two values F1 (that determine the value {F1 (rj) + mF2 (rj)} are obtained. Since there are an infinite number of combinations of rj) and mF2 (rj), it is not possible to specify their respective values F1 (rj) and F2 (rj) by using a computer with any computing power.
An illicit person cannot impersonate a legitimate user.

From the information contained in the above-mentioned signed information, no matter what computer capacity is used,
The user who created the signed information cannot be specified. Further, even the verifier terminal 20 cannot individually identify the user who created the signed information.

Further, the verifier terminal 20 and the exclusivity agent 200 cooperate to specify the user who created the above-mentioned signed information. In addition, any legitimate user belonging to a predetermined group cannot create legitimate signed information that does not make it clear that the user has created it.

The system shown in FIG. 1 can include a plurality of verifier terminals. In this case, for example, the process is performed according to the procedure shown in FIGS. 4 and 5. When there are a plurality of verifier terminals in this way, the correctness of the signed information can be verified by any verifier terminal.

In FIG. 4, the center 100 is a finite field F.
The bivariate polynomials F1 (x, y) and F2 (x, y) on q are randomly generated (S101), and an identifier Vk that specifies each of the plurality of verifiers is generated (S102). Then, the center 100 uses the bivariate polynomial F1 (x, y).
And polynomials F1 (x, Vk) and F2 (x, V) obtained by substituting the verifier's identifier Vk for y of F2 (x, y).
k) is transmitted to the verifier terminal 20k specified by the identifier Vk via the network NW (S103). The verifier terminal 20k receives the above polynomial F1 from the center 100.
When (x, Vk) and F2 (x, Vk) are received (S11)
1) Store the set of polynomials in a storage device.

The center 100 further includes Uj (j = 1, ...) Of a plurality of users who belong to a predetermined group.
.., n) corresponding to different finite fields Fq
A random number rj that is the source of is generated (S104). The random number rj corresponding to this user Uj is F1 with respect to the random numbers r i (i = 1, ..., N, i ≠ j) corresponding to all other users.
It is determined that (rj, y) ≠ F1 (ri, y).

The center 100 uses the random number rj generated as described above for the two-variable polynomials F1 (x, y) and F2.
Substituting x in (x, y), polynomials F1 (rj, y) and F2 (rj, y) are generated. And the center 100
Together with the random number rj, the polynomials F1 (rj, y) and F2
(Rj, y) is transmitted to the user terminal 10j of the user Uj corresponding to the random number rj (S105).

The user terminal 10j has the random number rj transmitted from the center 100 as described above and the polynomial F1 (rj,
y) and F2 (rj, y) are received (S131). Similarly to the above-described example, when the user Uj inputs a message regarding the voting content into the user terminal 10j, the user terminal 10j
Converts the message into message information m which is the source of the finite field Fq, and uses the message information m and the received polynomials F1 (rj, y) and F2 (rj, y) to generate a polynomial { Create F1 (rj, y) + mF2 (rj, y)}. Then, the user terminal 10j further includes the random number rj and its polynomial {F1 (rj, y) + mF2 (rj,
y)} and a digital signature {rj, F1 (rj, y) + mF2 (rj, y)} which is paired with the signature information {m, rj, F1 (Rj, y) + mF2 (rj, y)} is created (S132).

The user terminal 10j transmits the signed information created as described above to the user terminal 10i via the network NW (S133). When the signed information is transmitted in this way, the process regarding voting in the user terminal 10j ends.

When the user terminal 10i receives the signed information from the user terminal 10j of the user Uj (S1).
41), it is determined whether or not the signed information needs to be verified (S142). If it is determined that the signed information does not need to be verified (No in S142), the message information m included in the signed information is m.
Is stored in the user terminal 10i as the voting content.
On the other hand, when it is determined that the received signed information needs to be verified (Yes in S142), the user terminal 1
0i is the same as in the above-mentioned example, the signed information {m, rj, F1 (rj, y) + mF2 (rj, y)} received from the user terminal 10j together with the verification request is transmitted to a plurality of verifier terminals. Of the two, for example, the verifier terminal 2
It is transmitted to 0k (S143).

The verifier terminal 20k receives the signed information together with the verification request from the user terminal 10i (S
113), the polynomial F1 (r included in the signed information
j, y) + mF2 (rj, y) is substituted with the identifier Vk for identifying the verifier who manages the terminal 20k, and the value s1 is expressed as s1 = F1 (rj, Vk) + mF2 (rj, Vk). calculate. Further, the verifier terminal 20k
Is obtained by substituting the random number rj included in the signed information for x of the polynomials F1 (x, Vk) and F2 (x, Vk) issued from the center 100 as described above and stored in the storage device. Using the message information m included in the signed information, the value s2 is calculated as s2 = F1 (x, Vk) | x = rj + mF2 (x, Vk) | x = rj (S114).

The verifier terminal 20k determines whether or not the two values s1 and s2 obtained as described above match (S115). Also in this case, as in the above example, when the two values s1 and s2 match (yes in S115).
s), the verifier terminal 20k generates a verification result that the signed information is valid (S116), and transmits the verification result to the user terminal 10i which is the requester of the verification (S116).
117). On the other hand, if it is determined that the values s1 and s2 do not match (no in S115), a verification result that the signed information is invalid is generated (S118), and the verification result is the verification request source. It is transmitted to the user terminal 10i (S119).

A verification request was made as described above (S
143) When the user terminal 10i receives the verification result that the signed information is valid, as in the above-described example (S144), the vote represented by the message information m included in the signed information. Process the content as a valid vote. On the other hand, when the verification result that the signed information is not valid is received (S144), the user terminal 10i processes the voting content represented by the message information m included in the signed information as an invalid vote.

The verifier terminal 20k obtains a verification result that the signed information is valid (Y in S115).
es, S116), and the verification result is the user terminal 10
After sending to i (S117), step S shown in FIG.
At 120, it is determined whether the user who created the signed information should be identified. If it is determined that the user who created the signed information should be specified (Yes in S120), the verifier terminal 20k determines the random number rj included in the signed information and the polynomial stored in the storage device. Value F1 (rj, Vk) calculated using F1 (x, Vk)
Is transmitted to the exraw agent 200 (S12).
1). As described above, the exclusivity agent 200, which has obtained the information indicating the correspondence between the polynomial F1 (rj, y) and the user Uj from the center 100 (S151), in step S152 shown in FIG. 5, the verifier terminal 20k.
The value F1 (rj, Vk) transmitted from is received.

Based on the information indicating the correspondence between the polynomial F1 (rj, y) and the user Uj, the exclus- tion agent 200 becomes F1 (rj, Vk) = F1 (rj, y) | y = Vk. User U corresponding to the polynomial F1 (rj, y)
j is specified (S153). Then, the exposure agent 200 transmits the identifier Uj that identifies the user to the verifier terminal 20k (S154). Then, the verifier terminal 20k receives the identifier Uj specifying the user from the exclusivity agent 200 (S12).
2).

In this way, the verifier terminal 20k that has received the notification of the user Uj who has created the signed information {m, rj, F1 (rj, y) + mF2 (rj, y)}.
Manages the correspondence between the message information m included in the signed information and the user Uj who is the creator thereof, as in the above-described example. Thus, when it is necessary to specify the user who created the message information m for some reason, the relationship between the message information m managed by the verifier terminal 20k and the user who is the creator thereof is used. Is possible.

Although the system for performing processing in accordance with the procedure shown in FIGS. 4 and 5 has a plurality of verifier terminals, the same procedure can be performed even if a single verifier terminal is provided. It is possible to verify the signed information. However, if multiple verifier terminals are provided, a user who needs to verify the signed information requests the verifier terminal to any verifier terminal in consideration of the communication cost, the processing status of each verifier terminal, and the like. Therefore, the convenience is improved.

Even in the system that performs processing according to the procedure shown in FIGS. 4 and 5, verification that information was created by a legitimate user, non-specificity of the creator, information tampering prevention, and fraudulent user With regard to the prevention of spoofing, the denial of creation of message information by a legitimate user, and the like, it is possible to obtain the same effects as the above-described example (see FIGS. 2 and 3).

In each of the above examples, various information (F1 (x), F2) is sent from the center 100 to the verifier terminal 20 (20k), the user terminal 10j, and the escrow agent 200.
(X), F1 (rj), F2 (rj), rj, and the relationship between F1 (rj) and Uj) are transmitted via the network NW. In order to realize the verification of the signed information as described above, the various kinds of information are issued from the center 100 to the verifier, the user, and a predetermined institution by using communication means such as facsimile, telephone, and mail. You may do it. The various information issued in this way is sent to the verification terminal 20 (20k) by the verifier, to the user terminal 10i by the user, and the predetermined institution (escrow agent).
In the above, they may be input to the computer (200).

[0062]

As described above, according to the first and fourth aspects.
According to the present invention described, if any of a plurality of pieces of information included in a digital signature is tampered with, it is possible to detect that the tampering has occurred, and the elements of the structure of the digital signature can be obtained from information that can be known to others. (A pair of F1 (rj) and mF2 (rj) and a pair of F1 (rj, y) and mF2 (rj, y)) cannot be logically reproduced. Therefore, it is possible to realize a so-called electronic signature structure capable of guaranteeing the so-called quantitative security of information, which cannot be fraudulently used by a computer of any performance.

According to the present invention as set forth in claims 2, 3, 5 to 10, a method and system for verifying signed information created by adding the above-mentioned electronic signature to message information is realized. can do.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration example of a system to which a signed information verification method according to an embodiment of the present invention is applied.

FIG. 2 is a sequence diagram showing a first example of a processing flow in the system shown in FIG.

FIG. 3 is a sequence diagram showing a flow of processing subsequent to the flow of processing shown in FIG.

FIG. 4 is a sequence diagram showing a second example of a processing flow in the system shown in FIG.

5 is a sequence diagram showing a flow of processing subsequent to the flow of processing shown in FIG.

[Explanation of symbols]

10i, 10j, 10 ₁ to 10 _n user terminal 20, 20 k verifier terminal 100 center 200 exclo agent

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Junji Shikata             5-11-15 Seta, Setagaya-ku, Tokyo Soleil             Seta II Building No. 205 (72) Inventor Hideki Imai             Kanagawa Prefecture Yokohama City Totsuka Ward Shinanomachi 557-44-205 F term (reference) 5J104 AA08 EA27 FA00 LA06 NA16

Claims (10)

[Claims] 1. It should be added to message information m which is a source of a finite field Fq created at a terminal of each of a plurality of users Uj (j = 1, ... N) belonging to a predetermined group. In the structure of the electronic signature, a random number rj which is a source of the finite field Fq generated differently corresponding to each user Uj, and a randomly generated polynomial F1 on the finite field Fq.
A value {F1 calculated using values F1 (rj) and F2 (rj) obtained by substituting the random number rj into (x) and F2 (x).
A structure of a digital signature having a pair of (rj) + mF2 (rj)}. 2. The signed information created at each terminal of Uj (j = 1, ..., N) of a plurality of users belonging to a predetermined group is assigned to any user who belongs to the predetermined group. In the signed information verification method for verifying this, the polynomials F1 (x) and F2 (x) on the finite field Fq are randomly generated in a predetermined center. And the Uj of each of a plurality of users belonging to a predetermined group.
Using the step of generating random numbers rj that are the bases of the different finite fields Fq corresponding to (j = 1, ..., N) and the polynomials F1 (x), F2 (x) and the random numbers rj, Calculating the first value F1 (rj) and the second value F2 (rj), issuing the polynomials F1 (x), F2 (x) to the verifier, and generating the random number rj, the first value F1 (rj) and a second value F2 (rj) are issued to the user Uj, and the finite field Fq created in the terminal of the user Uj is executed by the terminal of the verifier. A set of the random number rj and a value {F1 (rj) + mF2 (rj)} calculated from the first value F1 (rj) and the second value F2 (rj) in the message information m which is the source of The step of obtaining the signed information {m, rj, F1 (rj) + F2 (rj)} to which is added; And message information m and a random number rj included in come information, the issued verifier polynomial F1 (x), F2
(X) and the step of calculating the value of F1 (x) | x = rj + mF2 (x) | x = rj, and the value {F1 (rj) + mF2 (rj) included in the signed information. )} Is determined, and the determination result is a verification result that the signed information is created by any user belonging to the predetermined group. Signed information verification method. 3. The signed information verification method according to claim 2, wherein the step of generating a random number rj assigned to the user Uj is a random number r i (i = 1, ...
, N, i ≠ j), a random number rj that satisfies F1 (rj) ≠ F1 (ri) is generated, and the first value F1 (rj) and the random number rj are executed in the center. The verifier provided the first value F1 (rj), which has a step of issuing information indicating a correspondence relationship with the corresponding user Uj to a predetermined institution. At the time, there is a step of specifying the user Uj corresponding to the first value F1 (rj) based on the information indicating the relationship between the first value F1 (rj) and the user Uj issued from the center. Signed information verification method. 4. The message information m, which is the source of the finite field Fq created at the terminals Uj (j = 1, ... N) of a plurality of users belonging to a predetermined group, should be added. In the structure of the electronic signature, a random number rj, which is a source of the finite field Fq generated differently corresponding to each user Uj, and a randomly generated bivariate polynomial F1 (x) on the finite field Fq. , Y), F2 (x, y), one of the polynomials F1 (rj, y), F2 obtained by substituting the random number rj into one variable x.
A polynomial {F1 (rj, rj calculated by using (rj, y)
y) + mF2 (rj, y)}, the structure of the electronic signature. 5. The signed information created in each terminal of Uj (j = 1, ..., N) of a plurality of users belonging to a predetermined group is assigned to any user who belongs to the predetermined group. In the signed information verification method for verifying this, the two-variable polynomials F1 (x, y), F2 (x, on the finite field Fq are executed at a predetermined center.
y) at random, and using the identifier Vk that is the element of the finite field Fq that identifies the verifier and the bivariate polynomials F1 (x, y) and F2 (x, y), the polynomial F1 ( x, Vk) and F2 (x, Vk), and a plurality of users Uj (j = 1, 1) belonging to a predetermined group.
, N) corresponding to each of the different finite fields Fq, which is the source of the random numbers rj, and the two-variable polynomials F1 (x, y), F2 (x, y) and the random numbers rj. Using the polynomials F1 (rj, y), F2 (rj,
y), and the polynomial F1 (x, Vk) and F2 (x, Vk) from the verifier V
is issued to k, and the random number rj and the polynomial F1 (r
j, y) and F2 (rj, y) are issued to the user Uj, and the finite field Fq created in the terminal of the user Uj is executed in the terminal of the verifier Vk. In the message information m which is the source of the above, the random number rj and the polynomial {F1 (rj, y) + mF2 (rj, y)} calculated from the above polynomials F1 (rj, y) and F2 (rj, y) Acquiring the signed information {m, rj, F1 (rj, y) + F2 (rj, y)} with the set added, and the polynomial {F1 (rj, y) + included in the signed information.
Using mF2 (rj, y)}, the value of {F1 (rj, y) + mF2 (rj, y)} | y = Vk and the polynomials F1 (x, Vk), F2 issued to the verifier Vi.
(X, Vk) and the message information m and random number rj included in the signed information, F1 (x, Vk) | x = rj + mF2 (x, Vk) | x = rj , Verifying that the signed information is created by one of the users belonging to the predetermined group. The resulting signed information verification method. 6. The signed information verification method according to claim 5, wherein the step of generating a random number rj assigned to the user Uj is a random number r i (i = 1, ...
.., n, i ≠ j, F1 (rj, y) ≠ F1 (ri,
y) The random number rj is generated, and at the same time, the information indicating the correspondence between the polynomial F1 (rj, y) and the user Uj corresponding to the random number rj, which is executed in the center, is issued to a predetermined institution. When the value F1 (rj, Vk) obtained by the calculation of F1 (x, Vk) | x = rj is provided from the verifier Vi, which has steps and is executed in the predetermined engine. , Polynomial F1 (rj, y) such that F1 (rj, Vk) = F1 (rj, y) | y = Vk based on the information indicating the correspondence between the polynomial F1 (rj, y) and the user Uj. ) Corresponding to user U
A message verification method comprising the step of identifying j. 7. The signed information created at each terminal Uj (j = 1, ..., N) of a plurality of users belonging to a predetermined group is assigned to any user who belongs to the predetermined group. In the signed information verification system for verifying this, the predetermined center has means for randomly generating polynomials F1 (x) and F2 (x) on the finite field Fq, and a predetermined center. Uj for each of multiple users in the group
Using means for generating different random numbers rj that are the elements of the finite field Fq corresponding to (j = 1, ..., N) and the polynomials F1 (x), F2 (x) and the random numbers rj, Means for calculating the first value F1 (rj) and the second value F2 (rj), and issuing the polynomials F1 (x), F2 (x) to the verifier, and the random number rj, first value F1 (rj) and means for issuing the second value F2 (rj) to the user Uj, and the verifier's terminal is the source of the finite field Fq created in the terminal of the user Uj. A pair of the random number rj and a value {F1 (rj) + mF2 (rj)} calculated from the first value F1 (rj) and the second value F2 (rj) is added to the message information m. A means for obtaining the signed information {m, rj, F1 (rj) + F2 (rj)}, and the message included in the signed information Distribution m and a random number rj and polynomials F1 issued to the verifier (x), F2
(X) is used to calculate the value of F1 (x) | x = rj + mF2 (x) | x = rj, and the value {F1 (rj) + mF2 (rj) included in the signed information. )} Is determined, and the determination result is used as a verification result that the signed information is created by any user belonging to the predetermined group. Signed information verification system. 8. The signed information verification system according to claim 7, wherein the means for generating the random number rj assigned to the user Uj is a random number r i (i = 1, ...
In addition to generating a random number rj that satisfies F1 (rj) ≠ F1 (ri) for n, i ≠ j), the center further sets the first value F1 (rj) and the random number rj. It has means for issuing information indicating a correspondence relationship with the corresponding user Uj to a predetermined institution, and the predetermined institution, when the first value F1 (rj) is provided from the verifier, Signed information having means for specifying the user Uj corresponding to the first value F1 (rj) based on the information indicating the relationship between the first value F1 (rj) and the user Uj issued from the center. Verification system. 9. The signed information created at each terminal of Uj (j = 1, ..., N) of a plurality of users belonging to a predetermined group is assigned to any user who belongs to the predetermined group. In the signed information verification system that verifies this, the predetermined center is a bivariate polynomial F1 (x, y), F2 (x, on the finite field Fq.
y) at random, and using the identifier Vk that is the element of the finite field Fq that specifies the verifier and the bivariate polynomials F1 (x, y) and F2 (x, y), the polynomial F1 ( x, Vk), F2 (x, Vk), and a plurality of users Uj (j = 1, 1) belonging to a predetermined group.
, N) corresponding to each of the different finite fields Fq to generate random numbers rj, and the two-variable polynomials F1 (x, y), F2 (x, y) and the random numbers rj Using the polynomials F1 (rj, y), F2 (rj,
y) and a polynomial F1 (x, Vk) and F2 (x, Vk) as the verifier V
is issued to k, and the random number rj and the polynomial F1 (r
j, y) and means for issuing F2 (rj, y) to the user Uj, and the terminal of the verifier Vk is an element of the finite field Fq created in the terminal of the user Uj. A set of the random number rj and a polynomial {F1 (rj, y) + mF2 (rj, y)} calculated from the polynomials F1 (rj, y) and F2 (rj, y) is added to the message information m. Means for obtaining the signed information {m, rj, F1 (rj, y) + F2 (rj, y)} and the polynomial {F1 (rj, y) + included in the signed information.
Using mF2 (rj, y)}, the value of {F1 (rj, y) + mF2 (rj, y)} | y = Vk and the polynomials F1 (x, Vk), F2 issued to the verifier Vi.
(X, Vk) and means for calculating F1 (x, Vk) | x = rj + mF2 (x, Vk) | x = rj using the message information m and the random number rj included in the signed information. , Verifying that the signed information has been created by any user who belongs to the predetermined group, and a means for determining whether or not each of the above values match. The resulting signed information verification system. 10. The signed information verification system according to claim 9, wherein the means for generating a random number rj assigned to the user Uj is a random number r i (i = 1, ...
For n, i ≠ j, F1 (rj, y) ≠ F1 (ri, y)
The center further generates a random number rj, and the center further issues information indicating the correspondence between the polynomial F1 (rj, y) and the user Uj corresponding to the random number rj to a predetermined institution. When the value F1 (rj, Vk) obtained by the calculation of F1 (x, Vk) | x = rj is provided from the verifier Vi, the predetermined institution has the polynomial F1 ( rj, y) and a user Uj, based on the information indicating the correspondence, F1 (rj, Vkd) = F1 (rj, y) | y = Vk A user corresponding to the polynomial F1 (rj, y) U
A signed information verification system having means for identifying j.