JP2004289247A - Method of using service, user apparatus, service using and processing program, service provider apparatus, service providing processing program, certificate management apparatus, certificate management program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide the method of using services or the like wherein the anonymity is secured. <P>SOLUTION: A user apparatus 200 transmits a first certificate generated by the user apparatus 200 through anonymous authentication to a certificate management apparatus 300, and receives a plurality of first certificates generated by apparatuses other than the user apparatus 200 from the certificate management apparatus 300. The user apparatus 200 transmits a group of the first certificates to a service provider apparatus 100. The service provider apparatus 100 checks a blind signature of each of the received group of the first certificates, checks a ring signature when the check of the blind signature is successful, calculates a challenge when the checking of the ring signature is successful, and transmits the calculated challenge to the user apparatus 200. The user apparatus 200 generates a response on the basis of the received challenge and transmits the response to the service provider apparatus 100. The service provider apparatus 100 checks the received response and provides the service when the checking is successful. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a service using method using anonymous authentication for authenticating information held by a user while ensuring the anonymity of the user, a user device, a service using process program, a service provider device, a service providing process program, and certificate management. The present invention relates to an apparatus, a certificate management program, and a recording medium.
[0002]
[Prior art]
"Public key certificate", "attribute certificate", "rights certificate", etc. are proposed as the framework of the electronic certificate used to authenticate the host (computer terminal) and the user as the subject to be authenticated. (See Non-Patent Documents 1 and 3). Authentication using these certificates is more resistant to unauthorized attacks such as user spoofing and eavesdropping on a network than authentication using IDs and passwords that are widely used at present. Therefore, it can be said that it is suitable for application to fields where it is strongly required to eliminate illegal attacks from the outside such as the medical field and electronic municipalities.
[0003]
However, the above-described authentication method does not consider the privacy of the user, that is, the owner of the digital certificate, but can identify the user who is the owner from the certificate. Even though the user's personal information was not directly known, the personal information could be tracked indirectly from the digital certificate.
[0004]
On the other hand, in recent years, in consideration of the protection of the privacy of the user, an authentication method has been proposed in which it is not possible to identify who the user is from the electronic certificate and only the right possessed by the user can be confirmed (Non-Patent Document) 4). This method uses a unique digital certificate that guarantees the user's personal information, rights, attributes, etc., and confirms the validity of the certificate with the entity that issues this certificate (hereinafter referred to as the issuer). The purpose is to clearly separate the entity that provides the service after confirmation (hereinafter, referred to as a verifier), and to ensure the privacy of the user on the premise that both parties do not collude. The issuer acquires information such as personal information, rights, and attributes of the user in advance, and issues an electronic certificate unique to the method to the user after examination. On the other hand, the verifier of the digital certificate verifies the anonymous digital certificate presented by the user, so that the user does not know who the user is, that is, does not know information such as the user's personal information, rights, attributes, etc. Even so, the service is provided to the user by confirming the validity of the electronic certificate.
[0005]
On the other hand, there are methods described in Patent Literatures 1, 2, 3, and Non-Patent Literature 5 that apply cryptography to further protect user privacy. This method makes it difficult for the issuer as well as the verifier of the certificate to associate the certificate with the user who owns the certificate in cryptography. In addition, in this method, even if the certificate issuer storing information such as the user's personal information, rights, and attributes simultaneously becomes the certificate verifier, the certificate verification stage Seemingly conflicting situations in which the user who owns is unknown. Hereinafter, this method is referred to as “anonymous authentication method”.
[0006]
In the anonymous authentication method, the issuer device that issues the certificate and the verifier device that verifies the certificate may each be owned by a different entity, or one and the same entity may have two devices. .
[0007]
The certificate issuer knows the user's personal information, rights, attributes, etc., and gives the user a certificate that guarantees the contents of the certificate (user's personal information, rights, attributes, etc.) by a blind signature. Issue. Details of the blind signature are described in Non-Patent Document 2.
[0008]
In the following, an electronic certificate created by anonymous authentication and associated with specific information and a user's public key is referred to as a “first certificate” for convenience.
[0009]
A specific mechanism for securing anonymity by the anonymous authentication method will be described.
[0010]
As a premise, before issuing the first certificate, a message M such as personal information of the user is set in advance by offline processing such as mailing or by online processing between the user apparatus and the issuer apparatus and the verifier apparatus. To the issuer device.
[0011]
First, the user equipment sets a random number r _j , W _j And public key P _u And secret key S _u And a function value Z represented by the following equation _j And the function value Z is stored in the issuer device. _j Send
[0012]
Z _j = P _sp (R _j ) G _B (G _A (P _u ｜｜ w _j ) || M) for 1 ≦ j ≦ N
Here, “||” represents a bit combination and g _A (•), g _B (•) represents a publicly-aware collision-resistant one-way hash function. These one-way hash functions g that are difficult to collide with _A (•) and g _B (·) May be the same function (the same algorithm). Also, P _sp Represents a public key widely published by the issuer, and M represents a specific message.
[0013]
Note that the public key P _u Does not disclose it to anyone at the stage of issuing the first certificate.
[0014]
The issuer device receives the Z _j Among them, any R are determined, and the corresponding _k ｝ (1 ≦ k ≦ R), Z _k The random number r required to calculate _k , Function value g _A (P _u ｜｜ w _k ) Is requested to the user apparatus.
[0015]
The user device receives Z from the issuer device. _k The Z parameter for (1 ≦ k ≦ R) is transmitted.
[0016]
The issuer device calculates the following equation Z based on the Z parameter: _k And calculate the received Z _j Verify whether or not matches.
[0017]
Z _k = P _sp (R _k ) G _B (G _A (P _u ｜｜ w _k ) || M) for 1 ≦ k ≦ R
If they do not match, it is determined that the certificate cannot be issued, and the first certificate issuing procedure ends. If they match, the undisclosed Z _i The following Z for (1 ≦ i ≦ NR) _i Perform a provisional blind signature on.
[0018]
pre-SIG _SP = S _sp (Π _i Z _i )
Where S _sp Represents the secret key of the issuer device. Also, “Π _i "Is a multiplication for all i (here Z ₁ × Z ₂ ×… × Z _NR ).
[0019]
Obtained provisional blind signature pre-SIG _SP Is sent to the user equipment.
[0020]
The user equipment receives the provisional blind signature pre-SIG _SP To perform a digital signature extraction process for executing the following calculation.
[0021]
SIG _SP = Pre-SIG _SP / Π _i r _i for all i (Π _i r _i = R ₁ × r ₂ ×… × r _NR )
Also, the following is collectively stored as the first certificate.
[0022]
Cert = [M, ｛w _i ｝, P _u , SIG _SP ] For all i
Where ｛w _i ｝ = ｛W ₁ , W ₂ , ..., w _NR ｝.
[0023]
Thus, the first certificate issuing process is completed.
[0024]
Next, a procedure for using the first certificate will be described.
[0025]
The user device sends the first certificate Cert to the verifier device.
[0026]
The verifier uses M, $ w included in the Cert received from the user device. _i ｝, P _u Using
Y _i = G _B (G _A (P _u ｜｜ w _j ) || M) for 1 ≦ j ≦ N
Is calculated, it is determined whether or not the following expression is satisfied.
[0027]
Π _i Y _i = P _sp (SIG _SP )
After it is confirmed that the above formula holds, a challenge / response method is used to confirm that the presented first certificate Cert is not illegally obtained by a user other than a valid user. . Specifically, the verifier uses the public key P _u Is used to calculate the challenge and send it to the user device. The user device has a secret key S _u Is used to calculate the response to the challenge and send it to the verifier device. The verifier verifies the received response. If the response is confirmed to be correct, the validity of the owner of the Cert has been verified.
[0028]
This proves that the user has issued the first certificate from the issuer and that he is a valid owner of the first certificate Cert.
[0029]
FIG. 1 is a conceptual diagram of the mechanism of the anonymous authentication method. As shown in FIG. 1, when user A, user B, and user C use first certificates Cert of A, Cert of B, and Cert of C, respectively, when the first certificate is issued, the user's personal Blind signature S as information and the original information of the blind signature issued to the user _sp (Π _i Z _i ) Can be associated and stored. This is the temporary blind signature S _sp (Π _i Z _i ) Provided by the user necessary for generating _i And Z _i This is because the Z parameter required for calculation includes user-specific information.
[0030]
However, when the first certificate is verified, there is no correspondence between the first certificates Cert of A, Cert of B, and Cert of C and the personal information of the user, so the first certificate returned Can be distinguished from each other, but it is the first data to be seen.
[0031]
As described above, a notable point of this anonymous authentication method is that the service provider as the issuer remembers who issued what kind of first certificate at the stage of issuing the first certificate. (The data that the issuer can store when the first certificate is issued is S _sp (Π _i Z _i )), When the first certificate is used and returns to the issuer itself, the first certificate (when the first certificate returns, SIG _SP Data) is not available to know who issued it. However, since the first certificate includes the temporary blind signature by the issuer himself, the issuer must admit that the first certificate was issued by himself.
[0032]
As described above, according to this anonymous authentication method, even if the same entity such as a service provider issues the first certificate to the user and verifies it, the privacy of the user is protected. Has advantages. For example, the service provider cannot know which member of the service provider used the service, and can confirm that the service provider is a member of the service provider.
[0033]
In addition to a blind signature technique for concealing "user information", a ring signature scheme (for example, see Non-Patent Document 6) that applies cryptography as a technique that can conceal "who is the signer" can be concealed. is there. The ring signature method will be described below in comparison with a normal signature.
[0034]
A typical signature method (such as an RSA signature) is generally performed, for example, by the steps shown in the flowchart of FIG. Signer A has signature key S _A And the corresponding verification key P _A Is acquired (s121). Here, the signature key S _A Is not disclosed and the verification key P _A Publish.
[0035]
Signer A has signature key S _A To calculate the signature SIG (s122).
[0036]
The verifier is a verification key P published by the signer A. _A To verify the signature SIG (s123).
[0037]
Therefore, the verifier of the signature verifies the verification key P _A Is used, it can be known that the signer is the signer A.
[0038]
On the other hand, a ring signature is a method of verifying a signature without informing the verifier of who the signer is. Specifically, for example, the signature is performed in the following steps along the flowchart shown in FIG.
[0039]
First, the signer A uses the signature key S _A And the corresponding verification key P _A Are acquired (s131). Here, the signature key S _A Is not disclosed and the verification key P _A Publish.
[0040]
Next, the signer A obtains another verification key P not owned by the signer A by a predetermined means. _B , P _c , P _D Are collected (s132).
[0041]
Next, signer A verifies verification key P _A , P _B , P _c , P _D … And signature key S _A Is used to calculate the signature SIG (s133).
[0042]
On the other hand, the verifier uses the verification key P _A , P _B , P _c , P _D .. Are verified (s134). For the verifier, the SIG is converted to a plurality of verification keys P _A , P _B , P _c , P _D ..., the signature key used for the SIG calculation is the verification key P _A , P _B , P _c , P _D I don't know which of the ... signing keys it corresponds to. However, the verifier cannot perform verification unless the signature key corresponds to one of the verification keys. Therefore, it is possible for the user to verify the signature without informing the verifier of who the signer is.
[0043]
In a blind signature, in a model where there is a "signer of the signature" and a "signer of the signature" at the time of signing, the "signer of the signature" tells the "signer" the "what" This is a technology that keeps secret. On the other hand, the ring signature is a technique for concealing "who" signed in a model in which only the "signer" exists at the time of signature.
[0044]
[Patent Document 1]
JP 2000-231331 A
[Patent Document 2]
JP 2001-134182 A
[Patent Document 3]
JP 2001-188775 A
[Non-patent document 1]
"PKI Handbook" by Fumiko Komatsu, Soft Research Center Co., Ltd., issued November 25, 2000, p. 41-68, “Chapter 3 3.1 Public Key Certificate”, p. 82-83 “3.3.1 Attribute Certificate”
[Non-patent document 2]
Okamoto Tatsuaki, Yamamoto Hiroshi, "Modern Cryptography", Industrial Books, p. 184, issued June 30, 1998
[Non-Patent Document 3]
Carl Ellisson, "SPKI Certificate Theory, RFC 2693 3.3 SPKI Certificates, 6.1.5 5-tuple Defined," [online], September 1999, [Search February 27, 2003], Internet <h /// www. faqs. org / rfcs / rfc2693. html>
[Non-patent document 4]
Takamichi Saito, Kentaro Umezawa, Hiroshi Okuno, "One Method of Access Control System with Emphasis on Privacy", IEICE Journal, DI, Vol. J84-DI, no. 11, p. 1553-1562, 2001
[Non-Patent Document 5]
Naoyuki Sato, Hideaki Suzuki, "Authentication method that allows rights to be exercised anonymously," Transactions of Information Processing Society of Japan, Vol. 41, no. 8, p. 2138-2147, 2000
[Non-Patent Document 6]
R. L. Rivest, A .; Shamir, and Y. Tauman, "How to leak a secret," Advances in Cryptology-Assistance 2001, LNCS 2248, p. 552-565, Springer-Verlag, 2001
[0045]
[Problems to be solved by the invention]
As described above, the anonymous authentication method means that even if the issuer of the first certificate knows in advance the information that can identify the user, the first certificate issued by the issuer to the user is the issuer himself. When returning to, it is not possible to identify which user the first certificate belongs to. "
[0046]
Accordingly, there is a feature that the anonymity of the user can be maintained even when the same entity issues and verifies the first certificate. Considering this feature, the anonymous authentication method is applied to service providers who register users as members and provide services, as implemented by existing Internet service providers (ISPs). It can be said that it is possible. In this case, for example, the service provider issues a first certificate when registering a user as a member, and when providing a service in response to a user request, a first certificate presented by the user. An operation such as authentication by verifying a certificate can be considered.
[0047]
However, in the above-described operation, the issuance and verification of the first certificate is performed in response to a request from the user, and the issuance and verification of the first certificate are performed in an arbitrary time series. It is expected to be. When the issuance and verification of the first certificate are performed in an arbitrary time series, there are users whose anonymity is not effectively guaranteed even if they have the same certificate contents (that is, user information). Situation can occur.
[0048]
FIG. 4 is a diagram for explaining the problem of the anonymous authentication method. In the following, it is assumed that both the issuance and verification of the first certificate are performed by the “service provider”, and that all users have the same certificate contents (that is, user information). In the following description, the service provider and the users A, B, and C exchange information. However, the communication is substantially realized by data communication between the service providing server and each user device via a network.
[0049]
First, the service provider issues a first certificate to the user A (s501), and the user A extracts a blind signature (s501a). Specifically, the received temporary blind signature is converted to a random number r _A Divide by. Note that the service provider actually issues the provisional blind signature pre-SIG. _SP And the provisional blind signature pre-SIG _SP From the user side blind signature SIG _SP And extract the blind signature SIG _SP M, the random number w of which is to be proved _k , Public key P _u To the first certificate Cert.
[0050]
Next, the service provider issues a first certificate to the user B (s502), and the user B executes the above-described extraction of the blind signature (s502a). Specifically, the received temporary blind signature is converted to a random number r _B Divide by. Next, the user A uses the first certificate, that is, sends the first certificate Cert of A to the service provider. From the viewpoint of the service provider, the probability that the first certificate belongs to the user A is 、, and the probability that the first certificate belongs to the user B is １ ／. At this time, since the user A is not identified from the first certificate, the anonymity can be secured. Then, the user B uses the first certificate. Also in this case, anonymity can be ensured as in the case of the user A. However, next, when the service provider issues the first certificate to the user C (s521), and then the user C uses the first certificate before issuing the first certificate to another user, (S522) The service provider knows that the first certificate received from the user C belongs to the user C with a probability of 1. This is because at least the service provider has memorized that the users A and B have already used the first certificate.
[0051]
As is clear from the above description, even if there are a plurality of users other than the user, the user cannot recognize his or her anonymity unless there is at least one object that cannot be distinguished from the user. Cannot be secured for service providers. This problem is caused by the fact that there is no user who cannot be identified from himself. Conversely, since the user A and the user B are mutually indistinguishable users, it is possible to ensure anonymity with respect to the service provider.
[0052]
In the anonymous authentication model in which the user receives one first certificate and uses the one first certificate, the service provider determines the number of returned first certificates from the number of returned first certificates. , How many users are using the first certificate can be stored. If it is stored that "all users who have issued the first certificate have already used the first certificate", the anonymity of the user who is newly issued the first certificate is guaranteed. Will not be.
[0053]
The present invention has been made in order to solve the above-mentioned problem, and an object of the present invention is to issue a first certificate at any time except when only one user has the same certification content. Service use method, a user device, a service use processing program, a service provider device, a service provision processing program that can always keep the first certificate owner of this user confidential from the service provider , A certificate management device, a certificate management program, and a recording medium.
[0054]
[Means for Solving the Problems]
The gist of the present invention is as follows.
[0055]
According to the present invention, first, a user who is a service user collects certification contents, that is, first certificates held by other users having the same user information, and verifies the plurality of collected first certificates at once. To the service provider who is This process will be described with reference to the example of FIG. 4 described above. Instead of providing the service provider with the “first certificate used by the user C” in (s522), the user “user A” Are provided to the service provider, including a first certificate used by the user, a first certificate used by the user B, and a first certificate used by the user C. Will be used.
[0056]
At this time, the service provider cannot know which of the three presented first certificates the first certificate created by the user C is.
[0057]
However, simply providing a plurality of different first certificates having the same proof content (ie, user information), any one of the first certificates is certainly its own first certificate. That is, for any one of the plurality of certificates presented to the service provider, it is determined that the user has a private key corresponding to the first certificate. Cannot claim to service provider. Therefore, the public key P of each user included in the first certificate _u And by calculating a ring signature that protects the privacy of the user shown in FIG. 3, the service provider can determine that any one of the first certificates is its own first certificate. It is possible to claim to.
[0058]
Further, when a plurality of first certificates having the same certification content are submitted to the service provider at a time to hide which user is making the service provision request, which first certificate is Since it is hidden whether or not the user is the first certificate of the user who has made the service provision request, the "user is required to have the correct private key" in the first certificate verification process described in the above-described related art. Verification of having "cannot be performed by challenge / response.
[0059]
Therefore, in the present invention, the key pair used for the challenge / response is the public key P included in the first certificate. ₁ And the corresponding private key S ₁ Rather, another public key type key pair P created when using the service ₂ , S ₂ And the ring signature and P ₂ Is provided to the service provider together with the first certificate group having the same certification contents as a second certificate.
[0060]
Thereby, the service provider holds (1) one of the first certificates by the user's public key group included in the first certificate group and the link signature included in the second certificate. It is possible to confirm that this is a service request from the user, and (2) the P included in the second certificate ₂ Sends a challenge to the user based on ₂ By obtaining a response based on the information, it is possible to confirm that the request is not a request from a malicious user who has tapped the information.
[0061]
The first certificate serves to objectively prove the association between the user information and the public key, while the second certificate proves that the user does possess the first certificate. Play a role.
[0062]
According to one aspect of the present invention, in order to realize the above-described method, a method of using a service using anonymous authentication of a user by a first certificate for certifying a connection between a certificate M and a public key of the user is provided. In the certificate issuance stage, the user device transmits the temporary blind signature information pre-SIG transmitted from the issuer device. _SP Based on blind signature SIG _SP And the user's private key S ₁ And the secret key S of the user for anonymous authentication corresponding to ₁ And the public key P of the paired user ₁ Creates a first certificate that proves the binding of the first certificate to the certificate management device, and the certificate management device generates a blind signature SIG of the first certificate. _SP Performing a first verification that verifies the user device, if the first verification is successful, stores the first certificate in a first storage device, and pre-stores the first certificate in the first storage device; And the private key S of the user ₁ Reads a first certificate group including a plurality of first certificates for anonymous authentication corresponding to a secret key different from the first certificate, transmits the first certificate group to the user device, and the user device receives the first certificate A public key is extracted from each group to obtain a public key group including a plurality of public keys, and the public key P of the user is obtained. ₂ , The public key group and the user's private key S ₁ And the user's public key P ₁ Ring signature SIG based on _U And calculate the public key P ₂ And ring signature SIG _U Creating a second certificate consisting of: in the service use stage, the user device transmits the first certificate group, the first certificate, and the second certificate to a service provider device; The service provider device performs a blind signature SIG on each of the first certificate group and the first certificate. _SP Is performed, and if the second verification is successful, the ring signature SIG of the second certificate is _U And performs a third verification to verify the public key P from the second certificate. ₂ And the public key P ₂ And sends the challenge to the user device based on the secret key S ₂ , A response is calculated and transmitted to the service provider device, and the service provider device verifies the response.
[0063]
According to another aspect of the present invention, there are provided a user device, an issuer device, a service provider device, a certificate management device for realizing the above-mentioned service using method, a program for functioning as these devices, and the program Also holds as a recording medium on which is recorded.
[0064]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
[0065]
FIG. 5 is a diagram showing an overall configuration of a service providing system to which a service providing method according to an embodiment of the present invention is applied. Reference numeral 400 denotes an electronic network such as the Internet. In this network 400, a service provider device 100 used by a service provider as an authentication subject for providing a service, a plurality of user devices 200 used by a user who uses the service and is authenticated, and a certificate management device 300 are provided. It is connected.
[0066]
The service provider device 100 is a device used by a service provider that issues an electronic certificate to the user device 200. The issued electronic certificate also includes an electronic certificate (hereinafter, referred to as a first certificate) for association between specific information and a user's public key, which is created in anonymous authentication. Anonymous authentication refers to a method of authenticating an electronic certificate without providing attribute information of a user who is a subject.
[0067]
The service provider device 100 is a device that authenticates a user and provides a service, and includes a first certificate issuing unit 110, a first certificate verification unit 120, and a second certificate verification unit 130. .
[0068]
The user device 200 is a device operated by a user to be authenticated in order to use a service, and includes a first certificate creation unit 210, a second certificate creation unit 220, and a service request unit 230. .
[0069]
The certificate management device 300 is a device for managing the issued first certificate, has a first certificate verification unit 310 and a first certificate management unit 320, and The first certificate is stored in the storage device 330.
[0070]
For example, a program read from a memory provided in the certificate management device 300 is read and executed by the CPU or the like of the certificate management device 300, so that the certificate management device 300 Function.
[0071]
FIG. 6 is a diagram showing an example of a detailed configuration of the service provider device 100.
[0072]
The first certificate issuing unit 110 performs a process of issuing a first certificate in anonymous authentication with the user device 200. The issuance process of the first certificate is, specifically, a provisional blind signature pre-SIG described later. _SP And transmission to the user device 200. The first certificate verification unit 120 performs a process of verifying the first certificate in the anonymous authentication with the user device 200. The first certificate verification unit 120 includes a blind signature verification unit 121 that verifies a blind signature included in the first certificate. The second certificate verification unit 130 includes a ring signature verification unit 131 that verifies the ring signature created by the user device 200 and a challenge calculation unit 132 that verifies that the user device 200 has a correct private key. Have.
[0073]
For example, a program read from a memory provided in the service provider device 100 is read and executed by a CPU or the like of the service provider device 100, so that the service provider device 100 Functions as 121 and 130.
[0074]
FIG. 7 is a diagram illustrating an example of a detailed configuration of the user device 200.
[0075]
The first certificate creation unit 210 performs a process of issuing a first certificate in the anonymous authentication method with the service provider device 100. The first certificate creation unit 210 uses the public key P ₁ And secret key S ₁ And create a secret key S ₁ Is carried out in a secret possession. The process possessed secretly corresponds to a process of storing data in a storage device or the like and setting it as unreadable.
[0076]
The second certificate creation unit 220 includes a key pair creation unit 221, a first certificate collection unit 222, a public key extraction unit 223, and a ring signature calculation unit 224.
[0077]
The key pair creation unit 221 sends the public key P ₂ And secret key S ₂ Create a pair of ₂ Is carried out in a secret possession. The first certificate collection unit 222 executes a process of acquiring the first certificate managed by another user device 200 from the certificate management device 300. The public key extracting unit 223 extracts a public key from each of the collected first certificates. The ring signature calculation unit 224 calculates a ring signature for the public key created by the key pair creation unit 221.
[0078]
The “second certificate” is the public key P created by the key pair creation unit 221. ₂ And ring signature SIG _U Refers to a set of
[0079]
The service request unit 230 has a certificate transmission unit 231 and a response calculation unit 232. The certificate transmission unit 231 transmits the first certificate group and the second certificate collected by the first certificate collection unit 222 to the service provider device 100. The response calculation unit 232 creates a response to the challenge of the service provider device 100 using the secret key created by the key pair creation unit 221, and transmits the response to the service provider device 100.
[0080]
The user device 200 is provided with a storage device 240, and can store data such as various electronic certificates and keys. The storage device 240 may be realized not only by a storage device such as a magnetic disk or an optical disk connected to the main body of the user device 200 but also by, for example, a card writing / reading device and an IC card writable and readable by the device. Good.
[0081]
For example, a program read from a memory provided in the user device 200 is read and executed by a CPU or the like of the user device 200, so that the user device 200 is configured by the components 210, 220, 221, 222, 223, and 223. Functions as 224, 230, 231 and 232.
[0082]
FIG. 8 is a diagram illustrating a configuration example of the first certificate 500 according to the present embodiment. The first certificate 500 is the public key P created by the first certificate creation unit 210 of the user device 200. ₁ , Certification contents (user attribute information) M, and public key P ₁ Signature SIG of service provider apparatus 100 for certificate content and certification content M _sp Consists of
[0083]
FIG. 9 is a diagram showing a configuration example of the second certificate 600. The second certificate 600 includes the public key P created by the key pair creation unit 221 of the user device 200. ₂ And the public key P ₂ Signature SIG of the user device 200 for _U Consists of
[0084]
FIG. 10 shows the flow of the process of creating the second certificate 600 including the creation of the first certificate 500.
[0085]
The first certificate creating unit 210 of the user device 200 creates the first certificate A in cooperation with the first certificate issuing unit 110 of the service provider device 100 (s1). In this process, an example of a process for creating the first certificate A will be described with reference to FIG.
[0086]
Before issuing the first certificate A shown in (s1), the message M such as the personal information of the user is stored in advance by offline processing such as mailing or online processing between the user apparatus 200 and the service provider apparatus 100. Is provided from the user to the service provider.
[0087]
As shown in FIG. 12, first, the user device 200 _j , W _j And public key P _1A And secret key S _1A And a function value Z represented by the following equation _j (S101), and the function value Z is stored in the service provider device 100. _j Is transmitted (s102).
[0088]
Z _j = P _sp (R _j ) G _B (G _A (P _1A ｜｜ w _j ) || M) for 1 ≦ j ≦ N
Here, “||” represents a bit combination and g _A (•), g _B (•) represents a publicly-aware collision-resistant one-way hash function. These one-way hash functions g that are difficult to collide with _A (•) and g _B (·) May be the same function (the same algorithm). Also, P _sp Represents a public key widely disclosed by a service provider, and M represents a specific message.
[0089]
Note that the public key P _1A Does not disclose it to anyone at the stage of issuing the first certificate A.
[0090]
The service provider apparatus 100 receives the Z _j Are determined (S103), and the corresponding ｛Z _k ｝ (1 ≦ k ≦ R), Z _k The random number r required to calculate _k , Function value g _A (P _1A ｜｜ w _k ) Is requested to the user apparatus 200 (s104).
[0091]
The user device 200 receives the request Z from the service provider device 100. _k The Z parameter for (1 ≦ k ≦ R) is transmitted (s105).
[0092]
The service provider apparatus 100 calculates the following equation Z based on the Z parameter. _k Is calculated, and Z received in (s102) is calculated. _j It is verified whether or not it matches (s106).
[0093]
Z _k = P _sp (R _k ) G _B (G _A (P _1A ｜｜ w _k ) || M) for 1 ≦ k ≦ R
If they do not match, it is determined that the certificate cannot be issued, and the procedure for issuing the first certificate A ends. If they match, the process proceeds to (s107), and Z not disclosed. _i The following Z for (1 ≦ i ≦ NR) _i Perform a provisional blind signature on.
[0094]
pre-SIG _SP = S _sp (Π _i Z _i )
Where S _sp Represents a secret key of the service provider apparatus 100. Also, “Π _i "Is a multiplication for all i (here Z ₁ × Z ₂ ×… × Z _NR ).
[0095]
Obtained provisional blind signature pre-SIG _SP Is transmitted to the user device 200 (s108).
[0096]
The user device 200 receives the provisional blind signature pre-SIG. _SP Is performed to extract the digital signature for executing the following calculation (step S109).
[0097]
SIG _SP = Pre-SIG _SP / Π _i r _i for all i (Π _i r _i = R ₁ × r ₂ ×… × r _NR )
Also, the following is bundled and stored in the storage device 240 as the first certificate A (= Cert 1A) (s110, s2).
[0098]
Cert 1A = [M, ｛w _i ｝, P _1A , SIG _SP ] For all i
Where ｛w _i ｝ = ｛W ₁ , W ₂ , ..., w _NR ｝.
[0099]
Thus, the first certificate A issuance processing (s1, s2: s101 to s110) is completed.
[0100]
Next, the first certificate collection unit 222 reads out the first certificate A created above (s3), transmits the first certificate A to the certificate management device 300, and requests transmission of another first certificate. (S4). The processing of (s3) and (s4) does not necessarily have to be performed immediately after the processing of (s2), but is performed at a predetermined time after a predetermined time has elapsed from (s2) (for example, at 12:00 every day). You may make it so.
[0101]
The first certificate verification unit 310 of the certificate management device 300 verifies the received blind signature of the first certificate A (s5). Note that the first certificate verification unit 310 determines in advance whether the first certificate A is stored in the storage device 330 with reference to the storage device 330, and when the first certificate A is not stored (s5). ), The blind signature may be verified, and if it is stored, the verification may be omitted, and the additional writing of the first certificate A may not be performed.
[0102]
Specifically, the first certificate verification unit 310 determines that M, $ w included in the Cert 1A received from the user device 2. _i ｝, P _u Using
Y _i = G _B (G _A (P _u ｜｜ w _j ) || M) for 1 ≦ j ≦ N
Is calculated, it is determined whether or not the following expression is satisfied.
[0103]
Π _i Y _i = P _sp (SIG _SP )
If it is determined that the condition is satisfied, it is proved that the user has issued the certificate from the service provider. If the verification is successful, the first certificate verification unit 310 stores the first certificate A in the storage device 330 (s6). If the verification fails, the first certificate A is not saved.
[0104]
When storing the first certificate A, the first certificate management unit 320 stores the first certificate group (first certificate B, first certificate C, The first certificate D) is read (s7) and transmitted to the first certificate collection unit 222 of the user device 200 (s8). Each of the above-mentioned first certificate groups is previously collected by the certificate management device 300 from another user device. When the first user who uses the present system transmits the first certificate to the certificate management device (s4), the first certificate group registered in advance by another user exists in the storage device 330. do not do. However, even in this case, for example, the certificate management apparatus 300 creates a plurality of dummy first certificates in cooperation with the service provider 100 by the same process (s1) as performed by the user in advance. This is stored in the storage device 330 as a first certificate group. Accordingly, the first certificate group including the plurality of first certificates can be transmitted to the first user in the process (s8).
[0105]
The public key extracting unit 223 extracts the public key P from each of the collected first certificate groups (the first certificate B, the first certificate C, and the first certificate D). _1B , P _1C , P _ID (S9). The key pair creation unit 221 uses the public key P _2A And secret key S _2A (S10), and creates a secret key S _2A Is stored in the storage device 240 to be held secretly (s11). The ring signature calculation unit 224 calculates the public key P _1A , P _1B , P _1C , PID and S _1A Using the public key P _2A Signature SIG for _U Is calculated (s12). Public key P _2A And ring signature SIG _U Is stored as the second certificate A (s13). The processing after (s9) does not need to be executed immediately after the transmission of the certificate in (s8), and after a predetermined time has elapsed from the transmission of the certificate in (s8), for example, the predetermined operation on the user device 200 It may be executed in response.
[0106]
FIG. 11 shows the flow of service request processing after issuing the first certificate A and the second certificate A.
[0107]
The certificate transmitting unit 231 of the user device 200 stores the first certificate A, the first certificate B, the first certificate C, the first certificate D, and the second certificate A owned by the user. It is read from the device 240 (s21) and transmitted to the first certificate verification unit 120 of the service provider device 100 (s22). The blind signature verification unit 121 of the first certificate verification unit 120 checks all received first certificates 500 (the first certificate A, the first certificate B, the first certificate C, the first certificate C, Signature SIG included in the certificate D) of _SP (530) is verified (s23). This verification process is common to the verification method executed by the first certificate verification unit 310. If this succeeds, the ring signature verification unit 131 of the second certificate verification unit 130 transmits the ring signature SIG included in the second certificate 600. _U (620) is verified (s24). If this succeeds, the challenge calculation unit 132 sets the public key P included in the second certificate A _2A A challenge is created using (601) (s25) and transmitted to the user device 200 (s26). The response calculation unit 232 of the user device 200 responds to the received challenge with the secret key S _2A Is used to calculate the response (s27), and transmitted to the service provider device 100 (s28). The service provider device 100 verifies the above response (s29), and if successful, provides a service to the user device 200 (s30).
[0108]
In the conventional anonymous authentication method, a user receives one certificate and uses the one certificate. For this reason, when a certificate is issued and used in an arbitrary time series, anonymity of the user may not be effectively secured depending on the time series relationship. On the other hand, according to the present embodiment, even if the user receives the issuance of one first certificate, by using a plurality of the first certificates at a time, the user can use any one of the first certificates. Is kept confidential to the service provider. Therefore, even if the first certificate is issued and used in an arbitrary time sequence, the service provider can be authenticated with anonymity secured without the service provider being uniquely inferred of the user.
[0109]
The present invention is not limited to the above embodiment.
[0110]
Both the certificate issuing procedure shown in FIG. 9 and the certificate verifying procedure shown in FIG. 10 have been described as an example in which the service provider apparatus 100 issues and verifies. However, an issuer apparatus and a verifier apparatus are separately provided, and each issuance is performed. Processing and verification processing may be performed. In addition, it is a matter of course that another device may provide the issuance and verification of the certificate and the provision of the service.
[0111]
In addition, the anonymous authentication method described with reference to FIG. 12 of the above embodiment is only an example, and the present invention is applied to any anonymous authentication method that authenticates an electronic certificate without providing attribute information of a subject. It is, of course, applicable.
[0112]
Further, although an example is shown in which the secret key and other data such as certificates are stored in the same storage device, the secret key may be stored in another storage device so as to be privately owned.
[0113]
The programs are read from the memories provided in the service provider device 100, the user device 200, and the certificate management device 300, so that each of the devices 100, 200, and 300 becomes a component 110, 120, 130, 210, Although the case where the function as 220, 230, 310, 320 and the like is shown, it is not limited to this. In order to function as each of the constituent elements 110, 120, 130, 210, 220, 230, 310, 320, etc., a recording medium storing program codes for giving instructions to the computers of the devices 100, 200, and 300 is created in advance. By reading a program from the recording medium to each of the devices 100, 200, and 300 by a recording medium reading device, each of the devices 100, 200, and 300 may function as the above component.
[0114]
【The invention's effect】
As described in detail above, according to the present invention, it is possible to provide a service in which anonymity is ensured without uniquely estimating a person to be authenticated by an authenticator.
[Brief description of the drawings]
FIG. 1 is a conceptual diagram of the mechanism of an anonymous authentication scheme.
FIG. 2 is a diagram showing a flowchart of a normal signature method.
FIG. 3 is a diagram showing a flowchart of a ring signature.
FIG. 4 is a diagram for explaining a problem of the anonymous authentication method.
FIG. 5 is a diagram showing an overall configuration of a service providing system to which a digital certificate management method according to an embodiment of the present invention is applied.
FIG. 6 is an exemplary view showing an example of a detailed configuration of the service provider apparatus according to the embodiment.
FIG. 7 is an exemplary view showing an example of a detailed configuration of the user device according to the embodiment.
FIG. 8 is an exemplary view showing a configuration example of a first certificate according to the embodiment.
FIG. 9 is an exemplary view showing a configuration example of a second certificate according to the embodiment.
FIG. 10 is an exemplary view showing the flow of a process of creating a second certificate 600 including creation of the first certificate 500 according to the embodiment.
FIG. 11 is an exemplary view showing the flow of a service request process after issuing the first certificate A and the second certificate A according to the embodiment.
FIG. 12 is a diagram showing an example of a process for creating a first certificate A.
[Explanation of symbols]
100: service provider device, 110: first certificate issuing unit, 120: first certificate verification unit, 130: second certificate verification unit, 200: user device, 210: first certificate creation Unit, 220: second certificate creation unit, 230: service request unit, 300: certificate management device, 310: first certificate verification unit, 320: first certificate management unit

Claims (14)

A service usage method using anonymous authentication of a user by a first certificate for certifying a connection between a certification content M and a public key of the user,
In the certificate issuance stage,
The user equipment
Based on the provisional blind signature information pre-SIG _SP transmitted from the issuer device, the contents of the certificate M and the secret key S of the user are included for the anonymous authentication corresponding to the secret key S _{1 of the} user, including the blind signature SIG _SP. create the first certificate to prove the ties ₁ and a pair of the user's public key P _1,
Transmitting the first certificate to a certificate management device;
The certificate management device,
Performing a first verification to verify the blind signature SIG _SP of the first certificate;
If the first verification is successful, store the first certificate in a first storage device;
Previously stored in the first storage device, the created outside the user device, a first comprising a plurality of first certificates for anonymous authentication corresponding to a different secret key with the private key S ₁ of the user Read out the group of certificates and send it to the user device,
The user device,
Extracting a public key from each of the received first certificate groups to obtain a public key group including a plurality of public keys;
Against the public key _{P 2} of the user, the public key group, based on the public key _{P 1} of the user's private key _{S 1} and the user and calculate a ring signature SIG _U, consisting of the public key _{P 2} and the ring signature SIG _U Create a second certificate,
In the service use stage,
The user device,
Transmitting the first certificate group, the first certificate, and the second certificate to a service provider device;
The service provider device,
Performing a second verification to verify a blind signature SIG _SP on each of the first group of certificates and the first certificate;
Performing a third verification to verify the ring signature SIG _U of the second certificate if the second verification is successful;
The extracts the public key P ₂ from the second certificate and calculates a challenge based on the public key P ₂ transmitted to the user device,
The user device,
Using the secret key S ₂ to the challenge and sends it calculates a response to the service provider device,
The service provider device,
A service utilization method characterized by verifying the response. 2. The service using method according to claim 1, wherein the issuer device and the service provider device are the same device. Based on the provisional blind signature information _{pre-SIG SP,} blind signature comprises _{SIG SP,} and the public user of the secret key _{S 1} pair of the user and certified contents M for anonymous authentication corresponding to the private key _{S 1} of the user and the first of the certificate creation unit that creates a first certificate to prove the ties of key P _1,
It transmits the first certificate, the receiving the first certificate group composed of a plurality of first certificates for anonymous authentication corresponding to a different secret key with the private key S ₁ of the user 1 certificate collection unit,
A public key extracting unit that extracts a public key from each of the first certificate groups and obtains a public key group including a plurality of public keys;
Against the public key _{P 2} of the user, the public key group, based on the public key _{P 1} of the user's private key _{S 1} and the user and calculate a ring signature SIG _U, consisting of the public key _{P 2} and the ring signature SIG _U A ring signature calculation unit for creating a second certificate;
A certificate transmitting unit that transmits the first certificate group, the first certificate, and the second certificate;
Receiving the calculated challenge based on the public key P ₂ extracted from the second certificate, calculates the response and transmits to the service provider device with the respect to the challenge secret key S ₂ A user device comprising a response calculation unit. On the computer,
Based on the provisional blind signature information _{pre-SIG SP,} blind signature comprises _{SIG SP,} and the public user of the secret key _{S 1} pair of the user and certified contents M for anonymous authentication corresponding to the private key _{S 1} of the user Creating a first certificate that proves the binding of key P ₁ ;
Transmits the first certificate, the process of receiving a first certificate group composed of a plurality of first certificates for anonymous authentication corresponding to a different secret key with the private key S ₁ of the user When,
A process of extracting a public key from each of the first certificate groups to obtain a public key group including a plurality of public keys;
Against the public key _{P 2} of the user, the public key group, based on the public key _{P 1} of the user's private key _{S 1} and the user and calculate a ring signature SIG _U, consisting of the public key _{P 2} and the ring signature SIG _U Creating a second certificate;
Transmitting the first certificate group, the first certificate, and the second certificate;
Receiving the calculated challenge based on the public key P ₂ extracted from the second certificate, calculates the response and transmits to the service provider device with the respect to the challenge secret key S ₂ Service use processing program for processing and execution. Each comprises a blind signature SIG _SP, and be one to demonstrate the binding of a public key of the certificate contents M and user secret proof contents M of the user for anonymous authentication corresponding to the private key S ₁ of the user the key S ₁ and a plurality of first certificate containing the first certificate attesting ties of the public key P ₁ of a pair of users, the public key group versus public key P ₂ of the user, the user's secret Receiving a ring signature SIG _U calculated based on the key S ₁ and the user's public key P ₁ and a second certificate comprising the public key P ₂ , and for each of the plurality of first certificates A first certificate verifying unit for performing a first verification for verifying the blind signature SIG _SP ;
A ring signature verification unit that performs a second verification that verifies a ring signature SIG _U of the second certificate when the first verification is successful;
The second extracts the public key P ₂ from the certificate, and transmits the calculated Challenge on the basis of the public key P _2, receives the response said were calculated using the private key S ₂ to the challenge And a challenge calculation unit for verifying the response. On the computer,
Each comprises a blind signature SIG _SP, and be one to demonstrate the binding of a public key of the certificate contents M and user secret proof contents M of the user for anonymous authentication corresponding to the private key S ₁ of the user the key S ₁ and a plurality of first certificate containing the first certificate attesting ties of the public key P ₁ of a pair of users, the public key group versus public key P ₂ of the user, the user's secret Receiving a ring signature SIG _U calculated based on the key S ₁ and the user's public key P ₁ and a second certificate comprising the public key P ₂ , and for each of the plurality of first certificates Performing a first verification for verifying the blind signature SIG _SP ;
A process of performing a second verification for verifying a ring signature SIG _U of the second certificate when the first verification is successful;
The second extracts the public key P ₂ from the certificate, and transmits the calculated Challenge on the basis of the public key P _2, receives the response said were calculated using the private key S ₂ to the challenge And a service providing process program for executing the process of verifying the response. A first certificate issuing unit for generating and transmitting temporary blind signature information pre-SIG _SP ;
Each comprises a blind signature SIG _SP, and be one to demonstrate the binding of a public key of the certificate contents M and user secret proof contents M of the user for anonymous authentication corresponding to the private key S ₁ of the user the key S ₁ and a plurality of first certificate containing the first certificate attesting ties of the public key P ₁ of a pair of users, the public key group versus public key P ₂ of the user, the user's secret Receiving a ring signature SIG _U calculated based on the key S ₁ and the user's public key P ₁ and a second certificate comprising the public key P ₂ , and for each of the plurality of first certificates A first certificate verifying unit for performing a first verification for verifying the blind signature SIG _SP ;
A ring signature verification unit that performs a third verification that verifies a ring signature SIG _U of the second certificate when the second verification is successful;
The second extracts the public key P ₂ from the certificate, and transmits the calculated Challenge on the basis of the public key P _2, receives the response said were calculated using the private key S ₂ to the challenge And a challenge calculation unit for verifying the response. On the computer,
Processing for generating and transmitting temporary blind signature information pre-SIG _SP ;
Each comprises a blind signature SIG _SP, and be one to demonstrate the binding of a public key of the certificate contents M and user secret proof contents M of the user for anonymous authentication corresponding to the private key S ₁ of the user the key S ₁ and a plurality of first certificate containing the first certificate attesting ties of the public key P ₁ of a pair of users, the public key group versus public key P ₂ of the user, the user's secret Receiving a ring signature SIG _U calculated based on the key S ₁ and the user's public key P ₁ and a second certificate comprising the public key P ₂ , and for each of the plurality of first certificates Performing a first verification for verifying the blind signature SIG _SP ;
A process of performing a third verification for verifying the ring signature SIG _U of the second certificate when the second verification is successful;
The second extracts the public key P ₂ from the certificate, and transmits the calculated Challenge on the basis of the public key P _2, receives the response said were calculated using the private key S ₂ to the challenge And a service providing process program for executing the process of verifying the response. A first certificate including a blind signature SIG _SP and proving the association between the certification content M and the user's public key is received from the user device, and a first certificate verifying the blind signature SIG _SP of the first certificate is received. A first certificate verification unit that performs verification, and stores the first certificate in a first storage device when the first verification is successful;
Previously stored in the first storage device, the created outside the user device, a first comprising a plurality of first certificates for anonymous authentication corresponding to a different secret key with the private key S ₁ of the user And a first certificate management unit for reading the group of certificates and transmitting the certificate group to the user device. On the computer,
A first certificate including a blind signature SIG _SP and proving the association between the certification content M and the user's public key is received from the user device, and a first certificate verifying the blind signature SIG _SP of the first certificate is received. Verifying, and storing the first certificate in a first storage device when the first verification is successful;
Previously stored in the first storage device, the created outside the user device, a first comprising a plurality of first certificates for anonymous authentication corresponding to a different secret key with the private key S ₁ of the user And a process of reading the group of certificates and transmitting the certificate group to the user device. On the computer,
Based on the provisional blind signature information _{pre-SIG SP,} blind signature comprises _{SIG SP,} and the public user of the secret key _{S 1} pair of the user and certified contents M for anonymous authentication corresponding to the private key _{S 1} of the user Creating a first certificate that proves the binding of key P ₁ ;
Transmits the first certificate, the process of receiving a first certificate group composed of a plurality of first certificates for anonymous authentication corresponding to a different secret key with the private key S ₁ of the user When,
A process of extracting a public key from each of the first certificate groups to obtain a public key group including a plurality of public keys;
Against the public key _{P 2} of the user, the public key group, based on the public key _{P 1} of the user's private key _{S 1} and the user and calculate a ring signature SIG _U, consisting of the public key _{P 2} and the ring signature SIG _U Creating a second certificate;
Transmitting the first certificate group, the first certificate, and the second certificate;
Receiving the calculated challenge based on the public key P ₂ extracted from the second certificate, calculates the response and transmits to the service provider device with the respect to the challenge secret key S ₂ A recording medium on which a service use processing program for processing and execution is recorded. On the computer,
Each comprises a blind signature SIG _SP, and be one to demonstrate the binding of a public key of the certificate contents M and user secret proof contents M of the user for anonymous authentication corresponding to the private key S ₁ of the user the key S ₁ and a plurality of first certificate containing the first certificate attesting ties of the public key P ₁ of a pair of users, the public key group versus public key P ₂ of the user, the user's secret Receiving a ring signature SIG _U calculated based on the key S ₁ and the user's public key P ₁ and a second certificate comprising the public key P ₂ , and for each of the plurality of first certificates Performing a first verification for verifying the blind signature SIG _SP ;
A process of performing a second verification for verifying a ring signature SIG _U of the second certificate when the first verification is successful;
The second extracts the public key P ₂ from the certificate, and transmits the calculated Challenge on the basis of the public key P _2, receives the response said were calculated using the private key S ₂ to the challenge And a service providing processing program for executing the processing for verifying the response. On the computer,
Processing for generating and transmitting temporary blind signature information pre-SIG _SP ;
Each comprises a blind signature SIG _SP, and be one to demonstrate the binding of a public key of the certificate contents M and user secret proof contents M of the user for anonymous authentication corresponding to the private key S ₁ of the user the key S ₁ and a plurality of first certificate containing the first certificate attesting ties of the public key P ₁ of a pair of users, the public key group versus public key P ₂ of the user, the user's secret Receiving a ring signature SIG _U calculated based on the key S ₁ and the user's public key P ₁ and a second certificate comprising the public key P ₂ , and for each of the plurality of first certificates Performing a first verification for verifying the blind signature SIG _SP ;
A process of performing a third verification for verifying the ring signature SIG _U of the second certificate when the second verification is successful;
The second extracts the public key P ₂ from the certificate, and transmits the calculated Challenge on the basis of the public key P _2, receives the response said were calculated using the private key S ₂ to the challenge And a service providing processing program for executing the processing for verifying the response. On the computer,
A first certificate including a blind signature SIG _SP and proving the association between the certification content M and the user's public key is received from the user device, and a first certificate verifying the blind signature SIG _SP of the first certificate is received. Verifying, and storing the first certificate in a first storage device when the first verification is successful;
Previously stored in the first storage device, the created outside the user device, a first comprising a plurality of first certificates for anonymous authentication corresponding to a different secret key with the private key S ₁ of the user Recording a certificate management program for executing a process of reading the certificate group and transmitting the certificate group to the user device.

Images