JP2008234143A - Subject limited mail opening system using biometrics, method therefor, and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To dispense with an issue of a digital certificate by an authentication station in every individual person, and carriage of a non-disclosed key, to encipher/decode a mail, to impart a digital signature, and to enable only a mail address owner to detect decoding, browse and alteration of the electronic mail. <P>SOLUTION: This subject limited mail opening systems 30, 40 are constituted of biometric information input devices 31, 41, biometric key pair generating functions 36, 46, enciphered mail preparing functions 37, 47, enciphered mail opening functions 38, 48, address/disclosed key registering functions 39, 49, and disclosed key acquiring functions 3a, 4a, assembles the disclosed key registered in the authentication station, a non-disclosed key, and corresponding digital certificate into the biometric information input devices 31, 41, executes the digital signature by the non-disclosed key assembled with the biometric disclosed key generated based on the input biometric information, registers the biometric disclosed key, the digital signature and the certificate, in an address/disclosed key repository, while correlated with the electronic mail address, and verifies the encipherment in a transmission side and the digital signature in a reception side, referring thereto. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an e-mail security technology, and in particular, encrypts an e-mail so that only the e-mail address owner can decrypt and decrypt the e-mail and guarantee that the received e-mail has not been tampered with. The present invention relates to a person-only e-mail opening system and method and a program therefor.

  As the Internet spreads, security issues are becoming more and more important. For example, Non-Patent Document 1 and Non-Patent Document 2 are mentioned.

  In Non-Patent Document 1, due to the spread of networks represented by the Internet, various information is digitized and exchanged through the network, but the network is not necessarily secure and there are various threats It has been mentioned that. As a countermeasure against threats such as tampering and denial among the threats on the Internet, digital signatures are now an effective technology.

  Non-Patent Document 2 relates to biometric authentication, which has recently been gaining interest in authentication technology. Biometrics authentication is an authentication method that performs identity verification based on physical characteristics such as fingerprints, irises behind the eyeballs, or voices. In Non-Patent Document 2, when biometric authentication is used, problems such as “forget” and “known to others” in authentication based on memory of passwords, etc., “lost” and “theft” in authentication based on possession of cards etc. It is mentioned that the problem of “misplaced” can be avoided.

  A digital signature used to improve Internet security is encrypted signature information that is assigned to guarantee the validity of a digital document. The digital signature mechanism is as follows.

  The signer encrypts the digest of the digital content with the signer's own private key (secret key), generates a digital signature, and attaches it to the message to be signed. The signature verifier first decrypts the digital signature using the signer's public key. This confirms that the person who generated the digest is indeed the signer.

  Next, it is possible to confirm that the digital content has not been tampered with by generating a digest of the digital content and comparing it with the digest decrypted from the digital signature. A digital signature can verify the creator of the digital content and ensure that the digital content has not been tampered with.

  When using the public key cryptosystem, it is necessary to confirm whether or not the public key to be used is really the correct counterpart (see Non-Patent Document 3). As a method for confirming the owner of the public key, there is a method for assuring the owner of the public key by a certification authority. The certificate authority (CA) confirms the identity of the owner of the public key by some method and issues a digital certificate for assuring the public key and its owner. By attaching the digital certificate to the digital signature, the owner of the public key (creator of the digital content) can be certified through a certificate authority (CA).

  Japanese Patent Application Laid-Open No. 2004-151867 discloses a technique for improving the security of authentication and enabling a digital certificate to be automatically downloaded from an authentication server without inputting an ID or a password even when the digital certificate is downloaded from an authentication server. It is disclosed.

  Patent Document 1 discloses a personal authentication method in a personal authentication system in which an application server that provides an application service, a client terminal used by a user, and an authentication server that authenticates the user are connected to each other via a network. Whether or not the user is a legitimate user is obtained by acquiring biometric information of the user operating the client terminal, transmitting it to the authentication server, and checking the biometric information stored in the digital certificate of the authentication server in advance. If it is determined that the user is a legitimate user, the message is encrypted and transmitted.

  In addition, there is a technique disclosed in Patent Document 2 as a technique for avoiding information necessary for sending and receiving e-mails being stolen by a third party.

  Patent Document 2 discloses a terminal device that acquires biometric information from a person who wants to send and receive an e-mail using a terminal device, transmits the biometric information to a server device, and an e-mail using the terminal device. By storing biometric information of a plurality of permitted persons permitted to send and receive in advance, receiving biometric information via a network, and comparing the received biometric information with the stored biometric information, When it is authenticated whether or not the person who wants to send / receive is one of a plurality of permitted persons, and the applicant is authenticated as one of a plurality of permitted persons, the applicant can send an e-mail to the terminal device used by the applicant. It is comprised from the server apparatus which permits transmitting / receiving.

JP 2002-7352 A JP 2001-217863 A "Http://www.ipa.go.jp/security/pki/012.html", Information Processing Promotion Corporation Security Center "Http://www.ipa.go.jp/security/fy14/reports/authentication/authentication2000.pdf", Information Processing Promotion Corporation Security Center "Http://www.ipa.go.jp/security/pki/031.html", Information Processing Promotion Corporation Security Center

  As described above, conventionally, a digital certificate is obtained from a certificate authority (CA) as a method for encrypting an e-mail so that only the mail address owner can view it, and using the public key included in the digital certificate, A method of performing encryption and decrypting using a private key at the time of opening is known.

  The first problem to be solved is that when the above method is used, it is necessary for each person to obtain a digital certificate from the CA, and it takes time and effort to obtain the certificate.

  The second problem to be solved is that, in the prior art, the entity of the private key for decrypting an e-mail is a data file. When decrypting on a different computer, the private key (Data file) must be carried around.

  As a solution to the above two problems, it is conceivable to use biometric information for encryption of electronic mail. Biometric information is information that shows physical characteristics such as fingerprints, irises behind the eyeballs, or voices that the signer himself has born as described above, and this guarantees the authenticity of the digital signature. Is done.

  However, biometric information is also just digital information on a computer, and there is a possibility of theft and counterfeiting like ordinary information. If biometrics information is handed over to a third party due to theft or forgery, etc., there is a possibility that the digital signature may be counterfeited by the third party, which makes it possible to tamper or impersonate the digital content. .

  A third problem to be solved is that the key information used for digital signature / encryption may be stolen or forged, and the authenticity of the digital signature cannot be proved.

  Further, what is disclosed in Patent Document 1 only mentions the authentication of the principal, and the problem that Patent Document 2 does not disclose the mechanism for encrypting and transmitting a message. There is a problem that what is disclosed refers to an authentication part as to whether or not mail can be transmitted and received, and does not refer to “giving an electronic signature for identity verification”. Therefore, it provides a mechanism for obtaining and encrypting the biometrics public key of the person to be sent from the e-mail address, and three functions of “authentication”, “encryption”, and “identification (signature)” by biometrics. It is demanded.

  Accordingly, a first object of the present invention is to encrypt an email without having an individual issue a digital certificate from a certificate authority (CA), and only an email address owner can decrypt, view, An object is to provide an e-mail opening system, a method thereof, and a program therefor that can detect tampering of e-mails.

  A second object of the present invention is to provide a person-only mail opening system and method, and a program for the same, which can encrypt / decrypt an e-mail and give a digital signature without carrying a private key. That is.

  The third object of the present invention is to provide a person-only e-mail opening system that prevents the forgery of a biometrics private key and guarantees the authenticity of a digital signature when certifying and encrypting an e-mail with biometric information. And a method thereof and a program therefor.

  In order to achieve the above object, the present invention incorporates in advance a public key for an input device, a private key for an input device, and a digital certificate issued by a certificate authority (CA) into a biometric information input device. Leave it in.

  Then, a biometric public key is generated from the biometric information input from the biometric information input unit (step S103 in FIG. 2), and the biometric public key to be registered is incorporated in the biometric information input device. A digital signature using a private key and a digital certificate are assigned (step S104), and the relationship between the “e-mail address” to be used and the “biometrics public key generated by the e-mail address owner” is “address Register in the “public key repository” (step S105). This ensures that the biometric public key is created from the biometric information input by the legitimate biometric information input device.

  At the time of e-mail transmission (see FIG. 3), a biometric public key is generated from the biometric information input from the biometric information input unit (step S203), and a digital signature for the e-mail is generated using the sender's biometric private key. (Step S204). Further, a digital signature using a private key incorporated in the biometric information input device and a digital certificate are given (step S205). Thereby, it is ensured that the biometric private key used for the digital signature is created from the biometric information input by the authorized biometric information input device. After the electronic mail is signed, a biometrics public key associated with the destination address is acquired from the address / public key repository (step S206), encrypted using this (step S209), and transmitted.

  When receiving e-mail (see FIG. 4), a biometric public key is generated from biometric information input from the biometric information input unit (step S302), and decryption is performed using its own biometric private key (step S302). S303). Thereafter, “digital signature by the biometric information input device” is verified (step S304). Since the public key of the biometric information input device is registered in advance with the certificate authority (CA), it can be assured that the biometric information is input from the legitimate biometric information input device. Thereafter, the biometrics public key associated with the source address is acquired from the address / public key repository, and the digital signature generated with the sender's biometrics private key is verified using this key (step S305). 309).

  The first effect of the present invention is that the e-mail is encrypted, and only the e-mail address owner can view the e-mail.

  The second effect of the present invention is that the individual does not have to issue a digital certificate from the certificate authority (CA) in advance in order to encrypt the mail and prove the authenticity of the text. It is a point that a labor can be saved.

  The third effect of the present invention is that there is no possibility of the private key being stolen or lost because it is not necessary to carry around the private key in order to generate a digital signature.

  The fourth effect of the present invention is that the digital signature can be prevented from being counterfeited by a third party and the authenticity of the digital signature can be proved.

The best mode for carrying out the present invention will be described below with reference to the drawings.
FIG. 1 shows a configuration of a person-only email opening system using biometrics to which the present invention is applied.

  Personal limited email opening systems 30 and 40 using biometrics include biometric information input devices 31 and 41, biometric key pair generation functions (means) 36 and 46, encrypted mail creation functions (means) 37 and 47, encryption E-mail opening function (means) 38, 48, address / public key registration function (means) 39, 49, and public key acquisition function (means) 3a, 4a. The personal-only email opening system 30, 40 may be a personal computer with a biometric information reading function, a form connected externally to the personal computer, or any form capable of working with biometric information inside the personal computer.

  The biometric information input devices 31 and 41 read biometric information used for generating a biometric public / private key (biometric key pair) for encryption / decryption, signature, and verification of an e-mail according to the present invention. It is a device and includes biometric information input units 3b and 4b.

  The public keys 32 and 42 and the private keys 33 and 43 are generated in advance for each individual biometric information input device and registered in the certificate authority (CA) 10, together with the corresponding digital certificates 34 and 44. It is stored in a ROM or the like and incorporated in advance in a biometric information input device. Further, tamper-proof devices 35 and 45 for preventing internal information from being read can be provided so as to further secure confidentiality.

  The biometric key pair generation functions (means) 36 and 46 are functions (means) for generating a biometric public key and a biometric private key from the biometric information input from the biometric information input devices 31 and 41. As the key generation algorithm used in the biometrics key pair generation function (means) 36 and 46, any conventionally known key generation algorithm can be used, but it needs to be unified. Thereby, the same biometric key pair can be generated for the same biometric information input from different biometric input devices.

  The encrypted mail creation functions (means) 37 and 47 are the biometrics private key generated by the biometric key pair generation functions (means) 36 and 46 and the private keys incorporated in the biometric information input devices 31 and 41, respectively. A digital signature is added to the e-mail using 33 and 43. In addition, it is a function (means) for encrypting a signed electronic mail using the public key acquired by the public key acquisition functions 3a and 4a from the destination electronic mail address.

  The encrypted mail opening functions (means) 38 and 48 are functions (means) for decrypting the electronic mail created by the biometrics encryption functions (means) 37 and 47 and verifying the assigned digital signature.

  The address / public key registration function (means) 39, 49 is a function for associating the biometrics public key generated by the biometrics key pair generation function 36, 46 with the owned e-mail address and registering it in the address / public key repository ( Means).

  The public key acquisition functions (means) 3a and 4a are functions (means) for acquiring a biometrics public key associated with a specified electronic mail address from the address / public key repository.

  The address / public key registration function (means) will be described with reference to the flowchart of FIG. In the following description, it is assumed that address / public key registration is performed by the person-only e-mail opening system 30 using biometrics.

  First, an e-mail address to be used is selected (step S101). Next, biometric information is input from the biometric information input device 31 (step S102). Next, a biometrics public key is generated by the biometrics key pair generation function (means) 36 (step S103).

  A digital signature and a digital certificate 34 are assigned to the biometrics public key using the private key 33 (step S104). Note that any known algorithm can be used for the digital signature.

  The e-mail address selected in step S101 and the biometrics public key signed in step S104 are registered in the address / public key repository 50. The address / public key repository 50 is placed in a mail server or the like.

  The encrypted mail creation function (means) will be described with reference to the flowchart of FIG. In the following description, it is assumed that an encrypted mail is created by the person-only mail opening system 30 using biometrics.

  First, a mail text to be transmitted is created (step S201). The sender inputs biometric information from the biometric information input device 31 (step S202).

  The biometrics private key is generated by the biometrics key pair generation function (means) 36 (step S203). Using the biometrics private key, a digital signature is assigned to the mail body created in (Step S201) (Step S204). Note that any known hash generation algorithm can be used.

  However, it is necessary to use the same hash algorithm for the system that applies the digital signature and the system that performs the verification). Further, a digital signature and a digital certificate are assigned using the private key 33 (step S205). Note that any known algorithm can be used for the digital signature.

  The biometric public key associated with the destination electronic mail address is acquired by the public key acquisition function (means) 3a (step S206).

  The certificate authority (CA) 10 is inquired and the validity of the digital certificate given to the obtained biometrics public key is verified (step S207). If the digital certificate is invalid, the process ends as a failure (step S210). If the digital certificate is valid, the digital signature is verified using the digital certificate (step S208).

  If the result of step S208 is NG, the verification ends as failure (step S210). In the case of OK (step S208: Y), the electronic mail in step S205 is encrypted using the biometrics public key acquired in step S206 (S209).

  The encrypted mail opening function (means) will be described with reference to the flowchart of FIG. In the following description, it is assumed that the encrypted mail is opened by the person-only mail opening system 40 using biometrics. After receiving the e-mail, the recipient inputs biometric information from the biometric information input device 41 (step S301).

  A biometrics private key is generated by the biometrics key pair generation function (means) 46 (step S302). The received mail is decrypted using the biometrics private key (step S303). The validity of the digital certificate 34 attached to the decrypted electronic mail is verified (step S304).

  If the digital certificate is invalid, the process ends as a failure (step S310). If the digital certificate is valid, the digital certificate provided using the private key 33 is verified using the digital certificate 34 (step S305). If the result of step S305 is NG, the verification ends as failure (step S310). The biometric public key associated with the transmission source e-mail address is acquired by the public key acquisition function (means) 4a (step S306).

  The certificate authority (CA) 10 is inquired and the validity of the digital certificate given to the acquired public key is verified (step S307). If the digital certificate is invalid, the process ends as a failure (step S310). If the digital certificate is valid, the digital signature is verified using the digital certificate (step S308).

  If the verification result in step S108 is NG, the verification ends as a verification failure (step S310). In the case of OK, using the biometric public key acquired in step S306, the digital signature is verified by the sender's biometric private key given to the e-mail (step S309). If the verification result in step S309 is NG, the verification ends as a verification failure (step S310). In the case of OK, the opening is completed as the verification is successful.

  Biometrics key pair generation function (means) 36, 46, encrypted mail creation function (means) 37, 47, encrypted mail opening function (means) 38, 48, address / public key registration function (means) 39, 49 The public key acquisition functions (means) 3a and 4a are performed by executing a program corresponding to each of these functions (means) using a CPU and memory of a personal computer. A program that realizes these functions (means) can be distributed to the market via a recording medium such as a CD-ROM, DVD, or FD, or a network such as the Internet.

  The present invention is a particularly effective technique for use when it is desired to limit opening to only the person himself, such as transmitting a confidential document by e-mail.

It is a configuration of a person-only email opening system using biometrics to which the present invention is applied. It is a flowchart which shows an address and public key registration function. It is a flowchart which shows an encryption mail preparation function. It is a flowchart which shows an encryption mail opening function.

Explanation of symbols

10: Certificate Authority (CA)
30, 40: Personal mail opening system using biometrics 31, 41: Biometric information input device 32, 42: Public key 33, 43: Private key 34, 44: Digital certificate 35, 45: Tamper resistant device 36, 46: Biometric key pair generation function (means)
37, 47: Encrypted mail creation function (means)
38, 48: Encrypted mail opening function (means)
39, 49: Address / public key registration function (means)
3a, 4a: Public key acquisition function (means)
3b, 4ba: Biometric information input unit 50: Address / public key repository

Claims (8)

In person-only email opening system using biometrics,
Means for incorporating a public key, a private key, and a corresponding digital certificate that are generated in advance for each individual biometric information input device and registered with a certificate authority (CA) into the biometric information input device;
Means for generating a biometric public key from the input biometric information;
Means for providing a digital signature with a private key incorporated in the biometric information input device;
A person-only e-mail opening system comprising means for associating an e-mail address with the biometrics public key, the digital signature, and the digital certificate and registering them in an address / public key repository. In the person limited email opening system according to claim 1,
Means for giving a digital signature using the biometric private key generated from the biometric information of the sender at the time of e-mail transmission;
Means for providing a digital signature and a digital certificate using the private key incorporated in the biometric information input device;
A person-only e-mail opening system comprising means for acquiring the biometrics public key associated with a destination e-mail address and encrypting the e-mail by using the biometric public key when transmitting an e-mail. The person-only email opening system according to claim 2, further comprising:
Means for decrypting the encrypted email with the email address owner's biometrics private key upon receipt of the email;
Means for acquiring a digital certificate from digital content to which a digital signature is attached and verifying the digital signature by the private key incorporated in the biometric information input device;
A person-only e-mail opening system comprising means for verifying a digital signature using the biometrics private key. In the person limited email opening system according to any one of claims 1 to 3,
A tamper-resistant device is incorporated in the biometric information input device in advance, and the person-only e-mail opening system is characterized. In the person-only email opening method using biometrics,
Incorporating in advance a public key, a private key, and a corresponding digital certificate generated in advance for each individual biometric information input device and registered in a certificate authority (CA) into the biometric information input device;
Generating a biometric public key from the input biometric information;
Providing a digital signature with a private key incorporated in the biometric information input device;
A method for opening a personal limited mail, comprising the step of associating an electronic mail address with the biometric public key, the digital signature, and the digital certificate in registration in an address / public key repository. In the person-only e-mail opening method according to claim 5,
Using the biometric private key generated from the biometric information of the sender at the time of e-mail transmission, giving a digital signature;
Providing a digital signature and a digital certificate using the private key embedded in the biometric information input device;
A method for opening a person-only email, characterized in that, when sending an e-mail, the method includes the step of acquiring the biometrics public key associated with a destination e-mail address and encrypting the e-mail using this key. The person-only email opening method according to claim 6, further comprising:
Decrypting the encrypted email with the email address owner's biometrics private key upon receipt of the email; and
Obtaining a digital certificate from the digital content provided with the digital signature, and verifying the digital signature by the private key embedded in the biometric information input device;
A person-only e-mail opening method comprising a step of verifying a digital signature using the biometrics private key.   The program for functioning a computer as each means in the personal limited mail opening system in any one of Claim 1 to 3.

Images