JP2011244321A - Proxy signature system, and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a proxy signature technology for a third-person device to substitutively generate a digital signature with a high explanatory strength.SOLUTION: A terminal device 100 has a specific arithmetic function and the terminal device 100 sends an arithmetic result of specific data by the arithmetic function to a signature generation device 200 (S5) and discards an arithmetic result (S5a). Furthermore, the signature generation device 200 generates a signature verification key from the arithmetic result (S7), and sends the signature verification key to a signature verification device 300 beforehand (S8). In a signature process, the terminal device 100 sends an arithmetic result determined again to the signature generation device 200 (S13), the signature generation device 200 generates a signature generation key from the arithmetic result (S17), uses the signature generation key to generate a digital signature for a message (S18), sends the digital signature to the signature verification device 300 (S19) and discards the arithmetic result and the signature generation key (S19a). The signature verification key device 300 verifies the digital signature using the signature verification key (S21).

Description

  The present invention relates to a proxy signature technique in which a third-party device generates an electronic signature with high proof power by a proxy.

  In electronic signature technology, proxy signature technology is known in which a terminal device entrusts a signature generation process to a third party device and the third party device generates an electronic signature. For example, Patent Document 1 is cited as such a conventional technique. As a request for proxy signing, for example, a case where the computing capability of the terminal device is low can be considered.

JP 2008-148033 A

  In the proxy signature technique, the terminal device usually has to transmit its private key to the third party device. However, the third-party device that has obtained the secret key can freely generate the signature of the terminal device as long as the secret key is valid. In other words, even if the terminal device restricts the signature target to a specific message and entrusts the generation of the electronic signature to the third party device, the third party device that once obtained the secret key has no relation to the entrustment from the terminal device. The electronic signature of the terminal device can be generated.

  For this reason, when a third party device generates an electronic signature on behalf of a terminal device, a mechanism that can prove that the electronic signature generation by the third party device is based on a commission from the terminal device is required. The

  The present invention has been made in view of such a point, and an object of the present invention is to provide a proxy signature technique in which a third-party device generates an electronic signature with high proof power by a proxy.

  The proxy signature technique of the present invention is as follows. That is, the terminal device has a specific calculation function, and the terminal device sends the calculation result of the calculation function for the unique data to the signature generation device and discards the calculation result. The signature generation device generates a signature verification key from the calculation result, and sends the signature verification key to the signature verification device in advance. In the signature process, the terminal device sends the calculation result by the calculation function for the unique data to the signature generation device, and the signature generation device generates a signature generation key from the calculation result, and uses the signature generation key to An electronic signature is generated and sent to the signature verification apparatus, and the calculation result and the signature generation key are discarded. The signature verification device verifies the electronic signature with the signature verification key.

  In this proxy signature technique, from the viewpoint of security improvement, when generating a signature generation key and a signature verification key, information obtained by disturbing the calculation result with a random number may be used instead of the calculation result.

  Alternatively, the proxy signature technique of the present invention is as follows. That is, the signature generation device generates a signature generation key and a signature verification key, and sends the signature verification key to the signature verification device in advance. The terminal device has a unique calculation function, and the terminal device sends the calculation result r1 of the calculation function for the unique data to the signature generation device, and discards the calculation result r1. Further, the signature generation apparatus divides the signature generation key into three types of fragments r1, u1, v1 so that the calculation result r1 becomes one of the fragments of the signature generation key [division processing], and the fragment u1 is stored in its own storage unit. The fragment v1 is sent to the backup device, and the fragment r1 and the signature generation key are discarded. The backup device stores the fragment v1 in its storage unit. In the signature process, the terminal device again sends the calculation result r1 by the calculation function for the specific data to the signature generation device, the signature generation device restores the signature generation key from the calculation result r1 and the fragment u1, and the signature generation key is An electronic signature for the message is generated and sent to the signature verification device, and the calculation result r1 and the signature generation key are discarded. The signature verification device verifies the electronic signature with the signature verification key. In the restoration process, the alternative terminal device has a specific calculation function, and the alternative terminal device sends the calculation result r2 of the calculation function for the specific data to the signature generation device and discards the calculation result r2. Also, the signature generation device restores the signature generation key from the fragment u1 and v1 provided from the backup device, and the signature generation key restored so that the operation result r2 becomes one of the restored signature generation key fragments. Is divided into three types of fragments r2, u2, and v2 [fragment update processing], the fragment u2 is stored in its own storage unit, the fragment v2 is sent to the backup device, and the fragment r2 and the signature generation key are discarded. The backup device stores the fragment v2 in its storage unit.

  With this proxy signature technology, from the viewpoint of improving security, the calculation results r1 and r2 can be obtained by randomizing the calculation results r1 and r2 instead of the calculation results r1 and r2 during the signature generation key splitting process and the fragment update process. Information s1 and s2 may be used.

  According to the present invention, it is difficult for a terminal device other than the terminal device A to obtain a calculation result of the terminal device A and a signature generation key uniquely generated from the calculation result from unique data input to the terminal device A. If so, as long as the signature generation device correctly generates the electronic signature and discards the calculation result and the signature generation key, the terminal device A does not participate and passes the signature verification using the signature verification key. Since it is difficult to generate an electronic signature, the electronic signature generated by the signature generation device is based on the entrustment from the terminal device A, and the electronic signature generated under the intention of the user, that is, the proof power It can be said to be a high electronic signature.

1 is a diagram illustrating a proxy signature system according to a first embodiment. FIG. 5 is a diagram illustrating a processing procedure of a proxy signature method according to the first embodiment. FIG. 9 is a diagram illustrating a processing procedure of a proxy signature method according to a modification of the first embodiment. The figure which shows the proxy signature system in Embodiment 2. FIG. FIG. 10 is a diagram illustrating a processing procedure of a proxy signature method according to the second embodiment (part 1); FIG. 10 is a diagram illustrating a processing procedure of a proxy signature method according to the second embodiment (No. 2). FIG. 10 is a diagram illustrating a processing procedure of a proxy signature method according to the second embodiment (part 3); FIG. 11 is a diagram showing a processing procedure of a proxy signature method in a modification of the second embodiment (No. 1). FIG. 12 is a diagram illustrating a processing procedure of a proxy signature method according to a modification of the second embodiment (part 2); The figure which shows the process sequence of the proxy signature method in the modification 2 of embodiment (the 3). The figure which shows the function structure of the terminal device which is a component of the proxy signature system in connection with each embodiment, a signature production | generation apparatus, a signature verification apparatus (AP server apparatus), an alternative terminal device, and a backup device.

Embodiment 1
[Proxy signature system]
As shown in FIG. 1, the proxy signature system 1 according to the first embodiment includes at least a terminal device 100, a signature generation device 200, and a signature verification device 300. These devices can communicate with each other via, for example, the communication network 5. In particular, it is desirable that the communication path between the terminal device 100 and the signature generation device 200 realizes highly confidential communication using an encryption technique or the like.

  The proxy signature system of the present invention can include one or a plurality of terminal devices 100 according to the number of users and one or a plurality of signature verification devices 300 according to the number of server administrators (for example, application service providers). However, in order to facilitate understanding of the present invention, in the first embodiment, the proxy signature system 1 includes N terminal devices 100-1,..., 100-i,. It is assumed that the verification apparatus 300 is included. However, N is an integer of 2 or more.

  In addition, the proxy signature system of the present invention can include one or a plurality of signature generation apparatuses 200. When the proxy signature system includes a plurality of signature generation apparatuses 200, consistency between signature generation and signature verification (for example, a pair relationship between a signature generation key and a signature verification key in the case of an RSA signature scheme) is maintained. It is preferable to operate. For example, when the signature verification device 300 requests the terminal device 100 for an electronic signature, the terminal device 100 sends information specifying the signature generation device 200 to which the terminal device 100 entrusts the generation of the electronic signature. Alternatively, a mechanism is desired in which the terminal device 100 sends information for identifying the signature generation device 200 entrusted with the generation of the electronic signature to the signature verification device 300 that has requested the electronic signature. Such a mechanism is easily constructed by including the information in communication data between devices, for example. In the first embodiment, it is assumed that the proxy signature system 1 includes one signature generation device 200 in order to facilitate understanding of the present invention.

<Terminal device>
The terminal device 100 is a device having a calculation function and a data transmission / reception function, and is exemplified by a personal computer, a mobile phone, an IC card, and the like. In particular, assuming a situation in which the terminal device 100 must entrust generation of an electronic signature to the signature generation device 300, the terminal device 100 has a low calculation capability, the calculation capability is specialized for a specific operation, or Understand the necessity of proxy signatures, assuming that it is difficult to add application software, and that it is difficult to execute digital signature key generation processing or signature generation processing that differs for each application software. Will make it easier.

  However, the terminal device 100 is assumed to have a unique calculation function. This unique calculation function is not particularly limited.For example, a hash operation with a key, that is, a hash value Hash (S‖K) of data S‖K obtained by concatenating K and S to key data K and input fixed data S. ). Here, the key data K is different for each terminal device 100. Alternatively, when the terminal device 100 has an electronic signature function different from the electronic signature used in the application software in advance, the electronic signature function may be a unique calculation function.

<Signature generation device>
The signature generation device 200 is a device having a calculation function and a data transmission / reception function. The signature generation device 200 preferably has a calculation capability to generate an electronic signature. In particular, since the signature generation apparatus 200 handles a signature generation key (secret key), it is desirable to have tamper resistance. The signature generation apparatus 200 is realized by, for example, an HSM (Hardware Security Module) or a TPM (Trusted Platform Module). .

<Signature verification device>
The signature verification apparatus 300 is an apparatus having a calculation function and a data transmission / reception function, and is exemplified by a server apparatus, for example. In the first embodiment, the signature verification apparatus 300 is an apparatus that executes application software for the terminal apparatus 100, for example. From this point of view, the signature verification apparatus 300 will be referred to as an AP server apparatus 300. In the first embodiment, it is assumed that application of the application software to the terminal device 100 requires an electronic signature.

  The proxy signature process in the proxy signature system 1 will be described with reference to FIG. Refer to FIG. 11 for the functional configuration of each device. Since the same proxy signature processing is performed for any of the N terminal devices 100-1,..., 100-i,. The proxy signature process for the i-th terminal device 100-i will be described in consideration of the above.

<Registration process>
First, a signature key registration process is executed prior to the signature process.

The unique data generation unit 301 of the AP server device 300 generates unique data h _i unique to the terminal device 100-i (step S1). The unique data h _i is stored in the storage unit 309 of the AP server device 300 in association with information (identifier) that identifies the terminal device 100-i.

The transmitting unit 307 of the AP server device 300 transmits the unique data h _i to the terminal device 100-i (step S2), and the receiving unit 108 of the terminal device 100-i receives the unique data h _i (step S2). S3).

The unique calculation unit 101 of the terminal device 100-i performs a calculation g unique to the terminal device 100-i on the unique data h _i and outputs this calculation result r _i = g (h _i ) (step S4). . If the specific operation g is, for example, the hash operation Hash described above, the data h _i ‖K obtained by concatenating K _i and h _i to the key data K _i specific to the terminal device 100- _i and the input specific data h _{i i} hash value hash of (h _i ‖K _i) is a calculation result r _i.

The transmission unit 107 of the terminal device 100-i transmits the calculation result r _i to the signature generation device 200 (step S5), and the reception unit 208 of the signature generation device 200 receives the calculation result r _i (step S6). ). After the process of step S5, the control unit 105 of the terminal device 100-i performs a process of deleting the calculation result r _i from a storage unit (not shown) of the terminal device 100-i (step S5a).

The signature key generation unit 201 of the signature generation apparatus 200 generates at least a signature verification key PK _i = Gen (r _i ) using the calculation result r _i (step S7). The signature key generation unit 201 determines the signature generation key SK _i and the signature verification key PK _i as a set using the calculation result r _i as a parameter, or uniquely generates either the signature generation key SK _i or the signature verification key PK _i Has the function Gen to do. In addition, the signature key generation unit 201 may use the calculation result r _i as the signature generation key SK _i and generate the signature verification key PK _i from the calculation result r _i . In the first embodiment, SK _i = Gen (r _i ) = r _i and PK _i = Gen (r _i ). Examples of signature schemes that can be used in the present invention include RSA signature schemes, Schnorr signature schemes, and improved schemes thereof (see references A and B).
(Reference A) Tatsuaki Okamoto, Hiroshi Yamamoto, “Contemporary Cryptography”, Sangyo Tosho, 1997, ISBN-13: 978-4782853535
(Reference B) Masashi Une, Tatsuaki Okamoto, “Recent Trends in Theoretical Research on Digital Signatures”, Bank of Japan Financial Research Institute / Financial Studies / 2000.4, [Search April 14, 2010], Internet <http://www.imes.boj.or.jp/japanese/kinyu/2000/kk19-b1-3.pdf>

(Schnorr signature method)
[Key generation]
Select prime number p and prime factor q of p-1. Further, an element x of a multiplicative group modulo p is selected, and y = g ^(−x) mod p is obtained. Here, g is a primitive element of a multiplicative group modulo p, and the order of g is q. The signature generation key is x, and the signature verification key is y, g, p, q.
[Signature generation]
A random number k is generated, and a signature (e, s) for the message M is generated. e = Hash (M, r), s = (xe + k) mod q, r = g ^k mod p. Hash is a hash function.
[Signature verification]
v = g ^s y ^e mod p, e1 = Hash (M, v) is calculated, and the success or failure of e = e1 is verified.

(RSA signature method)
[Key generation]
Select sufficiently large primes p and q to find n = pq. Find the least common multiple L = LCM (p-1, q-1) of p-1 and q-1. A natural number e that satisfies the greatest common divisor GCD (e, L) = 1 is selected, and d that satisfies ed = 1 mod L is selected. The signature generation key is d, and the signature verification key is e, n.
[Signature generation]
Generate a signature S for message M. S = (Hash (M)) ^d mod n.
[Signature verification]
The success or failure of Hash (M) = S ^e mod n is verified.

The transmission unit 207 of the signature generation apparatus 200 transmits the signature verification key PK _i to the AP server apparatus 300 (step S8), and the reception unit 308 of the AP server apparatus 300 receives the signature verification key PK _i (step S8). S9). The signature verification key PK _i is stored in the storage unit 309 of the AP server device 300 in association with the identifier that identifies the terminal device 100-i.

Note that after the processing of step S7 to step S8, the control unit 205 of the signature generation apparatus 200 performs processing of deleting the calculation result r _i from the storage unit 209 of the signature generation apparatus 200 (step S8a).

<Signature process>
Next, application of the application software of the AP server device 300 to the terminal device 100 requires an electronic signature. For example, a request for the AP server device 300 from the terminal device 100-i is triggered to execute a signature process. The

The transmission unit 307 of the AP server device 300 transmits the unique data h _i corresponding to the terminal device 100-i stored in the storage unit 309 to the terminal device 100-i (step S10), and the terminal device 100- The i reception unit 108 receives the unique data h _i transmitted in step S10 (step S11).

The unique calculation unit 101 of the terminal device 100-i performs a calculation g specific to the terminal device 100-i on the unique data h _i received in step S11, and the calculation result r _i = g (h _i ). Is output (step S12). The calculation result r _i is the same as r _i obtained in the process of step S4.

The transmission unit 107 of the terminal device 100-i transmits the calculation result r _i obtained in step S12 to the signature generation device 200 (step S13), and the reception unit 208 of the signature generation device 200 proceeds to step S13. The calculation result r _i transmitted in step S14 is received (step S14). After the process of step S13, the control unit 105 of the terminal device 100-i performs a process of deleting the calculation result r _i from a storage unit (not shown) of the terminal device 100-i (step S13a).

  In addition, the transmission unit 307 of the AP server apparatus 300 transmits the message m to be digitally signed to the signature generation apparatus 200 (step S15), and the reception unit 208 of the signature generation apparatus 200 receives the message m. (Step S16).

The signature key generation unit 201 of the signature generation apparatus 200 generates at least a signature generation key SK _i = Gen (r _i ) using the calculation result r _i received in step S13 (step S17). The signature method is as described above. In the first embodiment, SK _i = Gen (r _i ) = r _i .

Then, the signature generation unit 202 of the signature generation apparatus 200 generates an electronic signature Sig = Gsig (m, SK _i ) for the message m using the signature generation key SK _i (step S18).

  The transmission unit 207 of the signature generation device 200 transmits the electronic signature Sig to the AP server device 300 (step S19), and the reception unit 308 of the AP server device 300 receives the electronic signature Sig (step S20).

The signature verification unit 302 of the AP server device 300 verifies the electronic signature Sig using the signature verification key PK _i corresponding to the terminal device 100-i stored in the storage unit 309 (step S21).

Note that after the processing from step S18 to step S19, the control unit 205 of the signature generation apparatus 200 performs processing of deleting the calculation result r _i and the signature generation key SK _i from the storage unit 209 of the signature generation apparatus 200 (step S19a). ).

As described above, the terminal device 100-i other than the terminal device 100-i obtains the calculation result r _i and the signature generation key SK _i uniquely generated from the calculation result from the unique data h _i input to the terminal device 100-i. If it is difficult, as long as the signature generation apparatus 200 correctly generates the electronic signature and discards the operation result r _i and the signature generation key SK _i , the signature verification key is not involved without involving the terminal apparatus 100-i. It becomes difficult to generate an electronic signature Sig that passes signature verification using PK _i .

Since the calculation result is based on a calculation function unique to each terminal device, it is usually considered difficult for a terminal device other than the terminal device 100- _i to obtain the calculation result r _i . For example, as described above, a unique calculation function is a hash operation with a key, that is, a hash value Hash (S‖K) of data S‖K obtained by concatenating K and S to key data K and input fixed data S This can be easily realized with the function of outputting. In addition, the calculation result r _i is transmitted to the signature generation apparatus 200 by secure communication, and the signature generation apparatus 200 is realized by HSM or the like to make it difficult to modify the processing function. It can be considered that the generation apparatus 200 correctly generates the electronic signature and discards the calculation result.

Furthermore, since the signature generation apparatus 200 does not have the signature generation key SK _i except during the signature generation process, even if the third party apparatus can obtain the internal data of the signature generation apparatus 200, The signature generation key SK _i can be prevented from being illegally stolen except when generating a signature. As for the risk at the time of signature generation, risk hedging is possible by responding to denying signature generation as soon as an abnormality such as theft of the signature generation apparatus 200 or a trace of unauthorized access is confirmed.

  Therefore, the electronic signature Sig generated by the signature generation apparatus 200 is based on the entrustment from the terminal apparatus 100-i, and is an electronic signature generated with the intention of the user, that is, an electronic signature with high proof power. it can.

<< Modification of Embodiment 1 >>
A modification of the first embodiment for improving security in the first embodiment will be described (see FIG. 3). In the first embodiment, it is unknown whether the calculation result r _i is sufficiently random between the terminal devices. In this modification, the calculation result r _i is disturbed by a random number when generating the signature generation key and the signature verification key.

Specifically, in the first embodiment, instead of step S7, the signature key generation unit 201 of the signature generation apparatus 200 disturbs the calculation result r _i with the random number t _i generated by the random number generation unit (not shown). In step S7p, the signature key generation unit 201 of the signature generation apparatus 200 receives the signature verification key PK _i using the information s _i obtained in step S17. It is assumed that at least the signature generation key SK _i is generated (step S17p) using information s _i obtained by disturbing the calculation result r _i with the random number t _i . Since these other processes are the same as those in the first embodiment, description thereof is omitted.

“Information s _i obtained by disturbing the operation result r _i with the random number t _i ” is, for example, s _i = r _i (+) t _i . Here, (+) represents exclusive OR. The signature key generation unit 201 determines the signature generation key SK _i and the signature verification key PK _i as a set using the information s _i as a parameter, or uniquely generates either the signature generation key SK _i or the signature verification key PK _i . The signature key generation unit 201 may use the information s _i as the signature generation key SK _i and generate the signature verification key PK _i from the information s _i . The random number t _i is stored in the storage unit 209 of the signature generation device 200 in association with the identifier that identifies the terminal device 100-i.

Such processing ensures that the information s _i used when generating the signature generation key and signature verification key is sufficiently random. Incidentally, the random number t _i is generated and stored by the AP server 300 may be sent to the signature generation device 200 each time the signing process. Further, in this modification, the processing for ensuring sufficient randomness using the XOR operation has been described, but other operations may be used as long as sufficient randomness can be ensured.

<< Embodiment 2 >>
The second embodiment is an embodiment aimed at preventing leakage of a secret value (for example, the key data K) from the terminal device and recovering the secret value when the terminal is lost in the first embodiment. The same components as those in the first embodiment are denoted by the same reference numerals, and redundant description thereof is omitted.

In the second embodiment, the secret value is divided into three types of values (fragments), and if two types of fragments are used among the three types of fragments, the secret value can be restored, and the secret value cannot be restored only with one type of fragment. A simple division technique is used. As a specific example of such a dividing technique, there is a data dividing method described in the following reference patent document, and this is used.
(Reference Patent Document) Japanese Patent Application Laid-Open No. 2004-213650

[Proxy signature system]
As illustrated in FIG. 4, the proxy signature system 2 according to the second exemplary embodiment includes at least a terminal device 100, a signature generation device 200, a signature verification device 300, an alternative terminal device 400, and a backup device 500. . These devices can communicate with each other via, for example, the communication network 5. In particular, the communication path between the terminal device 100 and the signature generation apparatus 200, the communication path between the alternative terminal apparatus 400 and the signature generation apparatus 200, and the communication path between the backup apparatus 500 and the signature generation apparatus 200 are respectively: It is desirable that highly confidential communication is realized by an encryption technique or the like.

  Since the terminal device 100, the signature generation device 200, and the signature verification device 300 are the same as those in the first embodiment, a duplicate description is omitted.

<Alternative terminal device>
The alternative terminal device 400 is a device having a calculation function and a data transmission / reception function, and is assumed to have substantially the same function as the terminal device 100. In this sense, the alternative terminal device 400 is not different from the terminal device 100, but the alternative terminal 400 is used under the control of the same user or when the terminal device 100 is lost or damaged. The alternative terminal device 400 is different from the terminal device 100 in that the terminal device 100 is scheduled.

<Backup device>
The backup device 500 is sufficient if it has data storage and data transmission / reception functions, and is exemplified by a server device, for example. Although the present invention may include one or a plurality of backup devices, in the second embodiment, the proxy signature system 2 is assumed to include one backup device 500 in order to facilitate understanding of the present invention.

The proxy signature process in the proxy signature system 2 will be described with reference to FIGS. In the following, the processing procedure for registering the signature verification key corresponding to the terminal device 100-i to the AP server 300 (registration process), by dividing the signature generation key SK _i distributed management procedure (dividing process), the electronic signature The processing procedure (signature process) for generating the signature and the processing procedure (recovery process) for restoring the signature generation key SK _i will be described separately. Refer to FIG. 11 for the functional configuration of each device.

<Registration process>
The signature key generation unit 201 of the signature generation device generates a signature generation key SK _i and a signature verification key PK _i (step S101). The signature generation key SK _i is stored in the storage unit 209 of the signature generation apparatus 200 in association with information (identifier) that identifies the terminal apparatus 100-i. Examples of signature schemes that can be used in the present invention include RSA signature schemes, Schnorr signature schemes, and improved schemes thereof (see references A and B above).

The transmission unit 207 of the signature generation apparatus 200 transmits the signature verification key PK _i to the AP server apparatus 300 (step S102), and the reception unit 308 of the AP server apparatus 300 receives the signature verification key PK _i (step S102). S103). The signature verification key PK _i is stored in the storage unit 309 of the AP server device 300 in association with the identifier that identifies the terminal device 100-i.

<Division process>
The unique data generation unit 301 of the AP server device 300 generates unique data h _i1 unique to the terminal device 100-i (step S104). The unique data h _i1 is stored in the storage unit 309 of the AP server device 300 in association with information (identifier) that identifies the terminal device 100-i.

The transmission unit 307 of the AP server device 300 transmits the unique data h _i1 to the terminal device 100-i (Step S105), and the reception unit 108 of the terminal device 100-i receives the unique data h _i1 (Step S105). S106).

The unique calculation unit 101 of the terminal device 100-i performs a calculation g unique to the terminal device 100-i on the unique data h _i1 and outputs this calculation result r _i1 = g (h _i1 ) (step S107). . If the specific operation g is, for example, the hash operation Hash described above, the data h _i1 ‖K obtained by concatenating K _i1 and h _i1 to the key data K _i1 specific to the terminal device 100-i and the input specific data h _i1 . _i1 hash value hash of (h _i1 ‖K _i1) is a calculation result r _i1.

The transmission unit 107 of the terminal device 100-i transmits the calculation result r _i1 to the signature generation device 200 (step S108), and the reception unit 208 of the signature generation device 200 receives the calculation result r _i1 (step S109). ). After the process of step S108, the control unit 105 of the terminal apparatus 100-i performs a process of deleting the calculation result r _i1 from a storage unit (not shown) of the terminal apparatus 100-i (step S108a).

Dividing unit 203 of the signature generating apparatus 200, the signature is generated key SK _i from at least two pieces of the three types of fragments obtained by dividing a recoverable signature generation key SK _i, three fragments The terminal device 100 stored in the storage unit 209 so that the operation result r _i1 becomes one of the fragments of the signature generation key SK _i according to the above-described dividing method in which the signature generation key SK _i cannot be recovered from one type of fragment. The signature generation key SK _i corresponding to −i is divided into three types of fragments r _i1 , u _i1 and v _i1 (step S110). The fragment u _i1 is stored in the storage unit 209 of the signature generation device 200 in association with the identifier that identifies the terminal device 100-i (step S111).

The transmission unit 207 of the signature generation device 200 transmits the fragment v _i1 to the backup device 500 (step S112), and the reception unit 508 of the backup device 500 receives the fragment v _i1 (step S113). The fragment v _i1 is stored in the storage unit 509 of the backup device 500 in association with the identifier that identifies the terminal device 100-i (step S114).

Note that after the process of step S110, the control unit 205 of the signature generation apparatus 200 performs a process of deleting the calculation result r _i1 and the signature generation key SK _i from the storage unit 209 of the signature generation apparatus 200 (step S115).

<Signature process>
Next, application of the application software of the AP server device 300 to the terminal device 100 requires an electronic signature. For example, a request for the AP server device 300 from the terminal device 100-i is triggered to execute a signature process. The

The transmission unit 307 of the AP server device 300 transmits the unique data h _i1 corresponding to the terminal device 100-i stored in the storage unit 309 to the terminal device 100-i (step S116), and the terminal device 100- The i reception unit 108 receives the unique data h _i1 transmitted in step S116 (step S117).

The unique computation unit 101 of the terminal device 100-i performs a computation g unique to the terminal device 100-i on the unique data h _i1 received in step S117, and obtains this computation result r _i1 = g (h _i1 ). Output (step S118). The calculation result r _i is the same as r _i obtained in the process of step S107.

The transmission unit 107 of the terminal device 100-i transmits the calculation result r _i1 obtained in step S118 to the signature generation device 200 (step S119), and the reception unit 208 of the signature generation device 200 proceeds to step S119. The calculation result r _i1 transmitted in step S120 is received. After the process of step S119, the control unit 105 of the terminal device 100-i performs a process of deleting the calculation result r _i1 from a storage unit (not shown) of the terminal device 100-i (step S119a).

  On the other hand, the transmission unit 307 of the AP server device 300 transmits the message m to be digitally signed to the signature generation device 200 (step S121), and the reception unit 208 of the signature generation device 200 receives the message m. (Step S122).

The signature generation unit 202 of the AP server apparatus 300 restores the signature generation key SK _i using the calculation result r _i1 received in step S120 and the fragment u _i1 stored in the storage unit 309 of the AP server apparatus 300, An electronic signature Sig = Gsig (m, SK _i ) is generated for the message m using the restored signature generation key SK _i (step S123).

  The transmission unit 207 of the signature generation apparatus 200 transmits the electronic signature Sig to the AP server apparatus 300 (step S124), and the reception unit 308 of the AP server apparatus 300 receives the electronic signature Sig (step S125).

The signature verification unit 302 of the AP server device 300 verifies the electronic signature Sig using the signature verification key PK _i corresponding to the terminal device 100-i stored in the storage unit 309 (step S126).

Note that after the process of step S123, the control unit 205 of the signature generation apparatus 200 performs a process of deleting the calculation result r _i1 and the signature generation key SK _i from the storage unit 209 of the signature generation apparatus 200 (step S124a).

<Recovery process>
This recovery process is performed when the terminal device 100 is lost or damaged.

The unique data generation unit 301 of the AP server device 300 generates unique data h _i2 unique to the alternative terminal device 400 (step S127). The unique data h _i2 is associated with information (identifier) that identifies the terminal device 100-i _instead of the unique data h _i1 , and the unique data h _i2 corresponds to information (identifier) that identifies the alternative terminal device 400. And stored in the storage unit 309 of the AP server device 300.

The transmission unit 307 of the AP server device 300 transmits the unique data h _i2 to the alternative terminal device 400 (step S128), and the reception unit 408 of the alternative terminal device 400 receives the unique data h _i2 (step S129). .

The unique operation unit 401 of the alternative terminal device 400 performs an operation y specific to the alternative terminal device 400 on the unique data h _i2 and outputs this operation result r _i2 = y (h _i2 ) (step S130). If the hash operation Hash unique operation y is for example described above, alternatively the terminal apparatus 400 to the data h obtained by connecting K _i2 and h _i2 against specific data h _i2 of type-specific key K _{i2 i2} ‖K _i2 The hash value Hash (h _i2 ‖K _i2 ) is the operation result r _i2 .

The transmission unit 407 of the alternative terminal device 400 transmits the calculation result r _i2 to the signature generation device 200 (step S131), and the reception unit 208 of the signature generation device 200 receives the calculation result r _i2 (step S132). . After the process of step S131, the control unit 405 of the alternative terminal device 400 performs a process of deleting the calculation result r _i2 from a storage unit (not shown) of the alternative terminal device 400 (step S131a).

Upon receiving a request from the signature generation device 200, the transmission unit 507 of the backup device 500 uses the fragment v _i1 associated with the terminal device 100-i stored in the storage unit 509 of the backup device 500 as the signature generation device. 200 (step S133), and the reception unit 208 of the signature generation apparatus 200 receives the fragment v _i1 (step S134).

The fragment update unit 204 of the signature generation device 200 restores the signature generation key SK _i using the fragment u _i1 stored in the storage unit 209 of the signature generation device 200 and the fragment v _i1 received in step S214, and according division method, as the operation result r _i2 is one of the restored signature generation key SK _i fragment, dividing the restored signature generation key SK _i into three fragments r _i2, u _i2, v _i2 (Step S135). The fragment u _i2 is stored in the storage unit 209 of the signature generation device 200 in association with the identifier that identifies the alternative terminal device 400 (step S136).

The transmission unit 207 of the signature generation device 200 transmits the fragment v _i2 to the backup device 500 (step S137), and the reception unit 508 of the backup device 500 receives the fragment v _i2 (step S138). The fragment v _i2 is stored in the storage unit 509 of the backup device 500 in association with the identifier that identifies the alternative terminal device 400 (step S139).

Note that after the process of step S135, the control unit 205 of the signature generation apparatus 200 performs a process of deleting the calculation result r _i2 and the signature generation key SK _i from the storage unit 209 of the signature generation apparatus 200 (step S140).

After the processing in step S135 is executed, the signature generation apparatus 200 generates an electronic signature based on a request from the alternative terminal apparatus 400. That is, the steps S116 to S126 of the signature process are executed for the alternative terminal device 400. At this time, in the description of each of the above-described steps S116 to S126, “terminal device 100-i” is replaced with “alternative terminal device 400”, “unique data h _i1 ” is represented with “unique data h _i2 ”, and “calculation result r `` <sub>i1</sub> '' into `` operation result r _i2 '', `` fragment r <sub>i1</sub> '' into `` fragment r _i2 '', `` fragment u <sub>i1</sub> '' into `` fragment u _i2 '', `` fragment v <sub>i1</sub> '' into `` fragment v _i2 '', “Key data K _i1 ” may be replaced with “Key data K _i2 ”.

In the recovery process, there is an operational advantage that it is not necessary to change the signature verification key PK _i even if the terminal device 100 is lost or damaged. Even if the lost terminal device 100-i is used illegally, the AP server device 300 refuses to transmit the unique data hi ₁ or the signature generation device 200 refuses to receive the calculation result ri _1. Can be prevented.

<< Modification of Embodiment 2 >>
A modification of the second embodiment for improving security in the second embodiment will be described (FIGS. 8-10). In the second embodiment, it is unknown whether the calculation result r _{i that} is a fragment of the signature generation key SK _i is sufficiently random. Therefore, in this modification, the calculation result r _i is disturbed with a random number when the division process is executed. Along with this process, the signature generation process and the fragment update process are changed.

Specifically, in the second embodiment,
Instead of step S110, the dividing unit 203 of the signature generation device 200, among the three kinds of fragments obtained by dividing the signature generation key SK _i is a recoverable signature generation key SK _i at least two kinds of fragments According to the above dividing method in which the signature generation key SK _i cannot be recovered from one of the three types of fragments, the operation result r _i1 is disturbed by a random number t _i1 generated by a random number generation unit (not shown). The signature generation key SK _i corresponding to the terminal device 100-i stored in the storage unit 209 is changed into three types of fragments s _i1 , u so that the obtained information s _i1 becomes one of the fragments of the signature generation key SK _i. A process of dividing into _i1 and v _i1 (step S110p),
Instead of step S123, the signature generation unit 202 of the AP server 300 is a storage unit 309 of the information s _i1 and the AP server 300 to obtain a calculation result r _i1 received in step S200 and disturbance in the random number t _i1 The signature generation key SK _i is restored using the fragment u _i1 stored in, and the electronic signature Sig = (m, SK _i ) is generated for the message m using the restored signature generation key SK _i (Step S123p)
Instead of step S135, the fragment update unit 204 of the signature generation device 200 uses the fragment u _i1 stored in the storage unit 209 of the signature generation device 200 and the fragment v _i1 received in step S214 to generate the signature generation key SK. restore _i, the following division method, fragments of the operation result random number generation unit r _i2 signature information s _i2 obtained by disrupting a random number t _i2 generated by (not shown) is restored generated key SK _i It is assumed that the restored signature generation key SK _i is divided into three types of fragments s _i2 , u _i2 and v _i2 (step S135p). Since these other processes are the same as those in the second embodiment, description thereof will be omitted.

“Information s _{i *} obtained by disturbing the calculation result r _{i *} with a random number t _{i *} ” (* = 1 or 2) is, for example, s _{i *} = r _{i *} (+) t _{i *} . Here, (+) represents exclusive OR. The random number t _i1 is associated with the identifier that identifies the terminal device 100-i and is stored in the storage unit 209 of the signature generation device 200, and the random number t _i2 is associated with the identifier that identifies the alternative terminal device 400. And stored in the storage unit 209 of the signature generation apparatus 200.

Such processing ensures that the information s _{i *} used for generating the signature generation key and signature verification key is sufficiently random. Note that the random number t _{i *} may be generated and stored by the AP server device 300 and transmitted to the signature generation device 200 at each signature process. Further, in this modification, the processing for ensuring sufficient randomness using the XOR operation has been described, but other operations may be used as long as sufficient randomness can be ensured.

<Supplementary note>
Hardware entities (terminal device, signature generation device, signature verification device, alternative terminal device, backup device) included in the proxy signature system are an input unit that can be connected to a keyboard, an output unit that can be connected to a liquid crystal display, etc. A communication unit to which a communication device (for example, a communication cable) that can communicate with the outside of the wear entity can be connected, a CPU (Central Processing Unit) [a cache memory, a register, etc. ], A RAM or ROM that is a memory, an external storage device that is a hard disk, and a bus that connects the input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so that data can be exchanged between them. have. If necessary, a hardware entity may be provided with a device (drive) that can read and write a recording medium such as a CD-ROM. A physical entity having such hardware resources includes a general-purpose computer.

  The external storage device of the hardware entity stores a program necessary for realizing the above functions and data necessary for processing the program (not limited to the external storage device, for example, reading a program) It may be stored in a ROM that is a dedicated storage device.) Data obtained by the processing of these programs is appropriately stored in a RAM or an external storage device. In the above description, a storage device such as a RAM or a register that stores an operation result, an address of a storage area thereof, or the like is simply referred to as a “storage unit”.

  In the hardware entity, each program stored in an external storage device (or ROM, etc.) and data necessary for processing each program are read into a memory as necessary, and are interpreted and executed by a CPU as appropriate. . As a result, the CPU implements predetermined functions (for example, a specific operation unit, a specific data generation unit, a signature verification unit, a signature key generation unit, a signature generation unit, a division unit, a fragment update unit, and a control unit).

In the details of the hardware entity described in each embodiment, numerical calculation processing in number theory may be required, but numerical calculation processing in number theory itself is achieved in the same manner as in the well-known technique. A detailed description of the arithmetic processing method and the like has been omitted (software that can perform numerical calculation processing in number theory indicating the technical level of this point includes, for example, PARI / GP, KANT / KASH, etc. About PARI / GP For example, see the Internet <URL: http://pari.math.u-bordeaux.fr/> [Search April 9, 2010] For KANT / KASH, for example, the Internet <URL: http: / /www.math.tu-berlin.de/algebra/> [Search April 9, 2010].)
Reference literature C can be cited as a literature regarding this point.
(Reference C) H. Cohen, "A Course in Computational Algebraic Number Theory", GTM 138, Springer-Verlag, 1993.

  The present invention is not limited to the above-described embodiment, and can be appropriately changed without departing from the spirit of the present invention. In addition, the processing described in the above embodiment may be executed not only in time series according to the order of description but also in parallel or individually as required by the processing capability of the apparatus that executes the processing. .

  Further, when the processing functions in the hardware entity described in the above embodiment are realized by a computer, the processing contents of the functions that the hardware entity should have are described by a program. Then, by executing this program on a computer, the processing functions in the hardware entity are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, a hardware entity is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (8)

A proxy signature system including a terminal device, a signature generation device, and a signature verification device, wherein the signature generation device generates an electronic signature based on a request from the terminal device;
The terminal device is
A unique operation unit that performs an operation specific to the terminal device for data given to the terminal device (hereinafter referred to as unique data) and outputs an operation result;
The signature generation device
A signature key generation unit capable of generating a signature generation key and a signature verification key using the calculation result;
A signature generation unit that generates an electronic signature for the message set by the signature verification apparatus using the signature generation key;
A control unit that performs a process of deleting the calculation result and the signature generation key from the storage unit of the signature generation device,
The signature verification device
A unique data generation unit that generates the unique data unique to the terminal device;
A signature verification unit that verifies the electronic signature using the signature verification key,
Proxy signature system. The proxy signature system according to claim 1,
The signature generation device
Instead of the signature key generation unit of the signature generation device,
A proxy signature system comprising a signature key generation unit capable of generating a signature generation key and a signature verification key using information obtained by disturbing the operation result with a random number. A proxy signature including a terminal device, an alternative terminal device, a signature generation device, a signature verification device, and a backup device, and the signature generation device generates an electronic signature based on a request from the terminal device or the alternative terminal device A system,
The terminal device is
A unique operation unit that performs an operation specific to the terminal device for data given to the terminal device (hereinafter referred to as first unique data) and outputs an operation result r1;
The alternative terminal device is
A unique operation unit that performs an operation specific to the alternative terminal device for data given to the alternative terminal device (hereinafter referred to as second unique data) and outputs an operation result r2,
The signature generation device
A signature key generation unit for generating a signature generation key and a signature verification key;
The signature generation key can be restored from at least two of the three types of fragments obtained by dividing the signature generation key, but the signature generation key is restored from one of the three types of fragments. A dividing unit that divides the signature generation key into three types of fragments r1, u1, and v1, so that the operation result r1 becomes one of the fragments of the signature generation key according to an impossible division method;
A signature generation unit that restores the signature generation key using the operation result r1 and the fragment u1, and generates an electronic signature for the message set by the signature verification device using the restored signature generation key;
Reconstructing the signature generation key using the fragment u1 and the fragment v1, and reconstructing the signature so that the operation result r2 becomes one of the reconstructed signature generation key fragments according to the division method A fragment update unit that divides the key into three types of fragments r2, u2, and v2,
A control unit that performs processing to delete the calculation result r1, the calculation result r2, and the signature generation key from the storage unit of the signature generation device;
A storage unit for storing the signature generation key fragment u1 and / or the fragment u2;
The signature verification device
A unique data generation unit that generates the first unique data and the second unique data unique to the terminal device and the alternative terminal device, respectively;
A signature verification unit that verifies the electronic signature using the signature verification key,
The backup device
A storage unit for storing the signature generation key fragment v1 and / or the fragment v2;
A proxy signature system in which the signature generation device generates an electronic signature based on a request from the alternative terminal device after the processing by the fragment update unit is executed. In the proxy signature system according to claim 3,
The signature generation device
In place of the dividing unit of the signature generation device,
The signature generation key can be restored from at least two of the three types of fragments obtained by dividing the signature generation key, but the signature generation key is restored from one of the three types of fragments. According to an impossible division method, the signature generation key is divided into three types of fragments s1, u1, and v1 so that the information s1 obtained by disturbing the operation result r1 with a random number becomes one of the fragments of the signature generation key. A dividing part to be
Instead of the signature generator above,
The signature generation key is restored using the information s1 obtained by disturbing the operation result r1 with the random number and the fragment u1, and the message set by the signature verification apparatus using the restored signature generation key A signature generation unit for generating an electronic signature
Instead of the fragment update unit of the signature generation device,
The signature generation key is restored using the fragment u1 and the fragment v1, and the information s2 obtained by disturbing the operation result r2 with a random number is restored according to the division method, A proxy signature system comprising: a fragment update unit that divides the restored signature generation key into three types of fragments s2, u2, and v2. In a proxy signature system including a terminal device, a signature generation device, and a signature verification device, a proxy signature method in which the signature generation device generates an electronic signature based on a request from the terminal device,
A unique data generation step in which the unique data generation unit of the signature verification device generates unique data unique to the terminal device;
A first unique data transmission step in which a transmission unit of the signature verification device transmits the unique data to the terminal device;
A first unique data receiving step in which the receiving unit of the terminal device receives the unique data;
A first unique calculation step in which the unique calculation unit of the terminal device performs a calculation specific to the terminal device on the unique data and outputs a calculation result;
A first computation result transmission step in which the transmission unit of the terminal device transmits the computation result to the signature generation device;
A first computation result receiving step in which the receiving unit of the signature generation device receives the computation result;
A first signature key generation step in which a signature key generation unit of the signature generation device generates at least a signature verification key using the calculation result;
A verification key transmission step in which the transmission unit of the signature generation device transmits the signature verification key to the signature verification device;
A verification key receiving step in which the receiving unit of the signature verification apparatus receives the signature verification key;
A first discard step in which the control unit of the signature generation device performs a process of deleting the calculation result from the storage unit of the signature generation device;
A second unique data transmission step in which the transmission unit of the signature verification device transmits the unique data to the terminal device;
A second unique data receiving step in which the receiving unit of the terminal device receives the unique data transmitted in the second unique data transmitting step;
A second specific calculation step in which the specific calculation unit of the terminal device performs a calculation specific to the terminal device with respect to the specific data received in the second specific data reception step, and outputs a calculation result;
A second computation result transmission step in which the transmission unit of the terminal device transmits the computation result obtained in the second unique computation step to the signature generation device;
A second calculation result receiving step in which the receiving unit of the signature generation device receives the calculation result transmitted in the second calculation result transmitting step;
A message transmission step in which a transmission unit of the signature verification apparatus transmits a message to the signature generation apparatus;
A message receiving step in which the receiving unit of the signature generating apparatus receives the message;
A second signature key generation step in which a signature key generation unit of the signature generation device generates at least a signature generation key using the calculation result received in the second calculation result reception step;
A signature generation step in which a signature generation unit of the signature generation device generates an electronic signature for the message using the signature generation key;
A signature transmission step in which the transmission unit of the signature generation device transmits the electronic signature to the signature verification device;
A signature receiving step in which the receiving unit of the signature verification apparatus receives the electronic signature;
A second discarding step in which the control unit of the signature generation device performs a process of deleting the calculation result and the signature generation key from the storage unit of the signature generation device;
A proxy signature method, wherein the signature verification unit of the signature verification apparatus includes a signature verification step of verifying the electronic signature using the signature verification key. The proxy signing method according to claim 5,
Instead of the first signing key generation step,
A first signature key generation step in which a signature key generation unit of the signature generation device generates at least a signature verification key using information obtained by disturbing the operation result with a random number;
Instead of the second signing key generation step,
Second signature key generation in which the signature key generation unit of the signature generation device generates at least a signature generation key using information obtained by disturbing the calculation result received in the second calculation result receiving step with the random number A surrogate signature method comprising the steps of: In a proxy signature system including a terminal device, an alternative terminal device, a signature generation device, a signature verification device, and a backup device, the signature generation device receives an electronic signature based on a request from the terminal device or the alternative terminal device. A proxy signing method to generate,
A signature key generation step in which a signature key generation unit of the signature generation device generates a signature generation key and a signature verification key;
A verification key transmission step in which the transmission unit of the signature generation device transmits the signature verification key to the signature verification device;
A verification key receiving step in which the receiving unit of the signature verification apparatus receives the signature verification key;
A unique data generation unit of the signature verification apparatus that generates first unique data unique to the terminal device;
A first unique data transmission step in which a transmission unit of the signature verification device transmits the first unique data to the terminal device;
A first unique data receiving step in which the receiving unit of the terminal device receives the first unique data;
A first unique calculation step in which a unique calculation unit of the terminal device performs a calculation specific to the terminal device on the first unique data and outputs a calculation result r1;
A first computation result transmission step in which a transmission unit of the terminal device transmits the computation result r1 to the signature generation device;
A reception unit of the signature generation apparatus receiving a first calculation result r1 for receiving the calculation result r1;
The division unit of the signature generation device can restore the signature generation key from at least two types of fragments among the three types of fragments obtained by dividing the signature generation key. The signature generation key is divided into three types of fragments r1, u1, and v1 so that the calculation result r1 becomes one of the fragments of the signature generation key according to a division method in which the signature generation key cannot be recovered from the fragments of A splitting step;
A storage step in which the storage unit of the signature generation device stores the fragment u1,
A first fragment transmission step in which a transmission unit of the signature generation device transmits the fragment v1 to the backup device;
A first fragment receiving step in which the receiving unit of the backup device receives the fragment v1;
A storage step in which the storage unit of the backup device stores the fragment v1, and
A first discard step in which the control unit of the signature generation device performs a process of deleting the calculation result r1 and the signature generation key from the storage unit of the signature generation device;
A second unique data transmission step in which the transmission unit of the signature verification device transmits the first unique data to the terminal device;
A second unique data receiving step in which the receiving unit of the terminal device receives the first unique data transmitted in the second unique data transmitting step;
A second unique calculation step in which the unique calculation unit of the terminal device performs a calculation specific to the terminal device with respect to the first unique data received in the second unique data reception step, and outputs a calculation result r1;
A second computation result transmission step in which the transmission unit of the terminal device transmits the computation result r1 obtained in the second unique computation step to the signature generation device;
A second calculation result receiving step in which the receiving unit of the signature generation device receives the calculation result r1 transmitted in the second calculation result transmitting step;
A message transmission step in which a transmission unit of the signature verification apparatus transmits a message to the signature generation apparatus;
A message receiving step in which the receiving unit of the signature generating apparatus receives the message;
The signature generation unit of the signature verification apparatus restores the signature generation key using the calculation result r1 received in the second calculation result receiving step and the fragment u1 stored in the storage unit of the signature verification apparatus A signature generation step for generating an electronic signature for the message using the restored signature generation key;
A signature transmission step in which the transmission unit of the signature generation device transmits the electronic signature to the signature verification device;
A signature receiving step in which the receiving unit of the signature verification apparatus receives the electronic signature;
A second discarding step in which the control unit of the signature generation device performs a process of deleting the calculation result r1 and the signature generation key from the storage unit of the signature generation device;
A signature verification step in which the signature verification unit of the signature verification apparatus verifies the electronic signature using the signature verification key;
A second unique data generation step in which the unique data generation unit of the signature verification device generates second unique data unique to the alternative terminal device;
A third unique data transmission step in which the transmission unit of the signature verification device transmits the second unique data to the alternative terminal device;
A third unique data receiving step in which the receiving unit of the alternative terminal device receives the second unique data;
A third unique calculation step in which the unique calculation unit of the alternative terminal device performs a calculation specific to the alternative terminal device on the second specific data and outputs a calculation result r2.
A third computation result transmission step in which the transmission unit of the alternative terminal device transmits the computation result r2 to the signature generation device;
A third calculation result receiving step in which the receiving unit of the signature generation device receives the calculation result r2,
A second fragment transmission step in which the transmission unit of the backup device transmits the fragment v1 stored in the storage unit of the backup device to the signature generation device;
A second fragment receiving step in which the receiving unit of the signature generation apparatus receives the fragment v1,
The fragment update unit of the signature generation device restores the signature generation key using the fragment u1 stored in the storage unit of the signature generation device and the fragment v1 received in the second fragment reception step, A fragment update step of dividing the restored signature generation key into three types of fragments r2, u2, and v2 so that the operation result r2 becomes one of the restored fragments of the signature generation key according to the division method; ,
A storage step in which the storage unit of the signature generation device stores the fragment u2, and
A third fragment transmission step in which the transmission unit of the signature generation device transmits the fragment v2 to the backup device;
A third fragment receiving step in which the receiving unit of the backup device receives the fragment v2,
A storage step in which the storage unit of the backup device stores the fragment v2, and
A control unit of the signature generation device includes a third discarding step for performing a process of erasing the calculation result r2 and the signature generation key from the storage unit of the signature generation device;
A proxy signature method in which the signature generation apparatus generates an electronic signature based on a request from the alternative terminal apparatus after the processing in the fragment update step is executed. The proxy signing method according to claim 7,
Instead of the above division step,
The division unit of the signature generation device can restore the signature generation key from at least two types of fragments among the three types of fragments obtained by dividing the signature generation key. Three types of signature generation keys are used so that information s1 obtained by disturbing the operation result r1 with a random number becomes one of the fragments of the signature generation key according to a division method in which the signature generation key cannot be recovered from the fragments of Splitting step to s1, u1, v1
Instead of the above signature generation step,
The signature generation unit of the signature verification apparatus stores information s1 obtained by disturbing the calculation result r1 received in the second calculation result reception step with the random number and the storage unit of the signature verification apparatus A signature generation step of restoring the signature generation key using the fragment u1 and generating an electronic signature for the message using the restored signature generation key;
Instead of the fragment update step above,
The fragment update unit of the signature generation device restores the signature generation key using the fragment u1 stored in the storage unit of the signature generation device and the fragment v1 received in the second fragment reception step, According to the division method, the restored signature generation key is divided into three types of fragments s2, so that the information s2 obtained by disturbing the operation result r2 with a random number becomes one of the restored signature generation key fragments. and a fragment update step of dividing into u2 and v2.

Images