JP2015037298A - Terminal, id-type signature ciphering method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide high-speed signature processing without leakage of a secret key by dividing signature processing and allowing an anti-tamper device and a terminal for causing the anti-tamper device to operate to execute the divided signature processing.SOLUTION: A controller 110 controls, in the ID-type signature ciphering processing, an arithmetic processing unit 120 to execute arithmetic processing needing no secret key, and transmits the arithmetic result to an anti-tamper device 130. The anti-tamper device 130 executes only arithmetic processing needing a secret key by using the received arithmetic result and transmits the arithmetic result to the controller 110. The controller transmits the ciphered signature to an inspection server 200 via a transmitter 140.

Description

  The present invention relates to a terminal that implements signature processing between a tamper resistant device and a host terminal that operates the tamper resistant device, and realizes faster signature processing without leaking a secret key, an ID type signature encryption method, and Regarding the program.

  Software may not be used normally because it is tampered with without permission or a virus is mixed. For this countermeasure, a method for confirming whether the software has been falsified or whether malicious software such as a virus has been mixed using an electronic signature has been proposed (for example, non-patent literature). 1).

F. Hess. Efficient Identity Based Signature Schemes Based on Pairings, “SAC 2002, LNCS 2595, pp. 310-324.

  However, with the technology disclosed in Non-Patent Document 1, executing all processing within the tamper resistant device has a large processing load. Further, if all processing is performed on the host terminal side, there is a risk that the secret key is leaked.

  Therefore, the present invention has been made in view of the above-described problems, and performs signature processing between a tamper-resistant device and a terminal that operates the tamper-resistant device, and performs faster processing without leaking a secret key. It is an object of the present invention to provide a terminal, an ID-type signature encryption method, and a program that implement signature processing.

  The present invention proposes the following matters in order to solve the above problems.

  (1) The present invention is a terminal equipped with a tamper-resistant device, and in the tamper-resistant device, only arithmetic processing means for performing arithmetic processing and arithmetic processing that requires a secret key in ID-type signature encryption processing Control means for causing the arithmetic processing means to execute the other arithmetic processing, and transmission means for transmitting the encrypted signature to the verification server in the ID-type signature encryption processing, Proposes a terminal to do.

  (2) The present invention proposes a terminal characterized in that, for the terminal of (1), the ID is the telephone number of the terminal.

  (3) The present invention proposes a terminal in which the tamper resistant device is a UIM (User Identity Module) for the terminal of (1) or (2).

(4) The present invention provides an ID type signature encryption method in a terminal comprising a tamper resistant device, an arithmetic processing unit, a control unit and a transmission unit, wherein the control unit uses a secret key in the ID type signature encryption process. A first step for causing the arithmetic processing means to execute arithmetic processing that is not required;
A second step of transmitting the calculation result to the tamper resistant device, and a third step of executing only the calculation process that requires the secret key by using the received calculation result. A fourth step in which the tamper resistant device transmits a calculation result to the control means; and a fifth step in which the control means transmits an encrypted signature to the verification server via the transmission means; The ID type signature encryption method characterized by comprising the above.

  (5) The present invention proposes an ID type signature encryption method according to (4), wherein the ID is a telephone number of the terminal.

  (6) The present invention proposes an ID type signature encryption method characterized in that the tamper resistant device is a UIM (User Identity Module) with respect to the ID type signature encryption method of (4) or (5). .

  (7) The present invention is a program for causing a computer to execute an ID-type signature encryption method in a terminal provided with a tamper-resistant device, an arithmetic processing unit, a control unit, and a transmission unit. In the signature encryption process, a first step for causing the arithmetic processing means to execute a calculation process that does not require a secret key, a second step for transmitting the calculation result to the tamper resistant device, and the tamper resistant device include: A third step of executing only the calculation process that requires the secret key using the received calculation result; a fourth step of the tamper resistant device transmitting the calculation result to the control means; The control means provides a program for causing the computer to execute a fifth step of transmitting the encrypted signature to the verification server via the transmission means. It is.

  (8) The present invention proposes a program in which the ID is a telephone number of the terminal in the program of (7).

  (9) The present invention proposes a program according to (7) or (8), wherein the tamper resistant device is a UIM (User Identity Module).

  According to the present invention, there is an effect that a high-speed and highly secure signature and user authentication can be realized.

It is a figure which shows the structure of the system which concerns on embodiment of this invention. It is a figure which shows the structure of the terminal which concerns on embodiment of this invention. It is a figure which shows the process of the ID type signature encryption method which concerns on embodiment of this invention. It is a figure which shows the specific example of a process of the ID type signature encryption method which concerns on embodiment of this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<Embodiment>
The embodiment of the present invention will be described with reference to FIGS.

<System configuration>
As shown in FIG. 1, the system according to this embodiment includes a terminal 100 and a verification server 200.

  The terminal 100 divides ID type signature generation processing into the main body CPU and UIM. That is, the process using the secret key is executed by the UIM, and other processes are performed by the CPU of the main body. Details will be described later. The verification server 200 verifies the validity of the ID type signature generated by the terminal 100.

<Terminal configuration>
As illustrated in FIG. 2, the terminal according to the present embodiment includes a control unit 110, an arithmetic processing unit 120, a tamper resistant device 130, and a transmission unit 140.

  The arithmetic processing unit 120 performs main arithmetic processing for the entire terminal. In the ID-type signature encryption process, the control unit 110 causes only the calculation process that requires a secret key to be executed in the tamper resistant device 130 and causes the calculation processing unit 120 to execute another calculation process. The transmission unit 140 transmits the encrypted signature to the verification server 200 in the ID type signature encryption process.

Hereinafter, the function of each component will be specifically described.
First, PεG ₁ and a random number sε (Z / qZ) ^* is a master key. P _pub = sP is a public key, H ₁ : {0,1} ^* → G ₁ and H: {0,1} × G ₂ → (Z / qZ) ^* are hash functions, and public personal information ID∈ {0 1} ^* , let the public key be Q _ID = H ₁ (ID) εG ₁ and the secret key be S _ID = sQ _ID .

Based of the above assumptions, to sign a message m ∈ {0, 1} ^* the private key _{S ID,} terminal, using any P∈G ₁ ^* and the random number k∈ (Z / ^{qZ) *} The following three steps are performed.

1) r: = e (P ₁ , P) ^k ∈ G ₁
2) v: = H (m, r) ε (Z / qZ) ^*
_{3) u: = vS ID +} kP 1 ∈G 1
At this time, the signature is (u, v) εG ₁ × (Z / qZ) ^* .

Above, of the three steps, operations using the private key S _ID is only the last step. Therefore, the control unit causes the arithmetic processing unit 120 to execute the operations of step 1) and step 2), and causes the tamper resistant device 130 to execute the operation of only step 3).

Further, the verification server 200 calculates r ′ = e (u, P) e (Q _ID , −P _pub ) ^v from the public key Q _ID , the message m received from the terminal, and the signature (u, v). Authentication is performed after confirming that v = H (m, r ′).

In this example, if (u, v) is given as above,
r ′ = e (u, P) e (Q _ID , −P _pub ) ^v
= E (vS _ID + kP ₁ , P) e (Q _ID , −P _pub ) ^v
_{= E (vsQ ID, P)} e (kP 1, P) e (Q ID, -P pub) v
^{_{= E (Q ID, P pub}} ) v e (kP 1, P) e (Q ID, P pub) -v
= E (P ₁ , P) ^k = r
Therefore, v = H (m, r). Since the terminal arbitrarily takes P ₁ ∈G ₁ at the time of signing, e (P ₁ , P) may be calculated in advance, for example, P ₁ = P.

<Terminal processing>
Processing of the terminal according to the present embodiment will be described with reference to FIGS. 3 and 4.

  First, as shown in FIG. 3, the control unit 110 causes the arithmetic processing unit 120 to perform arithmetic processing that does not require a secret key in the ID-type signature encryption processing (step S <b> 110), and the arithmetic result is sent to the tamper resistant device 130. Transmit (step S120).

  Next, the tamper resistant device 130 uses the received calculation result to execute only the calculation process that requires the secret key (step S130), and transmits the calculation result to the control unit 110 (step S140). And the control part 110 transmits a signature to the verification server 200 via the transmission part 140 (step S150).

Hereinafter, the processing of the terminal according to the present embodiment will be specifically described with reference to FIG.
First, PεG ₁ and a random number sε (Z / qZ) ^* is a master key. P _pub = sP is a public key, H ₁ : {0,1} ^* → G ₁ and H: {0,1} × G ₂ → (Z / qZ) ^* are hash functions, and public personal information ID∈ {0 1} ^* , let the public key be Q _ID = H ₁ (ID) εG ₁ and the secret key be S _ID = sQ _ID .

Based of the above assumptions, to sign a message m ∈ {0, 1} ^* the private key _{S ID,} terminal, using any P∈G ₁ ^* and the random number k∈ (Z / ^{qZ) *} The following three steps are performed.

1) r: = e (P ₁ , P) ^k ∈ G ₁
2) v: = H (m, r) ε (Z / qZ) ^*
_{3) u: = vS ID +} kP 1 ∈G 1
At this time, the signature is (u, v) εG ₁ × (Z / qZ) ^* .

Above, of the three steps, operations using the private key S _ID is only the last step. Therefore, the control unit causes the arithmetic processing unit 120 to execute the operations of step 1) and step 2), and causes the tamper resistant device 130 to execute the operation of only step 3).

That is, first, the arithmetic processing unit 120 generates a random number k, calculates r: = e (P ₁ , P) ^k ∈G ₁ (step S210), and then calculates r from the message m. v: = H (m, r) ε (Z / qZ) ^* is calculated (step S220).

  The control unit 110 receives the random numbers k and v from the arithmetic processing unit 120 and transmits them to the tamper resistant device 130 (step S230).

The tamper resistant device 130, using the _{S ID stored, u: = vS ID + kP} 1 calculates the ∈G ₁ (step S240), the transmission unit 140 transmits the computed u verification server 200 ( Step S250).

  As described above, according to the present embodiment, the signature process is divided and executed between the tamper-resistant device and the arithmetic processing unit of the terminal, thereby preventing leakage of the secret key and performing high-speed processing. Signature processing can be realized.

  The terminal of the present invention can be realized by recording the processing of the terminal on a recording medium readable by the computer system, causing the terminal to read and execute the program recorded on the recording medium. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

100; terminal 110; control unit 120; arithmetic processing unit 130; tamper resistant device 140; transmission unit 200;

Claims (9)

A terminal equipped with a tamper resistant device,
Arithmetic processing means for performing arithmetic processing;
In the ID type signature encryption process, only a calculation process that requires a secret key is executed in the tamper resistant device, and another calculation process is executed by the calculation processing means;
In the ID-type signature encryption process, a transmission unit that transmits an encrypted signature to a verification server;
A terminal comprising:   The terminal according to claim 1, wherein the ID is a telephone number of the terminal.   The terminal according to claim 1, wherein the tamper resistant device is a UIM (User Identity Module). An ID-type signature encryption method in a terminal provided with a tamper-resistant device, arithmetic processing means, control means, and transmission means,
A first step for causing the arithmetic processing means to execute arithmetic processing that does not require a secret key in the ID-type signature encryption processing;
A second step of transmitting the calculation result to the tamper resistant device;
A third step in which the tamper resistant device executes only a calculation process that requires the secret key using the received calculation result;
A fourth step in which the tamper resistant device transmits a calculation result to the control means;
A fifth step in which the control means transmits the encrypted signature to the verification server via the transmission means;
An ID-type signature encryption method comprising:   5. The ID type signature encryption method according to claim 4, wherein the ID is a telephone number of the terminal.   6. The ID type signature encryption method according to claim 4, wherein the tamper resistant device is a UIM (User Identity Module). A program for causing a computer to execute an ID-type signature encryption method in a terminal including a tamper-resistant device, arithmetic processing means, control means, and transmission means,
A first step for causing the arithmetic processing means to execute arithmetic processing that does not require a secret key in the ID-type signature encryption processing;
A second step of transmitting the calculation result to the tamper resistant device;
A third step in which the tamper resistant device executes only a calculation process that requires the secret key using the received calculation result;
A fourth step in which the tamper resistant device transmits a calculation result to the control means;
A fifth step in which the control means transmits the encrypted signature to the verification server via the transmission means;
A program that causes a computer to execute.   The program according to claim 7, wherein the ID is a telephone number of the terminal.   The program according to claim 7 or 8, wherein the tamper resistant device is a UIM (User Identity Module).

Images