JP4678956B2 - Attribute certification program and device - Google Patents

Description

【００６３】
これにより、検証者装置Ｖは、属性認可書Ｃert_A内の全ての属性情報ａ₁〜ａ_nのうち、開示要求されたｉ個の属性情報ａ₁〜ａ_iの全てが認可された正当な情報であることを検証することができる。
また、検証結果が正当を示すとき、属性証明検証部３４は、開示要求した属性ｊ∈Λについて、ステップＳＴ１２で受けたコミット値ｃ_jを使い、開示された属性ａ_jの正当性を次の第２検証式のように個別に検証する（ＳＴ１６）。
【数２】

【００６４】
これにより、検証者装置Ｖは、属性認可書Ｃert_A内のｎ個の属性ａ₁〜ａ_nのうち、開示された属性ａ_jのみを個別に検証することができる。
【００６５】
上述したように本実施形態によれば、ｎ個の属性情報ａ₁〜ａ_nの埋め込まれた属性認可書Ｃert_Aを利用し、開示要求されたｎ個以下の属性情報ａ_jのみを検証者装置Ｖに開示し、開示要求されない属性情報を隠蔽できる。
【００６６】
このように、各種証明／署名の際に、属性情報ａ_jを選択的に開示する属性証明システムを構築できるので、各種システムに応用でき、情報化社会の発展に寄与することができる。
【００６７】
すなわち、利用者装置Ａは、ステップＳＴ１２により、属性認可書Ｃert_A内の全ての属性情報ａ₁〜ａ_nが認可された正当な情報であることを検証者装置Ｖに証明することができる。
【００６８】
また、利用者装置Ａは、ステップＳＴ１５により、属性認可書Ｃert_A内の全ての属性情報ａ₁〜ａ_nのうち、開示要求されたｉ個の属性情報ａ₁〜ａ_iの全てが認可された正当な情報であることを検証者装置Ｖに証明することができる。
【００６９】
さらに、利用者装置Ａは、ステップＳＴ１６により、各属性ａ_jを個別に証明できるので、必要最小限の属性ａ_jしか開示しなくとも済む。このため、開示要求されなかった属性情報を検証者から隠蔽・保護することができる。例えば、属性情報がプライバシーに関する内容である場合、開示要求されなかった属性情報に関するプライバシーを保護することができる。
【００７０】
（第２の実施形態）
次に、本発明の第２の実施形態に係る属性証明システムについて述べるが、第１の実施形態と同一部分についてはその詳しい説明を省略し、ここでは異なる部分について主に述べる。なお、以下の各実施形態についても同様にして重複した説明を省略する。
すなわち、本実施形態は、第１の実施形態の変形例であり、セキュリティの向上を図るものであって、具体的には、属性証明ｆ(ｍ)の生成過程において、属性証明に使用される値ｍを、チャレンジＭのハッシュ値ｍ＝ｈ(Ｍ)に変更した構成となっている。
【００７１】
従って、本実施形態は、以下に述べる属性証明時のチャレンジに関する動作以外は第１の実施形態と同様の作用効果を有する。
すなわち、本実施形態の属性証明時においては、検証者装置Ｖのチャレンジ生成部３３が、チャレンジｍではなく、チャレンジＭ∈_RＺｑ*を生成して前述同様に（開示要求する属性群Λと共に）利用者装置Ａに送信する。
【００７２】
利用者装置Ａの属性証明生成部１５は、チャレンジＭのハッシュ値ｍ＝ｈ(Ｍ)を計算し、このハッシュ値ｍに対する属性証明ｆ(ｍ)を前述同様に計算し、前述同様に（検証用データ（ｊ,ａ_j,ｒ_j）と共に）検証者装置Ｖに送信する。
【００７３】
また、検証者装置Ｖの属性証明検証部３４は、利用者装置Ａから属性証明ｆ(ｍ)を受けると、チャレンジＭのハッシュ値ｍ＝ｈ(Ｍ)を計算した後、このハッシュ値ｍを用いて前述同様に属性証明ｆ(ｍ)の正当性を検証する。
以下、第１の実施形態と同様に動作する。
【００７４】
上述したように本実施形態によれば、第１の実施形態の効果に加え、チャレンジＭのハッシュ値ｍ＝ｈ(Ｍ)に対して属性証明ｆ(ｍ)を行なうことから、セキュリティ性を向上させることができる。
【００７５】
（第３の実施形態）
図４は本発明の第３の実施形態に係る属性証明システムの構成を示す模式図である。
本実施形態は、第１及び第２の実施形態の変形例であり、第１及び第２の実施形態と異なる点は、チャレンジＭが利用者（証明者）装置Ａにより生成される点である。すなわち、本実施形態は、属性証明の一種として、自己の文書（チャレンジ）Ｍに対する属性署名（属性付き署名）を実現するものである。
【００７６】
具体的には利用者装置Ａの属性証明生成部１５が、前述した機能に加え、文書ＭとしてのチャレンジＭを生成し、このチャレンジＭのハッシュ値ｍ＝ｈ(Ｍ)を算出し、このハッシュ値ｍの属性証明（文書Ｍに対する署名）ｆ(ｍ)を算出し、且つ（検証者装置Ｖからの開示要求無しに）開示する属性群Λを用意し、これらチャレンジＭ、属性証明ｆ(ｍ)、属性群Λの検証用データを検証者装置Ｖに送信可能な構成となっている。
【００７７】
ここで、文書Ｍとしては、属性署名の対象となる電子化文書であれば任意の文書が使用可能であり、その種の電子化文書の典型的な例としては、アンケート調査の回答文書などがある。開示する属性としては、前述同様に必要最小限の属性であり、例えば「性別（例、男性）」、「年齢（例、２６歳）」、「職業（例、会社員）」等がある。なお、開示する属性は、ここでは利用者装置Ａに用意される場合を述べたが、第１及び第２の実施形態と同じく、検証者装置Ｖから要求されてもよい。
【００７８】
一方、検証者装置Ｖでは、属性情報要求部３２及びチャレンジ生成部３３が省略された構成となる。これに伴い、属性認可書検証部３１は、前述した機能において、属性認可書Ｃert_Aの検証結果の送出先が属性証明検証部３４’になっている。
【００７９】
属性証明検証部３４’は、前述した機能に加え、利用者装置Ａから受けたチャレンジＭを用いてそのハッシュ値ｍ＝ｈ(Ｍ)を計算する機能と、得られたハッシュ値ｍを用いて前述同様に属性証明ｆ(ｍ)の正当性を検証する機能をもっている。
【００８０】
以上のような構成により、属性証明時に、利用者装置Ａの属性証明生成部１５は、前述した機能に加え、チャレンジＭを生成し、そのハッシュ値ｍ＝ｈ(Ｍ)を計算し、ハッシュ値ｍを用いた属性証明ｆ(ｍ)を計算する。また、開示する属性群Λの検証用情報を用意する。
【００８１】
しかる後、利用者装置Ａの属性証明生成部１５は、属性認可書Ｃert_Aの検証用データ（ｖ,Ｃert_A,ｎ,Ｐ_A,ｃ₁,…,ｃ_n）、チャレンジＭ、属性証明ｆ(ｍ)、開示する属性情報の検証用データ(ｊ,ａ_j,ｒ_j)を検証者装置Ｖに送信する。
【００８２】
検証者装置Ｖでは、これらを受けると、属性認可書検証部３１が、前述した通り、属性認可書Ｃert_Aの検証用データ（ｖ,Ｃert_A,ｎ,Ｐ_A,ｃ₁,…,ｃ_n）に基づいて属性認可書Ｃert_Aを検証し、検証結果を属性証明検証部３４’に送出する。
【００８３】
属性証明検証部３４’は、検証結果が属性認可書Ｃert_Aの正当性を示すとき、利用者装置Ａから受けたチャレンジＭを用いてそのハッシュ値ｍ＝ｈ(Ｍ)を計算し、このハッシュ値ｍを用いて前述同様に属性証明ｆ(ｍ)の正当性を検証する。以下、第１の実施形態と同様に動作する。
【００８４】
上述したように本実施形態によれば、第１及び第２の実施形態の効果に加え、さらに、利用者（証明者）が自らチャレンジＭを生成して属性署名（属性付き署名）を行なうことができる。この属性署名は、例えばアンケート調査の回答文書ＭとしてのチャレンジＭなどのハッシュ値ｍ＝ｈ(Ｍ)に対して実施できる。
【００８５】
なお、本実施形態の変形例として、開示する属性が、第１及び第２の実施形態と同じく、検証者装置Ｖから要求されてもよい。
この変形例の場合、属性証明時に、利用者装置Ａの属性証明生成部１５は、属性証明時に、第１の実施形態と同じく、属性認可書Ｃert_Aの検証用データ（ｖ,Ｃert_A,ｎ,Ｐ_A,ｃ₁,…,ｃ_n）を検証者装置Ｖに送信し、検証者装置Ｖの属性認可書検証部３１は、前述した通り、属性認可書Ｃert_Aの検証結果を属性証明検証部３４’に送出する。
属性証明検証部３４’は、検証結果が属性認可書Ｃert_Aの正当性を示すとき、開示して欲しい属性からなる属性群Λを利用者装置Ａに送信する。
利用者装置Ａでは、属性群Λを受けると、属性証明生成部１５が、チャレンジＭを生成し、そのハッシュ値ｍ＝ｈ(Ｍ)を計算し、ハッシュ値ｍを用いた属性証明ｆ(ｍ)を計算する。また、開示する属性群Λの検証用情報を用意する。
といった動作となる。このような変形例としても本発明を同様に実施して同様の効果を得ることができる。
【００８６】
（第４の実施形態）
次に、本発明の第４の実施形態に係る属性証明システムについて説明する。
【００８７】
本実施形態は、第１〜第３の実施形態の変形例であり、生成器ｇを利用者装置Ａが生成する値とし、属性認可書発行時に、生成器ｇを利用者装置Ａから属性認可書発行機関装置ＡＣＡに提示する方式となっている。
【００８８】
これに伴い、利用者装置Ａ、属性認可書発行機関装置ＡＣＡ及び検証者装置Ｖの構成が以下のように変更される。
利用者装置Ａにおいては、鍵生成部１１が、前述した機能に加え、生成器ｇを生成する機能を有する。
【００８９】
属性情報生成部１２は、前述した機能に加え、属性認可書発行機関装置ＡＣＡに対し、前述した情報（Ｐ_A，Λ₀）と、生成器ｇとを提示する機能を有する。
【００９０】
属性証明生成部１５は、前述した機能に加え、生成器ｇを含めて属性情報の検証用データ（ｇ,ｖ,Ｃert_A,ｎ,Ｐ_A,ｃ₁,…,ｃ_n）を検証者装置Ｖに送信する機能をもっている。
【００９１】
一方、属性認可書発行機関装置ＡＣＡにおいては、属性認可書発行部２２が、前述した機能に加え、属性認可書発行時に、下記のように、生成器ｇを含めた内容の属性認可書Ｃert_Aを発行する機能をもっている。
【００９２】
Ｃert_A＝Ｓig_ACA［ｈ（ｇ||Ｐ_A||ｎ||ｃ₁||…||ｃ_n）］
また一方、検証者装置Ｖにおいては、属性認可書検証部３１が、前述した機能に加え、下記のように、生成器ｇを含めた内容の属性認可書Ｃert_Aを検証する機能をもっている。
【００９３】
Ｖeri_ACA［ｈ（ｇ||Ｐ_A||ｎ||ｃ₁||…||ｃ_n），Ｃert_A］＝valid？
以上のような構成としても、第１〜第３の実施形態と同様の効果を得ることができる。
【００９４】
（第５の実施形態）
図５は本発明の第５の実施形態に係る検証者装置の構成を示す模式図である。
本実施形態は、第１〜第５の実施形態の変形例であり、具体的には検証者装置Ｖが、属性証明検証部３４による検証結果に応じて後段の対象システムを利用可能とする対象実行許可部３５を備えている。
【００９５】
ここで、対象実行許可部３５は、属性証明検証部３５により検証された属性と所定の判定基準とに基づいて、後段の対象システムの実行可否を判定し、実行可の時に実行を許可する機能をもっている。
実行可否の判定基準は、任意であり、例えば属性が「男性」で判定基準が「男性」というように完全一致の場合や、属性が「２６歳」で判定基準が「２０歳以上」というように範囲指定の場合などが使用可能であり、その他、判定基準を検索条件と考えれば周知の検索技術などが適用可能である。
【００９６】
対象システムの個数及び内容は任意であるが、例えば、「２０歳以上」「独身」「男性」の属性が証明された利用者にのみ閲覧させるホームページ等としてもよい。または、「本人」の属性が証明された利用者にのみ証明書を発行するシステム等がある。あるいは、任意の属性と、「属性認可書Ｃert_Aの発行（要求）日」の属性とが証明され、且つ「属性認可書Ｃert_Aの発行（要求）日」が有効期限内である利用者のみ実行可能なシステム等がある。
【００９７】
すなわち、対象実行許可部３５は、任意の属性、当該属性に基づく実行可否の判定基準及び各種の対象システムに適用でき、それら実行可否の判定基準や対象システムの内容には限定がない。
【００９８】
以上のような構成により、第１〜第４の実施形態の効果に加え、後段の対象システムを不正な利用者による利用から保護することができる。
【００９９】
なお、本実施形態は、対象実行許可部３５が実行可否を判定する場合を説明したが、実行可否に加え、対象実行許可部３５が、検証された属性に基づいて、利用可能な範囲をも設定する機能を有してもよい。
【０１００】
例えば、機密事項ＤＢ及び周知資料ＤＢを有する社内システムの場合、「正社員」の属性をもつ利用者は、社内システム自体と周知資料ＤＢとを利用可能であるが、必ずしも機密事項ＤＢを利用できず、機密事項ＤＢを利用するには更に「機密事項ＤＢの担当部門」及び／又は「部長」以上の属性を必要とする等のように、検証された属性に基づいて、対象システムの実行可能な範囲を定めてもよい。
【０１０１】
あるいは、対象システムが複数の実行パラメータをもつ場合（例、シミュレーションシステム、ロールプレイングゲームシステム、占いゲームシステム等）、システム全体を実行可能であるが、対象実行許可部３５が、検証された属性に基づいて、実行パラメータを設定する機能を備えてもよい。
【０１０２】
（第６の実施形態）
次に、本発明の第６の実施形態に係る属性証明システムについて説明する。
本実施形態は、第１〜第５の各実施形態の変形例であり、概略的には、第１〜第５の各実施形態における離散対数問題を、有限群Ｅ（ＧＦ(ｐ)）上の楕円離散対数問題（ＥＤＬＰ）に書換えた構成となっている。
【０１０３】
ここで、有限群Ｅ（ＧＦ(ｐ)）は、有限体ＧＦ(ｐ)上の楕円曲線を意味しており、ａ，ｂ∈ＧＦ(ｐ)を４ａ³＋２７ｂ²≠０なる元とするとき、
｛（ｘ，ｙ）∈ＧＦ(ｐ)²｜ｙ²＝ｘ³＋ａｘ＋ｂ｝｝∪Ο
と表現される。但し、Ο：仮想的な無限遠点。
【０１０４】
すなわち、本実施形態は、第１〜第５の各実施形態を楕円曲線暗号に適用した変形例である。具体的には、第１の実施形態に明記され且つ第２〜第５の各実施形態に引用される各式が以下のように書換えられる。なお、Ｇは楕円曲線上の点とする。
【０１０５】
公開鍵Ｐ_A＝Ｓ_A・Ｇ （ｍｏｄ ｐ）
（＝Ｇ＋…＋Ｇ：ＧをＳ_A回加算）
コミット値Ｃ_i＝ｂ_i・Ｇ （ｍｏｄ ｐ）
コミット値Ｖ＝ｕ・Ｇ （ｍｏｄ ｐ）
【数３】

第２検証式Ｃ_j≡ｈ(ａ_j||ｒ_j)・Ｇ （ｍｏｄ ｐ）
以上のような構成としても、第１〜第５の各実施形態の効果を得ることができ、さらに楕円曲線暗号で実現したことにより、鍵長や署名データ長を低減させることができる。
なお、上記実施形態に記載した手法は、コンピュータに実行させることのできるプログラムとして、磁気ディスク（フロッピーディスク、ハードディスクなど）、光ディスク（ＣＤ−ＲＯＭ、ＤＶＤなど）、光磁気ディスク（ＭＯ）、半導体メモリなどの記憶媒体に格納して頒布することもできる。
【０１０６】
また、この記憶媒体としては、プログラムを記憶でき、かつコンピュータが読み取り可能な記憶媒体であれば、その記憶形式は何れの形態であっても良い。
【０１０７】
また、記憶媒体からコンピュータにインストールされたプログラムの指示に基づきコンピュータ上で稼働しているＯＳ（オペレーティングシステム）や、データベース管理ソフト、ネットワークソフト等のＭＷ（ミドルウェア）等が本実施形態を実現するための各処理の一部を実行しても良い。
【０１０８】
さらに、本発明における記憶媒体は、コンピュータと独立した媒体に限らず、ＬＡＮやインターネット等により伝送されたプログラムをダウンロードして記憶または一時記憶した記憶媒体も含まれる。
【０１０９】
また、記憶媒体は１つに限らず、複数の媒体から本実施形態における処理が実行される場合も本発明における記憶媒体に含まれ、媒体構成は何れの構成であっても良い。
【０１１０】
尚、本発明におけるコンピュータは、記憶媒体に記憶されたプログラムに基づき、本実施形態における各処理を実行するものであって、パソコン等の１つからなる装置、複数の装置がネットワーク接続されたシステム等の何れの構成であっても良い。
【０１１１】
また、本発明におけるコンピュータとは、パソコンに限らず、情報処理機器に含まれる演算処理装置、マイコン等も含み、プログラムによって本発明の機能を実現することが可能な機器、装置を総称している。
【０１１２】
なお、本願発明は、上記各実施形態に限定されるものでなく、実施段階ではその要旨を逸脱しない範囲で種々に変形することが可能である。
例えば「属性情報」の語は、１個で独立して意味をもつ単位情報（例、単語、名称や小文書など、完結した情報）に限らず、全部又はしきい値個数以上が統合されると意味をもつ分散情報（例、秘密情報の一部）であってもよい。すなわち、「属性情報」の語は、任意の部分情報であればよく、社会通念上の「属性（その物の有する特徴・性質）」を示す内容ではなくても、本発明の範囲に包含される。
【０１１３】
例えば、本発明を周知の段階的秘密交換プロトコルの適用対象（例、電子商取引など）に適用し、秘密情報（例、決済情報や契約文書）を所定サイズ毎に属性情報とした場合、社会通念上「決済情報や契約文書の一部」を示す内容であっても、本発明の「属性」に包含される。
【０１１４】
但し、この場合、利用者装置と検証者装置の機能を併せもつ２台の利用・検証者装置が使用され、互いに選択的な属性情報の開示を繰り返し、最終的には全ての属性情報を開示し合うという構成になる。すなわち、属性情報の選択的な開示は、１回に限らず、複数回繰り返してもよい。また、利用者装置Ａと検証者装置Ｖとは、一方向で固定的な場合に限らず、双方向で交替的な場合も可能である。
【０１１５】
一方、属性情報の定義に伴い、「属性認可書」の語は、各部分情報（各属性情報）の集合に対するデジタル署名であればよく、社会通念上の「属性を認可」したものでなくても本発明の範囲に包含される。前述の例では、社会通念上の「決済情報や契約文書」が本発明の「属性認可書」に包含される。
【０１１６】
また、「利用者装置」及び「検証者装置」の語は、上述した機能を有するものであれば、社会通念上の「利用者」「検証者」には限定されない。例えば、本発明を「数字（属性情報）を揃えるスピードくじ」に適用する場合、スピードくじ（属性認可書）の販売者が「利用者装置」を用い、社会通念上の利用者が「検証者装置」を使うことになるが、このような場合も本発明の範囲に包含される。
【０１１７】
また、各実施形態及び変形例は可能な限り適宜組み合わせて実施してもよく、その場合、組み合わされた効果が得られる。また、各実施形態及び変形例の組合せに限らず、各装置（利用者装置Ａ、属性認可書発行機関装置ＡＣＡ、検証者装置Ｖ）も、適用されるシステムに応じて適宜組合せて実施できる。
【０１１８】
例えば、第１〜第６の実施形態の場合、属性認可書発行機関装置ＡＣＡと検証者装置Ｖとを組合せてもよい。また、前述したスピードくじのシステムの場合等では、利用者装置Ａと属性認可書発行機関装置ＡＣＡとを組合せてもよい。さらに、前述した段階的秘密交換のシステムの場合等では、利用者装置Ａと検証者装置Ｖとを組合せてもよい。
【０１１９】
さらに、上記各実施形態には種々の段階の発明が含まれており、開示される複数の構成用件における適宜な組み合わせにより種々の発明が抽出され得る。
例えば実施形態に示される全構成要件から幾つかの構成要件が省略されることで発明が抽出された場合には、その抽出された発明を実施する場合には省略部分が周知慣用技術で適宜補われるものである。
【０１２０】
その他、本発明はその要旨を逸脱しない範囲で種々変形して実施できる。
【０１２１】
【発明の効果】
以上説明したように本発明によれば、各種システムに応用でき、情報化社会の発展に寄与できる属性証明プログラム及び装置を提供できる。
【図面の簡単な説明】
【図１】本発明の第１の実施形態に係る属性証明システムの構成を示す模式図
【図２】同実施形態における属性認可書発行の動作を説明するためのフローチャート
【図３】同実施形態における属性証明の動作を説明するためのフローチャート
【図４】本発明の第３の実施形態に係る属性証明システムの構成を示す模式図
【図５】本発明の第５の実施形態に係る検証者装置の構成を示す模式図
【図６】本発明の骨子を説明するための模式図
【図７】本発明の骨子を従来と比較して説明するための模式図
【符号の説明】
Ａ…利用者装置
１１…鍵生成部
１２…属性情報生成部
１３…属性認可書検証部
１４…属性情報管理部
１５…属性証明生成部
ＡＣＡ…属性認可書発行機関装置
２１…属性情報審査部
２２…属性認可書発行部
Ｖ…検証者装置
３１…属性認可書検証部
３２…属性情報要求部
３３…チャレンジ生成部
３４，３４’…属性証明検証部[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an attribute certification program and apparatus applicable to various systems.
[0002]
[Prior art]
In the information-oriented society in recent years, authentication / signature technologies such as digital signature and message authentication for authenticating the validity of data and other party authentication for authenticating the other party of communication are widely used in data communication between terminal devices. It is used.
[0003]
Such authentication / signature technology is a method in which, for example, a prover (signer) performs authentication or signature using his / her private key information. Further, the verifier may verify, for example, the signature of the prover with the public key information of the prover (signer).
[0004]
[Problems to be solved by the invention]
The authentication / signature technologies as described above are highly necessary among the cryptographic technologies that support the information society, and it is preferable to develop various application methods from the viewpoint of developing the information society.
[0005]
The present invention has been made in view of the above circumstances, and an object thereof is to provide an attribute certification program and apparatus that can be applied to various systems and contribute to the development of an information society.
[0006]
[Means for Solving the Problems]
The gist of the present invention is to provide an authentication / signature technology that can be applied to various systems by providing an attribute authorization document that includes a plurality of pieces of attribute information that can be individually verified.
[0007]
The present invention has the following properties (1) to (3).
[0008]
(1) Attribute authorization certificate Cert _A In the example of FIG. 6, the public key P of the prover is _A , Key-encrypted attribute information c ₁ ~ C ₈ , And the total number of attributes n (= 8), and the digital signature of the attribute authority issuing authority ACA.
[0009]
(2) The prover A has attribute information a related only to the attribute requested to be disclosed. ₁ , a _Three , a ₆ Can be disclosed to the verifier, and the disclosed attribute information a ₁ , a _Three , a ₆ Can be verified to the verifier that it is authorized legitimate information.
[0010]
(3) Attribute information a regarding attributes that are not requested to be disclosed ₂ , a _Four , a _Five , a ₇ , a ₈ Is not exposed to the verifier at all. Therefore, various certifications / signatures using the minimum necessary attributes are possible.
[0011]
The present invention is different from the conventional signature with a secret key shown in FIG. 7A in that the signature includes attributes 1 to 3 as shown in FIG. As described above, it is excellent in that each attribute can be selectively disclosed.
[0012]
Now, the following measures are specifically taken for the gist of the present invention as described above. In addition, although each invention shows only the case where it represents as a program from a viewpoint of the simplicity of description, it cannot be overemphasized that you may express with other categories, such as an apparatus, a method, a system.
The object of application of each invention is n pieces of attribute information Is based on n random numbers Embedded attribute certificate And an attribute proof calculated from each blind value based on n or less attribute information of the n attribute information and n or less random numbers of the n random numbers A user device that uses the attribute, and the attribute authorization document to the user device And the n random numbers And the attribute authorization certificate issuing institution device that issues the certificate, and the attribute authorization document received from the user device, and among the n pieces of attribute information in the attribute authorization document, n or less attribute information All of The By the attribute proof Verify In addition, each of the n or less attribute information is individually verified by the n or less random numbers. It is an attribute certification program used for the attribute certification system provided with a verifier apparatus.
[0013]
According to a first aspect of the present invention, the computer of the user device is configured to generate a key generation means for generating a secret key and a public key at the time of issuing the attribute authorization document, and the n pieces of attribute information based on the input contents. Attribute information generating means for generating and presenting the n attribute information and the public key generated by the key generating means to the attribute authorization issuing authority device; Means for receiving an attribute authorization letter and the n random numbers from the attribute authorization letter issuing authority device; The attribute authorization certificate verifying means for verifying the attribute authorization certificate received from the attribute authorization certificate issuing institution device, and when verifying by the verifier device, the verification data of the attribute license certificate and the challenge And each of the blind values Calculated based on Said Function as attribute certification generation means for transmitting attribute certification and verification data of the n or less attribute information to the verifier device simultaneously or separately. The verification data for the n or less attribute information includes the n or less attribute information and the n or less random numbers. It is an attribute certification program.
[0014]
Here, the attribute proof generation unit may calculate a hash value of the challenge from the viewpoint of improving security, and calculate the attribute proof based on the hash value.
[0015]
In addition, the attribute proof generation means is replaced with “simultaneously” instead of “simultaneously or separately” from the viewpoint of applying to an attribute signature (signature with attribute) by which a user (certifier) generates a challenge by himself / herself. And processing for generating the challenge may be included.
[0016]
According to a second aspect of the present invention, there is provided attribute information examination means for examining whether or not each attribute information presented by the user apparatus is valid for the computer of the attribute authorization issuance institution apparatus, and the examination result by the attribute information examination means is When indicating that it is valid, the n pieces of attribute information are Based on the n random numbers Issue the attribute approval form embedded, and the attribute approval form And the n random numbers Is an attribute certification program for functioning as an attribute authorization document issuing means for transmitting a message to a user device.
[0017]
According to a third aspect of the present invention, there is provided an attribute authorization document verification means for verifying the validity of the attribute authorization document based on the verification data of the attribute authorization document received from the user device. When the verification result by the attribute authorization document verification means shows validity, the attribute certification received from the user device and the n or less attribute information, Based on the n or less random numbers received from the user device, This is an attribute certification program for functioning as attribute certification verification means for verifying the validity of each.
[0018]
Here, the third invention is an attribute for designating n or less attributes when the verification result by the attribute authorization verification means indicates validity from the viewpoint of application when the verifier generates a challenge by himself / herself. An attribute certification program for functioning as an information generation unit and a challenge generation unit that generates a challenge when an attribute is specified by the attribute information generation unit and transmits the challenge and the specified content to the user device. May be.
[0019]
In the third invention, when the verification result by the attribute proof verification means indicates validity, Received from user device Further, it may be an attribute certification program for functioning as a target execution permission unit that permits execution of a predetermined target system based on the contents of n or less pieces of attribute information.
[0020]
(Function)
Therefore, the present invention takes the above-described means to use the attribute approval document in which n pieces of attribute information are embedded, and discloses only n pieces or less of attribute information to be disclosed to the verifier. Attribute information that is not required to be disclosed can be concealed.
[0021]
As described above, since an attribute certification system that selectively discloses attribute information can be constructed at the time of various certifications / signatures, it can be applied to various systems and contribute to the development of an information-oriented society.
[0022]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings. Various parameters and symbols used in each embodiment are as follows.
p, q: A sufficiently large prime number satisfying the relational expression p = 2q + 1.
g: A generator whose order in the multiplicative group Zp * is q.
(G may be a system common value (first to sixth embodiments excluding the fourth) or a value generated by the user device A (fourth to sixth embodiments)).
P _A : Public key of user device A.
S _A : Secret key of user device A.
Λ ₀ : Attribute group {a ₁ , a ₂ , ..., a _n }.
a _i : Λ ₀ I-th (1 ≦ i ≦ n) attribute information (attribute)
n: Total number of attribute information
r _i : I-th (1 ≦ i ≦ n) random number.
b _i : A _i Blinded attribute
c _i : B _i Commit value (committed blinded attribute)
h: collisionless one-way hash function.
Sig _ACA [D]: Signature of the authority issuing authority for data D.
Veri _ACA [D]: Signature verification of the attribute approval certificate issuing organization for data D.
u: a random number (∈) generated by the user (provider) device A at the time of attribute certification _R Zq *)
v: Commit value of u calculated by user (certifier) device A at the time of attribute certification
(V = g ^u (Mod p))
Λ: An attribute group requested to be disclosed at the time of attribute certification.
m: Challenge (∈Zq *) generated by the verifier device V at the time of attribute certification or a hash value generated by the user device A (of this challenge)
f (m): Λ attribute proof using m
x || y: Combination of bit string x and bit string y.
[0023]
(First embodiment)
FIG. 1 is a schematic diagram showing the configuration of an attribute certification system according to the first embodiment of the present invention. This attribute certification system includes a user device A, an attribute authorization certificate issuing authority device ACA, and a verifier device V, and each device A, ACA, V can be configured by hardware, software, or a combination thereof. It has become. When configured by software, programs for realizing the functions of the devices A, ACA, and V are preinstalled in the computers of the devices A, ACA, and V.
[0024]
The user device A includes a key generation unit 11, an attribute information generation unit 12, an attribute authorization document verification unit 13, an attribute information management unit 14, and an attribute proof generation unit 15.
[0025]
The key generation unit 11 uses the attribute authorization certificate Cert _A Before issuing the secret key S _A And public key P _A Is generated, and the attribute authorization certificate Cert _A When issuing the secret key S _A And public key P _A Is sent to the attribute information generation unit 12.
[0026]
The attribute information generation unit 12 receives the secret key S received from the key generation unit 11. _A Is set in the attribute authorization document verification unit 13 and the attribute information {a ₁ , a ₂ , ..., a _n } And sets the attribute information management unit 14 in the public key P _A Attribute group Λ consisting of attribute information to be approved ₀ = {A ₁ , a ₂ , ..., a _n } To the attribute authorization certificate issuing agency ACA. The attribute information may be any partial information, and the content thereof is arbitrary.
[0027]
The attribute certificate verifying unit 13 receives the attribute certificate Cert received from the attribute certificate issuing authority ACA. _A And n random numbers (r ₁ , ..., r _n ) Based on the attribute information management unit 14, a function for performing a predetermined verification process (ST9 to be described later), and after completion of the verification process, the attribute authorization certificate Cert _A And n random numbers (r ₁ , ..., r _n ) In the attribute information management unit 14.
[0028]
In addition, attribute authorization certificate Cert _A Is the digital signature Sig by the attribute authorization issuing authority device ACA _ACA [H (P _A || n || c ₁ ||… || c _n ]].
[0029]
The attribute information management unit 14 holds and manages each piece of information in the user apparatus A so as to be readable / writable. _A , Secret key S _A , Each attribute a ₁ ~ A _n , Each random number r ₁ ~ R _n , Each commit value c ₁ ~ C _n And attribute certificate Cert _A Can be managed. Secret key S _A May be managed by another tamper resistant memory (not shown).
[0030]
The attribute proof generation unit 15 refers to the function for generating the random number u and the commit value v at the time of attribute proof, and the verification data (v, Cert _A , n, P _A , c ₁ , ..., c _n ) To the verifier device V, and when receiving the challenge m and the attribute group Λ from the verifier device V, when accepting the disclosure of the requested attribute, the function of calculating the attribute proof f (m); This attribute proof f (m) and data (j, a _j , r _j ) To the verifier device V.
[0031]
Further, any form can be applied as a form of realization of the user device A. For example, any of an installation type such as a personal computer, a portable type, a portable type such as a mobile phone or an electronic notebook, or a combination thereof (eg, a combination of an installation type device and a portable IC card). The communication method may be either wired or wireless.
[0032]
The attribute authorization certificate issuing institution device ACA includes an attribute information examination unit 21 and an attribute authorization certificate issuing unit 22.
[0033]
The attribute information examination unit 21 uses the attribute group Λ presented from the user device A. ₀ Each attribute a _i And the function of sending the examination result to the attribute authorization document issuing unit 22.
[0034]
The attribute certificate issuing unit 22 has a function of executing a predetermined attribute certificate issuing process (ST5 to ST8 to be described later) and an attribute certificate when the examination result received from the attribute information examination unit 21 is valid. After the issuing process is completed, the attribute authorization certificate Cert _A , N random numbers (r ₁ , ..., r _n ) To the user device A.
[0035]
The verifier device V includes an attribute authorization document verification unit 31, an attribute information request unit 32, a challenge generation unit 33, and an attribute certification verification unit 34.
[0036]
The attribute authorization document verification unit 31 receives the verification data (v, Cert) received from the user device A. _A , n, P _A , c ₁ , ..., c _n ) Based on the attribute authorization certificate Cert _A And a function for sending the verification result to the attribute information requesting unit 32.
[0037]
The attribute information request unit 32 has a function of sending an attribute group Λ composed of attributes (request attributes) desired to be disclosed to the challenge generation unit 33 when the verification result received from the attribute authorization document verification unit 31 is valid.
[0038]
Upon receiving the attribute group Λ from the attribute information request unit 32, the challenge generation unit 33 generates a challenge m, and transmits the challenge m and the attribute group Λ to the attribute certification verification unit 34 and the user device A. Have
[0039]
The attribute certification verification unit 34 verifies the validity of the attribute certification f (m) received from the user apparatus A, and when the verification result indicates validity, the attribute certification verification unit 34 _j It has a function to verify the legitimacy of.
[0040]
Next, the operation of the attribute certification system configured as described above will be described in the order of issuance of an attribute certificate during the initial procedure and attribute certification during normal use, with reference to the flowcharts of FIGS.
[0041]
(Issuance of attribute certificate)
As shown in FIG. 2, in the user device A, the key generation unit 11 performs the secret key S _A ∈ _R Zq is generated (ST1), and the public key P _A = G ^SA When (mod p) is calculated (ST2), these secret keys S _A And public key P _A Is sent to the attribute information generation unit 12.
[0042]
The attribute information generation unit 12 uses the secret key S _A Is set in the attribute authorization document verification unit 13, and the attribute information desired to be approved is generated (ST3) and set in the attribute information management unit 14, while the public key P _A And an attribute group Λ consisting of attribute information to be approved ₀ Is presented to the attribute authority issuing authority ACA.
In the attribute approval certificate issuing organization ACA, the attribute information examination unit 21 sends each attribute a _i Is validated as user information (ST4), and the examination result is sent to the attribute authorization document issuing unit 22.
[0043]
When the attribute approval certificate issuing unit 22 indicates that the examination result is valid, the attribute approval certificate issuing unit 22 executes the following attribute approval certificate issuing processing (ST5 to ST8).
[0044]
First, n random numbers r _i ∈ _R Zq * is generated (ST5).
[0045]
Then, random number r _i And attribute a _i Are combined (concatenated) with a hash function to obtain n blind values b _i = H (a _i || r _i ) Is calculated (ST6).
[0046]
Next, for each generator g, each blind value b _i N commit values c using _i = G ^bi (Mod p) is calculated (ST7).
[0047]
Finally, the public key P _A , Attribute a _i The attribute authorization certificate Cert is obtained by combining the total number n and the commit values c1 to cn and signing the hash values obtained through the hash function with their own private key. _A Is issued (ST8).
[0048]
Cert _A = Sig _ACA [H (P _A || n || c ₁ ||… || c _n ]]
After such attribute authorization issuance processing is completed, the attribute authorization issuing authority ACA sends the attribute authorization certificate Cert. _A , N random numbers (r ₁ , ..., r _n ) To user device A.
[0049]
On the other hand, in the user device A, the attribute authorization document verification unit 13 performs the following verification process (ST9).
[0050]
First, n attributes a from the attribute information management unit 14 ₁ ~ A _n To obtain each of these attributes a _i And each random number r _i And n blind values b by a hash function _i = H (a _i || r _i ).
[0051]
Next, for each generator g, each blind value b _i And c _i = G ^bi Calculate (mod p).
[0052]
Finally, the public key P _A , Attribute a _i Total number n and each commit value c ₁ ~ C _n And the hash value obtained through the hash function and the attribute authorization certificate Cert _A Is compared with the decryption result obtained by decrypting with the public key of the attribute authority issuing authority ACA. _A Verify the signature of
[0053]
Veri _ACA [H (P _A || n || c ₁ ||… || c _n ), Cert _A ] = Valid?
If the verification result is valid after completion of such verification processing, the user apparatus A sends the attribute authorization certificate Cert. _A , Each random number r ₁ ~ R _n And each commit value c ₁ ~ C _n Is stored in the attribute information management unit 14.
[0054]
(Attribute certification)
As shown in FIG. 3, in the user apparatus A, the attribute proof generation unit 15 performs random number uε _R Zq * is generated and its commit value v = g ^u (Mod p) is calculated (ST11).
[0055]
After that, the attribute certification generation unit 15 refers to the attribute information management unit 14 and refers to the commit value v of the random number u, the attribute authorization certificate Cert. _A , Attribute a ₁ ~ A _n Total number n, public key P _A , Attribute a ₁ ~ A _n Commit value c ₁ , ..., c _n Data for verification (v, Cert _A , n, P _A , c ₁ , ..., c _n ) Is transmitted to the verifier device V.
[0056]
The verifier device V uses the attribute authorization certificate Cert _A Data for verification (v, Cert _A , n, P _A , c ₁ , ..., c _n ) Is received by the attribute approval certificate verification unit 31. _A Is verified (ST12).
[0057]
Veri _ACA [H (P _A || n || c ₁ ||… || c _n ), Cert _A ] = Valid?
As a result, the verifier apparatus A makes the attribute authorization certificate Cert _A All attribute information in ₁ ~ A _n Verifies that is valid and authorized information. After the end of the validity verification process, the attribute authorization document verification unit 31 sends the verification result to the attribute information request unit 32.
[0058]
If the verification result is valid, the attribute information request unit 32 sends to the challenge generation unit 33 an attribute group Λ composed of attributes (request attributes) that are desired to be disclosed.
[0059]
The challenge generator 33 creates a challenge m∈ _R Zq * is generated (ST13), and the challenge m and the attribute group Λ composed of the attributes desired to be disclosed are transmitted to the own attribute certification verification unit 34 and the user apparatus A.
[0060]
When the user apparatus A receives the challenge m and the attribute group Λ, the attribute proof generation unit 15 accepts the disclosure for the attribute requested to be disclosed, and the attribute proof f (m ) Is calculated (ST14).
f (m) = vS _A + Um + b ₁ m ² + ... + b _n m ^{n + 1} (Mod q)
That is, the attribute proof f (m) is i + 1-order as in the following equation when the total number of attributes requested for disclosure is i.
f (m) = vS _A + Um + b ₁ m ² + ... + b _i m ^{i + 1} (Mod q)
“B” in the same formula ₁ ~ B _i “” Is different from the first to i-th values, and i “b” corresponding to the disclosure request. _j It is needless to say that “” is used. This is because “c” in the verification formula of f (m) described later. _i The same applies to “.” As a modification, all n attributes (b) ₁ ~ B _n ) To generate the attribute proof f (m).
[0061]
In any case, after that, the attribute certification generation unit 15 sends the attribute certification f (m), the attribute number j corresponding to the attribute group Λ requested to be disclosed, and the attribute a _j And random number r _j Data for verification of attribute information requested for disclosure (j, a _j , r _j ) To the verifier device V (jεΛ).
[0062]
In the verifier apparatus V, the attribute proof verification unit 34 verifies the validity of the attribute proof f (m) using the following first verification formula (ST15).
[Expression 1]

[0063]
As a result, the verifier device V receives the attribute authorization certificate Cert. _A All attribute information in ₁ ~ A _n Of i pieces of attribute information a requested to be disclosed ₁ ~ A _i It is possible to verify that all of these are authorized and legitimate information.
When the verification result indicates validity, the attribute proof verification unit 34 determines the commit value c received in step ST12 for the attribute jεΛ requested to be disclosed. _j And the disclosed attribute a _j Are individually verified as in the following second verification formula (ST16).
[Expression 2]

[0064]
As a result, the verifier device V receives the attribute authorization certificate Cert. _A N attributes a in ₁ ~ A _n Of the disclosed attribute a _j Can only be verified individually.
[0065]
As described above, according to the present embodiment, n pieces of attribute information a ₁ ~ A _n Attribute certificate Cert with embedded _A N or less attribute information a requested to be disclosed _j Can be disclosed to the verifier device V, and attribute information that is not required to be disclosed can be concealed.
[0066]
In this way, the attribute information a is used for various certifications / signatures. _j Therefore, it is possible to construct an attribute proof system that selectively discloses information, so that it can be applied to various systems and contribute to the development of an information society.
[0067]
That is, the user apparatus A, in step ST12, acquires the attribute authorization certificate Cert _A All attribute information in ₁ ~ A _n Can be proved to the verifier device V that it is authorized legitimate information.
[0068]
Further, the user apparatus A, in step ST15, obtains the attribute authorization certificate Cert. _A All attribute information in ₁ ~ A _n Of i pieces of attribute information a requested to be disclosed ₁ ~ A _i It is possible to prove to the verifier device V that all of the information is authorized and valid information.
[0069]
Furthermore, the user apparatus A makes each attribute a in step ST16. _j Can be proved individually, so the minimum required attribute a _j You only have to disclose it. Therefore, it is possible to conceal / protect attribute information that is not requested to be disclosed from the verifier. For example, when the attribute information is content related to privacy, it is possible to protect the privacy related to attribute information that is not requested to be disclosed.
[0070]
(Second Embodiment)
Next, an attribute certification system according to the second embodiment of the present invention will be described. Detailed description of the same parts as those of the first embodiment will be omitted, and different parts will be mainly described here. In the following embodiments, the same description is omitted.
In other words, this embodiment is a modification of the first embodiment, and is intended to improve security. Specifically, this embodiment is used for attribute certification in the process of generating attribute certification f (m). The value m is changed to the hash value m = h (M) of the challenge M.
[0071]
Therefore, this embodiment has the same effects as those of the first embodiment except for the operation related to the challenge at the time of attribute certification described below.
That is, at the time of attribute certification of the present embodiment, the challenge generation unit 33 of the verifier device V does not challenge m but challenges Mε _R Zq * is generated and transmitted to the user apparatus A (with the attribute group Λ required to be disclosed) in the same manner as described above.
[0072]
The attribute proof generation unit 15 of the user device A calculates the hash value m = h (M) of the challenge M, calculates the attribute proof f (m) for the hash value m in the same manner as described above, Data (j, a _j , r _j And) to the verifier device V.
[0073]
Further, when the attribute proof verification unit 34 of the verifier device V receives the attribute proof f (m) from the user device A, the hash value m of the challenge M is calculated and then the hash value m is calculated. As in the above, the validity of the attribute proof f (m) is verified.
The operation is the same as in the first embodiment.
[0074]
As described above, according to the present embodiment, in addition to the effect of the first embodiment, the attribute proof f (m) is performed on the hash value m = h (M) of the challenge M, thereby improving security. Can be made.
[0075]
(Third embodiment)
FIG. 4 is a schematic diagram showing a configuration of an attribute certification system according to the third exemplary embodiment of the present invention.
The present embodiment is a modification of the first and second embodiments. The difference from the first and second embodiments is that the challenge M is generated by the user (provider) device A. . That is, this embodiment implements an attribute signature (signature with attribute) for its own document (challenge) M as a kind of attribute proof.
[0076]
Specifically, the attribute proof generation unit 15 of the user apparatus A generates a challenge M as the document M in addition to the functions described above, calculates a hash value m = h (M) of the challenge M, and this hash An attribute proof (signature for document M) f (m) of value m is calculated and an attribute group Λ to be disclosed (without a request for disclosure from verifier device V) is prepared, and challenge M, attribute proof f (m ), The verification data of the attribute group Λ can be transmitted to the verifier device V.
[0077]
Here, as the document M, any document can be used as long as it is an electronic document subject to attribute signature, and a typical example of such an electronic document is a questionnaire response document. is there. The disclosed attributes are the minimum necessary attributes as described above, and include, for example, “gender (eg, male)”, “age (eg, 26 years old)”, “occupation (eg, office worker)” and the like. The attribute to be disclosed is described here as being prepared in the user apparatus A, but may be requested from the verifier apparatus V as in the first and second embodiments.
[0078]
On the other hand, the verifier device V has a configuration in which the attribute information request unit 32 and the challenge generation unit 33 are omitted. Accordingly, the attribute approval document verification unit 31 performs the attribute approval certificate Cert in the above-described function. _A The destination of the verification result is the attribute certification verification unit 34 '.
[0079]
In addition to the functions described above, the attribute proof verification unit 34 ′ calculates the hash value m = h (M) using the challenge M received from the user device A and uses the obtained hash value m. As described above, it has a function of verifying the validity of the attribute proof f (m).
[0080]
With the above configuration, at the time of attribute certification, the attribute certification generation unit 15 of the user apparatus A generates a challenge M, calculates a hash value m = h (M) in addition to the functions described above, and calculates a hash value. Attribute proof f (m) using m is calculated. Also, verification information for the disclosed attribute group Λ is prepared.
[0081]
Thereafter, the attribute proof generation unit 15 of the user apparatus A receives the attribute authorization certificate Cert. _A Data for verification (v, Cert _A , n, P _A , c ₁ , ..., c _n ), Challenge M, attribute proof f (m), disclosed attribute information verification data (j, a _j , r _j ) Is transmitted to the verifier device V.
[0082]
In the verifier device V, when receiving these, the attribute authorization verification unit 31 performs the attribute authorization certificate Cert as described above. _A Data for verification (v, Cert _A , n, P _A , c ₁ , ..., c _n ) Based on the attribute authorization certificate Cert _A And the verification result is sent to the attribute proof verification unit 34 ′.
[0083]
The attribute proof verification unit 34 ′ indicates that the verification result is the attribute authorization certificate Cert. _A The hash value m = h (M) is calculated using the challenge M received from the user apparatus A, and the validity of the attribute proof f (m) is calculated using the hash value m as described above. Verify sex. The operation is the same as in the first embodiment.
[0084]
As described above, according to the present embodiment, in addition to the effects of the first and second embodiments, the user (the prover) can generate the challenge M himself and perform the attribute signature (signature with attribute). Can do. This attribute signature can be applied to a hash value m = h (M) such as a challenge M as a questionnaire survey response document M, for example.
[0085]
As a modification of the present embodiment, the disclosed attribute may be requested from the verifier device V as in the first and second embodiments.
In the case of this modification, at the time of attribute certification, the attribute certification generation unit 15 of the user apparatus A performs attribute certification Cert at the time of attribute certification as in the first embodiment. _A Data for verification (v, Cert _A , n, P _A , c ₁ , ..., c _n ) To the verifier device V, and the attribute authorization document verification unit 31 of the verifier device V, as described above, acquires the attribute authorization certificate Cert. _A Is sent to the attribute certification verification unit 34 ′.
The attribute proof verification unit 34 ′ indicates that the verification result is the attribute authorization certificate Cert. _A Is transmitted to the user apparatus A, the attribute group Λ composed of the attributes desired to be disclosed.
In the user apparatus A, upon receiving the attribute group Λ, the attribute proof generation unit 15 generates a challenge M, calculates the hash value m = h (M), and uses the hash value m to generate the attribute proof f (m ). Also, verification information for the disclosed attribute group Λ is prepared.
It becomes such operation. Even in such a modified example, the present invention can be implemented in the same manner to obtain the same effect.
[0086]
(Fourth embodiment)
Next, an attribute certification system according to the fourth embodiment of the present invention will be described.
[0087]
The present embodiment is a modification of the first to third embodiments, in which the generator g is a value generated by the user device A, and the generator g is assigned the attribute authorization from the user device A when the attribute authorization document is issued. This method is presented to the book issuing institution apparatus ACA.
[0088]
Accordingly, the configurations of the user device A, the attribute authorization certificate issuing authority device ACA, and the verifier device V are changed as follows.
In the user device A, the key generation unit 11 has a function of generating the generator g in addition to the functions described above.
[0089]
In addition to the functions described above, the attribute information generation unit 12 sends the above-described information (P _A , Λ ₀ ) And the generator g.
[0090]
In addition to the functions described above, the attribute proof generation unit 15 includes the generator g and data for verifying attribute information (g, v, Cert _A , n, P _A , c ₁ , ..., c _n ) To the verifier device V.
[0091]
On the other hand, in the attribute approval certificate issuing authority apparatus ACA, the attribute certificate issuing unit 22 performs the attribute approval certificate Cert including the generator g as shown below when issuing the attribute certificate in addition to the functions described above. _A It has a function to issue.
[0092]
Cert _A = Sig _ACA [H (g || P _A || n || c ₁ ||… || c _n ]]
On the other hand, in the verifier apparatus V, the attribute approval document verification unit 31 adds to the function described above, the attribute approval certificate Cert including the generator g as described below. _A It has a function to verify.
[0093]
Veri _ACA [H (g || P _A || n || c ₁ ||… || c _n ), Cert _A ] = Valid?
Even if it is the above structures, the effect similar to 1st-3rd embodiment can be acquired.
[0094]
(Fifth embodiment)
FIG. 5 is a schematic diagram showing a configuration of a verifier apparatus according to the fifth embodiment of the present invention.
This embodiment is a modification of the first to fifth embodiments. Specifically, the verifier device V can use the target system in the subsequent stage according to the verification result by the attribute certification verification unit 34. An execution permission unit 35 is provided.
[0095]
Here, the target execution permission unit 35 determines whether or not the subsequent target system can be executed based on the attribute verified by the attribute certification verification unit 35 and a predetermined determination criterion, and permits execution when the execution is possible. Have
The criteria for determining whether or not execution is possible are arbitrary, for example, when the attribute is “male” and the criterion is “male”, or when the attribute is “26 years old” and the criterion is “20 years or older”. In other cases, a well-known search technique can be applied if the determination criterion is considered as a search condition.
[0096]
The number and contents of the target systems are arbitrary. For example, the target system may be a homepage that is viewed only by users who have been certified with the attributes of “20 years old or older”, “single”, and “male”. Alternatively, there is a system that issues a certificate only to a user who has been certified with the “person” attribute. Or any attribute and “attribute authorization certificate Cert _A Issuance (request) date "attribute and" attribute approval certificate Cert " _A There are systems that can be executed only by users whose "issue (request) date" is within the expiration date.
[0097]
That is, the target execution permission unit 35 can be applied to arbitrary attributes, determination criteria for execution based on the attributes, and various target systems, and there is no limitation on the determination criteria for execution and the contents of the target system.
[0098]
With the configuration as described above, in addition to the effects of the first to fourth embodiments, the target system at the latter stage can be protected from being used by an unauthorized user.
[0099]
In addition, although this embodiment demonstrated the case where the target execution permission part 35 determines execution propriety, in addition to execution propriety, the target execution permission part 35 has the range which can be used based on the verified attribute. You may have the function to set.
[0100]
For example, in the case of an in-house system having a confidential matter DB and a well-known material DB, a user having the attribute of “regular employee” can use the in-house system itself and the well-known material DB, but cannot necessarily use the confidential matter DB. In order to use the confidential matter DB, it is possible to execute the target system based on the verified attribute, such as requiring an attribute higher than the “department in charge of the confidential matter DB” and / or “manager”. A range may be defined.
[0101]
Alternatively, when the target system has a plurality of execution parameters (eg, simulation system, role-playing game system, fortune-telling game system, etc.), the entire system can be executed, but the target execution permission unit 35 has the verified attribute. Based on this, a function for setting execution parameters may be provided.
[0102]
(Sixth embodiment)
Next, an attribute certification system according to the sixth embodiment of the present invention will be described.
This embodiment is a modification of each of the first to fifth embodiments. Generally, the discrete logarithm problem in each of the first to fifth embodiments is expressed on a finite group E (GF (p)). The elliptic discrete logarithm problem (EDLP) is rewritten.
[0103]
Here, the finite group E (GF (p)) means an elliptic curve on the finite field GF (p), and a, bεGF (p) is expressed as 4a. ^Three + 27b ² When we assume that ≠ 0,
{(X, y) ∈GF (p) ² ｜ y ² = X ^Three + Ax + b}} ∪Ο
It is expressed. However, Ο: Virtual infinity point.
[0104]
That is, this embodiment is a modification in which the first to fifth embodiments are applied to elliptic curve cryptography. Specifically, the formulas specified in the first embodiment and cited in the second to fifth embodiments are rewritten as follows. G is a point on the elliptic curve.
[0105]
Public key P _A = S _A ・ G (mod p)
(= G + ... + G: G is S _A Addition)
Commit value C _i = B _i ・ G (mod p)
Commit value V = u · G (mod p)
[Equation 3]

Second verification formula C _j ≡h (a _j || r _j ) ・ G (mod p)
Even if it is the above structures, the effect of each 1st-5th embodiment can be acquired, Furthermore, key length and signature data length can be reduced by implement | achieving by elliptic curve encryption.
The method described in the above embodiment is a program that can be executed by a computer as a magnetic disk (floppy disk, hard disk, etc.), optical disk (CD-ROM, DVD, etc.), magneto-optical disk (MO), semiconductor memory. It can also be stored and distributed in a storage medium.
[0106]
In addition, as long as the storage medium can store a program and can be read by a computer, the storage format may be any form.
[0107]
In addition, an OS (operating system) running on a computer based on an instruction of a program installed in the computer from a storage medium, MW (middleware) such as database management software, network software, and the like implement the present embodiment. A part of each process may be executed.
[0108]
Further, the storage medium in the present invention is not limited to a medium independent of a computer, but also includes a storage medium in which a program transmitted via a LAN, the Internet, or the like is downloaded and stored or temporarily stored.
[0109]
Further, the number of storage media is not limited to one, and the case where the processing in the present embodiment is executed from a plurality of media is also included in the storage media in the present invention, and the media configuration may be any configuration.
[0110]
The computer according to the present invention executes each process according to the present embodiment based on a program stored in a storage medium, and includes a single device such as a personal computer or a system in which a plurality of devices are connected to a network. Any configuration may be used.
[0111]
In addition, the computer in the present invention is not limited to a personal computer, but includes an arithmetic processing device, a microcomputer, and the like included in an information processing device, and is a generic term for devices and devices that can realize the functions of the present invention by a program. .
[0112]
Note that the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the invention at the stage of implementation.
For example, the term “attribute information” is not limited to unit information (eg, complete information such as a word, a name, a small document, etc.) that has an independent meaning, but all or more than the threshold number are integrated. May be distributed information (for example, a part of secret information). That is, the term “attribute information” may be any partial information, and is not included in the scope of the present invention, even if it is not content indicating “attributes (features / characteristics of the object)”. The
[0113]
For example, when the present invention is applied to an application target of a well-known stepwise secret exchange protocol (eg, electronic commerce), and secret information (eg, payment information or contract document) is attribute information for each predetermined size, it is common practice The content indicating “part of payment information and contract document” is also included in the “attribute” of the present invention.
[0114]
However, in this case, two user / verifier devices having the functions of the user device and verifier device are used, and the disclosure of selective attribute information is repeated, and finally all attribute information is disclosed. It becomes the composition of sympathizing. That is, the selective disclosure of attribute information is not limited to once, and may be repeated a plurality of times. Further, the user device A and the verifier device V are not limited to being fixed in one direction, but may be alternated in both directions.
[0115]
On the other hand, along with the definition of attribute information, the term “attribute authorization document” may be a digital signature for a set of each partial information (each attribute information), not a socially accepted “attribute authorized” Are also included within the scope of the present invention. In the above-described example, “settlement information and contract document” on social convention is included in the “attribute authorization document” of the present invention.
[0116]
Further, the terms “user device” and “verifier device” are not limited to “user” and “verifier” as long as they have the functions described above. For example, when the present invention is applied to “speed lottery for aligning numbers (attribute information)”, the seller of the speed lottery (attribute approval document) uses the “user device”, and the user on the social belief is “verifier” Such a case is also included in the scope of the present invention.
[0117]
In addition, the embodiments and the modifications may be appropriately combined as much as possible, and in that case, combined effects can be obtained. Moreover, not only the combination of each embodiment and modification but each apparatus (User apparatus A, Attribute authorization-issue issuing institution apparatus ACA, Verifier apparatus V) can also be implemented suitably combining according to the system to which it is applied.
[0118]
For example, in the case of the first to sixth embodiments, the attribute approval certificate issuing institution device ACA and the verifier device V may be combined. Further, in the case of the speed lottery system described above, the user device A and the attribute authorization certificate issuing institution device ACA may be combined. Furthermore, in the case of the above-described system for the stepwise secret exchange, the user device A and the verifier device V may be combined.
[0119]
Furthermore, the above embodiments include inventions at various stages, and various inventions can be extracted by appropriate combinations of a plurality of disclosed configuration requirements.
For example, when an invention is extracted by omitting some constituent elements from all the constituent elements shown in the embodiment, when the extracted invention is implemented, the omitted part is appropriately supplemented by a well-known common technique. It is what is said.
[0120]
In addition, the present invention can be implemented with various modifications without departing from the gist thereof.
[0121]
【The invention's effect】
As described above, according to the present invention, it is possible to provide an attribute certification program and apparatus that can be applied to various systems and contribute to the development of the information society.
[Brief description of the drawings]
FIG. 1 is a schematic diagram showing a configuration of an attribute certification system according to a first embodiment of the present invention.
FIG. 2 is a flowchart for explaining an operation of issuing an attribute certificate in the embodiment;
FIG. 3 is a flowchart for explaining the operation of attribute certification in the embodiment;
FIG. 4 is a schematic diagram showing a configuration of an attribute certification system according to a third embodiment of the present invention.
FIG. 5 is a schematic diagram showing a configuration of a verifier apparatus according to a fifth embodiment of the present invention.
FIG. 6 is a schematic diagram for explaining the outline of the present invention.
FIG. 7 is a schematic diagram for explaining the essence of the present invention in comparison with the prior art.
[Explanation of symbols]
A ... User device
11: Key generation unit
12 ... Attribute information generation unit
13 ... Attribute approval form verification part
14 ... Attribute information manager
15 ... Attribute proof generation unit
ACA: Attribute approval certificate issuing organization
21 ... Attribute Information Screening Department
22 ... Attribute authorization form issuing department
V ... Verifier device
31 ... Attribute approval form verification part
32 ... Attribute information request part
33 ... Challenge generator
34, 34 '... attribute certification verification unit

Claims (14)

an attribute authorization document in which n pieces of attribute information are embedded based on n random numbers, n pieces of attribute information of the n pieces of attribute information, and n pieces of random numbers of the n pieces of random information, Received from the user device that uses the attribute certificate calculated from each blind value based on the above, the attribute approval certificate issuing institution device that issues the attribute approval document and the n random numbers to the user device, and the user device The attribute certificate is verified, and among the n pieces of attribute information in the attribute certificate , all the n pieces of attribute information are verified by the attribute certification , and each of the n pieces of attribute information is An attribute proof program used in an attribute proof system including a verifier device that individually verifies with n or less random numbers ,
A computer of the user device;
When issuing the attribute approval document,
Key generation means for generating a secret key and a public key;
Attribute information generating means for generating the n pieces of attribute information based on the inputted content, and presenting the n pieces of attribute information and the public key generated by the key generating means to the attribute authorization letter issuing institution device;
Means for receiving an attribute authorization letter and the n random numbers from the attribute authorization letter issuing authority device;
Function as an attribute license verification means for verifying the attribute license received from the attribute certificate issuing institution device,
Upon verification by the verifier device,
Transmitting the verification data attributes authorizations, challenge and the in each blind value and the verifier device calculated the attribute certificate and the verification data of the n or less of the attribute information simultaneously or separately on the basis of the Attribute proof generation means,
To function as,
The verification data of the n or less attribute information includes the n or less attribute information and the n or less random numbers . In the attribute certification program according to claim 1,
The attribute proof generating unit calculates a hash value of the challenge and calculates the attribute proof based on the hash value. In the attribute certification program according to claim 1 or claim 2,
The attribute proof generation means includes
An attribute proof program characterized in that it includes a process of “simultaneously” instead of “simultaneously or separately” and generating the challenge. an attribute authorization document in which n pieces of attribute information are embedded based on n random numbers, n pieces of attribute information of the n pieces of attribute information, and n pieces of random numbers of the n pieces of random information, Received from the user device that uses the attribute certificate calculated from each blind value based on the above, the attribute approval certificate issuing institution device that issues the attribute approval document and the n random numbers to the user device, and the user device The attribute certificate is verified, and among the n pieces of attribute information in the attribute certificate , all the n pieces of attribute information are verified by the attribute certification , and each of the n pieces of attribute information is An attribute proof program used in an attribute proof system including a verifier device that individually verifies with n or less random numbers ,
A computer of the attribute authorization issuance institution apparatus,
Attribute information examination means for examining whether each attribute information presented from the user device is valid or not,
When the examination result by the attribute information examination means indicates that it is valid, the attribute information is issued by embedding the n pieces of attribute information based on the n random numbers, and the attribute authorization form and the n pieces of attribute information are issued . Attribute authorization document issuance means for sending random numbers to user devices,
Attribute certification program to function as An attribute authorization document in which n pieces of attribute information are embedded based on n random numbers, and n pieces of attribute information among the n pieces of attribute information are n pieces or less of the n pieces of random numbers, and Received from the user device that uses the attribute certificate calculated from each blind value based on the above, the attribute approval certificate issuing institution device that issues the attribute approval document and the n random numbers to the user device, and the user device The attribute certificate is verified, and among the n pieces of attribute information in the attribute certificate , all the n pieces of attribute information are verified by the attribute certification , and each of the n pieces of attribute information is An attribute proof program used in an attribute proof system including a verifier device that individually verifies with n or less random numbers ,
A computer of the verifier device;
An attribute authorization verification unit for verifying the validity of the attribute authorization based on the verification data of the attribute authorization received from the user device;
When the verification result by the attribute authorization certificate validation means indicates validity, relates the attribute certificate and the n or less of the attribute information received from the user device, the n or less random numbers received from the user device Attribute certification verification means for verifying the validity based on each,
Attribute certification program to function as In the attribute certification program according to claim 5,
A computer of the verifier device;
Attribute information generation means for designating n or less attributes when the verification result by the attribute authorization document verification means indicates validity;
When an attribute is specified by the attribute information generation unit, a challenge is generated, and the challenge and the specified content are transmitted to the user device.
Attribute certification program to function as In the attribute certification program according to claim 5 or 6,
A target execution permission unit for permitting execution of a predetermined target system based on the contents of n or less pieces of attribute information received from the user device when the verification result by the attribute proof verification unit indicates validity;
Attribute certification program to function as an attribute authorization document in which n pieces of attribute information are embedded based on n random numbers, n pieces of attribute information of the n pieces of attribute information, and n pieces of random numbers of the n pieces of random information, Received from the user device that uses the attribute certificate calculated from each blind value based on the above, the attribute approval certificate issuing institution device that issues the attribute approval document and the n random numbers to the user device, and the user device The attribute certificate is verified, and among the n pieces of attribute information in the attribute certificate , all the n pieces of attribute information are verified by the attribute certification , and each of the n pieces of attribute information is The user device used in the attribute proof system including a verifier device that individually verifies with n or less random numbers ,
Key generation means for generating a secret key and a public key when issuing the attribute authorization document;
Attribute information generating means for generating the n pieces of attribute information based on the input content, and presenting the n pieces of attribute information and the public key generated by the key generating means to the attribute authorization issuing authority apparatus; ,
Means for receiving an attribute authorization letter and the n random numbers from the attribute authorization issuing authority apparatus;
Attribute license verification means for verifying the attribute license received from the attribute certificate issuing institution device;
Upon verification by the verifier device, and the verification data of the attribute authorizations, challenge and said verification data of the attribute certificate and the n or less of the attribute information is calculated based on the respective blind value simultaneously Or attribute proof generation means for separately transmitting to the verifier device;
Equipped with a,
The verification data of the n or less attribute information includes the n or less attribute information and the n or less random numbers . The user device according to claim 8, wherein
The attribute proof generation unit calculates a hash value of the challenge, and calculates the attribute proof based on the hash value. In the user apparatus according to claim 8 or 9,
The attribute proof generation means includes
A user apparatus characterized by including a process of “simultaneously” instead of “simultaneously or separately” and generating the challenge. an attribute authorization document in which n pieces of attribute information are embedded based on n random numbers, n pieces of attribute information of the n pieces of attribute information, and n pieces of random numbers of the n pieces of random information, Received from the user device that uses the attribute certificate calculated from each blind value based on the above, the attribute approval certificate issuing institution device that issues the attribute approval document and the n random numbers to the user device, and the user device The attribute certificate is verified, and among the n pieces of attribute information in the attribute certificate , all the n pieces of attribute information are verified by the attribute certification , and each of the n pieces of attribute information is The attribute authorization issuance institution apparatus used in the attribute certification system including a verifier apparatus that individually verifies with n or less random numbers ,
Attribute information examination means for examining whether each attribute information presented from the user device is valid or not;
When the examination result by the attribute information examination means indicates that it is valid, the attribute information is issued by embedding the n pieces of attribute information based on the n random numbers, and the attribute authorization form and the n random numbers are issued. Attribute authorization issuance means for transmitting to the user device;
An attribute approval issuance institution apparatus characterized by comprising: an attribute authorization document in which n pieces of attribute information are embedded based on n random numbers, n pieces of attribute information of the n pieces of attribute information, and n pieces of random numbers of the n pieces of random information, Received from the user device that uses the attribute certificate calculated from each blind value based on the above, the attribute approval certificate issuing institution device that issues the attribute approval document and the n random numbers to the user device, and the user device The attribute certificate is verified, and among the n pieces of attribute information in the attribute certificate , all the n pieces of attribute information are verified by the attribute certification , and each of the n pieces of attribute information is The verifier device used in the attribute proof system including a verifier device that individually verifies with n or less random numbers ,
Based on the verification data of the attribute certificate received from the user device, attribute license verification means for verifying the validity of the attribute license,
Based on the n or less random numbers received from the user device with respect to the attribute proof and the n or less attribute information received from the user device when the verification result by the attribute authorization verification means indicates validity Te, and the attribute certificate verification means for verifying each validity,
A verifier apparatus characterized by comprising: The verifier device according to claim 12,
Attribute information generating means for designating n or less attributes when the verification result by the attribute authorization document verification means indicates validity;
When an attribute is specified by the attribute information generating means, a challenge is generated, and the challenge and the specified content are transmitted to the user device, and challenge generating means,
A verifier apparatus characterized by comprising: In the verifier device according to claim 12 or 13,
When the verification result by the attribute certification verification means shows validity, the system includes a target execution permission means for permitting execution of a predetermined target system based on the contents of n or less pieces of attribute information received from the user device . A verifier device characterized by that.

Images