JP6013177B2 - Kana management system, kana management method, and kana management program - Google Patents

Description

  The present invention relates to a kana management system, a kana management method, and a kana management program for protecting personal information when a plurality of service sites are used.

  Today, personal information (for example, service usage information) is collected at each service site, and services are often provided based on this usage information. Here, if usage information provided to a plurality of service sites can be traced, the damage caused when the user's personal information is leaked may increase. Therefore, a member management system that prevents tracing of usage information has been studied (for example, see Patent Document 1). In the member management system described in this document, each service information is provided to the user by connecting to a plurality of service management servers. Here, different member IDs are generated in each service management server from one unique ID stored in the user's IC card, and the service management server is made to manage the membership of one user with these different member IDs.

In addition, a service that unifies authentication and provides different user identification information for each service site has been studied (for example, see Non-Patent Document 1). If information leaks from a site providing such a service, user information can be linked between different sites. A paper has been published on a mechanism for preventing such leakage (see, for example, Non-Patent Document 2).
In Non-Patent Document 2, a blind signature technique is used to perform identity verification. For this blind signature technique, a selective document attack may be performed that allows an attacker to create a signature for another document desired by the attacker by obtaining a signature for a document preselected by the attacker. . An improvement for eliminating the vulnerability of the blind signature in the selected document attack is also being studied (for example, see Non-Patent Document 3).

SlideShare, “Pseudonyms for Privacy”, [online], October 13, 2010, JayUnger, [December 5, 2012 search], Internet <URL: http://www.slideshare.net/JayUnger/iiw -11-pseudonyms-5771938> Google, “PseudoID: Enhancing Privacy in Federated Login”, [online], 2010, Arkajit Dey, Stephen A. Weis, [Search December 5, 2012], Internet <URL: http: // research. google.com/pubs/pub36553.html> Moonsang KWON and Yookun CHO, “Randomization Enhanced Blind Signature Schemes Based on RSA”, [online], [Search on December 21, 2012], Internet <URL: http://citeseerx.ist.psu.edu/viewdoc/ download? doi = 10.1.1.129.4475 & rep = rep1 & type = pdf>

Japanese Patent Laying-Open No. 2007-249690 (first page, FIG. 1)

In the technique described in Patent Document 1, an IC card is used. However, when a service site is used on the Internet, it is difficult to use the IC card.
In addition, in the technique described in Non-Patent Document 1, when user-specific information different for each service site leaks information from a centrally managed site, the influence is great. Further, the technique described in Non-Patent Document 2 has a security problem because it repeatedly uses an electronic signature stored as a cookie (HTTP cookie). That is, since it is only confirmed that it has a certificate, if a certificate is stolen, another person may be authenticated.

  The present invention has been made to solve the above-described problems, and an object thereof is to provide a technique for protecting personal information when a plurality of service sites are used.

  (1) A kana management system, a kana management method, and a kana management program for solving the above problems, a parameter information storage unit that stores fixed conversion parameters, and a user information storage unit that stores a kana made up of character strings A control unit connected to the authentication system and the service system, wherein the control unit obtains a user identifier and a first electronic signature generated using the user identifier from the authentication system, and the user identifier And a variable conversion parameter used for conversion of the user identifier corresponding to the kana, and using the fixed conversion parameter, the variable conversion parameter, and the first electronic signature, A converted user identifier and a second electronic signature for the first electronic signature are generated from the user identifier, and the converted user identifier and Said second digital signature, and providing to the service system.

  Thereby, the service system can specify the user authenticated in the authentication system using the converted user identifier and the second electronic signature. In addition, it can be confirmed that authentication has been performed in the authentication system.

  (2) Furthermore, it is preferable that the kana associated with the user identifier is output to identify the kana selected by the user. Thereby, the user can select a pseudonym corresponding to the access destination.

  (3) Furthermore, it is preferable to specify the pseudonym acquired when accessing the service system. As a result, the pseudonym can be specified without burden on the user according to the service system that is the access destination.

  (4) A pseudonym management system, a pseudonym management method, and a pseudonym management program for solving the above-described problem, a challenge code storage unit that stores a challenge code used in authentication in association with a plurality of user identifiers, and an authentication system A control unit connected to the service system, and the control unit provides the authentication system with a preceding challenge code used at the time of previous authentication and a subsequent challenge code used for the current authentication. A blind signature for a subsequent challenge code is obtained from the authentication system for the user specified based on the used preceding challenge code, and an electronic signature for the user is generated using the blind signature, and the service system is An electronic signature is provided for the electronic signature. Thereby, based on a user's usage history, a user can be specified and converted into a pseudonym.

  (5) Furthermore, it is preferable that the control unit obtains a parameter for generating the subsequent challenge code from an authentication system. Thereby, the fall of security can be controlled.

  (6) Further, before the control unit obtains a parameter for generating the subsequent challenge code from the authentication system, information for confirming that the selected document attack has not been performed (attack verification code) ) Is preferably provided to the authentication system. This selected document attack is an attack that enables an attacker to create a signature for another document desired by the attacker by obtaining a signature for a preselected document when the kana management system becomes an attacker. is there. Thereby, the subsequent challenge code can be generated on the condition that the selected document attack is not performed. Specifically, before generating an electronic signature, the authentication system verifies the relationship between the original attack verification code required for pseudonymization and the challenge code, and confirms that the selected document attack has not been performed. .

  (7) Furthermore, it is preferable to acquire the user identifier from the service system. Thereby, a preceding challenge code can be specified using the user identifier acquired from the service system.

  (8) Furthermore, it is preferable that the control unit specifies the user identifier based on a pseudonym designated by a user, and provides the user identifier together with the electronic signature to the service system. Thereby, in a service system, a user can be specified and verified using the user identifier and electronic signature acquired from the pseudonym management system.

  According to the present invention, personal information can be protected when using a plurality of service sites.

1 is a system schematic diagram of a first embodiment. It is explanatory drawing of the data used in 1st Embodiment, Comprising: (a) is the data recorded on the user information storage part, (b) Explanatory drawing of the data recorded on the kana information storage part. Explanatory drawing of the process sequence of 1st Embodiment. Explanatory drawing of the process sequence of 2nd Embodiment. Explanatory drawing of the process sequence of 3rd Embodiment.

<First Embodiment>
Hereinafter, an embodiment in which a kana management system, a kana management method, and a kana management program are embodied will be described with reference to FIGS. In the present embodiment, it is assumed that the user uses a plurality of service sites. If multiple service sites with the same name are used and site usage information can be traced with this name, the impact of leaking personal information may increase. Therefore, when accessing each service site, it is assumed that the user logs in with a different name (a pseudonym) while performing personal authentication.

As shown in FIG. 1, in this embodiment, a user terminal 10, an authentication server 20, a pseudonym server 30, and a service site server 50 connected via a network are used.
The user terminal 10 is a computer terminal used by a user who accesses each service site server 50. The user terminal 10 includes a terminal control unit 11, an input unit, and an output unit.

  The terminal control unit 11 includes a control unit including a CPU, a RAM, a memory such as a ROM, and the like, and performs display processing of information acquired from the service site server 50 to be accessed and transmission processing of information to the service site server 50. Run. The terminal control unit 11 functions as the browser 111 by executing the browser program for this purpose.

  The input unit is a means for inputting various types of information, and includes a keyboard, a pointing device, and the like. On the other hand, the output unit is a means for outputting various types of information, and is configured by a display or the like. Further, by using a touch panel display, it is possible to cause one device to function as an input unit and an output unit.

  The service site server 50 is a computer system of a service organization that functions as a service system and provides various information to the user terminal 10. The service site server 50 includes a control unit 51 and a personal information storage unit 52.

  The control unit 51 includes control means including a CPU, a memory such as a RAM and a ROM, and executes a user management process recorded in the personal information storage unit 52. By executing the personal information management program for this purpose, the control unit 51 functions as a personal authentication unit and a service management unit.

The personal authentication unit executes a process of confirming that the user is a registered user by login authentication of the user who is an accessor.
The service management unit executes processing for providing various services to the logged-in user.

  The personal information storage unit 52 stores a user management record for managing the user's personal information. In the user management record, various personal information is recorded in association with the user identifier.

  The authentication server 20 functions as an authentication system and is a computer system for authenticating a user who uses the service site server 50. The authentication server 20 includes a control unit 21 and a user information storage unit 22.

  The control unit 21 includes a control unit including a CPU, a memory such as a RAM and a ROM, and executes processing for supporting user authentication. By executing the authentication management program for this purpose, the control unit 21 functions as a login management unit 211 and a signature management unit 212.

The login management unit 211 executes a process for authenticating the user.
The signature management unit 212 executes processing for generating an electronic signature indicating that the user is an authenticated user. In this embodiment, an electronic signature is generated using an RSA encryption method. Therefore, the signature management unit 212 manages an encryption key and a public key for generating an electronic signature.

  As shown in FIG. 2A, a user management record 220 for managing users using the service site server 50 is recorded in the user information storage unit 22. This user management record 220 is recorded when a user registration is made for using this service. This user management record 220 includes data relating to an ID, a password, and a user identifier.

In the ID data area, data relating to an identifier used when each user using the service logs in is recorded.
In the password data area, personal authentication data for authenticating each user is recorded.

  In the user identifier data area, data relating to an identifier for identifying the user is recorded. By using this user identifier, detailed information about the user can be acquired from another data storage unit.

  The kana server 30 functions as a kana management system and is a computer system for managing kana when the user uses each service site server 50. The kana conversion server 30 includes a control unit 31 and a kana information storage unit 32.

  The control unit 31 includes a control unit including a CPU, a memory such as a RAM and a ROM, and executes a process of managing a pseudonym for a user who has been authenticated. By executing the kana management program for this purpose, the control unit 31 of the kana conversion server 30 functions as the kana management unit 311 and the signature management unit 312.

The kana management unit 311 executes a process for managing a kana for a user who has been authenticated.
The signature management unit 312 executes processing for managing an electronic signature indicating that personal authentication has been performed. The signature management unit 312 includes dedicated hardware (for example, HSM: hardware security module) that stores the fixed conversion parameter r in a secret manner as a parameter information storage unit.

  As shown in FIG. 2B, a kana management record 320 for managing each user's kana is recorded in the kana information storage section 32 as a user information storage section. This kana management record 320 is recorded when a kana is registered. The kana management record 320 includes data relating to a user identifier, a kana, and a kana code.

Data relating to an identifier for identifying each user is recorded in the user identifier data area.
In the kana data area, data relating to kana used by the user is recorded. In this data area, a plurality of pseudonyms can be registered in order to use a plurality of service site servers 50.
In the kana code data area, data relating to a character string used when the user identifier of this user is converted into an anti-blind signature, which will be described later, is recorded corresponding to the kana.

Next, a processing procedure for using the service site server 50 using the pseudonym by the above system will be described with reference to FIG.
Here, prior to providing the service, the control unit 21 of the authentication server 20 executes a process for generating a public key (e, n) (step S1-1). Specifically, the signature management unit 212 of the control unit 21 selects two prime numbers p and q, and calculates n = p · q and φ = (p−1) · (q−1). In the present embodiment, the prime number p functions as a variable conversion parameter. Then, the signature management unit 212 randomly selects an integer e and a signature private key d so that e · d≡1 (modφ). Then, the control unit 21 discloses the public key (e, n).

  Prior to providing the service, the control unit 31 of the pseudonymization server 30 executes a process for generating the fixed conversion parameter r (step S1-2). Specifically, the signature management unit 312 of the control unit 31 randomly generates a fixed conversion parameter r for making an anti-blind signature. Here, “anti-blind signature” is a concept for “blind signature”. Specifically, the “blind signature” is a method in which a user is asked to sign without knowing the subject of signature (contents) so that the contents can be understood later. On the other hand, “anti-blind signing” is a method of signing in a state where the subject of signature is known and handing it over to others without knowing the contents. Then, the signature management unit 312 conceals the generated fixed conversion parameter r in the hardware security module (HSM).

  And the terminal control part 11 of the user terminal 10 performs an access process (step S1-3). Specifically, the browser 111 of the terminal control unit 11 inputs the address (URL) of the service site server 50 to be accessed. In this case, the browser 111 transmits an access request to the service site server 50.

  Next, the control unit 51 of the service site server 50 executes a random code γ generation process (step S1-4). Specifically, the personal authentication unit of the control unit 51 uses a cookie, a service-specific ID, or the like to identify the accessing user and confirms whether the user has already been authenticated. For the authenticated user, the service management unit of the control unit 51 continues the service for this user. On the other hand, in the case of a user who has not been authenticated, the personal authentication unit of the control unit 51 randomly generates a random code γ (γεZn). The random code γ is an identifier for requesting authentication to the authentication server 20 on the assumption that the pseudonym server 30 is requested to perform pseudonymization.

  Next, the control part 51 of the service site server 50 performs the redirect transmission process of the random code (gamma) (step S1-5). Specifically, the personal authentication unit of the control unit 51 transmits the random code γ to the user terminal 10 so that the random code γ can be transferred to the authentication server 20. Since there is a case where it is not desired to tell the authentication server 20 which service site server 50 is used, a method of accessing the authentication server 20 via the pseudonymization server 30 is also conceivable.

  Next, the terminal control unit 11 of the user terminal 10 executes a random code γ transfer process (step S1-6). Specifically, the browser 111 of the terminal control unit 11 transfers the random code γ to the authentication server 20.

  Next, the control unit 21 of the authentication server 20 executes a login screen transmission process (step S1-7). Specifically, the login management unit 211 of the control unit 21 transmits login screen data to the user terminal 10. This login screen is provided with input fields for ID and password.

  Next, the terminal control unit 11 of the user terminal 10 executes ID and password input processing (step S1-8). Specifically, the browser 111 of the terminal control unit 11 displays the login screen data acquired from the authentication server 20 on the display. Then, the browser 111 transmits a login request to the authentication server 20. This login request includes data relating to the ID and password entered on the login screen.

  Next, the control part 21 of the authentication server 20 performs a user authentication process (step S1-9). Specifically, the login management unit 211 of the control unit 21 searches the user information storage unit 22 for a user management record 220 in which an ID and a password acquired from the user terminal 10 are recorded. If the user management record 220 in which the ID and password are recorded can be extracted, the user authentication process is completed. On the other hand, when the user management record 220 in which the ID and password are recorded cannot be extracted, the login management unit 211 outputs a message indicating that login cannot be performed to the user terminal 10.

  Next, the control part 21 of the authentication server 20 performs the identification process of the user identifier m (step S1-10). Specifically, the login management unit 211 of the control unit 21 specifies the user identifier m recorded in the extracted user management record 220.

Next, the control unit 21 of the authentication server 20 executes the generation process of the electronic signature s (step S1-11). Specifically, the login management unit 211 of the control unit 21 uses the following formula to calculate the electronic signature s using a value obtained by raising the user identifier m of the authenticated user and the random code γ to the d-th power. (First electronic signature) is calculated. Here, if an arbitrary random code γ is allowed, the signature private key d may be leaked. Therefore, the validity of the service site server 50 is checked, or the signature private key d acquired from the service site server 50 is checked. It is also possible to use a method of calculating a hash value of the salted and padded value.

  Next, the control unit 21 of the authentication server 20 executes redirect transmission processing of the user identifier m and the electronic signature s (step S1-12). Specifically, the login management unit 211 of the control unit 21 transmits the user identifier m and the electronic signature s to the user terminal 10 so as to be transferred to the pseudonymization server 30.

  Next, the terminal control unit 11 of the user terminal 10 executes a transfer process of the user identifier m and the electronic signature s (step S1-13). Specifically, the browser 111 of the terminal control unit 11 transfers the user identifier m and the electronic signature s to the pseudonymization server 30.

  Next, the control unit 31 of the pseudonymization server 30 executes a process for specifying the pseudonym of the user identifier m (step S1-14). Specifically, the pseudonym management unit 311 of the control unit 31 verifies the electronic signature s using the public key (e, n) of the authentication server 20. If the electronic signature s cannot be verified, the kana management unit 311 returns an error message to the user terminal 10. On the other hand, when the electronic signature s can be verified, the kana management unit 311 extracts the kana management record 320 in which the user identifier m is recorded from the kana information storage unit 32, and is recorded in the kana management record 320. Get a pseudonym.

  Next, the control unit 31 of the kana conversion server 30 executes transmission processing of a kana selection screen (step S1-15). Specifically, the kana management unit 311 of the control unit 31 transmits kana selection screen data to the user terminal 10. The kana selection screen includes a list of kana acquired from the kana management record 320 and a desired kana selection button.

  Next, the terminal control unit 11 of the user terminal 10 performs a pseudonym selection process (step S1-16). Specifically, the browser 111 of the terminal control unit 11 displays a kana selection screen acquired from the kana conversion server 30. When a desired kana is selected on the kana selection screen, the browser 111 transmits data relating to the selected kana to the kana conversion server 30.

Next, the control unit 31 of the kana server 30 executes a coefficient calculation process (step S1-17). Specifically, the signature management unit 312 of the control unit 31 calculates a coefficient r _ss for converting the user identifier m into an anti-blind signature from the user identifier m, the authentication server 20 identifier, the pseudonym code c, and the fixed conversion parameter r. calculate. Here, the following calculation formula is used. “AS” is an identifier (for example, name) of the authentication server 20.

  As the kana code c, a character string corresponding to the kana used for the service site server 50 and recorded in the kana management record 320 is used. The kana code c can be randomly generated when the kana is created. The kana code c may be an identifier of the service site server 50 or an arbitrary character string selected or input by the user.

Next, the control unit 31 of the pseudonymization server 30 executes a process of generating a converted user identifier m ′ and electronic signature s ′ (step S1-18). Specifically, the signature management unit 312 of the control unit 31 generates a converted user identifier m ′ obtained by converting the user identifier m into an anti-blind signature, and also outputs a corresponding electronic signature s ′ (second electronic signature). calculate. Note that the signature management unit 312 performs these series of processes in the hardware security module (HSM) so that the coefficient r _ss does not leak to the outside.

  Next, the control unit 31 of the pseudonymization server 30 executes redirect transmission processing of the converted user identifier m ′ and electronic signature s ′ (step S1-19). Specifically, the signature management unit 312 of the control unit 31 transmits the converted user identifier m ′ and the electronic signature s ′ converted to the anti-blind signature to the user terminal 10 so as to be transferred to the service site server 50. .

  Next, the terminal control unit 11 of the user terminal 10 executes a transfer process of the converted user identifier m ′ and the electronic signature s ′ (Step S1-20). Specifically, the browser 111 of the terminal control unit 11 transfers the post-conversion user identifier m ′ and the electronic signature s ′ that have been anti-blind signed to the service site server 50.

Next, the control unit 51 of the service site server 50 executes an electronic signature verification process (step S1-21). Specifically, the personal authentication unit of the control unit 51 uses the converted user identifier m ′ acquired from the user terminal 10 to verify the anti-blind signature electronic signature s ′. Specifically, it is confirmed whether the following calculation formula is satisfied.

This formula is established when the authentication server 20 correctly performs an electronic signature as follows.

  Next, the control unit 51 of the service site server 50 executes a user identification process using the converted user identifier m ′ (step S1-22). Specifically, the service management unit of the control unit 51 acquires personal information from the personal information storage unit 52 using the verified user identifier m ′ that has been verified, and provides the service to the user terminal 10.

According to this embodiment, the following effects can be obtained.
(1) In the present embodiment, the terminal control unit 11 of the user terminal 10 executes a pseudonym selection process (step S1-16). Thereby, the service site server 50 can be used using the pseudonym selected by each user. Therefore, by changing the pseudonym for each service site server 50, it is possible to prevent tracing when user information is leaked.

  (2) In the present embodiment, the control unit 21 of the authentication server 20 executes the generation process of the electronic signature s (step S1-11). Further, the control unit 31 of the pseudonymization server 30 executes a coefficient calculation process (step S1-17), a post-conversion user identifier m ', and a digital signature s generation process (step S1-18). Thereby, the property of the electronic signature s generated in the authentication server 20 is inherited in the electronic signature s ′, so that the electronic signature can be verified in the service site server 50. Further, since the electronic signature s ′ includes the random code γ, it is possible to verify that the personal authentication has been performed after the access processing (step S1-1) of the terminal control unit 11 of the user terminal 10. .

  (3) In the present embodiment, the control unit 31 of the pseudonymization server 30 executes a process for generating the fixed conversion parameter r (step S1-2). In this case, the signature management unit 312 conceals the generated fixed conversion parameter r in the hardware security module (HSM). Thereby, leakage of the fixed conversion parameter r can be suppressed.

<Second Embodiment>
Next, a second embodiment will be described with reference to FIG. In the first embodiment, the pseudonymization server 30 generates a post-conversion user identifier m ′ and an electronic signature s ′. In the second embodiment, the user terminal 10 is configured to generate a post-conversion user identifier m ′ and an electronic signature s ′, and detailed description of similar parts is omitted. In the present embodiment, the terminal control unit 11 of the user terminal 10 is provided with a signature management unit and a parameter information storage unit.

Here, as shown in FIG. 4, prior to service provision, the control unit 21 of the authentication server 20 executes public key (e, n) generation processing in the same manner as in step S <b> 1-1 (step S <b> 2-1). ).
Prior to using the service, the terminal control unit 11 of the user terminal 10 executes a process for generating the fixed conversion parameter r (step S2-2). Specifically, the signature management unit of the terminal control unit 11 generates the fixed conversion parameter r as in step S1-2. Then, the signature management unit of the terminal control unit 11 encrypts the fixed conversion parameter r and records it in the parameter information storage unit in the user terminal 10. The terminal control unit 11 acquires a script for generating and storing the fixed conversion parameter r from the pseudonym server 30 and executes the script. In this script, the fixed conversion parameter r is randomly generated. Further, the terminal control unit 11 stores the fixed conversion parameter r in the user terminal 10 without transmitting it to the outside (for example, the pseudonymization server 30).

And the terminal control part 11 of the user terminal 10 performs an access process similarly to step S1-3 (step S2-3).
Next, the control part 51 of the service site server 50 performs the production | generation process of random code (gamma) similarly to step S1-4 (step S2-4).

Next, the control part 51 of the service site server 50 performs the redirect transmission process of random code (gamma) similarly to step S1-5 (step S2-5).
Next, the terminal control unit 11 of the user terminal 10 executes a transfer process of the random code γ similarly to step S1-6 (step S2-6).

Next, the control part 21 of the authentication server 20 performs the transmission process of a login screen similarly to step S1-7 (step S2-7).
Next, the terminal control unit 11 of the user terminal 10 executes ID and password input processing (step S2-8) in the same manner as in step S1-8.

Next, the control part 21 of the authentication server 20 performs a user authentication process similarly to step S1-9 (step S2-9).
Next, the control part 21 of the authentication server 20 performs the identification process of the user identifier m similarly to step S1-10 (step S2-10).

Next, the control unit 21 of the authentication server 20 executes the generation process of the electronic signature s as in Step S1-11 (Step S2-11).
Next, similarly to step S1-12, the control unit 21 of the authentication server 20 executes a redirect transmission process for the user identifier m and the electronic signature s (step S2-12).

Next, the terminal control unit 11 of the user terminal 10 executes a transfer process of the user identifier m and the electronic signature s as in Step S1-13 (Step S2-13).
Next, similarly to step S1-14, the control unit 31 of the kana conversion server 30 executes a process for specifying the kana of the user identifier m (step S2-14).

Next, similarly to step S1-15, the control unit 31 of the kana conversion server 30 executes transmission processing of the kana selection screen (step S2-15).
Next, the terminal control unit 11 of the user terminal 10 performs a pseudonym selection process (step S2-16), similarly to step S1-16.

  Next, the control unit 31 of the pseudonymization server 30 executes a parameter specifying process (step S2-17). Specifically, the signature management unit 312 of the control unit 31 specifies the user identifier m, the authentication server 20 identifier, and the pseudonym code c. Here, as the kana code c, a character string corresponding to the kana used for the service site server 50 is used. As the kana code c, an identifier of the service site server 50 or an arbitrary character string selected or input by the user can be used.

  Next, the control unit 31 of the pseudonymization server 30 executes a parameter, electronic signature s, and script transmission process (step S2-18). Specifically, the signature management unit 312 of the control unit 31 transmits information necessary for generating an electronic signature to the user terminal 10. Here, parameters (user identifier m, authentication server 20 identifier, pseudonym code c), electronic signature s, and script are transmitted as information necessary for generating the electronic signature. This script is a program that runs on the browser, and calculates a converted user identifier m ′ obtained by converting the user identifier m into an anti-blind signature and an electronic signature s ′ corresponding thereto from these parameters and the fixed conversion parameter r. .

Next, the terminal control unit 11 of the user terminal 10 executes a process for generating the converted user identifier m ′ and the electronic signature s ′ (step S2-19). Specifically, the signature management unit of the terminal control unit 11 converts the user identifier m into an anti-blind signature from the fixed conversion parameter r stored in the storage unit of the user terminal 10 using a script acquired from the pseudonym server 30. Calculate the coefficient r _ss for.

  Further, the signature management unit calculates the converted user identifier m ′ obtained by converting the user identifier m into an anti-blind signature by the script, and also calculates the corresponding electronic signature s ′.

  Next, the terminal control unit 11 of the user terminal 10 executes a transmission process of the converted user identifier m ′ and the electronic signature s ′ (Step S2-20). Specifically, the browser 111 of the terminal control unit 11 transmits the converted user identifier m ′ and the electronic signature s ′ that have been converted into an anti-blind signature to the service site server 50.

Next, the control unit 51 of the service site server 50 executes the verification process of the transmission electronic signature of the converted user identifier m ′ and electronic signature s ′, similarly to step S1-21 (step S2-21).
Next, the control part 51 of the service site server 50 performs a user specific process by the converted user identifier m 'similarly to step S1-22 (step S2-22).

According to this embodiment, the following effects can be obtained.
(4) In the present embodiment, the terminal control unit 11 of the user terminal 10 executes a process for generating the fixed conversion parameter r (step S2-2). And the terminal control part 11 of the user terminal 10 performs the production | generation process of the converted user identifier m 'and electronic signature s' (step S2-19). In this case, the fixed conversion parameter r stored in the user terminal 10 is used. Thereby, the electronic signature s ′ can be generated in the user terminal 10 while taking over the property of the electronic signature s generated in the authentication server 20. Further, the post-conversion user identifier m ′ is generated using a fixed conversion parameter r that the pseudonymization server 30 does not grasp. Accordingly, the user can use the service site server 50 without the external pseudonymization server 30 not knowing the converted user identifier m ′. For this reason, the influence of the information leakage in the pseudonymization server 30 can be reduced.

<Third Embodiment>
Next, a third embodiment will be described with reference to FIG. In the first embodiment, the kana server 30 specifies a kana. In the third embodiment, the service site server 50 obtains a pseudonym and obtains an electronic signature from the pseudonymization server 30 to verify the pseudonym, and detailed description of similar parts is omitted. . In this case, the service site server 50 stores, in each user, the personal information storage unit 52 for each user, a symbol m _i (identifier for user authentication) that identifies the accessing user. Note that the symbol _mi is different for each access even for the same user. The challenge code β _i used in association with the ID is recorded in the user information storage unit 22 of the authentication server 20. Further, the used challenge code β _i is recorded in the kana information storage unit 32 of the kana conversion server 30 for each kana. Thereby, the kana information storage unit 32 functions as a challenge code storage unit.

Here, prior to providing the service, the control unit 21 of the authentication server 20 executes a process for generating a public key (e, n), similarly to step S1-1 (step S3-1).
And the terminal control part 11 of the user terminal 10 performs an access process similarly to step S1-3 (step S3-2).

Next, the control part 51 of the service site server 50 performs a user specific process (step S3-3). Specifically, the control unit 51 uses a cookie (HTTP cookie) for realizing user identification and session management, a unique ID (a pseudonym) for each user in the service site server 50, etc. Is identified. Then, the control unit 51, the current access, to ensure that the authenticated, to generate the symbols m _i for obtaining a digital signature to the authentication server 20. Furthermore, the control unit 51 specifies the symbol m _i-1 used when the electronic server asked the authentication server 20 for an electronic signature last time from the personal information storage unit 52 at the previous access.

Next, the control unit 51 of the service site server 50, the symbol m _i, performing the redirection process of transmitting m _i-1 (step S3-4). Specifically, the control unit 51 transmits the symbol _mi and the symbol _mi-1 to the user terminal 10 such that the symbol _mi and the symbol _mi-1 can be transferred to the pseudonymization server 30.

Next, the terminal control unit 11 of the user terminal 10 executes transfer processing of symbols m _i and m _i-1 (step S3-5). Specifically, the browser 111 of the terminal control unit 11 transfers the symbols m _i and m _i−1 to the pseudonymization server 30.

Next, the control unit 31 of the pseudonymization server 30 executes a calculation process of the intermediate parameter α _i (step S3-6). Specifically, the kana management unit 311 of the control unit 31 calculates the intermediate parameter α _i using the randomly selected blinding parameter u _i εZn and the fixed transformation parameter r _i εZn ≠ 0. In this case, the following calculation formula is used.

Then, the kana management unit 311 transmits the intermediate parameter α _i to the user terminal 10 so that the intermediate parameter α _i can be transferred to the authentication server 20.

Next, the terminal control unit 11 of the user terminal 10 executes the transfer process of the intermediate parameter α _i (step S3-7). Specifically, the browser 111 of the terminal control unit 11 transfers the intermediate parameter α _i to the authentication server 20.

Next, the control unit 21 of the authentication server 20 executes a random code x _i generation process (step S3-8). Specifically, the signature management unit 212 of the control unit 21 randomly generates a random code x _i εZn. Then, the signature management unit 212 transmits the random code x _i to the user terminal 10 so that the random code x _i can be transferred to the pseudonymization server 30.

Then, the terminal control unit 11 of the user terminal 10 performs the transfer processing of the random code x _i (step S3-9). Specifically, the browser 111 of the terminal control unit 11 transfers the random code x _i to the pseudonymization server 30.

Next, the control unit 31 of the pseudonymization server 30 executes a calculation process of the challenge code β _i (step S3-10). Specifically, the kana management unit 311 of the control unit 31 randomly selects a random code b _i εZ ^* n and calculates a challenge code β _i (subsequent challenge code).

Next, the control unit 31 of the pseudonymization server 30 executes a challenge code β _i recording process (step S3-11). Specifically, the kana management unit 311 of the control unit 31 stores the challenge code β _i in the kana information storage unit 32 together with the symbol m _i .

Next, the control unit 31 of the pseudonymizing server 30 executes a transmission process of challenge codes β _i and β _i-1 (step S3-12). Specifically, the kana management unit 311 of the control unit 31 acquires the challenge code β _i-1 used in the previous access from the kana information storage unit 32 as a preceding challenge code. Then, the kana management unit 311 transmits the challenge codes β _i and β _i-1 to the authentication server 20.

Next, the control unit 21 of the authentication server 20 executes ID identification processing using the challenge code β _i-1 (step S3-13). Specifically, the signature management unit 212 of the control unit 21 specifies an ID associated with the challenge code β _i-1 in the user information storage unit 22. Furthermore, the signature management unit 212 records the challenge code β _i in the user information storage unit 22 in association with a new ID.

  Next, the control part 21 of the authentication server 20 performs the transmission process of a login screen similarly to step S1-7 (step S3-14). Here, it is also possible to initially set an ID specified in advance on the login screen.

  Next, the terminal control unit 11 of the user terminal 10 executes a password input process (step S3-15). Specifically, the browser 111 of the terminal control unit 11 displays the login screen acquired from the authentication server 20 on the display. Then, the browser 111 transmits a login request to the authentication server 20. The login request includes data related to the password entered on the login screen.

Next, the control part 21 of the authentication server 20 performs a user authentication process similarly to step S1-9 (step S3-16).
Next, the control unit 21 of the authentication server 20 executes the generation processing of the electronic signature t _i (step S3-17). Specifically, the signature management unit 212 of the control unit 21 calculates a blinded electronic signature t _i for indicating that the user authentication process has been completed. Here, the following calculation formula is used.

The signature management unit 212, a digital signature t _i, so as to be transferred to pseudonymization server 30, and transmits to the user terminal 10.

Then, the terminal control unit 11 of the user terminal 10 performs the transfer processing of the electronic signature t _i (step S3-18). Specifically, the browser 111 of the terminal control unit 11 transfers the digital signature t _i to pseudonymization server 30.

Next, the control unit 31 of the pseudonymization server 30 executes processing for generating parameters c _i and electronic signatures s _i (step S3-19). Specifically, the signature management unit 312 of the control unit 31 calculates an unblinded electronic signature s _i and parameters c _i . Here, the following calculation formula is used.

Next, the control unit 31 of the pseudonymization server 30 executes a redirect transmission process of the parameters c _i and the electronic signature s _i (step S3-20). Specifically, the signature management unit 312 transmits the parameters c _i and the electronic signature s _i to the user terminal 10 so as to be transferred to the service site server 50.

Next, the terminal control unit 11 of the user terminal 10 executes a transfer process of the parameters c _i and the electronic signature s _i (step S3-21). Specifically, the browser 111 of the terminal control unit 11 transfers the parameter c _i and the electronic signature s _i to the service site server 50.

Next, the control unit 51 of the service site server 50 executes an electronic signature verification process (step S3-22). Specifically, the control unit 51 verifies the parameters c _i and electronic signature s _i acquired from the user terminal 10. Here, it is confirmed that the electronic signature s _i is correct by satisfying the following calculation formula.

According to this embodiment, the following effects can be obtained.
(5) In the present embodiment, the control unit 51 of the service site server 50 executes a user identification process (step S3-3), and the terminal control unit 11 of the user terminal 10 uses symbols _mi , _{mi- 1} transfer process (step S3-5) is executed. Next, the control unit 31 of pseudonymization server 30, calculation processing of the challenge code beta _i (step S3-10), executes challenge code β _i, β _i-1 transmission processing (step S3-12). Then, the control unit 21 of the authentication server 20 executes ID identification processing using the challenge code β _i-1 (step S3-13). Thereby, in the authentication server 20, a user can be specified based on the service use history. Further, in the pseudonymization server 30, without informing the pseudonym to the authentication server 20 may be from the authentication server 20 obtains the electronic signature t _i. Then, the control unit 31 of the pseudonymization server 30 executes a process for generating the parameters c _i and the electronic signature s _i (step S3-19). Thereby, the electronic signature s _i that can be verified in the service site server 50 can be generated.

In addition, you may change each said embodiment as follows.
In the first and second embodiments, the control unit 31 of the kana server 30 executes a kana selection screen transmission process (steps S1-15 and S2-15). The terminal control unit 11 of the user terminal 10 performs a pseudonym selection process (steps S1-16 and S2-16). Alternatively, the pseudonymization server 30 may acquire the identification information of the service site server 50 that is the access destination from the user terminal 10 and specify the pseudonym corresponding to this identification information. In this case, in the kana information storage unit 32, the identifier information of the service site server 50 that uses this kana is stored in association with each kana.

  In the second embodiment, the fixed conversion parameter r is stored in the storage unit of the user terminal 10. Here, the fixed conversion parameter r may be encrypted and stored in a plurality of user terminals 10. In this case, a parameter information storage unit is provided for each user terminal 10. And each user terminal 10 synchronizes the fixed conversion parameter r memorize | stored in each parameter information storage part. Here, each user terminal 10 synchronizes all the fixed conversion parameters r so as to be shared in the latest state.

  In the third embodiment, the blind signature is performed using the RSA encryption method. The blind signature method is not limited to these encryption methods. For example, it is possible to use a bilinear pairing cryptosystem.

- In the third embodiment, the control unit 21 of the authentication server 20 executes a process of generating random code x _i (step S3-8). The control unit 31 of the pseudonymization server 30 that has acquired the random code x _i through the user terminal 10 executes a calculation process of the challenge code β _i (step S3-10). Here, in order to reinforce the vulnerability of the blind signature of the RSA encryption method, a further improved RSA encryption method can be used. For example, when the pseudonym server 30 becomes an attacker, a method corresponding to a selected document attack that makes it possible to create a signature for another document desired by the attacker by obtaining a signature for a document selected in advance. It is also possible to use. In this case, the information (attack verification code) for confirming that the selected document attack has not been performed before the pseudonym server 30 obtains the random code x _i for generating the subsequent challenge code β _i. π ′) may be provided to the authentication server 20. Prior to generating an electronic signature using the method disclosed in Non-Patent Document 3, the authentication server 20 verifies the relationship between the attack verification code π ′ and the challenge code, and a selected document attack is performed. Make sure there is no.

In step S3-10 of the third embodiment, when the kana server 30 can selectively select b _i by the received random code x _i , the challenge code β _i can be selected by the kana server 30 There is sex. Therefore, in order to make the selected document attack difficult, the random code b _i is determined by the pseudonym server 30 before the random code x _i is transmitted to the pseudonym server 30. Therefore, the authentication server 20 transmits the attack verification source code π to the pseudonymization server 30 prior to step S3-8. Then, pseudonymization server 30, a random code b _i generated randomly, were calculated from attacks verification element code π and random code b _i attack verification code π'to the authentication server 20. Thereafter, the authentication server 20 generates and transmits a random code x _i in step S3-8. In step S3-13, the authentication server 20 that has received the challenge code beta _i calculates attack verification code π'from challenge code beta _i. Then, the authentication server 20 confirms that the challenge code β _i matches the previously received attack verification code π ′, whereby the challenge code β _i is determined by the pseudonymizing server 30 before the random code x _i is transmitted. It is verified that the code b _i is used. As a result, the pseudonymization server 30 cannot selectively create the challenge code β _i after receiving the random code x _i , so that the authentication server 20 can prevent the selected document attack.

Next, technical ideas that can be grasped from the above-described embodiment and other examples will be described below together with their effects.
(A) a plurality of parameter information storage units, wherein the fixed conversion parameter (r) is encrypted in the parameter information storage unit, and the fixed conversion parameters (r) stored in the plurality of parameter information storage units, respectively; ) To synchronize the pseudonym management system.

  Thereby, even when fixed conversion parameters are distributed and stored in a plurality of parameter information storage units, synchronization can be achieved.

  DESCRIPTION OF SYMBOLS 10 ... User terminal, 11 ... Terminal control part, 111 ... Browser, 20 ... Authentication server, 21 ... Control part, 211 ... Login management part, 212 ... Signature management part, 22 ... User information storage part, 30 ... Kana server DESCRIPTION OF SYMBOLS 31 ... Control part, 311 ... Kana management part, 312 ... Signature management part, 32 ... Kana information storage part, 50 ... Service site server, 51 ... Control part, 52 ... Personal information storage part.

Claims (12)

A parameter information storage unit for storing fixed conversion parameters;
A user information storage unit for storing a pseudonym comprising a character string;
A pseudonym management system including an authentication system and a control unit connected to a service system,
The control unit is
Obtaining a user identifier and a first electronic signature generated using the user identifier from the authentication system;
Identify a pseudonym corresponding to the user identifier;
Corresponding to the pseudonym, a variable conversion parameter used for conversion of the user identifier is specified,
Using the fixed conversion parameter, the variable conversion parameter, and the first electronic signature, generate a converted user identifier from the user identifier and a second electronic signature for the first electronic signature,
The pseudonym management system, wherein the converted user identifier and the second electronic signature are provided to the service system.   The pseudonym management system according to claim 1, wherein a pseudonym associated with the user identifier is output and the pseudonym selected by the user is specified.   The pseudonym management system according to claim 1 or 2, wherein the pseudonym acquired when accessing the service system is specified. A challenge code storage unit for storing a challenge code used at the time of authentication in association with a plurality of user identifiers;
A pseudonym management system including an authentication system and a control unit connected to a service system,
The control unit is
Providing the preceding challenge code used during the previous authentication and the subsequent challenge code used for the current authentication to the authentication system,
Obtaining a blind signature for a subsequent challenge code from the authentication system for a user identified based on the previous challenge code used during previous authentication;
Using the blind signature to generate an electronic signature for the user;
A pseudonym management system that provides an electronic signature to the service system.   The kana management system according to claim 4, wherein the control unit obtains a parameter for generating the subsequent challenge code from the authentication system.   The control unit provides the authentication system with an attack verification code for confirming that a selected document attack is not performed before acquiring a parameter for generating the subsequent challenge code from the authentication system. The kana management system according to claim 4 or 5, characterized by the above-mentioned.   The pseudonym management system according to claim 4, wherein the control unit acquires the user identifier from the service system. The control unit identifies the user identifier based on a pseudonym designated by a user;
The pseudonym management system according to any one of claims 4 to 6, wherein the user identifier is provided to the service system together with the electronic signature. A parameter information storage unit for storing fixed conversion parameters;
A user information storage unit for storing a pseudonym comprising a character string;
A method for managing pseudonyms using a pseudonym management system including an authentication system and a control unit connected to a service system,
The control unit is
Obtaining a user identifier and a first electronic signature generated using the user identifier from the authentication system;
Identify a pseudonym corresponding to the user identifier;
Corresponding to the pseudonym, a variable conversion parameter used for conversion of the user identifier is specified,
Using the fixed conversion parameter, the variable conversion parameter, and the first electronic signature, generate a converted user identifier from the user identifier and a second electronic signature for the first electronic signature,
The pseudonym management method, wherein the converted user identifier and the second electronic signature are provided to the service system. A challenge code storage unit for storing a challenge code used at the time of authentication in association with a plurality of user identifiers;
A method for managing pseudonyms using a pseudonym management system including an authentication system and a control unit connected to a service system,
The control unit is
Providing the preceding challenge code used during the previous authentication and the subsequent challenge code used for the current authentication to the authentication system,
Obtaining a blind signature for a subsequent challenge code from the authentication system for a user identified based on the previous challenge code used during previous authentication;
Using the blind signature to generate an electronic signature for the user;
A pseudonym management method comprising providing an electronic signature to the service system. A parameter information storage unit for storing fixed conversion parameters;
A user information storage unit for storing a pseudonym comprising a character string;
A program for managing pseudonyms using a pseudonym management system comprising a control unit connected to an authentication system and a service system,
The control unit
Obtaining a user identifier and a first electronic signature generated using the user identifier from the authentication system;
Identify a pseudonym corresponding to the user identifier;
Corresponding to the pseudonym, a variable conversion parameter used for conversion of the user identifier is specified,
Using the fixed conversion parameter, the variable conversion parameter, and the first electronic signature, generate a converted user identifier from the user identifier and a second electronic signature for the first electronic signature,
A pseudonym management program that causes the converted user identifier and the second electronic signature to function as means for providing the service system. A challenge code storage unit for storing a challenge code used at the time of authentication in association with a plurality of user identifiers;
A program for managing pseudonyms using a pseudonym management system comprising a control unit connected to an authentication system and a service system,
The control unit
Providing the preceding challenge code used during the previous authentication and the subsequent challenge code used for the current authentication to the authentication system,
Obtaining a blind signature for a subsequent challenge code from the authentication system for a user identified based on the previous challenge code used during previous authentication;
Using the blind signature to generate an electronic signature for the user;
A pseudonym management program that functions as means for providing an electronic signature to the service system.

Images