KR100466827B1 - An Identity Escrow method supporting key recovery - Google Patents

Abstract

An identity consignment method in which an identity can be authenticated to a service provider while providing anonymity for the user's identity in the authentication process between the user and the service provider, in which the user registers his identity with the issuer, and the publisher signs the agent. The information is generated and sent to the user, the user verifies the surrogate signature information, then generates an anonymous authentication information and sends it to the service provider, the service provider verifies the user's anonymous authentication information, and the user uses the service provider's certificate. Generate the agreed session key and common key between the two entities, the service provider performs encrypted communication with the user by using the agreed session key and common key, and the service provider and the law agency This is done by removing the anonymity of your identity. In addition, when encryption communication is performed by performing a key agreement protocol between users using an identity entrusting method, a process of performing key recovery for an encryption key used for encryption communication is additionally performed.

Description

{An Identity Escrow method supporting key recovery}

The present invention is an identity entrusting method that supports key recovery, and more particularly, entrusts an identity of a user to an issuer, generates anonymous authentication information using an issuer's surrogate signature factor, and uses the anonymity of the identity of the user. Providing that the service provider is a legitimate user and providing key agreement between the user and the service provider to maintain the confidentiality and integrity, the contents of the service provider are provided, and if there is an illegal behavior of the user, the identity of the user The present invention relates to an identity entrustment method capable of recovering a key used for encrypted communication when performing encryption communication between two entities using the identity entrustment method.

In the process of providing content to the service provider via the Internet, Joe Kilian et al. Proposed an identity consignment method using a group signature to prove that the user is a legitimate user while providing the anonymity of the user.

Identity referral methods, using group signatures, provide both the issuer and the legal authority to oversee the group as a group manager. Group managers can allow new users to join a group, and can verify messages signed by the group's organizers.

The group manager allows group members to perform group signatures. Group members maintain their anonymity by signing groups to service providers, and service providers verify users' group signatures to ensure that users Prove that you are a member and provide services to the user. In addition, the Group Manager can eliminate the anonymity of a user in case of a signer.

This approach has the problem that the issuer and the law agency are non-independent because the issuer and the law agency are done as a group manager. And, by its nature, law enforcement should only be called upon removing anonymity from a user, which is also called during group initialization.

Lastly, if the user acts illegally, the legal authority and the publisher cannot cooperate to publicly verify that the anonymity of the user can be removed.

In addition, Joe Kilian et al. Proposed an identity referral method using zero-knowledge proof to solve the independence of legal institutions, which is a problem of identity referral method using group signature.

The identity delegation method using zero-knowledge proof eliminated contact with law agencies by using zero-knowledge proof at system initialization. This approach proves that the user has authentication information using the zero-knowledge proof to the service provider in the user authentication phase. At this time, a tracking factor that can remove the anonymity of the user is provided by encrypting it with the public key of the legal authority. In case of emergency, the service provider can remove the anonymity of the user by providing a tracking factor to law enforcement. Thus, legal authorities can be eliminated during system initialization. However, this method has a problem of impersonating a user because the publisher has all the information of the user. In addition, there is a problem that the reliability of the entire system is deteriorated because the legal authority and the issuer cannot cooperate to publicly verify that the anonymity of the user can be removed when the user acts illegally.

An object of the present invention is to provide an identity consignment method that enables a user to prove that he is a legitimate user and use contents while maintaining his anonymity on the Internet.

It is still another object of the present invention to provide a key agreement protocol that can provide confidentiality and integrity of communication data in communication between a user and a service provider on the Internet, and key agreement between users using an identity reconciliation method that supports key recovery. It provides a protocol, and provides key recovery for the encryption key used in the encryption communication performed between the use.

In order to achieve these objects, the present invention provides an identity registration process (A1 to A3) performed by a user and a publisher, and a proxy signature information generation process (B1 to B4) performed by a user and a publisher to provide delegation information to the user. Anonymous authentication information generation processes (C1 to C2) performed by the user and the service provider to verify the validity of the service provider while maintaining the anonymity of the user, and to the user and the service provider to securely receive the contents of the service provider. Key agreement and encryption communication processes (D1 to D2) performed by the user, anonymity removal process (E1 to E2) performed by service providers, legal authorities and issuers to remove anonymity of illegal users, and key recovery. Key agreement and encryption communication process between users using an identity conferencing method (F1 to F2) and the user That of the key made of a key recovery process (G1~G2) to recover the encryption key generated by the agreement features.

1A to 1D are flowcharts illustrating a procedure of an identity delegation method supporting key recovery according to the present invention.

Hereinafter, the present invention will be described with reference to the accompanying drawings. First, the requirements of the identity entrustment method supporting key recovery that can be configured by the present invention will be described.

First, general requirements for identity referral methods

① Authentication that provides anonymity: When performing authentication between a user and a service provider, the user's anonymity should be maintained to the service provider, and the service provider should be able to verify that the user is legitimate while maintaining the user's anonymity.

② Elimination of Anonymity of Illegal Users: In case of illegal activities by users, the legal authorities and issuers should cooperate to remove the anonymity of illegal users.

③ Proof of maintaining confidential information for authentication information: It must not be able to impersonate a third party. That is, only the user should have secret information that can prove that the authentication information belongs to the user.

(4) Independence of the legal body: Communication with the legal body should only be carried out when requested to remove anonymity by illegal users.

⑤ Prevention of illegal anonymization removal: Anonymity removal of users should be possible only with the permission of the legal authority. That is, the issuer or service provider should not be able to remove the anonymity of the user using only authentication information and publicly available information.

Second, requirements for reliability of identity referral method

(6) Disclosure of Anonymity. Public Verifiability: Any participating entity should be able to publicly verify that anonymity of an illegal user can be eliminated in cooperation with law enforcement and issuers.

1A-1D are flow diagrams illustrating the procedure of an identity delegation method that supports key recovery in accordance with the present invention. The identity registration process (A1 to A3) performed by the user and the issuer who wants to greatly entrust the identity, the proxy signature information generation process (B1 to B4) performed by the user and the issuer to provide the delegated information to the user, and Anonymous authentication information generation processes (C1 to C2) performed by the user and the service provider to prove validity to the service provider while maintaining anonymity, and performed by the user and the service provider to securely receive the contents of the service provider. Key agreement and encryption communication processes (D1 to D2), anonymity removal processes (E1 to E2) performed by service providers, law enforcement and issuers to eliminate anonymity of illegal users, and key recovery Key agreement and encryption communication process (F1 to F2) between users who use the identity delegation method, and key agreement between users And a key recovery process (G1 to G2) for recovering the encryption key generated by the process.

In the present invention, in order to prevent the removal of anonymity of an illegal user in order to prevent the illegal removal of anonymity of an illegal user by cooperating with the issuer without going through the legal authority, only the legal authority can access the element. In order to maintain independence, a surrogate signature scheme is applied and the anonymity removal public verification element is disclosed. Anonymity Disclosure By disclosing public verification elements, it ensures the legitimacy and credibility of identity consignment methods that legal authorities and issuers can cooperate to eliminate anonymity of users in case of illegal activities. In addition, confidential information about the user's authentication information is configured to be accessible only to the user, thereby preventing other entities from stealing the user's identity.

Symbols displayed in the present invention are defined as follows.

P: decimal (p ≥512)

Q: decimal (q | p-1)

G: primitive element on Zp with order q

*: User A, User B, Issuer ISS, Service Provider SP, Legal LEA

#: Session key (ssk, seskey), common key (PsK, PuK)

X_ *: * private key

Y_ *: public key of * (Y_ * ≡ g ^{X_ *} mod p)

Cert (*): * public key certificate

E _* (): The ciphertext that encrypts * 's public key, original text can be obtained by decrypting with *' s private key.

Sig _* (): signature signed with * private key, verifiable by * public key and original text

KE _# (): Encryption text encrypted with symmetric key #, original text can be obtained by decrypting with same symmetric key #

S_ *: The only secret value * has (only S_ * ≡ t_ * + t _* )

T_ *, t _* : Random number constituting S_ *

ID _* : Identifier of _*

AID _* : alias alias of *

Identity Information: Information that can prove your identity

Contents: Services provided by the service provider to the user

Σ: surrogate signature information of the signer

H () is a safe one-way hash function. Α ≡ β mod p: expression such as “ α mod p ≡ β mod p”, and for mod p, α and β are mathematical notations.

First, the process of registering the identity by the user and issuer who wants to trust the identity will be described in detail. User A to trust an identity is selected for a random coefficient (t_A and t _A) to generate the public information (g ^t_A) and secret information (S_A) and generate public information (g ^t_A mod p) and the secret information (S_A) And disclose the public information.

S_A = t_A + t _A .............. (A1)

^Encrypts A's identity, g ^S_A mod p and the secret coefficient t _A with the issuer's public key, and t_A and A's identifier ID _A with the public authority's public key to generate coefficients for controlling their identity and anonymity .Sig _A , E _Iss (identity ∥ g ^S_A mod p ∥ t _A ∥ E _LEA (t_A ∥ ID _A )) ............. (A2)

The generated signature is sent to the issuer. The issuer verifies the transmitted signature using user A's public key to obtain E _Iss (identity information ∥ ^{g S_A} mod p ^∥ t _A ), and obtains his private key. utilized to decode the E _Iss (identity ∥g ^S_A mod p∥t _a) to obtain the identity information with ^S_A g mod p and t _a.

The issuer uses the obtained g ^S_A mod p and t _A to verify that user A's referral information is correct. In the verification process, the value calculated using the obtained t _A The result of multiplying g ^t_A published by mod p and A is checked to be equal to the transmitted g ^S_A mod p. If so, it verifies that A's secret information has been correctly entrusted.

g ^S_A ≡ * g ^t_A mod p ....... (A3) Verification that user A's confidential information has been correctly entrusted can be verified by the following process. * g ^t_A mod p≡ ^{+ t_A} mod p≡g ^S_A mod p

In the event of an emergency, we will disclose public information that publicly verifies that the cooperation between the publisher and the law enforcement can eliminate anonymity of the user. At this time, the issuer creates A's pseudonym identifier (AID _A ), and creates and publishes a signature using his private key as follows.

Sig _Iss , AID _A g ^S_A ) ....................... (A4)

The issuer generates surrogate signature information σ that can verify legitimacy with the service provider while maintaining the anonymity of the user. First, random information d is generated, and proxy signature information σ is generated based on this.

D ≡g ^d mod p

σ = X_ISS + d * D ... (B1)

In order to deliver the generated signature information of the issuer to the user, an expression is constructed as follows and transmitted to the user.

E _A (σ ∥ _D ∥ AID _A ∥ Sig _ISS (AID _A ∥ E _LEA (t_A ∥ ID _A )) ...... (B2)

User A decrypts E _A (σ∥D∥AID _A ) with his private key to obtain σ, D and AID _A. Compare the calculated g ^σ mod p and Y_ISS * D ^D mod p with the obtained ^σ . If it is the same, it is verified that it is the correct surrogate signature information.

g ^σ ≡ Y_ISS * D ^D mod p ............... (B3)

Validation of the surrogate signature information can be validated by the following process: Y_ISS * D ^D mod p≡ g ^X_ISS * (g ^d ) ^D mod p≡ g ^{X_ISS + d * D} mod p≡ g ^σ mod p

The user uses the surrogate signature information sent from the issuer to create anonymous authentication information that only the user can generate while maintaining anonymity for the service provider. At this time, the user generates the user anonymous authentication information S _σ (m) using the random information r and the service request message m as follows.

H = h (m)

R ≡ g ^r mod p mod q

S _σ (m) ≡ S_A + r-R * σ * H mod p ... (C1)

The user configures the following information to request authentication from the service provider.

AID _A ∥D ∥R ∥m ∥S _σ (m) ∥Sig _ISS (AID _A ∥E _LEA (t_A ∥ ID _A )) ∥Sig _A (g ^S_A mod p) ... (C2)

The service provider verifies the anonymous authentication information received from the user. At this time, the service provider ^verifies Sig _A (g ^S_A mod p) with user A's public key and obtains g ^S_A mod p. After comparing the obtained g ^S_A mod p and g ^S_A mod p, if the same, verify the user's anonymous authentication information as follows.

H = h (m)

V ≡ Y_ISS * D ^D mod p

R * g ^S_A ≡ g ^{Sσ (m)} * V ^RH mod p mod q ................ (C3) Anonymous authentication information verification is performed through the following process. Can be proved g ^{Sσ (m)} * V ^RH mod p mod q≡ g ^{S_A + r-R * σ * H} * (Y_ISS * D ^D ) ^{R * H} mod p mod q≡ g ^{S_A + r-R * σ * H} * (g ^X_ISS * g ^{d * D} ) ^{R * H} mod p mod q≡ g ^{S_A + r-R * σ * H} * (g ^{X_ISS + d * D} ) ^{R * H} mod p mod q≡ g ^{S_A + r-R * σ * H} * (g ^σ ) ^{R * H} mod p mod q≡ g ^{S_A + r-R * σ * H} * g ^{σ * R * H} mod p mod q≡ g ^{S_A + r-R * σ * H + σ * R * H} mod p mod q≡ g ^{S_A + r} mod p mod q≡ g ^S_A * g ^r mod p mod q≡ g ^S_A * R mod p mod q

In order for the user to securely receive the contents of the service provider, a session key and a common key are generated using the service provider's certificate. At this time, the user A calculates the session key (sk) and the common key (PsK) by using the service provider's public key (Y_SP) and the disposable random number (n ₁ ).

^ssk ≡ (g ^X_SP ) ^S_A mod p

PsK ≡ n ₁ ssk ... (D1)

User A constructs a message and sends it to the service provider as follows.

_{KE ssk (AID A ∥n 1 ∥PsK} ) ∥Sig A (g S_A) ................ (D2)

The service provider verifies the session key and the common key through a message sent from the user. At this time, the service provider generates a session key ( ^ssk ) using Sig _A (g ^S_A ), and calculates a common key (PsK) through the session key.

^ssk ≡ (g ^S_A ) ^X_SP mod p

PsK ≡ n ₁ ssk ... (D3)

The service provider provides the content to the user by using the session key and the common key generated through the key agreement between the user A and the service provider.

KE _PsK (Contents) ∥Cert (SP) ................... (D4)

If user A has done something illegal, the service provider sends the user's anonymity removal factor to the law enforcement agency.

Sig _ISS (AID _A ∥E _LEA (t_A∥ID _A )) ................. (E1)

The legal authority verifies the anonymity removal factor sent to the issuer's public key and obtains AID _A and E _LEA (t_A∥ID _A ). Subsequently, E _LEA (t_A∥ID _A ) is decrypted with its private key to obtain identifier A of user _A and t_A, one of secret information. )

The legal authority calculates the secret information S_A (= t_A + t _A ) by requesting the issuer, t _A , one of the user A's secret information corresponding to ID _A , thereby removing the anonymity of the user A. ........ (E3)

In the identity consignment method, a user generates a common key PuK using a session key seskey and a single-use random number N ₁ using user B's public information for key agreement between user A and user B. .

seskey ≡ (g ^t_B ) ^t_A

PuK ≡ N ₁ seskey ................ (F1)

User A constructs a message and sends it to User B as follows.

KE _seskey , ID _A ∥N ₁ ∥PuK ∥g ^t_A ................... (F2)

User B verifies the session key and the common key through a message sent from user A. At this time, user B generates a session key ^seskey using g ^t_A and calculates a common key PuK using the session key.

seskey ≡ (g ^t_A ) ^t_B

PuK ≡ N ₁ seskey ................ (F3)

User A performs cryptographic communication with User B by using a session key and a common key generated through the key agreement between User A and User B.

_{KE PuK (message) ∥KE seskey (} ID A ∥N 1 ∥PuK) ............... (F4)

When user A and user B lose the common key obtained through the key agreement process during encryption communication, user A (the entity that wants to request key recovery) decrypts the ciphertext to the legal authority. _{Provides the} relevant information necessary for KE _seskey (ID _A ∥ N ₁ ∥ PuK). .............. (G1)

The legal authority requests the issuer for key-related information at the request of User A, and the issuer provides the corresponding information to the legal authority.

E _LEA (t_A∥ID _A ), E _LEA (t_B∥ID _B ) ............... (G2)

The legal agency decrypts the information sent from the issuer using its private key and then calculates the session key using t_A and t_B. The common key (PuK) is recovered by decrypting KE _seskey (ID _A ∥N ₁ ∥PuK) using this session key. .......... (G3)

The legal authority constructs the recovered common key (PuK) as follows and sends it to user A (key recovery requester).

E _{S_A} (Puk∥ID _LEA ) ............... (G4)

User A decrypts its own encrypted message using a common key sent from the law enforcement agency. ............... (G5)

The technical spirit of the present invention has been described above with reference to the accompanying drawings, but this is by way of example only and not by way of limitation. In addition, it is obvious that any person skilled in the art may make various modifications and imitations without departing from the scope of the technical idea of the present invention.

As described above, the present invention eliminates the anonymity of the user in the conventional identity delegation method using the group signature that the service provider can remove the anonymity of the illegal user in cooperation with the issuer without going through a legal agency. Elements are resolved by being configured so that only the legal authority can access them.The legal authority should be called only when the user's anonymity is removed. We do this by making the element public. It also solves the problem of credibility by disclosing the public anonymity elimination problem, which is caused by the fact that legal authorities and issuers cannot cooperate to remove the anonymity of the user in case of illegal behavior. Doing. In addition, the problem of impersonating a user because the issuer has all of the user's information in the conventional trust method using the zero-knowledge proof is solved by having only the secret information for the user's authentication information. Resolve an issue of credibility removal by disclosing anonymity public verification element because the legal authority and the issuer can not openly verify the legitimacy of removing the anonymity of the user in case of illegal behavior by the user. have.

Claims (1)

In a client / server system capable of exchanging digital content through a communication means such as the Internet, it is common in the process of conducting transactions of digital content while authenticating the identity of the client system user while validating the identity of the user of the client system. In an identity escrow method that supports key recovery that can provide key recovery: A first step of generating a secret information by a user of a client system (called a "user") selecting a random coefficient; A second process of generating identity information of users and coefficients for anonymity control using the secret information generated through the first process; A third process of transmitting the cipher text generated through the second process to a system of a trusted authority (referred to as "issuer"); A fourth process of verifying the validity of the coefficient by the publisher who receives the cipher text through the third process; If it is determined that the coefficient received by the fourth process is not a valid coefficient, the user is requested to generate a coefficient for accurate identity and anonymity control. A fifth step of publishing information that can be publicly verified that the issuer and the legal agency can remove the anonymity of the user in cooperation with the validity of the received coefficient, and generating and publishing a pseudonym identifier of the user; A sixth step of generating, by the issuer, proxy signature information that can verify the legitimacy of the service provider while maintaining the anonymity of the user; A seventh step of transmitting the proxy signature information of the issuer generated in the sixth step to the user; An eighth step of verifying the validity of the surrogate signature information by the user who has received the surrogate signature information from the issuer through the seventh process; If the surrogate signature information received as a result of the verification in the eighth step is invalid, the issuer is requested to regenerate the surrogate signature information. A ninth step of generating anonymous authentication information using the surrogate signature information when the surrogate signature information provided from the issuer is valid; 10 steps of transmitting anonymous authentication information of the user generated in the ninth step to a service providing server (called a "service provider"); When the service provider receiving the anonymous authentication information from the user through the tenth step verifies the validity of the anonymous authentication information and requests the user to regenerate the anonymous authentication information when it is determined to be invalid, and is valid anonymous authentication information. An eleventh step of transmitting a certificate according to the verification result information to the user; A twelfth step of generating a session key and a common key using a service provider's certificate in order for a user to securely receive digital content from the service provider; A thirteenth step of transmitting the session key and the common key generated in the twelfth step to a service provider; A fourteenth step of validating each key received by the service provider who has received the session key and the common key from the user through the thirteenth step; If it is determined that the verification by the fourteenth process is invalid, the user is requested to regenerate the session key and the common key. A fifteenth step of providing digital content to a user while providing confidentiality and integrity using the verified session key and the common key when the session key and the common key are verified; If the service provider detects an illegal activity of the user, the service provider transmits the anonymity removal factor of the user to the system of the public authority enforcement agency (called "law agency"); A seventeenth step of extracting the identification information and the secret information of the user by using the anonymity removal factor from the legal authority receiving the user anonymization removal factor from the service provider through the sixteenth step; An eighteenth step of extracting the actual information of the illegal actor by removing the anonymity of the user in cooperation with the issuer in the legal agency; A nineteenth step of generating, by the user A, a session key and a common key by using the public information of the user B for the agreement of the keys between the two users using the identity entrusting method according to the first to fifteenth steps; A twentieth step of transmitting the session key and the common key generated in the nineteenth step to the user B; A twenty-first step of verifying information received by the user B, which has received the session key and the common key from the user A through the twentieth step; A twenty-second step of user A and user B performing secret communication while providing confidentiality and integrity using the session key and the common key verified through the twenty-first step; When the user A and the user B lose the common key generated in the 19th process in the process of performing the 22nd process, the entity which wants to request the key recovery transmits the relevant information necessary to decrypt the ciphertext to the legal authority. The twenty-third process; A twenty-fourth step of requesting the issuer for key-related information from the law agency by using the information provided from the key recovery requester; A twenty-fifth step in which the issuer who is requested to provide key related information through the twenty-fourth step transmits the corresponding information to the law enforcement agency; A twenty-sixth step of restoring the session key and the common key used in the cipher text by the legal authority by using the key-related information of the user received in the twenty-fifth step; A twenty-seventh step of providing the key recovery requester with the common key recovered through the twenty-sixth step; And a twenty-eighth step of recovering important data using the common key transmitted through the twenty-seventh step.