KR102005946B1 - System and method for providng anonymous identity-based signature using homomorphic encryption - Google Patents

Abstract

Disclosed are an anonymous ID-based signature system and method using homomorphic encryption. According to an embodiment of the present invention, the method comprises: a step of allowing an authentication requestor terminal to generate a first homomorphic cryptogram (c=HE(id)) corresponding to an ID of the authentication requester terminal by using a symmetric homomorphic password secret key (hsk) of the authentication requestor terminal; a step of allowing an authentication authority server to generate a second homomorphic cryptogram (c=HE(sk_id)) for the secret key corresponding to the ID by using the first homomorphic cryptogram (C) received from the authentication requestor terminal; and a step of allowing the authentication requestor terminal to receive the second homomorphic cryptogram (C) and obtain the secret key (sk_id) from the received second homomorphic cryptogram (C). According to the present invention, ID-based signatures can be further secured.

Description

Anonymous ID-based Signature System and Method Using Isomorphic Password {SYSTEM AND METHOD FOR PROVIDNG ANONYMOUS IDENTITY-BASED SIGNATURE USING HOMOMORPHIC ENCRYPTION}

Embodiments of the present invention relate to identity based signature techniques.

Identity based signature is a kind of public key signature method that uses user's information as public key. In this case, the information that can be used as the public key should be the only information that is applicable only to the user, such as the user's e-mail address or phone number. The advantage of public key cryptography is that even users who have not previously met and shared keys can communicate securely. However, at this point, a method that allows the counterpart to verify that the public key is really the public key of the user is necessary. The ID-based signature scheme has the advantage that this process is unnecessary because the identity of the other party is used as the public key.

In the ID-based signature scheme, a secret key generator for assigning a secret key corresponding to the user's ID is required, which is generally performed by a trusted CA. However, in this process, since the certification authority knows each user's ID and secret key information, there is a problem that the secret information is centralized compared to the existing public key cryptosystem.

Republic of Korea Patent Publication No. 10-1865703 (2018. 06. 01)

Disclosed embodiments are to provide a technical means for protecting a user's ID information and secret key information from a secret key generator such as a certification authority by applying a symmetric homogeneous encryption technology.

According to an exemplary embodiment, a method performed in a terminal device having one or more processors and a memory storing one or more programs executed by the one or more processors, the authentication requester terminal comprising: Generating a first homomorphic ciphertext (c = HE (id)) corresponding to an ID of the authentication requestor terminal by using a symmetric homologous secret secret key (hsk); In the certification authority server, the second isomorphic ciphertext (C = HE (sk) for the secret key (sk _id ) corresponding to the id (id) using the first isomorphic ciphertext (c) received from the certificate requester terminal. _id )); And receiving, at the authentication requestor terminal, the second isomorphic ciphertext (C) and obtaining the secret key (sk _id ) from the received second isomorphic ciphertext (C).

The ID may be a virtual ID generated by the authentication requester terminal.

The generating of the second isomorphic ciphertext may be configured to generate the second isomorphic ciphertext C from the first isomorphic ciphertext c using an eval algorithm of symmetrical isomorphic encryption.

Generating the first isomorphic cipher text (c) may include generating a random value for generating the secret key; And generating a third homogeneous cipher text (HE) corresponding to the generated random value by using the symmetric homologous secret secret key (hsk).

The generating of the second isomorphic ciphertext C may be configured to generate the second isomorphic ciphertext C = HE (sk _id ) by further considering the third isomorphic ciphertext received from the authentication requestor terminal. have.

According to another exemplary embodiment, an authentication for generating a first isomorphic cipher text (c = HE (id)) corresponding to an ID of the authentication requester terminal using its symmetric isomorphic password secret key (hsk) Requester terminal; And a second isomorphic ciphertext (C = HE (sk _id )) for a secret key (sk _id ) corresponding to the id (id) by using the first isomorphic ciphertext (c) received from the authentication requestor terminal. And a certification authority server for generating, wherein the authentication requester terminal receives the second homomorphic ciphertext (C) from the certification authority server, and receives the secret key (sk _id ) from the received second homogeneous ciphertext (C). An ID based signature system is provided, which obtains a.

The ID may be a virtual ID generated by the authentication requester terminal.

The certification authority server may generate the second isomorphic ciphertext C from the first isomorphic ciphertext c using an eval algorithm of symmetrical homologous cryptography.

The authentication requester terminal generates a random value for generating the secret key and generates a third homogeneous cipher text corresponding to the random value generated by using the symmetric homologous secret key hsk. (random)).

The certification authority server may generate the second isomorphic ciphertext C = HE (sk _id ) by further considering the third isomorphic ciphertext received from the authentication requestor terminal.

According to the disclosed embodiments, it is possible to prevent the ID and the corresponding secret key from being exposed to a key generator such as a certification authority in the process of issuing a key for ID-based signature, thereby further increasing the security of the ID-based signature. Can be.

1 is a block diagram illustrating an ID-based signature system according to an embodiment.
2 is a flowchart illustrating a general ID based signature method.
3 is a flowchart illustrating an ID-based signature method according to an embodiment.
6 is a block diagram illustrating and describing a computing environment 10 that includes a computing device suitable for use in the exemplary embodiments.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to assist in a comprehensive understanding of the methods, devices, and / or systems described herein. However, this is only an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of a user or an operator. Therefore, the definition should be made based on the contents throughout the specification. The terminology used in the description is for the purpose of describing embodiments of the invention only and should not be limiting. Unless explicitly used otherwise, the singular forms “a,” “an,” and “the” include plural forms of meaning. In this description, expressions such as "comprises" or "equipment" are intended to indicate certain features, numbers, steps, actions, elements, portions or combinations thereof, and one or more than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, actions, elements, portions or combinations thereof.

1 is a block diagram illustrating an ID-based signature system 100 according to an embodiment. As shown, the ID-based signature system 100 according to one embodiment includes a Certificate Authority 102, a Certificate Requestor 104, and a Verifier 106.

The certificate authority 102 is a key generation server that receives the id of the requestor 104 and generates a secret key sk _id therefrom. The ID is unique information corresponding only to the user, such as the e-mail address or phone number of the requestor 104.

The requestor 104 is a terminal that generates a signature value σ for the message m using the secret key sk _id received from the certificate authority 102. The requestor 104 then sends the signature value σ to the verifier 106 to request authentication.

Finally, the verifier 106 is a terminal that performs authentication on the requestor 104 by verifying the signature value σ received from the requestor 104.

2 is a flowchart illustrating a general ID based signature method 200. Identity-based signatures consist of four algorithms: setup, keygen, sign, and verify.

In step 202, the certification authority 102 generates a master secret key msk and a corresponding public key pp from the security parameter k using the setup algorithm. This is expressed as a formula as follows.

(msk, pp) ← setup (1 ^k )

In step 204, the requestor 104 sends its ID to the certificate authority.

In step 206, the certification authority 102 generates a corresponding secret key sk _id from the id of the requestor 104. In detail, the certification authority 102 generates a secret key corresponding to the id by inputting the id and the master secret key to the keygen algorithm. This is expressed as a formula as follows.

sk _id ← keygen (msk, id)

In step 208, the requestor 104 signs the message m using the secret key (sk _id ) and sign algorithm issued from the certificate authority 102 to generate a signature value σ. This is expressed as a formula as follows.

σ ← sign (sk _id , m)

In step 210, the verifier 106 verifies the signature value σ received from the requestor 104. Specifically, the verifier 106 inputs the public key (pp), the original message (m), and the signature value (σ) verify algorithm of the certification authority 102 to output a verification result. For example, the verifier 106 can return 1 if the signature is valid, or 0 as the verification result. This is expressed as a formula as follows.

verify (pp, m, σ) → 1 or 0

As can be seen in the flowchart, the ID-based signature method involves generating a secret key corresponding to the ID through the certification authority 102. In this process, the certification authority 102 can know the information of all users' IDs and corresponding secret key pairs using the ID-based signature, so that sensitive personal information is concentrated on the central certification authority 102. Occurs. In order to solve this problem, an embodiment of the present invention uses a symmetric homologous cryptography technique.

Symmetric Homomorphic Encryption (HE) includes four algorithms including KGen, Enc, Dec, and Eval.

KGen algorithm is an algorithm for generating a secret key (sk) and public parameters (params) by receiving a security parameter k. Among these, the secret key sk is shared and kept secret by the sender and the receiver, and public parameters are disclosed. This is expressed as a formula as follows.

(sk, params) ← KGen (1 ^k )

Enc (sk, m) algorithm is an algorithm executed by the sender (encryptor), receives the secret key (b) and the message (m) to be encrypted, and outputs the cipher text (c) for m.

The Dec (sk, c) algorithm is an algorithm executed by the receiver, and receives the secret key (b) and the cipher text (c) and outputs the decrypted plain text message (m).

Eval (f, params, c ₁ , ..., c _n ): Outputs ciphertext C by applying the function f to ciphertext c ₁ , ..., c _n . If c ₁ , ..., c _n is a ciphertext of m ₁ , ..., m _n , C becomes a ciphertext of f (m ₁ , ..., m _n ).

3 is a flowchart illustrating an ID-based signature method 300 according to an embodiment. The illustrated flow diagram may be performed by the Certificate Authority 102, the certificate requestor 104, and the verifier 106 described above. In the illustrated flow chart, the method is divided into a plurality of steps, but at least some of the steps may be performed in a reverse order, in combination with other steps, omitted, divided into substeps, or not shown. One or more steps may be added and performed.

The ID-based signature method 300 illustrated in FIG. 3 is an anonymous (or anonymous ID, or pseudonym) -based signature method (HE-IBS) using an isomorphic password, and includes setup, HESetup, CAKGen, UserKGen, sign, and verify. It consists of six algorithms.

In step 302, the certification authority 102 generates a master secret key msk and a corresponding public key pp from the security parameter k using the setup algorithm. This is expressed as a formula as follows.

(msk, pp) ← setup (1 ^k )

In step 304, the requestor 104 generates a homologous secret key hsk and a public parameter params from the security parameter k using the HESetup algorithm. That is, the HESetup algorithm is the same as the KGen algorithm of the symmetric homogeneous cryptography method. This is expressed as a formula as follows.

(hsk, params) ← HEsetup (1 ^k )

In step 306, the requestor 104 uses the homologous secret key (hsk) generated in the step 304 and the Enc algorithm of the symmetric homologous cryptography method, and the first homologous cipher text (c =) corresponding to its ID. HE (id)) This is expressed as a formula as follows.

C = HE (id) ← Enc (hsk, id)

In one embodiment, the ID (id) of the requestor 104 is a virtual ID (pseudonym), which is a random value generated by the authentication requestor terminal, not information that can be identified by itself, such as an email address or a telephone number. Can be. Accordingly, even if the certification authority 102 obtains an unencrypted ID, it is impossible to identify the requestor 104 corresponding to the ID.

In step 308, the certification authority 102 uses the first homogeneous cipher text c and the CAKGen algorithm received from the requestor 104 to generate a second key for the secret key (sk _id ) corresponding to the id (id). Generate an isomorphic ciphertext (C = HE (sk _id )). This is expressed as a formula as follows.

HE (skid) ← CAKGen (msk, c, params)

In one embodiment, CAKGen algorithm second homozygous ciphertext for by using the eval algorithm symmetric homozygous cryptography method, the first homozygous ciphertext (c) straight secret key (sk _id) without having to extract the id in corresponding to the id ( C = HE (sk _id )). Specifically, assuming that f is a keygen algorithm in the eval algorithm, the following relationship holds.

Eval (keygen (msk, HE (id)), params) = HE (sk _id )

As such, when the eval symmetric homologous cipher is used, the only information that can be known from the certification authority 102 is the homologous ciphertext (HE (id)) of the id and the homogeneous ciphertext (HE (sk _id )) of the secret key. ) Does not know the actual value of the ID and secret key. Therefore, according to the embodiment of the present invention, it is possible to block the ID and secret key from being exposed to the certification authority 102.

In step 310, the requestor 104 receives the second isomorphic ciphertext (C) and obtains a secret key (sk _id ) from the received second isomorphic ciphertext (C). Specifically, the requestor 104 may obtain sk _id by decoding the HE (sk _id ) using the UserKGen algorithm. This is expressed as a formula as follows.

Sk _id ← UserKGen (hsk, params, C = HE (sk _id ))

In step 312, the requestor 104 generates a signature value σ by signing the message m using the secret key (sk _id ) and the sign algorithm obtained in step 310. This is expressed as a formula as follows.

σ ← sign (sk _id , m)

In step 314, the verifier 106 verifies the signature value σ received from the requestor 104. Specifically, the verifier 106 inputs the public key (pp), the original message (m), and the signature value (σ) verify algorithm of the certification authority 102 to output a verification result (1 or 0). This is expressed as a formula as follows.

verify (pp, m, σ) → 1 or 0

On the other hand, according to the above method, since the certification authority 102 cannot know the actual value of the received ID, it cannot know which ID the private key has issued. However, since the certification authority 102 has a secret key generation algorithm (keygen), when the identity is later known, the secret authority 102 may generate a secret key corresponding to the id using the keygen algorithm.

To compensate for this, in one embodiment, the requestor 104 directly selects a random value for generating the secret key, and selects a third isotype ciphertext (HE) corresponding to the selected random value. Can be generated and sent to certificate authority 102. Then, the receiving authority 102 may generate a secret key (sk _id ) by additionally applying the received homogeneous ciphertext of the random value to the keygen function. This is expressed as a formula as follows.

Eval (keygen (msk, HE (id), HE (random)), params) = HE (sk _id )

As such, when the requestor 104 directly determines the random value for generating the secret key, even if the certificate authority 102 later acquires the ID of the requester 104, the random value used for generating the secret key is still unknown. You will not be able to create a private key for.

4 is a block diagram illustrating and describing a computing environment 10 that includes a computing device suitable for use in example embodiments. In the illustrated embodiment, each component may have different functions and capabilities in addition to those described below, and may include additional components in addition to those described below.

The illustrated computing environment 10 includes a computing device 12. In one embodiment, computing device 12 may be a certification authority 102, a certificate requestor 104, and a verifier 106 in accordance with embodiments of the present invention. Computing device 12 includes at least one processor 14, computer readable storage medium 16, and communication bus 18. The processor 14 may cause the computing device 12 to operate according to the example embodiments mentioned above. For example, processor 14 may execute one or more programs stored in computer readable storage medium 16. The one or more programs may include one or more computer executable instructions that, when executed by the processor 14, cause the computing device 12 to perform operations in accordance with an exemplary embodiment. Can be.

Computer readable storage medium 16 is configured to store computer executable instructions or program code, program data and / or other suitable forms of information. The program 20 stored in the computer readable storage medium 16 includes a set of instructions executable by the processor 14. In one embodiment, computer readable storage medium 16 includes memory (volatile memory, such as random access memory, nonvolatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash Memory devices, or any other form of storage medium that is accessible by computing device 12 and capable of storing desired information, or a suitable combination thereof.

The communication bus 18 interconnects various other components of the computing device 12, including the processor 14 and the computer readable storage medium 16.

Computing device 12 may also include one or more input / output interfaces 22 and one or more network communication interfaces 26 that provide an interface for one or more input / output devices 24. The input / output interface 22 and the network communication interface 26 are connected to the communication bus 18. The input / output device 24 may be connected to other components of the computing device 12 via the input / output interface 22. Exemplary input / output devices 24 may include pointing devices (such as a mouse or trackpad), keyboards, touch input devices (such as touchpads or touchscreens), voice or sound input devices, various types of sensor devices, and / or imaging devices. Input devices, and / or output devices such as display devices, printers, speakers, and / or network cards. The example input / output device 24 may be included inside the computing device 12 as one component of the computing device 12, and may be connected to the computing device 102 as a separate device from the computing device 12. It may be.

Meanwhile, an embodiment of the present invention may include a program for performing the methods described herein on a computer, and a computer readable recording medium including the program. The computer-readable recording medium may include program instructions, local data files, local data structures, etc. alone or in combination. The media may be those specially designed and constructed for the purposes of the present invention, or those conventionally available in the field of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical recording media such as CD-ROMs, DVDs, and specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Hardware devices are included. Examples of such programs may include high-level language code that can be executed by a computer using an interpreter as well as machine code such as produced by a compiler.

While the exemplary embodiments of the present invention have been described in detail above, those skilled in the art will appreciate that various modifications can be made to the above-described embodiments without departing from the scope of the present invention. . Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined by the claims below and equivalents thereof.

100: ID based signature system
102: certification authority
104: certificate requester
106: Verifier

Claims (10)

One or more processors, and
A method performed in a terminal device having a memory for storing one or more programs executed by the one or more processors, the method comprising:
Generating, at the authentication requester terminal, a first homomorphic cipher text (c = HE (id)) corresponding to an ID of the authentication requestor terminal by using a symmetric homologous password secret key (hsk) of the authentication requestor terminal. ;
In the certification authority server, the second isomorphic ciphertext (C = HE (sk) for the secret key (sk _id ) corresponding to the id (id) using the first isomorphic ciphertext (c) received from the certificate requester terminal. _id )); And
Receiving, at the authentication requester terminal, the second homomorphic ciphertext (C) and obtaining the secret key (sk _id ) from the received second homogeneous ciphertext (C),
Generating the first isomorphic cipher text (c),
Generating a random value for generating the secret key; And
Generating a third homomorphic ciphertext (HE) corresponding to the random value generated using the symmetric homologous secret secret key (hsk).
The method according to claim 1,
The ID is a virtual ID (pseudonym) generated by the authentication requestor terminal.
The method according to claim 1,
The generating of the second isomorphic ciphertext comprises: generating the second isomorphic ciphertext (C) from the first isomorphic ciphertext (c) using an eval algorithm of symmetrical isomorphic encryption.
delete The method according to claim 1,
Generating the second isomorphic ciphertext (C) is configured to generate the second isomorphic ciphertext (C = HE (sk _id )) by further considering the third isomorphic ciphertext received from the authentication requestor terminal. Way.
An authentication requester terminal for generating a first homogeneous cipher text (c = HE (id)) corresponding to an ID of the authentication requester terminal by using its symmetric homologous password secret key hsk; And
By using the first isotype cipher text (c) received from the authentication requester terminal, a second isotype cipher text (C = HE (sk _id )) for the secret key (sk _id ) corresponding to the _id ( _id ) is generated. Includes a certification authority server,
The authentication requester terminal generates a random value for generating the secret key and generates a third homogeneous cipher text corresponding to the random value generated by using the symmetric homologous secret key hsk. (random), receiving the second homogeneous ciphertext (C) from the certification authority server, and obtaining the secret key (sk _id ) from the received second homogeneous ciphertext (C). system.
The method according to claim 6,
The ID (id) is a virtual ID (pseudonym) generated by the authentication requester terminal, ID based signature system.
The method according to claim 6,
The certification authority server,
And generating the second isomorphic ciphertext (C) from the first isomorphic ciphertext (c) using an eval algorithm of symmetric isomorphic cryptography.
delete The method according to claim 6,
The certification authority server,
And generating the second isomorphic ciphertext (C = HE (sk _id )) by further considering the third isomorphic cipher text received from the authentication requestor terminal.

Images