WO2010013571A2

WO2010013571A2 - Group signature system and method

Info

Publication number: WO2010013571A2
Application number: PCT/JP2009/061915
Authority: WO
Inventors: 古川　潤
Original assignee: 日本電気株式会社
Priority date: 2008-07-28
Filing date: 2009-06-30
Publication date: 2010-02-04
Also published as: JP2011233943A

Description

Group signature system and method

The present invention relates to a group signature system and method, and more particularly to a technique for identifying a signer.

As a group signature technique using a bilinear map related to the present invention, there is a group signature described in Non-Patent Document 1. An outline of the group signature will be described below with reference to FIG. FIG. 1 shows the overall configuration of the group signature system 1000.

Suppose that the group secret key 1007 is an element γ of a field Z / pZ randomly selected with p being a prime number.

The group public key 1001 is
Prime number p,
Group 1 and group 2 and group T with order p, bilinear mapping e from group 1 and group 2 to group T, isomorphic mapping φ from group 2 to group 1, and a character string (Z / pZ) a string describing the hash function Hash that maps to
The generator G _{2 of} group 2, and
φ and (G ₂₎ = generators G ₁ in G ₁ the group consisting 1,
Randomly selected group 1 former H,
It is assumed that W = [γ] G ₂ .

However, W is γ double point of G _2.

The tracking secret key 1018 is assumed to be composed of two points ξ ₁ and ξ ₂ on a randomly selected field Z / pZ.

The tracking public key 1002 is assumed to be composed of two points on the group 2 that satisfy [ξ ₁ ] U = [ξ ₂ ] V = H.

Suppose that the member private key 1009 is a point x on a randomly selected field Z / pZ.

Member certificate 1008 has a point y on a randomly chosen body Z / pZ, and
And A satisfying A = [1 / (γ + y)] ([1-x] G ₁ ). The member secret key 1009 and the member certificate 1008 are generated by the member certificate-member secret key generation device 1005.

Hereinafter, the group signature device 1013 will be described.

The group signature device 1013 receives a message 1012 to be signed, a group public key 1001, a tracking public key 1002, a member secret key 1009, a member certificate 1008, and a random number.

The group signature device 1013 randomly selects α and β, which are points on Z / pZ, using the input random number. After that, the group signature device 1013 constitutes the ciphertext 1020 of the member evidence,
T ₁ = [α] U,
T ₂ = [β] V, and
T ₃ = [α + β] H + A
Is generated.

The group signature apparatus 1013 further uses the input random numbers to randomly generate points α ′, β ′, δ ′ ₁ , δ ′ _2, and y ′ that are points on Z / pZ.
Select. The group signature device 1013 then constitutes a commitment,
R ₁ = [α '] U,
R ₂ = [β '] V,
R ₃ = e (T ₃ , G ₂ ) ^ (x ') · e (H, W) ^ (-α'-β') · e (H, G ₂ ) ^ (-δ ' ₁ -δ' ₂ ) ・ E (H, G ₂ ) ^ (y '),
R ₄ = [x '] T ₁ -[\ delta' ₁ ] U, and
R ₅ = [x '] T ₂ -[\ delta' ₂ ] V
Is generated. Here, the symbol “^” means power residue.

The group signature device 1013 includes a group public key 1001, a tracking public key 1002, a message 1012, U, V, T ₁ , T ₂ , T ₃ , R ₁ , R ₂ , R ₃ , R ₄ and R _5. And generate a hash value. The group signature device 1013 sets this hash value as the challenge value c.

The group signature device 1013 constitutes a response,
s _α = α '+ c α,
s _β = β '+ c β,
s _x = x '+ c x,
s _δ1 = δ ' ₁ + c xα,
s _δ2 = δ ' ₂ + c xβ, and
s _y = y '+ x y
Is generated.

The group signature device 1013
T ₁ , T ₂ , T ₃ , c, s _α , s _β , s _x , s _δ1 , s _δ2 , and s _y
Is output as a group signature 1014 for m which is the message 1012.

Hereinafter, the group signature verification apparatus 1015 will be described.

In the group signature verification apparatus 1015, a signed message 1012, a group public key 1001, and a tracking public key 1002 are input.

Group signature verification device 1015
R ₁ = [s _α ] U-[c] T ₁ ,
R ₂ = [s _β ] V-[c] T ₂ ,
R ₃ = e (T ₃ , G ₂ ) ^ (s _x ) ・ e (H, W) ^ (-s _α -s _β ) ・ e (H, G ₂ ) ^ (-s _δ1 -s _δ2 ) ・e (H, G ₂ ) ^ (s _y ) (e (G ₁ , G ₂ ) / e (T ₃ , W)) ^ (-c),
R ₄ = [s _x ] T _1- [s _δ1 ] U, and
R ₅ = [s _x ] T _2- [s _δ2 ] U
Is generated.

Subsequently, the group signature verification device 1015 includes a group public key 1001, a tracking public key 1002, a signed message 1012, U, V, T1, T2, T3, R1, R2, R3, R4, and R5. And generate a hash value. The group signature verification device 1015 confirms whether this hash value matches the challenge value c. The group signature verification apparatus 1015 determines that the group signature is valid if they match, and determines that the group signature is invalid if they do not match.

Hereinafter, the tracking device 1017 will be described.

The tracking device 1017 receives a group signature 1014 including a ciphertext 1020 of member evidence and a tracking private key 1018.

The tracking device 1017 calculates member evidence 1019, A = T ₃ − [ξ ₁ ] T ₁ − [ξ ₂ ] T ₂ .

The tracking device 1017 identifies a user who has A as member evidence 1019 in the member certificate as an unauthorized person.

When tracking unauthorized persons using related technology, the value A must be decrypted from the signature using the tracking private key, and the corresponding person must be found. This correspondence can be known only by the person who created the member certificate. Therefore, in order for a person other than the person who created the member certificate (hereinafter referred to as “tracker”) to track, the tracker asks the person who created the member certificate about the correspondence, or the member's action It is necessary to obtain a table in advance. In the former method, the person who created the member certificate needs to be involved in tracking all unauthorized persons. For this reason, in a large system, the burden on the person who created the member certificate increases. In the latter method, members belonging to the group are disclosed. For this reason, in a group having many group members who do not like this, it becomes a problem that members belonging to the group are disclosed.

That is, there is a problem that the member identifier cannot be extracted directly from the group signature by the unauthorized person tracking device without using the member list or the like.

Therefore, in view of the above circumstances, an object of the present invention is to obtain a group signature that can be verified easily.

In order to achieve the above object, the present invention has the following configuration.

A group signature system according to the present invention is a group signature system having a member certificate acquisition device, a member certificate issuing device, and a group signature device, wherein the member certificate acquisition device includes an identifier of a signer A member evidence generating unit that generates a member evidence including a signature based on a member private key that is a signature private key, and a member including the member evidence when the signature is confirmed to be valid A member certificate verification unit that outputs a certificate, wherein the member certificate issuing device includes a public key list that is a list of a member public key corresponding to the member private key and the identifier, and the member evidence A signature verification unit that confirms that the signature is valid, the group signature device includes a group public key, a tracking public key, and the And Nba secret key, and the member certificate, on the basis of, and outputs a group signature that contains the encrypted text of the signature.

The group signature method according to the present invention generates member evidence including an identifier of a signer and a signature based on a member private key that is a private key for signing, a member public key corresponding to the member private key, Based on the public key list, which is a list of pairs with identifiers, and the member evidence, the signature is confirmed to be valid, and the member evidence is confirmed when the signature is confirmed to be valid. And a group signature including the ciphertext of the signature based on the group public key, the tracking public key, the member private key, and the member certificate.

According to the present invention, it is possible to obtain a group signature that can be easily verified for validity.

It is a figure for demonstrating the related technique of a group signature. It is a block diagram which shows the whole structure of embodiment of this invention. It is a block diagram which shows the function structure of the member certificate acquisition apparatus which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the member certificate issuing apparatus which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the group signature apparatus which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the group signature verification apparatus which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the tracking apparatus which concerns on embodiment of this invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

In the following embodiment, the ciphertext of the identifier of the group signature member is made a part of the group signature, and the unauthorized person tracking device extracts the unauthorized person identifier by directly decrypting it.

FIG. 2 shows the overall configuration of this embodiment. 2, the group signature system 600 includes a member certificate acquisition device 100, a member certificate issuing device 200, a group signature device 300, a group signature verification device 400, and a tracking device 500. In FIG. 2, a block enclosed by a rectangle indicates information that is input or output, and a block enclosed by a rounded rectangle indicates each device or means. Next, definitions of symbols and the like used in the following description will be described.

Suppose that p is a prime number.

Suppose that each of group 1, group 2, and group T is a group of order p.

Suppose that there is a bilinear mapping e from the set of group 1 and group 2 to group T.

Group 1, Group 2, and Group T are groups that are difficult to solve the Diffie-Hellman discrimination problem. In particular, in order for this problem to be difficult on group 1 and group 2, it is necessary that it is difficult to calculate isomorphisms from group 1 to group 2 and vice versa.

Suppose that the public key list includes the identifier of the owner of the public key and the set of the public key.

Suppose the hash function Hash is a hash function that maps a character string to a field (Z / pZ).

Suppose that g is a generator of group 1, G is a generator of group 2, and Γ is a generator of group T.

Φ and ψ are Z / pZ elements selected at random, and f and h are generators of group 1 selected at random.

π is a randomly chosen encryption function, π ^-1 is a decryption function,
Y = G _φ , Z = G _ψ is generated, the group secret key is (φ, ψ), and the group public key is (group 1, group 2, group T, p, e, g, G, Hash, π , Y, Z, f, h).

Ξ and ζ that are the elements of Z / pZ are randomly selected, r = h ^ξ and t = h ^ζ are generated, the tracking secret key is (ξ, ζ), and the tracking public key is (r, t) Suppose that

<Member certificate acquisition device 100>
Referring to FIG. 3, the functional configuration of the member certificate acquisition apparatus 100 is shown. The member certificate acquisition apparatus 100 includes a member evidence generation unit 103, a signature unit 108, a knowledge proof unit 113, and a member certificate verification unit 117. As the member certificate acquisition apparatus 100, for example, an information processing apparatus such as a computer including a communication device, an input / output device, an arithmetic device (CPU or the like), and a storage device (memory or the like) can be used. Each of the above-described units can be realized by cooperation between a software program that uses these hardware and the hardware.

The member evidence generation unit 103 can be generally called member evidence generation means. Signature section 108 can be generally referred to as signature means. Knowledge proof unit 113 can be generally referred to as knowledge proof means. Member certificate verification unit 117 can generally be referred to as member certificate verification means.

The group public key 101, the identifier 105 (ID), and the random number 102 are input to the member certificate acquisition apparatus 100.

Using the input random number 102, the member evidence creation unit 103 randomly selects χ and ω ′, which are the member secret keys 107, from (Z / pZ). Further, the member evidence creating unit 103 generates q = ^fχ as the secret key knowledge 104. The signature unit 108 generates σ, z = q h ^{ω ′} as the signature 109 of the person holding the ID that is the identifier 105 for q. These (ID, q, σ) are called member evidence 112. The member certificate obtaining apparatus 100 sends member evidence (ID, q, σ) to the member certificate issuing apparatus 200.

The knowledge proof part 113 has two types as follows:
The knowledge of (χ, ω ′) that satisfies q = f ^χ , z / q = h ^{ω ′} is proved to the member certificate issuing device 200.
[Begin procedure]
The knowledge proof part 113 randomly selects χ ', ω [1] from (Z / pZ) from the input random number, and generates q' = f ^{χ '} , z' = h ^{ω [2]} as a commitment The commitment is sent to the member certificate issuing device 200.

The knowledge proof unit 113 waits for a challenge value c, which is the source of Z / pZ, to be sent from the member certificate issuing device 200.

When the knowledge proof unit 113 receives the challenge value c, the response χ ″ = cχ + χ ′, ω [3] = cω [1] + ω [2],
And the calculation result (response) is sent to the member certificate issuing device.
[End of procedure]
The member certificate verification unit 117 waits for (a, α, β, ω ″), which is the member certificate source 116, to be sent from the member certificate issuing device 200.

If the member certificate verification unit 117 receives the above value,
ω = ω '+ ω'', b = π (ID, σ),
Calculate Thereafter, the member certificate verification unit 117
e (a, Y G ^α ) e (b, Z G ^β ) e (f _χ , G) e (h _ω , G) = e (g, G)
Confirm that Thereafter, the member certificate verification unit 117
(a, α, b, β, χ, ω) as member certificate 119,
χ is output as the member secret key 118.

Here, π ^-1 (b) = (ID, σ) can be decrypted from b, and q can be restored from q = f ^χ and the member certificate. Therefore, it can be said that the member certificate 119 includes the member evidence 112. .

<Member certificate issuing device 200>
Referring to FIG. 4, the functional configuration of the member certificate issuing device 200 is shown. The member certificate issuing device 200 includes a signature verification unit 208, a knowledge verification unit 209, and a member certificate source generation unit 211. As the member certificate issuing device 200, for example, an information processing device such as a computer having a communication device, an input / output device, a computing device (CPU or the like), and a storage device (memory or the like) can be used. Each of the above-described units can be realized by cooperation between a software program that uses these hardware and the hardware.

The signature verification unit 208 can be generally called signature verification means. Knowledge verification unit 209 can be generally referred to as knowledge verification means. Member certificate source generation unit 211 can be generally referred to as member certificate source generation means.

The member certificate issuing device 200 receives a group public key 101, a group secret key 210, a random number 201, a public key list 202, and a member list 203.

The signature verification unit 208 waits for the member evidence (ID, q, σ) 112 to be sent from the member certificate acquisition apparatus 100.

The signature verification unit 208 uses the public key list 202 to confirm that the signature 109 σ is a legitimate signature of the ID for q that is the secret key knowledge 104.

The knowledge verification unit 209 performs the following two procedures,
It is verified that the member certificate acquisition apparatus 100 holds knowledge of (χ, ω ′) satisfying q = f ^χ , z / q = h ^{ω ′} .
[Begin procedure]
The knowledge verification unit 209 waits for the commitment (q ′, z ′) to be sent from the member certificate acquisition device 100.

If the commitment (q ', z') is sent, the knowledge verification unit 209 selects the challenge value c randomly from (Z / pZ) from the input random number, and the challenge value c is a member certificate. Send to acquisition device 100.

The knowledge verification unit 209 waits for a response (χ ″, ω [3]) to be sent from the member certificate acquisition apparatus 100.

If the response (χ ″, ω [3]) is sent, the knowledge verification unit 209
g _{χ ''} = q _c q ', h _{ω [3]} = (z / q) _c z'
Confirm that
[End of procedure]
The member certificate source generation unit 211 selects α, β, ω '' that is an element of Z / pZ from the input random numbers, and a = (g f ^-1 h-ω ^'' π (ID, σ) ^{ψ + β} ) ^{φ + α}
And (a, α, β, ω ″) is sent to the member certificate acquisition apparatus 100 as the member certificate source 212.

Also, the member certificate issuing device 200 adds the identifier ID to the member list and outputs the member list 203.

<Group signature device 300>
Referring to FIG. 5, the functional configuration of the group signature device 300 is shown. The group signature device 300 includes an encryption unit 303 and a knowledge proof sentence generation unit 308. As the group signature apparatus 300, for example, an information processing apparatus such as a computer including a communication device, an input / output device, an arithmetic device (CPU or the like), and a storage device (memory or the like) can be used. Each of the above-described units can be realized by cooperation between a software program that uses these hardware and the hardware.

The encryption unit 303 can generally be called encryption means. Knowledge proof sentence generator 308 can generally be referred to as knowledge proof sentence generation means.

The group signature device 300 includes a group public key 101 (group 1, group 2, group T, p, e, g, G, Hash, π, Y, Z, f, h), and a tracking public key 301. A certain (r, t), a member certificate 119 (a, α, b, β, χ, ω), a member secret key 118 χ, a message 302 m, and a random number 303 are input.

The encryption unit 303 randomly selects ρ, τ, θ from the field Z / pZ,
(V ′, m ′, n ′) = (f ^χ h ^τ , r ^τ , t ^τ ), which is a ciphertext 304 of the secret key knowledge related to the secret key knowledge 104,
(V, m, n) = (b h ^ρ , r ^ρ , t ^ρ ), which is the ciphertext 305 of the signature related to the signature 109 with respect to the secret key knowledge 104,
U = a h ^θ, which is a partial commitment of the member certificate
Is generated.

The knowledge certificate generator 308 performs the following processing.

The following processing is the following formula
(v, m, n) = (b h ^ρ , r ^ρ , t ^ρ ),
(v ', m', n ') = (f ^χ h ^τ , r ^τ , t ^τ ), and
e (g, G) e (u, Y) ^-1 e (v, Z) ^-1 = e (f, G) ^χ e (u, G) ^α e (v, G) ^β e (h, Y) ^-θ e (h, Z) ^-ρ e (h, G) ^ω
Is a proof of knowledge that satisfies (χ, α, β, θ, ρ, τ, ω).
[Begin generating proof of knowledge]
The knowledge proof generation unit 308 uses a commitment generation unit (not shown),
From the field Z / pZ, ρ ', τ', θ ', χ', α ', β', ω 'are randomly selected,
Δ = e (f, G) ^{χ '} e (u, G) ^α' e (v, G) ^{β '} e (h, Y) ^-θ' e (h, Z) ^{-ρ '} e (h, G) ^{ω '}
m _* = r ^{ρ '}
n _* = t ^{ρ '}
v ' _* = f ^χ' h ^{τ '}
m ' _* = r ^τ'
n ' _* = t ^τ'
Is generated.

The knowledge proof generation unit 308 has (Δ, m _* , n _* , v ′ _* , m ′ _* , n ′ _* ) as a commitment.

The knowledge proof sentence generation unit 308 uses a challenge value generation unit (not shown) to obtain a challenge value.
c = Hash (p, g, G, π, Y, Z, f, h, r, t, v, m, n, v ', m', n ', u, Δ, m _* , n _* , v ' _* , M' _* , n ' _* , m)
Is generated.

The knowledge proof generation unit 308 uses a response generation unit (not shown),
χ '' = χc + χ ', α''= αc + α', β '' = βc + β ', θ''= θc + θ', ρ '' = ρc + ρ ', τ''= τc + τ ', ω''= ωc + ω'
Is generated.

The knowledge proof generation unit 308 uses (χ ″, α ″, β ″, θ ″, ρ ″, τ ″, ω ″) as a response.

The knowledge proof sentence generation unit 308 sets the commitment and response as fsp which is the knowledge proof sentence 309.
[End of knowledge proof generation]
The group signature device 300 outputs (v, m, n, v ′, m ′, n ′, u, fsp) as a group signature 313 for m that is the message 302.

<Group signature verification device 400>
Referring to FIG. 6, the functional configuration of the group signature verification apparatus 400 is shown. The group signature verification apparatus 400 includes a knowledge verification unit 401 and a challenge value generation unit 402. As the group signature verification apparatus 400, for example, an information processing apparatus such as a computer including a communication device, an input / output device, an arithmetic device (CPU or the like), and a storage device (memory or the like) can be used. Each of the above-described units can be realized by cooperation between a software program that uses these hardware and the hardware.

The group signature verification apparatus 400 includes a group public key 101 (group 1, group 2, group T, p, e, g, G, Hash, π, Y, Z, f, h), and a tracking public key 301. A message (r, t), m, which is a message 302, and (v, m, n, v ′, m ′, n ′, u, fsp), which are group signatures 313, are input.

However, fsp = (Δ, m _* , n _* , v ' _* , m' _* , n ' _* , χ'',α'',β'',θ'',ρ'',τ'', ω '').

The group signature 313 includes (v ′, m ′, n ′) = (f ^χ h ^τ , r ^τ , t ^τ ) that is the secret key knowledge ciphertext 304 and the signature ciphertext for the secret key knowledge. 307 (v, m, n) = (bh ^ρ , r ^ρ , t ^ρ ) is included.

The knowledge verification unit 401 can generally be referred to as knowledge verification means. Challenge value generation unit 402 can be generally referred to as challenge value generation means.

The knowledge verification unit 401 uses the challenge value generation unit 402 to
c = Hash (p, g, G, π, Y, Z, f, h, r, t, v, m, n, v ', m', n ', u, Δ, m _* , n _* , v ' _* , M' _* , n ' _* , m)
Is generated.

The knowledge verification unit 401 has the following formula:
(e (g, G) e (u, Y) ^-1 e (v, Z) ^-1 ) ^c Δ = e (f, G) ^{χ ''} e (u, G) ^{α ''} e (v, G ) ^{β ''} e (h, Y) ^{-θ ''} e (h, Z) ^{-ρ ''} e (h, G) ^{ω ''}
m ^c m _* = r ^{ρ ''}
n ^c n _* = t ^{ρ '}
v ' ^c v' _* = f ^{χ ''} h ^{τ ''}
m ' ^c m' _* = r ^{τ ''}
n ' ^c n' _* = t ^{τ ''}
Confirm that

The knowledge verification unit 401 outputs “valid” if this is true, and outputs “invalid” if this is not true.

<Tracker 500>
Referring to FIG. 7, the functional configuration of the tracking device 500 is shown. The tracking device 500 includes a decryption unit 503, a decryption validity proving unit 510, and a signature verification unit 513. As the tracking device 500, for example, an information processing device such as a computer including a communication device, an input / output device, a computing device (CPU or the like), and a storage device (memory or the like) can be used. Each of the above-described units can be realized by cooperation between a software program that uses these hardware and the hardware.

Decoding section 503 can generally be called decoding means. Decryption validity proving unit 510 can be generally referred to as decryption validity proving means. Signature verification unit 513 can generally be referred to as signature verification means.

The tracking device 500 includes a public key list 202 and a group public key 101 (group 1, group 2, group T, p, e, g, G, Hash, π, Y, Z, f, h), tracking public Key 301 (r, t), tracking private key 501 (ξ, ζ), message 302 m, group signature 313 (v, m, n, v ′, m ′, n ′, u , fsp) is input.

Using the private key 501 for tracking, the decryption unit 503 uses the private key knowledge ciphertext 304 and the private key knowledge ciphertext 307 to obtain the private key knowledge 504 and the private key knowledge that are part of the member evidence. The signature 507 is decrypted as follows. That is, the decoding unit 503
q = v 'm' ^-ξ , b = v m ^-ξ , (ID, ρ) = π ^-1 (b)
Is generated.

The decryption correctness proving unit 510 generates a certificate indicating that (q, b) is a decryption result of the ciphertext (v ′, v ′, v, m). The generated proof text is called a decryption correctness proof text 511. The signature verification unit 513 confirms that the signature σ is a valid signature for q using the public key corresponding to the ID in the public key list 202. The tracking device 500 outputs the decryption validity 514 and the IDs q, b and the signer identifier 105.

<Group signature system 600>
Reference is again made to FIG. In FIG. 2, the member certificate acquisition device 100 acquires a member certificate 119 and a member secret key 118 by communicating with the member certificate issuing device 200. The member certificate issuing device 200 obtains the member list 203 through this communication.

The group signature device 300 includes a member certificate 119 acquired by the member certificate acquisition device 100, a member private key 118 acquired by the member certificate acquisition device 100, a message 302, a group public key 101, and a tracking disclosure. The key 301 is accepted and a group signature 313 for the message 302 is output.

The group signature verification device 400 accepts the message 302, the group public key 101, the tracking public key 301, and the group signature 313, and outputs a verification result 407 indicating that the group signature 313 is a valid group signature for the message 302. To do.

The tracking device 500 receives the tracking public key 301, the group signature 313, and the tracking private key 501, and outputs a member identifier 105 that represents the group signature 313 generated.

<Effect of this embodiment>
In this embodiment, the group signature device 300 generates the group signature 313 using the member certificate 119 and the member private key 118 acquired by the member certificate acquisition device 100 communicating with the member certificate issuing device 200. . The generated group signature 313 can be easily verified by the group signature verification device 400. In addition, when the tracking device 500 is used, the signer identifier 105 can be directly extracted from the group signature 313. In other words, since the ciphertext of the identifier of the group signature member is a part of the group signature, the unauthorized person tracking device can extract the identifier of the unauthorized person by directly decrypting it.

The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

This application claims priority based on Japanese Patent Application No. 2008-194024 filed on July 28, 2008, the entire disclosure of which is incorporated herein.

DESCRIPTION OF SYMBOLS 100 Member certificate acquisition apparatus 101 Group public key 102 Random number 103 Member evidence generation part 104 Secret key knowledge 105 Identifier 107 Member secret key 108 Signature part 109 Signature 112 Member evidence 113 Knowledge proof part 117 Member certificate verification part 118 Member secret key 119 Member certificate 200 Member certificate issuing device 201 Random number 202 Public key list 203 Member list 208 Signature verification unit 209 Knowledge verification unit 211 Member certificate source generation unit 212 Member certificate source 300 Group signature device 301 Tracking public key 302 Message 303 Encryption Unit 304 Secret Key Knowledge Cipher Text 305 Signature Cipher Text 308 Knowledge Proof Text Generation Unit 309 Knowledge Proof Text 313 Group Signature 400 Group Signature Verification Device 401 Knowledge Testimony unit 402 challenge value generating unit 500 tracking device 503 decoding unit 504 private key knowledge 507 private signature for key knowledge 510 decoding correctness proof unit 511 validity proof text 513 signature verification unit 514 correctness proof of the decoding of the decoding

Claims

A group signature system having a member certificate acquisition device, a member certificate issuing device, and a group signature device,
The member certificate acquisition device includes:
Member evidence generating means for generating member evidence including a signer identifier and a signature based on a member private key that is a private key for signature;
Member certificate verification means for outputting a member certificate including the member evidence when the signature is confirmed to be valid, and
The member certificate issuing device
A signature verification means for confirming that the signature is valid based on a public key list which is a list of a set of a member public key corresponding to the member secret key and the identifier, and the member evidence;
The group signature device is:
A group signature system that outputs a group signature including a ciphertext of the signature based on a group public key, a tracking public key, the member private key, and the member certificate.
The group signature system further comprises a tracking device,
The tracking device comprises:
The group signature system according to claim 1, further comprising decryption means for decrypting the identifier based on the group signature and a tracking private key corresponding to the tracking public key.
The group signature system further includes a group signature verification device,
The group signature verification device includes:
The group signature system according to claim 1, wherein the group signature system verifies whether the group signature is valid by using the group public key and the tracking public key.
Generating member evidence including a signer's identifier and a signature based on a member private key that is a private key for signing;
Confirming that the signature is valid based on a public key list that is a list of a member public key corresponding to the member private key and the identifier and the member evidence,
When the signature is confirmed to be valid, a member certificate including the member evidence is output,
A group signature method for outputting a group signature including a ciphertext of the signature based on a group public key, a tracking public key, the member secret key, and the member certificate.
The group signature method according to claim 4, further comprising decrypting the identifier based on the group signature and a tracking private key corresponding to the tracking public key.
6. The group signature method according to claim 4, further comprising verifying whether or not the group signature is valid by using the group public key and the tracking public key.