WO2010090068A1

WO2010090068A1 - Authentication system, method and program

Info

Publication number: WO2010090068A1
Application number: PCT/JP2010/050538
Authority: WO
Inventors: 賢尾花
Original assignee: 日本電気株式会社
Priority date: 2009-02-03
Filing date: 2010-01-19
Publication date: 2010-08-12

Abstract

Provided is an authentication system which enables the amount of information held by each participant to be smaller than the amount proportional to the total number (n) of users. A setup device (100) for activating two or more commit data generation/verification devices (200) for generating commit data and verifying the presence or absence of falsification of data to be verified relating to the commit data is provided with an authentication information generation unit (102) for generating authentication data and authenticators used for the verification. The authentication information generation unit (102) generates the authentication data and the authenticators on the basis of data obtained by assigning a constant to one variable in a bivariate polynomial.

Description

Authentication system, method and program

The present invention relates to an authentication system, a setup device, a commit data generation / verification device, an authentication method, a setup device program, and a commit data generation / verification device program, and in particular, a commitment scheme that does not rely on computational assumptions for safety. It relates to the authentication system.

When multiple users collaborate to execute a protocol based on the data held by each user, a user who knows the data executes the protocol advantageously by knowing the user owned by another user. There are many cases where this is possible.

As a typical example of such an example, consider performing janken on a network. At this time, when a certain user knows the hand that another user puts out, the user who knows the hand can win the janken with a probability of 1.

A technique called Commitment (Bit Commitment Protocol) is known as a method to prevent the advancement of the protocol after determining the data of the other party after knowing the other party's data, as is the case after such a janken. ing.

Commitment is a protocol that consists of two phases, commit and disclosure / verification, in the presence of both sender and receiver.
In the commit phase, the sender outputs commit data, disclosure data, and proof data based on the input data, and passes the commit data to the receiver.

In the disclosure / verification phase, the verifier passes disclosure data, commit data, and proof data to the receiver, and the receiver uses the passed disclosure data, commit data, and proof data as input, and verifies it. The result “0” or “1” is output.
A verification result of 1 means that the input data and the disclosed data match, and a verification result of 0 means that the input data and the disclosed data are different. .

There are two requirements for commitment safety: confidentiality and binding.
Confidentiality guarantees that the input data is not known from the commit data, and constrainedness means that after the receiver receives the commit data, the sender is a data disclosure data receiver that is different from the input data. To verify that the verification result cannot be 1.

In the following, confidentiality under a certain computational complexity assumption is called computational confidentiality, and confidentiality without making computational assumptions is called perfect concealment.
In terms of restraint, restraint under certain computational complexity assumptions is called computational restraint, and restraint with no computational assumptions is called perfect restraint.

By using the commitment, it is possible to prevent the follow-up of janken described above as follows.
When the user A and the user B play a junk, both the users A and B execute the commit phase using the hands J_A and J_B that they are about to input as input data, the commit data c_A and c_B, and the disclosed data r_A, r_B is output, A passes c_A to B, and B passes c_B to A.

Next, A and B execute a disclosure / verification phase, confirm the correctness of J_A and J_B, and then confirm which has won the janken.
When the above protocol is executed, it becomes impossible for A and B to change their hands after sending the commit data, and either A or B sees the other's hand first. But you won't be able to change your hand to your advantage.

As typical related technologies related to such commitments, for example, Non-Patent Document 1 to Non-Patent Document 4 shown below can be cited.

Non-Patent Document 1 describes a commitment scheme that has computational complexity and complete constraint using a pseudo-random number generator.
Non-Patent Document 2 describes a commitment method having complete secrecy and computational constraint using the difficulty of the discrete logarithm problem.

In Non-Patent Document 3, it is assumed that there is a reliable third party who passes data used in the commit phase and the disclosure / verification phase, respectively, before the commit phase starts. Commitmen and methods that are both sex and fully constrained are described.

Non-Patent Document 4 also describes a completely confidential commitment scheme assuming the existence of a reliable third party who plays the same role as Non-Patent Document 3.
The method of Non-Patent Document 4 is a broadcast-type commitment method, in which n people receive one commit data at the same time, and at the time of disclosure / verification, the validity of the commit data is verified using the information each has. It is possible to verify.
In addition, this method guarantees complete restraint unless k or more people collide.

In such related technology, before the commit phase begins, it is assumed that there is a reliable third party that passes data used in the commit phase and the disclosure / verification phase, respectively, in the sender and receiver. Non-Patent Documents 3 and 4 are the commitment methods having both the property and the complete constraint.

However, in Non-Patent Document 3 and Non-Patent Document 4, when many users participate in the protocol and it is not known in advance who will commit the data, each user can generate commit data, and In order to verify the commit data of other users, there is a disadvantage that data proportional to the total number of users n must be retained.

That is, the method described in Non-Patent Document 3 assumes a commitment between a single sender and a single receiver, and calculates commit data for a plurality of receivers. There is a disadvantage that the bit length of the commit data increases in proportion to the number of recipients.

In Non-Patent Document 4, in a situation where n participants commit their data as in multi-party calculation, each participant must hold an amount of data proportional to n. There is an inconvenience.

The object of the present invention is to reduce the amount of information that each participant must hold to the total number of users n even in a situation where it is not known in advance which n users will commit data, such as multi-party computation. An authentication system, a setup device, a commit data generation / verification device, an authentication method, which aims to reduce the amount of data necessary for authentication such as commit data generation / verification by making it possible to reduce it from a proportional amount, The object is to provide a setup device program and a commit / data generation / verification device program.

In order to achieve the above object, an authentication system of the present invention generates two or more commit data generation / verification devices that generate commit data and verify whether or not the verification target data relating to the commit data is falsified, and each of the commit data A setup device for operating each of the generation / verification devices, and the setup device includes an authentication information generation unit that generates authentication data and an authenticator used for the verification of each commit data generation / verification device. The commit data generation / verification device includes an authentication information storage unit that stores a part of the authentication data and the authenticator, and the authentication information generation unit sets a constant in one of the variables in the two-variable polynomial. The authentication data and the authenticator are generated based on the substituted data.

In order to achieve the above object, a setup apparatus of the present invention generates commit data and operates each of two or more commit data generation / verification apparatuses that verify whether or not the verification target data relating to the commit data is falsified. A setup device, comprising: an authentication information generator for generating authentication data and an authenticator used for the verification of each commit data generation / verification device, wherein the authentication information generator is one of the variables in the two-variable polynomial. The authentication data and the authenticator are generated based on data in which a constant is substituted for.

To achieve the above object, a commit data generation / verification apparatus according to the present invention is a commit data generation / verification apparatus that generates commit data and verifies whether or not the verification target data relating to the commit data is falsified. A mask data storage unit that stores mask data generated to conceal the verification target data, an authentication information storage unit that stores authentication data used for the verification and an authenticator for the mask data, and A verification target data storage unit for storing verification target data, a commit data generation unit for generating the commit data for concealing the verification target data based on the mask data, and all other devices and the own device output Commit data storage for storing each commit data, and mask data in other devices Commit data verification that verifies the non-falsification of other verification target data and outputs the verification result on the basis of the authenticator, its authenticator, a part of the authentication data in its own device, and the other commit data The authentication information storage unit stores the authentication data and the authenticator generated based on data in which a constant is substituted for one of the variables in the two-variable polynomial.

To achieve the above object, the authentication method of the present invention includes two or more commit data generation / verification devices that generate commit data and verify whether or not the verification target data relating to the commit data is falsified, An authentication system comprising a setup device for operating each commit data generation / verification device, wherein the commit data generation / verification device is an authentication method for verifying the verification target data. The mask data generation unit in the setup device generates mask data for concealing the verification target data, and subsequently generates authentication information for the verification and authentication information for the mask data in the setup device. Each generates authentication information, and then the verification target data is The commit data generating unit in the commit data generation / verification device generates the commit data to be concealed based on the data, and then the mask data and the authenticator in the other commit data generation / verification device, Based on a part of the authentication data in the own device and the other commit data, the commit data verification unit in the commit data generation / verification device verifies the non-falsification of the other verification target data. When generating a verification result and generating the authentication information, the authentication data and the authenticator are generated based on data obtained by assigning a constant to one of the variables in the two-variable polynomial.

To achieve the above object, the setup device program of the present invention operates at least two commit data generation / verification devices that generate commit data and verify whether or not the verification target data relating to the commit data is falsified. A program for a setup device capable of realizing various functions in a computer included in the setup device for generating a mask data for concealing the verification target data related to each commit data generation / verification device A data generation function, an authentication information generation function for generating an authentication data for the verification data and the mask data used for the verification of each commit data generation / verification device, and an authentication information generation function for realizing the computer, , One of the variables in the bivariate polynomial Is characterized in that the the function of generating the authentication data and the authenticator and its contents based on the data obtained by substituting the constant, to achieve this in the computer.

To achieve the above object, the commit data generation / verification apparatus program according to the present invention generates commit data and verifies whether or not the verification target data relating to the commit data is falsified. A commit data generation / verification apparatus program capable of realizing various functions in a computer included in the apparatus, the mask data storage function storing mask data generated to conceal the verification target data; An authentication information storage function for storing authentication data used for the verification and an authenticator for the mask data, a verification target data storage function for storing the verification target data, and concealing the verification target data based on the mask data Commit data generation function for generating the commit data, and others Commit data storage function for storing all commit data output by the device and the device itself, mask data and its authenticator in the other device, a part of the authentication data in the device, and the other commit A commit data verification function that verifies the non-falsification of other verification target data based on the data and outputs the verification result is realized in the computer. In the authentication information storage function, The computer is caused to execute a function of storing the authentication data and the authenticator generated based on data obtained by assigning a constant to one of the variables.

In the related art described above, in order to generate and verify commit data, it is necessary to store in advance data proportional to the total number of commit data generation devices n. According to the present invention, the authentication information generation unit Is configured to generate authentication data and an authenticator based on data obtained by assigning a constant to one of the variables in the bivariate polynomial, the data required for generating and verifying the commit data is Can be reduced to an amount proportional to k (≦ n), which is the number of commit data generation / verification devices that need to be collocated to threaten the security, thereby enabling authentication such as commit data generation / verification Therefore, it is possible to reduce the amount of data necessary for authentication and increase the processing speed for authentication.

It is a block diagram which shows an example of the whole structure of the commitment production | generation / verification system by one Embodiment to which the authentication system of this invention is applied. It is a block diagram which shows an example of the hardware constitutions in the commitment production | generation / verification system of FIG. It is a flowchart which shows an example of the operation processing procedure of the setup apparatus in the commitment production | generation / verification system by one embodiment of this invention. It is a flowchart which shows an example of the operation | movement process sequence at the time of the commit data production | generation of the commit data production | generation / verification apparatus in the commitment production | generation / verification system by one embodiment of this invention. It is a flowchart which shows an example of the operation | movement process sequence at the time of the commit data verification of the commit data production | generation / verification apparatus in the commitment production | generation / verification system by one embodiment of this invention.

Hereinafter, an example of a preferred embodiment in which the “authentication system” of the present invention is applied to a commitment generation / verification system will be specifically described with reference to the drawings.

[First Embodiment]
(Basic configuration of commitment generation / verification system)
First, the basic configuration of the commitment generation / verification system will be described. As shown in FIG. 1, the commitment generation / verification system 1 generates two or more commit data generation / verification apparatuses 200 (200-1) that generate commit data and verify whether or not the verification target data relating to the commit data has been falsified. 200-n) and a setup device 100 for operating each of the commit data generation / verification devices 200 (200-1 to 200-n).
Here, the number of commit data generation / verification apparatuses 200 is represented as n. The device numbers are i and j.

The setup apparatus 100 includes an authentication information generation unit 102 that generates authentication data and an authenticator used for the verification of the commit data generation / verification apparatuses 200 (200-1 to 200-n).
The setup apparatus 100 outputs a mask value stored in the all commit data generation / verification apparatus 200 and authentication information including an authenticator for the mask value.

One commit data generation / verification apparatus 200-1 includes an authentication information storage unit 202-1 as an authentication information storage unit that stores a part of the authentication data and the authenticator.

The authentication information generation unit 102 generates the authentication data and the authenticator based on data obtained by assigning a constant to one of the variables in the two-variable polynomial.

Furthermore, one commit data generation / verification apparatus 200 (200-1) includes a commit data generation unit 205-1, a commit data verification unit 206-1, and a plurality of storage units.

The commit data generation unit 205-1 receives the verification target data stored in the data storage unit 201-1 in the apparatus, and outputs the commit data.

The commit / data verification unit 206-1 outputs another commit / data output from another commit / data generation / verification device 200 (with the device number j) stored in the commit / data storage unit 204-1 in the device. Data, other verification target data stored in the data storage unit 201-j of the device number j, a part of the authentication information stored in the authentication information storage unit 202-j of the device number j, and the device number j The other mask value (other mask data) stored in the mask value storage unit 203-j is input, and the other verification target data stored in the device number j is the commit data generated by the device number j. Whether or not falsification has been made is verified from other verification target data at the time, and 1 is output when it is determined that no falsification has been made, and 0 is output when it is determined that falsification has been performed. *

With the above configuration, the authentication information output by the setup device is data obtained by substituting a known constant for one or both variables of one or a plurality of bivariate polynomials, and the order of the bivariate polynomial is appropriate. Thus, the size of the authentication information stored in the authentication information storage unit of each commit / data generation / verification apparatus 200 can be reduced.

That is, according to the basic configuration as described above, in the related technology described above, it is necessary to store in advance data proportional to the total number of commit data generation devices n in order to generate and verify commit data. On the other hand, according to the basic configuration of the present embodiment, the authentication information generation unit is configured to generate authentication data and an authenticator based on data obtained by assigning a constant to one of the variables in the two-variable polynomial. The data necessary for the generation / verification of commit data is proportional to k (≦ n), which is the number of commit data generation / verification devices 200 that need to be collocated in order to threaten the constraint of the commitment method. It is possible to reduce the amount of data required for authentication such as commit / data generation / verification, thereby reducing the processing speed required for authentication. It is possible to increase the speed.

(Detailed configuration of commitment generation / verification system)
Next, the specific configuration of the commitment generation / verification system according to the present embodiment will be described from the overall configuration, followed by the detailed configuration of each unit. FIG. 1 is a block diagram showing an example of the overall configuration of the commitment generation / verification system according to the first embodiment of the present invention.

Since the embodiments described below are preferred embodiments of the present invention, various technically preferable limitations are given, but the scope of the present invention is particularly limited in the following description. As long as there is no description of the effect, it is not restricted to these aspects.

First, terms used in this specification will be briefly described.
Operator: In this specification, the symbols +, −, ×, and ^ are used as a sum, difference, product, and power operator, respectively.

As shown in FIG. 1, the commitment generation / verification system 1 of this embodiment includes a setup device 100 and a plurality of commit data generation / verification devices 200 (200-1 to 200-n). Communication between the setup device 100 and each commit data generation / verification device 200 (200-1 to 200-n), between each commit data generation / verification device 200 (200-1 to 200-n), etc. It is possible to exchange data and information.

The setup apparatus 100 includes a mask value generation unit 101 as a mask data generation unit and an authentication information generation unit 102.

The mask value generation unit 101 generates and outputs n independent random numbers r_1, r_2,..., R_n for masking data held by the commit data generation / verification apparatuses 200-1 to 200-n. It has a function.

The authentication information generation unit 102 receives r_i (i = 1, 2,..., N) as input, and makes it possible for all commit data generation / verification devices 200-1 to 200-n to detect t_r alteration of each r_i. , E_n, authentication information verification keys f_1, f_2,..., F_n, and an authenticator a_i of r_i generated using the key e_1 for each r_i And output r_i, f_i, a_i (i = 1, 2,..., N).

The authenticator a_i generated here is generated based on a method that makes it difficult to generate a valid authenticator a′_i for a value r′_i other than r_i even when less than k devices cooperate. It is characterized by being.

The present embodiment is characterized in that a bivariate polynomial is used to generate such an authenticator.
Specifically, the authentication information generation unit 102 includes a two-variable polynomial generation / calculation unit 1021 for generating an authenticator.

This two-variable polynomial generator / arithmetic unit 1021 generates a plurality of two-variable polynomials internally, and outputs a value obtained by substituting the device number i for one variable of all the generated polynomials as e_i. A variable obtained by substituting the device number i for the variable that has not been substituted for e_i for the polynomial is output as f_i.

That is, the authentication information generation unit 102 has a two-variable Kth order polynomial random generation function that randomly and independently generates at least two two-variable Kth order polynomials.

In addition, the authentication information generation unit 102 may include a constant such as first data in which a constant, for example, a device number is substituted for one of the variables in one of the generated two-variable Kth order polynomials, and one of the variables in the other two-variable Kth order polynomials. An authentication information generation key generation function for generating an authentication information generation key based on the second data into which the device number is substituted is provided.

Further, the authentication information generation unit 102 uses a constant such as the third data in which a constant, for example, a device number is substituted for the other variable in the generated one-variable K-degree polynomial, and a constant, for example, the other variable in the other two-variable K-degree polynomial. An authentication information verification key generation function for generating an authentication information verification key based on the fourth data substituted with the device number is provided.

Furthermore, the authentication information generation unit 102 has an authenticator generation function for generating an authenticator for the mask data based on the generated authentication information generation key and mask data.

Further, the mask value generation unit 101 as the mask data generation unit has independent random numbers corresponding to the number of the devices for masking the verification target data held by the commit / data generation / verification devices 200, respectively. Each data is generated as mask data.
The authentication information generation unit 102 outputs each random number data, each authentication information verification key, and each authenticator.

The commit data generation / verification apparatus 200-i (i = 1, 2,..., N) includes a data storage unit 201-i as a verification target data storage unit and an authentication information storage unit 202 as an authentication information storage unit. -I, a mask value storage unit 203-i as a mask data storage unit, a commit data storage unit 204-i as a commit data storage unit, a commit data generation unit 205-i, and a commit data verification unit 206-i And.

The data storage unit 201-i is a storage device that stores data d_i (data to be verified) that is a target of commitment. The data storage unit 201-i outputs data to the commit data generation unit 205 when generating commit data, Data is output to the commit data verification unit 206-j (i ≠ j).

The authentication information storage unit 202-i stores the authentication information verification key f_i that is data generated by the authentication information generation unit 102 and is a part of the authentication data used for verification, and an authenticator for the mask data (random number data). Store a_i.
In other words, the authentication information storage unit 202-i stores the authentication data and the authenticator generated based on data obtained by assigning a constant to one of the variables in the two-variable polynomial.

The mask value storage unit 203-i stores the mask data (mask information) r_i output from the mask value generation unit 101 in order to keep the verification target data confidential.

The commit data generation unit 205-i receives the data d_i stored in the data storage unit 201-i and the mask data r_i stored in the mask value storage unit 203-i as input, and the data stored in the data storage unit 201-i Generate and output commit data c_i for d_i.
Thereby, the commit data generation unit 205-i generates the commit data c_i that conceals data (data to be verified) d_i based on the mask data r_i.

The commit data storage unit 204-i includes the commit data c_i that is the output of the commit data generation unit 205-i and the other commit data generation unit 205-j (j = 1, 2,..., I−1, i + 1). ,..., N), one or a plurality of commit data c_j is stored.
That is, one commit data storage unit 204-i stores all commit data c_1,..., C_i,.

The commit data verification unit 206-i includes the mask data r_j in the other device 200-j and its authenticator a_j, the authentication information verification key f_i that is a part of the authentication data in the own device 200-i, and the other Based on the commit data c_j, the non-falsification of the other verification target data d_j is verified and the verification result is output.

More specifically, the commit data verification unit 206-i is generated based on the other detection target data d_j stored in the data storage unit 201-j of the other commit data generation / verification device 200-j. The other commit data c_j stored in the section 204-i, the authentication information verification key f_i stored in the authentication information storage section 202-i, and the mask value storage section 203-j of the other commit data verification section 206-j The other mask data r_j to be stored and the other authenticator a_j stored in the authentication information storage unit 202-j of the other commit data verification unit 206-j) are input, and “0” or “ 1 "is output.

As described above, the verification result “1” means that the input data and the disclosed data match, and the verification result “0” means that the input data and the disclosed data are different. It means that

(Hardware configuration)
The setup device 100 and the commit data generation / verification device 200 shown in FIG. 1 are realized by a semiconductor integrated circuit such as an LSI (Large Scale Inter- lation) or a DSP (Digital Signal Processor) configured by a logic circuit, for example.

Further, as shown in FIG. 2, the setup device 100 and the commit / data generation / verification device 200 input a command, information, and the like to the processing device 10 that executes predetermined processing according to a program and the processing device 10. It may be realized on software by a computer including an input device 20 for monitoring and an output device 30 for monitoring the processing result of the processing device 10.

The processing device 10 shown in FIG. 2 includes a CPU 11, a main storage device 12 that temporarily stores information necessary for the processing of the CPU 11, a setup device 100 described later in the CPU 11, and a commit data generation unit 205 (205-1 to 205). -N) and a recording medium 13 on which a program for executing processing as the commit data verification unit 206 (206-1 to 206-n) is recorded.

The processing device 10 also includes a data storage device 14 that stores data to be committed, authentication information, a mask value, and commit data, a main storage device 12, a recording medium 13, and a data storage device 14. A memory control interface unit 15 that controls data transfer to and from the I / O interface unit 16 that is an interface unit between the input device 10 and the output device 30, and a communication interface (not shown). Connected configuration.

Here, the data storage device 14 does not need to be in the processing device 10 and may be provided independently of the processing device 10.

The processing device 10 includes a setup device 100, a commit data generation unit 205 (205-1 to 205-n), and a commit data verification unit 206 (206-1 to 206-n), which will be described later, according to the program recorded on the recording medium 13. As a function.
The recording medium 13 may be a magnetic disk, a semiconductor memory, an optical disk, or other recording medium.

(About operation procedure)
(Overall outline operation)
Next, an overall operation processing procedure in the commitment generation / verification system (secret information distribution system) having the above-described configuration will be described with reference to FIGS. FIG. 3 is a flowchart showing an example of an operation processing procedure of the setup device in the commitment generation / verification system according to the embodiment of the present invention. FIG. 4 is a flowchart showing an example of an operation processing procedure at the time of commit / data generation of the commit / data generation / verification apparatus. FIG. 5 is a flowchart illustrating an example of an operation processing procedure at the time of commit data verification.

The operation processing procedure in commitment generation / verification according to the present embodiment includes two or more commit data generation / verification devices 200 that generate commit data and verify whether or not the verification target data relating to the commit data has been tampered with, The authentication system includes a setup device 100 for operating each commit data generation / verification device 200, and performs authentication for verifying the verification target data.

The overall operation processing procedure in the commitment generation / verification according to the present embodiment is as a basic procedure: mask data for concealing the verification target data related to each commit data generation / verification device 200 is the setup device 100. Is generated by a mask value generation unit 101 as a mask data generation unit (step S1: mask data generation step shown in FIG. 3).

Subsequently, an authentication information generation unit 102 in the setup apparatus 101 generates authentication data for the verification data and the mask data used for the verification as authentication information (steps consisting of steps S2 to S4 shown in FIG. 3: authentication information) Generation step).

Next, the commit data for concealing the verification target data based on the mask data is converted into the commit data generation unit 205 (205-1 to 205-n) in the commit data generation / verification apparatus 200 (200-1 to 200-n). (Step consisting of step C1 to step C3 shown in FIG. 4: commit data generation step).

Thereafter, the mask data and its authenticator (that is, other mask data and other authenticator) in the other commit data generation / verification apparatus 200-j, a part of the authentication data in the own apparatus 200-i, and the like The commit data verification unit 206-i in the commit data generation / verification apparatus 200-i verifies the non-falsification of the other verification target data based on the commit data of this and outputs the verification result (step shown in FIG. 5) Step consisting of R1 to R6: commit data verification step).

When generating the authentication information, the authentication data and the authenticator are generated based on data obtained by assigning a constant to one of the variables in the two-variable polynomial.

Further, in the operation processing procedure in this commitment generation / verification, when generating the authentication information, a two-variable K-order polynomial random generation process for randomly and independently generating at least two two-variable K-order polynomials is performed.

Further, in the operation processing procedure in the commitment generation / verification, when generating the authentication information, the first data in which the device number is substituted into one of the variables in the generated one-variable K-degree polynomial and the other two variables. An authentication information generation key generation process is performed to generate an authentication information generation key based on the second data in which the device number is substituted into one of the variables in the Kth order polynomial.

In the operation processing procedure in this commitment generation / verification, when generating the authentication information, the third data in which the device number is substituted for the other variable in the generated one-variable K-degree polynomial and the other two-variable An authentication information verification key generation process for generating an authentication information verification key is performed based on the fourth data in which the device number is substituted for the other variable in the Kth order polynomial.

Further, in the operation processing procedure in the commitment generation / verification, when generating the authentication information, an authenticator generation process for generating an authenticator for the mask data based on the generated authentication information generation key and the mask data is performed. Do.

(Detailed operation)
This will be described in detail below.
As shown in FIG. 3, first, the mask value generation unit 101 outputs random number data r_i (i = 1, 2,..., N) as n independent and random mask data (mask values) ( Step S1: Mask data generation step or function).

Next, when the output r_i of the mask value generation unit 101 is input to the authentication information generation unit 102, the authentication information generation unit 102 operates the two-variable polynomial generation / calculation unit 1021 to obtain n pieces of authentication data. An authentication information generation key e_i and an authentication information verification key f_i (i = 1, 2,..., N) are generated (step S2: authentication information generation key generation step or function, authentication information verification key generation step or function).

Next, the authentication information generation unit 102 authenticates ai (i = 1, 2,...) For the random number data (mask data) r_i from the random number data (mask data) r_i and the authentication information generation key e_i that is authentication data. n) is generated (step S3: authenticator generation step or function).

The random number data (mask data) r_i generated in step S1 is stored in the mask value storage unit 203-i as a mask data storage unit, and the authentication information verification key f_i generated in step S2 is generated in step S3. Each authentication code a_i is stored in the authentication information storage unit 202-i (step S4: mask data storage step or function, authentication information storage step or function).

As shown in FIG. 4, the commit data generation / verification apparatus 200-i generates commit data from the data storage unit 201-i serving as the verification target data storage unit and the verification target data d_i from the mask value storage unit. Each is read into the unit 205-i (step C1).

Next, the commit data generation unit 205-i generates commit data c_i that is a value obtained by masking the verification target data d_i with the random number data r_i.
At this time, the commit data c_i is generated based on a method in which the value related to the verification target data d_i can be completely concealed from the commit data c_i (step C2).

Next, the commit data generation unit 205-i stores the commit data c_i generated in step C2 in all the commit data storage units 204-j (j = 1, 2,..., N) (step C3 )

As shown in FIG. 5, the commit data generation / verification device 200-i authenticates the other verification target data d_j from the data storage unit 201-j of the other commit data generation / verification device 200-j (j ≠ i). The other authenticator a_j from the information storage unit 202-j, the other random number data (other mask data) r_j from the mask value storage unit 203-j, and the authentication information verification key from the authentication information storage unit in the own device (200-i) f_i is read from the commit data storage unit 204-i and the other commit data c_j is read into the commit data verification unit 206-i, respectively (step R1).

Next, the commit data verification unit 206-i restores the other verification target data d_j from the other commit data c_j and the other random number data r_j (step R2: other verification target data restoration step or function).

Next, the commit data verification unit 206-i receives the other verification target data d_j restored in step R2, the other authenticator a_j related to the other verification target data d_j, and the authentication information verification key f_i of the own device 200-i. And verifying whether there is any contradiction among the other verification target data d_j, the other authenticator a_j, and the authentication information verification key f_i (step R3: other verification target data verification step or function).

If there is no contradiction, the commit data verification unit 206-i outputs “1” and ends (step R4).
If a contradiction is detected, “0” is output and the process ends (step R5).

As described above, according to the present embodiment, the authentication information for the mask value output by the setup device is substituted with a known constant for one or both variables of one or a plurality of two-variable polynomials generated at random. By appropriately adjusting the order of the bivariate polynomial as data, it is possible to reduce the size of the authentication information stored in the authentication information storage unit of each commit / data generation / verification device.

Here, a part of each block in the block diagram shown in FIG. 1 may have a software module configuration showing a functionalized state by a program executable by a computer.

That is, the physical configuration is, for example, one or a plurality of CPUs (or one or a plurality of CPUs and one or a plurality of memories), but the software configuration by each unit (circuit / means) is exhibited by the CPU by controlling the program. A plurality of functions are expressed as components by a plurality of units (means).

When the CPU expresses a dynamic state in which the CPU is executed by the program (a state in which each procedure constituting the program is being executed), each unit (means) is configured in the CPU. In a static state in which the program is not executed, the entire program (or each program part included in the configuration of each unit) that realizes the configuration of each unit is stored in a storage area such as a memory.

Each unit (means) described above may be configured such that a computer functionalized by a program can be realized together with the function of the program, or a plurality of electronic circuits permanently functionalized by specific hardware You may comprise with the apparatus which consists of a block. Therefore, these functional blocks can be realized in various forms by hardware only, software only, or a combination thereof, and is not limited to any one.

Further, each unit may be configured as a device including a dedicated computer capable of communication, and the system may be configured by each of these devices. Conversely, a system in which each unit is configured as a single device may be used.

[Second Embodiment]
Next, a second embodiment according to the present invention will be described. The second embodiment shows a specific example of the above-described first embodiment, and will be described using the same diagram as that of the first embodiment.

In the second embodiment, the commitment generation / verification system 1 uses GF (p) (p: prime number or prime number width, GF: Galois field) for each verification target data d_i. A Galois field is a set of remainders obtained by dividing an integer by a prime number, and is a set in which elements are finite and four arithmetic operations are closed. A Galois field having element (element) p is defined as GF (p).

Here, the setup device 100 and the commit data generation / verification device 200-i (i = 1, 2,..., N) according to the present embodiment will be described.

At the time of setup, the mask value generation unit 101 of the setup apparatus 100 generates n pieces of random number data r_1, r_2,..., R_n on GF (p) as mask data.

Next, the authentication information generation unit 102 generates at least two bivariate Kth order polynomials h_0 (x, y) and h_1 (x, y) on the Galois field GF (p) randomly and independently. It has a polynomial random generation function.

Further, the authentication information generation unit 102 receives the authentication information generation key e_i and the authentication information verification key f_i.
e_i = (e_ {i0} (x), e_ {i1} (x))
= (H_0 (x, i), h_1 (x, i)),
f_i = (f_ {i0} (y), f_ {i1} (y))
= (H — 0 (i, y), h — 1 (i, y))
As a function of generating each.

That is, the authentication information generation unit 102 assigns one of the variables in one of the generated two-variable Kth order polynomials to one of the variables in the first data and the other two-variable Kth order polynomial. An authentication information generation key generation function for generating an authentication information generation key e_i based on the second data substituted with a constant (for example, a device number) is provided.

Furthermore, the authentication information generation unit 102 assigns the third data obtained by assigning a constant (for example, a device number) to the other of the variables in one of the generated two-variable Kth order polynomials and the other of the variables in the other two-variable Kth order polynomials. An authentication information verification key generation function for generating an authentication information verification key f_i based on the fourth data substituted with a constant (for example, a device number) is provided.

Also, the authentication information generation unit 102 has an authenticator generation function for generating an authenticator a_i (x) for the generated mask information (mask data) r_i.

The setup device 100 has a function of storing the authentication information verification key f_i and the authenticator a_i (x) in the authentication information storage unit 202-i and storing mask data (random number data) r_i in the mask value storage unit 203-i. Prepare.

That is, the mask value generator 101 masks the verification target data d_1 to d_n held by the commit / data generation / verification apparatuses 200 (200-1 to 200-n), respectively. A function of generating n pieces of independent random number data r_1 to r_n as mask data is provided. Accordingly, the authentication information generation unit 102 has a function of outputting the random number data r_1 to r_n, the authentication information verification keys f_1 to f_n, and the authenticators a_1 (x) to a_n (x).

Further, the authentication information generation key generation function in the authentication information generation unit 102 is based on one generated two-variable Kth order polynomial h_0 (x, y) and the other two-variable Kth order polynomial h_1 (x, y). The authentication information generation key e_i in the device number i of the own device is
e_i = (h — 0 (x, i), h — 1 (x, i))
The function of generating two types of h — 0 (x, i) and h — 1 (x, i) per device is provided.

In the authentication information verification key generation function in the authentication information generation unit 102,
Based on one of the generated two-variable Kth order polynomial h_0 (x, y) and the other two-variable Kth order polynomial h_1 (x, y), an authentication information verification key f_i for the device number i of the own device is obtained.
f_i = (h — 0 (i, y), h — 1 (i, y))
As a function of generating two types of h_0 (i, y) and h_1 (i, y) per device.

Further, in the authenticator generation function in the authentication information generation unit 102, the authenticator a_i (x) for the random number data r_i is converted into the h_0 (x, i) based on the generated authentication information generation key e_i and the random number data r_i. ) Generated key e_ {i0} (x) and h_1 (x, i) generated key e_ {i1} (x)
a_i (x) = e_ {i0} (x) + r_i × e_ {i1} (x)
It has the function to generate by.

The commit data generation unit 205 calculates the sum of the verification target data stored in the data storage unit 201 serving as the verification target data storage unit and the random number data stored in the mask value storage unit 203 serving as a mask data storage unit. Thus, the commit data is generated and stored in the commit data storage unit 204.

That is, the commit data generation unit 205-i reads the verification target data d_i and the mask data (random number data) r_i from the data storage unit 201-i and the mask value storage unit 203-i, respectively, and the commit data c_i by c_i = d_i + r_i. It has a function to generate.

The commit data generation unit 205-i sends the generated commit data c_i to the commit data storage unit 204 (204-1 to 204-n) of all the commit data generation / verification devices 200 (200-1 to 200-n). The function to store is provided.
Specifically, the commit data generation unit 205-1 uses the generated commit data c_1 as the commit data storage unit 204 (204-1 to 204-1) of all the commit data generation / verification apparatuses 200 (200-1 to 200-n). 204-n).
Similarly, the commit data generation unit 205-n converts the generated commit data c_n into commit data storage units 204 (204-1 to 204) of all the commit data generation / verification apparatuses 200 (200-1 to 200-n). -Store in n).
Therefore, commit data c_1 to c_n are stored in the commit data storage unit 204-1. Similarly, commit data c_1 to c_n are stored in the commit data storage unit 204-n.

The commit data verification unit 206 includes another verification target data restoration function for restoring other verification target data from other commit data and other random number data, and another verification target restored by the other verification target data restoration function. There is no contradiction between the other verification target data, other authenticators, and the authentication information verification key using the data, the other authenticators related to the other verification target data, and the authentication information verification key related to the local device. And other verification target data verification function for verifying whether or not.

The other verification object data verification function includes other random number data r_j and other authenticator a_j (x) in the device number j of the other device, authentication information verification key f_i of the authentication information storage unit in the device number i of the own device, and The other commit data c_j of the commit data storage unit in the device number i of the own device is read, and the device number i is substituted for x of the a_j (x) to calculate a_j (i), and the f_i of 2 Substituting the device number j into two equations and calculating f_ {i0} (j) and f_ {i1} (j) respectively, a_j (i) = f_ {i0} (j) + (c_j −r_j) × f_ {i1} (j)
It verifies whether or not holds.

(Operation)
Next, the operation of the commit data generation / verification apparatus when generating commit data according to the present embodiment will be described.

At the time of generating the commit data, the commit data generating unit reads the verification target data d_i and the mask data (random number data) r_i from the data storage unit and the mask value storage unit, respectively, and generates the commit data c_i by c_i = d_i + r_i.

The generated commit data c_i is stored in the commit data storage unit 204 of all the commit data generation / verification apparatuses 200.

Next, the operation of the commit data generation / verification apparatus 200-i at the time of verifying commit data in this embodiment will be described.

At the time of commit data verification, the commit data verification unit 206-i receives other mask data (other random number data) r_j and other authenticator a_j (x) from the other commit data generation / verification device 200-j, and authentication information of the own device. The authentication information verification key f_i is read from the storage unit 202-i and the other commit data c_j is read from the commit data storage unit 204-i of its own device, and it is checked whether or not the following equation is satisfied.
a_j (i) = f_ {i0} (j) + (c_j−r_j) × f_ {i1} (j)

“1” is output when the above formula is satisfied, and “0” is output when it is not satisfied.

As described above, according to the second embodiment, when the authentication information generation unit 102 uses the degree K of the polynomial as the number of devices as k, the natural number does not exceed (3k−2) / 2. In addition to having a function for generating authentication data and an authenticator based on this setting, even if k devices collide, it is possible to establish a system that breaks the constraint of the system. / P can be suppressed.

In addition, according to the second embodiment, the size of the data necessary for verifying the commit, for example, the authentication information stored for verifying the commit is also about log (p) × (9k-6) / 2 bits. . For this reason, it is possible to reduce the size to be proportional to k, and when k is smaller than n, it is possible to reduce the size of data to be stored as compared with the related art method. Yes. *

Other configurations, other steps or functions, and operation effects thereof are the same as those in the first embodiment described above. In the above description, the operation content of each step described above, the constituent elements of each unit, and the functions thereof may be programmed (software program) and executed by a computer.

[Third Embodiment]
Next, a third embodiment according to the present invention will be described. The third embodiment shows still another specific example of the first embodiment described above, and will be described with reference to the same drawing as that of the first embodiment.

As in the second embodiment, the commitment generation / verification system in the present embodiment also adds GF (p) (p to each verification target data d_ {i1}, d_ {i2}, ..., d_ {im}. : Prime number or prime width, GF: Galois field).

Next, the setup device 100 and the commit data generation / verification device 200-i (i = 1, 2,..., N) according to the present embodiment will be described.

At the time of setup, the mask value generation unit 101 of the setup apparatus 100
Nxm random number data on GF (p) r_ {11}, r_ {12}, ..., r_ {1m},
r_ {21}, r_ {22}, ..., r_ {2m},
...
r_ {n1}, r_ {n2}, ..., r_ {nm},
Is generated as mask data.

That is, the mask value generation unit 101 as the mask data generation unit stores m random number data r_ {i1}, r_ {i2},... In the mask value storage unit 203-i as the mask data storage unit for the device number i. .., R_ {im} is stored.

Next, the authentication information generation unit 102 includes a bivariate K-th order polynomial h_ {01} (x, y), h_ {02} (x, y),..., H_ {on m + 1 GF (p). 0m} (x, y) and h_1 (x, y) are randomly and independently generated.

Further, the authentication information generation unit 102 receives the authentication information generation key e_ {il} and the authentication information verification key f_i, respectively.
e_ {il} = (e_ {iOl} (x), e_ {i1l} (x))
= (H_ {01} (x, i), h_1 (x, i))
(L = 1, 2, ..., m)

f_i = (f_ {i01} (y), f_ {i02} (y),...
, F_ {i0m}, f_ {i1} (y))

= (H_ {01} (i, y), h_ {02} (i, y), ...
., H_ {0m} (i, y), h_1 (i, y))
It has the function to generate as.

In addition, the authentication information generation unit 102 has an authenticator generation function for generating an authenticator a_ {il} (x) for mask information (random data that is an example of mask data) r_ {il}.

The setup device 100 stores the authentication information verification key f_i and the authenticator a_ {il} (x) in the authentication information storage unit 202-i and r_ {il} in the mask value storage unit 203-i.

More specifically, the mask data generation unit 101 stores m random numbers r_ {i1}, r_ {i2},..., R_ {im} in the mask data storage unit for the device number i.

In the bivariate Kth order polynomial random generation function in the authentication information generation unit 102, m + 1 bivariate Kth order polynomials h_ {01} (x, y), h_ {02} (x, y),. {0m} (x, y), h_1 (x, y) are provided randomly and independently.

In the authentication information generation key generation function in the authentication information generation unit 102, one of the generated two-variable K-th order polynomials h_ {01} (x, y), h_ {02} (x, y),. , H_ {0m} (x, y) and the other two-variable K-th order polynomial h_1 (x, y), the authentication information generation key e_i in the device number i of the own device,
e_ {il} = (h_ {01} (x, i), h_1 (x, i))
(L = 1, 2, ..., m)
Thus, a function for generating m + 1 types of the generated keys per apparatus is provided.

Further, in the authentication information verification key generation function in the authentication information generation unit 102, one of the generated two-variable K-th order polynomials h_ {01} (x, y), h_ {02} (x, y),. , H_ {0m} (x, y) and the other two-variable K-th order polynomial h_1 (x, y), the authentication information verification key f_i in the device number i of its own device,
f_i = (h_ {01} (i, y), h_ {02} (i, y),...
., H_ {0m} (i, y), h_1 (i, y))
The function of generating m + 1 types per apparatus is provided.

Further, in the authenticator generation function in the authentication information generation unit 102, the authenticator a_ {il} (x) for the random number data r_ {il} based on the generated authentication information generation key e_i and the random number data r_i, Generated key e_ {i01} (x) based on h_ {01} (x, i) (l = 1, 2,..., M) and generated key e_ {i1} (x) based on h_1 (x, i) )
a_ {il} (x) = e_ {i01} (x) + r_ {il} × e_ {i1} (x)
(L = 1, 2, ..., m)
It has the function to generate by.

Further, the commit data generation unit 205-i in the apparatus number i is the verification target data d_ {il} (l = 1, 2,...) Stored in the data storage unit 201-i as the verification target data storage unit. M) and the random number data r_ {il}, the commit data c_ {il}
c_ {il} = d_ {il} + r_ {il} (l = 1, 2,..., m)
And a function for storing in the commit data storage unit 204-i as a commit data storage unit.

Further, the other verification object data verification function in the second embodiment includes the other random number data r_ {jl} and the other authenticator a_ {jl} (x) in the device number j of the other device, and the authentication in the device number i of the own device. The authentication information verification key f_i of the information storage unit and the other commit data c_ {jl} of the commit data storage unit in the device number i of the own device are read, and the device number i is substituted for x of the a_ {jl} (x). Then, a_j (i) is calculated, and f_ {iOl} (j) and f_ {i1} (j) are calculated by substituting the device number j into the two expressions f_i, respectively. a_ {jl} (i) =
f_ {iOl} (j) + (c_ {jl} −r_ {jl}) × f_ {i1} (j)
Has a function to verify whether or not

Further, the mask data generation unit 101 has a function of generating the mask data using an encryption key based on a Burnham encryption that is a disposable key encryption.

The authentication information generation unit 102 sets the degree K of the bivariate Kth order polynomial to a natural number not exceeding (3k−2) / 2 when the number of devices is k, and based on this, the authentication information generation unit 102 sets the authentication. A function of generating data and the authenticator is provided.

Next, the operation of the commit data generation / verification apparatus when generating commit data in the present embodiment will be described.

At the time of generating commit data, the commit data generating unit 205 reads d_ {il} and r_ {il} from the data storage unit 201 and the mask value storage unit 203, respectively, and the commit data c_ {il} is c_ {il} = d_ {. il} + r_ {il}
Generate by.

The generated commit data c_ {il} is stored in the commit data storage unit 204 of all the commit data generation / verification apparatuses 200.

At the time of commit data verification, the commit data verification unit 206-i sends other mask data r_ {jl} and other authenticator a_ {jl} (x) from the other commit data generation / verification apparatus 200-j to the own apparatus. The authentication information verification key f_i is read from the authentication information storage unit 202-i, and the other commit data c_ {jl} is read from the commit data storage unit 204-i of the own apparatus, and it is checked whether or not the following equation is satisfied.
a_ {jl} (i) =
f_ {iOl} (j) + (c_ {jl} −r_ {jl}) × f_ {i1} (j)
If the above formula is satisfied, “1” is output, and if not, “0” is output.

As explained above, according to the third embodiment,
Each of the commit data generation / verification units 206-i can calculate commitments for up to m verification target data d_ {i1}, d_ {i2},..., D_ {im}. It has the characteristics, and it is possible to remove the restriction that only the commitment for one data, which was the restriction of the second embodiment of the present invention, can be generated.

Other configurations, other steps or functions, and operational effects thereof are the same as those in the first embodiment and the second embodiment described above. In the above description, the operation content of each step described above, the constituent elements of each unit, and the functions thereof may be programmed (software program) and executed by a computer.

[Other variations]
Also, although the apparatus and method according to the present invention have been described according to some specific embodiments thereof, the embodiments described in the text of the present invention can be used without departing from the spirit and scope of the present invention. Various modifications are possible.

For example, the number, position, shape, and the like of the above-described constituent members are not limited to the above-described embodiment, and can be set to a suitable number, position, shape, and the like in carrying out the present invention.

A setup apparatus according to an embodiment of the present invention operates at least two commit data generation / verification apparatuses that generate commit data and verify whether or not the verification target data relating to the commit data is falsified.
The setup device includes a mask data generation function for generating mask data for concealing the verification target data related to each commit data generation / verification device, and an authentication used for the verification related to each commit data generation / verification device. And an authentication information generation function for generating an authenticator for each of the data and the mask data.
The authentication information generation function includes a function of generating the authentication data and the authenticator based on data obtained by assigning a constant to one of the variables in the two-variable polynomial.

In addition, the commit data generation / verification apparatus according to the embodiment of the present invention generates commit data and verifies whether or not the verification target data related to the commit data is falsified.
The commit data generation / verification device stores a mask data storage function for storing mask data generated for concealing the verification target data, an authentication data used for the verification, and an authenticator for the mask data. An authentication information storage function; a verification target data storage function for storing the verification target data; a commit data generation function for generating the commit data for concealing the verification target data based on the mask data; Commit data storage function for storing all commit data output by the own device, other mask data in other devices, other authenticators, a part of the authentication data in the own device, and other commit data Commit data that verifies the non-falsification of other verification target data and outputs the verification result based on And the verification function, may comprise.
The authentication information storage function includes a function for storing the authentication data and the authenticator generated based on data obtained by assigning a constant to one of the variables in the two-variable polynomial.

By the way, key cryptography using a multivariable polynomial including a two-variable K polynomial is an encryption scheme that seeks a ground for security for an NP complete problem. Even though the quantum computer can break the RSA cipher and the elliptical cipher, it is predicted that the NP complete problem cannot be solved. Therefore, the key cipher using the multivariable polynomial functions as a quantum computer key cipher. In addition, key cryptography using multivariate polynomials does not require quantum information processing such as quantum cryptography, and is an encryption method that can be used on current networks. The low introduction cost using this network can be realized. *

In addition, the authentication system may be configured such that each communication device and the management device are connected to each other via a communication network to exchange information between the communication devices. When the bit commitment protocol is implemented between the communication devices, this can be realized by installing a commit data generation / verification device in each communication device and a setup device in the management device.

Furthermore, in the system according to the above embodiment, the communication structure is not limited to the client server system, but is a system based on peer-to-peer communication in which terminals form a network without passing through a server and transmit / receive data to / from each other. There may be.

Further, in the present specification, the steps shown in the flowchart include processes that are executed in parallel or individually even if they are not necessarily processed in time series, as well as processes that are executed in time series according to the described procedure. It is a waste. In the implementation, the order in which the program procedures (steps) are executed may be changed. Furthermore, the specific procedures (steps) described herein may be implemented, removed, added, or rearranged as a combined procedure (step) as needed for implementation.

Further, in “communication”, wireless communication and wired communication as well as communication in which wireless communication and wired communication are mixed, that is, wireless communication is performed in a certain section and wired communication is performed in another section. There may be. Further, communication from one device to another device may be performed by wired communication, and communication from another device to one device may be performed by wireless communication.

By the way, such an apparatus may exist independently, or may be used in a state where it is incorporated in a certain device, but the idea of the invention is not limited to this and includes various aspects.

In addition, terms (random number data, storage unit, authentication information generation key, authentication information verification key, etc.) cited as broad terms in the description (mask data, storage unit, authentication data, etc.) In other descriptions, broad terms can be used. Further, in the description in the specification, each operation content to be processed by each step is not described in the operation description of each step, but each write process is executed in each specific storage area in the storage medium. Including things.

Further, the scope of the invention is not limited to the illustrated example. Further, the above embodiments include various stages, and various inventions can be extracted by appropriately combining a plurality of disclosed constituent elements. That is, examples include combinations of the above-described embodiments, or any of them and any of the modifications.

This application claims priority based on Japanese Patent Application No. 2009-022837 filed on Feb. 3, 2009, the entire disclosure of which is incorporated herein.

The present invention can be used for authentication systems in general.

1 Commitment generation / verification system (authentication system)
100 Setup Device 101 Mask Value Generation Unit (Mask Data Generation Unit)
102 Authentication Information Generation Unit 1021 Bivariate Polynomial Generation / Calculation Unit 200 (200-1 to 200-n) Commit Data Generation / Verification Device 201 (201-1 to 201-n) Data Storage Unit (Verification Target Data Storage Unit)
202 (202-1 to 202-n) Authentication information storage unit (authentication information storage unit)
203 (203-1 to 203-n) Mask value storage unit (mask data storage unit)
204 (204-1 to 204-n) Commit data storage unit (commit data storage unit)
205 (205-1 to 205-n) Commit data generation unit 206 (206-1 to 206-n) Commit data verification unit

Claims

Two or more commit data generation / verification devices for generating commit data and verifying whether or not the verification target data relating to the commit data is falsified, and a setup device for operating each of the commit data generation / verification devices, With
The set-up device includes an authentication information generation unit that generates authentication data and an authenticator used for the verification according to each commit data generation / verification device,
The commit data generation / verification device includes an authentication information storage unit that stores a part of the authentication data and the authenticator,
The authentication system, wherein the authentication information generation unit generates the authentication data and the authenticator based on data obtained by assigning a constant to one of variables in a two-variable polynomial.
The authentication system according to claim 1,
The set-up device includes a mask data generation unit that generates mask data for concealing the verification target data according to each commit data generation / verification device,
The authentication information generation unit is configured to generate an authenticator for the generated mask data.
The authentication system according to claim 2,
The commit data generation / verification device includes:
A verification target data storage unit for storing the verification target data; a mask data storage unit for storing the mask data; a commit data generation unit for generating the commit data for concealing the verification target data based on the mask data; A commit data storage unit that stores the commit data output by each of the commit data generation / verification devices.
Based on the mask data and its authenticator in the other commit data generation / verification apparatus, a part of the authentication data in the own apparatus, and the other commit data, the non-falsification of other verification target data is verified. An authentication system comprising a commit data verification unit that outputs the verification result.
The authentication system according to claim 3,
The authentication information generation unit
An authentication system comprising a bivariate Kth order polynomial random generation function that randomly and independently generates at least two bivariate Kth order polynomials.
The authentication system according to claim 4,
The authentication information generation unit
An authentication information generation key based on the first data in which a constant is substituted for one of the variables in one of the generated two-variable Kth order polynomials and the second data in which a constant is substituted for one of the variables in the other two-variable Kth order polynomial An authentication system comprising an authentication information generation key generation function for generating
The authentication system according to claim 5,
The authentication information generation unit
An authentication information verification key based on the third data in which a constant is substituted for the other variable in the one two-variable K-degree polynomial and the fourth data in which a constant is substituted for the other variable in the other two-variable K-degree polynomial. An authentication system comprising an authentication information verification key generation function for generating
The authentication system according to claim 6,
The authentication information generation unit
An authentication system comprising an authenticator generation function for generating an authenticator for the mask data based on the generated authentication information generation key and mask data.
The authentication system according to claim 7,
The mask data generation unit
Each of the commit data generation / verification devices is configured to generate, as mask data, independent random number data corresponding to the number of the devices for masking the verification target data respectively held by the commit data generation / verification devices,
The authentication information generation unit
The authentication system, wherein each random number data, each authentication information verification key, and each authenticator are output.
The authentication system according to claim 8,
The authentication information generation key generation function in the authentication information generation unit is
Based on one generated two-variable Kth order polynomial h_0 (x, y) and the other two-variable Kth order polynomial h_1 (x, y), an authentication information generation key e_i for the device number i of the own device is set to e_i = (H_0 (x, i), h_1 (x, i)) is an authentication system characterized by a function that generates two types of h_0 (x, i) and h_1 (x, i) per device. .
The authentication system according to claim 9,
The authentication information verification key generation function in the authentication information generation unit is:
Based on one of the two-variable K-th order polynomial h_0 (x, y) and the other two-variable K-th order polynomial h_1 (x, y), the authentication information verification key f_i for the device number i of the own device is expressed as f_i = (H — 0 (i, y), h — 1 (i, y)) as an authentication system, which is a function that generates two types of h — 0 (i, y) and h — 1 (i, y) per device .
The authentication system according to claim 10,
The authenticator generating function in the authentication information generating unit is
Based on the generated authentication information generation key e_i and the random number data r_i, the authentication code a_i (x) for the random number data r_i is changed to the generation key e_ {i0} (x) generated by the h_0 (x, i) and the h_1 ( x, i) using the generated key e_ {i1} (x),
a_i (x) = e_ {i0} (x) + r_i × e_ {i1} (x)
An authentication system characterized in that it is a function generated by.
The authentication system according to claim 11,
The commit data generation unit
An authentication system, wherein the commit data is generated and stored in a commit data storage unit by a sum of the verification target data stored in the verification target data storage unit and the random number data.
The authentication system according to claim 12,
The commit data verification unit
Other verification target data restoration function for restoring other verification target data from other commit data and other random number data,
Using the other verification target data restored by the other verification target data restoration function, another authenticator relating to the other verification target data, and an authentication information verification key relating to the own apparatus, the other verification Other verification target data verification function for verifying whether or not there is a contradiction between target data, the other authenticator, and the authentication information verification key;
An authentication system comprising:
The authentication system according to claim 13,
The other verification target data verification function is:
Random number data r_j and authenticator a_j (x) in device number j of another device, authentication information verification key f_i in authentication information storage unit in device number i of own device, and commit data storage in device number i of own device The other commit data c_j is read, a_j (i) is calculated by substituting the device number i for x of the a_j (x), and the device number j is substituted for the two equations of f_i to obtain f_ {I0} (j) and f_ {i1} (j) are calculated as follows: a_j (i) = f_ {i0} (j) + (c_j−r_j) × f_ {i1} (j)
An authentication system characterized by verifying whether or not is established.
The authentication system according to claim 14,
The mask data generation unit
An authentication system, characterized in that m random number data r_ {i1}, r_ {i2},..., R_ {im} are stored in a mask data storage unit for apparatus number i.
The authentication system according to claim 15, wherein
The bivariate Kth order polynomial random generation function in the authentication information generation unit is:
m + 1 bivariate Kth order polynomials h_ {01} (x, y), h_ {02} (x, y),..., h_ {0m} (x, y), h_1 (x, y) are randomly selected An authentication system characterized in that the function is generated independently.
The authentication system according to claim 16, wherein
The authentication information generation key generation function in the authentication information generation unit is
One bivariate K-order polynomial h_ {01} (x, y), h_ {02} (x, y),..., H_ {0m} (x, y) and the other two-variable K-th order Based on the polynomial h_1 (x, y), the authentication information generation key e_i in the device number i of the own device is
e_ {il} = (h_ {01} (x, i), h_1 (x, i))
(L = 1, 2, ..., m)
An authentication system characterized by having a function of generating m + 1 types of the generated keys per apparatus.
The authentication system according to claim 17,
In the authentication information verification key generation function in the authentication information generation unit,
One bivariate K-order polynomial h_ {01} (x, y), h_ {02} (x, y),..., H_ {0m} (x, y) and the other two-variable K-th order Based on the polynomial h_1 (x, y), the authentication information verification key f_i in the device number i of the own device is
f_i = (h_ {01} (i, y), h_ {02} (i, y),...
., H_ {0m} (i, y), h_1 (i, y))
An authentication system characterized by having a function of generating m + 1 types of verification keys for each device.
The authentication system according to claim 18,
The authenticator generating function in the authentication information generating unit is
Based on the generated authentication information generation key e_i and random number data r_i, the authenticator a_ {il} (x) for the random number data r_ {il} is changed to h_ {01} (x, i) (l = 1, 2,..., M) using the generated key e_ {i01} (x) and the generated key e_ {i1} (x) based on h_1 (x, i)
a_ {il} (x) = e_ {i01} (x) + r_ {il} × e_ {i1} (x)
(L = 1, 2, ..., m)
An authentication system characterized in that it is a function generated by.
The authentication system according to claim 19,
The commit data generation unit in the device number i is
Based on the verification target data d_ {il} (l = 1, 2,..., M) stored in the verification target data storage unit and the random number data r_ {il}, the commit data c_ {il} is
c_ {il} = d_ {il} + r_ {il} (l = 1, 2,..., m)
An authentication system characterized by having a function of generating and storing in a commit data storage unit.
The authentication system according to claim 20,
The other verification target data verification function is:
Random number data r_ {jl} and authenticator a_ {jl} (x) in device number j of another device, authentication information verification key f_i in the authentication information storage unit in device number i of own device, commit in device number i of own device Read other commit data c_ {jl} of the data storage unit, substitute a device number i for x of the a_ {jl} (x) to calculate a_j (i), and use the two expressions of the f_i Substituting the device number j for f_ {i01} (j) and f_ {i1} (j), respectively, the following formulas a_ {jl} (i) =
f_ {iOl} (j) + (c_ {jl} −r_ {jl}) × f_ {i1} (j)
An authentication system characterized in that it is a function whose content is to verify whether or not is established.
The authentication system according to claim 21, wherein
The mask data generation unit
An authentication system comprising a function of generating the mask data using an encryption key based on a Burnham encryption that is a disposable key encryption.
The authentication system according to claim 22,
The authentication information generating unit
A function of setting the degree K of the bivariate K-degree polynomial to a natural number not exceeding (3k−2) / 2 when the number of devices is k, and generating the authentication data and the authenticator based on the natural number. An authentication system characterized by comprising.
A setup device for operating each of two or more commit data generation / verification devices that generate commit data and verify whether or not the verification target data related to the commit data is falsified,
An authentication information generating unit that generates authentication data and an authenticator used for the verification of each commit data generation / verification device;
A setup apparatus, wherein the authentication information generation unit generates the authentication data and the authenticator based on data obtained by assigning a constant to one of variables in a two-variable polynomial.
A commit data generation / verification device that generates commit data and verifies whether or not the verification target data relating to the commit data is falsified,
A mask data storage for storing mask data generated to conceal the verification target data;
An authentication information storage unit for storing authentication data used for the verification and an authenticator for the mask data;
A verification target data storage unit for storing the verification target data;
A commit data generating unit that generates the commit data for concealing the verification target data based on the mask data;
A commit data storage unit for storing all the commit data output by other devices and the own device;
Based on the mask data and the authenticator in another device, a part of the authentication data in the own device, and the other commit data, the non-falsification of other verification target data is verified and the verification result is output. A commit data verification unit,
With
In the authentication information storage unit,
An apparatus for generating and verifying commit data, wherein the authentication data and the authenticator generated based on data obtained by assigning a constant to one of variables in a two-variable polynomial are stored.
Two or more commit data generation / verification devices that generate commit data and verify whether or not the verification target data relating to the commit data is falsified, and a setup device for operating each of the commit data generation / verification devices An authentication method for verifying the verification object data, comprising:
A mask data generation unit in the setup device generates mask data for concealing the verification target data applied to each commit data generation / verification device,
Subsequently, an authentication data generation unit in the setup device generates authentication data for the authentication data used for the verification and the mask data as authentication information,
Next, the commit data generating unit in the commit data generating / verifying device generates the commit data for concealing the verification target data based on the mask data,
Thereafter, based on the mask data and the authenticator in the other commit data generation / verification apparatus, a part of the authentication data in the own apparatus, and the other commit data, the other verification target data is not falsified. The commit data verification unit in the commit data generation / verification device verifies the performance and outputs the verification result,
An authentication method characterized in that, when generating the authentication information, the authentication data and the authenticator are generated based on data obtained by assigning a constant to one of variables in a two-variable polynomial.
Various functions can be realized in a computer provided in a setup device for operating each of two or more commit data generation / verification devices that generate commit data and verify whether or not the verification target data relating to the commit data is falsified. A program for a setup device,
A mask data generation function for generating mask data for concealing the verification target data according to each of the commit data generation / verification devices;
An authentication information generation function for generating an authentication data for the verification data and the mask data used for the verification of each commit data generation / verification device;
Realizing the computer,
In the authentication information generation function,
A program for a setup device, characterized in that the contents of a function for generating the authentication data and the authenticator based on data obtained by substituting a constant into one of variables in a two-variable polynomial are realized by the computer.
A program for a commit data generation / verification device that can generate various functions in a computer provided with a commit data generation / verification device that generates commit data and verifies whether the verification target data relating to the commit data is falsified There,
A mask data storage function for storing mask data generated to conceal the verification target data;
An authentication information storage function for storing authentication data used for the verification and an authenticator for the mask data;
A verification target data storage function for storing the verification target data;
A commit data generation function for generating the commit data for concealing the verification target data based on the mask data;
Commit data storage function for storing all the commit data output by other devices and its own device,
Based on the mask data and the authenticator in another device, a part of the authentication data in the own device, and the other commit data, the non-falsification of other verification target data is verified and the verification result is output. Commit data verification function,
To the computer,
In the authentication information storage function,
Commit data characterized in that the authentication data generated based on data obtained by substituting a constant into one of the variables in the two-variable polynomial and the function for storing the authenticator are stored in the contents, and this is realized in the computer. Program for generator / verifier.