WO2021079515A1 - Method, program, digital signature device, user device, verification device, and system - Google Patents

Abstract

[Problem] To reduce the risk of a signature key being leaked. [Solution] A method to be executed by a digital signature device, said method having a step of generating one or more pairs of a signature key and public key and a step of storing the generated signature keys in a storage area in the digital signature device, but not having a step of outputting the signature keys to the outside of the digital signature device.

Description

Methods, programs, digital signature devices, user devices, verification devices, and systems

The present invention relates to methods, programs, digital signature devices, user devices, verification devices, and systems.

Public key cryptography is known (Non-Patent Document 1).

A system in which the signature key is generated outside a digital signature device (device that performs digital signature) such as a certificate authority, or a system in which a signature key generated inside the digital signature device can be output to the outside of the digital signature device. Then, there is a risk that the signature key will be leaked.

The above problem can be solved by, for example, the following means.

The way digital signature devices perform
The process of generating one or more pairs of signing and public keys,
It has a step of storing the generated signature key in a storage area in the digital signature device.
A method that does not include a step of outputting the signature key to the outside of the digital signature device.

A program that causes the digital signature device to execute the above method.

A digital signature device that executes the above method.

A user device equipped with the above digital signature device.

A verification device that verifies the digital signature using the public key generated by the digital signature device.

A system equipped with the above user device and the above verification device.

A system in which the above program is transmitted to the digital signature device via a network.

According to one embodiment of the present invention, since the digital signature device generates the signature key inside the own device and does not output the signature key to the outside of the own device, the risk of the signature key being leaked is reduced. Can be done.

It is a flowchart explaining the method which concerns on Embodiment 1. FIG. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a generation condition and a storage condition using a counter, and perform generation and storage. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a generation condition using a counter, and is made to generate. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a storage condition using a timer, and perform storage. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a generation condition using a counter, and is made to generate. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a storage condition using a counter and a timer, and perform storage. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a generation condition using a timer, and is made to generate. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a storage condition using a counter, and perform storage. It is a flowchart explaining an example which causes a digital signature apparatus to judge the success or failure of a generation condition and a storage condition by using a timer, and perform generation and storage. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a generation condition using a timer, and is made to generate. It is a flowchart explaining an example which makes it judge whether the storage condition is success or failure by using a counter and a timer, and is made to perform a memory. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a generation condition using a counter and a timer, and is made to generate. It is a flowchart explaining an example which makes a judgment of the success or failure of a storage condition using a counter, and makes a memory perform. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a generation condition using a counter and a timer, and is made to generate. It is a flowchart explaining an example which makes a judgment of success or failure of a storage condition using a timer, and makes a memory perform. It is a flowchart explaining an example which causes a digital signature apparatus to judge success or failure of a generation condition using a counter and a timer, and is made to generate. It is a flowchart explaining an example which makes it judge whether the storage condition is success or failure by using a counter and a timer, and is made to perform a memory. It is a schematic diagram which shows the structural example of the system which concerns on Example 1. FIG. It is a sequence diagram explaining the operation example of the system which concerns on Example 1. FIG. It is a schematic diagram which shows the structural example of the system which concerns on Example 2. It is a sequence diagram explaining the operation example of the system which concerns on Example 2. FIG. It is a schematic diagram which shows the structural example of the system which concerns on Example 3. FIG. It is a sequence diagram explaining the operation example of the system which concerns on Example 3. FIG. It is a schematic diagram which shows the structural example of the system which concerns on Example 4. FIG. It is a sequence diagram explaining the operation example of the system which concerns on Example 4. FIG. It is a schematic diagram which shows the structural example of the system which concerns on Example 5. FIG. It is a sequence diagram explaining the operation example of the system which concerns on Example 5. FIG. It is a schematic diagram which shows the system which concerns on Example 6. It is a sequence diagram explaining the operation example of the system which concerns on Example 6. It is a schematic diagram which shows the example of the configuration of the hardware wallet. It is a schematic diagram which shows the example of the function of the hardware wallet. It is a figure (the 1) explaining the effect of the signature key update. It is a figure (the 2) explaining the effect of the signature key update. It is a figure which shows the configuration example of the system which transmits the program which causes the digital signature apparatus to execute the method which concerns on Embodiment 1 from another apparatus to the digital signature apparatus via a network. It is a figure which shows the example which stores the public key and the user information in association with each other. It is a flowchart which shows the example which specifies the user information by the comparison of a public key.

[Method according to Embodiment 1]
FIG. 1 is a flowchart illustrating the method according to the first embodiment. The method according to the first embodiment is a method executed by a digital signature device, and as shown in FIG. 1, a step (S10) of generating a pair or a plurality of pairs of signature keys and public keys, and a generated signature key are generated. It has a step (S20) of storing in a storage area in the digital signature device, and does not have a step of outputting the signature key to the outside of the digital signature device. Hereinafter, a detailed description will be given.

In the present specification, the step (S10) of generating a pair or a plurality of pairs of signature keys and public keys may be simply referred to as a "generation step", and the generated signature key is stored in a storage area in the digital signature device. (S20) may be simply referred to as a "memorizing step". In the present embodiment, it is assumed that the step of storing is performed after the step of generating, but the order in which both steps are executed does not matter. For example, the digital signature device may execute the step of generating after the step of storing, or may execute the step of generating and the step of storing in parallel (that is, parallel processing).

(Digital signature device)
The method according to the first embodiment is a method executed by a digital signature device. The digital signature device is a device that digitally signs data based on a public key cryptography (Public-key cryptography).

Public key cryptography sends and receives digitally signed data. Digitally signed data is data generated by encrypting data to be transmitted / received using a signature key. The signing key is also called a private key. The digitally signed data is verified using a public key (Public key) that is paired with the signature key. Specifically, if you try to decrypt digitally signed data using a public key that is paired with the signature key and you can decrypt the data correctly, you can judge that there is no fraud such as spoofing or tampering with the data, and you can decrypt it correctly. If not, it is determined that there is some kind of fraud such as spoofing or data falsification. In public key cryptography, digitally signed data can only be correctly decrypted by the public key that is paired with the signature key, and verification of fraud such as spoofing or data tampering is performed. Do. The signing key is managed so that only a specific user can know it, and the public key is managed so that an unspecified user can know it.

The method according to the first embodiment can be used without being limited to a specific signature algorithm. In addition, since each generated signature key and each stored signature key can be freely set, for example, assuming a threat to estimate a signature key to be used in the future from the history of the signature key to be used, etc. The operator can positively set the signature key.

Digital signature means encrypting the target data using the signature key stored in the storage area in the digital signature device. Encryption is defined by various public key encryption methods such as RSA (Rivest Shamir Adult), DSA (Digital Signature Algorithm), and ECDSA (Elliptic Curve Digital Signature Algorithm).

When a plurality of signature keys are stored in the storage area in the digital signature device, the digital signature device is made to select one signature key from the plurality of signature keys, and the selected signature key is used. Can be digitally signed.

Since the signature key is kept secretly only by the user concerned, the signature key should be backed up in the digital signature device in order to avoid the situation where the ciphertext encrypted with the signature key cannot be decrypted. Is preferable. For example, after securing multiple secure storage areas inside the digital signature device, for example, the signature key (primary) and the signature key (secondary) (the signature key (secondary) is the signature key (positive)). It is a duplicate and has the same data as the signature key (positive).) It is preferable to store a plurality of signature keys having the same contents in different non-volatile physical memory address spaces. As a result, since it is duplicated and stored in the non-volatile physical memory, it can be read from either area even if it is partially destroyed, and there is a possibility that the situation where decoding cannot be performed can be avoided. The storage area of the signature key (positive) in the digital signature device and the storage area of the signature key (secondary) in the digital signature device can be stored in different non-volatile physical memory address spaces.

The execution of the method according to the first embodiment in the digital signature device may be realized by hardware or software. Alternatively, it may be realized by a combination of these. When realized by software, the digital signature device executes the method according to the first embodiment by executing a program. This program is a program for causing the digital signature device to execute the method according to the first embodiment, and for example, causes the digital signature device to execute each step of the method according to the first embodiment. The program may be stored in advance in the digital signature device, or may be transmitted from another device to the digital signature device via a network.

FIG. 18 is a diagram showing a configuration example of a system in which a program for causing a digital signature device to execute the method according to the first embodiment is transmitted from another device to the digital signature device via a network. As shown in FIG. 18, in this system, a user device provided with a digital signature device and a transmission device for transmitting a program for causing the digital signature device to execute the method according to the first embodiment form a network such as the Internet or a dedicated line. It is a system connected via. The transmitting device may transmit the above program to the user device in response to a request from the user device, or may transmit the above program to the user device in response to a predetermined condition or a transmission command from the outside. May be sent.

The existence of data inside the digital signature device or in the digital signature device means that, for example, the data can be processed by the calculation device of the digital signature device (the calculation unit that executes the method according to the first embodiment) (or the range). (Inside) and in a state (or within range) that other devices cannot process (that is, the data is in a state (or within range) that can be exclusively processed by the arithmetic unit of the digital signature device). This means that the data is stored in the housing in which the arithmetic device of the digital processing device is housed. The absence of data outside the digital signature device or outside the digital signature device means that the data is not inside the digital signature device or inside the digital signature device.

(Generation step S10)
The method according to the first embodiment includes a step of generating a pair or a plurality of pairs of signature keys and public keys. This step can be executed a plurality of times by the digital signature device. In the present specification, the process of generating the signature key and the public key by the second and subsequent executions of this step, and storing the generated signature key and the public key by the second and subsequent executions of the step S20, which will be described later, is performed. , Signing key and / or public key "update". Even if the generation process S10 is executed, the storage process S20 may not be executed, or vice versa. Therefore, the number of times the generation process S10 is executed and the number of times the storage process is executed at a certain point in time are not necessarily the same. It does not match.

The algorithm for generating the signature key and public key is not limited. The signing key and public key are, for example, a public key based on an algorithm defined by RSA (Rivest Shamir Adult), DSA (Digital Signature Algorithm), ECDSA (Elliptic Curve Digital Signature Algorithm), or the like. be able to.

The bit length of the signature key and public key is not limited. For example, the bit length of the signature key or public key is in the range of 100 bits or more and 20000 bits or less, preferably in the range of 2048 bits or more and 15360 bits or less.

The public key generated in this process is output to the outside of the digital signature device.

(Memory step S20)
The method according to the first embodiment includes a step of storing the generated signature key in a storage area in the digital signature device. This step can be executed a plurality of times by the digital signature device. As described above, in the present specification, the signature key and the public key are generated by the second and subsequent executions of the generation step S10 described above, and the generated signature key and the public key are executed by the second and subsequent executions of the present step. The process of storing may be referred to as "update" of the signing key and / or the public key. Further, even if the generation process S10 is executed, the storage process S20 may not be executed, or vice versa. Therefore, the number of times the generation process S10 is executed and the number of times the storage process is executed at a certain point in time are not necessarily the same. It does not match.

When a pair of signature key and public key are generated, one signature key is stored in the storage area in the digital signature device. When multiple pairs of signature keys and public keys are generated, the plurality of signature keys are stored in the storage area in the digital signature device.

When storing the signature key in the storage area in the digital signature device, the other signature key stored in the storage area in the digital signature device (that is, the previously generated and stored signature key) is stored in the digital signature device. It may be deleted from the storage area in. When updating the signature key and public key, if the previously generated and stored signature key is not deleted from the storage area, the digital signature is digitally signed using the previously generated and stored signature key even after the update. It is possible to verify the digitally signed data using the previously generated public key even after the update. On the other hand, when updating the signature key and public key and deleting the previously generated and stored signature key from the storage area, after the update, only using the newly generated and stored signature key. It is possible to digitally sign, and after updating, the digitally signed data can be verified only using the newly generated public key.

(There is no process to output the signature key)
The method according to the first embodiment does not include a step of outputting a signature key to the outside of the digital signature device. Therefore, the digital signature device that executes the method according to the first embodiment does not voluntarily output the signature key to the outside of the own device. In other words, the digital signature device that executes the method according to the first embodiment cannot output the signature key generated inside the digital signature device to the outside of the digital signature device. "There is no process to output to the outside of the own device" includes the case where the process to output to the outside of the own device is included, but the process is not executed and the output is not to the outside as a result. Absent.

It is preferable that the method according to the first embodiment does not include a step of outputting information about the signature key (eg, a part of the signature key and / or a hash value of the signature key) in addition to the signature key itself. In this way, the signature key itself is not output to the outside of the digital signature device, but information about the signature key (eg, a part of the signature key and / or the hash value of the signature key) is output to the outside of the digital signature device. By doing so, it is possible to prevent the signature key from being presumed.

(Summary of Embodiment 1)
As described above, in the method according to the first embodiment, the digital signature device itself that performs digital signature is made to generate a pair of a signature key and a public key. In addition, the method according to the first embodiment does not have a step of outputting the signature key to the outside of the own device, and the digital signature device that executes the method according to the first embodiment voluntarily outputs the signature key to the own device. It does not output to the outside of. In other words, by causing the digital signature device to execute the method according to the first embodiment, it is not possible for the digital signature device to output the signature key generated inside the digital signature device to the outside of the digital signature device. Therefore, according to the method according to the first embodiment, the signature key generated in the digital signature device can be confined in the digital signature device. As described above, according to the method according to the first embodiment, since the digital signature device generates the signature key inside the own device and does not output the signature key to the outside of the own device, the signature key may be leaked. Can be reduced. Therefore, for example, it is possible to suppress the possibility that the digital signature is illegally made or the digital signature by the legitimate signer is denied, and it is possible to prevent the credibility of the digital signature itself from being lowered.

(Tamper resistance)
The digital signature device preferably has tamper resistance. By doing so, in addition to the above-mentioned digital signature device not voluntarily outputting the signature key to the outside of the own device, it is also possible to suppress forcibly reading the signature key from the digital signature device. Therefore, the leakage of the signature key can be further suppressed.

The device having tamper resistance can include, for example, any one or more of the devices (1) to (5).
(1) A device that immediately stops operation when it detects a change in voltage, current, power, or frequency applied to its own device.
(2) A device that immediately stops operation when it detects a change in the electrical characteristics, temperature characteristics, or optical characteristics of its own device.
(3) A device that is shielded so that physical quantities such as voltage, current, power, frequency, and electromagnetic waves do not leak from its own device.
(4) A device in which the number of times a signal is input to the own device is limited. (5) By changing the temperature, humidity, and electromagnetic waves outside the own device, the own device may malfunction or malfunction, and the result may be induced. A device that is implemented so as not to give a means to illegally obtain the signature key inside the own device from the information obtained.

[Method according to Embodiment 2]
Subsequently, the method according to the second embodiment will be described. In the method according to the second embodiment, preferable conditions for executing the above-mentioned generation step (S10) and storage step (S20) will be described.

(External command)
The generation step (S10) is preferably executed when a command is input from the outside of the digital signature device. Similarly, the storage step (S20) is preferably executed when a command is input from the outside of the digital signature device. External commands are, for example, when the signature key and public key are first generated in the digital signature device, or when an emergency such as system intrusion or information leakage occurs, the verifier, the user, or these. It can be input to the digital signature device when a request for renewal of the signature key is received from a person concerned.

(Generation condition, storage condition)
Further, it is preferable that the generation step (S10) is executed when the generation conditions are satisfied. Similarly, the storage step (S20) is preferably executed when the storage conditions are satisfied. The generation condition is a condition in which the success or failure of the digital signature device is judged inside the own device. Similarly, the storage condition is a condition in which the success or failure of the digital signature device is judged inside the own device. By enabling generation and storage not only when an instruction is input from the outside but also when the generation condition and the storage condition are satisfied, the digital signature device can spontaneously generate and store the inside of the digital signature device. It becomes possible to perform memory.

When the public key is generated, the digital signature device transmits the public key to a device of a person who verifies the digital signature using the public key, such as a verification device. If the public key certificate is managed and operated by a CA (Certificate Authority) and the signature key and public key are updated according to the validity period of the public key certificate, the validity period inside the public key certificate A series of key renewal processes, including checking and public key renewal, are exchanged between the CA, the person who digitally signs using the signing key, and the person who verifies the digital signature using the public key. It was. However, when the digital signature device itself updates the signature key and the public key by the method according to the first embodiment, it is not necessary to intervene the CA station, and the person who performs the digital signature using the signature key and the public key By communicating with a person who verifies the digital signature using the above, it is possible to complete the procedure for updating the signature key and the public key. Therefore, for example, the communication overhead at the time of updating can be reduced.

(Counter, timer)
The success or failure of the generation condition and the storage condition can be determined by the digital signature device using a counter or a timer. For example, when a counter is used, it is possible to set as a generation condition or a storage condition that the number of times the digital signature is executed (the number of times the data is digitally signed) reaches a predetermined number of times. When a timer is used, it is possible to set as a generation condition or a storage condition that a predetermined time has elapsed since the last digital signature.

Although the counter and timer can be provided outside the digital signature device, it is preferable to provide the counter and timer inside the digital signature device so that the information of the counter and timer does not leak to the outside of the digital signature device. Providing a counter or timer externally means that the hardware for realizing these is provided outside the digital signature device, and the program for realizing these is executed by the device outside the digital signature device. Providing a counter or timer inside means that the hardware for realizing these is provided inside the digital signature device, and the program for realizing these is executed inside the digital signature device.

Counters and timers can be combined in various ways when setting generation conditions and storage conditions. For example, the following table shows the relationship between how to combine counters and timers and the generation and storage conditions.

As shown in this table, both the generation condition and the storage condition can be determined by using the counter. Further, both the generation condition and the storage condition can be determined by using a timer. Further, the generation condition can be determined by using one of the counter and the timer, and the storage condition can be determined by using the other. Further, both the generation condition and the storage condition can be determined by using the counter and the timer.

Hereinafter, an example in which a digital signature device is made to judge the success or failure of a generation condition or a storage condition by using a counter or a timer to generate and store the data will be described in detail. In the following, Nc indicates the number of times the digital signature is executed, and is incremented by 1 each time the digital signature is executed. The initial value of Nc is not particularly limited, but is, for example, 0. In addition, Tc indicates the date and time when the last digital signature was executed. The initial value of Tc is not particularly limited, but the initial value is, for example, a predetermined date and time. Du indicates the difference between the current time and Tc. That is, Du = current time-Tc. Further, NcGen, NcMax, DuGen, and DuMax are all constants and can be set in advance in the counter or timer. It is assumed that NcGen ≦ NcMax and DuGen ≦ DuMax.

(Case 1 in Table 1)
First, an example of Case 1 in Table 1 will be described. FIG. 2 is a flowchart illustrating an example in which a digital signature device is made to use a counter to determine the success or failure of a generation condition and a storage condition, and to perform generation and storage. As shown in FIG. 2, in this example, the digital signature device is made to check the value of Nc (A11). Then, when the generation condition (Nc = NcGen) is satisfied, the digital signature device is made to execute the generation step (A12). On the other hand, when the storage condition (Nc> NcMax) is satisfied, the digital signature device is made to determine whether or not the digital signature is being executed (A13), and if it is not being executed, the process of storing is executed (A14). Nc is returned to the initial value (A15). If NcGen = NcMax, the process of generating and the process of storing can be executed at substantially the same timing. The flowchart shown in FIG. 2 can be started every time a digital signature is performed, for example.

(Case 2 in Table 1)
Next, an example of Case 2 in Table 1 will be described. FIG. 3A is a flowchart illustrating an example in which a digital signature device is made to judge the success or failure of a generation condition by using a counter and generate, and FIG. 3B is a flowchart in which the digital signature device is made to use a timer to determine the success or failure of a storage condition. It is a flowchart explaining an example which makes it judge and make a memory. As shown in FIG. 3A, in this example, the digital signature device is made to determine whether or not the generation condition (Nc = NcGen) is satisfied (B11), and if it is satisfied, the digital signature device executes the generation step. (B12) and return Nc to the initial value (B13). Further, as shown in FIG. 3B, the digital signature device is made to determine whether or not the storage condition (Du> DuMax) is satisfied (B21), and if so, the digital signature device is executing the digital signature. Whether or not it is determined (B22), the step of storing if it is not being executed is executed (B23), and Tc is set to the current time (B24). The flowchart shown in FIG. 3A can be started every time a digital signature is performed, for example. The flowchart shown in FIG. 3B can be started periodically, for example.

(Case 3 in Table 1)
Next, an example of Case 3 in Table 1 will be described. FIG. 4A is a flowchart illustrating an example in which a digital signature device is made to determine the success or failure of a generation condition using a counter and generation is performed. FIG. 4B is a flowchart in which the digital signature device is made to use a counter and a timer to store conditions. It is a flowchart explaining an example which makes it judge whether or not it succeeds, and makes it memorize. As shown in FIG. 4A, in this example, the digital signature device is made to determine whether or not the generation condition (Nc = NcGen) is satisfied (C11), and if it is satisfied, the digital signature device executes the generation step. (C12). Further, as shown in FIG. 4B, the digital signature device is made to determine whether or not the storage conditions (Du> DuMax and Nc> NcMax) are satisfied (C21), and if so, the digital signature device is digitally used. It is made to judge whether the signature is being executed (C22), to execute the step of storing if it is not being executed (C23), to set Tc to the current time and to return Nc to the initial value (C24). The flowchart shown in FIG. 4A can be started every time a digital signature is performed, for example. The flowchart shown in FIG. 4B can be started periodically, for example.

(Case 4 in Table 1)
Next, an example of Case 4 in Table 1 will be described. FIG. 5A is a flowchart illustrating an example in which a digital signature device is made to determine the success or failure of a generation condition using a timer and generation is performed. FIG. 5B is a flowchart in which the digital signature device is made to use a counter to determine the success or failure of a storage condition. It is a flowchart explaining an example which makes it judge and make a memory. As shown in FIG. 5A, in this example, the digital signature device is made to determine whether or not the generation condition (Du = DuGen) is satisfied (E11), and if it is satisfied, the digital signature device executes the generation step. (E12) and set Tc to the current time (E13). Further, as shown in FIG. 5B, the digital signature device is made to determine whether or not the storage condition (Nc> NcMax) is satisfied (E21), and if so, the digital signature device is executing the digital signature. Whether or not it is determined (E22), the step of storing if it is not being executed is executed (E23), and Nc is returned to the initial value (E24). The flowchart shown in FIG. 5A can be started periodically, for example. The flowchart shown in FIG. 5B can be started every time a digital signature is performed, for example.

(Case 5 in Table 1)
Next, an example of Case 5 in Table 1 will be described. FIG. 6 is a flowchart illustrating an example in which a digital signature device is made to use a timer to determine the success or failure of a generation condition and a storage condition, and to perform generation and storage. As shown in FIG. 6, in this example, the digital signature device is made to determine whether or not Du = DuGen is satisfied (F11). Then, when the generation condition (Nc = NcGen) is satisfied, the digital signature device is made to execute the generation step (F12). Next, the digital signature device is made to determine whether or not the storage condition (Du> DuMax) is satisfied (F13). Then, when the storage condition (Du> DuMax) is satisfied, the digital signature device is made to determine whether or not the digital signature is being executed (F14), and if not, the step of storing the digital signature is executed (F15). Tc is set to the current time (F16). The flowchart shown in FIG. 6 can be started periodically, for example.

(Case 6 in Table 1)
Next, an example of Case 6 in Table 1 will be described. FIG. 7A is a flowchart illustrating an example in which the digital signature device is made to judge the success / failure of the generation condition by using the timer and the generation is performed, and FIG. 7B is made to judge the success / failure of the storage condition by using the counter and the timer. , It is a flowchart explaining an example of making a memory. As shown in FIG. 7A, in this example, the digital signature device is made to determine whether or not the generation condition (Du = DuGen) is satisfied (G11), and if it is satisfied, the digital signature device executes the generation step. Let (G12). Further, as shown in FIG. 7B, the digital signature device is made to determine whether or not the storage conditions (Du> DuMax and Nc> NcMax) are satisfied (G21), and if so, the digital signature device is made to digitally. It is made to judge whether the signature is being executed (G22), to execute the step of storing if it is not being executed (G23), to set Tc to the current time and to return Nc to the initial value (G24). The flowcharts shown in FIGS. 7A and 7B can be started periodically, for example.

(Case 7 in Table 1)
Next, an example of Case 7 in Table 1 will be described. FIG. 8A is a flowchart illustrating an example in which the digital signature device is made to judge the success / failure of the generation condition by using the counter and the timer, and the generation is performed. FIG. 8B is made to judge the success / failure of the storage condition by using the counter. , It is a flowchart explaining an example of making a memory. As shown in FIG. 8A, in this example, the digital signature device is made to determine whether or not the generation conditions (Du = DuGen and Nc = NcGen) are satisfied (H11), and if so, the digital signature device is used. , The process of generating is executed (H12), and Tc is set to the current time (H13). Further, as shown in FIG. 8B, the digital signature device is made to determine whether or not the storage condition (Nc> NcMax) is satisfied (H21), and if so, the digital signature device is executing the digital signature. Whether or not it is determined (H22), the step of storing if it is not being executed is executed (H23), and Nc is returned to the initial value (H24). The flowchart shown in FIG. 8A can be started periodically, for example. The flowchart shown in FIG. 8B can be started every time a digital signature is performed, for example.

(Case 8 in Table 1)
Next, an example of Case 8 in Table 1 will be described. FIG. 9A is a flowchart illustrating an example in which the digital signature device is made to judge the success / failure of the generation condition by using the counter and the timer, and the generation is performed. FIG. 9B is a flowchart in which the success / failure of the storage condition is judged by using the timer. , It is a flowchart explaining an example of making a memory. As shown in FIG. 9A, in this example, the digital signature device is made to determine whether or not the generation conditions (Du = DuGen and Nc = NcGen) are satisfied (I11), and if so, the digital signature device is used. , The step of generating is executed (I12), and Nc is returned to the initial value (I13). Further, as shown in FIG. 9B, the digital signature device is made to determine whether or not the storage condition (Du> DuMax) is satisfied (I21), and if so, the digital signature device is executing the digital signature. Whether or not it is determined (I22), the step of storing if it is not being executed is executed (I23), and Tc is set to the current time (I24). The flowcharts shown in FIGS. 9A and 9B can be started periodically, for example.

(Case 9 in Table 1)
Next, an example of Case 9 in Table 1 will be described. FIG. 10A is a flowchart illustrating an example in which a digital signature device is made to determine the success or failure of a generation condition using a counter and a timer, and generation is performed. FIG. 10B is a flowchart for determining the success or failure of a storage condition using the counter and the timer. It is a flowchart explaining an example which makes a judgment and memory. As shown in FIG. 10A, in this example, the digital signature device is made to determine whether or not the generation conditions (Du = DuGen and Nc = NcGen) are satisfied (J11), and if so, the digital signature device is used. , The step of generating is executed (J12). Further, as shown in FIG. 10B, the digital signature device is made to determine whether or not the storage condition (Du> DuMax and Nc> NcMax) is satisfied (J21), and if it is satisfied, the digital signature device is made to digitally. It is made to judge whether or not the signature is being executed (J22), and if it is not being executed, the process of storing is executed (J23), Tc is set to the current time, and Nc is returned to the initial value (J24). The flowcharts shown in FIGS. 10A and 10B can be started periodically, for example.

An embodiment will be described below. In the embodiment, a system using the digital signature device described above will be described. In these systems, it is preferable to use the digital signature device described above, but other digital signature devices can also be used.

FIG. 11A is a schematic diagram showing a configuration example of the system according to the first embodiment. As shown in FIG. 11A, the system according to the first embodiment is a system in which a user device provided with a digital signature device and a verification device for verifying digitally signed data are connected via a network. Hereinafter, a detailed description will be given.

(User device)
The user device is a device used by the user. The user device can send and receive data to and from other devices (eg, other user devices, verification devices). The user device functions as an interface located between the digital signature device and the other device, outputs the information received from the other device to the digital signature device, and also outputs the information output from the digital signature device (the information output from the digital signature device). Send the public key, etc.) to another device. As the user device, various devices such as smartphones, smart watches, and IC cards can be used. The digital signature device may be used as the user device itself, but in this case, the digital signature device transmits / receives data to / from another device.

(Verification device)
The verification device is the device of the verifier. A verifier is a person who verifies digitally signed data. The verification of digitally signed data is to decrypt the digitally signed data with the signature key using the public key, and if it can be decrypted, it is judged that there is no fraud such as spoofing or data tampering, and if it cannot be decrypted, it is spoofed. Alternatively, it means determining that there is some kind of fraud such as data falsification. Determining whether or not there is spoofing is also called personal authentication.

The verification device may be, for example, (1) the other device in bilateral communication in which the user device and the other device send and receive data, and (2) the user device, the other device, and a third party device. It may be the device of the third party in the three-party communication in which the data is transmitted and received. In the case of (1), the other device itself that communicates with the user device determines whether or not the data received from the user device is fraudulent, such as spoofing or falsification. In the case of (2), there is no fraud such as spoofing or falsification of the data received from the user device by the other device instead of the other device that sends and receives data to and from the user device. Determine if. The other device of (1) includes other user devices, devices of a person who provides a specific service, and the like. Services include electronic payments, online shopping, email and more. For example, when the other device is a device of a person who provides electronic payment, the other device itself verifies whether or not the payment information received from the user device is fraudulent. (2) The third-party device is provided with a digital signature verification service such as a certificate authority (CA) or a device of a person who provides a public key management service (a device that manages multiple public keys). The device of the person who performs as is included. For example, when another device is a device of a person who provides online shopping, the third party's device verifies whether the transaction information received from the user device by the other device is fraudulent. Send the verification result to another device.

(network)
For the network, for example, a public line such as the Internet or a dedicated line can be used.

(Operation example)
FIG. 11B is a sequence diagram illustrating an operation example of the system according to the first embodiment. Hereinafter, an operation example of the system according to the first embodiment will be described with reference to FIG. 11B. It is assumed that the user's public key is stored in the verification device in advance. However, the verification device may acquire the user's public key via the network, for example, at each verification or at a predetermined time interval.

(S101)
First, the verification device transmits data to the user device. This data is preferably data that is not obvious to the user device, such as a random number.

(S102)
Next, the digital signature device of the user device digitally signs the data using the signature key. Specifically, the digital signature device of the user device encrypts the received data using the user's signature key.

(S103)
The user device then sends the digitally signed data to the verification device.

(S104)
Next, the verification device verifies the digital signature attached to the received data by using the public key of the user device. Specifically, if the digitally signed data can be decrypted and decrypted with the user's public key, the user is determined to be the owner of the public key used for decryption (successful personal authentication), and if it cannot be decrypted. It is determined that the user is not the owner of the public key.

According to the first embodiment described above, by verifying the digitally signed data transmitted from the user device, it is possible to confirm whether or not the user of the user device is the owner of the public key used for the verification. ..

FIG. 12A is a schematic diagram showing a configuration example of the system according to the second embodiment. As shown in FIG. 12A, the system according to the second embodiment is a system in which a user device, a verification device including a digital signature device, and an item are connected via a network. Hereinafter, a detailed description will be given.

(User device, verification device, digital signature device, and network)
The configuration of the user device, the verification device, the digital signature device, and the network is the same as that of the first embodiment except that the verification device includes the digital signature device, and thus the description thereof will be omitted.

(item)
An item has a certain relationship with a user, a verifier, or the like. For example, when a service provider's device (eg, credit card company, car maker, home maker, car rental company) is used as the verification device, the item is the service provider's product (eg, credit card, car, etc.). You can use the house before delivery, the car you are renting).

(Operation example)
FIG. 12B is a sequence diagram illustrating an operation example of the system according to the second embodiment. Hereinafter, an operation example of the system according to the second embodiment will be described with reference to FIG. 12B. It is assumed that the user's public key is stored in the verification device in advance. However, the verification device may acquire the user's public key via the network, for example, at each verification or at a predetermined time interval.

(S201)
First, the user device transmits the user ID to the verification device. The user ID is data that identifies the user.

(S202)
Next, the digital signature device of the verification device digitally signs the user ID received from the user device using the user's signature key. Specifically, the user ID is encrypted with the user's signature key.

(S203)
The verification device then sends the digitally signed user ID to the item.

(S204)
The item then stores a digitally signed user ID.

The above is the procedure for pre-memory.

(S205, S206)
After the pre-storage, when the item transmits the digitally signed user ID stored in the own device to the verification device, the verification device verifies the digitally signed user ID. Specifically, if the digitally signed user ID can be decrypted with the user's public key and decrypted, it is determined that there is a certain relationship between the item and the user specified by the user ID obtained by the decryption. To do.

According to the second embodiment, the relationship between the user and the item can be determined by the verification device. For example, by a verification device, a credit card is in the name of a user, a car is owned by a user, a house is to be handed over to a user, and a car is for a user. It is possible to judge that the rental is in progress.

According to Example 2, it is also possible to determine whether the item has a certain relationship with the verifier. For example, when the item is a bag and the verifier is a bag maker, it is possible to determine whether the bag is genuine or fake by verifying the digitally signed user ID.

According to the second embodiment, in the service provided by the verifier, an IC tag or the like (an example of an item) is attached to the property of the user, and the digital signature device is built in the IC tag or the like, thereby causing the owner and its owner. Property can be verified by digital signature verification. It will be possible to perform conventional means such as writing a name on a property or engraving by electronic means.

FIG. 13A is a schematic diagram showing a configuration example of the system according to the third embodiment. As shown in FIG. 13A, the system according to the third embodiment is a system in which a user device including a digital signature device and a verification device and an item are connected via a network. Hereinafter, a detailed description will be given.

(User equipment, verification equipment, digital signature equipment, items, and networks)
The configuration of the user device, the verification device, the digital signature device, the item, and the network is the same as that of the second embodiment except that the user device includes the digital signature device and the verification device, and thus the description thereof will be omitted.

(Operation example)
FIG. 13B is a sequence diagram illustrating an operation example of the system according to the third embodiment. Hereinafter, an operation example of the system according to the third embodiment will be described with reference to FIG. 13B.

(S301)
First, the user device digitally signs the predetermined data using the user's signature key by the digital signature device. Specifically, the predetermined data is encrypted using the user's signature key. The predetermined data is not particularly limited. For the predetermined data, for example, an item ID that identifies the item, a purchase date and time of the item, item information common to all items, and the like can be used.

(S302)
The user device then sends the digitally signed item ID to the item.

(S303)
The user device then stores the item ID, which the item has digitally signed.

The above is the procedure for pre-memory.

(S304, S305)
After pre-storage, when the item transmits a digitally signed item ID to the user device, the verification device of the user device verifies the digital signature attached to the data received from the item. Specifically, if the digitally signed data can be decrypted with the user's public key and decrypted, it is determined that the item has a certain relationship with itself (example: own property).

According to the third embodiment, it is possible to determine whether or not the item has a certain relationship with the user, as in the second embodiment. In particular, Example 3 is suitable for determining whether an item is the property of a user (eg, an umbrella, jacket, shoes).

FIG. 14A is a schematic diagram showing a configuration example of the system according to the fourth embodiment. As shown in FIG. 14A, the system according to the fourth embodiment is a system in which a user device provided with a verification device and an item provided with a digital signature device are connected via a network. Hereinafter, a detailed description will be given.

(User equipment, verification equipment, digital signature equipment, items, and networks)
The configuration of the user device, the verification device, the digital signature device, the item, and the network is the same as that of the second embodiment except that the user device includes the verification device and the item includes the digital signature device, and thus the description thereof will be omitted. ..

(Operation example)
FIG. 14B is a sequence diagram illustrating an operation example of the system according to the fourth embodiment. Hereinafter, an operation example of the system according to the fourth embodiment will be described with reference to FIG. 14B. It is assumed that the public key of the item is stored in the user device in advance. However, the user device may acquire the public key of the item via the network, for example, at each verification or at a predetermined time interval.

(S401)
First, the user device transmits data to the item. For this data, for example, a random number can be used.

(S402)
The item's digital signature device then digitally signs the data using the item's signature key. Specifically, the data is encrypted using the item's signature key.

(S403)
The item then sends digitally signed data to the user device.

(S404)
The user device then uses the item's public key to verify the digital signature attached to the received data. Specifically, the digitally signed data is decrypted with the public key of the item, and if it can be decrypted, it is determined that the item has the public key used for decryption, and if it cannot be decrypted, the item has the public key. Judge that it is not.

According to the fourth embodiment, in addition to the third embodiment, S403 (response) is returned to S401 (dynamic data (challenge) by the user device), so that a static "digitally signed user ID" (S303) should be returned. ) Is stolen, which reduces the possibility of spoofing the item by the amount of elaborateness, and makes it possible to endorse more expensive items.

FIG. 15A is a schematic diagram showing a configuration example of the system according to the fifth embodiment. As shown in FIG. 15A, the system according to the fifth embodiment is a system in which a user device, a verification device, and a digital signature agency device provided with a digital signature device are connected via a network. Hereinafter, a detailed description will be given.

(User device, verification device, digital signature device, and network)
The configuration of the user device, the verification device, the digital signature device, the item, and the network is the same as in the case of the first embodiment, and thus the description thereof will be omitted. The verification device is, for example, a payment terminal installed in a product sales floor or a restaurant.

(Digital signature agency device)
The digital signature agency device is a device that digitally signs with a user's signature key on behalf of the user. The digital signature agency device is provided with, for example, a digital signature device for each user.

(Operation example)
FIG. 15B is a sequence diagram illustrating an operation example of the system according to the fifth embodiment. Hereinafter, an operation example of the system according to the fifth embodiment will be described with reference to FIG. 15B. It is assumed that the public key of the certificate authority is stored in advance in the digital signature agency device. Further, it is assumed that the signature key of the user and the signature key of the digital signature agency device are stored in the digital signature device of the digital signature agency device. Further, it is assumed that the user's public key and the public key of the digital signature agency device are stored in advance in the verification device. The digital signature agency device or verification device acquires the public key of the certificate authority, the user's public key, or the public key of the digital signature agency device via the network, for example, at each verification or at a predetermined time interval. You may.

(S501)
First, the user device transmits a digital signature request to the digital signature agency device. The digital signature request can include, for example, a user ID. In this way, in the digital signature agency device, the user can be easily specified, and which digital signature device inside the own device is used can be specified.

(S502)
Next, the verification device transmits data to the digital signature agency device. For this data, for example, a random number can be used.

(S503)
Next, the digital signature device of the digital signature agency device digitally signs the data using the user's signature key. Specifically, the data is encrypted using the user's signature key.

(S504)
Next, the digital signature agency device transmits the digitally signed data to the verification device.

(S505)
Next, the verification device verifies the digital signature attached to the received data using the user's public key. Specifically, the digitally signed data is decrypted with the user's public key, and if it can be decrypted, it is determined that the digital signature has been performed with the user's signature key.

(S506)
Next, the user device transmits the public key of the digital signature agency device digitally signed with the signature key of the certificate authority to the digital signature agency device.

(S507)
Next, the digital signature agency device verifies the public key of the digital signature agency device digitally signed with the signature key of the certificate authority using the public key of the certificate authority. Specifically, if the public key of the digital signature agency device digitally signed with the signature key of the certificate authority can be decrypted with the public key of the certificate authority and decrypted, the user is digitally signed with the signature key of the certificate authority. Judge that you have the public key of the digital signature agency device.

(S508)
Next, the digital signature agency device transmits the verification result to the verification device.

(S509)
Next, the user device transmits the public key of the user digitally signed by the signature key of the digital signature agency device to the verification device.

(S510)
Next, the verification device verifies the public key of the user digitally signed by the signature key of the digital signature agency using the public key of the digital signature agency. Specifically, if the public key of the user digitally signed by the signature key of the digital signature agency device can be decrypted and decrypted by the public key of the digital signature agency device, the user is digitally signed by the signature key of the digital signature agency device. It is determined that the user has the public key.

The verification device is, for example, a payment terminal installed in a product sales floor or a restaurant, and if there is no problem with all the verification results, payment is executed. That is, the digital signature is performed by the user's signature key, the user has the public key of the digital signature agency device digitally signed by the certificate authority's signature key, and the user signs the digital signature agency device. If the user has the public key digitally signed by the key, the payment is executed.

According to the fifth embodiment, the user can implement the digital signature service in the cloud environment by using the signature key managed by the digital signature agency device.

This embodiment is a "thin-client" type system configuration in which digital signature devices for storing a user's signature key are aggregated on a server. In this system configuration, for example, the device of the user and the digital signature agent (digital signature agent) has an agreement in advance that the digital signature agent performs digital signature with the user's signature key on behalf of the user. .. This may be, for example, that the application is already installed on the user device, and the user executes the application on the user device to make an agreement between the user and the digital signature agent. The application is, for example, an application that executes a payment using a two-dimensional code, an application that executes another electronic money payment, or an application that executes a credit card payment.

FIG. 16A is a schematic diagram showing the system according to the sixth embodiment. As shown in FIG. 16A, the system according to the sixth embodiment includes an IC card, a reader / writer, a controller, a database connected to the controller, and an electric lock connected to the controller. The IC card is an example of a user device and includes a digital signature device. This embodiment can be applied to opening and closing an electric lock in a door provided in a house or a building, for example.

(Controller, reader / writer, database, electric lock)
The controller is an example of a verification device, and is provided with a public key of an IC card in advance. The reader / writer acts as an interface between the IC card and the controller. The public key of the IC card is stored in the database. The electric lock opens and closes according to the command of the controller.

(Operation example)
FIG. 16B is a sequence diagram illustrating an operation example of the system according to the sixth embodiment. Hereinafter, an operation example of the system according to the sixth embodiment will be described with reference to FIG. 16B. Although the reader / writer is not shown in FIG. 16B, the IC card and the controller communicate with each other via the reader / writer.

(S601)
When the IC card is held over the reader / writer, the controller transmits data to the IC card. This data is preferably not obvious to the IC card, for example, a random number.

(S602)
Next, the IC card digitally signs the received data by the digital signature device. Specifically, the received data is encrypted by the signature key generated by the digital signature device.

(S603)
Next, the IC card transmits the digitally signed data to the controller.

(S604, S605)
The controller then validates the digitally signed data. Specifically, the controller reads the public key from the database and uses it to decrypt the digitally signed data. If it can be decrypted, the IC card is deemed to have the authority to unlock the electric lock, and the electric lock is unlocked. On the other hand, if it cannot be decrypted, the IC card does not unlock the electric lock because it does not have the authority to unlock it.

(S606)
Next, the IC card generates a signature key and a public key by the digital signature device, and stores the generated signature key in the storage area in the digital signature device.

(S607)
Next, the IC card transmits the generated public key to the controller.

(S608)
The controller then stores the received public key in the database.

According to this embodiment, since the signature key and the public key are generated and stored every time the electric lock is opened and closed, the key for opening the electric lock (signature key) is updated every time the electric lock is opened and closed. Can be (replaced). Therefore, the security for opening and closing the electric lock can be enhanced. That is, in this embodiment, each time the electric lock is opened and closed, the signature key and the public key are updated, and the previously generated and stored signature key is deleted from the storage area or remains stored in the storage area. If it is made unusable and the electric lock can be opened and closed only by using the newly generated and stored signature key after the update, the security regarding the opening and closing of the electric lock can be enhanced. Such a process of updating (replacing) the signature key and the public key each time the electric lock is opened and closed is practically impossible when the CA station intervenes, but it is easily realized according to the present embodiment. be able to.

According to this embodiment, it is possible to realize an entry / exit system using an IC card that requires a high security grade for entry / exit. Prior to entering and leaving the room, the operator holds the IC card over the reader / writer, and the reader / writer has a DB in which the controller that unlocks the electric lock of the door stores the public key of the IC card, and the operator has the IC card. When the reader / writer is held over the reader / writer, the reader / writer side becomes the service provider (verifier), the IC card side becomes the service user (signer), and the reader / writer side executes the signature verification protocol on the IC card side. In the high security grade entry / exit system, the key pair of the signature key and the public key of the IC card is updated every time the IC card is held up. As a result, each time the IC card is held up, signature verification is performed with the signature keys of different IC cards. By continuing to use the same signature key without updating it, a third party who intercepts the signature verification protocol here will be given a hint to the numerical value of the signature key, so the key update mechanism shown here. By introducing, it is possible to secure a high level of security. That is, a conventionally known attack on a public key cryptosystem is a method of estimating a key from output characteristics for a system in which the same key pair repeatedly outputs various ciphertexts, so that a specific key pair outputs. The smaller the amount of information in the ciphertext, the stronger the defense against the known attack method.

FIG. 17A is a schematic diagram showing an example of the configuration of the hardware wallet. It is the management of the signature key and public key for each wallet of virtual currency such as Bitcoin. It is said that it is desirable to have a large number of wallets and use different wallets for each payment because the risk of being attacked is lower if the payment of virtual currency is dispersed in a small amount. The digital signature device of the seventh embodiment is mounted in, for example, a non-contact IC card, and communicates with M digital signature devices and a reader / writer mounted on a higher-level device "hardware wallet". The hardware wallet executes a digital signature and sends a public key based on a request from a higher-level virtual currency application. In addition, N signature keys can be stored in one IC card, and by using M units at the same time, a maximum of M signature keys and signature keys of each N generation can be used together for operation. In virtual currency, when used with distributed ledger technology (Distributed Ledger Technology) such as blockchain, the past signature key is reflected in the past ledger, so as long as the operation of ledger management continues, the signature key used in the past will be reflected in the past ledger. , May be obliged to keep at the signer's responsibility. For such an operation mode, the signature key may be stored and stored in one non-contact IC card each time it is updated, and it may be operated so that it can be updated up to N generations. Further, a plurality of digital signature devices may be mounted on one non-contact IC card.

FIG. 17B is a schematic diagram showing an example of the function of the hardware wallet. Of the signature key and public key pair generated inside the digital signature device of the non-contact IC card, when the public key is output, it is stored in the hardware wallet. Here, for example, if an index index-key # 11 is attached to the first public key pub-11 of the first non-contact IC card and each public key is managed by the index, the public key of the non-contact IC card can be obtained. It becomes easy to relate to the substance of. Also, when specifying a public key entry on a higher-level virtual currency application, use a passphrase instead of the numerical value of the public key itself to simplify the handling of the public key. Therefore, the public key and passphrase should be associated and stored in the hardware wallet.

FIG. 17C is a diagram (No. 1) for explaining the effect of updating the signature key. In virtual currency using distributed ledger technology such as blockchain, the signature key is used at the user's responsibility. On the other hand, virtual currencies follow the history of currencies such as the gold standard, and the credit of currency value over many years is used as an index as a good currency, so it is inevitably signed because it is premised on long-term operation. Keys can be lost, stolen or leaked. Since it is possible to trade the value of virtual currency by digital signature using the signature key, if the signature key suddenly becomes unusable, the corresponding value transaction cannot be performed after that point. In the example shown in FIG. 17C, since the basic operation related to the update can be performed inside the digital signature device that stores the signature key, when the signature key is updated, the virtual currency side is requested to update the public key. By doing so, the virtual currency side can know the update of the signature key. Therefore, by having a means for generating a public key on the virtual currency side, it is possible to update the public key and continue operation while maintaining the value.

FIG. 17D is a diagram (No. 2) for explaining the effect of updating the signature key. Instead of updating the public key on the virtual currency side, it is possible to transfer the value and disable the signature key that can no longer be used due to loss, leakage, theft, etc. Such a method on the virtual currency side is directly linked to the issue of how to handle the virtual currency, and based on the basic idea of the virtual currency itself, the supply amount by PoW (Proof Of Work) and PoS (Proof Of Stake) in the virtual currency. , Speed, fairness, etc., so the renewal means provided in the present invention may be adopted in light of the above problems.

According to the present embodiment described above, since the signature key can be used for a digital signature from the time of generation to the expiration of the usage period including the time of renewal without the need for duplication, the "signature key duplication" originally required for digital signatures is required. It becomes possible to satisfy "not recommended". In addition, since the restrictive consent for using the service associated with duplicating the signature key is not required, the service can be used even by the service user who cannot accept this, and the quality of the service is improved. .. In addition, the user can independently update the signature key, and the service user can independently update the password of the service user in the same way as the password update of the service user in the conventional Web service. The quality improves. In addition, by using the digital signature device, which is the user's hardware device, as the storage location for the signature key, it is possible to realize a mechanism that can automatically update the numerical value of the signature key without anyone knowing it. Key handling is easier and the quality of service is improved. Further, the location of the signature key is specified in one place of the digital signature device such as the user's IC card, and the update is also executed in the storage location of the signature key, for example, inside the same digital signature device, and after the update. The public key is taken out of the storage location, and the entire life cycle from the generation, update, and deletion of the signature key, which is confidential information, is limited to one place. In other words, the flow of the signature key and public key throughout the entire life cycle is simple, the reliability of the uniqueness of the signature key in digital signatures is improved, and at the same time, complicated processing is numerically concealed (black) at the time of storage or update. Since it is a mechanism that is executed in a boxed state, it is suitable for automatic control, for example, the validity period of the public key certificate, the signature key, the numerical value of the public key itself, etc. should be edited directly. This is an excellent method compared to the control method that can induce various human errors. Also, while the signing key is hidden throughout the entire life cycle, the public parameter is the public key, and even if the public key is made public, it is difficult to estimate the signing key from the public key cryptography. It can be applied to any algorithm as long as it is a method, and it is an excellent method in that it does not depend on the algorithm of the cryptographic engine and the number of key bits exceeding the number of bits recommended by the algorithm.

FIG. 19A is a diagram showing an example in which a public key and user information are stored in association with each other, and FIG. 19B is a flowchart showing an example in which user information is specified by comparing public keys. As shown in FIG. 19A, in a device that stores the public key in association with user information, or in a device that can access this device, the step (K11) in which the public key is input and the public key are stored in association with each other. By executing the step (K12) of outputting the user information, it is possible to specify the user information associated with the public key. Therefore, it is possible to easily identify the user of a certain public key, whether or not the public key that is about to be used as one's own is already used by someone else. Is the same public key as the public key input in step K11 stored in association with the user information instead of or together with the step (K12) of outputting the user information stored in association with the public key? It is also possible to output the judgment result (output of information indicating that it is used or not used). The hash value of the public key can be stored in the user information in place of the public key or together with the public key. In this case, in this paragraph and in FIGS. 19A and 19B, "public key" can be read and understood as "public key and / or hash value of public key". For example, in step K11 of FIG. 19B, the hash value of the public key can be input in place of the public key or together with the public key, and in step K12, it is stored in association with the hash value of the public key. User information can be output. User information refers to information about a user, such as a user's name and user ID.

Although the embodiments have been described above, the configurations described in the claims are not limited by these explanations.

Claims (8)

1. The way digital signature devices perform
   The process of generating one or more pairs of signing and public keys,
   It has a step of storing the generated signature key in a storage area in the digital signature device.
   A method that does not include a step of outputting the signature key to the outside of the digital signature device.
2. The generation step is executed in each of the case where a command is input from the outside of the digital signature device and the case where the generation condition for determining success or failure is satisfied inside the digital signature device.
   The storage step is executed in claim 1 when a command is input from the outside of the digital signature device and when a storage condition for determining success or failure is satisfied inside the digital signature device. The method described.
3. A program that causes the digital signature device to execute the method according to claim 1 or 2.
4. A digital signature device that performs the method according to claim 1 or 2.
5. A user device provided with the digital signature device according to claim 4.
6. A verification device that verifies the digital signature using the public key generated by the digital signature device according to claim 4.
7. A system including the user device according to claim 5 and the verification device according to claim 6.
8. A system in which the program according to claim 3 is transmitted to the digital signature device via a network.
   
   

Images