WO2023188218A1

WO2023188218A1 - Signature control method, signature control program, information processing device, and system

Info

Publication number: WO2023188218A1
Application number: PCT/JP2022/016365
Authority: WO
Inventors: 陸大小嶋; 泰久奥村; 哲也伊豆; 和明二村; 秀暢小栗
Original assignee: 富士通株式会社
Priority date: 2022-03-30
Filing date: 2022-03-30
Publication date: 2023-10-05

Abstract

An information processing device (100) acquires, from a management device (101), an original verification key (112) and a second signature key (131). The information processing device (100) receives, from a first device (102), a first signature (142) using a first signature key (121) for confidential data (141). The information processing device (100) generates, for the received first signature (142), a second signature (143) using the acquired second signature key (131). The information processing device (100) uses a prescribed signature function, for example, to generate, for the received first signature (142), the second signature (143) using the acquired second signature key (131). The information processing device (100) transmits the generated second signature (143) to the first device (102). The information processing device (100) transmits the acquired original verification key (112) to a second device (103) that verifies the second signature (143).

Description

Signature control method, signature control program, information processing device, and system

The present invention relates to a signature control method, a signature control program, an information processing device, and a system.

Conventionally, in order to prevent document information from being tampered with, an electronic signature using a signature key is sometimes attached to document information. Here, in order to reduce the work burden on the signer in managing the generation and revocation of the signature key, the signer outsources the management of the signature key and the assignment of electronic signatures to the data to an external server. There is a remote signature method that does this.

As a prior art, for example, a server device performs a first encryption on a hash value of an electronic document using a first split key to generate encrypted data, and another server device performs a second encryption on the encrypted data. There is a system that generates signature data by performing second encryption using a split key.

Japanese Patent Application Publication No. 2010-154098

However, with the conventional technology, it may not be possible to ensure the reliability of electronic signatures. For example, a signature key may be leaked to an attacker from an external server. For example, data that requests an external server to add a digital signature may be intercepted and tampered with by an attacker. For example, an administrator of an external server may be the attacker.

In one aspect, the present invention aims to improve the reliability of signatures.

According to one embodiment, the second signature key is obtained from a management device that has a combination of a first signature key and a second signature key that makes it possible to generate the same signature as the original signature key, and the second signature key is anonymized. Receive a first signature on data using the first signature key from a first device having the first signature key, and generate a second signature using the acquired second signature key for the received first signature. , a signature control device, a signature control method, and a signature control program for transmitting the generated second signature to the first device are proposed.

According to one aspect, it is possible to improve the reliability of signatures.

FIG. 1 is an explanatory diagram showing an example of the signature control method according to the embodiment. FIG. 2 is an explanatory diagram showing an example of the signature control system 200. FIG. 3 is a block diagram showing an example of the hardware configuration of the information processing device 100. FIG. 4 is an explanatory diagram showing an example of the stored contents of the key management table 310. FIG. 5 is a block diagram showing an example of the hardware configuration of the key management device 201. FIG. 6 is a block diagram showing an example of the hardware configuration of the signing device 202. As shown in FIG. FIG. 7 is a block diagram showing an example of the hardware configuration of the verification side device 203. FIG. 8 is a block diagram showing an example of the functional configuration of the signature control system 200. FIG. 9 is an explanatory diagram showing an example of a blind signature method. FIG. 10 is an explanatory diagram (part 1) showing operation example 1 of the signature control system 200. FIG. 11 is an explanatory diagram (part 2) showing operation example 1 of the signature control system 200. FIG. 12 is a sequence diagram (part 1) showing an example of the registration processing procedure. FIG. 13 is a sequence diagram (part 2) showing an example of the registration processing procedure. FIG. 14 is a sequence diagram (part 1) showing an example of the signature processing procedure. FIG. 15 is a sequence diagram (part 2) showing an example of the signature processing procedure.

Embodiments of a signature control method, a signature control program, an information processing device, and a system according to the present invention will be described in detail below with reference to the drawings.

(An example of the signature control method according to the embodiment)
FIG. 1 is an explanatory diagram showing an example of the signature control method according to the embodiment. The information processing device 100 is a computer for improving the reliability of signatures. The signature is an electronic signature. The signature is defined by, for example, RSA (Rivest Shamir Adleman) cryptography.

Conventionally, in order to prevent document information from being tampered with, an electronic signature using a signature key is sometimes attached to document information. Here, in order to reduce the work burden on the signer in managing the generation and revocation of the signature key, the signer outsources the management of the signature key and the assignment of electronic signatures to the data to an external server. There is a remote signature method that does this. The remote signature method is defined, for example, in Reference 1 below.

Reference 1: “Document 4 Overview of remote signatures and last year's study results”, [online], September 29, 2016, Electronic Signature Law Study Group (1st meeting in 2016), [March 2021] 22nd search], Internet <URL: https://www. meti. go. jp/committee/kenkyukai/shoujo/denshishomeihou/pdf/h28_001_04_00. pdf＞

For example, one possible method is for the signer to upload the data itself to an external server. For example, an external server accepts the data itself, generates an electronic signature on the accepted data using a signature key, attaches the generated electronic signature to the data, and signs the data with the electronic signature attached. It will be provided to the person. This method may not ensure data security. For example, there is a problem that data may be leaked to an external server. For example, data may be leaked to an attacker from an external server.

On the other hand, a possible method is for the signer to upload the hash value of the data to an external server instead of the data itself. For example, an external server accepts a hash value of data, generates an electronic signature for the accepted hash value using a signature key, attaches the generated electronic signature to the hash value, and attaches an electronic signature. The hash value will be provided to the signer. With this method, it may not be possible to ensure the reliability of the electronic signature.

For example, a signature key may be leaked to an attacker from an external server. For example, the hash value of data for which an external server is requested to add a digital signature may be intercepted and tampered with by an attacker, or may be intercepted by an attacker and replaced with a hash value of fraudulent data. For example, an administrator of an external server may be the attacker. As a result, the signer may receive a hash value of fraudulent data that has been given an electronic signature.

Therefore, in this embodiment, a signature control method that can improve the reliability of signatures will be described.

In FIG. 1, an information processing device 100 can communicate with a management device 101, a first device 102, and a second device 103. The management device 101 has an original verification key 112 corresponding to the original signature key 111 and a combination of a first signature key 121 and a second signature key 131 forming the original signature key 111. It is assumed that the signature by the original signature key 111 and the signature by the combination of the first signature key 121 and the second signature key 131 are the same signature. The original verification key 112 is a key that allows the signature created by the original signature key 111 to be verified, and is a key that allows the signature created by the combination of the first signature key 121 and the second signature key 131 to be verified.

It is considered that a first verification key 122 corresponding to the first signature key 121 exists. The first verification key 122 is a key that allows the signature by the first signature key 121 to be verified. The management device 101 does not need to have the first verification key 122. It is considered that a second verification key 132 corresponding to the second signature key 131 exists. The second verification key 132 is a key that allows the signature by the second signature key 131 to be verified. The management device 101 does not need to have the second verification key 132.

The first device 102 is capable of communicating with the management device 101, for example. The first device 102 obtains the first signature key 121 from the management device 101, for example. The first device 102 generates a first signature 142 using the first signature key 121 for the anonymized data 141, for example. Specifically, the first device 102 performs a masking process on the target data, generates masked data 141 corresponding to the target data, and uses a predetermined signature function to generate the generated masked data. 141, a first signature 142 is generated using the first signature key 121. The anonymization process is, for example, a hash function. For example, the first device 102 transmits the generated first signature 142 to the information processing device 100. Specifically, the first device 102 may transmit the anonymized data 141 to which the first signature 142 is attached to the information processing device 100.

(1-1) The information processing device 100 obtains the original verification key 112 and the second signature key 131 from the management device 101.

(1-2) The information processing device 100 receives the first signature 142 based on the first signature key 121 on the anonymized data 141 from the first device 102 having the first signature key 121. For example, the information processing device 100 may receive the anonymized data 141 to which the first signature 142 is attached from the first device 102 .

Thereby, the information processing device 100 can obtain information useful for generating a signature based on the combination of the first signature key 121 and the second signature key 131 without referring to the first signature key 121. In the information processing apparatus 100, the first apparatus 102 can avoid disclosing the first signature key 121 and can conceal the first signature key 121.

(1-3) The information processing device 100 generates a second signature 143 based on the acquired second signature key 131 for the received first signature 142. The information processing apparatus 100 generates a second signature 143 based on the acquired second signature key 131 for the received first signature 142, for example, using a predetermined signature function. Thereby, the information processing device 100 can obtain a signature based on the combination of the first signature key 121 and the second signature key 131 that can be verified using the original verification key 112 without referring to the first signature key 121. .

(1-4) The information processing device 100 transmits the generated second signature 143 to the first device 102. Thereby, the information processing device 100 can make the generated second signature 143 usable by the first device 102. For example, the information processing device 100 can make the generated second signature 143 available by associating it with the anonymized data 141 or the target data. For example, the first device 102 may transmit target data to which the second signature 143 is attached to the second device 103.

(1-5) The information processing device 100 transmits the acquired original verification key 112 to the second device 103 that verifies the second signature 143. Thereby, the information processing device 100 can enable the second device 103 to verify the second signature 143. In this way, the information processing device 100 can generate the first signature key 121 and the second signature key 131 that can be verified using the original verification key 112 without referring to the target data itself and without referring to the first signature key 121. A second signature 143 can be generated by a combination of the following. Then, the information processing device 100 can enable the first device 102 to use the second signature 143. The information processing device 100 can enable the second device 103 to verify the second signature 143.

Therefore, the information processing device 100 can make the first signature key 121 confidential, and can improve the reliability of the second signature 143. The information processing device 100 can prevent the first signature key 121 from being leaked to an attacker. The information processing device 100 can make it difficult for an attacker to intercept the first signature 142 and falsify the first signature 142 or replace the first signature 142 with a fraudulent signature. The information processing device 100 can make it difficult to illegally generate the first signature 142 even if the user of the device is an attacker.

Here, a case has been described in which the first device 102 is a device different from the management device 101 and can communicate with the management device 101, but the present invention is not limited to this. For example, the first device 102 may be the same device as the management device 101. In this case, the first device 102 has an original verification key 112 corresponding to the original signature key 111 and a combination of the first signature key 121 and the second signature key 131 forming the original signature key 111.

Here, a case has been described in which the information processing device 100 acquires at least the original verification key 112 and the second signature key 131 from the management device 101, but the present invention is not limited to this. For example, the information processing device 100 may further acquire the first verification key 122 from the management device 101. Thereby, the information processing device 100 can verify the first signature 142, and can improve security.

Here, a case has been described in which the information processing device 100 transmits the original verification key 112 to the second device 103, but the present invention is not limited to this. For example, the management device 101 may transmit the original verification key 112 to the second device 103. For example, the first device 102 may receive the original verification key 112 from the management device 101 and transmit it to the second device 103.

Although the case where the information processing device 100 operates independently has been described here, the present invention is not limited to this. For example, a plurality of computers may cooperate to realize the functions of the information processing device 100. For example, the functions of the information processing device 100 may be implemented on the cloud.

(Example of signature control system 200)
Next, an example of a signature control system 200 to which the information processing apparatus 100 shown in FIG. 1 is applied will be described using FIG. 2.

FIG. 2 is an explanatory diagram showing an example of the signature control system 200. In FIG. 2, the signature control system 200 includes an information processing device 100, one or more key management devices 201, one or more signing devices 202, and one or more verification devices 203.

In the signature control system 200, the information processing device 100 and the key management device 201 are connected via a wired or wireless network 210. The network 210 is, for example, a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, or the like.

In the signature control system 200, the information processing device 100 and the signature side device 202 are connected via a wired or wireless network 210. In the signature control system 200, the information processing device 100 and the verification device 203 are connected via a wired or wireless network 210. In the signature control system 200, a key management device 201 and a signing device 202 are connected via a wired or wireless network 210. In the signature control system 200, a signing device 202 and a verifying device 203 are connected via a wired or wireless network 210.

The key management device 201 is a computer that manages signature keys. The key management device 201 is used, for example, by a signer.

The key management device 201 generates an original key pair. An original key pair is a combination of an original signing key and an original verification key. The original signature key corresponds to the original signature key 111 shown in FIG. The original verification key corresponds to the original verification key 112 shown in FIG.

The key management device 201 generates a protection key pair. A protection key pair is a combination of a protection signature key and a protection verification key. The protected signature key corresponds to the first signature key 121 shown in FIG. The protection verification key corresponds to the first verification key 122 shown in FIG. The key management device 201 generates a escrow signature key. The escrow signature key corresponds to the second signature key 131 shown in FIG. The key management device 201 generates an escrow signature key so that an original signature key can be formed by combining the protected signature key and the escrow signature key.

The key management device 201 provides at least the protected signature key to the signing device 202.

The key management device 201 provides at least the entrusted signature key to the information processing device 100. The key management device 201 may further provide the information processing device 100 with a protection verification key. For example, the key management device 201 may provide the protection verification key to the information processing device 100 via the signing device 202. The key management device 201 may further provide the original verification key to the information processing device 100. The key management device 201 is, for example, a server or a PC (Personal Computer).

The signing device 202 is a computer that generates a protected signature using a protected signature key. The protection signature corresponds to the first signature shown in FIG. Signing side device 202 is used, for example, by a signer.

The signing device 202 receives the protected signature key from the key management device 201. The signature side device 202 has anonymized data obtained by performing an anonymization process on the target data. For example, the signature side device 202 performs an anonymization process on the target data to generate anonymization data. For example, the signature side device 202 may receive anonymized data obtained by performing an anonymization process on the target data from another computer. Signing side device 202 generates a protection signature for anonymized data using a protection signature key.

The signing device 202 transmits the generated protected signature to the information processing device 100. For example, the signing device 202 may transmit the anonymized data to which the generated protection signature has been added to the information processing device 100. The signing device 202 receives the entrusted signature based on the entrusted signature key for the protected signature from the information processing device 100 . Signing side device 202 transmits the escrow signature based on the escrow signature key for the protected signature to verification side device 203 . For example, the signing device 202 transmits the target data to which the deposited signature has been attached to the verification device 203. The signature side device 202 is, for example, a PC, a tablet terminal, or a smartphone.

The information processing device 100 is a computer that generates a deposited signature using a deposited signature key. The escrow signature corresponds to the second signature shown in FIG. The information processing device 100 is used, for example, by a system administrator of the signature control system 200.

The information processing device 100 receives the entrusted signature key from the key management device 201. The information processing device 100 may receive the protection verification key from the key management device 201. The information processing device 100 may receive the original verification key from the key management device 201. The information processing device 100 receives the protection signature from the signing device 202. For example, the information processing device 100 may receive anonymized data to which a protection signature is attached from the signing device 202.

If the information processing device 100 has received the protection verification key, it may verify whether the protection signature is valid based on the protection verification key. If the protected signature is not valid, the information processing device 100 discards the protected signature. The information processing apparatus 100 generates a escrow signature using the escrow signature key for the protected signature. The information processing device 100 transmits the generated entrusted signature to the signing device 202. The information processing device 100 transmits the original verification key to the verification side device 203. The information processing device 100 is, for example, a server or a PC.

The verifying device 203 receives the escrow signature from the signing device 202. The verification side device 203 is used, for example, by a verifier.

For example, the verification side device 203 receives target data to which a deposited signature has been attached from the signature side device 202. Verification side device 203 obtains the original verification key. The verification device 203 receives, for example, the original verification key from the information processing device 100. The verification device 203 verifies whether the deposited signature is valid based on the original verification key. The verification side device 203 discards the target data if the deposited signature is not valid. The verification device 203 is, for example, a PC, a tablet terminal, or a smartphone.

Here, a case has been described in which the key management device 201 provides the original verification key to the information processing device 100 so that the verification side device 203 can obtain the original verification key, but the present invention is not limited to this. For example, the key management device 201 may provide the original verification key to the verification device 203 via the signing device 202. For example, the key management device 201 may directly provide the original verification key to the verification device 203.

Here, a case has been described in which the key management device 201 is a device different from the signing device 202, but the present invention is not limited to this. For example, the signing device 202 may have a function as the key management device 201 and can also operate as the key management device 201. Here, a case has been described in which the signing device 202 is a device different from the verifying device 203, but the present invention is not limited to this. For example, there may be a case where the signing device 202 has the function of the verifying device 203 and can also operate as the verifying device 203.

(Example of hardware configuration of information processing device 100)
Next, an example of the hardware configuration of the information processing device 100 will be described using FIG. 3.

FIG. 3 is a block diagram showing an example of the hardware configuration of the information processing device 100. In FIG. 3, the information processing apparatus 100 includes a CPU (Central Processing Unit) 301, a memory 302, a network I/F (Interface) 303, a recording medium I/F 304, and a recording medium 305. Further, each component is connected to each other by a bus 300.

Here, the CPU 301 controls the entire information processing device 100. The memory 302 includes, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), a flash ROM, and the like. Specifically, for example, a flash ROM or ROM stores various programs, and a RAM is used as a work area for the CPU 301. The program stored in the memory 302 is loaded into the CPU 301 and causes the CPU 301 to execute the coded processing.

The memory 302 stores, for example, a protection verification key, an escrow signature key, and an original verification key in association with each other for each signing device 202. The protection verification key is, for example, a protection verification key corresponding to the protection signature key provided to the signing device 202. The escrow signature key is, for example, an escrow signature key that is combined with a protected signature key provided to the signing device 202. The original signature key is, for example, an original verification key that corresponds to an original signature key that makes it possible to generate a signature identical to the combination of the protected signature key and the escrow signature key. Specifically, the memory 302 stores a key management table 310, which will be described later in FIG.

The network I/F 303 is connected to a network 210 through a communication line, and is connected to other computers via the network 210. The network I/F 303 serves as an internal interface with the network 210, and controls data input/output from other computers. The network I/F 303 is, for example, a modem or a LAN adapter.

The recording medium I/F 304 controls reading/writing of data to/from the recording medium 305 under the control of the CPU 301. The recording medium I/F 304 is, for example, a disk drive, an SSD (Solid State Drive), a USB (Universal Serial Bus) port, or the like. The recording medium 305 is a nonvolatile memory that stores data written under the control of the recording medium I/F 304. The recording medium 305 is, for example, a disk, a semiconductor memory, a USB memory, or the like. The recording medium 305 may be removable from the information processing apparatus 100.

In addition to the components described above, the information processing device 100 may include, for example, a keyboard, a mouse, a display, a printer, a scanner, a microphone, a speaker, and the like. Further, the information processing apparatus 100 may include a plurality of recording medium I/Fs 304 and recording media 305. Further, the information processing apparatus 100 does not need to have the recording medium I/F 304 or the recording medium 305.

(Stored contents of key management table 310)
Next, an example of the storage contents of the key management table 310 will be explained using FIG. 4. The key management table 310 is realized, for example, by a storage area such as the memory 302 or the recording medium 305 of the information processing apparatus 100 shown in FIG. 3.

FIG. 4 is an explanatory diagram showing an example of the stored contents of the key management table 310. As shown in FIG. 4, the key management table 310 has fields of plug-in ID, protection verification key, escrow signature key, and original verification key. In the key management table 310, key management information is stored as a record 400-a by setting information in each field for each signing device 202. a is any integer.

A plug-in ID, which is identification information for identifying the browser plug-in possessed by the signing device 202, is set in the plug-in ID field. A protection verification key is set in the protection verification key field. For example, a protection verification key corresponding to the protection signature key provided to the signing device 202 is set in the protection verification key field. The protection verification key is provided, for example, from the key management device 201.

The escrow signature key is set in the escrow signature key field. In the escrow signature key field, for example, a escrow signature key to be combined with the protected signature key provided to the signing device 202 is set. The escrow signature key is provided, for example, from the key management device 201. The original verification key is set in the original verification key field. In the original verification key field, for example, an original verification key that enables generation of the same signature as the combination of the protected signature key provided to the signing device 202 and the escrow signature key is set. The original verification key is provided, for example, from the key management device 201.

(Example of hardware configuration of key management device 201)
Next, an example of the hardware configuration of the key management device 201 will be described using FIG. 5.

FIG. 5 is a block diagram showing an example of the hardware configuration of the key management device 201. In FIG. 5, the key management device 201 includes a CPU 501, a memory 502, a network I/F 503, a recording medium I/F 504, and a recording medium 505. Further, each component is connected to each other by a bus 500.

The example hardware configuration of the key management device 201 is specifically the same as the example hardware configuration of the information processing device 100, but the storage contents of the memory 502 are different from the storage contents of the memory 302. The memory 502 stores, for example, a protection key pair, an entrusted key pair, and an original key pair generated by the signing device 202 in association with each other. For example, the memory 502 does not need to store the escrow verification key among the escrow key pair. For example, the memory 502 may discard the original signature key from the original key pair.

(Example of hardware configuration of signing device 202)
Next, an example of the hardware configuration of the signing device 202 included in the signature control system 200 shown in FIG. 2 will be described using FIG. 6.

FIG. 6 is a block diagram showing an example of the hardware configuration of the signing device 202. In FIG. 6, the signature side device 202 includes a CPU 601, a memory 602, a network I/F 603, a recording medium I/F 604, a recording medium 605, a display 606, and an input device 607. Further, each component is connected to each other by a bus 600.

Here, the CPU 601 is in charge of overall control of the signature side device 202. Memory 602 includes, for example, ROM, RAM, flash ROM, and the like. Specifically, for example, a flash ROM or ROM stores various programs, and a RAM is used as a work area for the CPU 601. The program stored in the memory 602 is loaded into the CPU 601 and causes the CPU 601 to execute the coded processing. The memory 602 stores, for example, a protection key pair provided to the device itself. For example, the memory 602 does not need to store the protection verification key among the protection key pair.

The network I/F 603 is connected to a network 210 through a communication line, and is connected to other computers via the network 210. The network I/F 603 serves as an internal interface with the network 210, and controls data input/output from other computers. The network I/F 603 is, for example, a modem or a LAN adapter.

The recording medium I/F 604 controls data read/write to the recording medium 605 under the control of the CPU 601. The recording medium I/F 604 is, for example, a disk drive, SSD, or USB port. The recording medium 605 is a nonvolatile memory that stores data written under the control of the recording medium I/F 604. The recording medium 605 is, for example, a disk, a semiconductor memory, a USB memory, or the like. The recording medium 605 may be removable from the signing device 202.

The display 606 displays data such as a cursor, icons, or toolboxes, as well as documents, images, and functional information. The display 606 is, for example, a CRT (Cathode Ray Tube), a liquid crystal display, an organic EL (Electroluminescence) display, or the like. The input device 607 has keys for inputting characters, numbers, various instructions, etc., and inputs data. The input device 607 may be a keyboard, a mouse, or the like, or may be a touch panel type input pad, a numeric keypad, or the like.

In addition to the components described above, the signature side device 202 may include, for example, a printer, a scanner, a microphone, a speaker, and the like. Further, the signature side device 202 may have a plurality of recording medium I/Fs 604 and recording media 605. Further, the signature side device 202 does not need to have the recording medium I/F 604 or the recording medium 605.

(Example of hardware configuration of verification side device 203)
Next, an example of the hardware configuration of the verification side device 203 included in the signature control system 200 shown in FIG. 2 will be described using FIG. 7.

FIG. 7 is a block diagram showing an example of the hardware configuration of the verification side device 203. In FIG. 7, the verification side device 203 includes a CPU 701, a memory 702, a network I/F 703, a recording medium I/F 704, a recording medium 705, a display 706, and an input device 707. Further, each component is connected to each other by a bus 700.

Specifically, the hardware configuration example of the verification side device 203 is similar to the hardware configuration example of the signature side device 202, but the storage contents of the memory 702 are different from the storage contents of the memory 602. The memory 702 stores, for example, the original verification key provided to the device itself.

Here, the CPU 701 is in charge of overall control of the verification side device 203. Memory 702 includes, for example, ROM, RAM, flash ROM, and the like. Specifically, for example, a flash ROM or ROM stores various programs, and a RAM is used as a work area for the CPU 701. The program stored in the memory 702 is loaded into the CPU 701 and causes the CPU 701 to execute the coded processing.

The network I/F 703 is connected to a network 210 through a communication line, and is connected to other computers via the network 210. The network I/F 703 serves as an internal interface with the network 210, and controls data input/output from other computers. The network I/F 703 is, for example, a modem or a LAN adapter.

The recording medium I/F 704 controls data read/write to the recording medium 705 under the control of the CPU 701. The recording medium I/F 704 is, for example, a disk drive, an SSD, a USB port, or the like. The recording medium 705 is a nonvolatile memory that stores data written under the control of the recording medium I/F 704. The recording medium 705 is, for example, a disk, a semiconductor memory, a USB memory, or the like. The recording medium 705 may be removable from the verification device 203.

The display 706 displays data such as a cursor, icons, or toolboxes, as well as documents, images, and functional information. The display 706 is, for example, a CRT (Cathode Ray Tube), a liquid crystal display, an organic EL (Electroluminescence) display, or the like. The input device 707 has keys for inputting characters, numbers, various instructions, etc., and inputs data. The input device 707 may be a keyboard, a mouse, or the like, or may be a touch panel type input pad, a numeric keypad, or the like.

In addition to the components described above, the verification-side device 203 may include, for example, a printer, a scanner, a microphone, a speaker, and the like. Further, the verification side device 203 may have a plurality of recording medium I/Fs 704 and recording media 705. Further, the verification side device 203 does not need to have the recording medium I/F 704 or the recording medium 705.

(Functional configuration example of signature control system 200)
Next, an example of the functional configuration of the signature control system 200 will be described using FIG. 8.

FIG. 8 is a block diagram showing an example of the functional configuration of the signature control system 200. The signature control system 200 is a system including, for example, a management device 801, a first device 802, an information processing device 100, and a second device 803. The management device 801 is, for example, the key management device 201 shown in FIG. 2. In the following description, it is assumed that the management device 801 is the "key management device 201."

Further, the first device 802 is, for example, the signing device 202 shown in FIG. 2. In the following description, it is assumed that the first device 802 is the "signing device 202." The second device 803 is, for example, the verification device 203 shown in FIG. 2. In the following description, it is assumed that the second device 803 is the "verification side device 203." The management device 801 may be the same device as the first device 802.

The key management device 201 includes a first storage unit 810, a first acquisition unit 811, a first generation unit 812, and a first output unit 813.

The first storage unit 810 is realized, for example, by a storage area such as the memory 502 or the recording medium 505 shown in FIG. Although a case will be described below in which the first storage unit 810 is included in the key management device 201, the present invention is not limited to this. For example, the first storage unit 810 may be included in a device different from the key management device 201, and the stored contents of the first storage unit 810 may be referenced by the key management device 201.

The first acquisition unit 811 to first output unit 813 function as an example of a control unit of the key management device 201. Specifically, the first acquisition unit 811 to the first output unit 813, for example, cause the CPU 501 to execute a program stored in a storage area such as the memory 502 or the recording medium 505 shown in FIG. The network I/F 503 realizes this function. The processing results of each functional unit are stored in a storage area such as the memory 502 or the recording medium 505 shown in FIG. 5, for example.

The first storage unit 810 stores various information that is referenced or updated in the processing of each functional unit. The first storage unit 810 stores a signature key or a verification key to be provided to a predetermined signing device 202. The signature key is realized by, for example, a private key. The verification key is realized by, for example, a public key.

The first storage unit 810 stores, for example, an original signature key to be provided to a predetermined signing device 202. The original signature key corresponds to, for example, the original signature key. The original signature key is generated by the first generation unit 812, for example. The first storage unit 810 stores, for example, an original verification key corresponding to an original signature key provided to a predetermined signing device 202. The original verification key can verify the signature by the original signature key. The original verification key corresponds to, for example, the original verification key. The original verification key is generated by the first generation unit 812, for example.

The first storage unit 810 stores, for example, a first signature key to be provided to a predetermined signing device 202. The first signature key corresponds to, for example, a protected signature key. The first signature key is generated by the first generation unit 812, for example. The first signature key enables generation of the first signature. The first storage unit 810 stores, for example, a first verification key corresponding to a first signature key provided to a predetermined signing device 202. The first verification key is capable of verifying the signature by the first signature key. The first verification key corresponds to, for example, a protection verification key. The first verification key is generated by the first generation unit 812, for example.

The first storage unit 810 stores, for example, a second signature key to be provided to a predetermined signing device 202. The second signature key corresponds to, for example, the escrow signature key. The second signature key is generated by the first generation unit 812, for example. The second signature key allows a second signature to be generated. The first storage unit 810 stores, for example, a second verification key corresponding to a second signature key provided to a predetermined signing device 202. The second verification key is capable of verifying the signature by the second signature key. The second verification key corresponds to, for example, the escrow verification key. The second verification key is generated by the first generation unit 812, for example.

The first acquisition unit 811 acquires various information used in the processing of each functional unit. The first acquisition unit 811 stores the acquired various information in the first storage unit 810 or outputs it to each functional unit. Further, the first acquisition unit 811 may output various information stored in the first storage unit 810 to each functional unit. The first acquisition unit 811 acquires various information based on, for example, a user's operation input. The first acquisition unit 811 may receive various information from a device different from the key management device 201, for example.

The first acquisition unit 811 acquires, for example, a key generation request regarding a predetermined signing device 202. The key generation request may include identification information of a predetermined signing device 202, for example. The first acquisition unit 811 receives an input of a key generation request based on a user's operation input. The first acquisition unit 811 may receive a key generation request from a predetermined signing device 202.

The first acquisition unit 811 may receive a start trigger to start processing of any functional unit. The start trigger is, for example, a predetermined operation input by the user. The start trigger may be, for example, receiving predetermined information from another computer. The start trigger may be, for example, that any functional unit outputs predetermined information.

Specifically, the first acquisition unit 811 receives the acquisition of the key generation request as a start trigger for starting the processing of the first generation unit 812.

The first generation unit 812 generates a signature key and a verification key in response to a key generation request. The first generation unit 812 generates at least an original verification key, a first signature key, and a second signature key. The first generation unit 812 may generate the original signature key. The first generation unit 812 may generate the first verification key. The first generation unit 812 may generate the second verification key.

The first generation unit 812 generates, for example, a combination of an original signature key and an original verification key. The first generation unit 812 generates, for example, a combination of a first signature key and a first verification key. The first generation unit 812 generates the second signature key such that, for example, the combination of the first signature key and the second signature key can generate the same signature as the original signature key. Thereby, the first generation unit 812 can generate a signature that is verifiable with the original verification key and is the same as the signature using the original signature key, while keeping the original signature key secret.

The first output unit 813 outputs the processing result of at least one of the functional units. The output format is, for example, displaying on a display, printing out to a printer, transmitting to an external device via network I/F 503, or storing in a storage area such as memory 502 or recording medium 505. Thereby, the first output unit 813 can notify the user of the processing results of at least one of the functional units, thereby improving the usability of the key management device 201.

The first output unit 813 transmits the first signature key to the signing device 202. The first output unit 813 transmits the second signature key to the information processing device 100. The first output unit 813 may transmit the first verification key to the information processing device 100. The first output unit 813 provides the original verification key to the verification side device 203. The first output unit 813 transmits, for example, the original verification key to the signature device 202 or the information processing device 100 so that the verification device 203 can obtain it.

The signature side device 202 includes a second storage section 820, a second acquisition section 821, a second anonymization section 822, a second signature generation section 823, and a second output section 824.

The second storage unit 820 is realized, for example, by a storage area such as the memory 602 or the recording medium 605 shown in FIG. 6. In the following, a case will be described in which the second storage unit 820 is included in the signing device 202, but the present invention is not limited to this. For example, there may be a case in which the second storage unit 820 is included in a device different from the signing device 202, and the storage contents of the second storage unit 820 can be referenced from the signing device 202.

The second acquisition unit 821 to second output unit 824 function as an example of a control unit of the signing device 202. Specifically, the second acquisition unit 821 to the second output unit 824, for example, cause the CPU 601 to execute a program stored in a storage area such as the memory 602 or the recording medium 605 shown in FIG. The network I/F 603 realizes this function. The processing results of each functional unit are stored in a storage area such as the memory 602 or the recording medium 605 shown in FIG. 6, for example.

The second storage unit 820 stores various information that is referenced or updated in the processing of each functional unit. The second storage unit 820 stores the first signature key. The first signature key is acquired by the second acquisition unit 821, for example.

The second acquisition unit 821 acquires various information used in the processing of each functional unit. The second acquisition unit 821 stores the acquired various information in the second storage unit 820 or outputs it to each functional unit. Further, the second acquisition unit 821 may output various information stored in the second storage unit 820 to each functional unit. The second acquisition unit 821 acquires various information based on, for example, a user's operation input. The second acquisition unit 821 may receive various information from a device different from the signing device 202, for example.

The second acquisition unit 821 acquires, for example, the first signature key. Specifically, the second acquisition unit 821 receives the first signature key from the key management device 201.

The second acquisition unit 821 acquires target data, for example. The target data is, for example, data sent to the verification device 203. For example, the target data can be anonymized and become anonymized data. For example, a signature is added to the target data. Specifically, the second acquisition unit 821 receives input of target data based on a user's operation input. Specifically, the second acquisition unit 821 may receive target data from another computer.

The second acquisition unit 821 acquires, for example, anonymized data. The second acquisition unit 821 acquires anonymized data without acquiring target data. Specifically, the second acquisition unit 821 receives input of anonymized data based on a user's operation input. Specifically, the second acquisition unit 821 may receive anonymized data from another computer.

The second acquisition unit 821 acquires, for example, a second signature based on the second signature key for a first signature based on the first signature key. Specifically, the second acquisition unit 821 receives the second signature from the information processing device 100. Specifically, the second acquisition unit 821 receives the second signature from the information processing device 100 in response to transmitting the first signature to the information processing device 100 .

The second acquisition unit 821 may receive a start trigger that starts processing of any of the functional units. The start trigger is, for example, a predetermined operation input by the user. The start trigger may be, for example, receiving predetermined information from another computer. The start trigger may be, for example, that any functional unit outputs predetermined information.

The second acquisition unit 821 receives, for example, the acquisition of the target data as a start trigger for starting the process of the second anonymization unit 822. The second acquisition unit 821 receives, for example, the acquisition of anonymized data as a start trigger for starting the processing of the second signature generation unit 823.

The second anonymization unit 822 performs an anonymization process on the target data and generates anonymization data. The anonymization process is, for example, a hash value calculation process. The second anonymization unit 822 generates a hash value of the target data as anonymization data. Thereby, the second anonymization unit 822 can generate a signature to be added to the target data while preventing leakage of the target data.

The second signature generation unit 823 generates a first signature using the first signature key for the anonymized data. The second signature generation unit 823 generates a first signature by inputting the anonymized data and the first signature key into the signature function. Thereby, the second signature generation unit 823 can acquire one element that enables generation of the same signature as the signature using the original signature key.

The second output unit 824 outputs the processing result of at least one of the functional units. The output format is, for example, displaying on a display, printing out to a printer, transmitting to an external device via network I/F 603, or storing in a storage area such as memory 602 or recording medium 605. Thereby, the second output unit 824 can notify the user of the processing results of at least one of the functional units, thereby improving the usability of the signature side device 202.

The second output unit 824 transmits the first signature to the information processing device 100, for example. Specifically, the second output unit 824 transmits the anonymized data to which the first signature is attached to the information processing device 100. Thereby, the second output unit 824 can enable the information processing apparatus 100 to generate the second signature.

The second output unit 824 transmits the second signature to the verification side device 203, for example. Specifically, the second output unit 824 transmits the target data to which the second signature has been added to the verification side device 203. Thereby, the second output unit 824 can make the target data verifiable by the verification device 203 based on the second signature.

The information processing device 100 includes a third storage unit 830, a third acquisition unit 831, a third verification unit 832, a third signature generation unit 833, and a third output unit 834.

The third storage unit 830 is realized, for example, by a storage area such as the memory 302 or the recording medium 305 shown in FIG. 3. Although a case will be described below in which the third storage unit 830 is included in the information processing device 100, the present invention is not limited to this. For example, there may be a case in which the third storage unit 830 is included in a device different from the information processing device 100, and the storage contents of the third storage unit 830 can be referenced from the information processing device 100.

The third acquisition unit 831 to third output unit 834 function as an example of a control unit. Specifically, the third acquisition unit 831 to the third output unit 834, for example, cause the CPU 301 to execute a program stored in a storage area such as the memory 302 or the recording medium 305 shown in FIG. The network I/F 303 realizes this function. The processing results of each functional unit are stored in a storage area such as the memory 302 or the recording medium 305 shown in FIG. 3, for example.

The third storage unit 830 stores various information that is referenced or updated in the processing of each functional unit. The third storage unit 830 stores, for example, the second signature key. The second signature key is acquired by the third acquisition unit 831, for example.

The third storage unit 830 may store the first verification key, for example. The first verification key is acquired by the third acquisition unit 831, for example.

The third storage unit 830 may store the original verification key, for example. The original verification key is acquired by the third acquisition unit 831, for example.

The third acquisition unit 831 acquires various information used in the processing of each functional unit. The third acquisition unit 831 stores the acquired various information in the third storage unit 830 or outputs it to each functional unit. Further, the third acquisition unit 831 may output various information stored in the third storage unit 830 to each functional unit. The third acquisition unit 831 acquires various information based on, for example, a user's operation input. The third acquisition unit 831 may receive various information from a device different from the information processing device 100, for example.

The third acquisition unit 831 acquires, for example, the second signature key. Specifically, the third acquisition unit 831 receives the second signature key from the key management device 201. The third acquisition unit 831 may acquire the first verification key, for example. Specifically, the third acquisition unit 831 receives the first verification key from the key management device 201. The third acquisition unit 831 may acquire the original verification key, for example. Specifically, the third acquisition unit 831 receives the original verification key from the key management device 201.

The third acquisition unit 831 acquires, for example, the first signature. Specifically, the third acquisition unit 831 receives the first signature from the signing device 202. Specifically, the third acquisition unit 831 may receive the anonymized data to which the first signature is attached from the signing device 202. The third acquisition unit 831 acquires, for example, the original verification key. Specifically, the third acquisition unit 831 receives the original verification key from the key management device 201.

The third acquisition unit 831 may receive a start trigger that starts processing of any of the functional units. The start trigger is, for example, a predetermined operation input by the user. The start trigger may be, for example, receiving predetermined information from another computer. The start trigger may be, for example, that any functional unit outputs predetermined information.

For example, the third acquisition unit 831 receives the acquisition of the first signature as a start trigger for starting the processing of the third verification unit 832 and the third signature generation unit 833.

The third verification unit 832 uses the acquired first verification key to determine the validity of the received first signature. The third verification unit 832 verifies the validity of the first signature, for example, based on the anonymized data and using the first verification key. Thereby, the third verification unit 832 can determine whether or not the second signature may be generated. If the first signature is not valid, the third verification unit 832 can determine that there is no need to generate the second signature and discard the first signature. The third verification unit 832 may determine whether the second signature may be transmitted. The third verification unit 832 can discard the second signature generated by the third signature generation unit 833 if the first signature is not valid.

The third signature generation unit 833 generates a second signature for the received first signature using the acquired second signature key. The third signature generation unit 833 generates the second signature by inputting the first signature and the second signature key into the signature function, for example. Thereby, the third signature generation unit 833 can generate a second signature that is the same signature as the signature using the original signature key. Therefore, the third signature generation unit 833 can guarantee the authenticity of the anonymized data.

The third output unit 834 outputs the processing result of at least one of the functional units. The output format is, for example, displaying on a display, printing out to a printer, transmitting to an external device via network I/F 303, or storing in a storage area such as memory 302 or recording medium 305. Thereby, the third output unit 834 can notify the user of the processing results of at least one of the functional units, thereby improving the usability of the information processing apparatus 100.

The third output unit 834 transmits the generated second signature to the signing device 202. Thereby, the third output unit 834 can enable the signature side device 202 to guarantee the authenticity of the anonymized data. The third output unit 834 may transmit the acquired original verification key to the verification side device 203. Thereby, the third output unit 834 can make the second signature verifiable by the verification device 203.

The verification device 203 includes a fourth storage section 840, a fourth acquisition section 841, a fourth verification section 842, and a fourth output section 843.

The fourth storage unit 840 is realized, for example, by a storage area such as the memory 702 or the recording medium 705 shown in FIG. 7. In the following, a case will be described in which the fourth storage unit 840 is included in the verification side device 203, but the present invention is not limited to this. For example, there may be a case in which the fourth storage unit 840 is included in a device different from the verification device 203, and the storage contents of the fourth storage device 840 can be referenced from the verification device 203.

The fourth acquisition unit 841 to fourth output unit 843 function as an example of a control unit. Specifically, the fourth acquisition unit 841 to the fourth output unit 843, for example, cause the CPU 701 to execute a program stored in a storage area such as the memory 702 or the recording medium 705 shown in FIG. The network I/F 703 realizes this function. The processing results of each functional unit are stored in a storage area such as the memory 702 or the recording medium 705 shown in FIG. 7, for example.

The fourth storage unit 840 stores various information that is referenced or updated in the processing of each functional unit. The fourth storage unit 840 stores, for example, the original verification key. The original verification key is acquired by the fourth acquisition unit 841.

The fourth acquisition unit 841 acquires various information used in the processing of each functional unit. The fourth acquisition unit 841 stores the acquired various information in the fourth storage unit 840 or outputs it to each functional unit. Further, the fourth acquisition unit 841 may output various information stored in the fourth storage unit 840 to each functional unit. The fourth acquisition unit 841 acquires various information based on, for example, a user's operation input. The fourth acquisition unit 841 may receive various information from a device different from the verification device 203, for example.

The fourth acquisition unit 841 acquires, for example, the second signature. Specifically, the fourth acquisition unit 841 receives the second signature from the signing device 202. More specifically, the fourth acquisition unit 841 receives the target data to which the second signature is attached from the signing device 202.

The fourth acquisition unit 841 acquires, for example, the original verification key. The fourth acquisition unit 841 may acquire the original verification key, for example, in response to acquiring the second signature. Specifically, the fourth acquisition unit 841 receives the original verification key from the key management device 201. Specifically, the fourth acquisition unit 841 may receive the original verification key from the information processing device 100. Specifically, the fourth acquisition unit 841 may receive the original verification key from the signing device 202.

The fourth acquisition unit 841 may receive a start trigger to start processing of any functional unit. The start trigger is, for example, a predetermined operation input by the user. The start trigger may be, for example, receiving predetermined information from another computer. The start trigger may be, for example, that any functional unit outputs predetermined information.

The fourth acquisition unit 841 receives, for example, the acquisition of the second signature and the original verification key as a start trigger for starting the process of the fourth verification unit 842.

The fourth verification unit 842 verifies the validity of the second signature. The fourth verification unit 842 verifies the validity of the second signature, for example, based on the target data and using the original verification key. Thereby, the fourth verification unit 842 can verify the authenticity of the target data based on the validity of the second signature. If the second signature is not valid, the fourth verification unit 842 can determine that the target data is not authentic and discard the target data.

The fourth output unit 843 outputs the processing result of at least one of the functional units. The output format is, for example, displaying on a display, printing out to a printer, transmitting to an external device via network I/F 703, or storing in a storage area such as memory 702 or recording medium 705. Thereby, the fourth output unit 843 can notify the user of the processing results of at least one of the functional units, thereby improving the usability of the verification-side device 203.

The fourth output unit 843 outputs the result of verifying the validity of the second signature so that the user can refer to it. The fourth output unit 843 displays, for example, the result of verifying the validity of the second signature on the display 706. Thereby, the fourth output unit 843 can enable the user to understand the validity of the second signature and the authenticity of the target data suggested by the validity of the second signature.

If the second signature is valid, the fourth output unit 843 outputs the target data so that the user can refer to it. The fourth output unit 843 displays the target data on the display 706, for example. Thereby, the fourth output unit 843 can enable the user to understand the target data that is genuine. The fourth output unit 843 can improve security.

(Operation example 1 of signature control system 200)
Next, operation example 1 of the signature control system 200 will be described using FIGS. 9 to 11. Specifically, in FIGS. 9 to 11, when the signer intends to provide the contract to the verifier, the signer acquires a signature to be added to the contract from the information processing device 100 while keeping the contract confidential. Let me explain when I would like to do so.

Here, in order to generate a signature to be added to a contract while keeping the contract confidential, the following blind signature method can be considered. First, an example of a blind signature method will be described using FIG. 9. Thereafter, a first operation example of the signature control system 200 in the case where the blind signature method described above is applied to the signature control system 200 will be explained using FIGS. 10 and 11.

FIG. 9 is an explanatory diagram showing an example of a blind signature method. In FIG. 9, it is assumed that an original signature key 900 exists. Original signature key 900 can be divided into a combination of protected signature key 901 and escrow signature key 902. For example, based on the original signature key 900 and the protected signature key 901, the escrow signature key 902 to be combined with the protected signature key 901 can be generated.

Blind processing 941 using the protected signature key 901 is defined for the contract 910. When blind processing 941 using the protected signature key 901 is performed on the contract 910, anonymized data 911 and a protected signature 921 corresponding to the contract 910 are generated. The anonymized data 911 is a hash value of the contract 910.

In the blind processing 941, for example, the contract 910 is input to a hash function, anonymized data 911 which is a hash value of the contract 910 is generated, and the anonymized data 911 and the protected signature key 901 are input to the signature function. and generate a protection signature 921.

A signature process 942 using the entrusted signature key 902 is defined for the protected signature 921. When a signature process 942 using the deposited signature key 902 is performed on the protected signature 921, a deposited signature 922 is generated.

The signature process 942 is, for example, generating a escrow signature 922 by inputting the protected signature 921 and the escrow signature key 902 into a signature function.

Here, if a signature process 943 using the original signature key 900 is performed on the contract 910, an original signature 931 is considered to be generated. The escrow signature 922 has the property of matching the original signature 931. Therefore, the escrow signature 922 is generated verifiable with the original verification key 903 corresponding to the original signature key 900.

The escrow signature 922 may be generated so that it matches the original signature 931 and can be verified with the original verification key 903 after performing an unblind process 944 corresponding to the blind process.

The blind signature method described above can enable different computers to share the process of using the protected signature key 901 and the process of using the escrow signature key 902 in the process of generating the escrow signature 922. Therefore, in the blind signature method described above, if the signer securely holds the protected signature key 901 and controls the process of using the protected signature key 901, the escrow signature 922 can be prevented from being generated fraudulently. It is thought that it is possible to do so.

Additionally, the blind signature method described above can generate the escrow signature 922 without using the original signature key 900, which is valid alone. The signer only has to manage the protected signature key 901, which is not valid on its own. Furthermore, the signer can avoid providing the original signature key, which is valid on its own, to an outside party. Therefore, the blind signature method described above can improve security and reduce the work burden on the signer.

Additionally, the blind signature method described above can facilitate secure management of the contract 910 through blind processing 941 using the protected signature key 901. Next, the explanation will move on to FIGS. 10 and 11.

FIGS. 10 and 11 are explanatory diagrams showing an example 1 of operation of the signature control system 200. In FIG. 10, the signer device 202 has a browser plug-in and operates using the browser plug-in. The verification side device 203 has a mailer plug-in and operates using the mailer plug-in. The key management device 201 is used, for example, by a signer. Specifically, it is assumed that the key management device 201 determines and accepts the operation input of a valid signer through authentication processing. The information processing device 100 provides Trust as a Service.

(10-1) The key management device 201 generates an original key pair by the KeyGen process 1000 based on the signer's operation input. The original key pair is a combination of an original signature key 1001 and an original verification key 1002.

For example, the KeyGen processing 1000 executes (N, e, d)←RSA. This is to calculate Gen(k). Specifically, the key management device 201 stores (N, e, d)←RSA. Gen(k) is calculated, pk=e is set to the original verification key 1002, N is set to the public parameter, and sk=d is set to the original signature key 1001.

(10-2) The key management device 201 generates a protection key pair by the KeyGen process 1000 based on the signer's operation input. The protection key pair is a combination of a protection signature key 1011 and a protection verification key 1012. Specifically, the key management device 201 stores (N, e', d')←RSA. Gen(k) is calculated, pk=e' is set to the protection verification key 1012, N is set to the public parameter, and sk=d' is set to the protection signature key 1011. N is the same as when generating the original key pair.

(10-3) The key management device 201 generates an entrusted key pair using the KeyGen process 1000. The escrow key pair is a combination of an escrow signature key 1021 and an escrow verification key 1022. Specifically, the key management device 201 calculates d''=d·e'modN, and sets sk=d'' in the escrow signature key 1021. Specifically, the key management device 201 may generate the escrow verification key 1022 corresponding to the escrow signature key 1021. Specifically, the key management device 201 does not need to generate the escrow verification key 1022 corresponding to the escrow signature key 1021. The key management device 201 defines a hash function H:{0,1} ^* →Z _N and provides it to the signing device 202 and the information processing device 100.

(10-4) The key management device 201 sends the protection key pair to the signing device 202. The key management device 201 transmits the original verification key 1002, the protected verification key 1012, and the escrow signature key 1021 to the information processing device 100. The key management device 201 may discard the original signature key 1001 after generating the protection key pair and the entrusted key pair. Next, the description will move on to FIG. 11.

In FIG. 11, (11-1) the signing device 202 obtains the contract 1100 based on the signer's operation input. The signing device 202 sets the acquired contract 1100 in the message m. Signing side device 202 performs Blind processing 1121 on message m.

Blind processing 1121 calculates m'←H(m), which is the hash value 1101 of message m, and calculates σ'=RSA. which becomes the protected signature 1111. This is to calculate Sign(m', d')=(m') ^d' mod N.

For example, the signing device 202 calculates the hash value 1101 (m'←H(m)) of the message m as a blind message, and creates the protected signature 1111 (σ'=RSA.Sign(m', d')=( m') ^d' mod N) is calculated. (11-2) The signing device 202 transmits the hash value 1101 (m') to which the protection signature 1111 (σ) has been added to the information processing device 100.

(11-3) The information processing device 100 receives the hash value 1101 (m') to which the protection signature 1111 (σ) has been added from the signing device 202. The information processing apparatus 100 uses the protection verification key 1012(d') to verify the validity of the protection signature 1111(σ) based on the hash value 1101(m'). If the protection signature 1111(σ) is not valid, the information processing apparatus 100 discards the hash value 1101(m') to which the protection signature 1111(σ) is attached.

(11-4) If the protected signature 1111(σ) is valid, the information processing apparatus 100 performs Sign processing 1122 on the protected signature 1111(d'). The Sign processing 1122 is, for example, calculating σ"=RSA.Sign(σ', d")=(σ') ^d" mod N, which is the escrow signature 1112.

The information processing device 100 calculates, for example, the escrow signature 1112 (σ"=RSA.Sign(σ', d")=(σ') ^d" mod N). Here, σ" is (H(m) ^d' ) ^d" = (H(m)) ^d , which matches the original signature σ using the original signature key 1001. (11-5) The information processing device 100 sends the entrusted signature 1112 to the signing device 202. Send.

(11-6) The signing device 202 receives the deposited signature 1112 from the information processing device 100. The signing device 202 performs an unblind process 1123 corresponding to the blind process 1121 on the deposited signature 1112 to obtain an original signature 1113. The unblind process 1123 is performed based on the parameter r corresponding to the blind process 1121, for example.

Specifically, the processing contents of the Unblind processing 1123 are defined according to the processing contents of the Blind processing 1121. Therefore, depending on the processing content of the blind processing 1121, the unblind processing 1123 may not perform any processing on the deposited signature 1112 and may set the deposited signature 1112 as the original signature 1113 as is.

Here, it is assumed that the Unblind process 1123 does not perform any processing on the deposited signature 1112. In other words, the signing device 202 may do without performing the Unblind process 1123. (11-7) The signing device 202 sends the message m with the original signature 1113 attached to the verification device 203 via email.

(11-8) The verification side device 203 receives the message m to which the original signature 1113 has been added from the signature side device 202 via email. The verification device 203 acquires the original verification key 1002 from the information processing device 100 in response to receiving the message m to which the original signature 1113 is attached. The verification device 203 verifies the validity of the original signature 1113 using the original verification key 1002.

The verification device 203 outputs the result of verifying the validity of the original signature 1113 so that the verifier can refer to it. If the original signature 1113 is not valid, the verification side device 203 discards the message m to which the original signature 1113 is attached. If the original signature 1113 is valid, the verification side device 203 outputs the message m to which the original signature 1113 is attached so that the verifier can refer to it.

Thereby, the signature control system 200 allows the signing device 202 to do without having the original signature key 1001 that is valid on its own, and only needs to have the protected signature key 1011 that is not valid on its own. be able to. Therefore, the signature control system 200 can prevent leakage of the original signature key 1001.

The signature control system 200 allows the information processing device 100 to do without the original signature key 1001 that is valid on its own, and can have the escrow signature key 1021 that is not valid on its own. Therefore, the signature control system 200 can improve security. The signature control system 200 can easily conceal the message m. Therefore, the signature control system 200 can reduce the workload placed on the signer.

In this way, the signature control system 200 is able to store the original signature 1113 even if the entrusted signature key 1021 is leaked from the information processing device 100 to the attacker, as long as the protected signature key 1011 is not leaked to the attacker. can be prevented from being generated. The signature control system 200 can prevent an attacker from adding the original signature 1113 to a message other than the signer's legitimate message m.

Similarly, the signature control system 200 prevents the attacker from adding the original signature 1113 to a signer's legitimate message m even if the information processing device 100 is used by an attacker. can be prevented. The signature control system 200 allows the verification device 203 to verify the authenticity of the message m even if the message m is intercepted and tampered with by an attacker, or even if it is intercepted by an attacker and replaced with an unauthorized message m. Can be properly verifiable. In this way, the signature control system 200 can improve security and realize the original signature 1113 with relatively high reliability.

(Operation example 2 of signature control system 200)
Next, a second operation example of the signature control system 200 will be described. Operation example 2 is a specific example in which the signature control system 200 uses a nonce to easily conceal statistical information regarding the same blind message. Specifically, the nonce is a random number. The statistical information is, for example, the number of times the escrow signature 1112 is generated for the same blind message.

Operation example 2 is an operation example in which the processing contents of the Blind processing 1121 shown in FIGS. 10 and 11 are replaced with the processing contents shown below.

In operation example 2, the Blind process 1121 obtains the nonce r ₁ from a uniform distribution. Blind processing 1121 calculates m'←H (m, r ₁ ), which is the hash value 1101 of message m, and calculates σ'=RSA. which becomes the protected signature 1111. Sign (m', d')=(m') ^d' mod N is calculated.

Thereby, the signature control system 200 can make the specific value of the escrow signature 1112 different each time it generates the escrow signature 1112 for the hash value 1101 of the same blind message. Therefore, the signature control system 200 can easily conceal statistical information regarding the same blind message.

(Operation example 3 of signature control system 200)
Next, a third operation example of the signature control system 200 will be described. Operation example 3 is a specific example of achieving linkability. Unlinkability means, for example, that even if the message m to which the signature is attached and the nonce _r1 are made public in the future, it is difficult for the information processing device 100 to associate the message m and the blind message. indicate a property.

Here, for example, a case may be considered in which message m indicates a bid price and is published at a predetermined timing. In this case, if linkability is not achieved, it becomes possible for the information processing device 100 to associate the message m and the blind message based on the message m indicating the published bid price. There is.

Operation example 3 is an operation example in which the processing contents of Blind processing 1121 and Unblind processing 1123 shown in FIGS. 10 and 11 are replaced with the processing contents shown below.

In operation example 3, the blind process 1121 obtains nonces r ₁ and r ₂ from a uniform distribution. Blind processing 1121 calculates m'←H(m, r ₁ )·r ₂ ^e , which is the hash value 1101 of message m, and calculates σ'=RSA. which becomes the protected signature 1111. Sign (m', d')=(m') ^d' mod N is calculated.

In operation example 3, the unblind process 1123 calculates an original signature 1113 (σ=σ”*r ₂ ⁻¹ ) based on the escrow signature 1112 (σ”). This allows the signature control system 200 to achieve linkability. The signature control system 200 can improve security. The signature control system 200 can protect the privacy of signers.

(Operation example 4 of signature control system 200)
Next, a fourth example of operation of the signature control system 200 will be described. Operation example 4 is a specific example in which the signature control system 200 uses the BLS (Boneh Lynn Shacham) encryption method instead of the RSA encryption method.

Operation example 4 is an operation example in which the processing contents of KeyGen processing 1000, Blind processing 1121, Sign processing 1122, and Unblind processing 1123 shown in FIGS. 10 and 11 are replaced with the processing contents shown below. .

In operation example 4, G ₁ , G ₂ , and G _T are cyclic groups of prime order p. Let g ₁ , g ₂ , and g _T be the generators of G ₁ , G ₂ , and G _T , respectively. Assume that a pairing map e: G ₁ ×G ₂ →G _T is defined. The KeyGen process 1000 sets sk=x to the original signature key 1001 and sets pk=g ₂ ^x to the original verification key 1002. The KeyGen process 1000 sets sk'=y to the protected signature key 1011 and sets pk=g ₂ ^y to the protected verification key 1012. The KeyGen process 1000 sets sk''=z=x·y ⁻¹ modp to the escrow signature key 1021. The KeyGen process 1000 defines a hash function H:{0,1} ^* →G ₁ .

In operation example 4, the blind process 1121 obtains nonces r ₁ and r ₂ from a uniform distribution. Blind processing 1121 calculates m'←H(m, r ₁ )·g ₁ ^r2 , which is the hash value 1101 of message m, and calculates σ'=(m') ^y modp, which becomes the protected signature 1111. In operation example 4, the Sign processing 1122 calculates, for example, σ"=(σ'・X ^{- r2} ), which is the deposited signature 1112. X is pk. In operation example 4, the Unblind processing 1123 calculates An original signature 1113 (σ=σ”·X ^−r2 ) is calculated based on the signature 1112 (σ”).

In operation example 4, the verification device 203 determines that the original signature 1113 is valid if e(σ, g ₂ )=e(H(m, r ₁ ), X) holds. The verification device 203 determines that the original signature 1113 is not valid unless e(σ, g ₂ )=e(H(m, r ₁ ), X) holds true. As a result, the signature control system 200 can utilize the BLS encryption method, which can be applied to threshold signatures, aggregate signatures, etc., and can improve convenience.

(Registration processing procedure)
Next, an example of a registration processing procedure executed by the signature control system 200 will be described using FIGS. 12 and 13.

12 and 13 are sequence diagrams showing an example of the registration processing procedure. In FIG. 12, a signer (Alice) inputs a key generation request into the key management device 201. The key management device 201 receives an input of a key generation request (step S1201).

The key management device 201 generates an original key pair in response to the key generation request (step S1202). The key management device 201 generates a protection key pair (step S1203). The key management device 201 generates a escrow signature key (step S1204).

The key management device 201 transmits the protection key pair to the signing device 202 via a secure communication means (step S1205).

The signing device 202 receives the protection key pair using the browser plug-in. The signing device 202 uses the browser plug-in to transmit the server authentication information to the information processing device 100 (step S1206). The server authentication information is information for guaranteeing the validity of the signing device 202.

After confirming the validity of the signing device 202 based on the server authentication information, the information processing device 100 transmits authentication success to the signing device 202 (step S1207). If the information processing device 100 cannot confirm the validity of the signing device 202, the signature control system 200 ends the registration process.

The signing device 202 uses the browser plug-in to send a registration request that associates the plug-in ID and the protection verification key to the information processing device 100 (step S1208). In response to the registration request, the information processing apparatus 100 associates the plug-in ID and the protection verification key and registers them in the key management table 310. The information processing device 100 transmits registration completion to the signing device 202 (step S1209). Next, the explanation will move on to FIG. 13.

In FIG. 13, the signing device 202 transmits the plug-in ID to the key management device 201 using the browser plug-in (step S1301). The key management device 201 receives the plug-in ID from the signing device 202. The key management device 201 generates server registration information including the plug-in ID (step S1302). The server registration information includes a deposited signature key and an original verification key in association with the plug-in ID.

The key management device 201 generates a signature using the protected signature key for the server registration information, and adds the signature to the server registration information (step S1303). The key management device 201 transmits a registration request to the information processing device 100 (step S1304). The information processing device 100 transmits a request to transmit server registration information to the key management device 201 (step S1305).

The key management device 201 transmits the signed server registration information to the information processing device 100 via a secure communication means (step S1306). The information processing device 100 receives server registration information with a signature added thereto from the key management device 201 . The information processing apparatus 100 verifies the signature added to the server registration information using the protection verification key (step S1307).

If the signature is not valid, the information processing device 100 discards the server registration information. If the signature is valid, the information processing apparatus 100 registers the protection verification key and server registration information in the storage area in association with the plug-in ID (step S1308). Specifically, the information processing apparatus 100 registers the protection verification key, the entrusted signature key and the original verification key included in the server registration information in the key management table 310 in association with the plug-in ID. The information processing device 100 transmits registration completion to the key management device 201 (step S1309).

Upon receiving the registration completion notification, the key management device 201 outputs the registration completion notification so that the signer (Alice) can refer to it (step S1310). The key management device 201 may discard the original signature key (step S1311). The signature control system 200 ends the registration process. Thereby, the signature control system 200 can appropriately generate a protected signature key, a protected verification key, a deposited signature key, and an original verification key, and distribute them to the signing device 202 and the information processing device 100. Can be done.

(Signature processing procedure)
Next, an example of a signature processing procedure executed by the signature control system 200 will be described using FIGS. 14 and 15.

FIGS. 14 and 15 are sequence diagrams showing an example of a signature processing procedure. In FIG. 14, a signer (Alice) uses a PC or the like to create a document to be signed (step S1401). The signer (Alice) uses a PC or the like to transmit the document to be signed to the signing device 202 (step S1402).

The signing device 202 uses the protected signature key of the protected key pair to perform a blind process and generate a protected signature for the document (step S1403). The signing device 202 transmits a signature processing start notification to the information processing device 100 (step S1404). The signing device 202 receives a notification of approval for the start notification from the information processing device 100 (step S1405).

The signing device 202 transmits the verification information to the information processing device 100 using the browser plug-in (step S1406). The verification information includes, for example, a document hash value, a protection signature, and a plug-in ID. The plug-in ID is identification information that allows the signing device 202 to be identified. Specifically, the plug-in ID is identification information that allows the browser plug-in of the signing device 202 to be identified.

The information processing device 100 receives the verification information. The information processing apparatus 100 acquires the entrusted signature key and the protection verification key associated with the plug-in ID included in the verification information from the key management table 310 (step S1407). The information processing apparatus 100 verifies the validity of the verification information using the protection verification key (step S1408).

If the verification information is not valid, the information processing device 100 discards the verification information. If the verification information is not valid, the signature control system 200 ends the signature process. If the verification information is valid, the information processing apparatus 100 performs a Sign process using the deposited signature key, generates a deposited signature for the protected signature, and adds the deposited signature to the protected signature (step S1409). Next, the explanation will move on to FIG. 15.

In FIG. 15, the information processing device 100 transmits the protected signature to which the deposited signature has been added to the signing device 202 (step S1501). The signing device 202 receives the protected signature to which the deposited signature has been added from the information processing device 100 using the browser plug-in. The signing device 202 uses the browser plug-in to perform unblind processing on the protected signature and generates an original signature (step S1502).

The signing device 202 uses the browser plug-in to add an original signature to the document (step S1503). The signing device 202 transmits the document to which the original signature has been added to the verification device 203 (step S1504). The verifying device 203 receives the document with the original signature from the signing device 202 using the mailer plug-in.

The verifier (Bob) inputs an original signature verification request to the verification device 203 (step S1505). The verification device 203 receives an input of an original signature verification request using a mailer plug-in. The verification device 203 uses the mailer plug-in to transmit the plug-in ID to the information processing device 100, and requests the information processing device 100 for the original verification key (step S1506).

The information processing device 100 obtains the original verification key from the key management table 310 based on the plug-in ID. The information processing device 100 responds to the verification device 203 with the original verification key in association with the plug-in ID (step S1507). The verification device 203 receives the original verification key from the information processing device 100 using the mailer plug-in.

The verification device 203 uses the mailer plug-in to verify the validity of the original signature, and verifies the authenticity of the document to which the original signature has been added (step S1508). The verification device 203 uses the mailer plug-in to output the verification results so that the verification person (Bob) can refer to them (step S1509). Thereby, the signature control system 200 can safely exchange documents between the signing device 202 and the verifying device 203 while ensuring security.

As described above, according to the information processing device 100, the second signature key is acquired from the management device that has the combination of the first signature key and the second signature key, which enables generation of the same signature as the original signature key. can be obtained. According to the information processing device 100, the first signature using the first signature key on the anonymized data can be received from the first device 802 having the first signature key. According to the information processing apparatus 100, it is possible to generate a second signature for the received first signature using the acquired second signature key. According to the information processing device 100, the generated second signature can be transmitted to the first device 802. Thereby, the information processing apparatus 100 can generate a relatively highly reliable second signature, provide it to the first apparatus 802, and make it usable by the first apparatus 802.

According to the information processing device 100, the original verification key can further be acquired from the management device that has the original verification key corresponding to the original signature key. According to the information processing device 100, the acquired original verification key can be transmitted to the second device 803 that verifies the second signature. Thereby, the information processing device 100 can enable the second device 803 to verify the second signature, which has relatively high reliability.

According to the information processing device 100, the first verification key can further be obtained from the management device that has the first verification key corresponding to the first signature key. According to the information processing apparatus 100, the validity of the received first signature can be determined using the acquired first verification key. According to the information processing device 100, when it is determined that the received first signature is valid, the generated second signature can be transmitted to the first device 802. Thereby, the information processing apparatus 100 can improve security.

According to the information processing device 100, the hash value of the target data can be treated as anonymized data. Thereby, the information processing apparatus 100 can be applied even when the target data is anonymized.

According to the information processing device 100, it is possible to communicate with a management device that is the same device as the first device 802. Thereby, the information processing device 100 can be applied to a situation where the first device 802 and the management device are the same device.

Note that the signature control method described in this embodiment can be realized by executing a program prepared in advance on a computer such as a PC or a workstation. The signature control program described in this embodiment is recorded on a computer-readable recording medium, and executed by being read from the recording medium by the computer. The recording medium includes a hard disk, a flexible disk, a CD (Compact Disc)-ROM, an MO (Magneto Optical Disc), a DVD (Digital Versatile Disc), and the like. Furthermore, the signature control program described in this embodiment may be distributed via a network such as the Internet.

100 Information processing device 101,801 Management device 102,802 First device 103,803 Second device 111 Original signature key 112 Original verification key 121 First signature key 122 First verification key 131 Second signature key 132 Second verification key 141 ,911 Confidential data 142 First signature 143 Second signature 200 Signature control system 201 Key management device 202 Signing device 203 Verifying device 210 Network 300,500,600,700 Bus 301,501,601,701 CPU
302,502,602,702 Memory 303,503,603,703 Network I/F
304, 504, 604, 704 Recording medium I/F
305, 505, 605, 705 Recording medium 310 Key management table 606, 706

Display

607, 707 Input device 810 First storage section 811 First acquisition section 812 First generation section 813 First output section 820 Second storage section 821 Second Acquisition unit 822 Second anonymization unit 823 Second signature generation unit 824 Second output unit 830 Third storage unit 831 Third acquisition unit 832 Third verification unit 833 Third signature generation unit 834 Third output unit 840 Fourth storage unit 841 Fourth acquisition unit 842 Fourth verification unit 843

Fourth output unit

900,1001

Original signature key

901,1011 Protected

signature key

902,1021 Deposited

signature key

903,1002

Original verification key

910,1100

Contract

921,1111 Protected

signature

922 , 1112 Entrusted

signature

931, 1113 Original signature 941

Blind processing

942, 943 Sign processing 1000 KeyGen processing 1012 Protection verification key 1022 Entrusted verification key 1101 Hash value 1121 Blind processing 1122 Sign processing 1123 Unblind processing

Claims

obtaining the second signature key from a management device that has a combination of a first signature key and a second signature key that enables generation of the same signature as the original signature key;
receiving a first signature using the first signature key on the anonymized data from a first device having the first signature key;
generating a second signature using the acquired second signature key for the received first signature;
transmitting the generated second signature to the first device;
A signature control method characterized in that processing is executed by a computer.
The management device further includes an original verification key corresponding to the original signature key,
further acquiring the original verification key from the management device;
transmitting the obtained original verification key to a second device that verifies the second signature;
The signature control method according to claim 1, wherein the processing is executed by the computer.
The management device further includes a first verification key corresponding to the first signature key,
further acquiring the first verification key from the management device;
determining the validity of the received first signature using the acquired first verification key;
the computer executes the process;
3. The signature control method according to claim 1, further comprising transmitting the generated second signature to the first device when it is determined that the received first signature is valid.
The signature control method according to claim 1 or 2, wherein the anonymized data is a hash value of the target data.
3. The signature control method according to claim 1, wherein the first device is the same device as the management device.
obtaining the second signature key from a management device that has a combination of a first signature key and a second signature key that enables generation of the same signature as the original signature key;
receiving a first signature using the first signature key on the anonymized data from a first device having the first signature key;
generating a second signature using the acquired second signature key for the received first signature;
transmitting the generated second signature to the first device;
A signature control program that causes a computer to execute processing.
obtaining the second signature key from a management device that has a combination of a first signature key and a second signature key that enables generation of the same signature as the original signature key;
receiving a first signature using the first signature key on the anonymized data from a first device having the first signature key;
generating a second signature using the acquired second signature key for the received first signature;
transmitting the generated second signature to the first device;
An information processing device comprising a control section.
A system including a management device, an information processing device, a first device, and a second device,
The management device includes:
A combination of a first signature key and a second signature key that enables generation of the same signature as the original signature key is generated, the generated second signature key is provided to the information processing device, and the generated second signature key is provided to the information processing device. 1 a signature key to the first device;
The first device includes:
acquiring the first signature key from the management device, generating a first signature for the anonymized data using the acquired first signature key, and transmitting the generated first signature to the information processing device; In response to transmitting the first signature to the information processing device, a second signature based on the second signature key for the first signature is received from the information processing device, and the received second signature is , to the second device;
The information processing device includes:
Obtaining the second signature key from the management device, receiving the first signature from the first device, and generating the second signature using the obtained second signature key for the received first signature. and transmitting the generated second signature to the first device,
The second device includes:
receiving the second signature from the first device, acquiring an original verification key corresponding to the original signature key, and verifying the received second signature with the acquired original verification key;
A system characterized by:
The management device includes:
Further, generating the original verification key and transmitting it to the information processing device,
The information processing device includes:
Further, acquiring the original verification key from the management device and transmitting the acquired original verification key to the second device,
The second device includes:
The second signature is received from the first device, the original verification key is received from the information processing device, and the received second signature is verified with the received original verification key. 9. The system of claim 8.