JP4190713B2 - Signature generation device, signature verification device, and signature generation auxiliary device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a method for securely using a private key for generating an electronic signature, a signature generation apparatus, a signature verification apparatus, and a signature generation auxiliary apparatus.
[0002]
[Prior art]
Conventionally, when storing and using a signature private key for electronic signature in a special tamper-resistant device such as an IC card, owner authentication by PIN (personal identification number), management of certificate authority In the case of loss or theft by the CRL, a countermeasure against fraud was taken.
[0003]
[Problems to be solved by the invention]
However, since conventional IC cards usually do not have a display function, when a user signs a contract or the like at the store, even if the document content of the contract is confirmed on the store display, the IC card is actually used. There is no guarantee that the contract document signed by the card and the document displayed on the display are identical. Therefore, there is a problem that the user cannot confirm what is signed.
In order to solve this problem, an IC card with a display has been proposed. However, there are problems that the manufacturing cost of the IC card is increased and the compatibility between the IC card and other terminal devices is poor. Further, the screen provided on the IC card is too small to check the document.
[0004]
In order to confirm the contents of the contract, it is safe if the user records the information about the contract on a recording medium, takes it home, confirms it with a home computer, and then signs it. Sending a signature after returning home without contracting at a store, etc.) may result in loss due to another customer making a reservation in the meantime, and as a user, safety There was a problem that you had to choose between choosing or rushing the contract.
Furthermore, when a private key is stored in an IC card and carried around, there is a possibility that the information of the private key may be stolen without the IC card being lost or stolen or being noticed by the user. There is.
[0005]
The present invention has been made in view of such circumstances, and an object of the present invention is to provide an IC card and a store that can perform a temporary signature in a timely manner at a store and confirm a contract content to be signed, and then a formal electronic signature To provide a terminal.
[0006]
[Means for Solving the Problems]
To achieve the above object, the present invention provides a secret key serving as information for performing signature in a signature generation apparatus having communication means for transmitting and receiving information for performing signature by electronic signature to a signature verification apparatus. The message is temporarily stored using storage means for storing information, private key information stored in the storage means, and a message serving as information relating to the contents of the electronic signature received by the communication means from the signature verification apparatus. Provisional signature information that is information for signing and computing means for computing conversion data that is information for converting the temporary signature into a signature, and the communication means sends the temporary signature information to the signature verification device. After the transmission, the converted data is transmitted to the signature verification device, and a signature is made by an electronic signature.
[0007]
According to another aspect of the present invention, there is provided a signature verification apparatus having a communication unit that transmits and receives information for signing with a digital signature to the signature generation apparatus, and generates a message that is information relating to a content of the document to be signed with the digital signature. Whether or not provisional signature information, which is information for performing a provisional signature on the message, is calculated based on the message generation means, the secret key information stored in the signature generation apparatus, and the message. A verification unit that detects public key information corresponding to key information and the message; and when the verification unit detects that the temporary signature information is calculated, the verification unit sets the temporary contract for the message. And a conversion means transmitted from the signature generation apparatus after the provisional contract is set by the control means. And having a signature generating means for calculating a signature information from the temporary signature information.
[0008]
In addition, the present invention is connected to the signature verification apparatus by communication means and connected to the signature generation apparatus that communicates with the signature verification apparatus by communication means, and for the signature verification apparatus and the signature generation apparatus, In a signature generation auxiliary device that transmits / receives information for signing with an electronic signature, the secret key information that is information for performing the signature is divided into two as partial secret key information, and one of the divided partial secret key information is stored Based on the partial secret key information stored in the storage unit and a message serving as information relating to the content of the document to be signed by the electronic signature transmitted from the signature verification device. And provisional signature information that is information for performing the calculation and conversion means that calculates conversion data that is information for converting the temporary signature into a signature, After sending the temporary signature information to the signature verification device by serial communication means, and performs signature by an electronic signature and transmits the converted data to the signature verification device.
[0009]
In addition, the present invention is connected to the signature generation assisting device by communication means and connected to the signature generation device that communicates with the signature generation assisting device by communication means, and the signature generation assisting device and the signature generating device are connected to each other. On the other hand, in a signature verification apparatus that transmits and receives information for signing with an electronic signature, message generation means for generating a message that is information about the contents of a document that is signed with the electronic signature, and the message to the signature generation apparatus Storage means for storing partial signature information transmitted from the signature generation apparatus after transmission; partial secret key information stored in the signature generation auxiliary apparatus after transmitting the message to the signature generation auxiliary apparatus; and Whether or not provisional signature information, which is information for provisionally signing the message, is calculated based on the message Is detected by using public key information corresponding to the divided secret key information, the message, and the partial signature information, and the verification means detects that the temporary signature information has been calculated. Control means for setting as a temporary contract for the message, and after the temporary contract is set by the control means, the signature information is obtained from the temporary signature information based on the conversion data transmitted from the signature generation auxiliary device. And signature generating means for calculating.
[0010]
The present invention also provides a recording medium storing an electronic signature generation program in a signature generation apparatus having a communication unit that transmits and receives information for performing signature with the electronic signature to the signature verification apparatus, wherein the recording medium includes the signature A storage step for storing secret key information that is information for performing the information, a secret key information stored by the storage step, and information relating to the contents of the document to be digitally received by the communication means from the signature verification device A calculation step for calculating temporary signature information, which is information for performing a temporary signature on the message using a message, and conversion data, which is information for converting the temporary signature into a signature, by the communication means After the temporary signature information is transmitted to the signature verification device, the converted data is transmitted to the signature verification device, and the electronic signature is used. Possible to perform a transmission step of signing computer Te characterized.
[0011]
The present invention also provides a recording medium storing a signature generation program in a signature verification apparatus having a communication unit that transmits and receives information for performing a signature with an electronic signature to the signature generation apparatus, the recording medium including the electronic signature Information for performing a provisional signature on the message on the basis of a message generation step for generating a message as information on the contents of the document to be signed by the secret key information stored in the signature generation device and the message A verification step for detecting whether or not provisional signature information has been calculated using public key information corresponding to the secret key information and the message, and detecting that the provisional signature information has been calculated by the verification step A control step for setting as a temporary contract for the message, and Te after the temporary contract is set, based on the converted data to be transmitted from the signature generation apparatus, characterized in that to perform the signature generating step in a computer for calculating the signature information from the temporary signature information.
[0012]
In addition, the present invention is connected to the signature verification apparatus by communication means and connected to the signature generation apparatus that communicates with the signature verification apparatus by communication means, and for the signature verification apparatus and the signature generation apparatus, In a recording medium storing a signature generation program in a signature generation auxiliary device that transmits and receives information for performing a signature by using an electronic signature, the recording medium has private key information as information for performing the signature as partial secret key information. A storage step of storing one of the divided partial secret key information, a partial secret key information stored by the storage step, and a content of a document to be signed by the electronic signature transmitted from the signature verification device Based on the information message, provisional signature information, which is information for provisionally signing the message, and the provisional signature information A calculation step of calculating conversion data that is information for converting a name into a signature; and after transmitting temporary signature information to the signature verification apparatus by the communication means, the conversion data is transmitted to the signature verification apparatus to be electronic A transmission step of performing signature by signature is performed by a computer.
[0013]
In addition, the present invention is connected to the signature generation assisting device by communication means and connected to the signature generation device that communicates with the signature generation assisting device by communication means, and the signature generation assisting device and the signature generating device are connected to each other. On the other hand, in a recording medium that records a signature generation program in a signature verification apparatus that transmits and receives information for signing with an electronic signature, the recording medium generates a message that is information about the content of the document to be signed with the electronic signature. A message generation step, a storage step of storing partial signature information transmitted from the signature generation device after transmitting the message to the signature generation device, and after transmitting the message to the signature generation auxiliary device, Based on the partial secret key information stored in the signature generation auxiliary device and the message, the previous Verification that detects whether or not provisional signature information, which is information for performing provisional signature on a message, is calculated using public key information corresponding to the divided secret key information, the message, and the partial signature information A control step for setting a temporary contract for the message when the verification step detects that the temporary signature information has been calculated; and after the temporary contract is set by the control step, the signature A signature generation step of calculating signature information from the provisional signature information is performed by a computer based on the conversion data transmitted from the generation auxiliary device.
[0014]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an IC card and a store terminal according to an embodiment of the present invention will be described with reference to the drawings. Here, a case where a user who owns an IC card goes to a store and makes a transaction contract using an electronic signature will be described as an example. FIG. 1 is a schematic block diagram showing a configuration of an electronic signature system according to an embodiment of the present invention. In this figure, the electronic signature system includes a user terminal 100, a store terminal 300, a network 400, and an IC card 500.
[0015]
In the user terminal 100, a storage unit 110, an input unit 120, and a communication unit 150 are connected by a bus 160, and various data are transferred between the various units of the apparatus via the bus 160 based on control of the control unit 130. . The user terminal 100 is provided at the user's home, for example.
The storage unit 110 includes a secret key SK that is key information for generating an electronic signature, a public key (e, n) that is key information corresponding to the secret key SK, and a public key issued by a certificate authority (CA). Public key certificate information Cert serving as data for certifying the owner of (e, n) is stored. The storage unit 110 stores various data.
The communication unit 150 communicates with the store terminal 300 via the network 400. The input unit 120 outputs a signal corresponding to an input from a user who uses the user terminal 100.
[0016]
Further, an input / output device (hereinafter referred to as “R / W”) 170 that transmits and receives data between the IC card 500 and the bus 160 is connected to the outside of the user terminal 100. Further, the user terminal 100 is connected to a display device (not shown) as a peripheral device. Here, the display device refers to a CRT (Cathode Ray Tube), a liquid crystal display device, or the like.
[0017]
The store terminal 300 includes a control unit 310, a storage unit 320, an MSG generation unit 330, an instruction unit 340, a signature generation unit 350, a verification unit 360, a communication unit 370, and a bus 380. Each unit of the store terminal 300 is connected by a bus 380, and data transfer is controlled by the control unit 310. The store terminal 300 is provided in a store such as a merchandise store or a financial institution, for example.
[0018]
The storage unit 320 stores a public key (e, n) and a partial secret key SKbi. The storage unit 320 stores various data. The MSG generation unit 330 generates a message (hereinafter referred to as “MSG”) which is a contract for making a contract with a user who is a contractor. The instruction unit 340 instructs the IC card 500 to “0” or “1” via the bus 380 and the R / W 390. The instruction of “0” or “1” is randomly determined.
[0019]
The verification unit 360 uses a random number r transmitted from the IC card 500._iAnd random number data R_iBased on the above, it is detected whether or not the expression (1) using the format function shown below is satisfied.
F (r_i)^e= R_imod (n) (1)
However, F (r_i) Is a format function, in which input data is set in a template including a fixed value such as an identification information ID, a date, a continuous or repeated pattern of 0 and 1, and the like are provided with redundancy. A code such as a checksum or CRC may be further added to this format function.
[0020]
  The verification unit 360 is transmitted from the IC card 500.ProvisionalSignature y_iBased on the MSG generated by the MSG generation unit 330 and the public key e, it is detected whether the following expression (2) is satisfied.
y_i ^e= R_ih (MSG) mod (n) (2)
Here, a one-way hash function is used as the hash function used in this embodiment. In addition to this hash function, processing such as padding processing may be performed together.
[0021]
  The signature generation unit 350 is transmitted from the IC card 500.ProvisionalSignature y_iAnd random number r_iBased on the above, the signature S is generated by the following equation (3).
S = y_i/ F (r_i) Mod (n) (3)
Further, the signature generation unit 350 verifies the signature S by detecting whether or not the following expression (4) holds for the generated signature S based on the MSG and the public key e.
S^e= H (MSG) mod (n) (4)
[0022]
The communication unit 370 communicates with the user terminal 100 via the network 400. Further, an R / W 390 that transmits and receives data between the bus 380 and the IC card 500 is connected to the outside of the store terminal 300.
In addition, the store terminal 300 is connected to an input device, a display device, and the like (none of which are shown) as peripheral devices. Here, the input device refers to an input device such as a keyboard and a mouse. The display device refers to a CRT (Cathode Ray Tube), a liquid crystal display device, or the like.
[0023]
  The IC card 500 includes a communication unit 510, a control unit 520, a storage unit 530, a calculation unit 540, a random number generation unit 550, and a bus 560. The communication unit 510 communicates with the user terminal 100 via the R / W 170. The communication unit 510 communicates with the store terminal 300 via the R / W 390. The storage unit 530 stores the secret key SK transmitted from the user terminal 100. The storage unit 530 stores random numbers.r _iIs stored every time the random number generation unit 550 generates. Based on the MSG transmitted from the store terminal 300 and the secret key SK stored in the storage unit 530, the calculation unit 540 calculates the signature S according to the following equation (5).
S = h (MSG)SKmod (n) (5)
[0024]
In addition, the calculation unit 540 generates a signature S and a random number r generated by the random number generation unit 550._iBased on the above, the provisional signature y_iIs calculated.
y_i= F (r_i) S x mod (n) (6)
[0025]
In addition, the calculation unit 540 generates a random number r generated by the random number generation unit 550._iAnd the public key e, the random number data R according to the following equation (7)_iIs calculated.
R_i= F (r_i)^emod (n) (7)
The random number generator 550 generates a random number r_iIs generated.
[0026]
  The control unit 520 performs control to transfer data between each unit in the IC card 500 via the bus 560. In addition, the control unit 520 sends the random number data R to the store terminal 300._iWhen “0” is instructed from the store terminal 300 after sendingr _iIs transmitted to the store terminal 300, and when “1” is instructed from the store terminal 300, the temporary signature y is generated by the calculation unit 540._iIs transmitted to the store terminal 300.
[0027]
  Next, the operation of the electronic signature system in the configuration of FIG. 1 will be described using the flowchart of FIG. First, after the user inserts the IC card 500 into the R / W 170, the storage unit110The public key (e, n), secret key SK, and public key certificate information Cert stored in the IC card 500 are transferred and stored in the storage unit 530 of the IC card 500. Then, when the user goes to the store where the store terminal 300 is installed with the IC card 500 and conducts a transaction with an employee of the store and makes a contract, the user transmits a message as information on the content of the contract. Ask the employee to
[0028]
Next, the employee inputs to the store terminal 300 an instruction to generate an MSG that is information about the contents of the contract. The MSG generation unit 330 of the store terminal 300 receives the MSG generation instruction, generates the MSG, and stores the generated MSG in the storage unit 530. The control unit 310 performs control to display the MSG generated by the MSG generation unit 330 on the display device.
[0029]
Next, after confirming the MSG displayed on the display device by the user, the IC card 500 is inserted into the R / W 390. When the IC card 500 is inserted into the R / W 390, the control unit 310 reads out the public key (e, n) and the public key certificate information Cert stored in the storage unit 530 of the IC card 500 (step S1). ). Then, the store terminal 300 stores the read public key (e, n) and the public key certificate information Cert in the storage unit 320 and then displays them on the display device. The employee confirms the public key (e, n) with the public key (e, n) and the public key certificate information Cert displayed on the display device (step S2), and then instructs the MSG to be transmitted from the input device. Enter. When an MSG transmission instruction is input, control unit 310 reads MSG stored in storage unit 320 and transfers it to IC card 500 (step S3).
[0030]
The MSG transferred to the IC card 500 is stored in the storage unit 530. When the MSG is stored, the calculation unit 540 generates a signature S according to equation (5) based on the MSG and the private key SK stored in the storage unit 530 (step S4). Next, the calculation unit 540 sends a random number r to the random number generation unit 550._iInstruct the generation of. The random number generation unit 550 generates a random number r in response to an instruction from the calculation unit 540._iIs generated (step S5), output to the calculation unit 540, and a random number r with the number of times generated._iIs stored in the storage unit 530.
[0031]
The calculation unit 540 receives the random number r from the random number generation unit 550._iIs output, this random number r_iAnd the signature S, the provisional signature y_i(Step S6), and public key e and random number r_iBased on the above, the random number data R according to the equation (7)_iIs generated (step S7), and the generated temporary signature y is generated._iAnd random number data R_iAnd temporarily hold. Then, the calculation unit 540 generates the generated random number data R_iIs transmitted to the store terminal 300 by the communication unit 510 (step S8).
[0032]
Store terminal 300 uses random number data R transmitted from IC card 500._iIs stored in the storage unit 320. Random number data R_iIs stored, the instruction unit 340 instructs the IC card 500 to “0” or “1”.
When “0” is instructed from the instruction unit 340, the control unit 520 of the IC card 500 stores the random number r stored in the storage unit 320._iIs read out and output to the store terminal 300 by the communication unit 510. The communication unit 510 receives a random number r in response to an instruction from the control unit 520._iIs transmitted to the store terminal 300 (step S10).
[0033]
The store terminal 300 has a random number r_iIs received by the verification unit 360._iAnd random number data R stored in the storage unit 320_iBased on the above, it is detected whether or not the above equation (1) is established (step S11). When (1) is established, the verification unit 360 detects that the IC card 500 has calculated using the correct secret key SK.
[0034]
On the other hand, when “1” is instructed from the instruction unit 340, the control unit 520 of the IC card 500 displays the temporary signature y held in the calculation unit 540._iIs read out and output to the store terminal 300 by the communication unit 510. In response to an instruction from the control unit 520, the communication unit 510 receives the temporary signature y_iIs transmitted to the store terminal 300 (step S12).
[0035]
The store terminal 300 has a temporary signature y_iIs stored in the storage unit 320, and then is verified by the verification unit 360._iAnd the public key e, MSG, and random number data R stored in the storage unit 320_iBased on the above, it is detected whether or not the above equation (2) is established (step S12). When (2) is established, the verification unit 360 detects that the IC card 500 has been calculated using the correct secret key SK (step S13).
[0036]
Then, when the verification unit 360 detects that the calculation is performed using the correct secret key SK, the control unit 310 further performs control to repeat the processing operation from step S5 to step S13 k times. When it is detected that the calculation is always performed using the correct secret key SK after repeating k times, the control unit 310 determines that the temporary signature y transmitted i times (1 ≦ i ≦ k)_iIs extracted from the storage unit 320 as information for generating the signature S, and the public key (e, n), public key certificate information Cert, and MSG are associated and stored in the storage unit 320 (step S15). The control unit 310 then extracts the extracted temporary signature y_iIs output to the IC card 500 (step S16).
[0037]
The IC card 500 stores the number-of-times information i output from the store terminal 300 in the storage unit 530 (step S17).
After the count information is stored, the user takes out the IC card 500 from the R / W 390, returns to the home, and then causes the user terminal 100 to display the MSG stored in the IC card 500 on the display device. The contents of MSG are confirmed again (step S18). After the content of the MSG is confirmed by the user, the communication unit 150 responds to a transmission instruction from the user, and the communication unit 150 stores the frequency information i stored in the storage unit 530 of the IC card 500 via the network 400. Random number r corresponding to_iIs transmitted to the store terminal 300 as converted data (step S19).
[0038]
  Random number r transmitted from IC card 500_iIs received from the IC card 500 by the signature generation unit 350.ProvisionalSignature y_iAnd random number r_iBased on the above, the signature S is generated by the above-described equation (3). Next, the signature generation unit 350 verifies the signature S using the above-described equation (4) based on the generated signature S and the public key e.
[0039]
As described above, the verification unit 360 detects whether or not the expressions (1) and (2) are established, so that the store terminal 300 does not receive the signature S itself from the IC card 500. It is possible to confirm that the user has the secret key SK and confirm that the user has generated temporary signature data for the MSG. By performing these confirmations, a temporary signature is performed, and after the user confirms the MSG, the random number r_iSend a temporary signature y_iCan be converted into a signature S.
[0040]
The temporary signature y generated here_iSince it is not possible to determine whether or not it is legitimate for a third party, it is not established as a formal electronic signature, so that the user's risk can be limited to the user and the store side.
[0041]
Here, with reference to FIG._iWill be described. Using the conventional RSA signature method, S^e= H (MSG), but according to the above method, the temporary signature y_iIs y_i ^e= R_iXh (MSG). Therefore, the temporary signature y_iIs generated using random numbers, R_i= H (MSG) / y_i ^eRandom number data R_iIs calculated by a third party who does not have the private key SK._iCan be generated, or a third party can impersonate the user.
[0042]
On the other hand, the IC card 500 cannot predict “0” or “1” designated from the store terminal 300. If it can be predicted that “1” will be instructed from the store terminal 300, the temporary signature y is previously set as described above._iIs generated using random numbers and random number data R_iAnd random number data R_iThe temporary signature y generated using a random number after “1” is instructed from the store terminal 300_iIs verified in the store terminal 300 (reference numeral 600).
[0043]
However, when “0” is instructed from the store terminal 300, the random number data R_iRandom number r corresponding to_iIs not transmitted, the verification of the store terminal 300 is not established. In this case, F (r_i)^e= R_iRandom number r satisfying_iThis random number r is calculated._iTo find r_i= F '(R_i ^SK), And if there is no secret key SK, the random number r_iCannot be computed. Accordingly, it is predicted that “1” is instructed in the IC card 500, and the random number r_iAnd random number data R_iIf there is no secret key SK, the random number r_iCan not be calculated, it is possible to detect impersonation by the verification of the verification unit 360 (reference numeral 601). (However, F '() is the inverse function of F ())
[0044]
On the other hand, a random number r is predicted by predicting that “0” is instructed from the store terminal 300._iGenerate random number data R_iR_i= F (r_i)^eRandom number data R_iWhen “0” is instructed from the store terminal 300 as predicted after transmitting to the store terminal 300, the random number r_iCan be verified by the verification unit 360, and a third party who does not have the secret key SK can be impersonated (reference numeral 602).
[0045]
However, in this case, when “1” is instructed from the store terminal 300, the temporary signature y_iAt this time, but the temporary signature y_iTo generate a secret key SK, and a third party who does not have the secret key SK can use the temporary signature y for establishing verification._iCannot be generated (reference numeral 603). Therefore, the verification unit 360 can detect impersonation of a third party who does not have the secret key SK.
[0046]
In this way, the store terminal 300 uses the random number data R_iIt is possible to detect whether or not the user has the secret key SK by instructing “0” or “1” after receiving the password. At this time, the above-mentioned instruction “0” or “1” is performed to verify the data to be transmitted, thereby impersonating a third party who does not have the secret key SK with a probability of 1/2. Since it is possible to detect “0” or “1” by repeating the process of instructing k times k times, (1/2)^kSince it is possible to detect impersonation of a third party who does not have the secret key SK, the store terminal 300 uses the provisional signature y with an overwhelming probability._iIt is possible to confirm that is correct. Therefore, the store terminal 300 can confirm that the user has the secret key SK even if the signature S itself is not transmitted from the IC card 500.
[0047]
The store at the store terminal 300 is illegal and the provisional signature is y_iWhen the user forges the temporary signature y by performing verification processing of the temporary signature_iIt is possible to verify whether is forged. This verification processing is performed by, for example, provisional signature y verified with MSG_iAnd T = y_i÷ h (MSG)^SKThe temporary signature y is given by the equation mod (n)._iIt is verified whether or not conforms to the format function of F (). Since this format function is redundant, the provisional signature y_iIf it is counterfeited, it will not conform to the format with an overwhelmingly high probability._iCan be verified. However, when this verification process is performed, since the signature S for MSG can be calculated from T, it is desirable that a reliable third party confirm T instead of handing T directly to the store terminal 300.
[0048]
Next, a second embodiment will be described. FIG. 4 is a schematic block diagram showing the configuration of the electronic signature system in the second embodiment. In this figure, parts corresponding to those in FIG. 1 are denoted by the same reference numerals, and description thereof is omitted.
The distribution unit 140 of the user terminal 100 divides the secret key SK into a partial secret key SK1 and a partial secret key SK2. The random number generator 180 generates a random number r_iIs generated. The calculation unit 190 performs a calculation in the same manner as the calculation unit 540 in FIG. 1, and performs partial signature S1 and random number data R._i, Provisional signature y_iIs calculated.
[0049]
  The computing unit 541 of the IC card 500 computes the partial signature S2 by the following equation (8) based on the MSG transmitted from the store terminal 300 and the secret key SK2 stored in the storage unit 530..
S2 = h (MSG)SK2mod (n) (8)
Here, the partial signature is a signature S that is generated when two partial signatures Sn, that is, the partial signature S1 and the partial signature S2 are collected.
[0050]
  Next, the operation of the apparatus in the configuration of FIG. 4 will be described using the flowchart of FIG. First, after the user inserts the IC card 500 into the R / W 170, the storage unit110The public key (e, n) and the public key certificate information Cert stored in are stored in the storage unit 530 of the IC card 500 (step S48). Next, the user inputs an instruction to divide the secret key SK from the input unit 120. The distribution unit 140 reads the secret key SK from the storage unit 110 in accordance with an instruction input from the input unit 120, divides it into the secret key SK1 and the secret key SK2 (step S49), and the divided secret key SK1 and secret The key SK2 is stored in the storage unit 110. When the secret key SK is divided by the distribution unit 140, the divided secret key SK2 is stored in the storage unit 530 of the IC card 500 (step S50).
[0051]
Then, when the user goes to the store where the store terminal 300 is installed with the IC card 500 and conducts a transaction with an employee of the store and makes a contract, the user transmits a message as information on the content of the contract. Ask the employee to
2, the public key (e, n) and the public key certificate information Cert are transmitted from the IC card 500 to the store terminal 300 (step S51), and are made public at the store terminal 300. After confirmation of the key (e, n) (step S52), an MSG is generated and transmitted to the IC card 500 (step S53).
[0052]
  Based on the MSG transmitted from the store terminal 300 and the secret key SK2 stored in the storage unit 530, the calculation unit 540 is S2 = h (MSG)SK2The partial signature S <b> 2 is calculated by the equation mod (n) and stored in the storage unit 530. After being stored in the storage unit 530, the control unit 520 transmits the partial signature S2 by the communication unit 510 to the store terminal 300 (step S54). Store terminal 300 stores partial signature S <b> 2 transmitted from IC card 500 in storage unit 530.
[0053]
  After the partial signature S2 is stored, the store terminal 300 transmits MSG to the user terminal 100 (step S55). The user terminal 100 sends the partial signature S1 to S1 = h (MSG) by the calculation unit 190.SK1It is generated by the equation mod (n) (step S56) and stored in the storage unit 110. Next, the user terminal 100 generates the random number ri by the random number generation unit 180 and then stores the random number ri in the storage unit 110, and also generates the temporary signature yi and the random number data Ri by the calculation unit 190 and stores them in the storage unit 530. Thereafter, the random number data Ri is transmitted to the store terminal 300 (step S57).
[0054]
Store terminal 300 uses random number data R_iAnd stored in the storage unit 320, the instruction unit 340 instructs the user terminal 100 to “0” or “1” (step S58). The user terminal 100 receives a random number r when “0” is instructed from the store terminal 300._iIs sent to the store terminal 300, and when “1” is instructed, a temporary signature y_iIs transmitted to the store terminal 300 (step S59).
[0055]
The store terminal 300 generates a random number r according to the data transmitted from the user terminal 100 by the verification unit 360._iOr temporary signature y_iIs verified (step S60). Then, the processes from step S57 to step S60 are repeated k times (step S61). At this time, the store terminal 300 receives the temporary signature y_i, Public key (e, n), public key certificate information Cert, MSG, and partial signature S2 are stored in the storage unit 320 in association with the number of times i (1 ≦ i ≦ k) (step S61). And the shop terminal 300 transmits the frequency | count i to the user terminal 100 as frequency information i (step S62). When receiving the number-of-times information i from the store terminal 300, the user terminal 100 stores the number-of-times information i in the storage unit 110 (step S63).
[0056]
Then, after the user brings the IC card 500 home, the content of the MSG is displayed on the display device of the user terminal 100, and after confirming the content of the MSG, if there is no problem with the MSG, the count information i Corresponding random number r_iIs transmitted as conversion data to the store terminal 300 (step S64). The store terminal 300 uses the random number r transmitted from the user terminal 100 by the signature generation unit 350._iS = (y_i× S2) ÷ F (r_i) A signature S is generated by the equation mod (n), and the signature S is verified by the verification unit 360 (step S65).
[0057]
In the above embodiment, the generation of a temporary signature and the random number r_iIn the transmission, a PIN may be set for the IC card 500, or different data may be set for the PIN. Also, when generating a temporary signature, the PIN is not set and the random number r_iIt may be set so that a PIN is input when transmitting. In this way, different levels of restrictions are set using the access control function of the IC card 500, and the store terminal 300 generates a random number r at the time of provisional signature._iIt is preferable to prevent the material from being taken out secretly.
[0058]
In the above embodiment, the user uses a random number r._iIs not transmitted within a predetermined period, the store terminal 300 displays the temporary signature yⁱYou may make it cancel the temporary contract by.
In the above embodiment, the process of instructing “0” or “1” and performing verification by the verification unit 360 is repeated k times. However, k data may be transmitted and received at a time.
[0059]
In the above embodiment, the random number r_iWhen generating a random number r₀And r_i= H (r₀You may make it produce | generate as (ii). Thus, one random number r₀And the number information i are stored in a random number r_iSince it is possible to calculate the random number r_iNeed not be memorized every time As a result, it is possible to suppress an increase in necessary storage area.
[0060]
Furthermore, according to the above-described embodiment, it is only necessary to implement almost the same processing as the method using the conventional RSA signature, so that the processing in the IC card is not increased, thereby applying the present invention to the conventional IC card. can do.
[0061]
The random number r_iR_i'= H (r_i), And the calculated random number r_i'Is a new random number r_iAnd again using the above equation, r_i′ May be calculated. The random number r_iYou may make it produce | generate by methods other than the above-mentioned method.
[0062]
In the above-described second embodiment, the secret key SK is divided into two, but may be divided using a secret share. The secret share here means that the secret key SK is distributed to n partial secret keys SK1 to SKn with a threshold value k, and based on the distributed partial secret keys SK1 to SKn and MSG, the partial signatures S1 to S1 are distributed. Sn is generated. A signature S is generated when k arbitrary partial signatures Sn are collected from the partial signatures S1 to Sn.
[0063]
Furthermore, in the second embodiment described above, the secret key SK is divided into two and stored in the IC card 500 and the user terminal 100, so that the IC card 500 is lost or stolen. If a new secret key SK1 ′ and a secret key SK2 ′ are generated from the secret key SK by the user terminal 100 and the secret key SK1 ′ is set in the user terminal 100, the third party is lost. Even if the IC card 500 is to be abused, the effect that it cannot be used is obtained.
[0064]
Furthermore, in the above-described second embodiment, the case where the secret key SK is divided into two has been described as an example. However, the secret key SK is divided into the secret key SK1, the secret key SK2, and the secret key SK3, and the secret key SK1 May be stored in the IC terminal 500, the secret key SK3 is stored in the store terminal 300, and the signature S may be generated when these three secret keys are collected.
[0065]
Furthermore, in the above-described second embodiment, even if the secret key SK2 is copied to a third party without the user's knowledge, the random number r is received from the user terminal 100._iUnless the message is transmitted, the contract is not established, so that it is possible to prevent misuse of a malicious third party.
[0066]
1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed to execute digital signature generation management. You may go. Here, the “computer system” includes an OS and hardware such as peripheral devices.
Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a portable medium such as a floppy disk, a magneto-optical disk, a ROM, or a CD-ROM, and a storage device such as a hard disk built in the computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.
The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design and the like within a scope not departing from the gist of the present invention.
[0067]
【The invention's effect】
As described above, according to the present invention, after the provisional contract is made with the temporary signature information, the conversion data for converting the temporary signature information into the signature information is transmitted. It can be confirmed that it corresponds to the user's public key, and at the time of the contract, the proof that the user is the person who actually contracts and the provisional contract that tentatively concludes the contract can be performed. can get. By sending conversion data from the user to the store, the temporary signature information can be converted into an electronic signature and a contract can be made. After the temporary signature is confirmed at the store and the contents of the contract to be signed are confirmed, The effect that an electronic signature can be performed is obtained.
[0068]
In addition, according to the present invention, since the electronic signature is performed after the provisional signature, the message can be confirmed without providing a display or the like on the IC card, thereby suppressing an increase in manufacturing cost of the IC card. it can.
Further, according to the present invention, the electronic signature is performed after the provisional signature. Therefore, after the electronic signature is generated, it can be handled in the same manner as conventional electronic signature information, so that the electronic signature can be performed without reducing the compatibility between the IC card and other terminal devices. can get.
[0069]
Further, according to the present invention, since the secret key information is divided into two and stored in the IC card and the user terminal, if the IC card 500 is lost or stolen, the IC card Even if the partial secret key is copied to a third party without the user's knowledge, the contract is not established unless the conversion data is sent from the user terminal, so the confidentiality of the secret key information can be improved. An effect is obtained.
[Brief description of the drawings]
FIG. 1 is a schematic block diagram showing a configuration of an electronic signature system according to an embodiment of the present invention.
FIG. 2 is a flowchart for explaining the operation of the electronic signature system in the configuration of FIG. 1;
[Figure 3] Temporary Signature y_iIt is drawing for demonstrating.
FIG. 4 is a schematic block diagram illustrating a configuration of an electronic signature system according to a second embodiment.
FIG. 5 is a flowchart for explaining the operation of the electronic signature system in the configuration of FIG. 4;
[Explanation of symbols]
100 user terminals, 110 storage units,
130, 310, 520 control unit, 140 distribution unit,
150, 370, 510 communication unit, 180 random number generation unit,
190 calculation unit, 300 store terminal, 320 storage unit,
330 MSG generation unit, 340 instruction unit, 350 signature generation unit,
360 verification unit, 500 IC card, 530 storage unit,
540, 541 arithmetic unit, 550 random number generator

Claims (10)

In a signature generation apparatus having communication means for transmitting and receiving information for performing a signature with an electronic signature to a signature verification apparatus,
Storage means for storing public key information and secret key information to be information for performing the signature;
A temporary signature using secret key information stored in the storage means and a message that is information about the contents of a document to be digitally received from the signature verification apparatus by the communication means, and the temporary signature is converted into a signature. Calculation means for calculating conversion data which is information for
By said communication means to transmit the public key information and the temporary signature after sending the signature verification apparatus, the conversion data for converting the temporary signatures in the digital signature in the signing verification apparatus to the signature verification device A signature generation apparatus characterized by the above. In a signature generation apparatus having communication means for transmitting and receiving information for performing a signature with an electronic signature to a signature verification apparatus,
Storage means for storing public key information and secret key information to be information for performing the signature;
A random number generator for generating random numbers;
Generating signature information from a message and private key information, which is information relating to the content of the electronic signature received from the signature verification device, generating a temporary signature from the signature information and the random number, and the public key information A computing means for computing random number data from the random number;
Corresponding to the data “0” or “1” transmitted from the signature verification device after transmitting the public key information to the signature verification device and transmitting the random number data to the signature verification device by the communication means. Then, the random number or the temporary signature associated in advance is transmitted every time “0” or “1” is input. In a signature verification apparatus having communication means for transmitting and receiving information for performing a signature with an electronic signature to a signature generation apparatus,
Message generating means for generating a message which is information relating to the contents of the document to be signed by the electronic signature;
Verification detected using the public key information and the message provisional signature using said message and secret key information stored in the signature generation device whether or not a computation, corresponding to the secret key information Means,
By said verification means, in the case where the temporary signed is detected to have been computed, and control means for setting the temporary signature for said message,
After the temporary signed is set by said control means, when said from the signature generating device had sent the converted data generated in the signature generation apparatus, based on the converted data, the temporary signature or al Signature generation means for calculating signature information;
Have
The signature generation unit generates the signature information and comparison signature information from a message and a public key, and the verification unit compares the signature information with the comparison signature information to verify the signature. Signature verification device. In a signature verification apparatus having communication means for transmitting and receiving information for performing a signature with an electronic signature to a signature generation apparatus,
Message generating means for generating a message which is information relating to the contents of the document to be signed by the electronic signature;
Verifying means for detecting, using the public key information corresponding to the secret key information and the message, whether or not a temporary signature has been calculated using the secret key information stored in the signature generating apparatus and the message; ,
By said verification means, in the case where the temporary signed is detected to have been computed, and control means for setting the temporary signature for said message,
After the temporary signed is set by said control means, when said from the signature generating device had sent the random number generated in the signature generation apparatus, based on the random number, the temporary signatures or al signature information Signature generating means for computing
A plurality of random number data generated from the information in a random number to generate the temporary signature or et signature information after receiving from the signature generation apparatus, a data of "0" or "1" at random with respect to the signing generator And an instruction section for transmitting the message once,
The verification means, the random number or the temporary signed is input corresponds to the "0" or "1" sends the instruction unit, is received corresponding to the specified "0" or "1" and whether to validate that, compared with signature information signature generating means from the temporary signed及 beauty random number, and generates a comparison signature information from the message and the public key, the verification means and a comparison signature information and the signature information Signature verification apparatus characterized in that the signature is verified. Connected to the signature verification apparatus by communication means and connected to the signature generation apparatus that communicates with the signature verification apparatus by communication means, and signs the signature verification apparatus and the signature generation apparatus with an electronic signature Therefore, in the signature generation auxiliary device that transmits and receives information,
Storage means for storing secret key information, which is information for performing the signature, into two as partial secret key information, and storing one of the divided partial secret key information;
And the temporary signature with message comprising information about the content of the document for signing by the electronic signature transmitted partial secret key information stored with in the storage means from the signature verification apparatus, the signature the temporary signature Arithmetic means for calculating conversion data that is information for conversion,
After sending the temporary signature to the signature verification device by the communication unit, the signature generation and transmits the converted data to convert the temporary signatures in the digital signature in the signing verification apparatus to the signature verification device Auxiliary device. Connected to the signature generation auxiliary device by communication means, and connected to the signature generation device that communicates with the signature generation auxiliary device by communication means, and with respect to the signature generation auxiliary device and the signature generation device by an electronic signature In a signature verification device that sends and receives information for signing,
Message generating means for generating a message which is information relating to the contents of the document to be signed by the electronic signature;
Storage means for storing partial signature information transmitted from the signature generation device after transmitting the message to the signature generation device;
After sending the message to the signature generating auxiliary device private key temporary signature to the signature generation part secret key information stored in the auxiliary device and based on said message whether computed, which is the divided Verification means for detecting using public key information corresponding to information, the message and the partial signature information;
By said verification means, in the case where the temporary signed is detected to have been computed, and control means for setting the temporary signature for said message,
After the temporary signed is set by said control means, when said from the signature generating auxiliary device had sent the converted data generated in the signature generation auxiliary device, on the basis of on the converted data, the temporary station a signature generating means for calculating a name or et signature information,
Have
The signature generation unit generates the signature information and comparison signature information from a message and a public key, and the verification unit compares the signature information with the comparison signature information to verify the signature. Signature verification device. In a recording medium storing an electronic signature generation program in a signature generation apparatus having a communication means for transmitting and receiving information for performing a signature with an electronic signature to a signature verification apparatus,
The recording medium stores a secret key information serving as information for performing the signature;
Converting the temporary signature temporary signature to signature using a message that is information about the contents of a document for performing an electronic signature received from the signature verifying device by the private key information and the communication means is stored by said storing step And a calculation step for calculating conversion data that is information for
After sending the temporary signature to the signature verification device by the communication unit, a transmitting step of transmitting the converted data to convert the temporary signatures in the digital signature in the signing verification apparatus to the signature verification device, to the computer A recording medium storing a signature generation program characterized by being executed. In a recording medium storing a signature verification program in a signature verification apparatus having a communication means for transmitting and receiving information for performing a signature with an electronic signature to a signature generation apparatus,
The recording medium generates a message that is information about the content of the document to be signed by the electronic signature;
Verification step of detecting by using the public key information and the message whether the temporary signature based on said private key information message is computed to be stored in the signature generating apparatus, corresponding to the secret key information When,
By said verification step, when the temporary signed is detected to have been computed, and a control step of setting the temporary signature for said message,
After the temporary signed is set by said control step, when said from the signature generating device had sent the converted data generated in the signature generation apparatus, based on the converted data, the temporary signature or al A signature generation step for calculating signature information;
Have
A signature information wherein the signature generating means from the temporary signed及 beauty random number, and generates a comparison signature information from the message and the public key, verifies the signature the verification means compares the comparison signature information and the signature information A recording medium storing a signature verification program which is executed by a computer. Connected to the signature verification apparatus by communication means and connected to the signature generation apparatus that communicates with the signature verification apparatus by communication means, and signs the signature verification apparatus and the signature generation apparatus with an electronic signature Therefore, in a recording medium storing a signature generation program in a signature generation auxiliary device that transmits and receives information,
In the recording medium, the secret key information serving as information for performing the signature is divided into two as the partial secret key information, and a storage step of storing one of the divided partial secret key information;
Converting the signature the temporary signed the temporary signature based on the message comprising information about the content of the document for signing by the electronic signature transmitted the partial secret key information stored by the storing step from the signature verification device A calculation step for calculating conversion data, which is information for
A transmission step of transmitting the temporary signature after sending the signature verification apparatus, the conversion data for converting the temporary signatures in the digital signature in the signing verification apparatus to the signature verification device by said communication means,
A recording medium storing a signature generation program characterized by causing a computer to perform the above. Connected to the signature generation auxiliary device by communication means, and connected to the signature generation device that communicates with the signature generation auxiliary device by communication means, and with respect to the signature generation auxiliary device and the signature generation device by an electronic signature In a recording medium that records a signature verification program in a signature verification apparatus that transmits and receives information to perform a signature,
The recording medium generates a message that is information about the content of the document to be signed by the electronic signature;
Storing the partial signature information transmitted from the signature generation device after transmitting the message to the signature generation device;
After sending the message to the signature generating auxiliary device private key temporary signature based the signature generation part secret key information stored in the auxiliary device and to said message whether computed, which is the divided A verification step of detecting using public key information corresponding to information, the message, and the partial signature information;
By said verification step, when the temporary signed is detected to have been computed, and a control step of setting the temporary signature for said message,
After the temporary signed is set by said control step, when there is transmitted from the signature generation assisting device converting data generated in the signature generation auxiliary device, based on the converted data, the temporary signature a signature generation step of calculating the pressurized et signature information,
A recording medium storing a signature verification program characterized by causing a computer to perform the above.

Images