Patent Application
20130073845
The present invention relates to an anonymous credential system, a user device, a verification device, an anonymous credential method, and an anonymous credential program. More specifically, the present invention relates to an anonymous credential system and the like capable of handling characteristic values that are not binary values but are specific numerical values.
As the networks constituted with computers, mobile phones, and the like are being spread socially, there are increasing opportunities to use the digital signature technique for authenticating individuals. However, through the use of the digital signature, the history of activities done by the individual is recorded to the computer minutely. Thus, it is possible to have problems regarding protection of privacies.
The anonymous credential signature techniques (Anonymous Credential) depicted in Non-Patent Documents 1, 2, and the like are techniques that can overcome such problems. Provided that characteristics of each user are χ[1], - - - , χ[n] and an arbitrary subset of {1, - - - , n} is J={i1, - - - , im}, each user can generate a digital signature data “Signature” while keeping anonymous by disclosing a part of characteristics χ[i1], - - - , χ[im] belonging to iεJ and concealing the remaining characteristics. Note that m and n are natural numbers satisfying m<n.
The person who receives the digital signature data “Signature” can confirm that the user who generated the “Signature” has the characteristics χ[i1], - - - , χ[im] belonging to iεJ but cannot know the characteristics themselves. Only the authorized person who has an identification device can know the characteristics.
For example, when using a rental car, it is possible to rent a car while keeping anonymous by disclosing only a characteristic of “holding a driver's license” to the car rental company and signing to time information. The person who rented the car can be specified by those who are authorized such as the police by using an identification device only when the rented car is involved in an accident, a crime, or the like.
As technical documents related thereto, there are following patent documents. Among those, depicted in Patent Document 1 are a characteristic certificate issuing method and the like which, when the characteristic verifier cannot be specified individually, re-encrypt the characteristic certificate with a public key of a characteristic decryption organization and request the organization to disclose the characteristic value. In Patent Document 2, depicted are a certificate issuing device and the like which request to issue an anonymous public key by using respective encryption/decryption keys of “reply” and “kana”.
In Patent Document 3, depicted are an anonymous credential method and the like capable of using a group digital signature which certifies that a user belongs to a specific group. In Patent Document 4, depicted is an anonymous credential signature technique which keeps information regarding a specific user as a black list to make it possible to specify the user.
The anonymous credential signature techniques depicted in Non-Patent Documents 1, 2, and the like handle characteristic values having only two values such as “Yes”, “No”, e.g., “holds driver's license”, “male”, and “member of OO credit card”. However, there are characteristic values of each user having specific numerical values that are not binary values, which have a meaning in a fact that the numerical values are within a specific range.
For example, regarding a characteristic value “age”, it is necessary to check whether or not the user is under age in various scenes such as “driving a car”, “selling alcohol or cigarette”, and the like. Patent Documents 1 to 4 and Non-Patent Documents 1 to 2 described above do not disclose an anonymous credential signature technique which can prove that the user is not under age while concealing the specific numerical value of the age in such cases.
An object of the present invention is to provide an anonymous credential system, a user device, a verification device, an anonymous credential method, and an anonymous credential program capable of handling characteristic values that are not binary values but are specific numerical values and capable of proving that the characteristic value satisfies a specific condition even though the user conceals the characteristic value itself.
In order to achieve the foregoing object, the anonymous credential system according to the present invention is an anonymous credential system which includes, in a mutually-connected manner: a user device belonging to a specific group; a verification device which verifies that the user device belongs to the group without identifying discriminating information of the user device; an identification device which is authorized to identify the discriminating information; and a characteristic value disclosure device which is authorized to identify characteristic values of the user, wherein:
In order to achieve the foregoing object, the user device according to the present invention is a user device belonging to a specific group and constituting an anonymous credential system which includes, in a mutually-connected manner, a verification device which verifies that the user device belongs to the group without identifying discriminating information of the user device, an identification device which is authorized to identify the discriminating information, and a characteristic value disclosure device which is authorized to identify characteristic values of the user, and the user device includes:
In order to achieve the foregoing object, the verification device according to the present invention is a verification device which constitutes an anonymous credential system by being mutually connected to a user device belonging to a specific group, an identification device which is authorized to identify the discriminating information, and a characteristic value disclosure device which is authorized to identify characteristic values of the user, and verifies that the user device belongs to the group without identifying discriminating information of the constituting user device, and the verification device includes:
In order to achieve the foregoing object, the anonymous credential method according to the present invention is an anonymous credential method used in an anonymous credential system which includes, in a mutually-connected manner, a user device belonging to a specific group, a verification device which verifies that the user device belongs to the group without identifying discriminating information of the user device, an identification device which is authorized to identify the discriminating information, and a characteristic value disclosure device which is authorized to identify characteristic values of the user, wherein
In order to achieve the foregoing object, the anonymous credential program according to the present invention is an anonymous credential program used in an anonymous credential system which includes, in a mutually-connected manner, a user device belonging to a specific group, a verification device which verifies that the user device belongs to the group without identifying discriminating information of the user device, an identification device which is authorized to identify the discriminating information, and a characteristic value disclosure device which is authorized to identify characteristic values of the user, the program causing a computer, which stores in advance a user device public key, a user device private key corresponding thereto, a group public key showing that the user device belongs to the group, a member certificate containing a numerical value E acquired by performing modular exponentiation by using a reciprocal of data ρ generated from the group private key π and a part κ of the member certificate on the multiple that is acquired by multiplying a numerical value acquired by performing modular exponentiation on a part Φ_1 of group public key generated by using the group private key corresponding to the group public key with the user private key δ, a numerical value acquired by performing modular exponentiation on another part Φ_2 of group public key with a part β of the member certificate, and still another part Φ_0 of the group public key, a characteristic value certificate generated by using the user private key, which contains a characteristic value corresponding to the i-th χ[i] of the characteristic of the user, a numerical value E′[i] acquired by performing modular exponentiation by using a reciprocal of the p on the multiple that is acquired by multiplying a numerical value acquired by performing modular exponentiation on data Ψ_1[i] acquired from the χ[i] with the δ, a numerical value acquired by performing modular exponentiation on data Ψ2 acquired from the χ[i] with a part r[i] of the characteristic certificate, and data Ψ_0[i] acquired from the characteristics χ[i], an identification device public key of the identification device, and a characteristic value disclosure device public key of the characteristic value disclosure device, to execute:
As described above, the present invention is so structured that the user device generates and outputs the digital signature data containing the first encrypted text acquired by encrypting the user device public key with the identification device public key, the second encrypted text acquired by encrypting the characteristic value by the characteristic value disclosure device public key, and the signature text. Thus, when the verification device verifies the signature text of knowledge, it is possible to make a request to the characteristic value disclosure device to identify the characteristic value. This makes it possible to provide the anonymous credential system, the user device, the verification device, the anonymous credential method, and the anonymous credential program capable of handling the characteristic values that are not binary values but are specific numerical values and capable of proving that the characteristic value satisfies a specific condition even though the user conceals the characteristic value itself.
Hereinafter, structures of a first embodiment according to the present invention will be described by referring to the accompanying drawings 1 to 2.
First, basic contents of the embodiment will be described, and more specific contents will be described thereafter.
An anonymous credential system 1 according to the embodiment is an anonymous credential system constituted by mutually connecting: a user device 10 belonging to a specific group; a verification device 20 which verifies that the user device belongs to the group without identifying discriminating information of the user; an identification device 30 which is authorized to identify the discriminating information; and a characteristic value disclosure device 40 which is authorized to identify the characteristic value of the user. The user device 10 includes: a storage module 13 which stores in advance a user device public key 181, a user device private key 182 corresponding thereto, a group public key 191 showing that the user device belongs to the group, a member certificate 193 generated by using a group private key 192 corresponding to the group public key, a characteristic value certificate 184 generated by using the characteristic value corresponding to each of the characteristics of the user and the user private key, an identification device public key 161 of the identification device, and a characteristic value disclosure device public key 171 of the characteristic value disclosure device; and a signature unit 110 which generates digital signature data and transmits it to the authentication device. The signature unit 110 includes: a first function 111 which receives as inputs a plurality of subsets in which a plurality of characteristics of the user are classified; a second function 112 which generates a first encrypted text acquired by encrypting the user device public key with the identification device public key; a third function 113 which generates a second encrypted text acquired by encrypting the characteristic values belonging to a specific subset among the subsets with the characteristic value disclosure device public key; and a fourth function 114 which generates a signature text of knowledge showing that the data acquired by multiplying a part of the user device public key with the numerical values of the characteristic value certificate corresponding to each of all the characteristics satisfies a specific condition given in advance by using a part of the group public key and a part of the member certificate, and generates and outputs digital signature data containing the first and second encrypted texts as well as the signature text of knowledge.
Provided that: the member certificate 193 contains a numerical value E acquired by performing modular exponentiation by using a reciprocal of data ρ generated from the group private key π and a part κ of the member certificate on the multiple that is acquired by multiplying a numerical value acquired by performing modular exponentiation on a part Φ_1 of group public key with the user private key δ, a numerical value acquired by performing modular exponentiation on another part Φ_2 of group public key with a part β of the member certificate, and still another part Φ_0 of the group public key; the characteristic value certificate 184 corresponding to the i-th χ[i] of the characteristics contains a numerical value E′[i] acquired by performing modular exponentiation by using a reciprocal of the p on the multiple that is acquired by multiplying a numerical value acquired by performing modular exponentiation on data Ψ_1[i] acquired from χ[i] with the δ, a numerical value acquired by performing modular exponentiation on data Ψ2 acquired from χ[i] with a part r[i] of the characteristic certificate, and data Ψ_0[i] acquired from the characteristic χ[i]; the random number used when the third function 113 of the signature unit 110 generates the second encrypted text is τ[i], the numerical value acquired by multiplying E′[i] corresponding to χ[i] with E is G, and the numerical value acquired by adding all r[i] corresponding to all the characteristics χ[i] and then adding β is r, the fourth function 114 of the signature unit 110 generates a signature text of knowledge showing that G, r, the characteristic value ζ[i] belonging to a specific subset, the random number τ used when the second function generates the first encrypted text, and τ′[i] satisfy a specific given condition.
Further, the group public key contains data such as Y and Ω in addition to Φ_0, Φ_1, Φ_2, and a plurality of subsets contain a first subset which discloses only the characteristics, a second subset which discloses the characteristics and takes the characteristic values as the subject of encryption, and a third subset which discloses the characteristics and the characteristic values. The fourth function 114 of the signature unit: first randomly selects α, d, b, a, k from Z/qZ; further selects d′[i] randomly for the characteristics χ[i] belonging to the first and second subsets; defines the numerical value acquired by multiplying E′[i] corresponding to all the characteristics χ[i], E, and a numerical value acquired by performing modular exponentiation on Φ_2 with α as F; subsequently defines a numerical value acquired by multiplying a numerical value acquired by pairing Y with a numerical value that is acquired by multiplying a value acquired by multiplying Ψ_1[i] corresponding to the characteristics χ[i] belonging to the first and second subsets with a numerical value acquired by performing modular exponentiation with d′[i], a numerical value acquired by performing modular exponentiation on Φ_1 with d, and a numerical value acquired by performing modular exponentiation on Φ_2 with b, a numerical value acquired by pairing Ω with a value acquired by performing modular exponentiation on Φ_2 with a, and a numerical value acquired by pairing F with a numerical value acquired by performing modular exponentiation on Y with k of an inverted sign as L; defines a hash value of data containing F and L as c; defines a numerical value acquired by dividing a numerical value acquired by adding a to a numerical value acquired by multiplying α with c by a prescribed modulus as A; defines a numerical value acquired by dividing a numerical value acquired by adding d to a numerical value acquired by multiplying δ with c by a prescribed modulus as D; defines a numerical value acquired by dividing a numerical value acquired by adding k to a numerical value acquired by multiplying κ with c by a prescribed modulus as K; defines a numerical value acquired by adding the β to a numerical value acquired by adding all r[i] corresponding to all the characteristics χ[i], multiplying the c to a numerical value acquired by adding a product of κ and α thereto, and dividing the b by a prescribed modulus as B; defines a numerical value acquired by dividing a numerical value acquired by adding d′[i] to a numerical value acquired by multiplying ζ[i] and c to each i corresponding to the characteristics χ[i] belonging to the first and second subsets with a prescribed modulus as D′[i]; and outputs data containing F, c, A, D, T, B, K and D′[i] as a signature text.
In the meantime, the verification device 20 includes: a storage module 23 which stores in advance a group public key 191 and an identification device public key 161; a signature text verifying function 121 which extracts the first and second encrypted texts contained in the digital signature data received from the user device, and verifies whether or not the signature text of knowledge is proper by using the group public key; and a disclosure request function 122 which transfers the first encrypted text to the identification device 30 having an identification device private key corresponding to the identification device public key to make a request to identify the discriminating information of the user device, and transfers the second encrypted text to the characteristic value disclosure device having a characteristic value disclosure device private key corresponding to the characteristic value disclosure device public key to make a request to identify the characteristic value.
Further, the group public key contains each data Φ_0, Φ_1, Φ_2, Y, and Ω, a plurality of subsets contain a first subset which discloses only the characteristics, a second subset which discloses the characteristics and takes the characteristic values as the subject of encryption, and a third subset which discloses the characteristics and the characteristic values, and the signature text contains each data of data F, c, A, D, B, K, and D′[i] for χ[i] belonging to the first and second subsets. Further, the signature text verifying function 121: calculates Ψ_0[i] and Ψ_1[i] from each characteristic χ[i] belonging to all the subsets; subsequently defines a numerical value acquired by multiplying Φ_0 on a numerical value acquired by pairing Y with a product of numerical values acquired by multiplying a numerical value acquired by multiplying Ψ_1[i] corresponding to the characteristics χ[i] belonging to the first and second subsets with a numerical value acquired by performing modular exponentiation with D′[i], a product of numerical values acquired by performing modular exponentiation on Φ1 with D, and a product of numerical values acquired by performing modular exponentiation on Φ2 with B, a numerical value acquired by pairing Ω with a numerical value acquired by performing modular exponentiation on Φ_2 with A, and a numerical value acquired by pairing F with a numerical value acquired by performing modular exponentiation on Y with k of an inverted sign, and a numerical value acquired by performing modular exponentiation on a product of Ψ_0[i] corresponding to all the subsets χ[i] and Ψ_1[i] corresponding to χ[i] belonging to the third subset with ζ[i] as L; subsequently accepts the signature text when the hash value of the data containing F and L is equivalent to c, and rejects it if not.
Through having such structure, the anonymous credential system according to the embodiment can request the characteristic value disclosure device to identify the characteristic values when the verification device verifies the signature text of knowledge. This makes it possible to handle the characteristic values that are not binary values but specific numerical values, and to prove that the characteristic value satisfies a specific condition while the user conceals the characteristic value itself.
Hereinafter, this will be described in more details.
First, basic operations of the embodiment will be described. A normal anonymous credential signature technique first defines the private key of each user as δ and the public key as Δ=⊖̂δ, and acquires in advance a member certificate (β, κ, E) satisfying following Expression 1 from the authorized user who has the member certificate issuing device. Note here that the function e is a bilinear pairing, and Φ_0, Φ_1, Φ_2, Ω, and Y are the public keys of the authorized users. In this Description, “A with a superscript B (e.g., A to the power of B) is expressed as “ÂB”, and “A with a subscript B” is expressed as “A_B” in the lines other than numerical expressions.
e(Φ0Φ1δΦ2β,)=e(E,Ω
κ) (Expression 1)
Each user acquires E[i] satisfying following Expression 2 as the characteristic certificate of the characteristic χ[i] for i=1, - - - , n from the authorized user who has the characteristic certificate issuing device. Note here that Φ′[i] is a part of the public key of the authorized user.
e(Φ′0[i],)=e(E′[i],Ω
κ) (Expression 2)
When F is defined as in following Expression 3, the relation shown in following Expression 4 applies from Expression 1 and Expression 2.
F=E·(ΠiεJE′[i]) (Expression 3)
e(Φ′0·(ΠiεJΦ′0[i])·Φ1δΦ2β,)=e(F,Ω
κ) (Expression 4)
When generating the signature text satisfying the above relation, the random number τ is selected, the encrypted text Cipher shown in following Expression 5 is generated, and (δ, β, F) satisfying Expression 4 is generated as the signature of knowledge along with the Cipher. Note here that opk is the public key of the identification device.
Cipher=Enc(opk,Θ′δ;τ) (Expression 5)
The verifier can check the properness of the signature text by verifying the signature of knowledge. Further, the identification device can acquire the user public key Δ=⊖̂δ and identify the user ID corresponding to Δ through decrypting the Cipher with the private key corresponding to opk.
In the meantime, the embodiment employs the authorized user who discloses the characteristic value, and the device owned by the authorized user is referred to as the characteristic value disclosure device. Hash_0 and Hash_1 are defined as Hash functions, χ[i] is defined as the characteristic of each user, ζ[i] is defined as the characteristic value of χ[i], Ψ_0[i] is defined as Hash_0(χ[i]), and Ψ_1[i] is defined as Hash_1(χ[i]), respectively.
The embodiment uses a pair (r[i], E′[i]) satisfying following Expression 6 as the characteristic value certificate that certifies the characteristic of each user instead of E[i] satisfying Expression
e(Ψ0[i]Ψ1ζ[i]Φ2r[i],)=e(E′[i],Ω
κ) (Expression 6)
The user divides {1, - - - , n} showing the own characteristic into three subsets H, I, and J when generating the digital signature.
For the characteristic χ[i] satisfying iεH, it is desired to conceal the characteristic value ζ[i] from the verifier naturally and even from the authorized user who has the characteristic value disclosure device as well.
For the characteristic χ[i] satisfying iεI, it is desired to conceal the characteristic value ζ[i] from the verifier. However, the characteristic value ζ[i] may be disclosed to the authorized user who has the characteristic value disclosure device.
For the characteristic χ[i] satisfying iεJ, the characteristic value ζ[i] may be disclosed to the verifier.
When G and r are defined as in following Expression 7, the relation shown in following Expression 8 applies from Expression 1 and Expression 6. Note here that Enc and Enc′ are encryption functions, and τ, τ′, [i] are random numbers.
G=E·(ΠiεH∪I∪JE′[i])
r=β+(ΣiεH∪I∪Jr[i]) (Expression 7)
e(Φ0·(ΠiεH∪I∪JΨ0[i])·Φ1δ·(ΠiεH∪IΨ1[i]ç[i])·(ΠiεJΨ1[i]ç[i])Φ2f,)=e(G,Ω
κ) (Expression 8)
The user device operated by the user calculates Cipher[i] shown in following Expression 9. Further, the user device discloses the characteristic value ζ[i] for each iεJ, selects the characteristic value disclosure device R[i] to be the disclosure subject of the characteristic value for each iεI, defines the public key of the R[i] as apk[i], calculates the encrypted text Cipher′[i] shown in following Expression 10 for each iεI, and generates the signature text thereby.
Cipher[i]=Enc(opk,δ;τ) (Expression 9)
Cipher′[i]=Enc(apk[i],δ[i];τ′[i]) (Expression 10)
The characteristic value disclosure device R[i] has the private key that corresponds to apk[i]. Thus, it is possible to acquire the characteristic value ζ[i] by decrypting the Cipher′[i].
The user device 10 includes: a computation module (CPU: Central Processing Unit) 11 as the master unit for executing computer programs; an input/output module 12 which receives input operations from the user and displays calculation results acquired by the computation module 11; a storage module (RAM: Random Access Memory, ROM: Read Only Memory) 13 which stores the computer programs executed by the computation module 11, data, and the like: and a communication module 14 which exchanges data with other computers via the network 50.
Similarly, the verification device 20 also includes a computation module 21, a storage module 23, and a communication module 24, and further includes a display module 22 for displaying calculation results. Similarly, the identification device 30 also includes a computation module 31, a storage module 33, and a communication module 34. Similarly, the characteristic value disclosure device 40 also includes a computation module 41, a storage module 43, and a communication module 44. Functions and structures of each of those modules as hardware are the same in each of the devices.
In the computation module 11 of the user device 10, a signature unit 110 operates as a computer program. In the computation module 21 of the verification device 20, a verification unit 120 operates as a computer program. Further, in the computation module 31 of the identification device 30, an identification unit 130 operates as a computer program. Furthermore, in the computation module 41 of the characteristic value disclosure device 40, a characteristic value disclosure unit 140 operates as a computer program.
Further, common data called as a system parameter 150 is known and stored to all of each of the storage modules 13, 23, 33, and 44 of the respective devices. The system parameter 150 is constituted with a prime number q, (sufficient information for performing group calculations) on the order q group GRP[1], GRP[2], GRP[3], GRP′, (sufficient information for calculating) a bilinear mapping e from GRP[1]×GRP[2] to GRP[3]: GRP[1]×GRP[2]→GRP[3], and a generator Θ of GRP′.
From the viewpoint of the security, it is desirable that the discrete logarithm problems on GRP[1], GRP[2], and GRP[3] are difficult. As an example of such group, there is an elliptic curve group or its prime-number order subgroup. The elliptic curve group is necessarily characterized by the algebraic equation shown in Expression 11, so that it is possible to perform a group calculation on the elliptic curve group as long as (a, b, p) are given.
Y
2
=X
3
+aX+b mod p (Expression 11)
When using a prime-number order-number subset of an elliptic curve group, the generator of the subgroup is also required. Further, as the bilinear mapping e, it is possible to use Weil pairing or Tate pairing, for example. From the viewpoint of the security, it is desirable that the DDH problems on GRP′ are difficult. As an example of such group, there is an elliptic curve group, a cyclic group, or a prime-number order subgroup of those.
Further, the public key and the private key are generated and given to the identification device 30 in advance, which are stored to the storage module 33 in advance. These are referred to as the identification device public key (opk) 161 and the identification device private key (osk) 162, respectively. The identification device public key (opk) 161 is also distributed and stored to the storage module 13 of the user device 10 and the storage module 23 of the verification device 20 via the network 50.
As the identification device public key (opk) 161 and the identification device private key (ops) 162, a public key/private key pair of a specific public key encryption method is used. The encryption function of the public key encryption method is expressed as Enc. The symbol Enc (opk, M; r) shows an encrypted text that is acquired by encrypting a plain text M with the encryption function Enc by using the public key opk and the random number r.
Further, the public key and the private key are generated and given in advance to the characteristic value disclosure device 40, which are stored to the storage module 43 in advance. These are referred to as a characteristic value disclosure device public key (apk) 171 and a characteristic value disclosure device private key (ask) 172, respectively. The characteristic value disclosure device public key (apk) 171 is also distributed and stored to the storage module 13 of the user device 10 and the storage module 23 of the verification device 20 via the network 50.
As the characteristic value disclosure device public key (apk) 171 and the characteristic value disclosure device private key (ask) 172, a public key/private key pair of a specific public key encryption method is used. The encryption function of the public key encryption method is expressed as Enc′. The symbol Enc′ (apk, M; r) shows an encrypted text that is acquired by encrypting a plain text M with the encryption function Enc by using the public key apk and the random number r.
The public key and the private key are generated and given in advance to each user device 10, which are stored to the storage module 13 in advance. These are referred to as a user device public key 181 and a user device private key 182, respectively. Further, a list (LIST) 183 constituted with pairs of IDs of each of the user devices 10 and the respective user device public keys 181 is stored to the storage module 33 of the identification device 30 in advance. Note here that the user device public key 181 is an element Δ of GRP′, and the user device private key is an element δ of Z/qZ. These satisfy the relation of Δ=Θ̂δ.
In this embodiment, each of the user devices 10 belongs to some kind of group. A public key inherent to the group is given to such group. This is referred to as a group public key 191.
Hereinafter, it is assumed that there is only one group for simplifying the explanations. However, the method of the embodiment described herein can be easily expanded to the cases where there are a plurality of groups. The group public key 191 is generated in advance, and stored to the storage module 13 of each user device 10 in advance.
The group public key 191 is a set constituted with three elements Φ_0, Φ_1, Φ_2 of GRP[1] and two elements Y, Ω of GRP[2]. The group private key corresponding thereto is an element w which satisfies Ω=Ŷω. The group public key 191 and the group private key corresponding thereto are generated in advance by **, and only the group public key 191 is given to the user device 10 belonging to the group.
At the same time, information certifying the fact of being belonging to the group is also given to the user device 10 that belongs to the group. This information is referred to as a member certificate 193. The member certificate 193 is a set constituted with two elements β, κ of Z/qZ and an element E of GRP[1], which satisfies the relation shown in following Expression 12. Note here that ρ=ω+κ.
Φ0Φ1δΦ2β=Eρ (Expression 12)
Since Ω=Ŷω, it is also possible to rewrite Expression 12 as following Expression 13.
e(Φ0Φ1δΦ2β,)=e(E,Ω
κ) (Expression 13)
Further, the characteristics χ[1], - - - , χ[n] of each of the user devices 10 (individuals or parties managing the devices 10) are given to each of the user devices 10 belonging to the group. Characteristic values are allotted to a part of or the entire characteristics, and information certifying the properness of the characteristic values are also given thereto. This information is referred to as a characteristic value certificate 184.
Examples of the characteristics given with the characteristic value certificate 184 are name, sex, age, address, telephone number, and the like, and any other kinds may be employed as well. The characteristic values thereof may be “male” or “female” for the case of sex, for example, “18 years old” or “35 years old” for the case of age. In the embodiment, it is assumed that the characteristic is expressed as an arbitrary bit string, and the characteristic value is a number between 0 and q, inclusive.
Hash_0 and Hash_1 are different Hash functions which take values in GRP[1]. In a case where the member certificate 193 of the user device 10 is (β, κ, E), the characteristic value certificate 184 which certifies that the characteristic of the characteristic χ[i] of the user device 10 is ζ[i] is a set (r[i], E′[i]) constituted with an element of Z/qZ and an element of GRP[1], which satisfies the relation of following Expression 14.
Ψ0[i]1051ζ[i]Φ2r[i]=E′[i]ρ (Expression 14)
Note here that Ψ_0[i], ρ and Ω satisfy the relation of following Expression 15, so that Expression 14 can also be expressed as in following Expression 16.
Ψ0[i]=Hash0(χ[i])
Ψ1[i]=Hash1(χ[i])
ρ=ω+κ
Ω=ω (Expression 15)
e(Ψ0[i]Ψ1ζ[i]Φ2r[i],)=e(E′[i],
Ωκ) (Expression 16)
The method described as the embodiment can be used only for the user device 10 belonging to the group, so that it is assumed hereinafter that the user device 10 belongs to the group unless there is any specific notification.
In the meantime, the verification unit 120 includes: a signature verifying function 121 which judges whether or not the digital signature data “Signature” received from the user device 10 is proper; and a disclosure request function 122 which requests the identification device 30 to identify the user when the digital signature data “Signature” is proper, and further requests the characteristic value disclosure device 40 to disclose the characteristic value.
To the first function (input receiving function) 111 of the signature unit 110, the system parameter 150, the group public key (ipk) 191 shown in following Expression 17, the identification device public key (opk) 161, the user device public key (Δ) 181, the user device private key (δ) 182, the member certificate 193 (β, κ, E), the document M, the set of the characteristics of the user device 10 shown in following Expression 17, the set of the characteristic values of the characteristics, the set of the characteristic value certificates 184, and the set of the characteristic value disclosure device public key (apk) 171 are inputted (step S201).
Group public key ipk=(Φ0,Φ1,Φ2,,Ω)
Set of characteristics {χ[i]}iεH∪I∪J
Set of characteristic values {ξ[i]}iεH∪I∪J
Set of characteristic value certificates {(r[i],E′[i])}iεH∪I∪J
Set of characteristic value disclosure device public keys {apk[i]}iεH∪I∪J (Expression 17)
The second function (first encrypted text generating function) 112 of the signature unit 110 subsequently selects the random number τ from Z/qZ, and calculates the encrypted text “Cipher” shown in following Expression 18 (step S202).
Cipher Enc(opk,Δ;τ) (Expression 18)
The third function (second encrypted text generating function) 113 of the signature unit 110 further selects the random number τ′[i] from Z/qZ for each iεI, and calculates the encrypted text “Cipher′[i]” for each characteristic value shown in following Expression 19 (step S203).
Cipher′[i]=Enc′(apk[i],ξ[i];τ′[i]) (Expression 19)
Further, the fourth function (signature text output function) 114 of the signature unit 110 generates the signature of knowledge “Proof” shown in following Expression 20 (step S204). This Proof satisfies the conditions shown in following Expression 21.
At last, the fourth function (signature text output function) 114 of the signature unit 110 outputs the digital signature data “Signature” shown in following Expression 22 (step S205).
Signature=(Cipher,{Cipher′[i]}iεI,Proof) (Expression 22)
Note here that it is found that all the expressions described above can be satisfied by employing numerical values shown in Expression 23 as G″, r″, ζ[i], τ[i] and by employing each of δ′ and τ as δ″ and τ″.
G″=E·(ΠiεH∪I∪JE′[i])
r=β+(ΣiεH∪I∪Jr[i])
{ξ[i]}iεH∪I
{τ[i]}iεI (Expression 23)
The generated digital signature data Signature is transmitted to the verification device 20 along with a question Q shown in following Expression 24.
Q=(M,{χ[i]}iεH∪I∪J,{ξ″[i]}iεI, ID of identification device having public key opk, ID of identification device having public key apk[i1], - - - , ID of identification device having public key apk[im]) (Expression 24)
The verification device 20 checks that the signature text is generated by a proper method by the verification unit 120.
Further, when the digital signature data Signature is proper, the disclosure request function 122 of the verification unit 120 can transmit the query text Q and the digital signature data Signature to the identification device 30 to make a request to identify the user (step S214) and further can transmit those to the characteristic value disclosure device 40 to make a request to disclose the characteristic values as well (step S215) as necessary. The processing of steps S214 and S215 may not need to be executed when unnecessary.
The identification device 30 identifies the signatory who generated the signature text by using the identification unit 130 in response to the request of step S214.
In response to the request of step S215, the characteristic value disclosure device 40 identifies the characteristic value χ[i] of the signatory who generated the signature text by using the characteristic value disclosure unit 140.
The characteristic value disclosure unit 140 first reads Cipher′[i] and the characteristic value disclosure device private key (ask[i]) 172 (step S231), decrypts Cipher′[i] generated in step S203 with Expression 19 by the characteristic value disclosure device private key (ask[i]) 172 to acquire the decrypted result χ[i], and outputs it to the verification device 20 (step S232).
Next, overall operations of the first embodiment will be described. The anonymous credential method according to the embodiment is used in the anonymous credential system constituted by mutually connecting the user device belonging to a specific group, the verification device which certifies that the user device belongs to the group without identifying the discriminating information of the user device, the identification device which is authorized to identify the discriminating information, and the characteristic value disclosure device which is authorized to identify the characteristic value of the user, in which the user device: stores in advance the user device public key, the user device private key corresponding thereto, the group public key showing that the user device belongs to the user device, the member certificate generated by using the group private key corresponding to the group public key, the characteristic value certificate generated by using the characteristic values corresponding to each of the characteristics of the user and the user private key, the identification device public key of the identification device, and the characteristic value disclosure device public key of the characteristic value disclosure device; receives a plurality of subsets acquired by classifying a plurality of characteristics of the user as inputs (step S201); generates a first encrypted text in which the user device public key is encrypted with the identification device public key (step S202); generates a second encrypted text in which the characteristic value belonging to a specific subset among the subsets with the characteristic value disclosure device public key (step S203); generates a signature text of knowledge showing that data acquired by multiplying a part of the user device public key and the numerical values of the characteristic value certificates corresponding to each of all the characters satisfies a specific condition given in advance by using a part of the group public key and a part of the member certificate (step S204); and generates and outputs digital signature data containing the first and second encrypted text as well as the signature text of knowledge (step S205).
Further, the verification device upon receiving the digital signature data stores in advance the group public key and the identification device public key, extracts the first and second encrypted texts contained in the digital signature data received from the user device, and verifies whether or not the signature text of knowledge is proper by using the group public key (steps S211 to 213).
Note here that each of the above-described operation steps may be put into programs and have them executed by the user device 10 and the verification device 20 as the computers which directly execute each of the steps.
With such operations, the embodiment can provide following effects.
With the embodiment, the verification device can extract the first and second encrypted texts (Cipher and Cipher′[i]) contained in the digital signature data when the signature text of knowledge (Proof) contained in the digital signature data (Signature) is verified, and request the identification device having the private key corresponding to the identification device public key used when generating the encrypted text and to the characteristic value disclosure device having the private key corresponding to the characteristic value disclosure device public key to identify the user and to identify the characteristic value. Therefore, it is possible to handle the characteristic values that are not binary values but are specific numerical values with the digital signature data (Signature). This characteristic values can be handled only by the authorized user having the characteristic value disclosure device. Thus, as in the case of other anonymous credential systems, it is possible to certify that the characteristic value satisfies a specific condition while concealing the characteristic value itself.
A second embodiment of the present invention is structured to adapt in a better manner to the actual operation mode while keeping the same basic structure of the entire anonymous credential system as that of the first embodiment. That is, a member certificate issuing device 360 which is authorized to add and cancel the user device to the group and a characteristic value certificate issuing device 370 which certifies that the characteristic value of the user device is true are added further.
With this embodiment, it is also possible to acquire the same effects as those of the first embodiment. At the same time, it is possible to add and cancel the user device to the group and further to certify the characteristic value of the user device, for example. Hereinafter, it will be explained in more detail.
In addition to those, a member certificate issuing device 360 and a characteristic value certificate issuing device 370 are mutually connected to the anonymous credential system 310 via the network 50.
The structures of the user device 301, the verification device 320, the identification device 330, the characteristic value disclosure device 340 as hardware are the same as the structures of the user device 10, the identification device 30, and the characteristic value disclosure device 40 according to the first embodiment. That is, the user device 310 includes a computation module 311, an input/output module 312, a storage module 313, and a communication module 314. The verification device 320 includes a computation module 321, a storage module 323, and a communication module 324. The identification device 330 includes a computation module 331, a storage module 333, and a communication module 334. The characteristic value disclosure device 40 includes a computation module 341, a storage module 343, and a communication module 344.
Further, the structures of the member certificate issuing device 360 and the characteristic value certificate issuing device 370 as hardware are also the same. That is, the member certificate issuing device 360 includes a computation module 361, a storage module 363, and a communication module 364. The characteristic value certificate issuing device 370 also includes a computation module 371, a storage module 373, and a communication module 374.
In the computation module 311 of the user device 310, a member certificate acquiring unit 415, a characteristic value certificate acquiring unit 416, and a user device key generating unit 417 operate as computer programs in addition to a signature unit 410. In the computation module 321 of the verification device 320, a verification unit 420 operates as a computer program.
In the computation module 361 of the member certificate issuing device 360, a group key generating unit 460 and a member certificate issuing unit 461 operate as computer programs. Further, in the computation module 371 of the characteristic value certificate issuing device 370, a characteristic value certificate issuing unit 470 operates as a computer program.
The member certificate acquiring unit 415 of the user device 310 requests the member certificate issuing unit 461 of the member certificate issuing device 360 to add a member to an existing group. The characteristic value certificate acquiring unit 416 requests the characteristic value certificate issuing unit 470 of the characteristic value certificate issuing device 370 to issue a characteristic value certificate.
In the computation module 331 of the identification device 330, an identification unit 430 and an identification device key generating unit 431 operate as computer programs. The identification device key generating unit 431 generates the identification device public key (opk) 161 and an identification device private key (osk) 162. In the computation module 341 of the characteristic value disclosure device 340, a characteristic value disclosure device key generating unit 441 operates as a computer program in addition to a characteristic value disclosure unit 440. The characteristic value disclosure device key generating unit 441 generates the characteristic value disclosure device public key (apk) 171 and the characteristic value disclosure device public key (ask) 172.
The group key generating unit 460 of the member certificate issuing device 360 generates a group public key 191 and a private key 192 corresponding thereto. The member certificate issuing unit 461 performs adding, changing, or the like of a member to an existing group according to a request from the member certificate acquiring unit 451 of the user device 310, and issues the member certificate 193. The characteristic value certificate issuing unit 470 of the characteristic value certificate issuing device 370 issues the characteristic value certificate 184 according to a request from the characteristic value certificate acquiring unit 416 of the user device 310.
While each of the devices constituting the anonymous credential system 301 is illustrated as separate computer devices in
Λ1=Θλ (Expression 25)
The identification device key generating unit 431 first randomly selects the element λ of Z/qZ and the two elements Λ_1 and Λ_2 of GRP′, and defines Λ_1 to satisfy Expression 25 (step S501). Subsequently, the set of Λ_1 and Λ_2 is defined as the identification device public key (opk) 161, and λ is defined as the identification device private key (osk) 162 (step S502). The identification device public key (opk) 161 is transferred and known to the other devices which constitute the anonymous credential system 301.
Provided that opk=(Λ_1, Λ_2) is the identification device public key (opk) 161, Δ is an arbitrary element of GRP′, and τ is an element of Z/qZ, an encryption function Enc and a decryption function Dec corresponding thereto are expressed by following Expression 26.
Encryption function Enc(opk,Δ;τ)=(ΔΘτ,Λ1τ,Λ2τ)
Decryption function Dec(osk,Cipher)=U0/U11/λ
where osk=λ, Cipher=(U0,U1,U2) (Expression 26)
Λ′1=Θλ′ (Expression 27)
The characteristic value disclosure device key generating unit 441 first randomly selects the element λ′ of Z/qZ and the element Λ′_2 of GRP′, and defines Λ′_1 to satisfy Expression 27 (step S511). Subsequently, the set of Λ′_1 and Λ′_2 is defined as the characteristic value disclosure device public key (apk) 171, and λ′ is defined as the characteristic value disclosure device public key (ask) 172 (step S512). The characteristic value disclosure device public key (apk) 171 is transferred and known to the other devices which constitute the anonymous credential system 301.
Provided that apk=(Λ′_1, Λ′_2) is the characteristic value disclosure device public key and that ζ and τ′ are elements of Z/qZ, an encryption function Enc′ and a decryption function Dec′ (ask, Cipher) corresponding thereto are expressed by following Expression 28.
Encryption function Enc′(apk,Δ′;τ′)=(ΔΘξ+τ′,Λ′1τ′,Λ′2τ′)
Decryption function Dec′(ask,Cipher)=U′0/U′11/λ′
where ask=λ′, Cipher=(U′0,U′1,U′) (Expression 28)
The decryption function Dec′ cannot always be calculated efficiently. However, in a case where Cipher is an encrypted text acquired by encrypting a plain text ζ of short bit length, the calculation of Dec′ becomes efficient. Therefore, the embodiment is effective for a case where the bit length of each characteristic value that may possibly be decrypted is short.
The group public key 191 is transferred and known to the other devices which constitute the anonymous credential system 301. The group private key 192 is transferred only to the characteristic value certificate issuing device 370.
When the member certificate issuing device 360 and the user device 310 execute the member certificate issuing unit 461 and the member certificate acquiring unit 415, the user device 310 can be added to the group.
C=Φ
1
δΦ2ξ (Expression 29)
Subsequently, the member certificate acquiring unit 415 generates a zero-knowledge proof text prf showing that C and Δ are generated by a proper method by using the method shown in following Expression 30 (Δ, C, pro, and transmits it to the member certificate issuing device 360 (step S552).
Randomly select s and x from Z/qZ, and calculate Ξ=ΘS′, Γ=Φ1SΦ2X
Calculate η=Hash′(Ξ,Γ)
Calculate S=ηδ+s mod q, X=ηξ+x mod q
Define as prf=(η,S,X) (Expression 30)
The member certificate issuing unit 461 of the member certificate issuing device 360 upon receiving it certifies whether or not the received prf is proper by using the condition shown in following Expression 31 (step S553).
Calculate Ξ=ΘSΔ−η,Γ=Φ1SΦ2XC−η
Receive prf if η=Hash′(Ξ,Γ), and reject if not (Expression 31)
When prf is not proper, the member certificate issuing unit 461 issues an error and executes abnormal termination. When proper, ν and κ are randomly selected from Z/qZ, and E shown in Expression 32 is calculated (step S554).
E=(Φ0CΦ2ν)1/(ω+κ) (Expression 32)
Subsequently, the member certificate issuing unit 461 adds a set of ID of the user device 10 and Δ to the list (LIST) 183 (step S555), and transmits (ν, κ, E) to the user device 310 (step S556).
In the user device 310 that has received (ν, κ, E), the member certificate acquiring unit 415 judges whether or not the condition shown in following Expression 33 applies (step S557). When the condition does not apply, the member certificate acquiring unit 415 issues an error and executes abnormal termination. When the condition applies, the member certificate acquiring unit 415 stores (ν, κ, E) as the member certificate 193 (step S558), and ends the processing.
Calculate β=ξ+ν mod q
Judge whether or not e(Φ0Φ1δΦ2β,)=e(E,Ω
κ) (Expression 33)
When the characteristic value certificate issuing device 370 and the user device 310 execute the characteristic value certificate issuing unit 470 and the characteristic value certificate acquiring unit 416, respectively, it is possible to issue the characteristic value certificate 184 which proves that the characteristic value for the characteristic χ[i] of the user device 310 is ζ[i].
Ψ1[i]=Hash1(χ[i])
C′=Ψ
1
[i]
ξ[i]Φ2ξ′ (Expression 34)
Subsequently, the characteristic value certificate acquiring unit 416 generates a zero-knowledge proof text prf′ shown in Expression 35 indicating that C′ and Δ are generated by a proper method, and transmits (Δ, C′, prf′) to the member certificate issuing device 360 (step S562).
Randomly select s′ and x′ from Z/qZ, and calculate Ξ=ΘS′, Γ′=Ψ1[i]S′Φ2X′
Calculate η′=Hash′(Ξ′,Γ′)
Calculate S′=η′ξ[i]+s′ mod q, X′=η′ξ′+x′ mod q
Define as prf′=(η′,S′,X′) (Expression 35)
The characteristic value certificate issuing unit 470 of the member certificate issuing device 360 upon receiving it certifies whether or not the received prf′ is proper by using the condition shown in following Expression 36 (step S563).
Calculate Ψ1[i]Hash1(χ[i]),Ξ′=Θs′Δ−η′,Γ′=Ψ1[i]s′Φ2x′Ct-η′
Receive prf′ if η=Hash′(Ξ′,Γ′), and reject if not (Expression 36)
When prf′ is not proper, the characteristic value certificate issuing unit 470 issues an error and executes abnormal termination. When proper, ν′ is randomly selected from Z/qZ, calculates Ψ_0[i] and E′[i] shown in Expression 37 (step S564), and transmits (ν′, E′[i]) to the user device 310 (step S565).
Ψ0[i]=Hash0(χ[i])
E′[i]=(Ψ0[i]C′Φ2ν′)1/(ω+κ) (Expression 37)
In the user device 310 that has received (ν′, E′[i]), the characteristic value certificate acquiring unit 416 judges whether or not (ν′, E′[i]) satisfies the condition shown in following Expression 38 (step S566). When the condition is not satisfied, the characteristic value certificate acquiring unit 416 issues an error and executes abnormal termination.
Calculate r[i]=ξ′+ν′ mod q, Ψ0[i]=Hash0(χ[i])
Judge whether or not e(Φ0[i]Ψ1[i]ξ[i]Φ2t′[i],)=e(E[i],Ω
κ) (Expression 38)
When the condition is satisfied, the characteristic value certificate acquiring unit 416 stores the received (r[i], E′[i]) as the characteristic value certificate 184 (step S567), and ends the processing.
It is not specifically an issue how the characteristic value certificate issuing device 370 acquires the member certificate 193 containing κ, since it is not the scope of the present invention. However, from the viewpoints of the security, it is necessary for the characteristic value certificate issuing device 370 to check that κ is actually a part of the member certificate 193 of the user device 10 by using some kinds of method. For example, actually considered are: a method with which the member certificate issuing device 360 gives a signature to κ, and the characteristic value certificate issuing device 370 checks the signature; and a method with which the member certificate issuing device 360 discloses in advance a corresponding table of the user devices 10 and κ.
Group public key ipk=(Φ0,Φ1,Φ2,Y,Ω)
Public key opk=(Λ1,Λ2) of identification device 21
Public key Δ of user device 22, private key δ, member certificate (β,κ,E)
Set of characteristics of user device 22 {χ[i]}iεH∪I∪J
Set of characteristic values of the characteristics {ξ[i]}iεH∪I∪J
Set of characteristic value certificates of the characteristic values {(r[i],E′[i])}iεH∪I∪J
Set of public keys of characteristic value disclosure devices {apk[i]}iεH∪I∪J (Expression 39)
Then, the second function (the first encrypted text generating function) 412 of the signature unit 410 randomly selects τ from Z/qZ, and calculates the encrypted text Cipher acquired by encrypting Δ by the following procedure shown in following Expression 40 (step S572).
Calculate U0=ΔΘτ,U1=Λ1τ,U2=Λ2τ
Define as Cipher=(U0,U1,U2) (Expression 40)
Subsequently, the third function (the second encrypted text generating function) 413 of the signature unit 410 randomly selects τ′[i] from Z/qZ for each iεI, and calculates the encrypted text Cipher′[i] that is acquired by encrypting ζ[i] for each characteristic value shown in following Expression 41 (step S573).
Calculate U′0=Θξ[i]+r′[i],U′1=Λ1τ′[i],U′2=Λ2τ′[i]
Define as Cipher′[i]=(U′0[i],U′1[i],U′2[i]) (Expression 41)
The fourth function (the signature text output function) 414 of the signature unit 410 calculates signature of knowledge Proof by the procedure shown in following Expression 42 (step S574).
Randomly select a,d,t,b,a,k from Z,/qZ
Randomly select d′[i] and t′[i] from Z/qZ for each iεH∪I∪J
Calculate F=E·(ΠiεH∪I∪JE′[i])·Φ20
Calculate V0=Θd+t, V1=Λ1t, V2=Λ2t
Calculate V′0[i]=Θd′[i]+t′[i], V′1[i]=Λ′1[i]t′[i], V′2[i]=Λ′2t′[i], for each iεI
Calculate Ψ1[i]=Hash1(χ[i])
Calculate L=e(Φ1d·(ΠiεH∪IΨ1[i]d′[i])·Φ2b,)e(Φ2a,Ω)e(F,
−k)
Calculate c=Hash′(ipk,opk,{χ[i]}iεH∪I∪J,F,V0,V1,V2{V′0[i]}iεI,{V′1[i]}iεI, {V′2[i]}iεI,L,M
Calculate A=cα+a mod q, D=cδ+d mod q, T=cτ+t mod q, B=c(β+κα+(Σr[i]))+b mod q, K=cκ+k mod q
Calculate D′[i]=cξ′[i]+d′[i]mod q, T′[i]=cτ′[i]+t′[i]mod q for each iεI
Output Proof=(F,c,A,D,T,B,K,{D′[i]}iεH∪I,{T′[i]}iεI (Expression 42)
Then, the fourth function (the signature text output function) 414 of the signature unit 410 outputs the digital signature data Signature acquired at last shown in following Expression 43 to the verification device 320 (step S575), and ends the processing. Since Δ=Θ̂δ, it is also possible to do a calculation by having U_0 as U_0=Θ̂(δ+τ).
Sinnature=*Cipher,{Cipher′[i]}iεI,Proof) (Expression 43)
When executing the operation by the signature unit 410, the user device 310 uses the system parameter 150, the group public key 191, the identification device public key (opk) 161, the user device public key 181, the user device private key 182, and the member certificate 193 stored in the own storage unit 311.
Further, the user can use those arbitrarily selected by the user from the characteristics given to the user device 10 as the set of the characteristics {χ[i]}, can use the characteristic values and the characteristic value certificates 184 corresponding to those characteristics. The individual, group, or the program operating the user device 310 can arbitrarily decide which of the characteristics to use. The way of deciding it is not a technical issue, so that it is not included in the scope of the preset invention.
Group public key ipk=(Φ0,Φ1,Φ2,Y,Ω)
Public key opk=(Λ1,Λ2) of identification device
Set of characteristics {χ[i]}iεH∪I∪J
Set of characteristic values {ξ[i]}iεJ
Set of public keys of characteristic value disclosure devices {apk[i]}iεI
Signature text Signature=(Cipher,{Cipher′[i]}iεI,Proof) (Expression 44)
In the explanations below, the encrypted text Cipher, Cipher′[i], and the zero-knowledge proof text Proof are defined as in following Expression 45.
Cipher=(U0,U1,U2)
Cipher′[i]=(U′0[i],U′1[i],U′2[i])
Proof=(F,c,A,D,T,B,K,{D′[i]}iεH∪I,{T′[i]}iεI) (Expression 45)
Subsequently, the signature text verifying function 421 of the verification unit 420 verifies whether or not the zero-knowledge proof text Proof is proper by the procedure shown in following Expression 46 (step S582). When proper, it is received. If not, it is rejected, and abnormal termination is executed (steps S583 to 584). The signature text verifying function 421 may display the verified result of acceptance or rejection on the display module 322, may return the verified result to the user device 310 and display it on the input/output module 312, or may transfer it to another computer that performs processing following the authentication.
Calculate V0=ΘD+TU0−c,V1=Λ1TU1−c,V2[i]=Λ2TU2−c
Calculate V′0[i]=ΘD[i]+T′[i]U′0Q[i]−c,V′1[i]=Λ′1[i]T[i]U′1[i]−c,V′2[i]Λ′2T′[i]U′2[i]−c for each iεI
Calculate Ψ0[i]=Hash0(χ[h1]),Ψ1[i]=Hash1(χ[h1])
Calculate L=e(Φ1D·(ΠiεH∪IΨ1[i]D′[i])·Φ2B,)e(Φ2A,Ω)e(F,
−K)e(Φ0·(ΠiεH∪I∪JΨ0[i])·(ΠiεIΨ1[i]ξ[i])·,
)−c
Receive when c=Hash′(ipk,opk,{χ[i]}iεH∪I∪J,F,V0,V1,V2,{V′0[i]}iεI,{V′1[i]}iεI,{V′2[i]}iεI,L,M), and reject if not (Expression 46)
Further, when the digital signature data Signature is proper, the disclosure request function 422 of the verification unit 420 can transmit a query text Q and the digital signature data Signature to the identification device 430 to make a request to identify the user (step S585), and further can transmit those to the characteristic value disclosure device 440 to make a request to disclose the characteristic value as well (step S586). The processing of step S585 and S586 do not need to be executed when unnecessary.
When executing the operation by the verification unit 420, the verification device 320 uses the system parameter 150, the group public key 191, the identification device public key (opk) 161 stored in the own storage unit 321, and further uses the document M, the characteristics, the characteristic values, and the signature text received from the user device 310.
opk=(Λ1Λ2)
Signature=(Cipher,{Cipher′[i]}iεI,Proof)
Cipher=(U0,U1,U2) (Expression 47)
Δ=U0/U11/λ (Expression 48)
Then, the identification unit 430 acquires the ID of the user whose public key is Δ by collating it with the list (LIST) 183, and outputs it to the verification device 420 (step S592).
apk[j]=(Λ1[j],Λ2[j])
Signature=(Cipher,{Cipher′[i]}iεI,Proof)
Cipher′[i]=(U′0[i],U′1[i],U′2[i]) (Expression 49)
Calculate Δ′=U′0[J]/U′1U′[j]1/λ from Cipher′[i]=(U′0[i],U′1[i],U′2[i])
Judge whether or not Δ′=Θξ″ applies for ξ″=1,2, - - - ,
when judged as Δ′=ξ″, output ξ″ and stop (Expression 50)
While the present invention has been described by referring to the specific embodiments illustrated in the drawings, the present invention is not limited only to those embodiments described above. Any other known structures can be employed, as long as the effects of the present invention can be achieved therewith.
Regarding each of the embodiments described above, the new technical contents of the above-described embodiments can be summarized as follows. While a part of or a whole part of the embodiments can be summarized as follows as the new techniques, the present invention is not necessarily limited only to the followings.
The programs of the computer are recorded to non-transitory recording media.
An anonymous credential system which includes, in a mutually-connected manner: a user device belonging to a specific group; a verification device which verifies that the user device belongs to the group without identifying discriminating information of the user device; an identification device which is authorized to identify the discriminating information; and a characteristic value disclosure device which is authorized to identify characteristic values of the user, wherein:
The anonymous credential system as depicted in Supplementary note 1, wherein:
The anonymous credential system as depicted in Supplementary Note 2, wherein:
The anonymous credential system as depicted in Supplementary Note 3, wherein:
The anonymous credential system as depicted in Supplementary Note 1, wherein:
The anonymous credential system as depicted in Supplementary Note 5, wherein:
A user device belonging to a specific group and constituting an anonymous credential system which includes, in a mutually-connected manner, a verification device which verifies that the user device belongs to the group without identifying discriminating information of the user device, an identification device which is authorized to identify the discriminating information, and a characteristic value disclosure device which is authorized to identify characteristic values of the user, and the user device includes:
The user device as depicted in Supplementary Note 7, wherein:
A verification device which constitutes an anonymous credential system by being mutually connected to a user device belonging to a specific group, an identification device which is authorized to identify the discriminating information, and a characteristic value disclosure device which is authorized to identify characteristic values of the user, and verifies that the user device belongs to the group without identifying discriminating information of the constituting user device, and the verification device includes:
The verification device as depicted in Supplementary Note 9, wherein:
An anonymous credential method used in an anonymous credential system which includes, in a mutually-connected manner, a user device belonging to a specific group, a verification device which verifies that the user device belongs to the group without identifying discriminating information of the user device, an identification device which is authorized to identify the discriminating information, and a characteristic value disclosure device which is authorized to identify characteristic values of the user, wherein
An anonymous credential program used in an anonymous credential system which includes, in a mutually-connected manner, a user device belonging to a specific group, a verification device which verifies that the user device belongs to the group without identifying discriminating information of the user device, an identification device which is authorized to identify the discriminating information, and a characteristic value disclosure device which is authorized to identify characteristic values of the user, the program causing a computer, which stores in advance a user device public key, a user device private key corresponding thereto, a group public key showing that the user device belongs to the group, a member certificate containing a numerical value E acquired by performing modular exponentiation by using a reciprocal of data ρ generated from the group private key π and a part κ of the member certificate on the multiple that is acquired by multiplying a numerical value acquired by performing modular exponentiation on a part Φ_1 of group public key generated by using the group private key corresponding to the group public key with the user private key δ, a numerical value acquired by performing modular exponentiation on another part Φ_2 of group public key with a part β of the member certificate, and still another part Φ_0 of the group public key, a characteristic value certificate generated by using the user private key, which contains a characteristic value corresponding to the i-th χ[i] of the characteristic of the user, a numerical value E′[i] acquired by performing modular exponentiation by using a reciprocal of the ρ on the multiple that is acquired by multiplying a numerical value acquired by performing modular exponentiation on data Ψ_1[i] acquired from the χ[i] with the δ, a numerical value acquired by performing modular exponentiation on data Ψ2 acquired from the χ[i] with a part r[i] of the characteristic certificate, and data Ψ_0[i] acquired from the characteristics χ[i], an identification device public key of the identification device, and a characteristic value disclosure device public key of the characteristic value disclosure device, to execute:
This Application claims the Priority right based on Japanese Patent Application No. 2010-122797 filed on May 28, 2010 and the disclosure thereof is hereby incorporated by reference in its entirety.
The present invention can be broadly utilized in scenes where anonymous credential is used, particularly in scenes where it is necessary to prove that the characteristic value satisfies a specific condition. More specifically, the present invention can be utilized in scenes where it is necessary to verify that the user is not under age, e.g., use of a rental car, purchase of alcohol and cigarettes, entry to publicly operated gambling places and R-rated films.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2010-122797 | May 2010 | JP | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/JP2011/061775 | 5/23/2011 | WO | 00 | 11/27/2012 |
