Message presentation system, presentation device, and message presentation method

Abstract

The presentation device holds a template generated on the basis of registration biological information of a user, an encrypted message, and an issuing proof generated on the basis of a user public key corresponding to the template, the message, and an issuer secret key corresponding to an issuer subject of the message. The message is restored from the encrypted message using a user secret key generated on the basis of the template and presentation biological information of the user, a partial message is generated from the message on the basis of a presentation portion that is information for specifying a portion to be presented in the message, a presentation proof is generated on the basis of the presentation portion, an issuing proof, and the user secret key, and the presentation proof is issued. And outputting part of the message and the prompt proof.

Description

[0001] Reference-based citation

[0002] This application claims the benefit of Japanese Patent Application No. 2022-111731 filed on Jul. 12, 2022, the contents of which are incorporated herein by reference. Technical Field

[0003] The invention relates to a message prompting system, a prompting device and a message prompting method. Background Art

[0004] A system is known in which a user who has received an electronic message and data proving the contents of the message (proof of issuance) from an issuer presents all or part of the message and data proving that he or she has received the issuance (proof of presentation) from the issuer to a third-party verifier and receives verification.

[0005] For example, non-patent document 1 discloses a system in which an issuer issues data including a message called a claim and a proof for issuance called a Verifiable Credenial, and a user who receives the issuance (referred to as an owner in non-patent document 1) presents data including a verifiable credential and a proof for presentation called a Verifiable Presentation to a verifier.

[0006] It is preferred that the user can present only a portion (partial message) of the issued message to the verifier and keep the remaining portion confidential. As a method for performing such selective presentation, a method is disclosed in non-patent document 1, in which the issuer generates an electronic signature for the message and includes it in the issuance certificate, and the user includes the zero-knowledge proof related to the electronic signature in the presentation certificate. In addition, as another method for performing selective presentation, ACS (Anonymous Credentials System) is disclosed in non-patent document 2.

[0007] Prior Art Literature

[0008] Non-patent literature

[0009] Non-patent document 1: W3C, “Verifiable Credentials Data Model v1.1,” November 9, 2021 [retrieved February 4, 2022], Internet

[0010] Non-patent document 2: Olivier Sanders, “Efficient redactable signature and application to anonymous credentials,” January 28, 2020 [retrieved February 4, 2022], Internet Summary of the invention

[0011] Problems to be solved by the invention

[0012] In the method described in Non-Patent Document 1 or Non-Patent Document 2, if the data saved by the user is leaked, a security threat will arise. For example, in the method described in Non-Patent Document 1, the user needs to save the message and the issuance certificate. However, if the issuance certificate is leaked, there is a threat that someone other than the user may impersonate the user and make a notification.

[0013] In addition, in the method described in non-patent document 2, the user needs to save the user secret key, the message, and the issuance certificate. However, if the user secret key is leaked to a verifier who has received a set of a partial message and a presentation certificate for the partial message, there is a threat that the verifier may impersonate the user and present the message to other verifiers.

[0014] Furthermore, in Non-Patent Document 1 and Non-Patent Document 2, when a message is leaked, all the unindicated parts of the message will be known to the verifier or the third party.

[0015] Therefore, one embodiment of the present invention realizes a message notification system that can ensure security even when there is a possibility that data stored by a user may be leaked.

[0016] Means for solving problems

[0017] In order to solve the above-mentioned problems, one embodiment of the present invention adopts the following structure. A message prompting system includes a prompting device, the prompting device holds a template generated based on the user's registered biometric information, an encrypted message obtained by encrypting a message including one or more message elements, and an issuance certificate generated based on a user public key corresponding to the template, the message, and an issuer secret key corresponding to the issuer of the message, obtains the user's biometric information for prompting, generates a user secret key corresponding to the user public key based on the template and the biometric information for prompting, restores the message by decrypting the encrypted message using the user secret key, generates a partial message from the message based on a prompt part that is information for determining a part to be prompted in the message, generates a prompt certificate based on the prompt part, the issuance certificate, and the user secret key, and outputs the partial message and the prompt certificate.

[0018] Effects of the Invention

[0019] According to one embodiment of the present invention, a message notification system is realized that can ensure security even when there is a possibility that data stored by a user may be leaked.

[0020] Other problems, structures, and effects than those described above will become apparent from the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1A This is a block diagram showing an example of the configuration of the message notification system in the first embodiment.

[0022] Figure 1B This is a block diagram showing an example of the functional configuration of the issuer registration device in the first embodiment.

[0023] Figure 1C This is a block diagram showing an example of the functional configuration of the user registration device in the first embodiment.

[0024] Figure 1D This is a block diagram showing an example of the functional configuration of the verifier registration device in the first embodiment.

[0025] Figure 1E This is a block diagram showing an example of the functional configuration of the issuing device in the first embodiment.

[0026] Figure 1F This is a block diagram showing an example of the functional configuration of the acquisition device in the first embodiment.

[0027] Figure 1G This is a block diagram showing an example of the functional configuration of the presentation device in the first embodiment.

[0028] Figure 1H This is a block diagram showing an example of the functional configuration of the verification device in the first embodiment.

[0029] Fig. 1I This is a block diagram showing an example of the functional configuration of the log output device in the first embodiment.

[0030] Figure 2 This is a block diagram showing an example of the hardware configuration of a computer constituting each device included in the message presentation system in the first embodiment.

[0031] Figure 3 This is a sequence diagram showing an example of the issuer registration process in the first embodiment.

[0032] Figure 4 This is a sequence diagram showing an example of user registration processing in the first embodiment.

[0033] Figure 5This is a sequence diagram showing an example of the verifier registration process in the first embodiment.

[0034] Figure 6 This is a sequence diagram showing an example of issuance processing in Example 1.

[0035] Figure 7 This is a sequence diagram showing an example of the presentation process in the first embodiment.

[0036] Figure 8 This is a sequence diagram showing an example of the log output process in the first embodiment.

[0037] Fig. 9 This is a flowchart showing an example of transition of the display screen of the presentation device in the presentation process in the first embodiment. DETAILED DESCRIPTION

[0038] Hereinafter, an embodiment of the present invention will be described in detail based on the drawings. It should be noted that this embodiment is only an example for implementing the present invention and does not limit the technical scope of the present invention.

[0039] [Example 1]

[0040] In the first embodiment, a message notification system via a network is described. A message is any data expressed in electronic form. For example, a driver's license, a personal number card, a work experience certificate, a diploma, a completion certificate, a vaccination certificate, a purchase history, a credit card usage history, an employee ID, a student ID, and a membership card expressed in electronic form are all examples of messages. Hereinafter, a message is assumed to be a message expressed in electronic form, and the proviso "expressed in electronic form" is omitted.

[0041] A message, for example, is composed of one or more message elements. Message elements, for example, are units that can be prompted as parts. For example, M1: = (Name: Taro Hitachi, Date of birth: January 1, 2000, Gender: Male, Address: 1-6-6, Marunouchi, Chiyoda-ku, Tokyo) is an example of a message. Among them, A1: = A2 expresses that A1 is defined by A2. M1 is composed of four message elements, "Name: Taro Hitachi", "Date of birth: January 1, 2000", "Gender: Male", and address: "1-6-6, Marunouchi, Chiyoda-ku, Tokyo", which are separated by ",".

[0042] In addition, the method of defining message elements is not limited to the above. For example, M2: = (surname: Hitachi, given name: Taro, date of birth: January 1, 2000, gender: male, prefecture part of address: Tokyo, city, town, village and below: 1-6-6, Marunouchi, Chiyoda-ku) is also an example of a message.

[0043] Information for specifying "a portion of a message that is prompted in the prompt process" is referred to as a prompt portion, and a group of message elements corresponding to the prompt portion in a message is referred to as a partial message. For example, when the prompt portion in M1 is (name, date of birth), the partial message corresponding to the prompt portion is (name: Taro Hitachi, date of birth: January 1, 2000).

[0044] The information that expresses the meaning of each message element is called a key, and the information itself is called a value. For example, in the message element "Name: Taro Hitachi", the key is "name" and the value is "Taro Hitachi".

[0045] As for the structure of the message, as shown in the above-mentioned M1, each message element may be composed of a key and a value, or each message element may be composed of a value, and the structure information may be defined separately as follows. For example, M3 may be defined only by a value, such as M3: = (Taro Hitachi, January 1, 2000, male, 1-6-6, Marunouchi, Chiyoda-ku, Tokyo), and the structure information S3 may be defined by a key, such as S3: = (name, date of birth, gender, address). By referring to the key of the structure information S3 corresponding to each position of the message element of the message M3, the meaning of each message element can be known.

[0046] In the case where each message element is composed of a value, the construction information can be sent, encrypted, and decrypted together with the message or part of the message. At this time, the construction information can be associated with the message or part of the message. For example, the construction information can be included in the object of the signature included in the certificate of issuance. Alternatively, the construction information can be stored in a public database (DB (DataBase)) that is difficult to tamper with (such as a blockchain, or a database of a reliable organization, etc.), and a pointer to the storage location can be included in the object of the signature included in the certificate of issuance.

[0047] Alternatively, the following rule may be determined for the system: the structure information is stored in a specified position of the message, and the structure information must be prompted when prompted. For example, when the rule that the first message element of the message expresses the structure information is determined, M4:=(S3, Hitachi Taro, January 1, 2000, male, 1-6-6, Marunouchi, Chiyoda-ku, Tokyo) is an example of a message.

[0048] In addition, the message may also include the name of the message (such as "driver's license"), the name of the issuer, the validity period, and other information related to the message. In this case, in the prompt process, the prompt may be performed only when the validity period attached to the message has not expired, and the process may be terminated when it has expired.

[0049] Figure 1AThis is a block diagram showing a configuration example of a message notification system. Figure 1B This is a block diagram showing an example of the functional configuration of the issuer registration device 100 . Figure 1C It is a block diagram showing an example of the functional configuration of the user registration device 200. Figure 1D This is a block diagram showing an example of the functional configuration of the verifier registration device 300. Figure 1E This is a block diagram showing an example of the functional configuration of the issuing device 400. Figure 1F It is a block diagram showing an example of the functional configuration of the acquisition device 500. Figure 1G It is a block diagram showing an example of the functional configuration of the presentation device 600. Figure 1H It is a block diagram showing an example of the functional configuration of the verification device 700. Fig. 1I This is a block diagram showing an example of the functional configuration of the log output device 800 .

[0050] The message prompt system 10, for example, includes an issuer registration device 100, a user registration device 200, a verifier registration device 300, an issuance device 400, an acquisition device 500, a prompting device 600, a verification device 700, a log output device 800, an issuer secret key storage database 901, an issuer public key storage database 902, a user first database 903, a verifier secret key storage database 904, a verifier public key storage database 905, a user second database 906 and a user third database 907.

[0051] For example, an issuer registration device 100, a user registration device 200, a verifier registration device 300, an issuance device 400, an acquisition device 500, a prompting device 600, a verification device 700, a log output device 800, an issuer public key storage database 902, a user first database 903, a verifier public key storage database 905, a user second database 906, and a user third database 907 are connected to a network 911.

[0052] For example, the issuer registration device 100, the issuing device 400, and the issuer secret key storage database 901 are connected to the network 912. For example, the verifier registration device 300, the verification device 700, and the verifier secret key storage database 904 are connected to the network 913.

[0053] The Internet and a local area network within an organization are examples of the network 911, the network 912, and the network 913. The network 911, the network 912, and the network 913 may be a wired network or a wireless network.

[0054] In addition, Figure 1AIn the example of , the network connected to the devices in the message notification system 10 is composed of network 912, network 912 and network 913, but it is not necessarily configured in this way. For example, only one of network 911, network 912 or network 913 may exist, and all devices included in the message notification system 10 are connected to the one network.

[0055] However, in order to make it difficult for the issuer secret key to be illegally used when communicating, it is preferable to take measures to make it difficult for the issuer secret key to be leaked. An example of such measures is to perform authentication between the devices performing such communication. Similarly, in order to make it difficult for the verifier secret key to be illegally used, it is preferable to take measures to make it difficult for the verifier secret key to be used outside the verification device 700.

[0056] The issuer registration device 100 includes, for example, an issuer registration device communication unit 101 and an issuer key generation unit 102, both of which are functional units. The issuer registration device communication unit 101 communicates with a device connected to the issuer registration device 100. The issuer key generation unit 102 generates an issuer secret key and an issuer public key of an issuing entity that issues a message and an issuance certificate (data that certifies the contents of the message) to a user.

[0057] The user registration device 200 includes, for example, a user registration device communication unit 201, a registration biometric information acquisition unit 202, and a user key generation unit 203, all of which are functional units. The user registration device communication unit 201 communicates with a device connected to the user registration device 200. The registration biometric information acquisition unit 202 acquires registration biometric information. The user key generation unit 203 generates a set of a template and a user public key based on the registration biometric information.

[0058] The verifier registration device 300 includes, for example, a verifier registration device communication unit 301 and a verifier key generation unit 302, both of which are functional units. The verifier registration device communication unit 301 communicates with a device connected to the verifier registration device 300. The verifier key generation unit 302 generates a verifier secret key and a verifier public key.

[0059] The issuing device 400 includes, for example, an issuing device communication unit 401 , a user secret key knowledge certificate verification unit 402 , a message acquisition unit 403 , an issuing certificate generation unit 404 , and a data encryption unit 405 , all of which are functional units.

[0060] The issuing device communication unit 401 communicates with the device connected to the issuing device 400. The user secret key knowledge proof verification unit 402 performs user secret key knowledge proof verification using the user secret key knowledge proof and the user public key described later. The message acquisition unit 403 acquires the message. The issuing certificate generation unit 404 generates an issuing certificate using the user public key, the issuer secret key and the message. The data encryption unit 405 encrypts the message using the user public key.

[0061] The acquisition device 500 includes, for example, an acquisition device communication unit 501, an issuance biometric information acquisition unit 502, a user secret key restoration unit 503, and a user secret key knowledge certificate generation unit 504, all of which are functional units. The acquisition device communication unit 501 communicates with a device connected to the acquisition device 500. The issuance biometric information acquisition unit 502 acquires issuance biometric information. The user secret key restoration unit 503 restores the user secret key using the template and the issuance biometric information. The user secret key knowledge certificate generation unit 504 generates a user secret key knowledge certificate using the restored user secret key.

[0062] The prompting device 600, for example, includes a prompting consent acquisition unit 621, a prompting device communication unit 601, a prompting biometric information acquisition unit 602, a user secret key recovery unit 603, a data decryption unit 604, a template verification unit 605, a prompting certificate generation unit 606, a partial message selection unit 607, a data encryption unit 608 and a result output unit 609, all of which are functional units.

[0063] The prompt consent acquisition unit 621 acquires the user's consent to the prompt of the partial message described later. The prompt device communication unit 601 communicates with the device connected to the prompt device 600. The prompt biometric information acquisition unit 602 acquires the prompt biometric information. The user secret key recovery unit 603 recovers the user secret key using the template and the prompt biometric information. The data decryption unit 604 decrypts the encrypted message using the recovered user secret key.

[0064] The template verification unit 605 performs verification processing on the template. The prompt certificate generation unit 606 uses the issuance certificate and the user secret key to generate a prompt certificate for the prompt part of the decrypted message (data used to prove that the message that is the selection source of the partial message to be prompted is a message issued by the issuer). The partial message selection unit 607 selects the prompt part included in the decrypted message and generates a partial message. The data encryption unit 608 encrypts the partial message using the verifier public key. In addition, the data encryption unit 608 encrypts the log related to the prompt device 600 using the user public key. The result output unit 609 outputs the verification result of the verification device 700 for the prompt certificate.

[0065] The verification device 700 includes, for example, a verification device communication unit 701, a presentation part designation unit 702, a data decryption unit 703, and a presentation certificate verification unit 704, which are all functional units. The verification device communication unit 701 communicates with a device connected to the verification device 700. The presentation part designation unit 702 designates a part of a message that is a presentation object. The data decryption unit 703 decrypts the encrypted partial message using the verifier secret key. The presentation certificate verification unit 704 performs verification processing on the presentation certificate using the issuer public key and the decrypted partial message.

[0066] The log output device 800 includes, for example, a log output device communication unit 801 , a log output biometric information acquisition unit 802 , a user secret key restoration unit 803 , a data decryption unit 804 , and a log output unit 805 , all of which are functional units.

[0067] The log output device communication unit 801 communicates with a device connected to the log output device 800. The log output biometric information acquisition unit 802 acquires the log output biometric information. The user secret key restoration unit 803 restores the user secret key using the template and the log output biometric information. The data decryption unit 804 decrypts the encrypted log related to the notification device 600 using the restored user secret key. The log output unit 805 outputs the decrypted log.

[0068] The issuer secret key storage database 901 stores the issuer secret key. As an example of the issuer secret key storage database 901, an auxiliary storage device in a PC (Personal Computer) can be cited. In addition, as another example, a physical token or an IC (Integrated Circuit) card can be cited. The issuer secret key storage database 901 can also be included in the issuer registration device 100 or the issuing device 400.

[0069] The issuer public key storage database 902 stores the issuer public key. Examples of the issuer public key storage database 902 include a database of a reliable organization, a government database, a blockchain, a distributed ledger, or a decentralized database. The issuer public key storage database 902 is preferably public and difficult to tamper with.

[0070] The user first database 903, the user second database 906, and the user third database 907 store information related to the user. For example, the user first database 903 stores the user's template and the user's public key. For example, the user second database 906 stores encrypted messages and issuance certificates. For example, the user third database 907 stores encrypted logs.

[0071] In addition, the information stored in the above-mentioned user first database 903, user second database 906 and user third database 907 may not necessarily be divided in this way (that is, the above-mentioned information may be stored in any one of the user first database 903, user second database 906 and user third database 907). In addition, the database storing information related to the user may not necessarily be divided into three. For example, these three databases may be combined into one. Cloud storage and servers of organizations such as enterprises are examples of the user first database 903, user second database 906 and user third database 907. In addition, each database may be composed of multiple physical devices, and each data is divided and stored. For example, the user first database 903 may be composed of multiple physical devices, and on the basis of the user public key being divided into multiple parts, each physical device constituting the user first database 903 stores the divided parts of the user public key.

[0072] In addition, the above-mentioned multiple devices may also be physically included in one terminal. As an example, the following structure can be cited: the issuer terminal owned by the issuing institution includes an issuer registration device 100, an issuing device 400, and an issuer secret key storage database 901, the user personal terminal includes a user registration device 200, an acquisition device 500, and a prompting device 600, and the verifier terminal owned by the verifier includes a verifier registration device 300, a verification device 700, and a verifier secret key storage database 904.

[0073] As another example, the following configuration can be cited: the first issuer terminal owned by the issuing institution is equipped with an issuer registration device 100, an issuing device 400, and an issuer secret key storage database 901, the second issuer terminal owned by the issuing institution is equipped with a user registration device 200 and an acquisition device 500, the first verifier terminal owned by the verifier is equipped with a verifier registration device 300, a verification device 700, and a verifier secret key storage database 904, and the second verifier terminal owned by the verifier is equipped with a prompting device 600. In the case of this example, even if the user does not have his own terminal, he can use the second issuer terminal owned by the issuing institution to perform issuance processing and obtain messages, and can use the second verifier terminal owned by the verifier to perform prompting processing. In these configuration examples, an example can be cited in which the log output device 800 is included in the user's personal terminal or other terminals, and the remaining database is installed as above.

[0074] Figure 2 This is a block diagram showing an example of the hardware configuration of a computer that constitutes each device included in the message notification system 10 in Example 1. The computer 10000 includes, for example, a CPU (Central Processing Unit) 10001, a memory 10002, an auxiliary storage device 10003, an input device 10004, an output device 10005, a communication device 10006, and a reading device 10007.

[0075] CPU 10001 includes a processor, and executes a program stored in memory 10002. Memory 10002 includes ROM (Read Only Memory) as a non-volatile storage element and RAM (Random Access Memory) as a volatile storage element. ROM stores unchanging programs (such as BIOS (Basic Input / Output System)). RAM is a high-speed and volatile storage element such as DRAM (Dynamic Random Access Memory), and temporarily stores programs for CPU 10001 to execute and data used when the programs are executed.

[0076] The auxiliary storage device 10003 is a large-capacity and non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or a flash memory (SSD (Solid State Drive)), and stores programs executed by the CPU 10001 and data used when the programs are executed. That is, the programs are read from the auxiliary storage device 10003, loaded into the memory 10002, and executed by the CPU 10001.

[0077] The input device 10004 is a device such as a keyboard or a mouse that receives input from an operator. The output device 10005 is a device such as a display device or a printer that outputs the execution result of the program in a format that can be visually recognized by the operator.

[0078] The communication device 10006 is a network interface device that controls communication with other devices according to a predetermined protocol. The communication device 10006 includes a serial interface such as a USB (Universal Serial Bus), for example.

[0079] A part or all of the program executed by the CPU 10001 may be provided to the computer 10000 from a removable medium (CD-ROM, flash memory, etc.) as a nonvolatile storage medium or an external computer having a nonvolatile storage device via a network, and stored in the nonvolatile auxiliary storage device 10003 as a nonvolatile storage medium. The reading device 10007 is an interface device for reading data from a removable medium.

[0080] Each device included in the message prompt system 10 is a computer system constructed on a physical computer or on multiple computers constructed logically or physically. It can operate in individual threads on the same computer or on a virtual computer constructed on multiple physical computer resources.

[0081] For example, the issuer registration device communication unit 101 and the issuer key generation unit 102 of the issuer registration device 100 are included in the CPU 10001 of the computer 10000 constituting the issuer registration device 100. For example, the CPU 10001 of the computer 10000 constituting the issuer registration device 100 functions as the issuer registration device communication unit 101 by operating in accordance with the issuer registration device communication program loaded on the memory 10002 of the computer 10000, and functions as the issuer key generation unit 102 by operating in accordance with the issuer key generation program loaded on the memory 10002. The same applies to other devices included in the message notification system 10, such as the CPU 10001 of the computer 10000 constituting the device, the program loaded on the memory 10002 of the computer 10000, and the relationship between the functional units included in the device.

[0082] Furthermore, part or all of the functions of the functional units included in each device included in the message notification system 10 may be implemented by hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array).

[0083] The information held by each device included in the message notification system 10 is stored in the memory 10002 or the auxiliary storage device 10003 of the computer 10000 constituting the device. In addition, in the present embodiment, the information used by the message notification system 10 does not depend on the data structure and can be represented by any data structure. For example, a data structure appropriately selected from a table, a list, a database, or a queue can store information.

[0084] Although not shown in the figure, the computer 10000 constituting the user registration device 200, the acquisition device 500, the presentation device 600, and the log output device 800 may further include a sensor for acquiring biometric information such as face, fingerprint, iris, palm print, and finger vein.

[0085] Figure 3 This is a sequence diagram showing an example of the issuer registration process in Example 1. In step S1101, the issuer key generation unit 102 generates an issuer secret key and an issuer public key. As a method for generating a key pair consisting of an issuer secret key and an issuer public key, for example, as described later, a key pair generation process in an editable signature method or ACS (Anonymous Credentials System) may be performed.

[0086] In step S1102, the issuer registration device communication unit 101 transmits the issuer secret key generated in step S1101 to the issuer secret key storage database 901. In step S1911, the issuer secret key storage database 901 stores the issuer secret key transmitted in step S1102.

[0087] In step S1103, the issuer registration device communication unit 101 transmits the issuer public key generated in step S1101 to the issuer public key storage database 902. In step S1921, the issuer public key storage database 902 stores the issuer public key transmitted in step S1103.

[0088] Figure 4 2 is a sequence diagram showing an example of user registration processing in Example 1. In step S2201, the registration biometric information acquisition unit 202 acquires registration biometric information from the user. As biometric information, any type such as face, fingerprint, iris, palm print, and finger vein can be used. In addition, multiple types of biometric information can also be used in combination.

[0089] In step S2202, the user key generation unit 203 generates a set of a template and a user public key using the biometric information for registration acquired in step S2201. A specific example of the process in step S2202 will be described later.

[0090] In step S2203, the user registration device communication unit 201 transmits the set of the template and the user public key generated in step S2202 to the first user database 903. In step S2931, the first user database 903 stores the set of the template and the user public key transmitted in step S2203.

[0091] Figure 5 3301, the verifier key generation unit 302 generates a pair of a verifier secret key and a verifier public key. As a method for generating a key pair consisting of a verifier secret key and a verifier public key, a key pair generation algorithm in any encryption method can be used. In addition, a key pair generated by a key pair generation algorithm in any signature method may or may not be included.

[0092] In step S3302, the verifier registration device communication unit 301 transmits the verifier secret key generated in step S3301 to the verifier secret key storage database 904. In step S3941, the verifier secret key storage database 904 stores the verifier secret key transmitted in step S3302.

[0093] In step S3303, the verifier registration device communication unit 301 transmits the verifier public key generated in step S3301 to the verifier public key storage database 905. In step S3951, the verifier public key storage database 905 stores the verifier public key transmitted in step S3303.

[0094] Figure 6 This is a sequence diagram showing an example of the issuance process in Embodiment 1. In step S4931 , the user first database 903 transmits a set of the stored template and the user public key to the acquisition device 500 .

[0095] In step S4501, the biometric information acquisition unit for issuance 502 acquires biometric information for issuance from the user. Specifically, for example, the biometric information acquisition unit for issuance 502 acquires biometric information of the type or a part of the types used in step S2201.

[0096] In step S4502, the user secret key decompression unit 503 decompresses the user secret key using the template transmitted in step S4931 and the issuance biometric information acquired in step S4501. A specific example of the process in step S4502 will be described later.

[0097] In step S4503, the user secret key knowledge proof generation unit 504 generates a user secret key knowledge proof using the user secret key restored in step S4502. A specific example of the processing of step S4503 will be described later. In addition, the user secret key knowledge proof generation unit 504 may generate a knowledge proof for a part of the user secret key (for example, a part used when generating a presentation certificate in step S5605) instead of generating a knowledge proof for the entire user secret key.

[0098] In step S4504, the acquisition device communication unit 501 sends the user secret key knowledge certificate generated in step S4503 and the user public key sent in step S4931 to the issuing device 400. In addition, the acquisition device 500 may calculate the user public key based on the user secret key restored in step S4502 instead of receiving the user public key in step S4931. Not limited to this process, in the prompting process, the prompting device 600 may also calculate the user public key based on the user secret key instead of receiving the user public key. If the user public key is calculated based on the user secret key in the process of both parties, the user public key may not necessarily be stored in the user first database 903.

[0099] In step S4401, the user secret key knowledge proof verification unit 402 performs user secret key knowledge proof verification using the user secret key knowledge proof sent in step S4504 and the user public key. In addition, the user secret key knowledge proof generation process in step S4503 and the user secret key knowledge verification process in step S4401 may also be a conversational method (i.e., a method in which the knowledge proof and knowledge verification process are completed as a result of one or more round-trip communications between the acquisition device 500 and the issuance device 400 (e.g., a zero-knowledge proof protocol)).

[0100] In step S4402, the message acquisition unit 403 acquires a message to be issued. The message to be issued may be stored in advance in the issuing device 400 or in an external database connected to the issuing device 400, or may be generated by accepting input from an issuer using the issuing device 400 or a user to whom the message is to be issued.

[0101] In step S4911, the issuer secret key storage database 901 sends the stored issuer secret key to the issuing device 400. In step S4403, the issuing certificate generation unit 404 generates an issuing certificate using the user public key sent in step S4504, the issuer secret key sent in step S4911, and the message obtained in step S4402. A specific example of the process of step S4403 will be described later.

[0102] In step S4404, the data encryption unit 405 encrypts the message acquired in step S4402 using the user public key sent in step S4504, thereby generating an encrypted message. As the encryption method, any public key encryption method can be used.

[0103] In step S4405, the issuing device communication unit 401 sends the pair of the issuing certificate generated in step S4403 and the encrypted message generated in step S4404 to the user second database 906. In step S4961, the user second database 906 stores the pair of the encrypted message and issuing certificate sent in step S4405.

[0104] Figure 7 This is a sequence diagram showing an example of the presentation process in Embodiment 1. In step S5931, the user first database 903 sends a set of the stored template and the user public key to the presentation device 600. In step S5961, the user second database 906 sends a set of the stored encrypted message and the issuance certificate to the presentation device 600.

[0105] In step S5701, the prompt part designation unit 702 designates the prompt part. Specifically, for example, the prompt part is designated based on an input from a verifier using the verification device 700 or an administrator of the verification device 700. In addition, the prompt part designation process may also be performed before the prompt process. For example, in the case where a prompt process is performed in a store to confirm age, the date of birth (or proof that the date of birth is earlier than a specified date) may be designated as the prompt part before the prompt process.

[0106] In step S5702, the verification device communication unit 701 sends the prompt portion specified in step S5701 to the prompting device 600. When sending, the type of message (name of the message, issuer, etc.) requiring prompting may also be sent. The type of message requiring prompting is specified, for example, by input from a verifier using the verification device 700 or an administrator of the verification device 700. In addition, this specification may be performed before the prompting process.

[0107] In step S5621, the prompt consent acquisition unit 621 acquires the user's consent to the prompt of the partial message corresponding to the prompt portion sent in step S5702. For example, the prompt consent acquisition unit 621 displays the content of the prompt or the prompting party on a display screen (for example, the output device 10005 of the computer 10000 constituting the prompting device 600), displays a message on the screen asking whether to agree to the prompt, and allows the user to select "yes" or "no".

[0108] If "Yes" is selected, the process proceeds to the next step, and if "No" is selected, the process is terminated, for example. If "No" is selected, the consent acquisition unit 621 may display a message indicating that the process is terminated on the display screen.

[0109] In step S5601, the biometric information acquisition unit for presentation 602 acquires biometric information for presentation from the user. For example, the biometric information acquisition unit for presentation 602 acquires biometric information of the type or a part of the types used in step S2201.

[0110] In step S5602, the user secret key recovery unit 603 recovers the user secret key using the template sent in step S5931 and the biometric information for presentation acquired in step S5601. If the biometric information for presentation is sufficiently close to the biometric information for registration used when the template was generated, the user secret key having a fixed value corresponding to the template is recovered. A specific example of the process of step S5602 will be described later.

[0111] In step S5603, the data decryption unit 604 uses the user secret key restored in step S5602 to decrypt the encrypted message sent in step S5961 and obtain a message.

[0112] In step S5604, the template verification unit 605 verifies whether the template sent in step S5931 has not been tampered with. Through the processing of step S5604, the risk of attack against illegal modification of the template can be reduced. A specific example of the processing of step S5604 will be described later. In the case of performing the processing of step S5604, if the verification is successful, the next processing is performed, and if the verification fails, the subsequent processing is terminated, for example.

[0113] In step S5605, the presentation certificate generation unit 606 generates a presentation certificate using the presentation portion sent in step S5702, the issuance certificate sent in step S5961, the user secret key restored in step S5602, and, if necessary, a part or all of the message decrypted in step S5603. A specific example of the presentation certificate generation method in step S5605 will be described later.

[0114] In step S5606, the partial message selection unit 607 selects the prompt part sent in step S5702 from the message elements included in the message decrypted in step S5603, thereby generating a partial message. In addition, when all the message elements included in the message become the prompt objects, the partial message selection unit 607 can select all the message elements included in the message, or omit the processing of step S5606.

[0115] In step S5951, the verifier public key storage database 905 transmits the stored verifier public key to the presentation device 600. In step S5607, the data encryption unit 608 encrypts the partial message generated in step S5606 using the verifier public key transmitted in step S5951, thereby generating an encrypted partial message.

[0116] In step S5608, the presentation device communication unit 601 transmits a set of the partial message encrypted in step S5607 and the presentation certificate generated in step S5605 to the verification device 700. In step S5941, the verifier secret key storage database 904 transmits the stored verifier secret key to the verification device 700.

[0117] In step S5609, the data encryption unit 608 encrypts the log related to the notification device 600 by using the public key encryption method using the user public key sent in step S5931, and generates an encrypted log. In addition, the data encryption unit 608 may encrypt the log by using the common key encryption method using the user secret key restored in step S5602 instead of the public key encryption method using the user public key sent in step S5931.

[0118] The log to be encrypted includes, for example, the date and time of the notification, the destination of the notification, the content of the notification (e.g., the content of the notification part and the type of message, etc.), and the identifier of the notification device 600 used for the notification, etc. In addition, the processing of step S5609 may be performed after receiving the verification result sent in step S5705, and the verification result in step S5704 may be included in the log.

[0119] In step S5610, the notification device communication unit 601 transmits the encrypted log generated in step S5609 to the user third database. In step S5971, the user third database stores the encrypted log transmitted in step S5610.

[0120] In step S5703, the data decryption unit 703 uses the verifier secret key sent in step S5941 to decrypt the encrypted partial message sent in step S5608, thereby generating a partial message. In step S5921, the issuer public key storage database 902 sends the stored issuer public key to the verification device 700.

[0121] In step S5704, the presentation certificate verification unit 704 performs verification using the issuer public key sent in step S5921, the presentation certificate sent in step S5608, and the partial message decrypted in step S5703, and obtains verification success or verification failure as a verification result. In addition, the presentation certificate generation process of step S5605 and the presentation certificate verification process of step S5704 can also be performed in a dialog-based manner between the presentation device 600 and the verification device 700.

[0122] The verification device 700 may also output the verification result and at least one of the prompted partial messages. The output destination may be a display screen (e.g., the output device 10005 of the computer 10000 constituting the verification device 700) or another program. For example, when the output destination is a settlement program, an example of the processing performed by the settlement program is that, when the verification result is successful, a discount is given based on the prompted partial message (address, member information, etc.), and settlement processing is performed for the user. In addition, when the output destination is an admission management program (an admission management program to a gathering venue is also an example), an example of the processing of the admission management program is that, when the verification result is successful and the prompted partial message meets a specified condition (e.g., the condition that the test result related to a specified infectious disease is negative), the user is allowed to enter (e.g., open the door).

[0123] In step S5705, the verification device communication unit 701 transmits the verification result obtained in step S5704 to the presentation device 600. In step S5611, the result output unit 609 outputs the verification result transmitted in step S5705. The output destination may be a display screen (e.g., the output device 10005 of the computer 10000 constituting the presentation device 600) or another program (e.g., a settlement program or an admission management program).

[0124] Figure 8 This is a sequence diagram showing an example of log output processing in Embodiment 1. In step S6971, the user third database 907 sends the stored encrypted log to the log output device 800. In step S6931, the user first database 903 sends the stored template to the log output device 800.

[0125] In step S6801, the log output biometric information acquisition unit 802 acquires the log output biometric information from the user. For example, the log output biometric information acquisition unit 802 acquires the biometric information of the type or a part of the types used in step S2201.

[0126] In step S6802, the user secret key restoration unit 803 restores the user secret key using the template sent in step S6931 and the biometric information for log output acquired in step S6801. A specific example of the process in step S6802 will be described later.

[0127] In step S6803, the data decryption unit 804 uses the user secret key restored in step S6802 to decrypt the encrypted log sent in step S6971, thereby obtaining the log. In step S6804, the log output unit 805 outputs the log decrypted in step S6803. The output destination may be a display screen (for example, the output device 10005 of the computer 10000 constituting the log output device 800) or another program.

[0128] Fig. 9 This is a flowchart showing an example of the transition of the display content of the display screen of the prompting device 600 in the prompting process in Example 1. Display content 51000 is an example of the display content in the prompting consent acquisition process of step S5621. Display content 51000 includes, for example, module 51001, module 51002, module 51003, module 51004, and module 51005.

[0129] In module 51001, for example, a text indicating a prompt requesting information is displayed. In module 51002, for example, a file name corresponding to the message requested to be prompted, as well as text indicating the prompt portion of the message and the prompt destination are displayed. In module 51003, for example, a text asking whether to agree to the prompt is displayed. In module 51004, for example, a "yes" option is displayed. In module 51005, for example, a "no" option is displayed.

[0130] Branch 59001 is a branch related to the selection result in the prompt consent process of step S5621. In the case of consenting to the prompt in step S5621, that is, when module 51004 is selected (branch 59001: "Yes"), display content 52000 is displayed. In the case of not consenting to the prompt in step S5621, that is, when module 51005 is selected (branch 59001: "No"), display content 55000 is displayed.

[0131] The display content 52000 is an example of the display content in the biological information acquisition process for presentation in step S5601. The display content 52000 includes, for example, a module 52001 and a module 52002.

[0132] In module 52001, for example, a text requesting the presentation of biometric information is displayed. In module 52002, an image being photographed by a sensor (camera, etc.) for acquiring biometric information is displayed. In addition, module 52002 may also include a guide display 52003 indicating an appropriate position for presenting biometric information to the sensor.

[0133] Display content 55000 is an example of display content when "No" is selected in the selection in the prompt consent process in step S5621, or "No" is selected in the selection of whether to retry in step S5611 when the verification result is verification failure. Display content 55000 includes, for example, a module 55001 that displays a message indicating that the prompt process has been terminated.

[0134] Branch 59002 is a branch related to the verification result of step S5704. When the verification in step S704 is successful (branch 59002: "Verification successful"), display content 53000 is displayed in step S5611. When the verification in step S5704 fails (branch 59002: "Verification failed"), display content 54000 is displayed in step S5611. Display content 53000 includes, for example, a module 53001 that displays text indicating that the prompt processing is completed.

[0135] Display content 54000 includes, for example, module 54001, module 54002, and module 54003. In module 54001, for example, text indicating that verification failed (or prompting that processing failed) is displayed. In module 54002, for example, text asking whether to retry verification is displayed. In module 54003, a "yes" option is displayed. In module 54004, a "no" option is displayed.

[0136] In addition, when any of the processes up to step S5704 fails, for example, similar to the case of verification failure, the display may transition to display content 54000. In this case, it may be displayed in module 54001 which process has failed.

[0137] Branch 59003 is a branch related to the selection result in display content 54000. When retrying verification, that is, when module 54003 is selected (branch 59003: "Yes"), the display content changes to 52000. When not retrying verification, that is, when module 54004 is selected (branch 59003: "No"), the display content changes to 55000.

[0138] An example of the process until the display content 51000 is displayed is as follows. The presentation device 600 includes a sensor such as a camera, and the sensor reads data such as a two-dimensional code displayed on the display screen of the verification device 700 .

[0139] This data indicates, for example, a URI (Uniform Resource Identifier) ​​pointing to a web page including information such as which of the presentation process and the issuance process is to be performed, a file name, a presentation part, and a presentation destination.

[0140] The prompting device 600 can obtain information such as prompting processing, the file name to be prompted, the prompt part, and the prompt destination by accessing the web page corresponding to the URI obtained by the sensor, and can display it like the text of module 51002. In addition, the means for accessing information such as which of the prompting processing and the issuing processing is to be performed, the file name, the prompt part, and the prompt destination is not limited to reading the two-dimensional code, and any method can be used.

[0141] [Specific Example of User Key Generation Process and User Secret Key Restoration Process]

[0142] A specific example of the user key generation process of step S2202 and the user secret key recovery process of steps S4502, S5602, and S6802 is described. In addition, the specific example of the user secret key recovery process is as described about step S4502, and in steps S5602 and S6802, for example, the user secret key can be recovered by performing the same process as step S4502.

[0143] In the process, for example, a biometric encryption method is used. In the registration process, the biometric encryption method generates an auxiliary string c_E and a secret key s_E for registration based on the registration feature x_E ("_" indicates a subscript character). In addition, in the restoration process, the biometric encryption method generates a secret key s_A for restoration based on the restoration feature x_A and the auxiliary string.

[0144] When x_E and x_A are sufficiently close, s_E=s_A, that is, the secret key at the time of registration is restored. As a biometric encryption method, any method such as fuzzy extractor, fuzzy signature, fuzzy commitment, fuzzy vault, etc. can be used.

[0145] In step S2202, the user key generation unit 203 generates a registration feature x_E based on the registration biometric information, and generates an auxiliary string c_E and a registration secret key s_E based on the registration feature x_E through registration processing using the biometric encryption method. Based on this, the user key generation unit 203 determines the template T so that it includes the auxiliary string c_E.

[0146] The template T may also include data called a pseudo identifier (for example, a hash value of the secret key s_E at registration, or a public key corresponding to the secret key s_E at registration). On the other hand, the user key generation unit 203 generates a user public key upk using the secret key s_E at registration. Hereinafter, the case where the user secret key usk is generated as an internal process at this time will be described, but the user secret key usk may not necessarily be generated.

[0147] In step S4502, the user secret key recovery unit 503 first extracts the recovery feature x_A based on the issuing biometric information, performs recovery processing using the biometric encryption method using x_A and c_E included in T, and generates a recovery secret key s_A. When x_E is sufficiently close to x_A, s_E=s_A, that is, the registration secret key is recovered.

[0148] In addition, the user secret key recovery unit 503 may use a pseudo identifier to verify whether s_E is correctly recovered, and terminate the process if s_E is not recovered. Instead of terminating the process, the process may proceed to step S5611 and output a message indicating that the user secret key recovery has failed. When the secret key s_E is correctly recovered during registration, the user secret key recovery unit 503 uses s_E to perform a key recovery process corresponding to the generation method of (usk, upk) to recover usk.

[0149] As a first example of a method for generating (usk, upk), the user key generation unit 203 generates a pair of a secret key sk1 and a public key pk1 by using a key generation algorithm in any public key encryption method or electronic signature method. The user key generation unit 203 determines usk:=sk1, and determines upk so that it includes pk1. Furthermore, the user key generation unit 203 generates data Enc(s_E, sk1) obtained by encrypting sk1 using s_E, and includes Enc(s_E, sk1) in the template T. In this case, in the key recovery process, the user secret key recovery unit 503 can recover usk by recovering sk1 based on Enc(s_E, sk1) using the recovered s_E.

[0150] In addition, sk1 may be set as a group consisting of a plurality of secret keys, and pk1 may be set as a group of a plurality of public keys corresponding thereto. In the following examples, the secret key and the public key may each be a group consisting of a plurality of keys. When the secret key and the public key are each composed of a plurality of keys, encryption, decryption, electronic signature generation, and electronic signature verification may be performed using a specified object from among them.

[0151] As a second example of the method for generating (usk, upk), the user key generation unit 203 may use a transformation f_1 (e.g., an identity transformation or a transformation based on a pseudo-random number generator or a hash function) for s_E to generate sk2 using a secret key sk2:=f_1(s_E), generate a public key pk2 corresponding to sk2, determine usk:=sk2, and determine upk so as to include pk2. In this case, in the key recovery process, if the user secret key recovery unit 503 calculates f_1(s_E) for the recovered s_E, it is possible to recover usk.

[0152] Alternatively, the user secret key and user public key obtained by respectively linking the user secret key and user public key obtained in the first example of the method for generating (usk, upk) with the second example may be used. Alternatively, in the case where the registration process of the biometric encryption method is a method that can generate a template based on the specified s_E, the user key generation unit 203 may generate c_E after generating (usk, upk) so that s_E becomes usk. In this case, in the key recovery process, the user secret key recovery unit 503 can recover usk by recovering s_E.

[0153] Alternatively, as in the following example, a method obtained by combining the method described in the first example with the method described in the second example may be used. First, the user key generation unit 203 generates a pair of a secret key sk1 and a public key pk1 by using a key generation algorithm in any public key encryption method or electronic signature method. Furthermore, the user key generation unit 203 generates sk2 by using a secret key sk2:=f_1(s_E) using a transformation f_1 (e.g., an identity transformation or a transformation based on a pseudo-random number generator or a hash function) for s_E, and generates a public key pk2 corresponding to sk2. On this basis, the user key generation unit 203 determines (usk, upk) by using usk:=(sk1, sk2) and upk:=(pk1, pk2). Furthermore, the user key generation unit 203 generates data Enc(sk2, sk1) obtained by encrypting sk1 using sk2, and includes Enc(sk2, sk1) in the template T. In this case, in the key restoration process, the user secret key restoration unit 503 restores sk2 from the restored s_E by sk2:=f_1(s_E), and further restores sk1 from Enc(sk2, sk1) using the restored sk2, thereby restoring usk.

[0154] In the case of this method, for example, sk2 may be used in the message decryption process and sk1 may be used in the presentation certificate generation process, so that sk1 and sk2 are used for different processes. For this purpose, for example, sk2 or pk2 may be used for message encryption process, and pk1 may be used for issuance certificate generation process. Not limited to this example, when the secret key and the public key are composed of multiple keys, each key may be used for different processes.

[0155] In addition, in order to generate a user secret key, secret information (such as a password, or an additional secret key stored in a database, etc.) may be used in addition to the biometric information for registration. For example, the user key generation unit 203 may redetermine the value obtained by transforming the data formed by linking the usk generated by the above method and the secret information using an arbitrary function such as a hash function as usk. In this case, the user key generation unit 203 may determine the user public key so that it corresponds to the redefined usk. The user secret key recovery unit 503 can recover the user secret key by accepting the input of the secret information and using the secret information in addition to the biometric information for prompting. In this way, by generating the user secret key using secret information in addition to the biometric information for registration, the risk of the user secret key being illegally recovered can be reduced, and security can be improved.

[0156] [Specific Example of User Secret Key Knowledge Proof Generation Process and Verification Process]

[0157] A specific example of the user secret key knowledge certificate generation process of step S4503 and the user secret key knowledge certificate verification process of step S4401 will be described.

[0158] As a first specific example, the user secret key knowledge proof generation unit 504 generates knowledge proof according to any knowledge proof protocol such as the Schnorr Protocol. In this case, the user secret key knowledge proof verification unit 402 can verify whether the knowledge proof is correct by performing verification processing defined in the protocol.

[0159] As a second specific example, the user secret key knowledge proof verification unit 402 sends data such as a random number (issuance challenge) to the acquisition device 500, the user secret key knowledge proof generation unit 504 uses the user secret key to generate an electronic signature for the issuance challenge, and the user secret key knowledge proof verification unit 402 verifies the relationship between the issuance challenge, the sent user public key, and the electronic signature.

[0160] [Specific example of the generation of the certificate for issuance, the generation of the certificate for presentation, and the verification of the certificate for presentation]

[0161] A specific example of the generation of the issuance certificate in step S4403, the generation of the presentation certificate in step S5605, and the verification of the presentation certificate in step S5704 is described. The message is assumed to be composed of n (n is a positive integer) message elements m[1], m[2], ..., m[n], and the partial message is assumed to be composed of m[i_1], m[i_2], ..., m[i_k] ({i_1, i_2, ..., i_k} is a partial set of {1, 2, ..., n}).

[0162] In the presentation certificate generation process, the presentation certificate generation unit 606 generates a presentation certificate generation secret key usk_S based on the user secret key usk by usk_S:=f_S(usk), and the corresponding public key upk_S is included in the user public key upk. Examples of the function f_S include an identity transformation or a function that selects a specified part of usk.

[0163] In the first specific example, a general signature method and an editable signature method are used. This will be described.

[0164] The general signing method includes key pair generation processing, electronic signature generation processing and verification processing, which are denoted as Gen_S, Sig_S and Ver_S respectively. Each process is as follows. Gen_S generates a pair of signature key sk_S and verification key pk_S through (sk_S, pk_S) = Gen_S(). Sig_S generates an electronic signature Q based on sk_S for message L through Q = Sig_S (sk_S, L). Ver_S outputs the verification result Result_S through Result_S = Ver_S (pk_S, L, Q). Result_S is verification success or verification failure.

[0165] The editable signature method includes key pair generation processing, electronic signature generation processing, derivation processing and verification processing, which are respectively denoted as Gen_R, Sig_R, Derive_R, and Ver_R. Each processing is as follows.

[0166] Gen_R is a process of generating a pair of a signature key sk_R and a verification key pk_R by (sk_R, pk_R) = Gen_R(). Sig_R is a process of generating an electronic signature Q_1 based on sk_R for a message (M[1], M[2], ..., M[N]) consisting of N (N is a positive integer) message elements by Q_1 = Sig_R(sk_R, (M[1], M[2], ..., M[N])).

[0167] Derive_R is a process of generating an electronic signature Q_2 based on sk_R for (M[I_1], M[I_2], ..., M[I_K]) through Q_2=Derive_R({I_1, I_2, ..., I_K}, (M[1], M[2], ..., M[N]), Q_1). Here, K is a positive integer less than N, and {I_1, I_2, ..., I_K} is a partial set of {1, 2, ..., N}. The ability to generate an electronic signature Q_2 based on sk_R without sk_R is a feature of the editable signature method.

[0168] Ver_R is a process of outputting a verification result Result_R through Result_R=Ver_R(pk_R, (M[I_1], M[I_2], ..., M[I_K]), Q_2). Result_R indicates verification success or verification failure.

[0169] The first specific example using the above content is described. First, it is assumed that (usk_S, upk_S) is made in the same format as the key pair generated by Gen_S(). In addition, in the issuer key generation process of step S1101, the issuer key generation unit 102 generates a key pair (isk_R, ipk_R) by Gen_R, includes isk_R in the issuer secret key, and includes ipk_R in the issuer public key.

[0170] In the issuance certificate generation process of step S4403, the issuance certificate generation unit 404 generates an electronic signature q_11 by q_11=Sig_R(isk_R, (m[1], m[2], ..., m[n], upk_S)), and generates an issuance certificate including the electronic signature q_11.

[0171] In the presentation certificate generation process of step S5605 and the presentation certificate verification process of step S5704, the following processes are performed, for example. First, the presentation certificate verification unit 704 generates data such as a random number (presentation challenge) R_2, and sends it to the presentation device 600. The presentation certificate generation unit 606 generates an electronic signature q_12 based on isk_R for (m[i_1], m[i_2], ..., m[i_k], upk_S) by q_12=Derive_R({i_1, i_2, ..., i_k, n+1}, (m[1], m[2], ..., m[n], upk_S), q_11). In addition, the presentation certificate generation unit 606 generates an electronic signature q_13 based on usk_S for R_2 by q_13=Sig_S(usk_S, R_2). The certificate for presentation generation unit 606 generates a certificate for presentation so as to include q_12, q_13, and upk_S.

[0172] On this basis, the presentation certificate verification unit 704 determines Result_S and Result_R through Result_S=Ver_S(upk_S, R_2, q_13) and Result_R=Ver_R(ipk_R, (m[i_1], m[i_2], ..., m[i_k], upk_S), q_12), and regards the verification as successful when both Result_S and Result_R are verified successfully, otherwise it is regarded as verification failure. Result_S indicates verification of whether the user secret key usk_S corresponding to the presented user public key upk_S is used to generate the presentation certificate. Result_R indicates verification of whether the presented partial message and upk_S are indeed the correct values ​​specified by the issuer.

[0173] In particular, as a method for generating the electronic signature q_11, a general signature method can be used. For example, the following method can be cited: n random numbers r[1], r[2], ..., r[n] are generated, and each i=1, 2, ..., n is defined as h_i:=Hash(m[i], r[i]), and the electronic signature based on Sig_S for the data formed by linking h_1, h_2, ..., h_n is set to q_110, and the group formed by q_110, h_1, h_2, ..., h_n and r_1, r_2, ..., r_n is determined to be q_11.

[0174] At this time, q_12 is determined to be a group consisting of q_110, h_1, h_2, ..., h_n, and r_[i_1], r_[i_2], ..., r_[i_k]. As verification of q_12, it is sufficient to verify the relationship between (h_i, m[i], r[i]) of each message element presented and the relationship between q_110 and (h_1, h_2, ..., h_n).

[0175] The above is just an example, and data obtained by performing processing other than concatenation on h_1, h_2, ..., h_n may be used as signature object data for generating q_110. For example, Hash (h_1, h_2, ..., h_n) may be used as a signature object when generating q_110, or a method called Markle Hash may be used.

[0176] This has the effect of being able to use any signature method in each process. Thus, there is no need to use a library that performs special encryption and signature operations or install special encryption and signature operations, and it can be installed through a general encryption library and signature library (such as RSA encryption, a library that provides RSA signature function).

[0177] In addition, by setting R_2 to data such as a random number sent from the verification device 700, it is possible to make it difficult for the verifier who has received the prompt certificate to illegally send the prompt certificate to other verifiers. In order to achieve such an effect, as a signature object language used to generate q_13, information related to the verifier (the name of the verifier, etc.) or data R_3 such as the prompt date and time may be included to replace R_2 or as an addition to R_2. In the case where the prompt device 600 generates R_3, q_13 can be verified by the verification device 700 by also including R_3 in the prompt certificate. In addition, in order to make the user's consent to the prompt more clear, a part of the message that is the prompt object may also be included in the signature object language used to generate q_13.

[0178] The second specific example is described. The second specific example is a method using ACS described in non-patent document 2, etc. In the issuance certificate generation process of step S4403, the issuance certificate generation unit 404 generates an issuance certificate using the issuer secret key isk, upk_S which is a part of the user public key, and the message (m[1], m[2], ..., m[n]).

[0179] For example, the issuance certificate generation unit 404 generates an electronic signature q_21 based on isk for (m[1], m[2], ..., m[n], usk_S). If the method of non-patent document 2 is used, such an electronic signature can be generated, and furthermore, the signature can be editable.

[0180] In the presentation certificate generation process of step S5605, the presentation certificate generation unit 606 communicates with the verification device 700 as needed, and generates a presentation certificate using the message, the user secret key, the presentation part, and the issuance certificate. For example, the presentation certificate generation unit 606 generates an electronic signature q_22 based on isk for (m[i_1], m[i_2], ..., m[i_k], usk_S), further generates a knowledge certificate q_23 of usk_S, and generates a presentation certificate so that it includes q_22 and q_23.

[0181] In the verification process of the presentation certificate in step S5704, the presentation certificate verification unit 704 verifies the relationship between the presented partial message, the presentation certificate, and the issuer public key, and outputs verification success or verification failure. For example, the presentation certificate verification unit 704 verifies the relationship between (m[i_1], m[i_2], ..., m[i_k]), (q_22, q_23), and ipk, and outputs verification success or verification failure.

[0182] In this method, if (m[i_1], m[i_2], ..., m[i_k]) is tampered with, it is difficult to successfully verify. In addition, if usk_S is unknown, it is difficult to generate q_23 that allows successful verification. In addition, when generating a presentation certificate, the presentation certificate generation unit 606 generates a presentation certificate using a random number (an example of a presentation challenge) sent from the verification device 700. Therefore, the risk of an attack in which a verifier pretends to be a user and presents a presentation to another verifier can be reduced.

[0183] [Specific example of template verification processing]

[0184] The first specific example of the template verification process of step S5604 is described. First, in advance in step S4504, the acquisition device communication unit 501 sends the function value f_2(T) calculated by using a predetermined function f_2 (for example, a hash function) for the template T to the issuing device 400. Based on this, in step S4402, the message acquisition unit 403 determines a message so that it includes the function value f_2(T) as a message element.

[0185] On this basis, in step S5604, the template verification unit 605 uses f_2 to calculate the function value for the sent template, and verifies whether it is equal to the value of f_2(T) included in the message. Furthermore, the template verification unit 605 verifies the relationship between the function value f_2(T) included in the message and the issuance certificate, thereby verifying whether the function value f_2(T) included in the message has not been tampered with. The template verification unit 605 regards the verification as successful if these two verifications are successful, and regards the verification as failed if either one fails.

[0186] The second specific example of the template verification process of step S5604 is described. In the second specific example, the template verification unit 605 verifies the legitimacy of the value of the template data. Assume that the registration feature x_E belongs to the linear space X. Let S be a partial space of X. Consider the case where the auxiliary string c_E is generated by c_E:=x_E-CV(x_E) and the template T includes c_E. Among them, CV(x_E) is set to represent the point of S that is closest to x_E. At this time, c_E included in the template T needs to satisfy CV(c_E)=0. Therefore, the template verification unit 605 can confirm whether c_E is not illegal by verifying whether this condition is met.

[0187] The third specific example of the template verification process of step S5604 is described. In the third specific example, the template verification unit 605 also verifies the legitimacy of the value of the template data. Assume that the registration feature x_E is a t-dimensional real value vector. Consider the case where the auxiliary string c_E is generated by c_E:=x_E-B*<B^(-1)*x_E> using a t-dimensional regular matrix B and the template T includes c_E. Among them, * is the product of the matrix and the vector, and <> represents the processing of discarding the decimal point part of each component of the vector. At this time, c_E included in the template T requires that each component of B^(-1)*c_E is greater than 0 and less than 1. Therefore, the template verification unit 605 can confirm whether c_E is not illegal by verifying whether this condition is met.

[0188] [Example of changes in processing flow]

[0189] In the above-mentioned processing flow, part of the processing can be changed. For example, the following changes can be given.

[0190] When the user first database 903 is public, the issuance certificate generation unit 404 may use information that can identify the user public key instead of the user public key in the issuance certificate generation process of step S4403. As the information that can identify the user public key, for example, the location of the user first database 903 can be cited. In addition, when the user public keys of multiple users are stored in the user first database 903, as the information that can identify the user public key, information such as a user ID for identifying which user public key it is can be cited.

[0191] The user secret key knowledge certification generation process of step S4503 and the user secret key knowledge verification process of step S4401 may be omitted. However, by performing these processes, it is possible to verify that the process is performed by a legitimate user corresponding to the user public key sent in step S4504.

[0192] In addition, part or all of the issuance certificate generation process of step S4403 may be performed by the issuer secret key storage database 901. For example, when the issuance certificate generation process includes a signature generation process using the issuer secret key, the issuance device 400 may send the data to be signed to the issuer secret key storage database 901, and the issuer secret key storage database 901 sends the electronic signature obtained by performing the signature generation process to the issuance device 400, and the issuance device 400 uses the electronic signature to perform the remaining processes in the issuance certificate generation process. In this way, the issuer secret key does not need to be sent to the outside of the issuer secret key storage database 901, and security is improved.

[0193] In addition, the message encryption process of step S4404 may also be performed by the user's second database 906 instead of the issuing device 400. In this case, in step S4405, the issuing device communication unit 401 sends a message instead of encrypting the message. Alternatively, in step S4405, the issuing device communication unit 401 may also send the message to the acquisition device 500, and the acquisition device 500 may perform the message encryption process. In this case, it is also possible to perform common key encryption using the user's secret key instead of public key encryption using the user's public key. Among them, by performing the message encryption process of step S4404 by the issuing device 400, the message is also protected in the communication from the issuing device 400.

[0194] In addition, the acquisition device 500 or the presentation device 600 can also verify the relationship between the issued message and the issuance certificate. In this way, it is possible to confirm whether the issuance certificate is legitimate. If there is an encrypted object between the message and the issuance certificate, it can be decrypted using the user's secret key.

[0195] In addition, the prompt part may be a part that inquires whether the message is equal to a specified value or whether the value is included in a specified range for a specified message element, as an addition to the message element to be prompted, or as a replacement for the message element to be prompted.

[0196] For example, when M3 is defined as M3:=(Taro Hitachi, January 1, 2000, male, 1-6-6, Marunouchi, Chiyoda-ku, Tokyo), and the structure information S3 is defined as S3:=(name, date of birth, gender, address), and the verification device 700 knows that M3 is set to the structure of S3, the presentation part may be set to a combination of the first message element of M3 and the content of asking whether the second message element in M3 is a date before January 1, 2002. In this case, the partial message is set to a message consisting of the first message element of M3, and the proof that the second message element is a date before January 1, 2002 may be included in the presentation proof. As an ACS capable of such proof, for example, a function credential may be used.

[0197] In addition, in step S4404, the data encryption unit 405 may encrypt not only the message but also the certificate for issuance. In this case, in the communication and storage process related to the certificate for issuance immediately before step S5603, the encrypted certificate for issuance is used instead of the certificate for issuance, and in the message decryption process of step S5603, the data decryption unit 604 decrypts not only the message but also the encrypted certificate for issuance and obtains the certificate for issuance. The message and the certificate for issuance may be encrypted individually or collectively. In addition, in one example of the user key generation method described above, the template includes a part of the encrypted user secret key. In this example, the data encryption unit 405 may generate an encrypted message by encrypting a part of the user secret key together with the message, instead of including a part of the encrypted user secret key in the template. In this case, through the message decryption process of step S5603, the part of the user secret key is decrypted together with the message, for example, it can be used for the prompt certificate generation process of step S5605. In this case, in step S5602, the user secret key recovery unit 603 may not recover a part of the user secret key, but may recover a part of the user secret key required for the message decryption process in step S5603. In addition, the data encryption unit 405 may encrypt the certificate of issuance together with the message and a part of the user secret key.

[0198] In addition, the presentation part may be designated by the presentation device 600. In this case, for example, in the presentation consent acquisition process of step S5621, the user may be allowed to select the presentation part. In step S5608, the presentation device communication unit 601 transmits information on the presentation part if necessary.

[0199] In addition, in the presentation process, the presentation device 600 does not necessarily need the entire message obtained in step S4402. For example, in the method using a general signature method among the methods described in the first specific example of the issuance certificate generation, presentation certificate generation, and presentation certificate verification process, only a part of the message (i.e., a group consisting of message elements corresponding to the presentation part) is required for the processing of steps S5605, S5606, S5607, and S5608.

[0200] Like this, in the prompt processing, when only a part of the message obtained in step S4402 is needed, the message decrypted in step S5603 (also called "message for prompt processing") can also be only a part of the message obtained in step S4402 (also called "message for issuance processing").

[0201] Furthermore, the encrypted message sent in step S5961 (also referred to as "encrypted message for prompting process") may be only a necessary part of the encrypted message generated in step S4404 (also referred to as "encrypted message for issuance process"). Specifically, the encrypted message for prompting process may be only a part of the encrypted message for issuance process that is necessary for decrypting "a part of the encrypted message for issuance process that is necessary for the processes of steps S5605, S5606, S5607, and S5608".

[0202] An example of a method for setting a prompt processing encrypted message as a part of an issuance processing encrypted message and setting a prompt processing message as a part of an issuance processing message is described. In step S4404, the data encryption unit 405 divides the issuance processing message into a plurality of blocks (for example, message elements included in the issuance processing message are set as each block), and encrypts each block, thereby generating an issuance processing encrypted message composed of a plurality of blocks.

[0203] In step S5961, the user second database sends the required part of the encrypted message for issuance processing to the prompting device 600 as an encrypted message for prompting processing. For example, as in the above example, when the partial message is included in the prompting processing message, the user second database first receives the prompting part specified in step S5701 from other devices (such as the verification device 700 or the prompting device 600). Next, the user second database determines the message elements that constitute the partial message based on the prompting part. Next, the user second database selects the blocks of the encrypted message corresponding to each determined message element in the encrypted message for issuance processing, and sends the selected blocks to the prompting device 600 as the encrypted message for prompting processing.

[0204] In this way, by sending only the required part of the issuance process encrypted message as the prompt process encrypted message in step S5961, the risk of leakage of the part of the issuance process message that is not included in the prompt process message can be reduced.

[0205] In addition, when the prompt processing-oriented message and the partial message are consistent, in step S5606, the partial message selection unit 607 only needs to select all the message elements included in the prompt processing-oriented message as the partial message.

[0206] In addition, the partial message encryption process of step S5607 may not be performed. In this case, in step S5608, the notification device communication unit 601 can send the partial message instead of encrypting the partial message, and the partial message decryption process of step S5703 can be omitted.

[0207] In addition, the prompting device 600 may also perform authentication for verifying the legitimacy of the verification device 700. A set of a verifier secret key and a verifier public key can be used for this authentication. For example, the prompting device 600 generates a challenge such as a random number and sends it to the verification device 700, and the verification device 700 uses part or all of the verifier secret key to generate an electronic signature based on an arbitrary signature algorithm, and the prompting device 600 performs signature verification. Alternatively, the verification device 700 may also prove knowledge related to part or all of the verifier secret key through an arbitrary knowledge proof protocol.

[0208] In addition, in the log encryption process of step S5609, encryption based on the secret key or public key of the system administrator may be performed instead of encryption based on the user public key or user secret key. The secret key and public key in this case may be a key pair in the usual public key encryption, or a pair generated based on the biometric information of the system administrator by the same process as the user registration process. In addition, in the case of using a pair generated based on the biometric information, in the log encryption process of step S5609, the biometric information acquisition unit 802 for log output acquires the biometric information of the system administrator.

[0209] Furthermore, the verifier secret key storage database 904 may also include a partial message decryption unit, which performs the partial message decryption process of step S5703 instead of the verification device 700. This eliminates the need to send the verifier secret key to the outside of the verifier secret key storage database 904, thereby improving security.

[0210] In order to confirm that the person to be issued is the person himself, for example, the issuer or the issuing device 400 requests the user to present a document that can confirm the person himself, and the user presents the document that can confirm the person himself. The presenting method may be a method in which the user presents the document to the issuer face to face, or a method in which the acquisition device 500 acquires the document that can confirm the person as electronic data such as a photograph and transmits it to the issuing device 400. In addition, a presentation process in which the user is notified that the issuance has been accepted may be performed in addition to the presentation of the document that can confirm the person himself, or in place of the presentation of the document that can confirm the person himself.

[0211] In addition, the encryption process using the secret key in this embodiment can also be replaced by an encryption process using the public key corresponding to the secret key. In addition, the encryption process using the public key can also be replaced by a process of sending or restoring the secret key and an encryption process using the sent or restored secret key. In this case, it is preferable to take measures (such as encryption of the communication path) to reduce the risk of leakage of the sent secret key.

[0212] In addition, the issuer secret key may be generated based on the issuer biometric information, for example, as follows, instead of being stored in the issuer secret key storage database 901. In step S1101, the issuer key generation unit 102 obtains biometric information (issuer registration biometric information) from the issuer, and performs the same processing as the user key generation processing in step S2202 on the issuer registration biometric information, thereby generating an issuer template and an issuer public key. The issuer secret key storage database 901 stores the generated issuer template instead of the issuer secret key.

[0213] In step S4911, the issuer secret key storage database 901 sends the generated issuer template to the issuing device 400 to replace the issuer secret key. In step S4403, the certificate for issuance generation unit 404 obtains biometric information (biometric information for recovering the issuer secret key) from the issuer again, and performs the same processing as the user secret key recovery processing in step S4502 on the biometric information for recovering the issuer secret key and the issuer template, thereby recovering the issuer secret key. On this basis, the certificate for issuance generation unit 404 generates a certificate for issuance using the recovered issuer secret key.

[0214] In this way, by generating the issuer secret key based on the issuer biometric information, there is no need to store the issuer secret key, which has the effect of reducing the risk of leakage of the issuer secret key. Similarly, the verifier secret key can also be generated based on the verifier biometric information, thereby reducing the risk of leakage of the verifier secret key. In addition, the part of the biometric information used when generating the issuer secret key or the verifier secret key may not necessarily be the same as the part of the biometric information used when generating the user secret key.

[0215] [Effects of this embodiment]

[0216] This embodiment has the effect of ensuring security even when all the data stored by the user (specifically, the template, encrypted message, user public key, and issuance certificate) may be leaked.

[0217] First, in the conventional ACS system, if the data stored by the user is leaked, the part of the message other than the part of the message that has been prompted is also leaked. On the other hand, in the message prompting system 10 of the present embodiment, even if the data stored by the user is leaked, it is difficult to decrypt the encrypted message without the biometric information of the legitimate user, and therefore it is difficult to obtain the information of the part of the message other than the part of the message that has been prompted.

[0218] In addition, in the conventional ACS system, if the data stored by the user is leaked, an illegal user may use the user secret key included in the data to impersonate. On the other hand, in the message notification system 10 of the present embodiment, even if the data stored by the user is leaked, it is difficult to restore the user secret key without the biological information of the legitimate user, so it is difficult for an illegal user to impersonate.

[0219] In this way, even if all the data saved by the user (specifically, templates, encrypted messages, user public keys and issuance certificates) may be leaked, security can be ensured, thereby allowing these data to be stored in online locations such as cloud storage, and a terminal that is not necessarily limited can be used as a prompt device 600 for processing.

[0220] In a system where security cannot be ensured in the event of a leak of data stored by a user, as a countermeasure for security, a countermeasure is considered to manage the data stored by the user carefully (for example, in an offline manner), or a countermeasure is considered to store a key for encrypting and decrypting the data stored by the user in a specific terminal and only provide a prompt from the specific terminal. However, in these countermeasures, there is a problem that the user can only perform the prompt processing from a specific terminal. Such a problem is also solved by the message prompt system 10 of this embodiment.

[0221] Furthermore, in the process of generating the proof for presentation in step S5605, the proof for presentation generating unit 606 generates the proof for presentation using the data sent from the verification device 700, thereby reducing the risk of an attack in which a verifier pretends to be a user and presents a presentation to another verifier. In addition, by performing the template verification process in step S5604, the risk of illegal behavior such as tampering with the template can be reduced. In addition, according to the specific examples of each process, the effect of improving security as described above is achieved.

[0222] In addition, the present invention is not limited to the above-mentioned embodiments, and includes various modified examples. For example, the above-mentioned embodiments are embodiments described in detail to make the present invention easy to understand, and are not limited to all the structures described. In addition, a part of the structure of a certain embodiment can be replaced with the structure of other embodiments, and the structure of other embodiments can be added to the structure of a certain embodiment. In addition, with respect to a part of the structure of each embodiment, other structures can be added / deleted / replaced.

[0223] In addition, the above-mentioned various structures, functions, processing units, processing mechanisms, etc. may also be partially or entirely implemented by hardware, for example, by designing by integrated circuits. In addition, the above-mentioned various structures, functions, etc. may also be implemented by software by interpreting and executing programs that implement various functions by a processor. Information such as programs, tables, and files that implement various functions can be placed in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

[0224] In addition, the control lines and information lines are shown as necessary for explanation, and it is not necessary to show all the control lines and information lines in the product. It can also be considered that almost all components are actually connected to each other.

Claims

1. A message prompting system, comprising a prompting device, The reminder device is maintained: A template generated based on the user's registered biometric information; an encrypted message obtained by encrypting a message including one or more message elements; and a certificate for issuance generated based on a user public key corresponding to the template, the message, and an issuer secret key corresponding to an issuer of the message, The prompting device is used to: Obtaining the user's biometric information for notification, generating a user secret key corresponding to the user public key based on the template and the biometric information for presentation, recovering the message by decrypting the encrypted message using the user secret key, generating a partial message according to the message based on a prompt part, wherein the prompt part is information for determining a part to be prompted in the message, generating a presentation certificate based on the presentation part, the issuance certificate and the user secret key, The partial message and the prompt proof are output.

2. The message prompt system according to claim 1, The message prompt system also includes a verification device, The verification device sends a prompting challenge to the prompting device, The presentation device generates the presentation certificate based on the presentation challenge, the presentation part, the issuance certificate, and the generated secret key.

3. The message prompt system according to claim 1, The message prompt system also includes a verification device, The verification device holds the issuer public key corresponding to the issuer secret key and the prompt part, The presenting device sends the presenting certificate to the verifying device, The verification device verifies the presentation certificate using the issuer public key, the presentation part, and the partial message.

4. The message prompt system according to claim 1, The presentation device verifies whether the template has not been tampered with based on the template generation algorithm, and terminates the generation process of the presentation certificate if the verification fails.

5. The message prompt system according to claim 1, The prompting device is connected to the input device, The presentation device acquires the presentation biometric information when receiving an input of consent to output the presentation portion via the input device.

6. The message prompt system according to claim 5, The prompting device generates data for outputting a display screen for accepting the input of the consent, The display screen includes information indicating a message element of the presentation portion.

7. The message prompt system according to claim 1, The message prompt system includes a log output device, The log output device maintains: an encrypted log obtained by encrypting a log related to a prompt of the prompt part prompted by the prompting device using the user public key or the user secret key; and The template, The log output is performed by: Obtain the user's biometric information for log output, generating the user secret key based on the template and the biometric information for log output, Decrypt the encrypted log using the user secret key, Output the decrypted log.

8. The message prompt system according to claim 1, The message prompt system further includes a verification device for holding a verifier secret key. The prompting device is used to: maintaining a verifier public key corresponding to the verifier secret key, The partial message is output to the verification device in a state of being encrypted using the verifier public key.

9. The message prompt system according to claim 1, The message prompt system also includes a database, The issuance certificate is generated based on the user public key, an issuance-oriented processing message including the message, and the issuer secret key, The database performs: holding an issuance-oriented encrypted message, the issuance-oriented encrypted message being generated by dividing the issuance-oriented message into a plurality of pieces and encrypting the pieces, A part of the encrypted message for issuance processing is selected as the encrypted message and sent to the notification device.

10. A prompting device, a prompting message, The prompting device includes a processor and a memory. The memory holds: A template generated based on the user's registered biometric information; an encrypted message obtained by encrypting a message including one or more message elements; and a certificate for issuance generated based on a user public key corresponding to the template, the message, and an issuer secret key corresponding to an issuer of the message, The processor performs: Obtaining the user's biometric information for notification, generating a user secret key corresponding to the user public key based on the template and the biometric information for presentation, recovering the message by decrypting the encrypted message using the user secret key, generating a partial message according to the message based on a prompt part, wherein the prompt part is information for determining a part to be prompted in the message, generating a presentation certificate based on the presentation part, the issuance certificate and the user secret key, The partial message and the prompt proof are output.

11. A message prompt method, performed by a message prompt system, The message prompting system comprises a prompting device, The reminder device is maintained: A template generated based on the user's registered biometric information; an encrypted message obtained by encrypting a message including one or more message elements; and a certificate for issuance generated based on a user public key corresponding to the template, the message, and an issuer secret key corresponding to an issuer of the message, In the message prompt method, The presenting device obtains the presenting biometric information of the user, The presenting device generates a user secret key corresponding to the user public key based on the template and the presenting biometric information, The notification device restores the message by decrypting the encrypted message using the user secret key, The prompting means generates a partial message from the message based on a prompting part, wherein the prompting part is information for specifying a part to be prompted in the message, The presenting device generates a presenting certificate based on the presenting portion, the issuance certificate and the user secret key, The presenting means outputs the partial message and the presenting certificate.

Images