Electronic signature system, information processing device, and information processing method

Abstract

An electronic signature system is provided with an information processing device (100) and an information processing device (200) having a faster processing speed than the information processing device (100), the information processing device (100) acquires a message, generates an abstract from the message, and transmits the abstract to the information processing device (200), the information processing device (200) receives the abstract from the information processing device (100), generates an electronic signature from the abstract, and transmits the electronic signature to the information processing device (100). The electronic signature is transmitted to the information processing device (100), and the information processing device (100) receives the electronic signature from the information processing device (200), assigns the electronic signature to the message, and outputs the message assigned with the electronic signature.

Description

Technical Field

[0001] This disclosure relates to electronic signature systems that assign electronic signatures to messages, etc. Background Technology

[0002] Patent document 1 proposes a system for delegating signature generation in a Content-Centric Networking (CCN) network. In this system, a content generation device generates content objects and delegates digital signature generation to a content publishing device. The content publishing device monitors the content objects generated by the content generation device and retrieves them. Furthermore, the content publishing device generates a list of content objects and generates a digital signature for the list.

[0003] Existing technical documents

[0004] Patent documents

[0005] Patent Document 1: Japanese Patent Application Publication No. 2016-119660 Summary of the Invention

[0006] The technical problem that the invention aims to solve

[0007] However, in the system of Patent Document 1, the content object generated by the content generation device is retrieved through the content publishing device. This increases the risk of the content object being tampered with, and also increases the amount of communication associated with the content object.

[0008] Therefore, this disclosure provides an electronic signature system, etc., which can assign electronic signatures to messages obtained by information processing devices with slow processing speeds while suppressing the risks of tampering and impersonation and suppressing communication volume.

[0009] Technical solutions for solving the problem

[0010] One technical solution disclosed herein relates to an electronic signature system comprising: a first information processing device; and a second information processing device, the second information processing device having a processing speed faster than the first information processing device. The first information processing device acquires a message, generates a digest from the message, and sends the digest to the second information processing device. The second information processing device receives the digest from the first information processing device, generates an electronic signature from the digest, and sends the electronic signature to the first information processing device. The first information processing device receives the electronic signature from the second information processing device, assigns the electronic signature to the message, and outputs the message assigned the electronic signature.

[0011] Furthermore, these specific technical solutions can be implemented by non-transient recording media such as systems, devices, methods, integrated circuits, computer programs, or computer-readable CD-ROMs, or by any combination of systems, devices, methods, integrated circuits, computer programs, and recording media.

[0012] Invention Effects

[0013] The electronic signature system disclosed herein can, while suppressing the risks of tampering and impersonation and reducing communication volume, assign electronic signatures to messages obtained through slow information processing devices with low latency. Attached Figure Description

[0014] Figure 1 This is a block diagram illustrating the configuration of the communication system in the reference example.

[0015] Figure 2 This is a conceptual diagram representing the signature calculation of SPHINCS+.

[0016] Figure 3 This is a conceptual diagram of the pseudocode representing the signature calculation of SPHINCS+.

[0017] Figure 4 This is a comparison chart showing the time taken to compute the SPHINCS+ signature.

[0018] Figure 5 This is a block diagram illustrating a first example of the electronic signature system in the implementation method.

[0019] Figure 6 This is a block diagram illustrating a second configuration example of an electronic signature system in an implementation scheme.

[0020] Figure 7 This is a block diagram illustrating a third constituent example of an electronic signature system in an implementation scheme.

[0021] Figure 8 This is a block diagram illustrating a fourth configuration example of an electronic signature system in an implementation scheme.

[0022] Figure 9 This is a conceptual diagram representing the protected area in the implementation method.

[0023] Figure 10 This is a timing diagram illustrating the first action example of the electronic signature system in the implementation method.

[0024] Figure 11 This is a timing diagram illustrating the second action example of the electronic signature system in the implementation method.

[0025] Figure 12This is a timing diagram illustrating the third action example of the electronic signature system in the implementation method.

[0026] Figure 13 This is a timing diagram illustrating the fourth action example of the electronic signature system in the implementation method.

[0027] Figure 14 This is a block diagram illustrating a representative configuration example of an electronic signature system in an implementation scheme.

[0028] Figure 15 This is a timing diagram illustrating a representative action example of the electronic signature system in the implementation method. Detailed Implementation

[0029] In recent years, communication networks have become highly developed, enabling the transmission of all kinds of messages. As a result, it is possible to collect all kinds of messages.

[0030] Figure 1 This is a block diagram illustrating the configuration of the communication system in the reference example. Figure 1 The communication system includes a cloud server 301, a control device 302, a smart meter 303, and in-home equipment 304, etc.

[0031] Cloud server 301 serves as the server for the power management company, collecting data from smart meters 303 and other devices to manage electricity consumption. Control device 302 controls the actions of smart meters 303 and residential equipment 304.

[0032] The smart meter 303 is a battery-powered meter capable of communicating with the cloud server 301 and the residential device 304. Specifically, the smart meter 303 periodically measures electricity consumption data and sends the measured data to the cloud server 301 and the residential device 304. The residential device 304 is a computer within the residence that obtains data from the smart meter 303 and other devices to display electricity consumption information.

[0033] In the aforementioned communication system, the smart meter 303 assigns an electronic signature to the data to verify its authenticity and origin. An electronic signature is sometimes expressed as a signature or a digital signature. In particular, an electronic signature using public-key encryption is sometimes expressed as a digital signature. In this disclosure, electronic signatures, signatures, and digital signatures are interchangeable. The cloud server 301 and the residential device 304 can verify the authenticity of the data and its origin by verifying the electronic signature.

[0034] Here, as an example, electricity consumption data is transmitted, but various other messages can be transmitted via communication networks. Furthermore, each message can be assigned a digital signature.

[0035] Figure 2This is a conceptual diagram representing the signature computation of SPHINCS+. SPHINCS+ is a stateless hash-based signature method, a next-generation electronic signature method related to post-quantum cryptography (PQC). SPHINCS+ is an evolution of the signature method known as SPHINCS (Stateless Practical Hash-based Incredibly Nice Cryptographic Signatures).

[0036] In addition, SPHINCS+ has the characteristic of not utilizing the difficulty of mathematical problems such as lattice problems.

[0037] like Figure 2 As shown, in SPHINCS+, a digest is first generated from the message (S101). Specifically, the hash value obtained by inputting the message into a hash function is used as the digest, thus the hash value is used to generate the digest. For example, standard hash functions such as SHAKE256, SHA-256, or Haraka can be used.

[0038] Next, a signature is generated from the digest according to the FTS (Few-Time Signature) (S102). The signature generated according to the FTS is called the FTS signature. That is, the FTS signature is generated from the digest by calculating the FTS signature from the digest.

[0039] FTS has several types, including HORS (Hash to Obtain Random Subset), HORST (Hash to Obtain Random Subset Tree), and FORS (Forest Of Random Subsets). FORS is used in SPHINCS+.

[0040] Furthermore, a signature is generated from the FTS public key according to the HT (Hyper Tree) (S103). The signature generated according to the HT is called the HT signature. That is, the HT signature is generated from the digest by calculating the HT signature from the public key of the FTS signature.

[0041] Furthermore, the combination of the FTS signature and the HT signature is output as the SPHINCS+ signature.

[0042] Figure 3 This is a conceptual diagram of the pseudocode representing the signature calculation of SPHINCS+. For example... Figure 3 As shown, a message digest is generated. Next, an FTS signature is generated from the digest. Then, an HT signature is generated from the public key of the FTS signature. Finally, the combination of the FTS signature and the HT signature is output as a SPHINCS+ signature.

[0043] For example, SPHINCS+, as a signature method as described above, can also be used. Figure 1 This improves the reliability of messages through communication systems such as [the [system name]].

[0044] However, the signature calculation for SPHINCS+ is time-consuming. Specifically, the signature calculation for SPHINCS+ takes longer than that for previous encryption methods, and it also takes longer than the signature calculations for other encryption methods in PQC, such as Dilithium.

[0045] In addition, in such Figure 1 In IoT devices such as the smart meter 303, the circuit size is small and the processing speed is slow. Additionally, in... Figure 1 In battery-powered IoT devices such as the Smart Meter 303, battery life is shortened due to the time spent calculating.

[0046] Furthermore, for example, in the signature calculation of SPHINCS+, hash functions are used hundreds of thousands to millions of times. Therefore, it is also possible to perform signature calculations such as... Figure 1 IoT devices such as the smart meter 303 can adopt hardware accelerators for hash functions. However, the input to hash functions is usually less than 200 bytes per cycle, which is relatively short, so the effect of adopting hardware accelerators cannot be achieved.

[0047] In particular, FTS signature generation and HT signature generation are time-consuming in IoT devices. For example, even in IoT devices, the time spent generating a digest is typically less than 1ms. However, in the case of IoT devices, FTS signature generation and HT signature generation can take tens of seconds or more. On the other hand, in high-specification devices such as general-purpose computer systems, the time spent generating FTS signatures and HT signatures can be tens to hundreds of milliseconds.

[0048] Figure 4 This is a comparison chart showing the time it takes for the SPHINCS+ signature to be generated. Specifically, Figure 4 The table at the top shows the time required for signature generation and verification using a 78MHz single-core processor. This 78MHz single-core processor corresponds to the processors used in IoT devices. Figure 4The lower part of the table shows the time required for signature generation and signature verification using a 3GHz single-core processor. A 3GHz single-core processor corresponds to a processor found in high-specification devices such as general-purpose computer systems.

[0049] In addition, Figure 4 In this context, the parameter set is the set of parameters used for signature generation. The time spent on signature generation and verification is shown using two parameter sets: sha256-128f-simple and sha256-128s-simple. For example, on a 78MHz processor, signature generation using sha256-128f-simple takes 13.8 seconds. On the other hand, on a 3GHz processor, signature generation using sha256-128f-simple takes 11 milliseconds.

[0050] In other words, a 3GHz processor can generate a signature approximately 1250 times faster than a 78MHz processor. Conversely, on a 78MHz processor, signature generation takes approximately 1250 times longer than on a 3GHz processor. Furthermore, with other parameter sets not illustrated (sha256-256s-robust), signature generation on a 78MHz processor would take 18 minutes. On the other hand, signature verification takes less than one second in all cases.

[0051] As mentioned above, signature calculations in IoT devices can be time-consuming. Therefore, sending messages quickly becomes difficult. Furthermore, the battery life of IoT devices may be shortened. Additionally, beyond IoT devices and examples like SPHINCS+, it is not easy for slow information processing devices to assign digital signatures to messages.

[0052] In the system described in Patent Document 1, a content generation device generates content objects and delegates the generation of digital signatures to a content publishing device. The content publishing device monitors the content objects generated by the content generation device and retrieves the content objects. Furthermore, the content publishing device generates a list of content objects and generates digital signatures for the list.

[0053] However, in the system of Patent Document 1, the content object generated by the content generation device is retrieved by the content publishing device. This increases the risk of the content object being tampered with, and also increases the amount of communication associated with the content object.

[0054] Therefore, the electronic signature system of Example 1, which relates to a technical solution of this disclosure, includes: a first information processing device; and a second information processing device, which has a processing speed faster than the first information processing device. The first information processing device obtains a message, generates a digest from the message, and sends the digest to the second information processing device. The second information processing device receives the digest from the first information processing device, generates an electronic signature from the digest, and sends the electronic signature to the first information processing device. The first information processing device receives the electronic signature from the second information processing device, assigns the electronic signature to the message, and outputs the message assigned the electronic signature.

[0055] Therefore, a digest can be generated by a first information processing device with a slower processing speed, and an electronic signature can be generated by a second information processing device with a faster processing speed. Thus, the transmission of the message itself can be suppressed. Consequently, while suppressing the risks of tampering and impersonation and reducing communication volume, it is possible to assign electronic signatures to messages obtained by the slow information processing device with low latency.

[0056] Alternatively, the electronic signature system of Example 2, which relates to a technical solution of this disclosure, can also be the electronic signature system of Example 1, in which the first information processing device sends parameters corresponding to the private key used to generate the electronic signature to the second information processing device, and the second information processing device receives the parameters from the first information processing device and uses the parameters to generate the electronic signature from the digest.

[0057] Therefore, parameters sent from the first information processing device and received by the second information processing device can be used for the generation of electronic signatures. Thus, electronic signatures can be correctly generated in the second information processing device instead of the first information processing device.

[0058] Alternatively, the electronic signature system of Example 3, which relates to a technical solution of this disclosure, can also be the electronic signature system of Example 2, in which the first information processing device sends the parameters together with the digest to the second information processing device, and the second information processing device receives the parameters together with the digest from the first information processing device.

[0059] Therefore, it is possible to successfully generate an electronic signature from a digest using the parameters sent and received along with the digest.

[0060] Alternatively, the electronic signature system of Example 4, which relates to a technical solution of this disclosure, can also be the electronic signature system of Example 2, in which the first information processing device sends the parameters separately from the digest to the second information processing device before sending the digest, and the second information processing device receives the parameters separately from the first information processing device before receiving the digest.

[0061] Therefore, it is possible to generate an electronic signature from a digest using pre-sent and received parameters. This also helps to prevent the leakage of parameters corresponding to the private key.

[0062] Alternatively, the electronic signature system of Example 5, which relates to a technical solution of this disclosure, can also be any of the electronic signature systems in Examples 1 to 4. After receiving the electronic signature from the second information processing device, the first information processing device verifies the electronic signature, and if the verification of the electronic signature is successful, assigns the electronic signature to the message.

[0063] Therefore, a message can be electronically signed after its legitimacy has been verified. This further mitigates the risks of tampering and impersonation.

[0064] Alternatively, the electronic signature system of Example 6, which relates to a technical solution of this disclosure, can also be any of the electronic signature systems in Examples 1 to 5. The electronic signature includes a first electronic signature and a second electronic signature. The second information processing device generates the first electronic signature from the digest, generates the second electronic signature from the public key of the first electronic signature, sends the first electronic signature and the second electronic signature to the first information processing device, receives the first electronic signature and the second electronic signature from the second information processing device, assigns the first electronic signature and the second electronic signature to the message, and outputs the message that has been assigned the first electronic signature and the second electronic signature.

[0065] Therefore, two electronic signatures can be generated using the second information processing device, which has a faster processing speed. Thus, compared to generating two electronic signatures using the first information processing device, which has a slower processing speed, processing delays can be suppressed.

[0066] Alternatively, the electronic signature system of Example 7, which relates to a technical solution of this disclosure, can also be the electronic signature system of Example 6. In this system, the second information processing device sends the first electronic signature to the first information processing device after generating the first electronic signature and before generating the second electronic signature. After generating the second electronic signature, the second information processing device sends the second electronic signature to the first information processing device. The first information processing device begins verifying the first electronic signature after receiving the first electronic signature and before receiving the second electronic signature. After receiving the second electronic signature, the first information processing device begins verifying the second electronic signature. If the verification of both the first and second electronic signatures is successful, the message is assigned both the first and second electronic signatures.

[0067] Therefore, after verifying the legitimacy of the first and second electronic signatures, the message can be assigned both electronic signatures. This further mitigates the risks of tampering and impersonation. Furthermore, the verification of the first electronic signature can begin earlier, thus reducing processing delays.

[0068] Alternatively, the electronic signature system of Example 8 in this disclosure can also be the electronic signature system of Example 6 or Example 7, wherein the electronic signature follows SPHINCS+, the first electronic signature follows FTS (Few-Times Signature), and the second electronic signature follows HT (Hyper Tree).

[0069] Therefore, messages can be assigned highly reliable electronic signatures according to SPHINCS+, FTS, and HT.

[0070] Alternatively, the electronic signature system of Example 9, which relates to one of the technical solutions of this disclosure, can also be generated in any of the electronic signature systems of Examples 1 to 8, in which the second information processing device generates the electronic signature in the protected area where storage and transmission are performed in an encrypted state.

[0071] Therefore, the risk of tampering and impersonation can be further suppressed in the second information processing device.

[0072] Alternatively, the electronic signature system of Example 10, which relates to a technical solution of this disclosure, can also be in any of the electronic signature systems of Examples 1 to 9, where the first information processing device, when the conditions for generating the electronic signature by the first information processing device are met, does not send the digest to the second information processing device, but generates the electronic signature from the digest.

[0073] Therefore, electronic signatures can be generated appropriately in either the first or second information processing device, depending on the conditions. This allows for efficient decentralization of processing.

[0074] Additionally, one technical solution disclosed herein relates to an information processing apparatus of Example 11, comprising: a receiver that receives a message; a digest generator that generates a digest from the message; a communicator that sends the digest to a high-speed information processing device with a processing speed faster than the information processing apparatus and receives an electronic signature from the high-speed information processing device; and an outputter that assigns the electronic signature to the message and outputs the message assigned the electronic signature.

[0075] Therefore, it is possible to generate digests using a slow information processing device, and to generate electronic signatures using a high-speed information processing device. This allows for the suppression of message transmission itself. Consequently, it is possible to assign electronic signatures to messages obtained through slow information processing devices with low latency, while suppressing the risks of tampering and impersonation and reducing traffic.

[0076] Additionally, one technical solution disclosed herein relates to an information processing apparatus of Example 12, comprising: a communicator that receives a digest from a low-speed information processing device whose processing speed is slower than the information processing apparatus; and a signature generator that generates an electronic signature from the digest, wherein the communicator sends the electronic signature to the low-speed information processing device.

[0077] Therefore, it is possible to generate digests using slow, low-speed information processing devices, and to generate electronic signatures using fast-speed information processing devices. This allows for the suppression of message transmission itself. Consequently, it is possible to assign electronic signatures to messages obtained through slow, low-speed information processing devices with low latency, while suppressing the risks of tampering and impersonation and reducing traffic.

[0078] Furthermore, one technical solution of this disclosure relates to an information processing method in Example 13, which is an information processing method performed by an information processing device, including: a step of obtaining a message; a step of generating a digest from the message; a step of sending the digest to a high-speed information processing device with a processing speed faster than the information processing device; a step of receiving an electronic signature from the high-speed information processing device; a step of assigning the electronic signature to the message; and a step of outputting the message assigned the electronic signature.

[0079] Therefore, it is possible to generate digests using a slow information processing device, and to generate electronic signatures using a high-speed information processing device. This allows for the suppression of message transmission itself. Consequently, it is possible to assign electronic signatures to messages obtained through slow information processing devices with low latency, while suppressing the risks of tampering and impersonation and reducing traffic.

[0080] In addition, one technical solution of this disclosure relates to an information processing method in Example 14, which is an information processing method performed by an information processing device, including: a step of receiving a digest from a low-speed information processing device whose processing speed is slower than that of the information processing device; a step of generating an electronic signature from the digest; and a step of sending the electronic signature to the low-speed information processing device.

[0081] Therefore, it is possible to generate digests using slow, low-speed information processing devices, and to generate electronic signatures using fast-speed information processing devices. This allows for the suppression of message transmission itself. Consequently, it is possible to assign electronic signatures to messages obtained through slow, low-speed information processing devices with low latency, while suppressing the risks of tampering and impersonation and reducing traffic.

[0082] In addition, the program in Example 15 of this disclosure is a program for causing the information processing device to execute the information processing method of Example 13 or Example 14.

[0083] Therefore, the information processing device can reliably execute the aforementioned information processing method through the program.

[0084] Furthermore, these specific technical solutions can be implemented by non-transient recording media such as systems, devices, methods, integrated circuits, computer programs, or computer-readable CD-ROMs, or by any combination of systems, devices, methods, integrated circuits, computer programs, and recording media.

[0085] The embodiments will now be described using the accompanying drawings. Furthermore, the embodiments described below are inclusive or specific examples. The numerical values, shapes, materials, constituent elements, the arrangement of constituent elements, connection methods, steps, and the order of steps shown in the following embodiments are examples and are not intended to limit the claims.

[0086] Figure 5 This is a block diagram illustrating a first example of the electronic signature system in the implementation method. Figure 5 The electronic signature system shown includes an information processing device 100 and an information processing device 200, which assign electronic signatures to messages according to SPHINCS+.

[0087] For example, the information processing device 100 is as follows Figure 1 IoT devices such as the smart meter 303, and information processing devices such as the general-purpose computer system 200 are high-specification devices. Figure 1 The control device 302 can also be a high-specification device corresponding to the information processing device 200. The processing speed of the information processing device 100 is slower than that of the information processing device 200. In other words, the processing speed of the information processing device 200 is faster than that of the information processing device 100.

[0088] The information processing device 100 includes a memory 101, a communicator 102, a acquirer 103, a digest generator 104, and an output device 105.

[0089] The memory 101 is, for example, an information storage medium that stores information. The memory 101 can be either volatile or non-volatile. Specifically, the memory 101 stores a seed, which is a parameter corresponding to the private and public keys used for electronic signatures. Here, the seed includes PK.seed (public seed) and SK.seed (secret seed). Furthermore, the seed is used to generate public and private keys related to FTS signatures and HT signatures.

[0090] Seeds are used for digest generation, signature generation, and signature verification. Specifically, PK.seed is used for digest generation and signature verification. Both PK.seed and SK.seed are used for signature generation.

[0091] The communicator 102 is, for example, a communication processing circuit that performs information communication. The communicator 102 can also communicate with the information processing device 200 via secure communication. The communicator 102 may also include a transmitter for sending information and a receiver for receiving information. Specifically, the communicator 102 sends to the information processing device 200 a seed stored in the memory 101 and a digest generated by the digest generator 104. Additionally, the communicator 102 receives from the information processing device 200 an FTS signature and an HT signature generated by the information processing device 200.

[0092] The acquirer 103 is, for example, an information processing circuit that acquires information. Specifically, the acquirer 103 acquires the message before it is signed. The acquirer 103 can acquire the message from outside the information processing device 100 or from inside the information processing device 100.

[0093] For example, the acquirer 103 can also acquire a message by generating or calculating a message. Alternatively, the acquirer 103 can also be a sensor or a measuring instrument, which can acquire sensed or measured information as a message.

[0094] The digest generator 104 is, for example, an information processing circuit that generates a digest. Specifically, the digest generator 104 generates a digest from a message obtained by the acquirer 103.

[0095] More specifically, the digest generator 104 calculates the hash value obtained by inputting the message into a hash function as a digest, thereby generating a hash value as a digest. For example, the digest generator 104 uses standard hash functions such as SHAKE256, SHA-256, or Haraka to generate a digest from the message.

[0096] Additionally, PK.seed is used in the generation of the digest. Specifically, the digest generator 104 generates a hash value as the digest by concatenating PK.seed and the message together and inputting it into a hash function.

[0097] Output device 105 is, for example, an output processing circuit that outputs information. Specifically, output device 105 outputs a signed message, which is a message that has been given a signature. For example, output device 105 assigns a combination of the FTS signature and HT signature received through communicator 102 to a message obtained through acquirer 103 as a SPHINCS+ signature, and outputs the signed message.

[0098] More specifically, the SPHINCS+ signature is obtained by linking the intermediate hash value calculated as R during digest generation, the FTS signature, and the HT signature. The information processing apparatus 100 may also have a linker that links the FTS signature and the HT signature, etc. The output unit 105 may also have such a linker.

[0099] Additionally, signing a message corresponds to adding a signature to the message, signing a message link, or assigning a signature to the message. The information processing apparatus 100 may also have a signature assigner for signing messages in addition to the output unit 105, and the output unit 105 may also have such a signature assigner.

[0100] For example, output 105 can also be connected to... Figure 1 The cloud server 301 or the residential device 304 sends a signed message, thereby outputting a signed message. The output device 105 can also be integrated with the communicator 102.

[0101] The information processing device 200 includes a memory 201, a communicator 202, an FTS signature generator 203, and an HT signature generator 204.

[0102] The memory 201 is, for example, an information storage medium that stores information. The memory 201 can be either volatile or non-volatile memory. Specifically, the memory 201 stores the seed received through the communicator 202.

[0103] The communicator 202 may be a communication processing circuit, for example, for information communication. The communicator 202 may also communicate with the information processing device 100 via secure communication. Furthermore, the communicator 202 may include a transmitter for sending information and a receiver for receiving information.

[0104] Specifically, the communicator 202 receives from the information processing device 100 a seed stored in the information processing device 100 and a digest generated by the information processing device 100. Additionally, the communicator 202 sends to the information processing device 100 an FTS signature generated by the FTS signature generator 203 and a signature generated by the HT signature generator 204.

[0105] The FTS signature generator 203, for example, is an information processing circuit that generates an FTS signature. Specifically, the FTS signature generator 203 generates an FTS signature from a digest received via the communicator 202. Furthermore, a seed stored in memory 201 is used in the generation of the FTS signature.

[0106] More specifically, the digest is represented by, for example, 256 bits. The left 192 bits of these 256 bits are represented as `md`, and the right 64 bits are represented as `index`. Furthermore, the FTS signature generator 203 generates an FTS signature from `md`, `SK.seed`, `PK.seed`, and `index`. Conceptually, the private and public keys used for the FTS signature are determined by the `seed` and `index`. And, based on the private and public keys, the FTS signature is generated from `md`.

[0107] The HT signature generator 204, for example, is an information processing circuit that generates HT signatures. Specifically, the HT signature generator 204 generates HT signatures from the public key of the FTS signature generated by the FTS signature generator 203. Additionally, a seed stored in memory 201 is used in the generation of the HT signature.

[0108] More specifically, the HT signature generator 204 derives the public key of the FTS signature from the FTS signature, md, PK.seed, and index. Furthermore, the HT signature generator 204 generates the HT signature from the public key of the FTS signature, SK.seed, PK.seed, and index.

[0109] Furthermore, the FTS signature generated by the FTS signature generator 203 and the HT signature generated by the HT signature generator 204 are sent to the information processing device 100 via the communicator 202.

[0110] exist Figure 5 In this example, the electronic signature system can generate a digest using the slow-processing information processing device 100, and generate an electronic signature using the fast-processing information processing device 200. Therefore, the transmission of the message itself can be suppressed. Thus, while suppressing the risks of tampering and impersonation and reducing communication volume, it is possible to assign electronic signatures to messages obtained through the slow-processing information processing device 100 with low latency.

[0111] Figure 6This is a block diagram illustrating a second configuration example of the electronic signature system in the implementation method. Figure 6 In the example, with Figure 5 Compared to the example, the information processing device 100 also includes an FTS signature generator 106 and an HT signature generator 107.

[0112] The FTS signature generator 106, for example, is an information processing circuit that generates FTS signatures. Specifically, the FTS signature generator 106 generates an FTS signature from a digest generated by the digest generator 104. Furthermore, a seed stored in memory 101 is used in the generation of the FTS signature. The FTS signature generation method in the FTS signature generator 106 of the information processing apparatus 100 is substantially the same as the FTS signature generation method in the FTS signature generator 203 of the information processing apparatus 200.

[0113] The HT signature generator 107, for example, is an information processing circuit that generates HT signatures. Specifically, the HT signature generator 107 generates HT signatures from the public key of the FTS signature generated by the FTS signature generator 106. Furthermore, a seed stored in memory 101 is used in the generation of the HT signature. The HT signature generation method in the HT signature generator 107 of the information processing apparatus 100 is substantially the same as the HT signature generation method in the HT signature generator 204 of the information processing apparatus 200.

[0114] exist Figure 6 In the example, if the local generation conditions are met, the information processing device 100 does not send a digest to the information processing device 200, but generates a signature from the digest by the information processing device 100. The local generation conditions are the conditions used by the information processing device 100 to generate the signature.

[0115] The local generation condition is that the allowed time is more than the estimated time, where the allowed time is the time permitted for signature generation, and the estimated time is the time estimated as the time spent generating the signature in the information processing device 100.

[0116] For example, a permissible time is specified for the information processing device 100. Specifically, in Figure 1 Alternatively, the time interval can be specified as an allowable time by specifying the time interval for periodically sending data from the smart meter 303 to the cloud server 301.

[0117] Furthermore, if the allowed time is shorter than the estimated time, the signature may not be generated in the information processing device 100, but rather in the information processing device 200. On the other hand, if the allowed time is longer than the estimated time, the signature may be generated in the information processing device 100. In this case, the digest may not be sent to the information processing device 200.

[0118] Specifically, in cases where local generation conditions are not met, Figure 6 Examples of electronic signature systems and Figure 5 The example operates in the same way.

[0119] On the other hand, when the local generation conditions are met, the digest generator 104 outputs a digest to the FTS signature generator 106 instead of the communicator 102. Furthermore, the FTS signature generator 106 generates an FTS signature from the digest. Additionally, the HT signature generator 107 generates an HT signature from the public key of the FTS signature. Moreover, the output device 105 assigns a combination of the FTS signature and HT signature generated by the FTS signature generator 106 and the HT signature generator 107 to the message as the signature for SPHINCS+, without the aid of the information processing device 200.

[0120] The information processing apparatus 100 may also include a switch for switching between the action of generating a signature in the information processing apparatus 100 and the action of generating a signature in the information processing apparatus 200. Furthermore, the switch may switch between the action of generating a signature in the information processing apparatus 100 and the action of generating a signature in the information processing apparatus 200 according to local generation conditions, etc.

[0121] exist Figure 6 In this example, electronic signatures can be adaptively generated in information processing device 100 or information processing device 200 according to conditions. Therefore, processing can be efficiently distributed.

[0122] Figure 7 This is a block diagram illustrating a third configuration example of the electronic signature system in the implementation method. Figure 7 In the example, with Figure 5 In contrast to the previous example, after the FTS signature is generated by the FTS signature generator 203 and before the HT signature is generated by the HT signature generator 204, the communicator 202 of the information processing device 200 sends the FTS signature to the information processing device 100. Furthermore, the communicator 102 of the information processing device 100 receives the FTS signature from the information processing device 200.

[0123] Furthermore, after generating the HT signature using the HT signature generator 204, the communicator 202 of the information processing device 200 sends the HT signature to the information processing device 100. And the communicator 102 of the information processing device 100 receives the HT signature from the information processing device 200.

[0124] In addition, the information processing device 100 also includes an FTS signature verifier 108 and an HT signature verifier 109.

[0125] The FTS signature verifier 108, for example, is an information processing circuit that verifies FTS signatures. Specifically, the FTS signature verifier 108 verifies FTS signatures received via the communicator 102. Here, the verification of the FTS signature received via the communicator 102 uses the md and index of the digest generated by the digest generator 104 and the seed stored in the memory 101.

[0126] More specifically, the FTS signature verifier 108 derives the public key (PK_FORS') of the FTS signature from the FTS signature, md, PK.seed, and index. On the other hand, the FTS signature verifier 108 derives the original public key (PK_FORS) of the FTS signature from the seed and index. Furthermore, the FTS signature verifier 108 verifies the FTS signature based on whether the public key (PK_FORS') of the FTS signature matches the original public key (PK_FORS) of the FTS signature.

[0127] The HT signature verifier 109, for example, is an information processing circuit that verifies HT signatures. Specifically, the HT signature verifier 109 verifies HT signatures received via the communicator 102. Furthermore, the verification of the HT signature received via the communicator 102 utilizes the public key of the FTS signature, the index of the digest generated by the digest generator 104, and the seed stored in the memory 101.

[0128] More specifically, the HT signature verifier 109 derives the HT signature's public key (PK.root') from the FTS signature's public key, the HT signature, PK.seed, and index. On the other hand, the HT signature verifier 109 derives the original HT signature's public key (PK.root) from the seed and index. Furthermore, the HT signature verifier 109 verifies the HT signature based on whether the HT signature's public key (PK.root') matches the original HT signature's public key (PK.root).

[0129] Furthermore, if the FTS signature verifier 108 successfully verifies the FTS signature and the HT signature verifier 109 successfully verifies the HT signature, the output device 105 outputs a signed message. Specifically, in this case, the output device 105 assigns a signature including the FTS signature and the HT signature to the message obtained through the retriever 103, and outputs a signed message.

[0130] On the other hand, if the FTS signature verifier 108 fails to verify the FTS signature, or if the HT signature verifier 109 fails to verify the HT signature, the output device 105 will not output the signed message. In this case, there is a possibility of tampering or impersonation. Therefore, the output device 105 may also output an alarm. Specifically, for example, the output device 105 may also output an alarm. Figure 1 An alarm will be sent to the cloud server (301) or the residential device (304).

[0131] exist Figure 7 In the example, a message can be signed after the legitimacy of the signature is confirmed. Therefore, the risks of tampering and impersonation can be further suppressed. Furthermore, the FTS signature is sent before the HT signature is generated. Therefore, FTS signature verification can begin earlier. This helps to suppress processing delays.

[0132] Figure 8 This is a block diagram illustrating a fourth configuration example of an electronic signature system in an implementation scheme. Figure 8 Examples and Figure 6 Examples and Figure 7 The examples correspond to the combination. That is, in Figure 8 In this example, depending on whether the local generation conditions are met, the system switches between generating the signature using information processing device 100 and information processing device 200. Furthermore, when the signature is generated using information processing device 200, the signature is verified using information processing device 100.

[0133] like Figure 8 Like the example, Figure 6 Examples and Figure 7 Examples can be combined. Through... Figure 6 Examples and Figure 7 This combination of examples achieves the effects of both. Furthermore, signature generation and verification are based on a common method, thus reducing installation complexity.

[0134] Figure 9 This is a conceptual diagram representing the protected area in the implementation embodiment. The information processing device 200 receives the seed inherent to the information processing device 100. Furthermore, because the information processing device 200 has a high processing speed, it may be used for other processing. Therefore, there is a risk of leakage of the seed inherent to the information processing device 100. In addition, not limited to the seed, there is also a risk that the signature may be tampered with due to other processing.

[0135] Therefore, in Figure 9In this example, the information processing device 200 generates a signature in the protected area 210. Within the protected area 210, the signature is stored and transmitted in an encrypted state. This protects the signature generation process from interference from other processes.

[0136] Intel (registered trademark) SGX (Software Guard Extensions) can also be used for such a protected area 210. Specifically, an area called the Enclave is secured as protected area 210. Within the Enclave, data is configured and communication is conducted in an encrypted state. Thus, the data is protected.

[0137] With the above configuration, the risk of tampering and impersonation can be further suppressed in the information processing device 200.

[0138] Figure 10 This is a timing diagram illustrating the first action example of the electronic signature system in the implementation method. Figure 10 Examples and Figure 5 The actions in the examples, or in Figure 6 The example shows the actions that do not meet the local generation conditions.

[0139] First, information processing device 100 and information processing device 200 establish a secure communication channel (S201). Common encryption methods can also be used in the secure communication channel.

[0140] Next, the information processing device 100 obtains the message (S202). The information processing device 100 can obtain the message either from outside the information processing device 100 or by generating the message internally.

[0141] Next, the information processing device 100 generates a digest from the message (S203). The information processing device 100 may also generate a hash value obtained by inputting the message into a hash function as a digest.

[0142] Next, the information processing device 100 sends a digest and a seed to the information processing device 200 via a secure communication channel, and the information processing device 200 receives the digest and seed from the information processing device 100 via the secure communication channel (S204).

[0143] Next, the information processing apparatus 200 uses a seed to generate an FTS signature from the digest (S205). Next, the information processing apparatus 200 uses a seed to generate an HT signature from the public key of the FTS signature (S206).

[0144] Next, the information processing device 200 sends the FTS signature and HT signature to the information processing device 100 via a secure communication channel, and the information processing device 100 receives the FTS signature and HT signature from the information processing device 200 via the secure communication channel (S207).

[0145] Furthermore, the information processing device 100 assigns a combination of FTS signature and HT signature to the message as a SPHINCS+ signature, and outputs the signed message (S208).

[0146] exist Figure 10 In this example, the electronic signature system can generate a digest using a slow information processing device 100 and generate an electronic signature using a fast information processing device 200. Therefore, the transmission of the message itself can be suppressed. Thus, while suppressing the risks of tampering and impersonation and reducing traffic, it is possible to assign electronic signatures to messages obtained through the slow information processing device 100 with low latency.

[0147] Additionally, it is possible to successfully generate a signature from a digest using a seed that is sent and received along with the digest.

[0148] Figure 11 This is a timing diagram illustrating the second action example of the electronic signature system in the implementation method. Figure 11 Examples and Figure 7 The actions in the examples or in Figure 8 The example shows the actions that do not meet the local generation conditions.

[0149] Specifically, firstly, with Figure 10 Similarly, information processing device 100 and information processing device 200 establish a secure communication channel (S201). Additionally, information processing device 100 obtains a message (S202) and generates a digest from the message (S203). Next, information processing device 100 sends the digest and seed to information processing device 200, and information processing device 200 receives the digest and seed from information processing device 100 (S204).

[0150] Furthermore, the information processing apparatus 200 uses the seed to generate an FTS signature from the digest (S205). Next, in Figure 11 In the example, the information processing device 200 sends the FTS signature to the information processing device 100 via a secure communication channel, and the information processing device 100 receives the FTS signature from the information processing device 200 via the secure communication channel (S301).

[0151] Then, the information processing device 200 uses the seed to generate an HT signature from the public key of the FTS signature (S206). Here, in parallel with the process of generating the HT signature by the information processing device 200, the information processing device 100 verifies the FTS signature (S302).

[0152] Furthermore, the information processing device 200 sends the HT signature to the information processing device 100 via a secure communication channel, and the information processing device 100 receives the HT signature from the information processing device 200 via the secure communication channel (S303). Then, the information processing device 100 verifies the HT signature (S304).

[0153] If both the FTS signature and the HT signature are successfully verified, the information processing device 100 assigns a combination of the FTS signature and the HT signature to the message as a SPHINCS+ signature and outputs the signed message (S208).

[0154] exist Figure 11 In the example, the risks of tampering and impersonation can be mitigated through the verification of FTS signatures and HT signatures. The generation of HT signatures and the verification of FTS signatures can be performed in parallel. It is assumed that the generation of HT signatures and the verification of FTS signatures each take approximately tens to hundreds of milliseconds. Therefore, this time delay can be reduced.

[0155] Figure 12 This is a timing diagram illustrating the third action example of the electronic signature system in the implementation method. Figure 12 Examples and in Figure 6 In the examples, actions that meet the local generation conditions, or in Figure 8 The example shows the corresponding actions under the condition of satisfying the local generation criteria.

[0156] Specifically, firstly, with Figure 10 Similarly, information processing device 100 and information processing device 200 establish a secure communication channel (S201). Additionally, information processing device 100 obtains a message (S202) and generates a message digest (S203).

[0157] Next, in Figure 12 In the example, the information processing device 100 generates an FTS signature from the digest (S401) and generates an HT signature from the public key of the FTS signature (S402).

[0158] Next, with Figure 10 Similarly, the information processing device 100 assigns a combination of FTS signature and HT signature to the message as a SPHINCS+ signature, and outputs the signed message (S208).

[0159] like Figure 12 As in the example, the information processing device 100 can also generate FTS signatures and HT signatures without the aid of the information processing device 200, provided that the local generation conditions are met. This reduces the processing load on the information processing device 200.

[0160] Figure 13 This is a timing diagram illustrating the fourth action example of the electronic signature system in the implementation method. Figure 10 In the example, the seed is sent and received along with the digest, but... Figure 13 In the example, the seed is sent and received before the digest is sent and received.

[0161] Specifically, firstly, with Figure 10 Similarly, information processing device 100 and information processing device 200 establish a secure communication channel (S201).

[0162] Next, in Figure 13 In the example, information processing device 100 sends a seed to information processing device 200 via a secure communication channel, and information processing device 200 receives a seed from information processing device 100 via a secure communication channel (S501).

[0163] Next, with Figure 10 Similarly, the information processing device 100 obtains a message (S202) and generates a digest from the message (S203).

[0164] Next, in Figure 13 In the example, information processing device 100 sends a digest to information processing device 200 via a secure communication channel, and information processing device 200 receives a digest from information processing device 100 via a secure communication channel (S502). That is, no seed is sent or received during this timing.

[0165] Next, with Figure 10 Similarly, in this example, information processing device 200 uses a seed to generate an FTS signature from the digest (S205), and uses a seed to generate an HT signature from the public key of the FTS signature (S206). Information processing device 200 then sends the FTS signature and HT signature, and information processing device 100 receives the FTS signature and HT signature (S207). Information processing device 100 assigns a combination of the FTS signature and HT signature to the message as a SPHINCS+ signature, and outputs the signed message (S208).

[0166] exist Figure 13 In the example, a signature can be generated using pre-sent and pre-received seeds. Therefore, seed leakage can be suppressed.

[0167] For example in Figure 1In this example, the smart meter 303 corresponds to the slow-processing information processing device 100. Conversely, the control device 302, which controls the operation of the smart meter 303 and the residential equipment 304, corresponds to the fast-processing information processing device 200. In such an environment, seeds can be sent and received simultaneously with the controlled device, which registers information about the smart meter 303 in the control device 302. Therefore, it is not necessary to send and receive seeds each time a signature is generated. This helps to suppress seed leakage.

[0168] Furthermore, when the information processing device 200 receives requests to generate signatures from multiple devices, the information processing device 200 switches between multiple seeds. Figure 13 In the example, the information processing device 200 switches the seed by identifying the device that generates the signature for the request. On the other hand, in Figure 10 In the example, the seed is sent along with the digest, making it easy to switch seeds.

[0169] in addition, Figure 13 Examples and in Figure 10 In the example, the seed example is sent and received first. Similarly, it can also be done in... Figure 11 In the example, seeds are sent and received first.

[0170] In addition, Figures 10-13 In the example, information processing device 100 and information processing device 200 initially established a secure communication channel, but information processing device 100 and information processing device 200 can also establish a secure communication channel each time they communicate. In addition, if the possibility of information leakage during communication between information processing device 100 and information processing device 200 is low, it may not be necessary to establish a secure communication channel.

[0171] In addition, Figure 12 In the example, if it is determined that the local generation conditions are met before establishing a secure communication channel, a secure communication channel may not be established.

[0172] In addition, Figure 11 In the example, HT signature generation and FTS signature verification are performed in parallel, but it is not necessary to perform HT signature generation and FTS signature verification in parallel. For example, FTS signatures and HT signatures can be sent and received simultaneously, and FTS signatures and HT signatures can be verified simultaneously. Depending on the processing speed of the information processing device 100, there are cases where the information processing device 100 can process FTS signatures and HT signatures efficiently at the same time.

[0173] Furthermore, in the above description, FTS signatures and HT signatures were processed separately, but these signatures could also be processed together as a single signature. Additionally, FTS signature generator 203 and HT signature generator 204 can be considered as a single signature generator, or they can be substantially integrated into one signature generator.

[0174] Furthermore, while the above explanation uses signature methods conforming to SPHINCS+, FTS, and HT, it is not mandatory to use these methods; other signature methods can also be used. For example, a single-level signature can be used instead of a two-level FTS and HT signature, or a signature with three or more levels can be used.

[0175] Regarding the aforementioned electronic signature system, the following are representative examples of its structure and actions.

[0176] Figure 14 This is a block diagram illustrating a representative configuration example of an electronic signature system in an implementation scheme. Figure 14 In this electronic signature system, there are information processing device 100 and information processing device 200. The processing speed of information processing device 100 is slower than that of information processing device 200, and the processing speed of information processing device 200 is faster than that of information processing device 100. Information processing device 100 is also referred to as a low-speed information processing device, and information processing device 200 is also referred to as a high-speed information processing device.

[0177] The information processing apparatus 100 includes a communicator 102, a message acquirer 103, a message digest generator 104, and an output device 105. The message acquirer 103 acquires a message. The message digest generator 104 generates a message digest from the message. The communicator 102 sends the message digest to the information processing apparatus 200 and receives an electronic signature from the information processing apparatus 200. The output device 105 assigns an electronic signature to the message and outputs the message with the electronic signature.

[0178] The information processing apparatus 200 includes a communicator 202 and a signature generator 220. The signature generator 220 may also correspond to an FTS signature generator 203 and an HT signature generator 204. The communicator 202 receives a digest from the information processing apparatus 100. The signature generator 220 generates an electronic signature from the digest. The communicator 202 sends the electronic signature to the information processing apparatus 100.

[0179] Figure 15 This is a timing diagram illustrating a representative action example of the electronic signature system in the implementation method.

[0180] First, the information processing device 100 receives a message (S601). Next, the information processing device 100 generates a digest from the message (S602). Next, the information processing device 100 sends the digest to the information processing device 200 (S603), and the information processing device 200 receives the digest from the information processing device 100 (S604). Next, the information processing device 200 generates an electronic signature from the digest (S605).

[0181] Next, the information processing device 200 sends an electronic signature to the information processing device 100 (S606), and the information processing device 100 receives the electronic signature from the information processing device 200 (S607). Then, the information processing device 100 assigns an electronic signature to the message (S608). Finally, the information processing device 100 outputs the message that has been assigned an electronic signature (S609).

[0182] Therefore, a digest can be generated by the slow-processing information processing device 100, and an electronic signature can be generated by the fast-processing information processing device 200. Thus, the transmission of the message itself can be suppressed. Therefore, while suppressing the risk of tampering and impersonation and reducing traffic, it is possible to assign an electronic signature to a message obtained by the slow-processing information processing device 100 with low latency.

[0183] Alternatively, information processing device 100 may send parameters corresponding to the private key used to generate the electronic signature to information processing device 200. Information processing device 200 may also receive these parameters from information processing device 100. Furthermore, information processing device 200 may use these parameters to generate the electronic signature from the digest.

[0184] Therefore, parameters sent from information processing device 100 and received by information processing device 200 can be used for generating electronic signatures. Thus, electronic signatures can be correctly generated in information processing device 200 instead of information processing device 100. Furthermore, the parameters corresponding to the private key used to generate the electronic signature can be either parameters used to generate the private key, such as the seed mentioned above, or the private key itself.

[0185] Alternatively, information processing device 100 may send the aforementioned parameters along with the digest to information processing device 200. Information processing device 200 may also receive the aforementioned parameters along with the digest from information processing device 100. Thus, an electronic signature can be successfully generated from the digest using the parameters sent and received along with it.

[0186] Alternatively, for example, the information processing device 100 may send the aforementioned parameters to the information processing device 200 separately from the digest before sending the digest. Furthermore, the information processing device 200 may receive the aforementioned parameters from the information processing device 100 separately from the digest before receiving the digest. Thus, an electronic signature can be generated from the digest using the parameters that have been sent and received in advance. Therefore, leakage of parameters corresponding to the private key can be suppressed.

[0187] Furthermore, for example, the information processing device 100 can verify the electronic signature after receiving it from the information processing device 200. And, if the electronic signature verification is successful, the information processing device 100 can also assign an electronic signature to the message. Thus, it is possible to assign an electronic signature to the message after confirming the legitimacy of the electronic signature. Therefore, the risks of tampering and impersonation can be further suppressed.

[0188] Alternatively, an electronic signature may include a first electronic signature and a second electronic signature. Furthermore, the information processing device 200 may generate the first electronic signature from the digest. Additionally, the information processing device 200 may generate the second electronic signature from the public key of the first electronic signature. Then, the information processing device 200 may send the first and second electronic signatures to the information processing device 100.

[0189] Furthermore, the information processing device 100 can also receive the first electronic signature and the second electronic signature from the information processing device 200. Then, the information processing device 100 can also assign the first electronic signature and the second electronic signature to the message. Furthermore, the information processing device 100 can also output the message that has been assigned the first electronic signature and the second electronic signature.

[0190] Therefore, two electronic signatures can be generated using the fast information processing device 200. Thus, compared to generating two electronic signatures using the slow information processing device 100, processing delays can be suppressed.

[0191] Alternatively, for example, information processing device 200 may send the first electronic signature to information processing device 100 after generating the first electronic signature and before generating the second electronic signature. Alternatively, information processing device 200 may send the second electronic signature to information processing device 100 after generating the second electronic signature.

[0192] Furthermore, the information processing device 100 can begin verifying the first electronic signature after receiving the first electronic signature and before receiving the second electronic signature. Additionally, the information processing device 100 can begin verifying the second electronic signature after receiving the second electronic signature. Then, if the verification of both the first and second electronic signatures is successful, the information processing device 100 can assign both the first and second electronic signatures to the message.

[0193] Therefore, after verifying the legitimacy of the first and second electronic signatures, the message can be assigned both electronic signatures. This further mitigates the risks of tampering and impersonation. Furthermore, the verification of the first electronic signature can begin earlier, thus reducing processing delays.

[0194] Furthermore, electronic signatures can also follow SPHINCS+. The first electronic signature can also follow FTS (Few-Times Signature). Additionally, the second electronic signature can follow HT (Hyper Tree). Therefore, messages can be assigned highly reliable electronic signatures according to SPHINCS+, FTS, and HT.

[0195] Furthermore, for example, the information processing device 200 can generate an electronic signature in a protected area where storage and transmission are performed in an encrypted state. This further suppresses the risk of tampering and impersonation within the information processing device 200.

[0196] Alternatively, for example, if the conditions for generating an electronic signature by the information processing device 100 are met, the information processing device 100 may generate an electronic signature from the digest without sending a digest to the information processing device 200.

[0197] Therefore, electronic signatures can be generated adaptively in information processing device 100 or information processing device 200 according to conditions. Thus, processing can be efficiently distributed.

[0198] In addition, it can be used for Figure 14 and Figure 15 Additional representative examples of composition and representative examples of action are provided. Figures 1-13 The examples of the constituent parts and the examples of the actions described can be modified according to those parts or all.

[0199] Furthermore, multiple components of the information processing apparatus 100 may also be configured by a processor. Specifically, multiple components of the information processing apparatus 100 other than the memory 101 may also be configured by a processor. Furthermore, the processor may function as multiple components. Similarly, multiple components of the information processing apparatus 200 may also be configured by a processor. Specifically, multiple components of the information processing apparatus 200 other than the memory 201 may also be configured by a processor. Furthermore, the processor may function as multiple components.

[0200] The above describes the technical solutions of the electronic signature system and information processing device according to the embodiments. However, the technical solutions of the electronic signature system and information processing device are not limited to these embodiments. Modifications conceived by those skilled in the art can be implemented in accordance with these embodiments, and multiple constituent elements of the embodiments can be combined arbitrarily.

[0201] For example, other components may perform the processes that are performed by the specific components in the implementation, instead of specific components. Furthermore, the order of multiple processes may be changed, and multiple processes may be executed in parallel. Additionally, the ordinal numbers such as "1" and "2" used in the description may be appropriately replaced, removed, or reassigned. These ordinal numbers do not necessarily correspond to a meaningful order and can also be used for component identification.

[0202] Furthermore, the electronic signature method or information processing method, which includes the steps performed by the constituent elements of the electronic signature system or information processing device, can also be executed by any system or device. That is, the electronic signature method or information processing method can be executed by the aforementioned electronic signature system or information processing device, or by other systems or devices.

[0203] For example, part or all of the electronic signature method or information processing method can be executed by a computer system equipped with a processor, memory, and input / output circuits. In that case, the electronic signature method or information processing method can also be executed by the computer system executing a program designed to cause the computer system to perform the electronic signature method or information processing method.

[0204] For example, the above procedure can also cause a computer system corresponding to an information processing device to execute the following information processing method, which is an information processing method performed by the information processing device, including: a step of obtaining a message; a step of generating a digest from the message; a step of sending the digest to a high-speed information processing device with a processing speed faster than the information processing device; a step of receiving an electronic signature from the high-speed information processing device; a step of assigning the electronic signature to the message; and a step of outputting the message assigned the electronic signature.

[0205] Alternatively, for example, the above procedure can also cause the computer system corresponding to the information processing device to execute the following information processing method, which is an information processing method performed by the information processing device, including: receiving a digest from a low-speed information processing device with a processing speed slower than the information processing device; generating an electronic signature from the digest; and sending the electronic signature to the low-speed information processing device.

[0206] Alternatively, the above program can be recorded on a non-transitory computer-readable recording medium such as a CD-ROM.

[0207] Furthermore, the components of an electronic signature system or information processing device can be composed of dedicated hardware, general-purpose hardware that executes the aforementioned programs, or a combination thereof. Additionally, the general-purpose hardware can consist of a memory storing the program and a general-purpose processor that reads the program from the memory and executes it. Here, the memory can be a semiconductor memory or a hard disk, and the general-purpose processor can be a CPU.

[0208] Alternatively, dedicated hardware can consist of a memory and a dedicated processor. For example, a dedicated processor can also execute the aforementioned electronic signature method or information processing method, referring to the memory.

[0209] Furthermore, the constituent elements of an information processing device can also be circuits. These circuits can either form a single circuit or be separate circuits. Additionally, these circuits can correspond to either dedicated hardware or general-purpose hardware that executes the aforementioned programs.

[0210] Industrial availability

[0211] This disclosure can be used in electronic signature systems that assign electronic signatures to messages, and can be applied to communication systems, etc.

[0212] Explanation of reference numerals in the attached figures

[0213] 100, 200 information processing devices

[0214] 101, 201 memory

[0215] 102, 202 Communicator

[0216] 103 Acquisition Device

[0217] 104 Summary Generator

[0218] 105 Output

[0219] 106, 203 FTS Signature Generator

[0220] 107, 204 HT signature generator

[0221] 108 FTS Signature Verifier

[0222] 109 HT Signature Verifier

[0223] 210 Protected Area

[0224] 220 Signature Generator

[0225] 301 Cloud Server

[0226] 302 Control Device

[0227] 303 Smart Meter

[0228] 304 Residential Equipment

Claims

1. An electronic signature system comprising: a first information processing device; and a second information processing device that is faster in processing speed than the first information processing device, the first information processing device, acquiring a message, generating an abstract from the message, transmitting the abstract to the second information processing device, the second information processing device, receiving the abstract from the first information processing device, generating an electronic signature from the abstract, transmitting the electronic signature to the first information processing device, the first information processing device, receiving the electronic signature from the second information processing device, imparting the electronic signature to the message, and outputting the message to which the electronic signature is imparted.

2. The electronic signature system according to claim 1, the first information processing device transmitting a parameter corresponding to a private key used to generate the electronic signature to the second information processing device, the second information processing device, receiving the parameter from the first information processing device, and generating the electronic signature from the abstract using the parameter.

3. The electronic signature system according to claim 2, the first information processing device transmitting the parameter to the second information processing device together with the abstract, and the second information processing device receiving the parameter from the first information processing device together with the abstract.

4. The electronic signature system according to claim 2, the first information processing device transmitting the parameter to the second information processing device separately from the abstract before transmitting the abstract, and the second information processing device receiving the parameter from the first information processing device separately from the abstract before receiving the abstract.

5. The electronic signature system according to any one of claims 1 to 4, the first information processing device, verifying the electronic signature after receiving the electronic signature from the second information processing device, and imparting the electronic signature to the message in a case where the verification of the electronic signature is successful.

6. The electronic signature system according to any one of claims 1 to 4, the electronic signature including a first electronic signature and a second electronic signature, the second information processing device, generating the first electronic signature from the abstract, generating the second electronic signature from a public key of the first electronic signature, transmitting the first electronic signature and the second electronic signature to the first information processing device, the first information processing device, receiving the first electronic signature and the second electronic signature from the second information processing device, imparting the first electronic signature and the second electronic signature to the message, and outputting the message to which the first electronic signature and the second electronic signature are imparted.

7. The electronic signature system according to claim 6, the second information processing device, transmitting the first electronic signature to the first information processing device after generating the first electronic signature and before generating the second electronic signature, and transmitting the second electronic signature to the first information processing device after generating the second electronic signature, the first information processing device, ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ start verification of the first electronic signature after receiving the first electronic signature and before receiving the second electronic signature, start verification of the second electronic signature after receiving the second electronic signature, in a case where the verification of the first electronic signature and the second electronic signature is successful, attribute the first electronic signature and the second electronic signature to the message.

8. The electronic signature system according to claim 6, the electronic signature follows SPHINCS+, the first electronic signature follows FTS, i.e., finite time signature, the second electronic signature follows HT, i.e., hyper tree.

9. The electronic signature system according to any one of claims 1 to 4, the second information processing apparatus generates the electronic signature in a protection area where storage and transmission in an encrypted state are performed.

10. The electronic signature system according to any one of claims 1 to 4, in a case where a condition for generating the electronic signature by the first information processing apparatus is satisfied, the first information processing apparatus does not transmit the digest to the second information processing apparatus, but generates the electronic signature from the digest.

11. An information processing apparatus, comprising: an obtainer that obtains a message; a digest generator that generates a digest from the message; a communicator that transmits the digest to a high-speed information processing apparatus that is faster than the information processing apparatus in processing speed, receives an electronic signature from the high-speed information processing apparatus; and an outputter that attributes the electronic signature to the message, and outputs the message to which the electronic signature is attributed.

12. An information processing apparatus, comprising: a communicator that receives a digest from a low-speed information processing apparatus that is slower than the information processing apparatus in processing speed; and a signature generator that generates an electronic signature from the digest, the communicator transmits the electronic signature to the low-speed information processing apparatus.

13. An information processing method, which is an information processing method performed by an information processing apparatus, comprising: an obtaining step of obtaining a message; a digest generating step of generating a digest from the message; a transmitting step of transmitting the digest to a high-speed information processing apparatus that is faster than the information processing apparatus in processing speed; a receiving step of receiving an electronic signature from the high-speed information processing apparatus; an attributing step of attributing the electronic signature to the message; and an outputting step of outputting the message to which the electronic signature is attributed.

14. An information processing method, which is an information processing method performed by an information processing apparatus, comprising: a receiving step of receiving a digest from a low-speed information processing apparatus that is slower than the information processing apparatus in processing speed; a signature generating step of generating an electronic signature from the digest; and a transmitting step of transmitting the electronic signature to the low-speed information processing apparatus.

15. A program for causing the information processing method according to claim 13 or 14 to be executed by the information processing apparatus. ​ ​

Images