Signature generation method, signature verification method, existence proof system, communication device, and program

Abstract

To provide a signature technique that can be used for existence proof in a distributed data distribution platform and can hide blocks included in a local chain.SOLUTION: A signature generation method includes a first generation step in which a communication device U0 generates a message m0=H(hL+hL-1+...+hL-(K-1)+r1+...+rK-1) (where H is a hash function) from hash values hL, hL-1, ..., hL-(K-1) of the latest K blocks (where K is an integer equal to or greater than 2) BL, BL-1, ..., BL-(K-1) among blocks constituting a local chain LC0 recorded in a recording unit and random numbers r1, ..., rK-1, and broadcasts a pair (m0, pk0) of the message m0 and the public key pk0 of the communication device U0 to the communication devices U1, ..., UN.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to a proof of existence technology in a distributed data distribution platform. [Background technology]

[0002] There is a growing demand for data utilization using AI, and motivation for data utilization is spreading throughout society. However, data utilization has not progressed as expected due to a lack of data and security concerns regarding data sharing. To solve this problem, there is a demand for a data distribution platform that anyone can use safely and at low cost.

[0003] There are two types of data distribution infrastructure: a centralized model in which all processing is delegated to a trusted third party (TTP) such as a service provider, and a decentralized model in which participants themselves verify safety without assuming a trusted third party. Considering the current situation in which data sharing is not progressing due to concerns about data misuse by service providers, a decentralized data distribution infrastructure that is not based on trust in others is desirable. Known examples of decentralized data distribution infrastructure include those that use blockchains such as Bitcoin and Blockene (see Reference Non-Patent Document 1 and Reference Non-Patent Document 2), and those that build ledger infrastructure based on Directed Acyclic Graphs (DAGs) to improve costs and performance (see Reference Non-Patent Document 3).

[0004] (Reference non-patent document 1: Satoshi Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System,” https: / / bitcoin.org / bitcoin.pdf, 2020.) (Reference non-patent document 2: Sambhav Satija, Apurv Mehra, Sudheesh Singanamalla, Karan Grover, Muthian Sivathanu, Nishanth Chandran, Divya Gupta, and Satya Lokam, “Blockene: a high-throughput blockchain over mobile devices,” Proceedings of the 14th USENIX Conference on Operating Systems Design and Implementation, USENIX Association, pp.567-582, 2020.) (Reference non-patent document 3: Qin Wang, Jiangshan Yu, Shipping Chen, Yang Xiang, “SoK: Diving into DAG-based Blockchain Systems,” arXiv e-prints, 2020.) An important function of the data distribution platform is the proof of existence (also called time stamp) that proves that certain data existed at a certain time. In order to perform proof of existence safely and efficiently in the distributed data distribution platform, a random signature has been proposed in which the proof of existence is performed by a signature participant randomly selected from among the users of the distributed data distribution platform (see Non-Patent Document 1). In the random signature, each user of the distributed data distribution platform manages data required for the proof of existence as a local chain. The local chain is a sequence of blocks in which blocks, which are data for showing that certain data existed at a certain time, are associated so that the chronological relationship can be understood. A hash value is used for the link, which is data used to associate blocks. Specifically, a certain block included in the local chain includes the hash value of the latest block from the block in question as a link. In addition, the local chain is made public to other users. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Morinori Ohashi, Yifan Zhang, Takuro Hosoi, and Kanta Matsuura, "A study on DAG-based distributed time stamping methods," IPSJ Technical Report, Computer Security (CSEC), 2023-CSEC-100, Vol.67, pp.1-7, 2023. Summary of the Invention [Problem to be solved by the invention]

[0006] In random signatures, there is only one link connecting two blocks. Therefore, if a user hides the link that relates blocks, proof of existence becomes impossible. Therefore, users cannot freely hide blocks, and there is a problem that users are forced to publish blocks even if they contain information that is inconvenient to them.

[0007] Therefore, the objective of the present invention is to provide a signature technique that can be used for proof of existence in a distributed data distribution infrastructure and can hide blocks included in the local chain. [Means for solving the problem]

[0008] One aspect of the present invention is a signature generation method in which N+1 (where N is an integer equal to or greater than 1) communication devices included in an existence proof system composed of a plurality of communication devices that record local chains jointly generate an aggregate signature, N Among the N+1 communication devices, let us assume that the communication device participating in the request for generating an aggregate signature from the communication device U0 is one of the N+1 communication devices. The communication device U0 records the latest K blocks (where K is an integer equal to or greater than 2) of the blocks constituting the local chain LC0 recorded in the recording unit. L , B L-1 , …, B L-(K-1) The hash value of h L , h L-1 , …, h L-(K-1) and random numbers r1, …, r K-1Message m0 = H(h L +h L-1 +…+h L-(K-1) +r1+…+r K-1 ) (where H is a hash function), and sends the pair (m0, pk0) of the message m0 and the public key pk0 of the communication device U0 to the communication devices U1, …, U N a first generation step in which the communication device U0 broadcasts the n (n=1, …, N) to message m n and communication device U n Public key pk n A set of (m n , pk n ), and receives message hs0=m0||m1||…||m N and public key pks0=pk0||pk1||…||pk N Generate the signature σ0 = H(hs0||pk0) sk_0 (where H is a hash function, and sk0 is the private key of the communication device U0), and sends the pair (σ0, hs0, pks0) of the signature σ0, message hs0, and public key pks0 to the communication devices U1, …, U N a second generation step in which the communication device U0 broadcasts the n (n=1, …, N) to a signature σ n and message hs n and the public key pks n The set of (σ n , hs n , pks n ) and obtains signatures σ0, σ1, …, σ N From the aggregate signature σ Agg and generate a sequence of messages hs0, hs1, …, hs N and a sequence of public keys pks0, pks1, …, pks N Messages m0, m1, …, m N A sequence of messages containing pk0, pk1, …, pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n) (n=0, 1, …, N), and generate an aggregate signature σ Agg , a sequence of messages, a sequence of public keys, a table, and random numbers, r1, …, r K-1 Block B contains L Next block B L+1 and a third generation step of adding it to the local chain LC0 as

[0009] One aspect of the present invention is a signature verification method in which a communication device included in a presence proof system composed of a plurality of communication devices that record local chains verifies an aggregate signature, Agg Block B containing L+1 Communication devices U1, ..., U N The aggregate signature σ from the communication device U0 Agg The communication device that participated in the request to generate block B L+1 is the aggregate signature σ Agg At the same time, the communication device U0 generates a message m0=H(h L +h L-1 +…+h L-(K-1) +r1+…+r K-1 ) (where K is an integer greater than or equal to 2, H is a hash function, and h L , h L-1 , …, h L-(K-1) is block B among the blocks that make up local chain LC0. L+1 The most recent K blocks B L , B L-1 , …, B L-(K-1) hash values ​​of r1, …, r K-1 is a random number), message m1, ..., generated by communication device U1, N Message m generated by N A sequence of messages including the public key pk0 of communication device U0, the public key pk1 of communication device U1, ..., N pk N A sequence of public keys pubkeys containing a message m nand the public key pk n A set of (m n , pk n ) (n=0, 1, …, N) containing table tab, random numbers r1, …, r K-1 The communication device V0 receives the aggregate signature σ Agg Communication devices U0, U1, …, U N a determination step of determining whether a trusted communication device is included in the aggregate signature σ Agg Communication devices U0, U1, …, U N If a trusted communication device is included in table tab, the communication device V0 transmits a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N) to obtain a hash value h n =H(m n ||pk n ) (where H is a hash function) and generate hash values ​​h0, h1,…, h N and public keys pk0, pk1,…, pk N Using the aggregate signature σ Agg The first verification step verifies the aggregate signature σ Agg Communication devices U0, U1, …, U N If no trustworthy communication device is included in the communication device V0, the communication device V0 verifies the aggregate signature σ by DAG verification of a directed acyclic graph in which the vertices are the blocks included in the local chain recorded in the recording unit of the communication device included in the existence proof system, and the edges are the links between the blocks included in the local chain recorded in the recording unit of the communication device included in the existence proof system and the links between the blocks included in the local chain recorded in the recording unit of the communication device that requested the generation of the aggregate signature and the blocks included in the local chain recorded in the recording unit of the communication device that participated in the request to generate the aggregate signature. Agg and a second verification step of verifying that the Effect of the Invention

[0010] According to the present invention, it is possible to hide blocks included in a local chain that are required for a signature that can be used for proof of existence in a distributed data distribution infrastructure. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 illustrates an example of a presence proof system. [Diagram 2] 1 is a block diagram showing a configuration of an existence proof system 10. FIG. [Diagram 3] 1 is a block diagram showing a configuration of a communication device 100. FIG. [Figure 4] 13 is a flowchart showing an operation of the communication device 100 when generating a signature. [Diagram 5] 13 is a flowchart showing an operation of the communication device 100 at the time of signature verification. [Figure 6] FIG. 2 is a diagram illustrating an example of a functional configuration of a computer that realizes each device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described in detail. Note that components having the same functions are given the same reference numbers and duplicated explanations will be omitted.

[0013] Before describing each embodiment, the notation used in this specification will be described.

[0014] ^ (caret) represents a superscript. For example, x y^z Yes z is a superscript to x, and x y^z Yes z is a subscript to x. Also, _ (underscore) represents a subscript. For example, x y_z Yes z is a superscript to x, and x y_z Yes z is a subscript on x.

[0015] The superscripts "^" and "~" such as ^x and ~x for a certain letter x should actually be written directly above the "x", but due to the constraints of the description in the specification, they are written as ^x and ~x.

[0016] <Technical background> <<1: Design points of the signature technology used in the embodiment of the present invention>> The signature technique used in the embodiment of the present invention is capable of not only reducing the size of the signature data included in the block, but also hiding the blocks included in the local chain. Below, we will explain the ideas for reducing the size of the signature data and the ideas for hiding the blocks included in the local chain.

[0017] (1: Techniques for reducing the size of signature data) In order to reduce the size of signature data, it is conceivable to use a technology that aggregates multiple signatures, such as BGLS signatures (see Non-Patent Document 4). However, since BGLS signatures are intended for transactions between two parties, problems arise, such as the inability to deal with Rouge Publickey attacks and Sybil attacks, and as is, they cannot be used for existence proofs in a distributed data distribution platform.

[0018] (Reference Non-Patent Document 4: Dan Boneh, Craig Gentry, Ben Lynn, Hovav Shacham, “Aggregate and Verifiably Encrypted Signatures from Bilinear Maps,” In proceedings of Eurocrypt 2003, LNCS vol.2656, pp.416-432, 2003.) To ensure that a signature is resistant to rouge publickey attacks, the arguments of the hash function used to generate a signature in BGLS signatures must be different for each signing participant. Therefore, signing participants use data obtained by concatenating their public key with the message to be signed as an argument to the hash function, so that signing participants do not generate signatures from the same data. This makes the probability of a rouge publickey attack occurring due to the data being the same as the probability of a hash value collision, and can be ignored.

[0019] Furthermore, in order for a signature to be secure against Sybil attacks, it is necessary that signature verification can be performed even when all signing participants are attackers. Therefore, in addition to signature verification in BGLS signature, which is used for signature verification when there are reliable signing participants, DAG verification (see Non-Patent Document 1) is provided for signature verification when there are no reliable signing participants. However, in signature verification in BGLS signature, the signature is verified by using data obtained by concatenating a public key corresponding to the message to be signed with the message to be signed as an argument of the hash function, in correspondence with the data obtained by concatenating a public key with the message to be signed in signature generation as an argument of the hash function.

[0020] (2: A way to hide blocks included in the local chain) The local chain of random signature has a data structure in which two blocks are linked together in a chain by one link. Therefore, if a block included in the local chain is hidden, DAG verification cannot be performed. In other words, blocks could not be hidden with random signature. Therefore, the block included in the local chain is made to include two links, the hash value of the block immediately preceding the block in question, and the hash value of the block two blocks before the block in question. This maintains a data structure in which the blocks are linked together in a chain even if the block immediately preceding a certain block is hidden. In addition, random numbers are used to prevent the verifier from knowing the contents of the hidden block. Note that K is an integer equal to or greater than 2, and it is generally possible to include the hash values ​​of the K most recent blocks from the block included in the local chain. In other words, the block included in the local chain includes K links. In this case, it is possible to hide a maximum of K-1 blocks.

[0021] As can be seen from the above description, the signature technique used in the embodiment of the present invention is configured as a signature technique based on the BGLS signature, which is resistant to Rouge Publickey attacks and Sybil attacks, and has a small signature data size. Furthermore, the signature technique used in the embodiment of the present invention is configured as a signature technique that can hide blocks included in the local chain.

[0022] <<2: Distributed system according to an embodiment of the present invention>> A signature generation method and a signature verification method used in a distributed system for existence proof (hereinafter referred to as the existence proof system) according to an embodiment of the present invention will be described. Here, the existence proof system is composed of multiple communication devices that record local chains. The local chain recorded in each communication device is a sequence of blocks that are associated so that a chronological relationship can be determined for blocks that are data showing that certain data existed at a certain time. The data used to associate two blocks is called a link, and a hash value is used as the link.

[0023] In the proof-of-existence system according to an embodiment of the present invention, two or more communication devices jointly create a signature to prove the existence of certain data. It is not necessary for all communication devices included in the proof-of-existence system to participate in the signature generation. Each communication device participating in the proof-of-existence of certain data adds one block to a local chain that it manages. The added block is then associated so that it can be seen that it was signed jointly. The data indicating this association is also called a link.

[0024] FIG. 1 is a diagram showing an example of a proof-of-existence system. The proof-of-existence system of FIG. 1 includes smartphones 1, 2, 3, and 4, and each smartphone records a local chain in its recording section. For example, a link is provided between block B1 and block B2 included in the local chain recorded in the recording section of smartphone 2 so that the chronological relationship can be understood. In addition, a link is provided between block B3 included in the local chain recorded in the recording section of smartphone 1 and block B4 included in the local chain recorded in the recording section of smartphone 4 so that it can be understood that they were jointly signed.

[0025] Below, e:G1×G2→G t (However, G1, G2, G t is a group, and g1, g2 are generators of groups G1, G2, respectively. ) is a pairing map, H:{0, 1} * Let →G1 be a hash function, and + and || be combination operators (for example, the concatenation operator or the bit XOR operator), and we will explain the signature generation method (signature generation algorithm) and signature verification method (signature verification algorithm) used in the existence proof system.

[0026] (1: Signature generation algorithm) A communication device that requests the generation of an aggregate signature for proving the existence of certain data executes the following function SIGNING. Prior to executing the function SIGNING, the communication device that requests the generation of the aggregate signature is assumed to know the communication devices that will participate in the request to generate the aggregate signature. Note that the communication devices that will participate in the generation of the aggregate signature are determined from among the multiple communication devices included in the existence proof system using a predetermined method (e.g., a probabilistic method). The number of communication devices that cooperate to generate an aggregate signature may be different each time it is generated.

[0027] ------------------------------------------------------------------ 1: function SIGNING 2: m local ←H(h L +h L-1 +r) 3: BroadcastTarget(m local , pk local ) 4: data←ms, PubKeys←ReceiveTarget 5: hs←m local , pks←pk local 6: for (m j , pk j )←data j ∈data 7: hs←hs||m j 8: pks←pks||pk j 9: Signature: σ←H(hs||pk local ) sk_local 10: BroadcastSignature(data←(σ, hs, pks)) 11: sigs, ms, PubKeys←ReceiveSignature 12: σ Agg, messages, pubkeys, tab←AGGREGATE(sigs, ms, PubKeys) 13: add(σ Agg , messages, pubkeys, tab, r) to local-chain ------------------------------------------------------------------ The h that appears in the second line of processing L , h L-1 The latest block B among the blocks that make up the local chain recorded in the recording unit of the communication device that requests the generation of an aggregate signature is L hash value of the latest block B L Block B before L-1 The hash value of pk appears in the processing on the third line. local , sk that appears in the 9th line local are the public key and private key of the communication device requesting the generation of an aggregate signature.

[0028] In line 12, the following function AGGREGATE is called to obtain the aggregate signature σ Agg , generate a message column "messages", a public key column "pubkeys", and a table "tab".

[0029] ------------------------------------------------------------------ 1: function AGGREGATE(data←{sigs, ms, PubKeys}) 2: σ Agg ←g1 3: messages, pubkeys←{}, {} 4: for (σ k , hs k , pks k )←data k ∈data 5: pk k←first bytes of pks k 6: if e(σ k , g2)=e(H(hs||pk k ), pk k ) then 7: σ Agg ←σ Agg *σ k 8: for h m , pk m ←hs k , pks k do 9: messages←messages||h m 10: pubkeys← pubkeys||pk m 11: tab: σ k vs h m , pk m 12: return σ Agg , messages, pubkeys, tab ------------------------------------------------------------------ Note that the processing in the second line of the SIGNING function is local ←H(h L +h L-1 +r) instead of just m local ←h L In this case, the process in line 13 is add(σ Agg , messages, pubkeys, tab, r) to local-chain instead of add(σ Agg , messages, pubkeys, tab) to local-chain.

[0030] Also, the processing of the second line of the SIGNING function is local ←H(h L +h L-1 +r) instead of m local ←H(h L +h L-1+…+h L-(K-1) +r1+…+r K-1 ) (where K is an integer of 2 or more, h L , h L-1 , …, h L-(K-1) is the latest K blocks B among the blocks that make up the local chain recorded in the recording unit of the communication device that requests the generation of an aggregate signature. L , B L-1 , …, B L-(K-1) hash values ​​of r1, …, r K-1 is a random number). In this case, the process in line 13 is Agg , messages, pubkeys, tab, r) to local-chain instead of add(σ Agg , messages, pubkeys, tab, r1, …, r K-1 ) to local-chain.

[0031] (2: Signature verification algorithm) The communication devices included in the existence proof system verify the aggregate signature in different ways depending on the following two cases.

[0032] (A) When a trusted communication device is included among the communication devices involved in the generation of the aggregate signature (B) If a trusted communication device is not included among the communication devices involved in the generation of the aggregate signature. In the case of (A), the communication device verifying the aggregate signature executes the following function VERIFYAGG. The function VERIFYAGG is basically the same as the signature verification in the BGLS signature, but in the generation of the hash value in the third line, i Not just pk i It differs in that it also uses

[0033] ------------------------------------------------------------------ 1: function VERIFYAGG(σ Agg , messages, pubkeys, tab) 2: for ms i corresponding to pk i from tab do 3: h i ←H(ms i , pk i ) 4: if Πe(h i , pk i ) = e(σ Agg , g2) then 5: Return: Success 6: else 7: Return: Failure ------------------------------------------------------------------ On the other hand, in the case of (B), the communication device that verifies the aggregate signature executes the following function DAG VERIF. The function DAG VERIF corresponds to DAG verification for a directed acyclic graph in which the vertices are blocks included in the local chain recorded in the recording unit of the communication device included in the existence proof system, and the edges are links between blocks included in the local chain recorded in the recording unit of the communication device included in the existence proof system and links between blocks included in the local chain recorded in the recording unit of the communication device that requested the generation of the aggregate signature and blocks included in the local chain recorded in the recording unit of the communication device that participated in the request to generate the aggregate signature. Generally, there are breadth-first search and depth-first search for graph searches that target directed acyclic graphs, and the function DAG VERIF executes processing based on depth-first search.

[0034] (Reference Non-Patent Document 5: Breadth First Search or BFS for a Graph, [online], [searched June 20, 2023], Internet <URL: https: / / www.geeksforgeeks.org / breadth-first-search-or-bfs-for-a-graph / ) (Reference Non-Patent Document 6: Depth First Search or DFS for a Graph, [online], [Retrieved June 20, 2020], Internet<URL: https: / / www.geeksforgeeks.org / depth-first-search-or-dfs-for-a-graph / > ) ------------------------------------------------------------------ 1: function DAG VERIF(target signature: sig t , upper :n, verifier public key: pk v ) 2: queue[0, … , n]=φ 3: queue[0]←joint signers of sig t 4: while index←{0, … , n} do 5: for t node ←queue[index] do 6: sigs←(n-index) sub-chain of t node 7: for sig←sigs[index, … , n] do 8: jss←joint signers of sig 9: if pk v ∈jss then 10: if verify(CosignerChain) then 11: Return: True 12: for pk j ←jss do 13: if not(pk j ∈queue) then 14: queue[index+1]←add(pk j ) 15: Return: False ------------------------------------------------------------------ First Embodiment Hereinafter, the existence proof system 10 will be described with reference to FIG. 2 to FIG. 5. FIG. 2 is a block diagram showing the configuration of the existence proof system 10. FIG. 3 is a block diagram showing the configuration of the communication device 100. FIG. 4 is a flowchart showing the operation of the communication device 100 when generating a signature. FIG. 5 is a flowchart showing the operation of the communication device 100 when verifying a signature. As shown in FIG. 2, the existence proof system 10 includes a plurality of communication devices 100, and each communication device 100 is connected to a network 900. The network 900 may be, for example, the Internet, and the communication devices 100 can communicate with each other. As shown in FIG. 3, the communication device 100 includes a first generation unit 110, a second generation unit 120, a third generation unit 130, a judgment unit 140, a first verification unit 150, a second verification unit 160, and a recording unit 190. The recording unit 190 is a component that appropriately records information required for processing by the communication device 100. The recording unit 190 records, for example, a local chain.

[0035] The operation of the communication device 100 when generating a signature will be described with reference to FIG. 4. Consider a case where N+1 (where N is an integer equal to or greater than 1) communication devices 100 included in the existence proof system 10, which is composed of multiple communication devices 100 that record local chains, cooperate to generate an aggregate signature. Here, let U0 be the communication device 100 that requests the generation of an aggregate signature among the N+1 communication devices 100, U1, ..., U N Let be a communication device 100 that participates in the aggregate signature generation request from communication device U0 among the N+1 communication devices 100.

[0036] In S110, the first generation unit 110 of the communication device U0 generates the latest block B L The hash value of h L , and sends the pair (m0, pk0) of the message m0 and the public key pk0 of the communication device U0 to the communication devices U1, …, U NThe process of the first generation unit 110 of the communication device U0 is as follows: local ←h L This corresponds to the processing from the second to third lines of the SIGNING function when

[0037] In S120, the second generation unit 120 of the communication device U0 n A message m from the first generator 110 (n=1, ..., N) n and communication device U n Public key pk n A set of (m n , pk n ), and receives message hs0=m0||m1||…||m N and public key pks0=pk0||pk1||…||pk N Generate the signature σ0 = H(hs0||pk0) sk_0 (where H is a hash function, and sk0 is the private key of the communication device U0), and sends the pair (σ0, hs0, pks0) of the signature σ0, message hs0, and public key pks0 to the communication devices U1, …, U N The process of the second generation unit 120 of the communication device U0 is as follows: local ←h L This corresponds to the processing from line 4 to line 10 of the SIGNING function when

[0038] In S130, the third generation unit 130 of the communication device U0 n A signature σ from the second generator 120 (n=1, ..., N) n and message hs n and the public key pks n The set of (σ n , hs n , pks n ) and obtains signatures σ0, σ1, …, σ N From the aggregate signature σ Agg and generate a sequence of messages hs0, hs1, …, hs N and a sequence of public keys pks0, pks1, …, pks N Messages m0, m1, …, m NA sequence of messages containing pk0, pk1, …, pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N), and generate an aggregate signature σ Agg Block B contains a message column, pubkeys, and a table, tab. L Next block B L+1 The third generation unit 130 of the communication device U0 adds the process in the second line to the local chain LC0 as m local ←h L This corresponds to the processing from line 11 to line 13 of the SIGNING function when

[0039] The above-described operation of communication device 100 at the time of signature generation can be rephrased as follows: Here, a component including first generation unit 110 and second generation unit 120 is referred to as a signature generation unit (not shown).

[0040] In S110 and S120, the signature generation unit of the communication device U0 generates the signatures of messages m0, m1, ..., m N A signature σ0 is generated from a message hs0 generated based on the hash value of the latest block among the blocks that make up the local chain, and m n (n=1, …, N) is a communication device U n This is the message generated by

[0041] In S130, the third generation unit 130 of the communication device U0 generates signatures σ0, σ1, ..., σ N From the aggregate signature σ Agg and generate an aggregate signature σ Agg , messages m0, m1, …, m N A sequence of messages containing public keys pk0, pk1, …, pk NA sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N) is added to the local chain as the next block after the latest block. Here, σ n (n=1, …, N) is a communication device U n are messages m0, m1, …, m N Message generated based on hs n and the public key pk n The signature is generated from

[0042] Next, the operation of the communication device 100 during signature verification will be described with reference to Fig. 5. Consider a case where a communication device 100 included in an existence proof system 10 consisting of multiple communication devices 100 that record local chains verifies an aggregate signature. Here, V0 is the communication device 100 verifying the aggregate signature, U0 is the aggregate signature σ Agg Block B containing L+1 The communication device 100, U1, ..., U2, which is different from the communication device V0, which has recorded the local chain LC0 including the N The aggregate signature σ from the communication device U0 Agg The communication device 100 that participated in the request to generate block B L+1 is the aggregate signature σ Agg At the same time, the communication device U0 generates a message m0 (where m0 is a block B L+1 From the perspective of the latest block B L The hash value of h L , messages m1, ..., m2, generated by communication device U1, ..., m3, generated by communication device U N Message m generated by N A sequence of messages including the public key pk0 of communication device U0, the public key pk1 of communication device U1, ..., N pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (mn , pk n ) (n=0, 1, …, N).

[0043] In S140, the determination unit 140 of the communication device V0 calculates the aggregate signature σ Agg Communication devices U0, U1, …, U N In other words, the predetermined condition in FIG. 5 is satisfied when the aggregate signature σ Agg Communication devices U0, U1, …, U N This is the condition that a trusted communication device is included in the

[0044] Satisfying a given condition, i.e., aggregate signature σ Agg Communication devices U0, U1, …, U N If a trusted communication device is included in the table tab, in S150, the first verification unit 150 of the communication device V0 verifies the message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N) to obtain a hash value h n =H(m n ||pk n ) (where H is a hash function) and generate hash values ​​h0, h1,…, h N and public keys pk0, pk1,…, pk N Using the aggregate signature σ Agg The process of the first verification unit 150 of the communication device V0 corresponds to the process of the function VERIFYAGG.

[0045] On the other hand, if the predetermined condition is not satisfied, i.e., the aggregate signature σ Agg Communication devices U0, U1, …, U NIf no trustworthy communication device is included in the communication device V0, in S160, the second verification unit 160 of the communication device V0 verifies the aggregate signature σ by DAG verification of a directed acyclic graph in which the vertices are the blocks included in the local chain recorded in the recording unit 190 of the communication device 100 included in the existence proof system 10, and the edges are the links between the blocks included in the local chain recorded in the recording unit 190 of the communication device 100 that requested the generation of the aggregate signature and the blocks included in the local chain recorded in the recording unit 190 of the communication device 100 that participated in the request to generate the aggregate signature. Agg The process of the second verification unit 160 of the communication device V0 corresponds to the process of the function DAG VERIF.

[0046] According to an embodiment of the present invention, by using an aggregate signature as a signature that can be used for existence proof in a distributed data distribution platform, it is possible to reduce the data size required for a signature.

[0047] <Second embodiment> In the second embodiment, a form in which blocks included in a local chain can be hidden during signature verification will be described.

[0048] Hereinafter, the existence proof system 10 will be described with reference to FIG. 2 to FIG. 5. FIG. 2 is a block diagram showing the configuration of the existence proof system 10. FIG. 3 is a block diagram showing the configuration of the communication device 100. FIG. 4 is a flowchart showing the operation of the communication device 100 when generating a signature. FIG. 5 is a flowchart showing the operation of the communication device 100 when verifying a signature. As shown in FIG. 2, the existence proof system 10 includes a plurality of communication devices 100, and each communication device 100 is connected to a network 900. The network 900 may be, for example, the Internet, and the communication devices 100 can communicate with each other. As shown in FIG. 3, the communication device 100 includes a first generation unit 110, a second generation unit 120, a third generation unit 130, a judgment unit 140, a first verification unit 150, a second verification unit 160, and a recording unit 190. The recording unit 190 is a component that appropriately records information required for processing by the communication device 100. The recording unit 190 records, for example, a local chain.

[0049] The operation of the communication device 100 when generating a signature will be described with reference to FIG. 4. Consider a case where N+1 (where N is an integer equal to or greater than 1) communication devices 100 included in the existence proof system 10, which is composed of multiple communication devices 100 that record local chains, cooperate to generate an aggregate signature. Here, let U0 be the communication device 100 that requests the generation of an aggregate signature among the N+1 communication devices 100, U1, ..., U N Let be a communication device 100 that participates in the aggregate signature generation request from communication device U0 among the N+1 communication devices 100.

[0050] In S110, the first generation unit 110 of the communication device U0 generates the latest K blocks B (where K is an integer equal to or greater than 2) from among the blocks constituting the local chain LC0 recorded in the recording unit 190. L , B L-1 , …, B L-(K-1) The hash value of h L , h L-1 , …, h L-(K-1) and random numbers r1, …, r K-1 Message m0 = H(h L +h L-1 +…+h L-(K-1) +r1+…+rK-1 ) (where H is a hash function), and sends the pair (m0, pk0) of the message m0 and the public key pk0 of the communication device U0 to the communication devices U1, …, U N The process of the first generation unit 110 of the communication device U0 is as follows: local ←H(h L +h L-1 +…+h L-(K-1) +r1+…+r K-1 This corresponds to the processing from the second to third lines of the SIGNING function when

[0051] In S120, the second generation unit 120 of the communication device U0 n A message m from the first generator 110 (n=1, ..., N) n and communication device U n Public key pk n A set of (m n , pk n ), and receives message hs0=m0||m1||…||m N and public key pks0=pk0||pk1||…||pk N Generate the signature σ0 = H(hs0||pk0) sk_0 (where H is a hash function, and sk0 is the private key of the communication device U0), and sends the pair (σ0, hs0, pks0) of the signature σ0, message hs0, and public key pks0 to the communication devices U1, …, U N The process of the second generation unit 120 of the communication device U0 is as follows: local ←H(h L +h L-1 +…+h L-(K-1) +r1+…+r K-1 This corresponds to the processing from line 4 to line 10 of the SIGNING function when

[0052] In S130, the third generation unit 130 of the communication device U0 n A signature σ from the second generator 120 (n=1, ..., N) n and message hs n and the public key pks n The set of (σ n , hsn , pks n ) and obtains signatures σ0, σ1, …, σ N From the aggregate signature σ Agg and generate a sequence of messages hs0, hs1, …, hs N and a sequence of public keys pks0, pks1, …, pks N Messages m0, m1, …, m N A sequence of messages containing pk0, pk1, …, pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N), and generate an aggregate signature σ Agg , a sequence of messages, a sequence of public keys, a table, and random numbers, r1, …, r K-1 Block B contains L Next block B L+1 The third generation unit 130 of the communication device U0 adds the process in the second line to the local chain LC0 as m local ←H(h L +h L-1 +…+h L-(K-1) +r1+…+r K-1 This corresponds to the processing from line 11 to line 13 of the SIGNING function when

[0053] The above-described operation of communication device 100 at the time of signature generation can be rephrased as follows: Here, a component including first generation unit 110 and second generation unit 120 is referred to as a signature generation unit (not shown).

[0054] In S110 and S120, the signature generation unit of the communication device U0 generates the signatures of messages m0, m1, ..., m NHere, m0 is a message generated by the communication device U0 based on the hash values ​​of the latest K blocks (where K is an integer equal to or greater than 2) among the blocks that make up the local chain and K-1 random numbers, and m n (n=1, …, N) is a communication device U n This is the message generated by

[0055] In S130, the third generation unit 130 of the communication device U0 generates signatures σ0, σ1, ..., σ N From the aggregate signature σ Agg and generate an aggregate signature σ Agg , messages m0, m1, …, m N A sequence of messages containing public keys pk0, pk1, …, pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N), and add a block containing K-1 random numbers to the local chain as the next block after the most recent block. Here, σ n (n=1, …, N) is a communication device U n are messages m0, m1, …, m N Message generated based on hs n and the public key pk n The signature is generated from

[0056] Next, the operation of the communication device 100 during signature verification will be described with reference to Fig. 5. Consider a case where a communication device 100 included in an existence proof system 10 consisting of multiple communication devices 100 that record local chains verifies an aggregate signature. Here, V0 is the communication device 100 verifying the aggregate signature, U0 is the aggregate signature σ Agg Block B containing L+1 The communication device 100, U1, ..., U2, which is different from the communication device V0, which has recorded the local chain LC0 including the N The aggregate signature σ from the communication device U0Agg The communication device 100 that participated in the request to generate block B L+1 is the aggregate signature σ Agg At the same time, the communication device U0 generates a message m0=H(h L +h L-1 +…+h L-(K-1) +r1+…+r K-1 ) (where K is an integer greater than or equal to 2, H is a hash function, and h L , h L-1 , …, h L-(K-1) is block B among the blocks that make up local chain LC0. L+1 The most recent K blocks B L , B L-1 , …, B L-(K-1) hash values ​​of r1, …, r K-1 is a random number), message m1, ..., generated by communication device U1, N Message m generated by N A sequence of messages including the public key pk0 of communication device U0, the public key pk1 of communication device U1, ..., N pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N) containing table tab, random numbers r1, …, r K-1 This includes:

[0057] In S140, the determination unit 140 of the communication device V0 calculates the aggregate signature σ Agg Communication devices U0, U1, …, U N In other words, the predetermined condition in FIG. 5 is satisfied when the aggregate signature σ Agg Communication devices U0, U1, …, U N This is the condition that a trusted communication device is included in the

[0058] Satisfying a given condition, i.e., aggregate signature σ AggCommunication devices U0, U1, …, U N If a trusted communication device is included in the table tab, in S150, the first verification unit 150 of the communication device V0 verifies the message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N) to obtain a hash value h n =H(m n ||pk n ) (where H is a hash function) and generate hash values ​​h0, h1,…, h N and public keys pk0, pk1,…, pk N Using the aggregate signature σ Agg The process of the first verification unit 150 of the communication device V0 corresponds to the process of the function VERIFYAGG.

[0059] On the other hand, if the predetermined condition is not satisfied, i.e., the aggregate signature σ Agg Communication devices U0, U1, …, U N If no trustworthy communication device is included in the communication device V0, in S160, the second verification unit 160 of the communication device V0 verifies the aggregate signature σ by DAG verification of a directed acyclic graph in which the vertices are the blocks included in the local chain recorded in the recording unit 190 of the communication device 100 included in the existence proof system 10, and the edges are the links between the blocks included in the local chain recorded in the recording unit 190 of the communication device 100 that requested the generation of the aggregate signature and the blocks included in the local chain recorded in the recording unit 190 of the communication device 100 that participated in the request to generate the aggregate signature. Agg The process of the second verification unit 160 of the communication device V0 corresponds to the process of the function DAG VERIF.

[0060] A communication device U0 has K blocks B L , B L-1 , …, B L-(K-1)Of these, if K' blocks B L-i(1) , B L-i(2) , …, B L-i(K’) (where i(1), i(2), …, i(K') are integers satisfying 0 ≦ i(1) < i(2) < … < i(K') ≦ K - 1) are to be hidden, the communication device V0 generates K - K' hash values h L-j(1) , h L-j(2) , …, h L-j(K-K’) (where j(1), j(2), …, j(K - K') are integers satisfying 0 ≦ j(1) < j(2) < … < j(K - K') ≦ K - 1, and the union of the sets {j(1), j(2), …, j(K - K')} and {i(1), i(2), …, i(K')} is the set {0, 1, …, K - 1}) and values h L-i(1) +r1, h L-i(2) +r2, …, h L-i(K’) +r K’ and random numbers r K’+1 , …, r K-1 are received from the communication device U0, and the aggregated signature σ Agg is verified.

[0061] According to an embodiment of the present invention, by using an aggregated signature as the signature that can be used for proof of existence in a distributed data distribution infrastructure, it is possible to reduce the data size required for the signature. Also, when a block that is not to be made public is included in the local chain, it is possible to hide the block during signature verification. <Supplementary Note> The processing of each part of each device described above may be realized by a computer. In this case, the processing content of the functions that each device should have is described by a program. Then, this program is read into the recording unit 2020 of the computer 2000 shown in FIG. 6, and by operating the arithmetic processing unit 2010, the input unit 2030, the output unit 2040, the auxiliary recording unit 2025, etc., the processing functions in each of the above devices are realized on the computer.

[0062] The device of the present invention, for example, as a single hardware entity, has an input unit capable of inputting a signal from outside the hardware entity, an output unit capable of outputting a signal to the outside of the hardware entity, a communication unit to which a communication device (e.g., a communication cable) capable of communicating with the outside of the hardware entity can be connected, a CPU (Central Processing Unit, which may have a cache memory or a register, etc.) which is an arithmetic processing unit, RAM and ROM which are memories, an external storage device which is a hard disk, and a bus which connects the input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so that data can be exchanged between them. If necessary, the hardware entity may be provided with a device (drive) capable of reading and writing a recording medium such as a CD-ROM. A physical entity equipped with such hardware resources is, for example, a general-purpose computer.

[0063] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required in the processing of these programs (not limited to the external storage device, but for example the programs may be stored in a ROM, which is a read-only storage device). Data obtained by the processing of these programs is stored appropriately in the RAM, the external storage device, etc.

[0064] In the hardware entity, each program stored in an external storage device (or ROM, etc.) and data required for processing each program are loaded into memory as necessary, and interpreted, executed, and processed by the CPU as appropriate. As a result, the CPU realizes a predetermined function (each component represented as the above, "unit," "means," etc.). In other words, each component of the embodiment of the present invention may be configured by a processing circuit.

[0065] As described above, when the processing functions of the hardware entities (the devices of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program. Then, by executing this program on a computer, the processing functions of the hardware entities are realized on the computer.

[0066] The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a non-transitory recording medium, specifically, a magnetic recording device, an optical disk, or the like.

[0067] The program may be distributed, for example, by selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of a server computer and transferring the program from the server computer to other computers via a network.

[0068] A computer that executes such a program, for example, first stores a program recorded on a portable recording medium or a program transferred from a server computer in the auxiliary recording unit 2025, which is a non-transient storage device of the computer. Then, when executing a process, the computer reads the program stored in the auxiliary recording unit 2025, which is a non-transient storage device of the computer, into the recording unit 2020, and executes a process according to the read program. As another execution form of the program, the computer may read the program directly from the portable recording medium into the recording unit 2020 and execute a process according to the program, or may execute a process according to the received program each time a program is transferred from the server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may execute the above-mentioned process by a so-called ASP (Application Service Provider) type service that realizes a processing function only by issuing an execution instruction and obtaining a result. Note that the program in this embodiment includes information used for processing by an electronic computer and equivalent to a program (data that is not a direct instruction to a computer but has a nature that specifies the processing of a computer, etc.).

[0069] In addition, in this embodiment, the present device is configured by executing a specific program on a computer, but at least a part of the processing contents may be realized by hardware.

[0070] The present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the spirit of the present invention.

Claims

1. A signature generation method in which N+1 (where N is an integer equal to or greater than 1) communication devices included in a proof-of-existence system composed of a plurality of communication devices that record local chains jointly generate an aggregate signature, comprising: U 0 The communication device that requests the generation of an aggregate signature among the N+1 communication devices is U 1 , …, U N Among the N+1 communication devices, communication device U 0 a communication device participating in an aggregate signature generation request from Communication device U 0 However, the local chain LC recorded in the recording section 0 Among the blocks that make up L , B L-1 , …, B L-(K-1) The hash value of h L , h L-1 , …, h L-(K-1) and the random number r 1 , …, r K-1 Message from m 0 =H(h L +h L-1 +…+h L-(K-1) +r 1 +…+r K-1 ) (where H is a hash function) and sends a message m 0 and communication device U 0 Public key pk 0 A set of (m 0 , pk 0 ) to the communication device U 1 , …, U N a first generation step of broadcasting Communication device U 0 However, communication device U n (n=1, …, N) to message m n and communication device U n Public key pk n A set of (m n , pk n ) and receive the message hs 0 =m 0 ||m 1 ||…||m N and the public key pks 0 =pk 0 ||pk 1 ||…||pk N Generate a signature σ 0 =H(hs 0 ||pk 0 ) sk_0 (where H is a hash function, sk 0 is communication device U 0 ) and generate a signature σ 0 and message hs 0 and the public key pks 0 The set of (σ 0 , hs 0 , pks 0 ) to the communication device U 1 , …, U N a second generation step of broadcasting the Communication device U 0 However, communication device U n (n=1, …, N) to a signature σ n and message hs n and the public key pks n The set of (σ n , hs n , pks n ) and receives the signature σ 0 , σ 1 , …, σ N From the aggregate signature σ Agg and generate a message column hs 0 , hs 1 , …, hs N and the public key sequence pks 0 , pks 1 , …, pks N Message from m 0 , m 1 , …, m N A sequence of messages containing messages and a public key pk 0 , pk 1 , …, pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N), and generate an aggregate signature σ Agg , a sequence of messages, a sequence of public keys, a table, and a random number. 1 , …, r K-1 Block B contains L Next block B L+1 As a local chain LC 0 A third generation step adding A signature generation method comprising:

2. A signature generation method in which N+1 (where N is an integer equal to or greater than 1) communication devices included in a proof-of-existence system composed of a plurality of communication devices that record local chains jointly generate an aggregate signature, comprising: U 0 The communication device that requests the generation of an aggregate signature among the N+1 communication devices is U 1 , …, U N Among the N+1 communication devices, communication device U 0 a communication device participating in an aggregate signature generation request from m 0 Communication device U 0 A message m is generated based on the hash values ​​of the latest K blocks (where K is an integer greater than or equal to 2) of the blocks that make up the local chain and K-1 random numbers. n (n=1, …, N) is a communication device U n Message generated by pk 0 Communication device U 0 Let the public key of Communication device U 0 But message m 0 , m 1 , …, m N Message generated based on hs 0 and the public key pk 0 From this, the signature σ 0 a signature generation step for generating pk n (n=1, …, N) is a communication device U n ’s public key, σ n (n=1, …, N) is a communication device U n is the message m 0 , m 1 , …, m N Message generated based on hs n and the public key pk n The signature generated from Communication device U 0 But the signature σ 0 , σ 1 , …, σ N From the aggregate signature σ Agg and generate an aggregate signature σ Agg , message m 0 , m 1 , …, m N A sequence of messages containing messages and a public key pk 0 , pk 1 , …, pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N), and a third generation step of adding a block including the K−1 random numbers to the local chain as the next block after the latest block. A signature generation method comprising:

3. A signature verification method in which a communication device included in a presence proof system configured with a plurality of communication devices that record local chains verifies an aggregate signature, comprising: V 0 A communication device that verifies the aggregate signature, U 0 The aggregate signature to be verified is σ Agg Block B containing L+1 Local chain LC including 0 A communication device V that records the 0 A communication device different from U 1 , …, U N Communication device U 0 The aggregate signature from Agg The communication device that participated in the request to generate Block B L+1 is the aggregate signature σ Agg Together with the communication device U 0 Message m generated by 0 =H(h L +h L-1 +…+h L-(K-1) +r 1 +…+r K-1 ) (where K is an integer greater than or equal to 2, H is a hash function, and h L , h L-1 , …, h L-(K-1) is the local chain LC 0 Among the blocks that make up L+1 The most recent K blocks B L , B L-1 , …, B L-(K-1) The hash value of r 1 , …, r K-1 is a random number), communication device U 1 Message m generated by 1 ,..., communication device U N Message m generated by N A sequence of messages containing messages and a communication device U 0 Public key pk 0 , communication device U 1 Public key pk 1 ,..., communication device U N pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N) containing a table tab, a random number r 1 , …, r K-1 This includes: Communication device V 0 is the aggregate signature σ Agg Communication equipment U involved in the generation of 0 , U 1 , …, U N determining whether a trusted communication device is included in the Aggregate signature σ Agg Communication equipment U involved in the generation of 0 , U 1 , …, U N If a trusted communication device is included in 0 is the message m in table tab. n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N) to obtain a hash value h n =H(m n ||pk n ) (where H is a hash function) and generate a hash value h 0 , h 1 ,…, h N and the public key pk 0 , pk 1 ,…, pk N Using the aggregate signature σ Agg a first verification step of verifying Aggregate signature σ Agg Communication equipment U involved in the generation of 0 , U 1 , …, U N If there is no trusted communication device in 0 is generated by DAG verification of a directed acyclic graph in which the vertices are the blocks included in the local chain recorded in the recording unit of a communication device included in the existence proof system, and the edges are the links between the blocks included in the local chain recorded in the recording unit of a communication device included in the existence proof system and the links between the blocks included in the local chain recorded in the recording unit of a communication device that requested the generation of an aggregate signature and the blocks included in the local chain recorded in the recording unit of a communication device that participated in the request to generate the aggregate signature. Agg a second verification step for verifying A signature verification method comprising:

4. 4. The signature verification method according to claim 3, The second verification step includes: Communication device U 0 has K blocks B L , B L-1 , …, B L-(K-1) and wants to hide K' (where K' is an integer between 1 and K - 1) of these blocks B L-i(1) , B L-i(2) , …, B L-i(K’) (where i(1), i(2), …, i(K') are integers satisfying 0 ≦ i(1) < i(2) < … < i(K') ≦ K - 1), then Communication device V 0 has K - K' hash values h L-j(1) , h L-j(2) , …, h L-j(K-K’) (where j(1), j(2), …, j(K - K') are integers satisfying 0 ≦ j(1) < j(2) < … < j(K - K') ≦ K - 1, and the union of the sets {j(1), j(2), …, j(K - K')} and {i(1), i(2), …, i(K')} is the set {0, 1, …, K - 1}) and the value h L-i(1) +r 1 , h L-i(2) +r 2 , …, h L-i(K’) +r K’ and the random number r K’+1 , …, r K-1 are received from communication device U 0 and verify the aggregated signature σ Agg ​ 2. A signature verification method comprising:

5. A system for proving existence that is composed of multiple communication devices that record local chains, among which N+1 communication devices (where N is an integer equal to or greater than 1) jointly generate an aggregate signature, U 0 The communication device that requests the generation of an aggregate signature among the N+1 communication devices is U 1 , …, U N Among the N+1 communication devices, communication device U 0 a communication device participating in an aggregate signature generation request from Communication device U 0 teeth, Local chain LC recorded in the recording section 0 Among the blocks that make up L , B L-1 , …, B L-(K-1) The hash value of h L , h L-1 , …, h L-(K-1) and the random number r 1 , …, r K-1 Message from m 0 =H(h L +h L-1 +…+h L-(K-1) +r 1 +…+r K-1 ) (where H is a hash function) and sends a message m 0 and communication device U 0 Public key pk 0 A set of (m 0 , pk 0 ) to the communication device U 1 , …, U N a first generating unit for broadcasting to Communication device U n (n=1, …, N) to message m n and communication device U n Public key pk n A set of (m n , pk n ) and receive the message hs 0 =m 0 ||m 1 ||…||m N and the public key pks 0 =pk 0 ||pk 1 ||…||pk N Generate a signature σ 0 =H(hs 0 ||pk 0 ) sk_0 (where H is a hash function, sk 0 is communication device U 0 ) and generate a signature σ 0 and message hs 0 and the public key pks 0 The set of (σ 0 , hs 0 , pks 0 ) to the communication device U 1 , …, U N a second generation unit for broadcasting the Communication device U n (n=1, …, N) to a signature σ n and message hs n and the public key pks n The set of (σ n , hs n , pks n ) and receives the signature σ 0 , σ 1 , …, σ N From the aggregate signature σ Agg and generate a message column hs 0 , hs 1 , …, hs N and the public key sequence pks 0 , pks 1 , …, pks N Message from m 0 , m 1 , …, m N A sequence of messages containing messages and a public key pk 0 , pk 1 , …, pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N), and generate an aggregate signature σ Agg , a sequence of messages, a sequence of public keys, a table, and a random number. 1 , …, r K-1 Block B contains L Next block B L+1 As a local chain LC 0 A third generation unit added to A proof of existence system including:

6. A system for proving an existence of a plurality of communication devices that record local chains, in which N+1 communication devices (where N is an integer equal to or greater than 1) among the plurality of communication devices jointly generate an aggregate signature, comprising: U 0 The communication device that requests the generation of an aggregate signature among the N+1 communication devices is U 1 , …, U N Among the N+1 communication devices, communication device U 0 a communication device participating in an aggregate signature generation request from Local Chain LC 0 A recording unit for recording the The local chain LC recorded in the recording unit 0 Among the blocks that make up L , B L-1 , …, B L-(K-1) The hash value of h L , h L-1 , …, h L-(K-1) and the random number r 1 , …, r K-1 Message from m 0 =H(h L +h L-1 +…+h L-(K-1) +r 1 +…+r K-1 ) (where H is a hash function) and sends a message m 0 and communication device U 0 Public key pk 0 A set of (m 0 , pk 0 ) to the communication device U 1 , …, U N a first generating unit for broadcasting to Communication device U n (n=1, …, N) to message m n and communication device U n Public key pk n A set of (m n , pk n ) and receive the message hs 0 =m 0 ||m 1 ||…||m N and the public key pks 0 =pk 0 ||pk 1 ||…||pk N Generate a signature σ 0 =H(hs 0 ||pk 0 ) sk_0 (where H is a hash function, sk 0 is communication device U 0 ) and generate a signature σ 0 and message hs 0 and the public key pks 0 The set of (σ 0 , hs 0 , pks 0 ) to the communication device U 1 , …, U N a second generation unit for broadcasting the Communication device U n (n=1, …, N) to a signature σ n and message hs n and the public key pks n The set of (σ n , hs n , pks n ) and receives the signature σ 0 , σ 1 , …, σ N From the aggregate signature σ Agg and generate a message column hs 0 , hs 1 , …, hs N and the public key sequence pks 0 , pks 1 , …, pks N Message from m 0 , m 1 , …, m N A sequence of messages containing messages and a public key pk 0 , pk 1 , …, pk N A sequence of public keys pubkeys containing a message m n and the public key pk n A set of (m n , pk n ) (n=0, 1, …, N), and generate an aggregate signature σ Agg , a sequence of messages, a sequence of public keys, a table, and a random number. 1 , …, r K-1 Block B contains L Next block B L+1 As a local chain LC 0 A third generation unit added to A communication device comprising:

7. A program for causing a computer to function as the communication device according to claim 6.

Images