Communication certification device, communication terminal, verification device, information processing method, and program

Abstract

To provide a technique of achieving factual proof of a message in a communication service in which a large number of users send or receive messages.SOLUTION: A communication proof device to be used to prove the fact of a message transmitted or received in a communication system to which a plurality of communication terminals to be used by users are connected includes a tree creation unit that groups a plurality of proof digests generated from proof target data containing the message, creates a hash tree based on the plurality of proof digests belonging to the same group of the same user, and attaches a signature to a top digest of the hash tree, and an extraction unit that extracts and outputs at least the signature in response to a request from a specific user.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to authentication of facts for messages sent or received in a communication service. [Background technology]

[0002] In the Internet society, technologies such as electronic signatures and time stamps are used as "evidence" to guarantee "when," "what," and "who," and as effective means of verifying the authenticity of electronic documents.

[0003] For example, as disclosed in non-patent document 1, electronic notarization has been institutionalized, in which a trusted third party, a "notary public," can perform "authentication" to prove the creator of an electronic document, and "assign a fixed date (date information)" to prove that the document data existed at a certain point in time. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] "9-5 Electronic Notarization," Japan Notary Association, https: / / www.koshonin.gr.jp / notary / ow09_5 [Non-Patent Document 2] Craig Gentry et al., "(5) Cryptography and Security Technology," NTT DoCoMo Technical Journal Vol. 11 No. 4, Jan. 2004. https: / / www.docomo.ne.jp / binary / pdf / corporate / technology / rd / technical_journal / bn / vol11_4 / vol11_4_030jp.pdf Summary of the Invention [Problem to be solved by the invention]

[0005] In communication services in which a large number of users send and receive messages, it is desirable to have "proof of fact" that proves who sent or received what, and when, for each message, which is the unit of transmission or reception by users.

[0006] However, in the prior art, in a communication service in which a large number of users send or receive messages, authentication of facts regarding messages has not been realized.

[0007] The present invention has been made in consideration of the above points, and has an object to provide a technique for realizing fact verification for a message in a communication service in which a large number of users send or receive messages. [Means for solving the problem]

[0008] According to the disclosed technology, there is provided a communication certification device used to certify facts of messages sent or received in a communication system to which a plurality of communication terminals used by users are connected, the communication certification device comprising: a tree creation unit that groups a plurality of certification digests generated from certification target data having the message, creates a hash tree based on a plurality of certification digests belonging to the same group of the same user, and attaches a signature to the top digest of the hash tree; an extracting unit that extracts and outputs at least the signature in response to a request from a specific user; A communication authentication device is provided. Effect of the Invention

[0009] According to the disclosed technology, a technology is provided for realizing fact verification for a message in a communication service in which a large number of users send or receive messages. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram for explaining a hash tree signature. [Diagram 2]1 is a diagram showing an example of the configuration of a fact-certifying system according to an embodiment of the present invention; [Diagram 3] FIG. 13 is a diagram showing an image in which a certification digest is generated from certification subject data. [Figure 4] FIG. 2 is a diagram showing an example of a user tree and a round tree. [Diagram 5] FIG. 5 is a diagram showing an example of a round branch corresponding to the example of FIG. 4. [Figure 6] FIG. 13 is a diagram illustrating an example of a round chain. [Figure 7] FIG. 13 is a diagram for explaining an example of creating a user branch in Example 1. [Figure 8] FIG. 13 is a diagram for explaining an example of creating a user branch in Example 1. [Figure 9] FIG. 13 is a diagram for explaining an example of creating a user branch in Example 2. [Figure 10] FIG. 13 is a diagram for explaining an example of creating a user branch in Example 2. [Figure 11] FIG. 13 is a diagram for explaining an example of creating a user branch in Example 3. [Figure 12] FIG. 13 is a diagram for explaining an example of creating a user branch in Example 3. [Figure 13] FIG. 13 illustrates an example of a message branch. [Figure 14] 1 is a diagram illustrating an example of the configuration of a communication proving device 100. [Figure 15] 1 is a diagram illustrating an example of the configuration of a communication proving device 100. [Figure 16] 13 is a flowchart showing a round tree creation procedure. [Figure 17] 13 is a flowchart showing a round branch output procedure. [Figure 18] FIG. 13 is a diagram illustrating an example of a user tree when a round tree is not created. [Figure 19] FIG. 13 is a diagram illustrating an example of a message branch when a round tree is not created. [Figure 20] FIG. 2 is a diagram illustrating an example of the configuration of a communication terminal 200. [Figure 21] FIG. 2 is a diagram illustrating an example of the configuration of a communication terminal 200. [Figure 22] 13 is a flowchart showing a procedure for storing a proof digest. [Diagram 23] 13 is a flowchart showing a procedure for outputting fact proof data. [Figure 24] FIG. 3 illustrates an example of the configuration of a verification device 300. [Diagram 25] FIG. 3 illustrates an example of the configuration of a verification device 300. [Figure 26] 13 is a flowchart showing a processing procedure of the verification device 300. [Figure 27] FIG. 1 is a diagram illustrating a configuration example when applied to edge computing. [Figure 28] FIG. 13 is a diagram showing an example of calculation locations performed in a plurality of network edge units 150. [Figure 29] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0012] In the following, first, problems associated with the conventional technology and the technology according to the present embodiment will be described in detail, and then the configuration and operation according to the present embodiment will be described in detail.

[0013] (Regarding the Prior Art) As mentioned above, electronic notarization has been institutionalized, where a trusted third party, a "notary public," can perform "authentication" to prove the creator of an electronic document and "assignment of a fixed date (date information)" to prove that the document data existed at a certain point in time. The following conventional techniques a to c exist as conventional techniques related to electronic notarization.

[0014] <Conventional Technology A: Time Stamp> In prior art A, first, the user sends the electronic document or its digest (hash calculation result) to the notary. The notary then assigns a timestamp, which is an electronic signature with added time information, to the user's electronic document or digest, and sends it to the user. By presenting the electronic document and the timestamp to a third party, the user can prove that the electronic document has existed since its existence and that it has not been altered since then.

[0015] <Prior art B: Storage of electronic documents> In prior art B, a user sends an electronic document or a digest of the electronic document to a notary, and the notary stores the digest of the electronic document.

[0016] If necessary, the user can request and obtain a certificate from a notary public stating how long the electronic document has existed and that it has not been altered since then. By presenting the electronic document and the certificate to a third party, the user can prove that the electronic document has existed and that it has not been altered since then.

[0017] <Prior Art C: Hash Tree Signature> Prior art c is a technique in which data to be certified (such as a digital document) is aggregated using a hash tree and the top digest of the tree is signed; for example, this technique is disclosed in Non-Patent Document 2.

[0018] In conventional technology C, a large amount of data can be certified with a small number of signatures, and the entire tree of data is not required for signature verification. Signature verification can be performed if there is branch data from the data to be certified to the top digest. The hash tree signature of the prior art c will be described in more detail with reference to Fig. 1. As shown in Fig. 1, the hash tree signature constructs a hash tree (Merkle tree) for a large amount of data Dx and attaches a signature.

[0019] Specifically, first, a digest H0x of each data Dx is generated by hash calculation. These are the leaves of the hash tree. Next, a digest is generated by hash calculation using the two digests as input. By repeating this process, a top digest is generated, and a signature is applied to the top digest at the top. In the example in Figure 1, H31 is the top digest.

[0020] By using the above hash data set (called branch data) from each data Dx to the top digest, it is possible to verify that the signature attached to the top digest certifies each data Dx.

[0021] (Regarding the proof of fact of communication services in this embodiment) The following describes a technology for verifying facts in a communication service, which is realized in this embodiment. Note that the content described here is not a publicly known technology, and the problem described next is also not a publicly known technology.

[0022] With this technology, in a communication service in which a large number of users send and receive messages, "proof of fact" is provided to prove who sent and received what, and when, for messages (which can be text, binary files, audio, video, etc., with no limitations on format), which are the unit of transmission and reception by users.

[0023] The process for verifying the fact is executed by the communication proving device 100, which will be described later. The communication proving device 100 is a trusted third party device, and acts as an intermediary for sending and receiving messages between users.

[0024] A user does not necessarily judge whether a message is a target for existence proof at the time of sending or receiving the message, and even for a past message that the user judges afterwards to be a target for proof, the fact proof is performed by the communication proof device 100. In other words, all messages may potentially be a target for proof at the time of sending or receiving.

[0025] In the prior art, it has not been possible to provide proof of fact for a message in a communication service in which a large number of users send or receive messages. However, it is conceivable that such proof of fact could be provided using the above-mentioned prior art. Therefore, the following describes the problems that would arise if proof of fact were provided in a communication service using the above-mentioned prior art.

[0026] (About the assignment) It can be considered that the electronic document in the conventional technology and the message in the fact certification according to the present embodiment have the same status. If the notary in the conventional technology and the trusted third party (operating the communication certification device 100) in the fact certification according to the present embodiment have the same status, it is functionally possible to implement the fact certification service according to the present embodiment using the conventional technology.

[0027] However, when sending and receiving messages in a large-scale communication service are potential subjects for fact-proofing, the conventional technology has the following problems 1 to 4. Note that problems 1 to 4 are problems related to the technology according to this embodiment, and all of problems 1 to 4 can be solved by the technology according to this embodiment. Note that it is not essential that the present invention (the invention described in the claims) can solve all of problems 1 to 4.

[0028] <Assignment 1> When applying conventional technique a to the fact-proof service of this embodiment, electronic signatures are applied to a large amount of transmitted and received messages (including data to be certified), which causes an issue of increased computational resources required for signing by the communication proof device 100. Furthermore, when a distributed configuration of the signature device is adopted to execute a large amount of signature processing, the signature key is also distributed, which increases the cost of safely managing the key. As a result, electronic signatures are applied to messages (including data to be certified) that are not the subject of fact-proofing, resulting in a waste of many computational resources.

[0029] In addition, if a fact needs to be proved a long time after the signature is generated, the proof will not be valid if the expiration date of the signing key has passed. There is a method to re-sign with a new signing key before the expiration date of the signing key, but this consumes further computational resources.

[0030] <Task 2> When applying the conventional technique b to the fact proof service according to the present embodiment, it is necessary to store digests of a large amount of transmitted and received messages (including data to be certified), which poses an issue of increasing the storage capacity of the communication proof device 100. In other words, since the storage capacity increases in proportion to the number of messages transmitted and received in the communication service, a huge storage capacity is required for long-term certification.

[0031] As a result, messages (including data to be proven) that are not the subject of factual proof are also stored, resulting in a lot of wasted storage capacity.

[0032] <Task 3> In relation to the prior art C and the fact proof of communication services, for example, a hash tree can be constructed that aggregates (including proof target data) messages sent and received by communication system users in a certain time cycle (such as one day or one hour). Branch data can be determined for each cycle.

[0033] By applying a hash tree to conventional technology A and sending timestamps and branch data to users, the number of signatures required by conventional technology A can be reduced.

[0034] However, in conventional technology A, the signature can be sent to the user in synchronization with the user's message sending and receiving (as a series of transactions), but the branch data confirmation cycle is asynchronous with the user's message sending and receiving. In this way, when conventional technology A and conventional technology C are combined, the following problems (1) to (3) arise.

[0035] (1) The communication proving device 100 needs to continuously deliver branch data to the user asynchronously with message transmission and reception, and delete tree data that has already been delivered. This requires the construction of a complex system in terms of implementation and operation.

[0036] (2) If undelivered branch data is stored in the communication proving device 100 without being deleted, the storage capacity increases. Since the size of the hash tree is mathematically approximately twice the size of the entire leaf (terminal digest), storing undelivered data requires a maximum capacity approximately twice that of conventional technique B.

[0037] (3) A user needs to store the distributed branch data for each message sent or received by the user. For example, if the number of messages in one cycle is 1,000,000 and the hash function is SHA256, the size of one branch data will be at least 1280 bytes.

[0038] <Task 4> In the case of electronic notarization, there may be cases where the user sends a digest of the electronic document to the notary public, but if the user sends to the communication certification device 100 a digest of data other than the sent or received message, this does not achieve the proof of fact that is the objective of the technology of this embodiment.

[0039] Therefore, in the fact-proof service of this embodiment, the communication proving device 100 needs to perform a hash calculation on the message in any of the methods a, b, and c.

[0040] The amount of computation required for hash calculations is proportional to the size of the input data. For messages over a certain size (up to several tens of KBytes, depending on the conditions), the amount of computation required is greater than that required for signature generation. For large-scale communication services, the amount of computation required becomes enormous.

[0041] Therefore, when the conventional techniques a, b, and c are applied to the fact-proofing service according to the present embodiment, there is a possibility that the communication proving device 100 becomes a bottleneck in the communication service.

[0042] (Technology related to this embodiment) The technology according to the present embodiment for solving the above-mentioned problems will be described in detail below.

[0043] (System configuration example) Fig. 2 shows an example of the configuration of a fact-certifying system in this embodiment. As shown in Fig. 2, the fact-certifying system includes a communication proving device 100, a plurality of communication terminals 200, and a verification device 300. In the example of Fig. 2, communication terminals 200-1 and 200-2 are shown as the plurality of communication terminals 200. The communication proving device 100 and the communication terminals 200-1 and 200-2 are connected to a communication system 400.

[0044] The communication proving device 100 and the communication terminal 200 do not have to be physically integrated, and for example, some functions of the communication proving device 100 may be arranged at a network edge, and some functions of the communication terminal 200 may be arranged on a cloud. The configuration in which some functions of the communication proving device 100 are arranged at a network edge will be described later.

[0045] In the authentication system shown in FIG. 2, a communication terminal 200-1 (user) requests authentication of a transmitted / received message from a verification device 300 (verifier).

[0046] In this embodiment, the communication proving device 100 is operated by a third party trusted by both the user and the verifier. For example, the communication proving device 100 may be operated by a telecommunications carrier that operates the communication system 400.

[0047] Hereinafter, the operations of the communication proving device 100, the communication terminal 200, and the verification device 300 will be described in detail with reference to the drawings.

[0048] (Communication Proof Device 100) First, the operation of the communication proving device 100 will be described.

[0049] <Proof digest generation> The communication proving device 100 generates a proof digest, which is a hash calculation result of the data to be certified. The data to be certified is data including the sent and received messages of the user. Note that the "sent and received messages" may be only sent messages, only received messages, or both sent and received messages. The "sent and received messages" may be called "messages".

[0050] An image of how a certification digest is generated from certification target data is shown in Fig. 3. As shown in Fig. 3, certification target data is data in which additional information is added to a transmitted or received message.

[0051] Regarding the generation of the certification target data, a transmitted / received message may be input to the communication proving device 100 from the communication system 400, and the certification target data may be generated within the communication proving device 100, or the certification target data may be input to the communication proving device 100 from the communication system 400.

[0052] In the certification subject data, the additional information added to the transmitted / received message is, for example, a user ID and a transmission / reception time.

[0053] The method of determining the additional information is not limited to a specific method, but for example, the communication system 400 determines the additional information and inputs the additional information to the communication certification device 100. In this case, for example, a user ID identified by a subscriber authentication mechanism (such as a SIM) of the communication system 400 and the time when the message was transferred within the communication system 400 are used as the additional information.

[0054] Also, an element for certifying the user ID may be included in the message by including the signature and certificate of the communication terminal 200 (user) itself in the message. Therefore, the user ID may not be included in the additional information.

[0055] Note that a user ID or time information (eg, a self-proclaimed user name) that cannot be confirmed as true by the communication proving device 100 is inappropriate as additional information in this embodiment.

[0056] As described above, in addition to the embodiment in which the additional information is input from the communication system 400 to the communication proving device 100, there is an embodiment in which the additional information is generated inside the communication proving device 100.

[0057] Certification target data including additional information is stored in the user's communication terminal 200 for use in verification. The certification target data may be generated by the communication terminal 200 using additional information received from the communication system 400, or may be acquired from the communication certification device 100, for example.

[0058] <Round tree generation> The communication proving device 100 continuously classifies and groups the proof digests of the same user at regular intervals. Hereinafter, this classification unit is called a round, and a group of proof digests is called a round group. Note that using a period as a unit of classification is just an example. In addition to or instead of a period, classification may be performed based on other conditions (sending / receiving, specific message attributes, etc.).

[0059] The communication proving device 100 continuously creates a hash tree whose leaves (terminal digests) are proof digests belonging to the same round group of the same user. Hereinafter, this will be referred to as a "user tree." The top digest of the user tree will be referred to as the "user top." Since round groups are continuously generated one after another, the hash trees are also continuously created one after another.

[0060] The communication proving device 100 creates a hash tree with multiple user tops in the same round as leaves. Hereinafter, this will be called a "round tree."

[0061] The top digest of a round tree reflects the data to be certified by multiple users in the same round, and will be referred to as the "round top" hereinafter.

[0062] There is no limit to the number of users belonging to a round tree. For example, a round tree may be generated to which all users who are NW subscribers belong, or a round tree to which a smaller user group belongs may be generated.

[0063] As a simpler form, the communication proving device 100 may consider the user top as the round top without creating a round tree. Details of this form will be described later.

[0064] The communication proving device 100 signs the round top. Hereinafter, this is called a "round signature." The communication proving device 100 stores the latest round tree. In addition, the communication proving device 100 may delete round trees that are not the latest.

[0065] The communication proving device 100 outputs a "round branch" which is branch data of a round tree and a round signature in response to a request from the communication terminal 200 (user). More specifically, a round branch is a minimum data set required to reach the latest round top through a chain of hash calculations starting from the user top of a specific user.

[0066] Fig. 4 shows examples of a user tree and a round tree. Fig. 4 shows user trees for users 1 to 4. As described above, the communication proving device 100 constructs hash trees of the data to be certified (a user tree based on the digest of a specific user and a round tree based on the digests of multiple users), generates a signature for the round top (round signature), and stores the latest round tree. In addition, each communication terminal 200 stores a proof digest of its own data to be certified.

[0067] Fig. 5 shows an example of a round branch corresponding to the example of Fig. 4. The communication proving device 100 stores the latest round tree, and outputs a "round branch" which is branch data of the round tree and a round signature in response to an external request.

[0068] <Round chain generation> The communication proving device 100 sets the top digest of the user tree of the previous round to one of the leaves of the user tree for each user. This process forms a round chain, which is a chain that connects rounds. With the round chain, the latest user top reflects all past proof digests of a specific user. Furthermore, the latest round top reflects all past proof digests of multiple users.

[0069] An example of a round chain is shown in Figure 6. As shown in Figure 6, for each user, the top digest of the user tree in the previous round N-1 is set to one of the leaves of the user tree in the current round N.

[0070] (Communication terminal 200) Next, the operation of communication terminal 200 will be described.

[0071] <Data storage> The communication terminal 200 stores the certification target data and the certification digest. The communication terminal 200 may generate the certification digest by hash calculation, or may obtain the certification digest generated by the communication proving device 100 from the communication proving device 100. Furthermore, the communication terminal 200 may delete the certification target data that the user judges to be unnecessary.

[0072] Note that the communication terminal 200 stores all the certification digests for that communication terminal 200. In other words, even if the corresponding certification target data is deleted, the certification digest is not deleted but is stored because it is necessary for the fact proof of other certification target data.

[0073] The communication terminal 200 can generate the user top by recalculating the hash tree from the stored proof digest. Also, the communication terminal 200 stores the user top for each round, which allows efficient processing.

[0074] <Select data to be certified> The user selects the certification target data to be certified from among the certification target data stored in the communication terminal 200. For example, the communication terminal 200 displays a user interface screen, and the user selects the certification target data to be certified on the user interface screen.

[0075] <Dataset Creation> The communications terminal 200 creates a data set to be used for verifying the facts of the selected verification target data, in the following procedure.

[0076] First, the communication terminal 200 reconstructs a "user branch" of the selected certification target data from the certification digest stored in the communication terminal 200. The user branch is a minimum data set that starts from the certification digest of the selected certification target data and reaches the latest user top through a chain of hash calculations.

[0077] Next, the communication terminal 200 acquires the latest round branch and round signature from the latest round tree stored in the communication proving device 100. The round branch is the minimum data set that starts from the user top of the user of the communication terminal 200 and reaches the latest round top through a chain of hash calculations.

[0078] Finally, the communication terminal 200 connects the user branch (end point is the user top) and the round branch (start point is the user top) to complete a "message branch." The message branch is the minimum data set that starts from the proof digest of the selected proof target data and reaches the round top through a chain of hash calculations.

[0079] <Output> The communication terminal 200 outputs the round signature, the message branch, and the proof target data. Hereinafter, this set is referred to as fact proof data. The fact proof data is transmitted from the communication device 200 to the verification device 300 for fact proof.

[0080] <Detailed example of user branch generation> As described above, the user branch is the minimum data set that starts from the proof digest of the selected proof target data and reaches the latest user top through a chain of hash calculations.

[0081] The communication terminal 200 stores at least all of the proof digests and proof target data that can potentially prove facts, and when proof target data is selected for fact proof, it can generate a user branch from the proof target data to the latest user top.

[0082] For nodes that are not stored in the communication terminal 200 among the constituent nodes of the user branch, the communication terminal 200 can recalculate them using the proof digest.

[0083] The method of creating a user branch in the communication terminal 200 is not limited to a specific method, but may be, for example, the creation methods shown in the following examples 1 to 3.

[0084] <User branch creation: Example 1> In example 1, the communication terminal 200 does not perform pre-calculation when acquiring a proof digest (when sending or receiving a message), but creates a user branch (and a message branch) from the stored proof digest every time a user branch is created. Although the storage capacity is minimum, the amount of calculation by the communication terminal 200 is greater than in other examples, since recalculation is required from the initial proof digest every time a message branch is created.

[0085] 7 and 8 show an example of creating a user branch in Example 1. Using the proof digest data stored as shown in FIG. 7, a hash recalculation is performed to generate a user branch as shown in FIG.

[0086] <User branch creation: Example 2> In Example 2, when the communication terminal 200 acquires a proof digest (when sending or receiving a message), it recalculates the user tree of the previous round and stores only the user top. Each time a user branch is created, the communication terminal 200 creates a user branch (and a message branch) from the stored proof digest and user top.

[0087] In Example 2, the amount of recomputation is smaller than in Example 1, and the storage capacity increases by the user top digest per round. In other words, the amount of data hardly increases.

[0088] 9 and 10 show an example of creating a user branch in Example 2. Using the proof digest data stored as shown in FIG. 9, a hash recalculation is performed as shown in FIG. 10 to generate a user branch.

[0089] <Create user branch: Example 3> In Example 3, when the communication terminal 200 acquires a proof digest (when sending or receiving a message), it recalculates the user tree of the previous round and stores all nodes of the user tree. Each time a user branch is created, the communication terminal 200 creates a user branch (and a message branch) from the stored proof digest and all nodes of the user tree.

[0090] In Example 3, no recalculation is required, and the storage capacity is approximately twice that of Example 1. Specifically, in the case of SHA-256, the storage capacity per message becomes 64 bytes instead of 32 bytes.

[0091] 11 and 12 show an example of creating a user branch in Example 3. Using the proof digest data stored as shown in Fig. 11, a hash recalculation is performed to generate a user branch as shown in Fig. 12.

[0092] <message branch> An example of a message branch is shown in Fig. 13. As described above, the communication terminal 200 constructs a message branch from the selected proof target data to the latest round top. The communication terminal 200 acquires the latest round branch and the round signature from the communication proving device 100, constructs a user branch, and connects the user branch and the round branch to construct a message branch.

[0093] <Verification device 300> Next, the operation of the verification device 300 will be described. First, fact-proof data is input to the verification device 300. The verification device 300 verifies that the round top is reached through a chain of hash calculations starting from the proof target data and inputting the digest of the message branch (this is called verification (1)). Next, the verification device 200 verifies the round signature (this is called verification (2)). In signature verification, the verification device 300 performs signature verification using, for example, a public key certificate corresponding to the private key of the communication proving device 100.

[0094] The verification device 300 outputs a determination result of the proof of fact that the proof is "valid" if the results of both the above verifications (1) and (2) are valid, and is "invalid" otherwise.

[0095] An example of the configuration and operation of each device will be described below.

[0096] (Example of the configuration of the communication proving device 100) Fig. 14 shows an example of the configuration of the communication proving device 100. As shown in Fig. 14, the communication proving device 100 includes a proof target data input unit 101, a proof digest creation unit 102, a round group classification unit 103, a round tree creation unit 104, a round signature creation unit 105, a round tree storage unit 106, a round branch extraction unit 107, a request reception unit 108, a storage unit 109, and a control unit 110.

[0097] The certification target data input unit 101 is connected to the communication system 400 and receives an input of certification target data from the communication system 400 .

[0098] The request receiving unit 108 is connected to the communication system 400, receives a round branch request from a user (communication terminal 200), and outputs the round branch to the user. The memory unit 109 stores the latest round tree. The control unit 110 controls the communication proving device 100 as a whole.

[0099] The “proof digest creation unit 102, round group classification unit 103, round tree creation unit 104, round signature creation unit 105, round tree storage unit 106, and round branch extraction unit 107” are components that perform a series of procedures for creating a round tree from the proof target data inputted in the proof target data input unit 101.

[0100] Among these, the round tree creation unit 104 creates a hash tree with the proof digests belonging to the round group as leaves. In addition, the user top of the previous round group is added to the leaves. When creating the round tree, multiple proof digests or digests of multiple proof digests are temporarily stored in the working memory.

[0101] The round signature creation unit 105 also has a function of storing a private key used for signing. As the round signature creation unit 105, a tamper-resistant hardware security module (HSM) or the like may be used.

[0102] The round branch extraction unit 107 extracts a round branch of a user in response to a request from the user received by the request receiving unit 108 and returns the round branch to the request receiving unit 108 .

[0103] The configuration of the communication proving device 100 is not limited to the configuration shown in Fig. 14. The communication proving device 100 may have, for example, the configuration shown in Fig. 15. The communication proving device 100 shown in Fig. 14 and the communication proving device 100 in Fig. 15 have the same functions.

[0104] The communication proof device 100 shown in Fig. 15 includes a tree creation unit 111 and an extraction unit 112. The tree creation unit 111 groups a plurality of proof digests, creates a hash tree based on a plurality of proof digests belonging to the same group of the same user, and attaches a signature to the top digest of the hash tree. The extraction unit 112 extracts and outputs at least the signature in response to a request from a specific user.

[0105] The grouping by rounds already described is an example of the grouping, and the user tree and the round tree are both examples of the hash tree.

[0106] (Processing Procedure of Communication Proof Device 100) Next, a description will be given of the processing procedure of the communication proving device 100. The processing procedure of the communication proving device 100 includes a round tree creation procedure and a round branch output procedure.

[0107] The round tree creation procedure will be described with reference to the flowchart in Fig. 16. In the round tree creation procedure, the communication proving device 100 creates a round tree and a round signature from the certification target data input from the communication system 400, and stores them in the storage unit 109.

[0108] In S 1 , the certification target data is input from the communication system 400 to the communication certification device 100 .

[0109] In S2, the proof digest creation unit 102 performs a hash calculation (such as SHA256) on the data to be certified, and creates a proof digest.

[0110] Here, the communication certification device 100 may transmit the certification target data to the communication terminal 200 via the communication system 400 .

[0111] In S3, the round group classification unit 103 classifies the proof digests into round groups for each fixed period.

[0112] In S4, the round tree creation unit 104 creates a round tree from the proof digests of the same user and the same round group. Specifically, the round tree creation unit 104 creates a hash tree with the proof digests belonging to the round group as leaves. Furthermore, the round tree creation unit 104 adds the user top of the previous round group to the leaves to form a round chain.

[0113] In S5, the round signature creation unit 105 creates a round signature which is a digital signature (electronic signature) for the round top.

[0114] In S6, the round tree storage unit 106 stores the round tree and the round signature in the storage unit 109. The round tree storage unit 106 deletes from the storage unit 109 the round signature that is not the latest.

[0115] Next, the round branch output procedure will be described with reference to the flowchart of Fig. 17. The round branch output procedure is a procedure for outputting a round branch and a round signature from the latest round tree in response to a user request.

[0116] In S11, the request receiving unit 108 receives a round branch request from a user (communication terminal 200). In S12, the round branch extraction unit 107 extracts a round branch of the user from the latest round tree stored. In S13, the round branch extraction unit 107 outputs the extracted round branch and the latest round signature and transmits them to the communication terminal 200.

[0117] (Example of not creating a round tree) As described above, the communication proving device 100 may not create a round tree and may consider the user top as the round top.

[0118] That is, although the round tree has been defined as "a hash tree with multiple user tops in the same round as leaves", it is also possible to adopt a configuration in which the word "multiple" is omitted. An example of a user tree in this case is shown in Figure 18.

[0119] In this case, the communication proving device 100 does not create a round tree, but performs round signatures on all user tops.

[0120] Furthermore, communication terminal 200 treats a user branch as a message branch. An example of a message branch in this case is shown in Fig. 19. In the example shown in Fig. 19, any of the above-mentioned examples 1 to 3 may be applied to the method of creating a user branch in communication terminal 200.

[0121] In an example where a round tree is not created, the communication terminal 200 does not acquire a round branch (e.g., FIG. 13) from the communication proving device 100 when creating fact-proof data, but acquires a round signature (=signature for the user top). Also, in an example where a round tree is not created, the fact-proof data does not include a round branch, but includes a user branch, a round signature, and proof target data.

[0122] (Example of configuration of communication terminal 200) Fig. 20 shows a configuration example of the communication terminal 200. As shown in Fig. 20, the communication terminal 200 includes a communication unit 201, a user branch creation unit 202, a round branch request unit 203, a message branch creation unit 204, a fact proof data output unit 205, a user input / output unit 206, a storage unit 207, and a control unit 208.

[0123] The communication unit 201 transmits and receives messages via the communication system 400. The communication unit 201 also requests the communication proof device 100 for round branches and round signatures, and transmits fact proof data to the verification device 300.

[0124] The user input / output unit 206 is an element constituting a user interface, and allows the user to select what to prove from the proof target data stored in the storage unit 207 .

[0125] The communication terminal 200 may be configured on a cloud, and a user interface may be realized via the communication unit 201.

[0126] The storage unit 207 stores the proof target data and the proof digest. The user branch creation unit 202 creates a user branch from the proof digest stored in the storage unit 207.

[0127] The round branch request unit 203 creates a message requesting a round branch and a round signature to the communication proving device 100, and transmits and receives the message via the communication unit 201. The round branch request unit 203 also verifies the round signature.

[0128] The message branch creation unit 204 creates a message branch by linking the round branch and the user branch, and verifies the hash chain.

[0129] The fact-proof data output unit 205 creates a message for outputting the round signature, the message branch, and the proof target data via the communication unit 201, and outputs the message. The control unit 208 controls the communication terminal 200 as a whole.

[0130] The configuration of communication terminal 200 is not limited to the configuration shown in Fig. 20. Communication terminal 200 may have, for example, the configuration shown in Fig. 21. Note that communication terminal 200 shown in Fig. 20 and communication terminal 200 in Fig. 21 have the same functions.

[0131] The communication terminal 200 shown in FIG. 21 includes a user interface unit 211, a branch creation unit 212, and an output unit 213.

[0132] The user interface unit 211 accepts the selection of specific certification target data from the user.

[0133] The branch creation unit 212 creates a first branch, which is a minimum data set for starting from a proof digest of specific proof target data and reaching the latest top digest in a first hash tree having the proof digest as a leaf through a chain of hash calculations. A user branch is an example of the first branch.

[0134] The output unit 213 outputs the fact proof data including the first branch, the signature acquired from the communication proving device 100, and the specific proof target data. When a round tree is not created, the first branch corresponds to a user branch. When a round tree is created, the first branch corresponds to a user branch in a message branch that connects a user branch and a round branch.

[0135] (Processing procedure of communication terminal 200) Next, a description will be given of the processing procedure of the communication terminal 200. The processing procedure of the communication terminal 200 includes a proof digest storage procedure and a fact proof data output procedure.

[0136] The proof digest storage procedure will be described with reference to the flowchart in Fig. 22. The proof digest storage procedure is a procedure for storing the proof target data and the proof digest every time a message is transmitted or received.

[0137] In S21, the communication unit 201 transmits and receives a message via the communication system 400.

[0138] At this time, together with the message transmission and reception, the communication unit 201 receives a proof digest from the communication proving device 100. Note that the communication unit 201 may not receive the proof digest, in which case the communication terminal 200 creates the proof digest by performing a hash calculation on the data to be certified.

[0139] In S22, the communications terminal 200 stores the certification target data and the certification digest in the storage unit 207.

[0140] Next, a procedure for outputting fact-certifying data will be described with reference to the flowchart of Fig. 23. The procedure for outputting fact-certifying data is a procedure for creating and outputting fact-certifying data corresponding to certification target data selected by a user.

[0141] In S31, the user selects, via the user input / output unit 206, from among the certification target data stored in the communication terminal 200, the certification target data to be subjected to fact certification.

[0142] In S 32 , the user branch creation unit 202 reconstructs the “user branch” of the selected certification target data from the certification digest stored in the storage unit 207 .

[0143] In S33, the round branch request unit 203 requests and acquires the latest round branch and round signature from the latest round tree stored in the communication proving device 100.

[0144] In S34, the message branch creation unit 204 creates a message branch by linking the user branch and the round branch.

[0145] In S35, the fact-proof data output unit 205 outputs the fact-proof data (the round signature, the message branch, and the proof target data). The output fact-proof data is sent to the verification device 300.

[0146] (Example of configuration of verification device 300) 24 shows an example of the configuration of the verification device 300. As shown in FIG. 24, the verification device 300 includes an input / output unit 301, a message branch verification unit 302, a round signature verification unit 303, a fact proof determination unit 304, a storage unit 305, and a control unit 306.

[0147] The input / output unit 301 receives the certification data output by the communication terminal 200 and outputs the certification verification result.

[0148] The message branch verification unit 302 verifies that the proof target data is the starting point and that the chain of hash calculations using the digests of the message branches as input leads to the round top (verification (1)).

[0149] The round signature verification unit 303 verifies the round signature (verification (2)). At this time, the public key, the public key certificate, or the root certificate of the communication proving device 100 stored in the storage unit 305 is used for the signature verification.

[0150] The fact proof determination unit 304 outputs a determination result of the fact proof from the input / output unit 301, which is "valid" if the results of the above verification (1) and verification 2 (2) are both valid, and "invalid" otherwise. The storage unit 305 stores the public key, public key certificate, or root certificate of the communication proving device 100. The control unit 306 controls the entire verification device 300.

[0151] The configuration of the verification device 300 is not limited to the configuration shown in Fig. 24. The verification device 300 may have, for example, the configuration shown in Fig. 25. Note that the verification device 300 shown in Fig. 24 and the verification device 300 in Fig. 25 have the same functions.

[0152] The verification device 00 shown in FIG. 25 includes a branch verification unit 311, a signature verification unit 312, and a judgment unit 313.

[0153] The branch verification unit 311 verifies that a specific proof target data in the fact proof data is used as a starting point, and that a top digest is reached through a chain of hash calculations using digests of branches in the fact proof data as inputs. The signature verification unit 312 verifies the signature in the fact proof data.

[0154] If the verification by both the branch verification unit 311 and the signature verification unit 312 is successful, the authentication unit 313 determines that the specific certification target data selected by the user is valid.

[0155] (Processing procedure of verification device 300) Next, the processing procedure of the verification device 300 will be described with reference to the flowchart of FIG.

[0156] In S 41 , fact proof data is input to the verification device 300 via the input / output unit 301 .

[0157] In S42, the message branch verification unit 302 verifies that the chain of hash calculations starting from the proof target data belonging to the input fact proof data and using the digest of the message branch as an input leads to the round top (verification (1)).

[0158] In S43, the round signature verification unit 303 verifies the round signature belonging to the input fact proof data (verification (2)).

[0159] In S44, the fact certification determination unit 304 determines the fact certification as “valid” if the results of both the above verifications (1) and (2) are valid, and as “invalid” otherwise. In S45, the input / output unit 301 outputs the determination result.

[0160] (About Edge Computing) The communication proving device 100 may be applied to edge computing. A configuration example in this case is shown in Fig. 27. In this case, the communication proving device 100 is composed of a plurality of network edge units 150 and a single proving unit 160. For example, the network edge unit 150 performs hash calculation of the data to be proved, and the proving unit 160 performs calculation of the round tree and the like.

[0161] The functions and processing procedures of the "plurality of network edge units 150 and the proving unit 160" are the same as those of the communication proving device 100 described above. Note that when the communication proving device 100 is applied to edge computing, the proving unit 160 may be called the "communication proving device 100."

[0162] Fig. 28 shows an example of calculation locations performed by multiple network edge units 150. Fig. 28 shows an example in which calculations up to the proof digest are performed by the network edge unit 150. However, this is not limited to this, and the network edge unit 150 may perform hash calculations on multiple proof digests and calculate up to the user top digest.

[0163] (Other examples (supplementary explanations)) (1) Falsification of proof digest If the proof digest stored in the communication terminal 200 is changed to a proof digest with a different value obtained by hash calculation of incorrect data, the round top, which is the result of the hash calculation using the changed proof digest as input, will also have a different value, and will be invalid in the round signature verification by the verification device 300. Although there is an extremely low probability of obtaining an accurate round top from the result of a hash calculation using a different proof digest as input, this is a negligible threat (equivalent to accidental decryption of an encryption key). Therefore, it is not possible to overturn the verification result of the proof of fact (to prove that invalid proof target data is valid) by falsifying the proof digest.

[0164] (2) Storage scope of certification digest If there is a "possibility" that all past communication data will be subject to certification, there is a possibility that communication terminal 200 will continue to hold all data subject to certification and its certification digest. If the scope of data subject to certification can be limited, the scope of certification digest storage can be reduced, for example, by the following means.

[0165] a. If communications before a certain point T1 are not likely to be subject to certification, the certification digests before T1 can be deleted. b. If communications from a certain period T2 to T3 are unlikely to be subject to certification, the user top up to T2 can be sent as the latest certification subject data and registered in the communication certification device 200 (grafting the past branch onto the latest branch), thereby deleting the certification digest for the period T2 to T3.

[0166] (Hardware configuration example) Any of the devices described in this embodiment (the communication proving device 100, the communication terminal 200, and the verification device 300) can be realized by, for example, causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0167] That is, the device can be realized by executing a program corresponding to the processing performed by the device, using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0168] Fig. 29 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 29 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are mutually connected by a bus BS. The computer may further include a GPU.

[0169] The program for realizing the processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0170] The memory device 1003 reads out and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard and mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0171] (Summary of the embodiment, effects) As described above, this embodiment makes it possible to realize a fact-certifying system that certifies facts about messages transmitted and received through a communication service.

[0172] Since the decision as to whether or not to perform fact proof for a certain message is made after the fact, the number of data items to be proved becomes enormous, and there is a problem that the communication target device 100 needs to make efficient use of its computational resources.

[0173] Therefore, in this embodiment, the communication target device 100 constructs a user tree and a round tree for the proof target data. In addition, the user tree constructs a round chain. The communication proof device 100 only needs to execute a signature once per round tree, and only needs to store the latest round tree. Therefore, compared with the case of using the conventional technology, the processing load is reduced and the computational resources can be used efficiently.

[0174] Furthermore, by performing hash calculations on the certification target data in the network edge unit 150, the processing load due to hash calculations in the communication certification device 100 (certification unit 160) can be reduced.

[0175] In response to the above-mentioned problems 1 to 4, the technique according to the present embodiment can provide the following effects.

[0176] Problem 1 (number of signatures in conventional technique A): According to the technology of the present embodiment, the communication proving device 100 only needs to make a signature once per round tree, regardless of the number of users of the NW service or the number of messages sent and received. Alternatively, the communication proving device 100 only needs to make a signature per round, the number of users who have sent and received messages in the round.

[0177] The latest round signature can always be used to prove the facts of all past messages, eliminating issues related to key lifetimes.

[0178] Issue 2 (Storage capacity of conventional technology B): According to the technique of the present embodiment, the communication proving device 100 only needs to store the latest round tree and round signatures. Alternatively, the communication device 100 only needs to store round signatures for the number of users who have performed transmission and reception in the relevant round.

[0179] Although it depends on the implementation method, for example, even if the number of users of a network service is 100 million, the size of the round tree can be kept below 10 GB.

[0180] Problem 3 (Conventional Technology A + Conventional Technology C): According to the technology of this embodiment, it is not necessary to introduce a function for asynchronously distributing branch data to a user. Also, according to the technology of this embodiment, the communication proving device 100 only needs to store the latest round tree, so it is not necessary to accumulate undistributed branch data. Furthermore, according to the technology of this embodiment, the communication terminal 200 of the user only needs to store the proof digest of the user's own message.

[0181] The amount of data stored in the communication proving device 100 is 1 / (2*log2N) of that in the conventional technology when the number of messages in one cycle is N. For example, when the total number of messages in one round is 1,000,000, the amount is 1 / 40 or less of that in the conventional technology.

[0182] Problem 4 (Hash calculation amount of conventional techniques a, b, and c): According to the technology of this embodiment, it is possible to apply edge computing. By applying edge computing and performing hash calculations on the data to be certified at the network edge unit 150, it is possible to reduce the possibility that the communication proving device 100 will become a processing bottleneck. Note that since hash calculations do not require a private key, no problems related to key management will occur even when edge computing is applied.

[0183] The following supplementary notes are further disclosed regarding the above embodiment.

[0184] <Additional Notes> (Additional note 1) A communication certification device used to certify facts about messages sent or received in a communication system to which a plurality of communication terminals used by users are connected, comprising: Memory, at least one processor coupled to the memory; Including, The processor, grouping a plurality of certification digests generated from certification target data having the message, creating a hash tree based on a plurality of certification digests belonging to the same group of the same user, and attaching a signature to the top digest of the hash tree; In response to a request from a specific user, at least the signature is extracted and output. Communication proof device. (Additional note 2) The certificate digest is generated by the network edge. Item 1. A communication certification device according to item 1. (Additional note 3) The processor, A hash tree is created as a first tree, with multiple proof digests belonging to the same group of the same user as leaves. creating a hash tree having top digests of a plurality of the first trees of the same group as leaves as a second tree, and attaching the signature to the top digest of the second tree; A branch, which is a minimum data set required to reach the latest top digest of the second tree by a chain of hash calculations starting from the top digest of the first tree of the particular user, and the signature are extracted and output. Item 1. A communication certification device according to item 1. (Additional note 4) A communication terminal used to authenticate a message sent or received in a communication system to which a plurality of communication terminals used by users are connected, Memory, at least one processor coupled to the memory; Including, The processor, accepting from a user a selection of particular certification subject data comprising said message; creating a first branch, which is a minimum data set required to reach the latest top digest in a first hash tree having the proof digest as a leaf by a chain of hash calculations, starting from the proof digest of the specific proof target data; outputting fact-proof data including a signature acquired from the first branch and a communication proof device capable of communicating with the communication terminal, and the specific proof target data; Communications terminal. (Additional note 5) the signature is a signature attached to a top digest of a second hash tree having top digests of a plurality of the first hash trees as leaves, The processor, obtain, from the communication proving device, a second branch that is a minimum data set for starting from the top digest of the first hash tree and reaching the latest top digest of the second hash tree through a chain of hash calculations, and the signature, and create a third branch by concatenating the first branch and the second branch; outputting fact-proving data including the third branch, the signature, and the specific certification target data; Item 4. A communication terminal according to item 4. (Additional note 6) Memory, at least one processor coupled to the memory; Including, The processor, A first verification is performed to verify that the specific certification target data in the fact-proof data described in Supplementary Claim 4 is used as a base point, and that a top digest is reached through a chain of hash calculations using digests of branches in the fact-proof data as inputs; performing a second verification to verify the signature on the fact-proving data; When both the first verification and the second verification are successful, the specific certification target data is determined to be valid. Verification device. (Additional note 7) An information processing method executed by a communication certification device used to perform fact certification for a message sent or received in a communication system to which a plurality of communication terminals used by users are connected, comprising: a tree creation step of grouping a plurality of certification digests generated from certification target data having the message, creating a hash tree based on a plurality of certification digests belonging to the same group of the same user, and attaching a signature to the top digest of the hash tree; an extraction step of extracting and outputting at least the signature in response to a request from a specific user; An information processing method comprising: (Additional note 8) A non-transitory storage medium storing a program for causing a computer to function as each unit in the communication certification device described in any one of appendixes 1 to 3, each unit in the communication terminal described in appendix 4 or 5, or each unit in the verification device described in appendix 6.

[0185] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0186] 100 Communication Proof Device 101 Certification target data input section 102 Proof Digest Creation Unit 103 Round Group Classification Section 104 Round Tree Creation Department 105 Round Signature Creation Unit 106 Round Tree Storage 107 Round Branch Extraction Section 108 Request Reception Department 109 Storage section 110 Control section 111 Tree Creation Department 112 Extraction part 150 Network Edge Section 160 Certification Department 200 Communication terminal 201 Communications Department 202 User Branch Creation Department 203 Round Branch Request Part 204 Message Branch Creation Department 205 Fact Proof Data Output Unit 206 User input / output section 207 Memory section 208 Control Unit 211 User Interface Section 212 Branch Creation Department 213 Output section 300 Verification Device 301 Input / output section 302 Message Branch Validator 303 Round Signature Verification Unit 304 Factual Certification and Determination Division 305 Storage section 306 Control Unit 311 Branch Verification Department 312 Signature Verification Unit 313 Judgment section 400 Communication Systems 1000 Drive Device 1001 Recording media 1002 Auxiliary storage 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output device

Claims

1. A communication certification device used to certify facts about messages sent or received in a communication system to which a plurality of communication terminals used by users are connected, comprising: a tree creation unit that groups a plurality of certification digests generated from certification target data having the message, creates a hash tree based on a plurality of certification digests belonging to the same group of the same user, and attaches a signature to the top digest of the hash tree; an extracting unit that extracts and outputs at least the signature in response to a request from a specific user; A communication verification device comprising:

2. The certificate digest is generated by the network edge.

2. The communication certification device according to claim 1.

3. The tree creation unit includes: A hash tree having multiple certificate digests belonging to the same group of the same user as leaves is created as a first tree, creating a hash tree having top digests of a plurality of the first trees of the same group as leaves as a second tree, and attaching the signature to the top digest of the second tree; The extraction unit is A branch, which is a minimum data set required to reach the latest top digest of the second tree by a chain of hash calculations starting from the top digest of the first tree of the particular user, and the signature are extracted and output.

2. The communication certification device according to claim 1.

4. A communication terminal used to authenticate a message sent or received in a communication system to which a plurality of communication terminals used by users are connected, a user interface unit for receiving from a user a selection of specific certification target data having the message; a branch creation unit that creates a first branch, which is a minimum data set required to reach a latest top digest in a first hash tree having the proof digest as a leaf by a chain of hash calculations, starting from a proof digest of the specific proof target data; an output unit that outputs fact proof data including the first branch, a signature acquired from a communication proof device capable of communicating with the communication terminal, and the specific proof target data; A communication terminal comprising:

5. the signature is a signature attached to a top digest of a second hash tree having top digests of a plurality of the first hash trees as leaves, The branch creation unit, obtain, from the communication proving device, a second branch that is a minimum data set for starting from the top digest of the first hash tree and reaching the latest top digest of the second hash tree through a chain of hash calculations, and the signature, and create a third branch by concatenating the first branch and the second branch; The output unit outputs fact proof data including the third branch, the signature, and the specific certification target data. The communication terminal according to claim 4.

6. a branch verification unit that verifies that a top digest is reached by a chain of hash calculations using the specific certification target data in the fact-proof data as a base point and a digest of a branch in the fact-proof data as an input; and a signature verification unit that verifies the signature in the fact proof data; a determination unit that determines that the specific certification target data is valid when the verification by both the branch verification unit and the signature verification unit is successful; A verification device comprising:

7. An information processing method executed by a communication certification device used to perform fact certification for a message sent or received in a communication system to which a plurality of communication terminals used by users are connected, comprising: a tree creation step of grouping a plurality of certification digests generated from certification target data having the message, creating a hash tree based on a plurality of certification digests belonging to the same group of the same user, and attaching a signature to the top digest of the hash tree; an extraction step of extracting and outputting at least the signature in response to a request from a specific user; An information processing method comprising:

8. A program for causing a computer to function as each part of the communication certification device described in any one of claims 1 to 3, each part of the communication terminal described in claim 4 or 5, or each part of the verification device described in claim 6.

Images