Adaptor signature system, pre-signed relay device, and program thereof

Abstract

To provide an adaptor signature system which can implement an adaptor signature scheme with three or more parties.SOLUTION: An adaptor signature system 100 includes: a pre-signing generation apparatus 3, as an entity, which generates pre-signing for data by a pre-signing algorithm using an adaptor signature scheme; one or more pre-signing relay devices 2, as an entity, in a stage subsequent to the pre-signing generation apparatus 3, which generates new pre-signing for the data from the pre-signing generated in a preceding entity, and relays the new pre-signing to a subsequent entity; and a digital signature generation apparatus 1, as an entity, in a stage subsequent to the one or more pre-signing relay devices 2, which generates a digital signature by a fit algorithm using the adaptor signature scheme, from the pre-signing generated in a preceding entity.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to an adapter signature system, a pre-signature relay device, and a program therefor. [Background technology]

[0002] Conventionally, there is known an adapter signature scheme that can convert a pre-signature into a normal digital signature (see Non-Patent Documents 1 and 2). In this adaptor signature method, one of the two parties generates a pre-signature for some data, which is then converted (adapted) into a digital signature by the other party, and the two signatures are then set as a single signature for the data.

[0003] Furthermore, in recent years, with the rapid advancement of AI (Artificial Intelligence) technology, a large amount of unreliable content, where the source or creator of information or data is unclear, is being circulated on the Internet, such as the creation of fake images known as "deep fakes" and the spread of fake news through social networking services (SNS), which has become a social problem. In order to combat such false and misinformation, the Coalition for Content Provenance and Authenticity (C2PA) was established in 2021 as an organization that develops open technical specifications for presenting users with "content provenance information," such as the source of content and its editing history.

[0004] C2PA is working to standardize a mechanism for allowing users to determine whether or not to trust content by associating the provenance information of the content with the content (see Non-Patent Document 3). The standardization specifications being promoted by C2PA aim to ensure the reliability of content by recording the following three pieces of information (1) to (3) on a blockchain or in a system (database) in the supply chain from content creation (here, shooting) to presentation, as shown in Figure 10, and making it possible for anyone to verify it.

[0005] (1) Information indicating who did what to the content, when, and what, as well as a hash value (assertion AS) to link the content to the manifest. (2) A list of URIs (Uniform Resource Identifiers) of assertion ASes (claim information CL). (3) Signature information (digital signature SI) for the claim information CL. These three pieces of information are collectively referred to as the manifest (C2PA manifest) MF as provenance information.

[0006] In the example of Fig. 10, company A shoots the video and records the provenance information (manifest) MF on the blockchain BC. Then, company B edits the video shot by company A and records the provenance information MF on the blockchain BC. By repeating this process, the provenance information MF is recorded on the blockchain BC for each action in the supply chain (workflow) from content creation to presentation. This allows a content user U who uses (views) the content to verify the digital signature SI of the history information MF and determine whether the content is trustworthy for each action. [Prior art documents] [Non-patent literature]

[0007] [Non-Patent Document 1] A. Poelstra, “Scriptless scripts”, [online], [Retrieved October 10, 2023], Internet〈URL:https: / / download.wpsoftware.net / bitcoin / wizardry / mw-slides / 2017-03-mit-bitcoin-expo / slides.pdf> [Non-Patent Document 2] L. Aumayr et al., “Generalized Channels from Limited Blockchain Scripts and Adaptor Signatures”, [online], [Retrieved October 10, 2020], Internet <URL: https: / / eprint.iacr.org / 2020 / 476.pdf> [Non-Patent Document 3] “C2PA Technical Specification”, [online], [Retrieved October 10, 2023], Internet〈URL:https: / / c2pa.org / specifications / specifications / 1.3 / specs / C2PA_Specification.html〉 Summary of the Invention [Problem to be solved by the invention]

[0008] In traditional C2PA approaches, different content creators take action in the supply chain, and each digital signature is independent. In actual content production, for example, in the example of Figure 10, Company A and Company B often collaborate to produce content, such as when Company B commissions Company A to shoot a film and the commissioned Company B is the producer. In such cases, even if there is a contract that the final product belongs to Company B, Company A will record the provenance information. There is a demand for this provenance information to be recorded under the responsibility of the entrusting party. In such a case, it is conceivable that the digital signature can be generated using the adapter signature method, and the delegator can convert the pre-signature generated by the delegator into a digital signature and set it.

[0009] However, conventional adapter signature methods only support signatures between two parties, and have the problem that they cannot realize an adapter signature method involving N parties (three or more parties), for example, when there is a sub-entrustee (secondary entrustee) other than the trustor and the trustee.

[0010] Therefore, an object of the present invention is to provide an adapter signature system, a pre-signature relay device, and a program therefor, which are capable of implementing an adapter signature method among three or more parties. [Means for solving the problem]

[0011] In order to solve the above problems, the adapter signature system of the present invention is an adapter signature system in which pre-signatures for data are generated and relayed by three or more entities, and a digital signature is generated by combining the pre-signatures of the entities, and is configured to include a pre-signature generation device, one or more pre-signature relay devices, and a digital signature generation device as entities.

[0012] In such a configuration, the adapter signature system generates a pre-signature for data using a pre-signature algorithm of the adapter signature scheme by means of a pre-signature generating device. Then, the adapter signature system generates a new pre-signature for the data from the pre-signature generated by the preceding entity, using one or more pre-signature relay devices, and relays the new pre-signature to the following entity. Then, the adapter signature system generates a digital signature from the pre-signature generated by the preceding entity using an adapted algorithm of the adapter signature scheme by the digital signature generating device. In this way, the adapter signature system can relay pre-signatures at multiple stages by repeatedly generating and relaying pre-signatures using one or more pre-signature relay devices, thereby realizing an adapter signature method using N parties (three or more parties).

[0013] In addition, in order to solve the above-mentioned problems, the pre-signature relay device of the present invention is a pre-signature relay device in an adapter signature system that is composed of a pre-signature generation device that generates and relays pre-signatures for data by three or more entities and generates a digital signature combining the pre-signatures of the entities, one or more pre-signature relay devices provided in the downstream side of the pre-signature generation device, and a digital signature generation device provided in the downstream side of the one or more pre-signature relay devices, and is configured to include a private public information generation unit, a key generation unit, a public information receiving unit, a public information transmitting unit, a pre-signature information receiving unit, a pre-signature generation unit, and a pre-signature information transmitting unit.

[0014] In such a configuration, the pre-signature relay device generates, by the private / public information generation unit, private information and public information that form a predetermined algebraic relationship that is difficult to calculate. Moreover, the pre-signature relay device generates a private key and a public key in the digital signature scheme by using a key generating unit. Then, the pre-signature relay device transmits the public information generated by the private public information generation unit to the preceding entity by the public information transmission unit, so that the preceding entity can generate a pre-signature by using this public information.

[0015] Then, the pre-signature relay device receives, by means of the pre-signature information receiving unit, the public information, the public key, and the pre-signature generated by the entity at the previous stage. Then, the pre-signature relay device generates a new pre-signature for the data using the public information generated by the subsequent entity, the secret information and private key, and the pre-signature generated by the previous entity, by using the pre-signature generation unit.

[0016] Then, the pre-signature relay device transmits the public information generated in the private public information generation unit, the public key generated in the key generation unit, and the pre-signature generated in the pre-signature generation unit to a downstream entity via the pre-signature information transmission unit. As a result, the pre-signature relay device can realize an adapter signature scheme with N parties (three or more parties) by relaying the pre-signature in multiple stages. The pre-signature relay device can be operated by a program that causes a computer to function as each of the above-mentioned units. Effect of the Invention

[0017] According to the present invention, an adapter signature scheme can be implemented with three or more parties. [Brief description of the drawings]

[0018] [Figure 1] FIG. 1 is an explanatory diagram for explaining three algorithms of a digital signature method. [Diagram 2] FIG. 1 is an explanatory diagram for explaining five algorithms of the N-party adapter signature scheme. [Diagram 3] FIG. 1 is an explanatory diagram for explaining the flow of five algorithms for implementing an N-party adapter signature method. [Figure 4] 1 is a schematic diagram showing a configuration of an adapter signature system according to an embodiment of the present invention. [Diagram 5] 5 is a block diagram showing the configuration of the digital signature generating device of FIG. 4. [Figure 6] 5 is a block diagram showing the configuration of the pre-signature relay device of FIG. 4. [Figure 7] 5 is a block diagram showing the configuration of the pre-signature generating device of FIG. 4. [Figure 8] 5 is a block diagram showing the configuration of the digital signature verification device of FIG. 4. [Figure 9] 1 is a sequence diagram showing an operation of an adapter signature system according to an embodiment of the present invention. [Figure 10] FIG. 1 is an explanatory diagram for explaining a conventional method for recording history information. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [About the adapter signature method] First, an adapter signature scheme used in adapter signature system 100 (FIG. 4) of the present invention will be described with reference to FIGS. The adaptor signature scheme is an extension of the digital signature scheme that uses a computationally difficult algebraic relationship to adapt (transform) a signature called a pre-signature into a signature of the digital signature scheme. The adaptor signature scheme is a cryptographic technique proposed by Andrew Poelstra in 2017. In addition, the adaptor signature scheme was formulated as an independent cryptographic primitive by Lukas Aumayr et al. in 2021 (see Non-Patent Document 2). In the present invention, the conventional two-party adapter signature scheme is expanded to a three or more party adapter signature scheme, which will be hereinafter referred to as an N-party adapter signature scheme.

[0020] The N-party adaptor signature scheme NAS consists of the conventional digital signature scheme Σ (Figure 1) which consists of three algorithms Σ1, Σ2, and Σ3, and five algorithms NAS1, NAS2, NAS3, NAS4, and NAS5 (Figure 2) which use the computationally difficult algebraic relation (Y, y) ∈ R. A hard algebraic relation R is a relation based on an algebraically hard problem for which the probability of an algorithm that can be solved in polynomial time is negligibly small. Here, Y is called the public statement and y is called the secret witness. For example, if the discrete logarithm problem is used as a hard problem, then G= <g>(g is a generator) is a cyclic group of prime order q, Z q Let Y be the set of all integers less than q, then the algebraic relation R that is difficult to compute is R={(Y,y)|Y=g y }∈G×Z q This algebraic relation R that is difficult to compute can be defined according to the computational security that is the basis for the security of the adapter signature scheme that it constitutes, such as a lattice problem other than the discrete logarithm problem. Here, an overview of each algorithm will be given.

[0021] (Overview of digital signature method) As shown in Figure 1, the three algorithms that make up the digital signature scheme Σ are KeyGen algorithm Σ1, Sign algorithm Σ2, and Verify algorithm Σ3.

[0022] The KeyGen (key generation) algorithm Σ1 is an algorithm that inputs a security parameter λ and outputs a private key (signature key) sk and a public key (verification key) pk. The security parameter λ is a numerical value (e.g., key length) that indicates a predetermined level of security. The Sign algorithm Σ2 is an algorithm that inputs a public key pk, a private key sk, and data M, and outputs a signature σ. Verify algorithm Σ3 is an algorithm that inputs a public key pk, a signature σ, and data M, and outputs a verification result. Verify algorithm Σ3 outputs "1" as a verification result if the signature σ is a valid signature of data M, and outputs "0" as a verification result if it is not a valid signature.

[0023] (Overview of the N-party adapter signature scheme) As shown in Figure 2, the five algorithms that make up the N-party adapter signature scheme (NAS) are PreSign Un Algorithm NAS1, PreVerify Ui Algorithm NAS2, PreAdapt Ui Algorithm NAS3, Adapt U1 Algorithm NAS4, Ext Ui The algorithm is NAS5. Here, N (N=n; n is an integer ≥ 3) entities (devices) for implementing the N-party adapter signature scheme NAS are represented as U 1 ,…,U i ,…,U n Let us assume that.

[0024] The inputs and outputs of the five algorithms constituting the N-party adapter signature scheme NAS will be described below with reference to FIGS. In addition, in Fig. 3, U 1 PreVerify is executed U1 is U i PreVerify is executed Ui This is the same as the case of i=1 in U n Ext executed by Un is U i Ext executed by Ui This is the same as the case of i=n in U i ,U n Verify is executed Ui ,Verify Un is the verify algorithm Σ3 of the digital signature scheme Σ described in Figure 1.

[0025] PreSign Un (Pre-signature) Algorithm NAS1 is n In U n Public key pk n and the private key sk n Pair with (pk n ,sk n ) and U n-1 Public information published by Y n-1 Enter data M and U n Pre-signature of σ n This is an algorithm that outputs U 1 All entities except U generate pre-signatures. 1 ,U n Entities other than U i (2≦i <n)は、PreAdapt Ui This PreSign is generated by the algorithm NAS3. Un Algorithm NAS1 is n It is executed only by

[0026] PreVerify Ui (Pre-validation) Algorithm NAS2 is U n Entities other than U i (1≦i <n)において、U i From U n-1 Public information up to now (Y i ,…,Y n-1 ) and U i+1 From U n Public key (pk i+1 ,…,pk n ) and U i+1 From U n The pre-signature (σ i+1 ,…,σ n ) and data M, and outputs the verification result for each pre-signature. Ui Algorithm NAS2 uses pre-signature (σ i+1 ,…,σ n If the pre-signature of data M is correct, the verification result is “1”, otherwise the verification result is “0”. i+1 ,…,σ n ) for each

[0027] PreAdapt Ui (Pre-adaptation) Algorithm NAS3 is 1 ,U n Entities other than U i (2≦i <n)において、U i Confidential Information of i and the private key sk i And, U i-1 Public Information Y i-1 And, U i+1 Pre-signature of σ i+1 Enter data M and U i Pre-signature of σ i This is an algorithm that outputs

[0028] Adapt U1 (Adaptive) Algorithm NAS4 uses entity U 1 In this case, confidential information 1 And, U 2 Public key pk 2 and pre-signature σ 2 Enter data M and U 1 The signature of σ 1 This is an algorithm that outputs

[0029] Ext Ui The (extraction) algorithm NAS5 is 1 Entities other than U i For (2≦i≦n), U i-1 Public Information Y i-1 and pre-signature σ i-1 And, U i Pre-signature of σ i If the pre-signature is correct, i-1 Confidential Information of i-1 otherwise, it outputs a predetermined error code ⊥. The specific processing of each algorithm will be described in the explanation of the configuration of adapter signature system 100 (FIG. 4).

[0030] [Adapter Signing System Configuration] Next, the configuration of an adapter signature system 100 according to an embodiment of the present invention will be described with reference to FIG.

[0031] Adapter signature system 100 is a system in which N parties (three or more parties) sequentially generate and relay pre-signatures for data, and generate an adapter signature that integrates the signatures of the N parties (N-party adapter signature). The adapter signature system 100 is configured by connecting a digital signature generation device 1, a pre-signature relay device 2, and a pre-signature generation device 3 to a network NT. Here, in order to make it easier to understand the corresponding relationships between the digital signature generation device 1, the pre-signature relay device 2, and the pre-signature generation device 3, the devices are shown as being directly connected, but they may also be connected via the network NT. Note that one pre-signature relay device 2 is disposed between the digital signature generation device 1 and the pre-signature generation device 3, or two or more pre-signature relay devices 2 are connected in series. Also, in this example, a digital signature verification device 4 that verifies a signature generated by the adapter signature system 100 is connected to the network NT.

[0032] The digital signature generating device 1 is an entity U described in FIG. 1 The pre-signing relay device 2 corresponds to the entity U i The pre-signature generating device 3 corresponds to the entity U n In addition, the pre-signing relay device 2 corresponds to the entity U 2 ,…,U i ,…,U n-1 In the following, we will omit the entity notation and simply use U i Also, entity U i For the entity U that relays the pre-signature i+1 The first step is the relay entity U i-1 is called the latter stage.

[0033] Here, an example will be described in which the data to be signed is the claim information CL of the history information described in Fig. 10. That is, the digital signature generation device 1 is an entrusting device that entrusts an action on content (photographing, etc.). The pre-signature relay device 2 is an entrustee device (including a sub-entrustee) to which the action has been entrusted. The pre-signature generation device 3 is an apparatus that serves as the signature source for data further entrusted by the pre-signature relay device 2, the final entrustee.

[0034] Digital signature generator 1(U 1 ) is a pre-signature relay device 2 (U i ) to generate a digital signature by combining the signatures of N parties. Here, the digital signature generation device 1 records, on behalf of the delegator, information identifying the action taken on the content by the delegator (including the sub-delegator), specifically, a list of URIs of assertion AS (claim information CL: Figure 10) containing information on the action (who did what, when), and a signature (digital signature SI: Figure 10), as provenance information (manifest) MF.

[0035] Note that the assertion AS of the history information MF (FIG. 10) also includes a hash value for linking the content and the history information MF, as in conventional C2PA; however, since this is not directly related to the present invention, it will not be explained further below. Also, here, the history information MF is recorded on the block chain BC as a recording device on the network NT. This block chain BC is a common technology, so a description thereof will be omitted.

[0036] Pre-signature relay device 2 (U i ) is the entity in the previous stage (pre-signature generator 3 (U n ) or other pre-signature relay device 2(U i+1 )) generates a new pre-signature and sends it to the downstream entity (pre-signature relay device 2 (U i-1 ) or digital signature generator 1 (U 1 The pre-signature relay device 2 relays the signature to the previous entity U i+1 ,…,U n The pre-signature generated by i-1 will broadcast it to. Pre-signature generation device 3 (U n ) generates a pre-signature that is the basis for a digital signature.

[0037] The digital signature verification device 4 verifies the digital signature attached to the data. Here, the digital signature verification device 4 verifies the history information MF recorded on the block chain BC. The digital signature verification device 4 can verify the authenticity of the content corresponding to the history information MF by verifying the signature (digital signature) included in the history information MF. Each of the devices (entities) constituting adapter signature system 100 will be described below.

[0038] [Configuration of the digital signature generating device] First, the configuration of the digital signature generating device 1 will be described with reference to Fig. 5. The digital signature generating device 1 shown in Fig. 5 corresponds to the entity U in Fig. 4. 1 is equivalent to.

[0039] Digital signature generation device 1 includes a private public information generation unit 10, a public information transmission unit 11, a pre-signature information reception unit 12, a pre-signature verification unit 13, a signature generation unit 14, and a storage unit 15. Digital signature generation device 1 further includes a verification signature transmission unit 50, a key generation unit 51, an own data signature generation unit 52, and a signature information output unit 53. Note that when digital signature generation device 1 only has the function of generating a digital signature, verification signature transmission unit 50, key generation unit 51, and own data signature generation unit 52 are not essential components.

[0040] The secret public information generating unit 10 can use any method for generating the secret public information as long as it has an algebraic relationship that is difficult to calculate. Here, the method is based on an algebraic relationship that is difficult to calculate in the discrete logarithm problem of Schnorr signatures. The secret public information generation unit 10 divides G into a cyclic group of prime order q, Z q Let be the set of all integers less than q, then Z q Randomly select y with a bit length corresponding to the security parameter λ (y←Z q ) and confidential information 1 (=y). The private disclosure information generating unit 10 uses the generator g of the cyclic group G to obtain g y Calculate Y (Y=g y ), Public Information Y 1 (=Y). In other words, the algebraic relation R that is difficult to compute is R={(Y,y)|Y=g y }∈G×Z q It is defined as: The prime order q and the generator g are common information that are set in advance throughout the entire system. The private public information generating unit 10 generates the private information y 1 and public information Y 1 The secret public information generating unit 10 stores the public information Y 1 to the public information transmitting unit 11.

[0041] The public information transmission unit 11 transmits the public information Y 1 The pre-signature relay device 2 (U 2 )

[0042] The pre-signature information receiving unit 12 receives the pre-signature relay device 2 (U 2 ) to all pre-signature relays 2 (U 2 ,…,U n-1 ) generated public information (Y 2 ,…,Y n-1 ), and all pre-signature relay devices 2 and pre-signature generators 3 (U n ) and the public keys (pk 2 ,…,pk n ) and pre-signature (σ 2 ,…,σ n ) and data M as pre-signature information. Here, the data M is information that specifies an action to be taken on the content. The pre-signature information receiving unit 12 receives public information (Y 2 ,…,Y n-1 ) and the public key (pk 2 ,…,pk n ) and pre-signature (σ 2 ,…,σ n ) and the data M to the pre-signature verification unit 13.

[0043] The pre-signature verification unit 13 verifies all pre-signatures (σ 2 ,…,σ n ) to verify The pre-signature verification unit 13 is Ui (Pre-verification) The public information Y stored in the storage unit 15 is verified by the algorithm NAS2 (see FIG. 2). 1 and the public information (Y 2 ,…,Y n-1 ), public key (pk 2 ,…,pk n ) and the data M, the pre-signature (σ 2 ,…,σ n ) to calculate the verification result. Specifically, the pre-signature verification unit 13 verifies the pre-signature σ j For each (2≦j≦n), verify whether the equality in the following equation (1) is true (equal) or not. If it is true, the verification result is "1", otherwise the verification result is "0".

[0044]

number

[0045] where r j and s j is the pre-signature relay device 2 (U i+1 ) generated by the pre-signature generator 26 (FIG. 6) j =(r j ,s j ,s j+1 ′), or the value of the pre-signature generator 3 (U n ) generated by the pre-signature generator 32 (FIG. 7) j =(r j ,s j ) are the values ​​of the elements that make up the H is a cryptographic hash function that converts an input of any length into an output of a fixed length. This hash function H is a common function that is preset throughout the system. "||" indicates concatenation. The same applies to the other formulas below.

[0046] All pre-signatures σ i If it is verified that the pre-signature of the data M is correct, the pre-signature verification unit 13 uses the public key pk 2 , pre-signature σ 2 and outputs data M to signature generation unit 14. Pre-signature σ i If it is verified that any one or more of the above is not a correct pre-signature for the data M, the pre-signature verification unit 13 displays an error message on a display device or the like (not shown) of the digital signature generation device 1 indicating that the pre-signature is invalid, and aborts the processing.

[0047] The signature generation unit 14 generates the pre-signature σ 2 This converts the above into a signature for the digital signature method. The signature generation unit 14 U1 (Adaptation) The secret information y stored in the memory unit 15 is calculated by the algorithm NAS4 (see FIG. 2). 1 and the public key pk input from the pre-signature verification unit 13 2 and pre-signature σ 2 Then, the signature σ for the data M is 1 Generate. Specifically, the signature generating unit 14 generates the input pre-signature σ 2 =(r 2 ,s 2 ,s 3 ')s 2 and confidential information 1 Add and the value is s 1 (s 1 =s 2 +y 1 ) The signature generating unit 14 2 ands 1 A signature σ consisting of 1 =(r 2 ,s 1 ) The signature generating unit 14 generates the signature σ 1 to verification signature transmitting unit 50. In addition, the signature generation unit 14 generates the public key pk 2 , signature σ 1 And the data M is output to the signature information output unit 53 .

[0048] The storage unit 15 stores various information used by the digital signature generation device 1, and can be configured with a general storage medium such as a semiconductor memory. Here, the storage unit 15 stores the private information y 1 and Public Information Y 1 and the secret key sk generated by the key generation unit 51 1 and the public key pk 1 and remember.

[0049] The verification signature transmission unit 50 transmits the signature σ 1 The pre-signature relay device 2 (U 2 ) as a signature for verification. 1 In the pre-signature relay device 2, the secret information y 1 In addition, the pre-signature relay device 2 (U 2 ) generates a signature σ from the provenance information MF recorded on the blockchain BC. 1 or confidential information 1 In the case where the verification signature is not extracted, the digital signature generating device 1 does not need to include the verification signature transmitting unit 50.

[0050] The key generation unit 51 generates a private key (signature key) and a public key (verification key) for a digital signature method. The key generation unit 51 generates a secret key sk (sk 1 ) and public key pk(pk 1 ) and

[0051] Specifically, the key generation unit 51 generates Z q Let be the set of all integers less than q, then Z q Randomly select x with a bit length corresponding to the security parameter λ from 1 (sk 1 =x←Z q ) In addition, the key generation unit 51 uses the generator g of the cyclic group G to generate g x Calculate and set as X (X=g x ∈G), public key pk 1 (=X). The key generation unit 51 generates the secret key sk 1 and the public key pk 1 and are stored in the storage unit 15.

[0052] The self-data signature generating unit 52 generates data M, which is information specifying the action that the entrusting source itself will take on the content. 1 It generates a signature (digital signature) for The data signature generating unit 52 generates the private key sk stored in the storage unit 15 by the Sign (signature) algorithm Σ2 (see FIG. 1). 1 and the public key pk 1 and the externally input data M 1 and the signature σ 1 ' is generated. The data signature generating unit 52 generates the public key pk 1 , signature σ 1 ′ and data M 1 is output to the signature information output unit 53. In addition, the data M, such as the fact that the consignor does not take any action on the consigned content, 1 In the case where the data M and the like are not written into the history information MF, the digital signature generating device 1 does not need to include the key generating unit 51 and the own data signature generating unit 52.

[0053] The signature information output unit 53 records the signature information corresponding to the data M of the entrustee as history information MF in a recording device (blockchain BC) on the network. The signature information output unit 53 also records the data M generated by the digital signature generation device 1 itself as history information MF. 1 The signature information corresponding to the transaction is also recorded as history information MF in a recording device (blockchain BC) on the network. The signature information output unit 53 outputs data M,M which is information for specifying an action for the content. 1 Let CL be the claim information (Figure 10) and σ be the signature. 1 ,σ 1 ′ and the public key pk 2 ,pk 1 The provenance information MF is generated by writing each of the above in the digital signature SI (Figure 10) area and recording it on the blockchain BC.

[0054] With the above-described configuration, the digital signature generation device 1 can realize an N-party adapter signature scheme that integrates signatures from N parties (three or more parties). Furthermore, the digital signature generation device 1 can record the history information of the content by replacing the pre-signature generated by the pre-signature relay device 2, which is a trustee (sub-trustee), with its own signature. This digital signature generating device 1 can be operated by a program that causes a computer (not shown) to function as each of the above-mentioned units.

[0055] [Configuration of pre-signature relay device] Next, the configuration of the pre-signature relay device 2 will be described with reference to Fig. 6. The pre-signature relay device 2 shown in Fig. 6 is an entity U i The digital signature generating device 1 shown in FIG. 6 corresponds to the entity U 1 but the entity U i-1 4. The pre-signature relay device 2 shown in FIG. 6 may be the entity U n but the entity U i+1 In some cases, the pre-signature relay device 2 may be the pre-signature relay device 2.

[0056] The pre-signature relay device 2 includes a key generation unit 20, a private public information generation unit 21, a public information transmission unit 22, a public information reception unit 23, a pre-signature information reception unit 24, a pre-signature verification unit 25, a pre-signature generation unit 26, and a pre-signature information transmission unit 27. The pre-signature relay device 2 further includes a verification signature transmission unit 60, a verification signature reception unit 61, a signature verification unit 62, and a private information extraction unit 63. Note that when the pre-signature relay device 2 only has the function of relaying the pre-signature information, the verification signature transmission unit 60, the verification signature reception unit 61, the signature verification unit 62, and the private information extraction unit 63 are not essential components.

[0057] The key generation unit 20 generates a private key (signature key) and a public key (verification key) for a digital signature method. The key generation unit 20 generates a secret key sk (sk i ) and public key pk(pk i ) and The key generation unit 20 generates the secret key sk i and the public key pk i and are stored in the storage unit 28.

[0058] The private / public information generating unit 21 generates private information and public information that form an algebraic relationship that is difficult to calculate and is used in the adapter signature scheme. The secret public information generation unit 21 divides G into a cyclic group of prime order q, Z q Let be the set of all integers less than q, then Z q Randomly select y with a bit length corresponding to the security parameter λ (y←Z q ) and confidential information i (=y). In addition, the private disclosure information generating unit 21 uses the generator g of the cyclic group G to obtain g y Calculate Y (Y=g y ), Public Information Y i (=Y). In other words, the algebraic relation R that is difficult to compute is R={(Y,y)|Y=g y }∈G×Z q It is defined as: The private public information generating unit 21 generates the private information y i and public information Y i The secret public information generating unit 21 stores the public information Y i to the public information transmitting unit 22.

[0059] The public information transmission unit 22 transmits the public information Y i The entity in the previous stage (pre-signature generator 3 (U n ) or other pre-signature relay device 2(U i+1 )).

[0060] The public information receiving unit 23 receives the public information from the downstream entity (digital signature generating device 1 (U 1 ) or other pre-signature relay device 2(U i-1 )) from public information Y i (Figure 5) or Public Information Y i-1 The receiver receives the signal. The public information receiving unit 23 receives the public information Y i-1 is stored in the storage unit 28.

[0061] The pre-signature information receiving unit 24 receives the public key (pk n ) and pre-signature (σ n ) and data M as pre-signature information. i+1 If the pre-signature relay device 2 is another pre-signature relay device 2, the pre-signature information receiving unit 24 receives the pre-signature information from the previous pre-signature relay device 2 (U i+1 ) from public information (Y i+1 ,…,Y n-1 ) and the public key (pk i+1 ,…,pk n ) and pre-signature (σ i+1 ,…,σ n ) and data M as pre-signature information. The pre-signature information receiving unit 24 outputs the received pre-signature information to the pre-signature verifying unit 25 .

[0062] The pre-signature verification unit 25 verifies all pre-signatures (σ i+1 ,…,σ n ) to verify The pre-signature verification unit 25 is Ui (Pre-verification) The public information Y stored in the storage unit 28 is verified by the algorithm NAS2 (see FIG. 2). i and the public information (Y i+1 ,…,Y n-1 ), public key (pk i+1 ,…,pk n ) and the data M, the pre-signature (σ i+1 ,…,σ n ) to calculate the verification result. The pre-signature verification unit 25 verifies the pre-signature σ j For each (i+1≦j≦n), it is verified whether the equality in the above formula (1) is true (equal) or not, and if it is true, the verification result is "1", otherwise the verification result is "0".

[0063] All pre-signatures σ i If it is verified that the pre-signature of the data M is correct, the pre-signature verification unit 25 i+1 ,…Y n-1 ) and the public key (pk i+1 ,…,pk n ) and pre-signature (σ i+1 ,…,σ n ) and the data M to the pre-signature generation unit 26. Pre-signature σ i If it is verified that any one or more of the above is not a correct pre-signature for the data M, the pre-signature verification unit 25 displays an error message on a display device or the like (not shown) of the pre-signature relay device 2 indicating that the pre-signature is invalid, and aborts the processing.

[0064] The pre-signature generation unit 26 generates a pre-signature σ i+1 It generates a new pre-signature that matches its own pre-signature. The pre-signature generation unit 26 Ui (Pre-adaptation) The algorithm NAS3 (see Figure 2) pre-signs σ i+1 and public information Y stored in the storage unit 28. i-1 , confidential information i and the private key sk i From this, we obtain a new pre-signature σ for data M. i Generate.

[0065] Specifically, the pre-signature generating unit 26 generates Z q Let be the set of all integers less than q, then Z q Randomly select k from i Select (k i ←Z q ) and the pre-signature σ is calculated using the following formula (2): i r, one of the components of i Calculate.

[0066]

number

[0067] In addition, the pre-signature generating unit 26 i +r i ·sk i Calculate the value and pre-sign σ i s, one of the components of i (s i =k i +r i ·sk i ) Furthermore, the pre-signature generating unit 26 generates a pre-signature σ i+1 =(r i+1 ,s i+1 )s i+1 and confidential information i and the resulting value is the pre-signature σ i s, one of the components of i+1 ′(s i+1 ′=s i+1 +y 1 ) That is, the pre-signature generating unit 26 generates a pre-signature σ i =(r i ,s i ,s i+1 ′).

[0068] The pre-signature generating unit 26 generates a pre-signature σ i and the public information (Y i+1 ,…,Y n-1 ), public key (pk i+1 ,…,pk n ), pre-signature (σ i+1 ,…,σ n ) and data M to the pre-signature information transmitting unit 27. In addition, the pre-signature generating unit 26 generates a pre-signature σ i to the verification signature transmitting unit 60 and the secret information extracting unit 63. In addition, the advance signature generation unit 26 outputs the data M to the signature verification unit 62.

[0069] The pre-signature information transmission unit 27 transmits public information Y i and the public key pk i , and the public information (Y i+1 ,…,Y n-1 ), public key (pk i+1 ,…,pk n ), pre-signature (σ i ,…,σ n ) and data M to the subsequent entity (digital signature generating device 1(U 1 ) or other pre-signature relay device 2(U i-1 )).

[0070] The storage unit 28 stores various information used by the pre-signature relay device 2, and can be configured with a general storage medium such as a semiconductor memory. Here, the storage unit 28 stores the secret key sk generated by the key generation unit 20. i and the public key pk i and the private information y generated by the private public information generating unit 21. i and Public Information Y i and public information Y received by the public information receiving unit 23. i-1 and remember.

[0071] The verification signature transmission unit 60 transmits the pre-signature σ i The entity in the previous stage (pre-signature generator 3 (U n ) or other pre-signature relay device 2(U i+1 )) as a verification signature. i The entity in the previous stage (pre-signature generator 3 (U n ) or other pre-signature relay device 2(U i+1 )) Confidential Information i It is used to extract the secret information y i In the case where the pre-signature relay device 2 does not extract the signature, the pre-signature relay device 2 does not need to include the verification signature transmitting unit 60.

[0072] The verification signature receiving unit 61 receives the digital signature from the downstream entity (digital signature generating device 1 (U 1 ) or other pre-signature relay device 2(U i-1 )), the signature σ 1 (Fig. 5) or verification signature σ i-1 The pre-signature relay device 2 (U 2 ), the verification signature receiving unit 61 receives the signature σ 1 may be obtained from the provenance information MF recorded on the blockchain BC. The verification signature receiving unit 61 receives the verification signature σ i-1 to the signature verification unit 62 and the secret information extraction unit 63.

[0073] The signature verification unit 62 receives the verification signature σ i-1 This is to verify the following. The signature verification unit 62 generates the pre-signature σ by the pre-signature generation unit 26 using a verify algorithm Σ3 (see FIG. 1). i The data M generated when the public key (verification key) pk stored in the storage unit 28 i From this, the verification signature σ i-1 Verification will be performed. The signature verification unit 62 verifies the verification signature σ i-1 If the signature is correct, the verification result is output to the secret information extraction unit 63 as “1”, and if the signature is not correct, the verification result is output as “0”.

[0074] The secret information extraction unit 63 extracts the public information Y i-1 The secret information corresponding to the The secret information extraction unit 63 is Ext Ui (Extraction) The public information Y stored in the memory unit 28 is extracted by the algorithm NAS5 (see FIG. 2). i-1 and the pre-signature σ generated by the pre-signature generator 26. i and the verification signature σ received by the verification signature receiving unit 61. i-1 Therefore, confidential information i-1 Extract. Here, the secret information extraction unit 63 extracts the verification signature σ i-1 The secret information is extracted only when the verification result is correct (when the signature verification unit 62 inputs "1" as the verification result).

[0075] Specifically, the secret information extraction unit 63 extracts the secret information of the entity U of the pre-signature relay device 2. i If i is 3 or more, pre-signature σ i =(r i ,s i ,s i+1 ′) and pre-signature σ i-1 =(r i-1 ,s i-1 ,s i ′) to s i ′-s i Calculate the value of the secret information y i-1 (y i-1 =s i ′-s i ) In addition, the secret information extraction unit 63 extracts the secret information of the entity U i If i is 2, pre-signature σ 2 =(r 2 ,s 2 ,s 3 ′) and pre-signature σ 1 =(r 2 ,s 1 ) to s 1 -s 2 Calculate the value of the secret information y 1 (y 1 =s 1 -s 2 ) where y i-1 is defined as a computationally intractable algebraic relation R (Y i-1 ,y i-1 )∈R, the secret information extraction unit 63 extracts the secret information from the subsequent entity (digital signature generation device 1(U 1 ) or other pre-signature relay device 2(U i-1 Confidential Information of i-1 The value is output externally as being the same as On the other hand, y i-1 (Y i-1 ,y i-1 )∈R is not satisfied, the private information extraction unit 63 outputs a predetermined error code ⊥ to the outside. This confidential information i-1 This can be used as a key for the entrustee managing the pre-signed relay device 2 to receive remuneration for editing the content from the entrustor. In addition, the pre-signature relay device 2 receives the secret information y i-1 When the verification signature receiving unit 61, the signature verifying unit 62 and the secret information extracting unit 63 are not extracted, the verification signature receiving unit 61, the signature verifying unit 62 and the secret information extracting unit 63 are not required.

[0076] With the above-described configuration, the pre-signature relay device 2 can relay a pre-signature of the N-party adapter signature scheme in which signatures from N parties (three or more parties) are integrated. This pre-signature relay device 2 can be operated by a program that causes a computer (not shown) to function as each of the above-mentioned units.

[0077] [Configuration of pre-signature generation device] Next, the configuration of the pre-signature generating device 3 will be described with reference to Fig. 7. The pre-signature generating device 3 shown in Fig. 7 is an entity U n is equivalent to. The pre-signature generation device 3 includes a key generation unit 30, a public information receiving unit 31, a pre-signature generation unit 32, and a pre-signature information transmitting unit 33. Furthermore, the pre-signature generation device 3 includes a verification signature receiving unit 71, a signature verification unit 72, and a private information extraction unit 73. Note that when the pre-signature generation device 3 only has the function of generating and transmitting pre-signature information, the verification signature receiving unit 71, the signature verification unit 72, and the private information extraction unit 73 are not essential components.

[0078] The key generation unit 30 generates a private key (signature key) and a public key (verification key) for a digital signature method. The key generation unit 30 generates a secret key sk (sk n ) and public key pk(pk n ) and The key generation unit 30 generates the secret key sk n and the public key pk n and are stored in the storage unit 34.

[0079] The public information receiving unit 31 receives the public information from the subsequent entity (the pre-signature relay device 2 (U n-1 )) from public information Y n-1 (Public Information Y in Figure 6 i ) is received. The public information receiving unit 31 receives the public information Y n-1 is stored in the storage unit 34.

[0080] The pre-signature generation unit 32 generates a pre-signature of the N-party adapter signature scheme for data M. The data M is information specifying an action to be taken by a sub-entrustee managing the pre-signature generation apparatus 3 on content. The pre-signature generating unit 32 is a PreSign Un (Pre-signature) Public information Y stored in the memory unit 34 is signed by the algorithm NAS1 (see FIG. 2). n-1 and the private key sk n and the public key pk n From this, a pre-signature σ for the externally input data M is n Generate.

[0081] Specifically, the pre-signature generating unit 32 generates Z q Let be the set of all integers less than q, then Z q Randomly select k from n Select (k n ←Z q ) and the pre-signature σ is calculated using the following formula (3): n r, one of the components of n Calculate.

[0082]

number

[0083] In addition, the pre-signature generating unit 32 n +r n ·sk n Calculate the value and pre-sign σ n s, one of the components of n (s n =k n +r n ·sk n ) That is, the pre-signature generating unit 32 generates a pre-signature σ n =(r n ,s n ) The pre-signature generator 32 generates the public key pk n , pre-signature σ n And the data M is output to the pre-signature information transmitting unit 33 . In addition, the pre-signature generating unit 32 generates a pre-signature σ n to the secret information extraction unit 73. Furthermore, the advance signature generation unit 32 outputs the data M to the signature verification unit 72.

[0084] The pre-signature information transmission unit 33 receives the public key pk n , pre-signature σ n and data M, to the pre-signature relay device 2 (U n-1 )

[0085] The storage unit 34 stores various information used by the pre-signature generation device 3, and can be configured with a general storage medium such as a semiconductor memory. Here, the storage unit 34 stores the secret key sk generated by the key generation unit 30. n and the public key pk n and public information Y received by the public information receiving unit 31. n-1 and remember.

[0086] The verification signature receiving unit 71 receives the signature from the subsequent entity (pre-signature relay device 2 (U n-1 )) to obtain the verification signature σ n-1 (Pre-signature σ in Fig. 6) i ) is received. The verification signature receiving unit 71 receives the verification signature σ n-1 to the signature verification unit 72 and the secret information extraction unit 73.

[0087] The signature verification unit 72 receives the verification signature σ n-1 This is to verify the following. The signature verification unit 72 generates the pre-signature σ by the pre-signature generation unit 32 using a verify algorithm Σ3 (see FIG. 1). n The data M generated when the public key (verification key) pk stored in the storage unit 34 n From this, the verification signature σ n-1 Verification will be performed. The signature verification unit 72 verifies the verification signature σ n-1 Verification will be performed. The signature verification unit 72 verifies the verification signature σ n-1 If the signature is correct, the verification result is output to the secret information extraction unit 73 as "1", and if the signature is not correct, the verification result is output as "0".

[0088] The secret information extraction unit 73 extracts the public information Y n-1 The secret information corresponding to the The secret information extraction unit 73 extracts Ext Ui (Extraction) The public information Y stored in the memory unit 28 is extracted by the algorithm NAS5 (see FIG. 2). n-1 and the pre-signature σ generated by the pre-signature generator 32. n and the verification signature σ received by the verification signature receiving unit 71. n-1 Therefore, confidential information n-1 Extract. The secret information extraction unit 73 extracts the secret information y n-1 Extract. where y n-1 is defined as a computationally intractable algebraic relation R (Y n-1 ,y n-1 )∈R, the secret information extraction unit 73 extracts the secret information from the subsequent entity (another pre-signature relay device 2 (U n-1 Confidential Information of n-1 The value is output externally as being the same as On the other hand, y n-1 (Y n-1 ,y i-1 )∈R is not satisfied, the private information extraction unit 63 outputs a predetermined error code ⊥ to the outside. This confidential information n-1 can be used as a key for a trustee managing the pre-signature generation device 3 to receive remuneration for editing the content from the trustor. The pre-signature generating device 3 receives the secret information y n-1 When the verification signature receiving unit 71, the signature verifying unit 72, and the secret information extracting unit 73 are not extracted, the verification signature receiving unit 71, the signature verifying unit 72, and the secret information extracting unit 73 are not required.

[0089] With the above-described configuration, the pre-signature generation device 3 can generate a pre-signature of the N-party adapter signature scheme that integrates signatures from N parties (three or more parties). The pre-signature generating device 3 can be operated by a program that causes a computer (not shown) to function as each of the above-mentioned units.

[0090] [Configuration of the digital signature verification device] Next, the configuration of the digital signature verification device 4 will be described with reference to Fig. 8. The digital signature verification device 4 includes a signature information acquisition unit 40 and a signature verification unit 41.

[0091] The signature information acquisition unit 40 acquires data M and its corresponding signature and public key as signature information. Here, the signature information acquisition unit 40 acquires the history information MF recorded on the block chain BC as the signature information. The signature information acquisition unit 40 sequentially acquires the history information MF from the top of the block chain BC corresponding to the content for which the content user wishes to check the history, as specified by the content user. The signature information acquisition unit 40 outputs the data M, the signature σ, and the public key pk included in the history information MF to the signature verification unit 41. Note that the data M, the signature σ, and the public key pk are respectively the data M, the signature σ, and the public key pk shown in FIG. 1 and the public key pk 2 , or Data M 1 , signature σ 1 ′ and the public key pk 1 is equivalent to. The signature information acquisition unit 40 acquires all content history information from the beginning of the block chain BC and outputs it to the signature verification unit 41.

[0092] The signature verification unit 41 verifies the signature σ input from the signature information acquisition unit 40 . The signature verification unit 41 calculates a verification result for the signature σ from the data M and the public key pk included in the history information MF acquired by the signature information acquisition unit 40, using a verify algorithm Σ3 (see FIG. 1). If the signature verifier 41 verifies that the signature σ is a correct signature for the data M, it outputs "1" as the verification result, and if the signature is not correct, it outputs "0" as the verification result. The signature verification unit 41 verifies all the signatures σ included in the history information MF.

[0093] With the above-described configuration, the digital signature verification device 4 can verify the reliability of the content. This digital signature verification device 4 can be operated by a program that causes a computer (not shown) to function as each of the above-mentioned units.

[0094] [How the adapter signing system works] Next, the operation of adapter signature system 100 according to the embodiment of the present invention will be described with reference to FIG. 9 (for the configuration, refer to FIGS. 4 to 7 as appropriate). Here, the device that is the source of the action such as editing the content is the digital signature generating device 1 (entity U 1 ), and the entrusted device is the pre-signature relay device 2 (entity U 2 ), and the subcontracted device is the pre-signature generating device 3 (entity U 3 ) and the number of pre-signature relay devices 2 is one.

[0095] (set up) First, adapter signature system 100 performs the following steps S1 to S8 as a setup. In step S1, the private public information generating unit 10 of the digital signature generating device 1 generates private information y 1 and public information Y 1 and are stored in the storage unit 15. In step S2, the key generation unit 20 of the pre-signature relay device 2 generates a secret key sk of the digital signature method. 2 and the public key pk 2 and are stored in the storage unit 28. In step S3, the key generation unit 30 of the pre-signature generation device 3 generates a secret key sk of the digital signature method. 3 and the public key pk 3 and are stored in the storage unit 34. In step S4, the public information transmission unit 11 of the digital signature generation device 1 transmits the public information Y 1 to the pre-signature relay device 2.

[0096] In step S5, the public information receiving unit 23 of the pre-signature relay device 2 receives the public information Y 1 is received and stored in the storage unit 28. In step S6, the private public information generation unit 21 of the pre-signature relay device 2 generates private information y 2 and public information Y 2 and are stored in the storage unit 28. In step S7, the public information transmission unit 22 of the pre-signature relay device 2 transmits the public information Y 2 to the pre-signature generation device 3. In step S8, the public information receiving unit 31 of the pre-signature generating device 3 receives the public information Y 2 is received and stored in the memory unit 34. With the above operations, the setup of the adapter signature system 100 is completed.

[0097] (Pre-signature relay) Adapter signature system 100 performs the following steps S9 to S18, relays the pre-signature, and generates a digital signature that integrates the signatures of N parties. In step S9, the pre-signature generating unit 32 of the pre-signature generating device 3 Un (Pre-signature) Public information Y stored in the memory unit 34 is signed by the algorithm NAS1 (see FIG. 2). 2 and the private key sk 3 and the public key pk 3 From this, the pre-signature σ 3 Generate. In step S10, the pre-signature information transmission unit 33 of the pre-signature generating device 3 transmits the public key pk 3 and the pre-signature σ generated in step S9 3 and the data M are transmitted to the pre-signature relay device 2 as pre-signature information.

[0098] In step S11, the pre-signature information receiving unit 24 of the pre-signature relay device 2 receives the public key pk 3 and pre-signature σ 3 and data M. In step S12, the pre-signature verification unit 25 of the pre-signature relay device 2 Ui (Pre-verification) The public information Y stored in the storage unit 28 is verified by the algorithm NAS2 (see FIG. 2). 2 and the pre-signature information (public key pk 3 , pre-signature σ 3 , data M) and the pre-signature σ 3 Note that the pre-signature σ 3 If it is verified that the pre-signature is not a correct pre-signature for the data M, the pre-signature relay device 2 stops the subsequent processing (not shown). In step S13, the pre-signature generation unit 26 of the pre-signature relay device 2 Ui (Pre-adaptation) The algorithm NAS3 (see FIG. 2) is used to calculate the public information Y 1 and confidential information 2 and the private key sk 2 and pre-signature σ 3 From this, we obtain a new pre-signature σ for data M. 2 Generate. In step S14, the pre-signature information transmission unit 27 of the pre-signature relay device 2 transmits the public information Y 2 and the public key pk 2 and the pre-signature σ generated in step S13 2 and the public key pk received in step S11 3 and pre-signature σ 3 and the data M are transmitted to the digital signature generation device 1 as pre-signature information.

[0099] In step S15, the pre-signature information receiving unit 12 of the digital signature generating device 1 receives the pre-signature information, which is the public information Y 2 and the public key pk 2 ,pk 3 and pre-signature σ 2 ,σ 3 and data M. In step S16, the pre-signature verification unit 13 of the digital signature generation device 1 Ui (Pre-verification) The public information Y stored in the storage unit 15 is verified by the algorithm NAS2 (see FIG. 2). 1 The pre-signature information received in step S15 (public information Y 2 , public key pk 2 ,pk 3 , pre-signature σ 2 ,σ 3 and data M), the pre-signature σ 2 ,σ 3 Note that the pre-signature σ 2 ,σ 3 If it is verified that at least one of these is not a correct pre-signature for the data M, the digital signature generation device 1 stops the subsequent processing (not shown).

[0100] In step S17, the signature generation unit 14 of the digital signature generation device 1 U1 (Adaptation) The secret information y stored in the memory unit 15 is calculated by the algorithm NAS4 (see FIG. 2). 1 and the public key pk received in step S15 2 and pre-signature σ 2 From this, the signature σ for data M is 1 Generate. In step S18, the signature information output unit 53 of the digital signature generating device 1 outputs the signature σ 1 and the public key pk 2 The data M is output to the outside in correspondence with the above. Here, the signature information output unit 53 outputs the data M as the claim information CL (FIG. 10), the signature σ 1 and the public key pk 2 The system generates provenance information MF by writing the above information in the digital signature SI (Figure 10) area and records it on the blockchain BC. Through the above operations, adapter signature system 100 can relay the pre-signatures and generate a digital signature that integrates the signatures of N parties.

[0101] (Signature verification) Adapter signature system 100 performs the following steps S19 to S26, and verifies the signature (pre-signature) generated by the subsequent entity. In step S19, the verification signature transmission unit 60 of the pre-signature relay device 2 transmits the pre-signature σ 2 is transmitted to pre-signature generation device 3 as a signature for verification. In step S20, the verification signature receiving unit 71 of the pre-signature generating device 3 receives the pre-signature σ 2 Receive. In step S21, the signature verification unit 72 of the pre-signature generation device 3 verifies the data M and the public key pk stored in the storage unit 34 by the Verify algorithm Σ3 (see FIG. 1). 3 From this, the pre-signature σ received in step S20 2 The pre-signature σ 2 is not a correct pre-signature for data M, pre-signature generation device 3 stops the subsequent process (not shown). In step S22, the secret information extraction unit 73 of the pre-signature generation device 3 extracts Ext Ui (Extraction) The public information Y stored in the memory unit 34 is extracted by the algorithm NAS5 (see FIG. 2). 2 and the pre-signature σ generated in step S9 3 and the verification signature received in step S20, i.e., the pre-signature σ 2 Therefore, confidential information 2 Extract.

[0102] In step S23, the verification signature transmission unit 50 of the digital signature generation device 1 transmits the signature σ 1 The pre-signature relay device 2 transmits the above as a signature for verification. In step S24, the verification signature receiving unit 61 of the pre-signature relay device 2 receives the signature σ 1 Receive. In step S25, the signature verification unit 62 of the pre-signature relay device 2 verifies the data M and the public key pk stored in the storage unit 28 by the Verify algorithm Σ3 (see FIG. 1). 2 Then, the signature σ received in step S24 is 1 The signature σ 1 If it is verified that the signature is not a valid signature for the data M, the pre-signature relay device 2 stops the subsequent processing (not shown). In step S26, the secret information extraction unit 63 of the pre-signature relay device 2 extracts Ext Ui (Extraction) The public information Y stored in the memory unit 28 is extracted by the algorithm NAS5 (see FIG. 2). 2 and the pre-signature σ generated in step S13 2 and the signature σ, which is the verification signature received in step S24. 1 Therefore, confidential information 1 Extract. Through the above operations, the pre-signature relay device 2 and the pre-signature generation device 3 of the adapter signature system 100 can verify the signature and extract the secret information.

[0103] (Signature verification by content consumer) The adapter signature system 100 verifies the signature by the content user through the operations of steps S27 and S28 below. In step S27, the signature information acquisition unit 40 of the digital signature verification device 4 acquires the history information MF recorded on the block chain BC as signature information. In step S28, the signature verification unit 41 of the digital signature verification device 4 verifies the signature σ from the history information MF (data M, signature σ, and public key pk) acquired in step S27 by using the Verify algorithm Σ3 (see FIG. 1). This allows the digital signature verification device 4 to confirm the authenticity of the content. Note that steps S27 and S28 may be performed at any time by a content user who wishes to check the reliability of the content.

[0104] Although an embodiment of the present invention has been described above, the present invention is not limited to this embodiment, and includes design modifications and the like that do not depart from the gist of the present invention. For example, here, the history information, which is signature information, is recorded on the blockchain BC, but it may also be recorded in a database on the cloud.

[0105] Also, here, one digital signature verification device 4 is connected to the adapter signature system 100, but this digital signature verification device 4 can be provided for each content user who wishes to check the content history information, and multiple devices may be connected. [Explanation of symbols]

[0106] 100 Adapter Signature System 1. Digital signature generation device 10 Secret public information generation department 11 Public Information Transmission Department 12 Pre-signature information receiving unit 13 Pre-signature verification unit 14 Signature generation section 15 Storage section 2 Pre-signature relay device 20 Key generation section 21 Confidential Public Information Generation Department 22 Public Information Transmission Department 23 Public Information Receiving Department 24 Pre-signature information receiving unit 25 Pre-signature verification unit 26 Pre-signature generation unit 27 Pre-signature information transmission unit 3 Pre-signature generation device 30 Key generation section 31 Public Information Receiving Department 32 Pre-signature generation unit 33 Pre-signature information transmission unit 4. Digital signature verification device 40 Signature information acquisition section 41 Signature Verification Unit 50 Verification signature transmission unit 51 Key generation section 52 Self-data signature generation unit 53 Signature information output unit 60 Verification signature transmission unit 61 Verification signature receiver 62 Signature Verification Unit 63 Secret information extraction section 71 Verification signature receiver 72 Signature Verification Unit 73 Secret information extraction section BC Blockchain (recording device) MF provenance information (signature information)< / g>

Claims

1. 1. An adapter signature system for generating and relaying pre-signatures for data among three or more entities, and generating a digital signature by aggregating the pre-signatures of the entities, comprising: As one of the entities, a pre-signature generating device that generates a pre-signature for the data by a pre-signature algorithm of an adapter signature scheme; one or more pre-signature relay devices, which are disposed downstream of the pre-signature generation device and serve as one of the entities, generate a new pre-signature for the data from the pre-signature generated by the upstream entity and relay the new pre-signature to the downstream entity; a digital signature generation device, as one of the entities, at a downstream side of the one or more pre-signature relay devices, which generates the digital signature from a pre-signature generated by an entity at a upstream side by an adaptation algorithm of an adapter signature scheme; The pre-signature relay device a private / public information generating unit that generates private information and public information that have a predetermined algebraic relationship; a key generation unit that generates a private key and a public key in a digital signature scheme; a public information receiving unit that receives public information generated by a subsequent entity; a public information transmission unit that transmits the public information generated by the private public information generation unit to a preceding entity; a pre-signature information receiving unit for receiving public information, a public key, and a pre-signature generated by the entity in the previous stage; a pre-signature generation unit that generates a new pre-signature for the data from public information generated by a subsequent entity, the secret information, the private key, and a pre-signature generated by a previous entity; a pre-signature information transmission unit that transmits the public information generated by the private public information generation unit, the public key generated by the key generation unit, and the pre-signature generated by the pre-signature generation unit to a subsequent entity; 1. An adapter signing system comprising:

2. A pre-signature relay device in an adapter signature system including a pre-signature generation device that generates and relays pre-signatures for data among three or more entities and generates a digital signature by integrating the pre-signatures of the entities, one or more pre-signature relay devices provided downstream of the pre-signature generation device, and a digital signature generation device provided downstream of the one or more pre-signature relay devices, a private / public information generating unit that generates private information and public information that have a predetermined algebraic relationship; a key generation unit that generates a private key and a public key in a digital signature scheme; a public information receiving unit that receives public information generated by a subsequent entity; a public information transmission unit that transmits the public information generated by the private public information generation unit to a preceding entity; a pre-signature information receiving unit for receiving public information, a public key, and a pre-signature generated by the entity in the previous stage; a pre-signature generation unit that generates a new pre-signature for the data from public information generated by a subsequent entity, the secret information, the private key, and a pre-signature generated by a previous entity; a pre-signature information transmission unit that transmits the public information generated by the private public information generation unit, the public key generated by the key generation unit, and the pre-signature generated by the pre-signature generation unit to a subsequent entity; A pre-signature relay device comprising:

3. the pre-signature information receiving unit receives public information, public keys, and pre-signatures generated by all preceding entities including the immediately preceding entity; The pre-signature information transmission unit transmits public information, a public key, and a pre-signature generated by all preceding entities including the immediately preceding entity to a subsequent entity.

3. The pre-signature relay device according to claim 2, wherein:

4. a pre-signature verification unit that verifies the pre-signature received by the pre-signature information receiving unit using a pre-verification algorithm of the adapter signature method; The pre-signature relay device according to claim 2 , further comprising:

5. a verification signature transmission unit that transmits the pre-signature generated by the pre-signature generation unit as a verification signature to a preceding entity; a verification signature receiving unit that receives a pre-signature generated by a subsequent entity as a verification signature from the subsequent entity; a signature verification unit that verifies the verification signature received by the verification signature receiving unit using a verification algorithm of an adapter signature scheme; a secret information extraction unit that extracts secret information of a preceding entity from the verification signature verified to be correct by the signature verification unit using an extraction algorithm of an adapter signature scheme; The pre-signature relay device according to claim 2 , further comprising:

6. A program for causing a computer to function as the pre-signature relay device according to any one of claims 2 to 5.

Images