Authentication system, certificate holding device

Abstract

To provide a technology that enables the consignment and verification of electronic certificates while maintaining the anonymity of the holder. [Solution] The authentication system includes an issuing device (10), a first certificate holding device (20), at least one second certificate holding device (30), a verification device (40), and a storage device (50). The first certificate holding device has a first private key and uses public information stored in the storage device to generate a second signature value for verifying the authenticity of part or all of a first electronic certificate, issues a second electronic certificate that is part or all of the first electronic certificate with the generated second signature value attached, and presents the issued second electronic certificate and a second private key corresponding to the first private key to a second certificate holding device. The second certificate holding device uses the second private key to verify whether the second electronic certificate has been presented by the first certificate holding device.

Description

[Technical Field]

[0001] The present disclosure relates to techniques for delegating certificates. [Background technology]

[0002] Non-Patent Document 1 describes anonymous authentication among three parties: an issuer, a holder, and a verifier. In this anonymous authentication, the issuer issues a digital certificate to which a signature of a certain size is attached to a set of attributes related to the holder. The holder selects a set of attributes to disclose from the set of attributes signed by the issuer. The holder deletes attributes other than the selected set, generates a signature for the selected set of attributes, and updates the digital certificate. The verifier can verify that the attributes of the digital certificate updated by the holder are the attributes signed by the issuer, without being able to identify the attributes deleted by the holder. [Prior art documents] [Patent documents]

[0003] [Non-Patent Document 1] Sanders, O.; Efficient Redactable Signature and Application to Anonymous Credentials Summary of the Invention [Problem to be solved by the invention]

[0004] For example, consider a situation where a user of a mobility device entrusts a digital certificate to a trustor who is also a mobility device, and the trustor presents the digital certificate to a verifier who is a power supply service provider, and the trustor receives the power supply service. If the anonymous authentication is applied to such a situation, even if the trustor presents the digital certificate to the verifier, the verifier cannot verify whether the digital certificate was presented at the owner's will.

[0005] The present disclosure provides techniques that allow for the entrustment and verification of digital certificates while preserving the anonymity of the holder. [Means for solving the problem]

[0006] An authentication system according to one aspect of the present disclosure includes an issuing device (10), a first certificate holding device (20), a second certificate holding device (30), a verification device (40), and a storage device (50). The verification device is capable of communicating with the first and second certificate holding devices. The storage device is capable of communicating with the issuing device, the first and second certificate holding devices, and the verification device. The storage device stores public information. The issuing device has an issuer private key and uses the issuer private key to generate a first signature value for verifying that an electronic certificate has been issued to the first certificate holding device. The issuing device issues a first electronic certificate to which the generated first signature value is attached. The issuing device presents the issued first electronic certificate to the first certificate holding device. The first certificate holding device has a first private key. The first certificate holding device uses the public information stored in the storage device to generate a second signature value for verifying the authenticity of part or all of the first electronic certificate. The first certificate holding device issues a second electronic certificate, which is a part or all of the first electronic certificate to which the generated second signature value has been attached. The first certificate holding device presents the issued second electronic certificate and a second private key corresponding to the first private key to the second certificate holding device. The second certificate holding device verifies, using the second private key, whether the second electronic certificate has been presented by the first certificate holding device. The second certificate holding device generates a third signature value to certify the authenticity of the part or all of the second electronic certificate, using public information stored in the storage device. The second certificate holding device issues a third electronic certificate, which is a part or all of the second electronic certificate to which the generated third signature value has been attached. The verification device receives a fourth electronic certificate, which is based on the part or all of the third electronic certificate and has a fourth signature value attached based on the third signature value. The verification device verifies, using the fourth signature value and the public information stored in the storage device, that the fourth electronic certificate has been issued by the issuing device.

[0007] According to an authentication system according to one aspect of the present disclosure, a first certifier-holding device presents a second electronic certificate to a second certificate-holding device together with a second private key corresponding to the first private key, which is known only to the first certifier-holding device. This associates the second electronic certificate with the first certificate-holding device. Therefore, the electronic certificate can be entrusted from the first certificate-holding device to the second certificate-holding device while maintaining the anonymity of the first electronic certificate, and it is possible to verify that the first certificate-holding device intentionally entrusted the electronic certificate to the second certificate-holding device. This in turn prevents an attacker who does not possess the second private key from forging an electronic certificate and impersonating the first or second certificate-holding device.

[0008] In another aspect of the present disclosure, a certificate holding device (20) has a first private key and obtains a first digital certificate including a first signature value generated by an issuing device (10). The certificate holding device generates a second signature value using a public key associated with the issuing device to verify the authenticity of part or all of the first digital certificate. The certificate holding device issues a second digital certificate that is part or all of the first digital certificate with the generated second signature value attached. The certificate holding device entrusts the issued second digital certificate and a second private key corresponding to the first private key to another certificate holding device (30).

[0009] In another aspect of the present disclosure, a certificate holding device entrusts a second electronic certificate to another certificate holding device together with a second private key corresponding to the first private key, which is known only to the certificate holding device. This links the second electronic certificate to the certificate holding device, making it possible to verify that the electronic certificate has been intentionally entrusted to another certificate holding device by the certificate holding device while maintaining the anonymity of the certificate holding device. This in turn prevents an attacker who does not possess the second private key from forging an electronic certificate and impersonating another certificate holding device.

[0010] An authentication method according to yet another aspect of the present disclosure is performed by an authentication system including an issuing device (10), a first certificate holding device (20), a second certificate holding device (30), and a verification device (40), in which the issuing device generates a first signature value for verifying that it has issued an electronic certificate to the first certificate holding device using an issuer private key held by the issuing device, issues the first electronic certificate with the generated first signature value attached, and presents the issued first electronic certificate to the first certificate holding device, the first certificate holding device uses public information to generate a second signature value for verifying the authenticity of part or all of the first electronic certificate, and issues a second electronic certificate that is part or all of the first electronic certificate with the generated second signature value attached, The first certificate holding device presents the issued second electronic certificate and a second private key corresponding to the first private key held by the first certificate holding device to the second certificate holding device, and the second certificate holding device uses the second private key to verify whether the second electronic certificate was presented by the first certificate holding device, and uses the public information to generate a third signature value to certify the authenticity of part or all of the second electronic certificate, and issues a third electronic certificate that is part or all of the second electronic certificate with the generated third signature value attached, and the verification device receives a fourth electronic certificate that is based on part or all of the third electronic certificate and has a fourth signature value attached based on the third signature value attached, and uses the fourth signature value and the public information to verify that the fourth electronic certificate has been issued by the issuing device.

[0011] By carrying out the above authentication method, the same effects as those of the above authentication system can be achieved.

[0012] A certificate delegation method according to yet another aspect of the present disclosure is executed by a certificate holding device (20), and includes obtaining a first electronic certificate including a first signature value generated by an issuing device (10), generating a second signature value using a public key associated with the issuing device to verify the authenticity of all or part of the first electronic certificate, issuing a second certificate that is all or part of the first electronic certificate with the generated second signature value attached, and delegating the issued second electronic certificate and a second private key corresponding to the first private key held by the certificate holding device to another certificate holding device (30).

[0013] By carrying out the certificate entrustment method, the same effects as those of the certificate holding device can be achieved.

[0014] A program according to yet another aspect of the present disclosure causes a certificate holding device (20) to obtain a first electronic certificate including a first signature value generated by an issuing device (10); generate a second signature value using a public key associated with the issuing device to verify the authenticity of all or part of the first electronic certificate; issue a second electronic certificate that is all or part of the first electronic certificate to which the generated second signature value is attached; and entrust the issued second electronic certificate and a second private key corresponding to the first private key possessed by the certificate holding device to another certificate holding device (30).

[0015] The above program provides the same effects as the above certificate holding device. [Brief explanation of the drawings]

[0016] [Figure 1] 1 is a diagram showing an outline of an authentication system according to first and second embodiments. [Figure 2] FIG. 2 is a diagram showing the configurations of an issuing device, a first proof holding device, a second proof holding device, and a verification device according to the first and second embodiments. [Figure 3] FIG. 2 is a diagram illustrating functions of an issuing device, a first proof holding device, a second proof holding device, and a verification device according to the first and second embodiments. [Figure 4]FIG. 2 is a diagram showing a process from certificate issuance to verification according to the first and second embodiments. [Figure 5] FIG. 2 is a diagram illustrating certificate delegation according to the first and second embodiments. [Figure 6A] FIG. 2 is a diagram showing a part of an authentication process performed by the authentication system according to the first embodiment. [Figure 6B] FIG. 10 is a diagram showing the rest of the authentication process by the authentication system according to the first embodiment. [Figure 7] FIG. 2 is a diagram showing a first example of a storage device according to the first and second embodiments. [Figure 8] FIG. 10 is a diagram showing a second example of the storage device according to the first and second embodiments. [Figure 9A] FIG. 10 is a diagram showing a part of an authentication process performed by an authentication system according to a second embodiment. [Figure 9B] FIG. 10 is a diagram showing the rest of the authentication process by the authentication system according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0017] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. (1. First embodiment) <1-1.Configuration> 1 and 2, the configuration of an authentication system 100 according to this embodiment will be described. The authentication system 100 includes an issuing device 10, a first certificate holding device 20, a second certificate holding device 30, a verification device 40, and a storage device 50. The issuing device 10, the first certificate holding device 20, the second certificate holding device 30, the verification device 40, and the storage device 50 can communicate data with each other via a wide-area wireless communication network NW. In another embodiment, at least one of the issuing device 10, the first certificate holding device 20, the second certificate holding device 30, the verification device 40, and the storage device 50 and at least one other of the issuing device 10, the first certificate holding device 20, the second certificate holding device 30, the verification device 40, and the storage device 50 may communicate data with each other via short-range wireless communication such as Bluetooth (registered trademark) or Wi-Fi (registered trademark) or wired communication, instead of via the wide-area wireless communication network NW.

[0018] As shown in FIG. 2, the issuing device 10, the first certificate holding device 20, the second certificate holding device 30, and the verification device 40 each include a control device 1, a communication device 2, and a storage device 3. The control device 1 mainly includes a microcomputer including a CPU 1a, a ROM 1b, and a RAM 1c, and the CPU 1a executes a program stored in a non-transitory tangible recording medium to realize various functions. In this embodiment, the ROM 1b corresponds to the non-transitory tangible recording medium on which the program is stored. Furthermore, the CPU 1a executes the program to execute a method corresponding to the program. Note that some or all of the functions executed by the CPU 1a may be configured using hardware such as one or more ICs. Furthermore, the control device 1 may include multiple microcomputers.

[0019] The communication device 2 performs wireless data communication via a wide area wireless communication network NW. The storage device 3 stores various data. In this embodiment, the issuing device 10 is a device belonging to an issuer, such as a server, an IoT device, a smartphone, a tablet, a PC, or a mobility device. The issuer is an organization that issues digital certificates, such as a government agency, police, certification authority, or manufacturer.

[0020] The first certificate holding device 20 is a device that belongs to a holder, such as a smartphone, tablet, PC, IoT device, server, mobility, etc. The holder is a person who possesses a digital certificate issued by an issuer, and is a user who receives a service provided by presenting the digital certificate.

[0021] The second certificate holding device 30 is a device belonging to the trustor, such as a mobility device, a smartphone, a tablet, a PC, an IoT device, or a server. The trustor receives an electronic certificate from the holder and acts on behalf of the holder. For example, the trustor presents an electronic certificate on behalf of the holder to receive a service.

[0022] The verification device 40 is a device belonging to a verifier. A verifier is an organization that verifies the legitimacy of a digital certificate. An organization that verifies the legitimacy of a digital certificate is, for example, a servicer that provides services to the holder of the digital certificate. The verification device 40 is, for example, a server, an IoT device, a smartphone, a tablet, a PC, mobility, a servicer-managed device, a traffic light, or other device managed by a government agency.

[0023] The storage device 50 stores public information. The public information is related to at least one of the issuing device 10, the first certificate holding device 20, the second certificate holding device 30, and the verifying device 40. For example, the public information is the holder public key uvk of the first certificate holding device 20, the issuer public key clvk of the issuing device 10, the verification public key vrvk, the global parameter prm, a data format, etc. The storage device 50, for example, implements a public key infrastructure. Alternatively, the storage device 50 is a publicly verifiable registry, for example, implements a blockchain.

[0024] As shown in FIG. 3, the issuing device 10 includes a processing unit 11, a storage unit 12, a display unit 13, a communication unit 14, and an interface unit 15, which are implemented by a CPU 1a executing a program stored in a ROM 1b.

[0025] The processing unit 11 executes processing based on syntax or functions. The syntax includes a series of functions. More specifically, as shown in FIG. 4, the processing unit 11 generates a first signature value σ to certify that an electronic certificate has been issued to the first certificate holding device 20, and issues a first electronic certificate to which the first signature value σ is attached to the first certificate holding device 20. The first electronic certificate includes a set of attributes related to the holder. In the example shown in FIG. 4, the first electronic certificate includes attributes for four attribute names: "owner age," "violation points," "violation date," and "name." The first signature value σ certifies that the four attributes included in the first electronic certificate have not been tampered with. The processing unit 11 generates a first signature value σ of a fixed size regardless of the number of attributes included in the first electronic certificate. The generation of the first signature value σ will be described in detail later.

[0026] The storage unit 12 stores data used by the processing unit 11. Specifically, the storage unit 12 stores the attributes of each of the multiple holders to whom the processing unit 11 issues a first digital certificate, the issuer private key clsk of the issuing device 10, and the like.

[0027] The communication unit 14 communicates with the first certificate holding device 20 and the storage device 50. Specifically, the communication unit 14 transmits the first digital certificate to the first certificate holding device 20. The communication unit 14 also receives the holder public key uvk of the first certificate holding device 20 from the storage device 50. In another embodiment, the communication unit 14 may receive the holder public key uvk directly from the first certificate holding device 20. The communication unit 14 may also transmit the issuer public key clvk of the issuing device 10 to the first certificate holding device 20 and the second certificate holding device 30.

[0028] The display unit 13 displays the data stored in the storage unit 12. The display unit 13 also displays the connection destination and connection status of the issuing device 10, the progress status of the certificate issuance process (for example, the fact that syntax / function processing is being executed), etc.

[0029] The interface unit 15 is a touch panel, a keyboard, a voice input device, or the like, and receives instructions from the issuer, such as an instruction to issue a first digital certificate. The first certificate holding device 20 includes a processing unit 21, a storage unit 22, a display unit 23, a communication unit 24, and an interface unit 25.

[0030] The processing unit 21 executes processing based on syntax or functions. More specifically, as shown in FIG. 4, the processing unit 21 uses the issuer public key clvk to generate a second signature value σ' for verifying the correctness of part or all of the first digital certificate, and issues the second digital certificate to which the second signature value σ' is attached. The second digital certificate is part or all of the first digital certificate. The second signature value σ' has the same constant size as the first signature value σ, regardless of the number of attributes included in the second digital certificate. In other words, when expressed using Landau notation, the communication volume is O(1).

[0031] In FIG. 4, the second electronic certificate is part of the first electronic certificate and includes three of the four attributes of the first electronic certificate. The holder selects the attributes to disclose to the trustor from among the multiple attributes included in the first electronic certificate and deletes the attributes not to be disclosed. For example, of the attributes "owner's age," "violation points," "violation date," and "name," the holder selects "owner's age," "violation points," and "violation date" as attributes to be entrusted to the trustor, and selects "name" as an attribute not to be entrusted to the trustor. In this case, the handling of the entrusted attributes is left to the trustor, and the attributes not to be entrusted are kept confidential by the trustor. Note that the processing unit 21 may entrust all of the attributes of the first electronic certificate.

[0032] Furthermore, as shown in FIG. 5, the processing unit 21 generates an entrustor private key usk' corresponding to the holder private key usk, and entrusts the entrustor private key usk' to the entrustor. The entrustor private key usk' may be the same as the holder private key usk. Alternatively, the processing unit 21 may use a value obtained by adding a random number to the holder private key usk as the entrustor private key usk'. The first signature value σ is linked to the holder private key usk, and the second signature value σ' is linked to the entrustor private key usk'.

[0033] The storage unit 22 stores data used by the processing unit 21. Specifically, the storage unit 22 stores the first digital certificate received from the issuing device 10, the holder private key usk of the first certificate holding device 20, and the like.

[0034] The communication unit 24 receives the first digital certificate from the issuing device 10. The communication unit 24 also transmits the second digital certificate to the second certificate holding device 30 together with the trustor private key usk′. Because the second digital certificate is transmitted to the second certificate holding device 30 together with the trustor private key usk′, it is possible to verify that the digital certificate was entrusted to the trustor at the owner's will. Therefore, the trustor can act on behalf of the owner. Even if an attacker who does not possess the trustor private key usk′ forges a digital certificate, they cannot prove the association between the digital certificate and the owner, and therefore cannot impersonate the owner. The communication unit 24 also receives the issuer public key clvk of the issuing device 10 from the storage device 50. In another embodiment, the communication unit 24 may directly receive the issuer public key clvk from the issuing device 10. The communication unit 24 may also transmit the owner public key uvk of the first certificate holding device 20 to the issuing device 10.

[0035] Display unit 23 displays the data stored in storage unit 22. Display unit 23 also displays the connection destination and connection status of first certificate holding device 20, the progress of the certificate issuance process, the entrustment process, etc.

[0036] The interface unit 25 is a touch panel, keyboard, voice input device, etc., and receives instructions from the holder, such as instructions to select attributes to be entrusted, instructions to issue a second digital certificate, instructions to entrust, etc.

[0037] The second certificate holding device 30 includes a processing unit 31, a storage unit 32, a display unit 33, a communication unit , and an interface unit . The processing unit 31 executes processing based on syntax or functions. More specifically, as shown in FIG. 4, the processing unit 31 verifies the validity of the second signature value σ′ using the trustor private key usk′. That is, the processing unit 31 verifies, using the trustor private key usk′, whether the second electronic certificate has been issued by and entrusted to the first certificate holding device 20. If the processing unit 31 can verify the validity of the second signature value σ′, it stores the second electronic certificate in the storage unit 32. Furthermore, the processing unit 31 generates a verification public key vrvk using the trustor private key usk′.

[0038] Furthermore, as shown in FIG. 4, the processing unit 31 uses the issuer public key clvk to generate a third signature value σ′ for certifying the authenticity of part or all of the second digital certificate, and issues a third digital certificate to which the third signature value σ″ is attached. The third digital certificate is part or all of the second digital certificate. The third signature value σ″ has the same constant size as the first signature value σ and the second signature value σ′, regardless of the number of attributes included in the third digital certificate. In other words, when expressed using Landau notation, the communication volume is O(1).

[0039] In FIG. 4, the third digital certificate is part of the second digital certificate and includes two of the three attributes of the second digital certificate. The trustor determines which attributes do not need to be disclosed to the verifier, selects the attributes to disclose from the multiple attributes included in the second digital certificate, and deletes the attributes not to disclose. For example, the trustor selects "owner's age" and "violation points" from "owner's age," "violation points," and "violation date" as attributes to disclose, and selects "violation date" as an attribute not to disclose. The attributes deleted by the trustor are kept secret from the verifier. The processing unit 31 may disclose all of the attributes of the second digital certificate to the verifier. Note that the trustor appears to the verifier as the holder. In other words, the verifier does not distinguish whether the trustor has been entrusted with the digital certificate by the holder or has been issued the digital certificate directly by the issuer.

[0040] The storage unit 32 stores data used by the processing unit 31. Specifically, the storage unit 32 stores the second digital certificate received from the first certificate holding device 20, the trustor private key usk', and the like.

[0041] The communication unit 34 receives the second digital certificate and the trustor private key usk' from the first certificate holding device 20. The communication unit 34 also receives the issuer public key clvk from the storage device 50. The communication unit 34 also transmits the third digital certificate to the verification device 40 and transmits the verification public key vrvk to the storage device 50. In another embodiment, the communication unit 34 may directly receive the issuer public key clvk from the issuing device 10. The communication unit 34 may also transmit the verification public key vrvk to the verification device 40.

[0042] Display unit 33 displays the data stored in storage unit 32. Display unit 33 also displays the connection destination and connection status of second certificate holding device 30, the progress of the certificate issuance process, and the like.

[0043] The interface unit 35 is a touch panel, keyboard, voice input device, etc., and receives instructions from the entrustor, such as an instruction to accept the entrustment, an instruction to select attributes to be disclosed, and an instruction to issue a third digital certificate.

[0044] The verification device 40 includes a processing unit 41 , a storage unit 42 , a display unit 43 , a communication unit 44 , and an interface unit 45 . The processing unit 41 uses the third signature value σ″ and the verification public key vrvk to verify that the third electronic certificate has been issued by the issuing device 10. That is, the processing unit 41 verifies that the third electronic certificate is a part or all of the first electronic certificate issued by the issuing device 10. Then, if the verification of the third electronic certificate is successful, the processing unit 41 starts providing services to the second certificate holding device 30.

[0045] The storage unit 42 stores data used by the processing unit 41. Specifically, the storage unit 42 stores the third digital certificate received from the second certificate holding device 30, the verification public key vrvk, and the like.

[0046] The communication unit 44 receives the third digital certificate from the second certificate holding device 30. The communication unit 44 also receives the verification public key vrvk from the storage device 50. In another embodiment, the communication unit 44 may receive the verification public key vrvk from the second certificate holding device 30. The display unit 43 displays the data stored in the storage unit 42. The display unit 43 also displays the connection destination and connection status of the verification device 40, the progress of the verification process, etc., and the success or failure of the verification.

[0047] The interface unit 45 is a touch panel, a keyboard, a voice input device, etc., and receives instructions from the verifier, such as instructions to execute verification.

[0048] <1-2. Processing> Next, the flow of the entrusted anonymous authentication process will be described with reference to the sequence diagrams of Figures 6A and 6B. This authentication process begins when a holder requests the issuance of a digital certificate via first certificate holding device 20.

[0049] First, in S10, the issuing device 10, the first certificate holding device 20, the second certificate holding device 30, and the verification device 40 use the setup syntax to generate the global parameters prm to be made public. Specifically, the global parameters prm are generated using the following equations (1) and (2). The global parameters prm are specifications for variables and the like commonly used by the issuing device 10, the first certificate holding device 20, the second certificate holding device 30, and the verification device 40. λ is a security parameter.

[0050] The issuing device 10, the first certificate holding device 20, the second certificate holding device 30, and the verification device 40 do not need to generate the global parameters prm simultaneously, and may generate them at their own timing. Also, at least one of the issuing device 10, the first certificate holding device 20, the second certificate holding device 30, and the verification device 40 may generate the global parameters prm and store them in the storage device 50.

[0051]

number

[0052] Next, in S20, the issuing device 10 generates an issuer public key clvk and an issuer private key clsk using the issuer key generation syntax. Specifically, the issuing device 10 randomly samples n+2 elements from an integer set whose order is a prime number p, and generates an input value (x, y0, y1, ... y n ) is obtained. Then, input values ​​(x, y0, y1, ... y n ) to generate an issuer public key clvk and an issuer private key clsk. The issuing device 10 stores the issuer public key clvk in the storage device 50, or stores the issuer public key clvk in the storage unit 22 and transmits it to the first certificate holding device 20. Furthermore, the issuing device 10 stores the issuer private key clsk in the storage unit 12.

[0053]

number

[0054] Next, in S30, the first certificate holding device 20 generates the holder public key uvk and the holder private key usk using the holder key generation syntax. Specifically, the first certificate holding device 20 generates the holder public key uvk and the holder private key usk using the following formula (5). The first certificate holding device 20 stores the holder public key uvk in the storage device 50, or stores the holder public key uvk in the storage unit 22 and transmits it to the issuing device 10. Furthermore, the first certificate holding device 20 stores the issuer private key clsk in the storage unit 22.

[0055]

number

[0056] Next, in S40, the issuing device 10 obtains the holder public key uvk from the storage device 50 or the first certificate holding device 20. Then, the issuing device 10 uses the holder public key uvk, the issuer private key clsk, and the attribute set M to be issued as input to the issuer signature generation syntax, and interacts with the first certificate holding device 20 and the holder signature verification syntax to generate a signature cred (i.e., a first signature value σ) for the attribute set M. The signature cred has a fixed size regardless of the number of attributes included in the attribute set M. Specifically, the issuing device 10 verifies that the first certificate holding device 20 has the holder private key usk. The first certificate holding device 20 executes the PoK protocol, which is a zero-knowledge proof of possession of the holder private key usk, and generates a value π (hereinafter, the proof value) that proves possession of the holder private key usk. The PoK protocol is a method in which the issuing device 10 and the first certificate holding device 20 interact to demonstrate that the first certificate holding device 20 possesses the holder private key usk without revealing the holder private key usk to the issuing device 10. The PoK protocol can be easily implemented by utilizing an existing zero-knowledge proof protocol.

[0057] The first certificate holding device 20 transmits the certification value π to the issuing device 10. The issuing device 10 verifies the correctness of the certification value π using the holder public key uvk. If the verification of the correctness of the certification value π is successful, the issuing device 10 obtains confirmation that the first certificate holding device 20 possesses the holder private key usk linked to the holder public key uvk, even if the holder private key usk remains undisclosed.

[0058] If the verification of the correctness of the certification value π is successful, the issuing device 10 calculates the elements σ1 and σ2 of the signature cred using the following equations (6) and (7), and then issues a digital certificate (i.e., a first digital certificate) including the attribute set M for issuing the digital certificate and the signature cred.

[0059]

number

[0060] Next, in S50, the issuing device 10 transmits the digital certificate to the first certificate holding device 20. Next, in S60, the first certificate holding device 20 obtains the issuer public key clvk from the storage device 50 or the issuing device 10. Then, the first certificate holding device 20 uses the holder private key usk, the issuer public key clvk, the issued attribute set M, and the signature cred as input to the holder signature verification syntax, and interacts with the issuing device 10 and the issuer signature generation syntax to verify the validity of the signature cred. Specifically, the first certificate holding device 20 verifies that the following formula (8) holds for cred=(σ1, σ2) received from the issuing device 10.

[0061] If formula (8) holds, it can be verified that (i) the signing cred is linked to the holder private key usk, and (ii) the signing cred has been made for attribute set M, i.e., the signing cred guarantees the validity of attribute set M. If formula (8) holds, the first certificate holding device 20 determines that the verification of the validity of the signing cred has been successful, and stores the signing cred in the storage unit 22. If formula (8) does not hold, the first certificate holding device 20 determines that the verification of the validity of the signing cred has failed, and outputs a bot to that effect.

[0062]

number

[0063] Next, in S70, the first certificate holding device 20 takes the holder private key usk, the issuer public key clvk, the issued attribute set M, the signature cred corresponding to M, and the attribute set S (∈M) to be entrusted as input to the holder delegation syntax, and generates the entrustor private key usk' and the signature cred' corresponding to the attribute set to be entrusted (i.e., the second signature value σ'). The attribute set S is one or more attributes from the attribute set M that the holder has chosen to entrust to the entrustor. The signature cred' has the same size as the signature cred regardless of the number of attributes included in the attribute set S.

[0064] The first certificate holding device 20 sets the trustor private key usk' to be the same as the holder private key usk. Alternatively, the first certificate holding device 20 may set the value obtained by adding a random number to the holder private key usk as the trustor private key usk'. In other words, the first certificate holding device 20 may set the trustor private key usk' to a value that cannot be generated unless the first certificate holding device 20 possesses the holder private key usk, but that makes it difficult to infer the holder private key usk.

[0065] Furthermore, the first certificate holding device 20 calculates cred'=(σ1',σ2',σ3',σ4') using the following equations (9) to (12). Then, the first certificate holding device 20 issues a entrusted certificate (i.e., a second digital certificate) including the entrusted attribute set S and the signature cred'.

[0066]

number

[0067] Next, in S80, the first certificate holding device 20 transmits the entrustment certificate to the second certificate holding device 30 together with the entrustor private key usk'. Next, in S90, the second certificate holding device 30 inputs the entrustor private key usk', issuer public key clvk, issued attribute set S, and signature cred' into the entrusted signature verification syntax, and verifies the validity of the entrusted signature cred'. Specifically, the second certificate holding device 30 verifies that the following equations (13) and (14) hold for cred'=(σ1',σ2',σ3',σ4') received from the first certificate holding device 20.

[0068] If equation (13) holds, it can be verified that (i) the signature cred' and the trustor private key usk' are linked, and (ii) the signature cred' was made for the attribute set S, i.e., the signature cred' guarantees the validity of the attribute set S.

[0069] Furthermore, since formula (14) holds, it can be verified that σ3' is a value generated by correctly inputting all attributes, including attributes that the first certificate holding device 20 did not entrust. In other words, since formula (14) holds, it can be verified that σ3' is not a value generated by inputting an attribute that the holder did not choose to entrust from the attribute set M after tampering with it. For example, in the example shown in Fig. 4, it can be verified that the holder did not generate σ3' by inputting an attribute "name" that was deleted after tampering with it.

[0070] In addition, if the trustor private key usk' is a value obtained by assigning a random number to the holder private key usk, the second certificate holding device 30 uses a pairing mapping to verify whether the trustor private key usk' is a correct value generated from the holder private key usk.

[0071] The second certificate holding device 30 determines that the verification of the validity of the signature cred' has been successful if formulas (13) and (14) are satisfied. Then, if the verification of the validity of the signature cred' has been successful and the validity of the trustor private key usk' has been verified, the second certificate holding device 30 stores the trustor private key usk' and the signature cred' in the storage unit 32. If formula (13) or (14) is not satisfied, the second certificate holding device 30 determines that the verification of the validity of the signature cred' has failed, and discards the trustor private key usk' and the signature cred'. The second certificate holding device 30 also discards the trustor private key usk' and the signature cred' if the verification of the validity of the trustor private key usk' has failed.

[0072]

number

[0073] Next, at S100, the second certificate holding device 30 generates a verification public key vrvk and a presentation signature cred* (i.e., a third signature value σ″) using the trustor private key usk′, the issuer public key clvk, the entrusted attribute set S, the signature cred′ corresponding to S, and the attribute set S′ to be presented as input to the signature presentation syntax. The attribute set S′ is one or more attributes that the trustor has selected to present to the verifier from the attribute set S. The presentation signature cred* has the same size as the signature cred, regardless of the number of attributes included in the attribute set S′. The second certificate holding device 30 also generates a verification private key vrsk. In this embodiment, the second certificate holding device 30 uses the trustor private key usk′ as the verification private key vrsk.

[0074] Specifically, the second certificate holding device 30 calculates the presentation signature cred*=(σ1″,σ2″,σ3″,σ4″,σ5″) using the following equations (15) to (19). Furthermore, the second certificate holding device 30 calculates the verification public key vrvk=C using the following equation (20). Then, the second certificate holding device 30 issues a presentation certificate (i.e., a third digital certificate) including the presented attribute set S′ and the presentation signature cred*.

[0075]

number

[0076] Next, in S110, the second certificate holding device 30 transmits the presentation certificate together with the verification public key vrvk to the verification device 40. Alternatively, the second certificate holding device 30 transmits the verification public key vrvk to the storage device 50, and transmits the presentation certificate to the verification device 40. Next, in S120, the verification device 40 interacts with the second certificate holding device 30 to verify the validity of the presentation signature cred*. More specifically, the verification device 40 obtains the verification public key vrvk from the storage device 50 or the second certificate holding device 30. Then, the verification device 40 interacts with the second certificate holding device 30, using the verification public key vrvk as an input to the verifier verification syntax and the verification private key vrsk as an input to the presenter proof syntax.

[0077] Specifically, first, the verification device 40 executes the following formula (21). Then, the second certificate holding device 30 executes the following formula (22). Then, the verification device 40 and the second certificate holding device 30 receive notification that the exchange of necessary information between them has ended. Then, the verification device 40 executes the following formula (23) to verify the validity of the presentation signature cred*. If the verification of the validity of the presentation signature cred* is successful, the verification device 40 approves the presentation signature cred*. If the verification of the presentation signature cred* is unsuccessful, the verification device 40 denies the presentation signature cred*.

[0078]

number

[0079]

number

[0080]

number

[0081] An attacker who has not been entrusted by the owner does not possess the entrustor private key usk' or the verification private key vrsk, and therefore cannot pass the necessary information to the verification device 40 in a dialogue with the verification device 40. Therefore, the attacker cannot pass the signature verification.

[0082] <1-3. Modification of the first embodiment> In the first embodiment described above, there is only one trustee. However, as shown in FIGS. 7 and 8, an electronic certificate may be entrusted to multiple trustees in stages. That is, the second certificate holding device 30 plays the role of the first certificate holding device 20, generates an entrustor private key usk" and a new entrustment certificate, and presents the entrustor private key usk" and the new entrustment certificate to the next certificate holding device. The entrustor private key usk" may be the same as the entrustor private key usk', or may be a value obtained by assigning a random number to the entrustor private key usk'. The next certificate holding device may play the role of the first certificate holding device 20 and further entrust to the next certificate holding device, or may play the role of the second certificate holding device 30 and present the verification public key vrvk and the presentation signature source to the verification device 40. There may be any number of certificate holding devices passing through between the first certificate holding device 20 and the verification device 40. Furthermore, the first certificate holding device 20 does not have to be entrusted. That is, the first certificate holding device 20 may generate the verification public key vrvk and the presentation certificate, and the first certificate holding device 20 may present the verification public key vrvk and the presentation certificate to the verification device 40. Even if an electronic certificate is presented after repeated delegation, the verification device 40 sees the party that presented the verification public key vrvk and the presentation certificate to the verification device 40 as the holder.

[0083] <1-4. Effects> According to the first embodiment described above in detail, the following effects are achieved. (1) The first certifier holding device 20 transmits the entrusted certificate to the second certificate holding device 30 together with the entrustor private key usk' corresponding to the holder private key usk, which is known only to the first certifier holding device 20. This links the entrusted certificate to the first certificate holding device 20 and, ultimately, to the holder. Therefore, the electronic certificate can be entrusted from the first certificate holding device 20 to the second certificate holding device 30 while maintaining the anonymity of the holder associated with the first certificate holding device 20, and it can be verified that the first certificate holding device 20 intentionally entrusted the electronic certificate to the second certificate holding device 30. This in turn prevents an attacker who does not possess the entrustor private key usk' from forging an electronic certificate and impersonating the first or second certificate holding device 20, 30.

[0084] (2) The sizes of the signature cred, signature cred', and signature cred' are constant. Therefore, regardless of the number of attributes included in a digital certificate, digital certificates can be issued, entrusted, and verified while maintaining a constant signature size. This ultimately reduces the amount of communication traffic.

[0085] (3) By entrusting the holder private key usk as the entrustor private key usk′, the processing load on the first certificate holding device 20 can be reduced. (4) By generating the trustor private key usk' by adding a random number to the holder private key usk, it is difficult for the second certificate holding device 30 to infer the holder private key usk. Therefore, the risk of the holder private key usk being leaked can be reduced.

[0086] (5) Since the signature cred is generated using the holder public key uvk corresponding to the holder private key usk, the first certificate holding device 20 can verify the validity of the signature cred using the holder private key usk.

[0087] (6) The first certificate holding device 20 can entrust the digital certificate to the second certificate holding device 30 while keeping part of the attribute set M secret. By using the pairing map, the second certificate holding device 30 can verify whether the signature cred' is a signature value generated by correctly inputting an attribute set that has not been disclosed to the entrustor. In other words, by using the pairing map, the second certificate holding device 30 can verify whether the first certificate holding device 20 has tampered with the concealed attributes.

[0088] (7) The second certificate holding device 30 can present a digital certificate to the verification device 40 while keeping part of the attribute set S secret. By using the pairing map, the verification device 40 can verify whether the signature cred* is a signature value generated by correctly inputting an attribute set that is not disclosed to the verification device 40. In other words, by using the pairing map, the verification device 40 can verify whether the second certificate holding device 30 has tampered with the concealed attributes.

[0089] (8) By using a pairing mapping, the first certificate holding device 20 and the second certificate holding device 30 can select a set of attributes to disclose and issue an electronic certificate including the selected set of attributes while keeping the set of attributes that will not be disclosed secret.

[0090] (9) By using the pairing mapping, the second certificate holding device 30 and the verification device 40 can verify whether the signature value attached to the electronic certificate is a signature value generated by correctly inputting the undisclosed attribute set.

[0091] (2. Second Embodiment) <2-1. Differences from the first embodiment> The second embodiment has the same basic configuration as the first embodiment, so differences will be described below. Note that the same reference numerals as those in the first embodiment indicate the same configuration, and reference will be made to the preceding description.

[0092] In the first embodiment described above, a general example of entrusted anonymous authentication was described. In contrast, in the second embodiment, an example in which entrusted anonymous authentication is applied to a mobility service will be described. Here, an example in which entrusted anonymous authentication of the present disclosure is applied to a plug and charge system will be described as an example of a mobility service.

[0093] As shown in Figures 9A and 9B, in this embodiment, the issuer is a mobility service provider (e-Mobility Service Provider, hereinafter referred to as eMSP). The entrustee is a mobility (specifically, an electric vehicle, hereinafter referred to as EV). The holder is a user of the mobility. The mobility may be a shared car or a rental car, and the user of the mobility may be different from the owner of the mobility. The verifier is a charging spot (Charge Point(s)).

[0094] The issuing device 10 is, for example, a server managed by eMSP. The first certificate holding device 20 is, for example, a smartphone owned by a user. The second certificate holding device 30 is, for example, an electronic control unit (ECU) installed in an EV. The verification device 40 is a PC that manages charging spots.

[0095] <2-2. Processing> Next, the flow of the entrusted anonymous authentication process will be described with reference to the sequence diagrams of Figures 9A and 9B. This authentication process starts when a user requests the eMSP to issue a digital certificate related to a charge spot usage contract. The charge spot usage contract is concluded between the user and the eMSP.

[0096] In S200, similar to S10, the issuing device 10, the first certificate holding device 20, the second certificate holding device 30 and the verification device 40 generate a global parameter prm. Next, in S210, the issuing device 10 generates a public key and a private key for the eMSP, similar to S20.

[0097] Next, in S220, the first certificate holding device 20 generates a public key and a private key for the user, similar to S30. Next, in S230, the issuing device 10 issues a digital certificate related to the usage contract for the charging spot, similarly to S40.

[0098] Next, in S240, the issuing device 10 transmits the electronic certificate related to the usage contract for the charging spot to the first certificate holding device 20, similar to S50. Next, in S250, the first certificate holding apparatus 20 verifies the validity of the electronic certificate related to the charge spot usage contract and stores it, similar to S60.

[0099] Next, in S260, the first certificate holding device 20 generates an entrustment certificate from part or all of the electronic certificate related to the charge spot usage contract, similar to S70. The first certificate holding device 20 also generates an EV private key corresponding to the user private key.

[0100] Next, in S270, the first certificate holding device 20 transmits the EV private key and the entrusted certificate to the second certificate holding device 30, similar to S80. Next, in S280, the second certificate holding device 30 verifies the authenticity of the entrusted certificate and stores it, similar to S90.

[0101] Next, in S290, the second certificate holding device 30 generates a presentation certificate to be presented to the verification device 40 from part or all of the entrustment certificate, as in S100, and also generates a verification public key.

[0102] Next, in S300, the second certificate holding device 30 transmits the verification public key and the presentation certificate to the verification device 40, as in S110. In S310, similar to S120, the verification device 40 interacts with the second certificate holding device 30 to verify the authenticity of the presentation certificate. If the verification of the authenticity of the presentation certificate is successful, the verification device 40 starts a power supply service from the charging spot to the EV.

[0103] <2-3. Modification of the second embodiment> In the second embodiment described above, a use case in which the entrusted anonymous authentication of the present disclosure is applied to a plug and charge system has been described. However, the entrusted anonymous authentication of the present disclosure can be applied to any use case in which part of the authentication information of one entity is entrusted to another entity, not limited to the plug and charge system. For example, the entrusted anonymous authentication of the present disclosure can be applied to various uses in which the authentication information held by a mobility user is entrusted to the mobility, and the mobility performs autonomous authentication and authorization with the mobility service.

[0104] Specifically, the delegated anonymous authentication disclosed herein can be applied to a park and charge service. The park and charge service is a mobility service that provides parking lot reservations and power supply as a set. The user enters into a park and charge service usage contract with the eMSP. The eMSP issues the user a digital certificate related to the park and charge service usage contract. The user entrusts part or all of the digital certificate to the EV. The EV autonomously searches for parking lots with charging spots near the destination and proposes the found parking lot to the user. If the user accepts the proposal, the EV reserves the parking lot using the delegated digital certificate, makes payment, and receives power upon arriving at the parking lot. By entrusting the digital certificate to the EV, the user can easily receive the park and charge service because the EV handles the procedures for receiving the park and charge service on the user's behalf.

[0105] <2-3. Effects> According to the second embodiment described above in detail, the same effects as the effects (1) to (9) of the first embodiment described above are achieved, and further, the following effects are achieved.

[0106] (10) By having the first certificate holding device 20 entrust the digital certificate to the second certificate holding device 30, the user can have the mobility service handle the procedures for receiving the service on his / her behalf. As a result, the user can easily receive the mobility service.

[0107] (3. Other Embodiments) Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments and can be implemented in various modified forms.

[0108] (a) In the above embodiment, the issuing device 10 transmits the digital certificate to the first certificate holding device 20. However, the digital certificate does not have to be directly presented to the first certificate holding device 20, and may be presented indirectly. For example, the issuing device 10 may upload the digital certificate to a cloud or the like and notify the first certificate holding device 20 that the digital certificate has been uploaded. The first certificate holding device 20 may obtain the digital certificate by downloading it.

[0109] (b) In the above embodiment, the first certificate holding device 20 transmits the entrustor private key usk' and the entrusted certificate to the second certificate holding device 30. However, the entrustor private key usk' and / or the entrusted certificate do not have to be presented directly to the second certificate holding device 30, and may be presented indirectly. For example, the first certificate holding device 20 may upload the entrustor private key usk' and / or the entrusted certificate to a cloud or the like and notify the second certificate holding device 30 of the upload. The second certificate holding device 30 may obtain the entrustor private key usk' and / or the entrusted certificate by downloading it.

[0110] (c) In the above embodiment, the second certificate holding device 30 transmitted the verification public key vrvk and the presentation certificate to the verification device 40. However, the verification public key vrvk and / or the presentation certificate do not have to be presented directly to the verification device 40, and may be presented indirectly. For example, the second certificate holding device 30 may upload the verification public key vrvk and / or the presentation certificate to a cloud or the like and notify the verification device 40 that the upload has been completed. The verification device 40 may also obtain the verification public key vrvk and / or the presentation certificate by downloading them.

[0111] (d) Multiple functions of one component in the above embodiments may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments. [Explanation of symbols]

[0112] 10...issuing device, 20...first certificate holding device, 20...first certifier holding device, 30...second certificate holding device, 40...verifying device, 50...storage device, 100...authentication system.

Claims

1. An issuing device (10); a first certificate holding device (20) configured to be able to communicate with the issuing device; a second certificate holding device (30) configured to be able to communicate with the first certificate holding device; a verification device (40) configured to be able to communicate with the first and second certificate holding devices; a storage device (50) configured to be able to communicate with the issuing device, the first and second certificate holding devices, and the verification device; the storage device is configured to store public information; The issuing device has an issuer private key, generating a first signature value using the issuer private key to certify that the digital certificate has been issued to the first certificate holding device; issuing a first digital certificate to which the generated first signature value is attached; and presenting the issued first digital certificate to the first certificate holding device; the first certificate holding device, a first private key; generating a second signature value for verifying the authenticity of a part or all of the first digital certificate using the public information stored in the storage device; issuing a second digital certificate which is a part or all of the first digital certificate to which the generated second signature value is attached; and presenting the issued second digital certificate and a second private key corresponding to the first private key to the second certificate holding device; the second certificate holding device, verifying, using the second private key, whether the second digital certificate was presented by the first digital certificate holding device; generating a third signature value for verifying the authenticity of a part or all of the second digital certificate using the public information stored in the storage device; issuing a third digital certificate which is a part or all of the second digital certificate to which the generated third signature value is attached; The verification device receiving a fourth digital certificate to which a fourth signature value based on the third signature value is attached and which is based in part or in whole on the third digital certificate; and verifying that the fourth digital certificate has been issued by the issuing device, using the fourth signature value and the public information stored in the storage device. Authentication system.

2. a third certificate holding device; The second certificate holding device (30) and presenting the issued third electronic certificate and a third private key corresponding to the second private key to the third certificate holding device. The authentication system of claim 1 .

3. the fourth signature value is identical to the third signature value; the fourth digital certificate is identical to the third digital certificate; The second certificate holding device (30) generating a verification public key for verifying the fourth digital certificate using the second private key; and presenting the fourth electronic certificate and the verification public key to the verification device (40). The authentication system of claim 1 .

4. the first digital certificate includes at least one attribute; the verification device (40) is configured to generate the first signature value of a fixed size regardless of the number of attributes included in the first digital certificate; the first certificate holding device (20) is configured to generate the second signature value of a fixed size regardless of the number of attributes included in the second digital certificate; The second certificate holding device (30) is configured to generate the third signature value of a fixed size regardless of the number of attributes included in the third digital certificate. The authentication system according to any one of claims 1 to 3.

5. the second private key is identical to the first private key; The authentication system according to any one of claims 1 to 3.

6. The first certificate holding device (20) is configured to use a value obtained by adding a random number to the first private key as the second private key. The authentication system according to any one of claims 1 to 3.

7. The public information stored in the storage device (50) includes an issuer public key corresponding to the issuer private key and a holder public key corresponding to the first private key; the issuing device (10) is configured to generate the first signature value using the holder public key in addition to the issuer private key; The first certificate holding device (20) is configured to verify the authenticity of the first signature value using the issuer public key and the first private key. The authentication system according to any one of claims 1 to 3.

8. the first digital certificate includes a first set of attributes; the second digital certificate includes a second set of attributes that is part of the first set of attributes, and is part of the first digital certificate; the first certificate holding device (20) is configured to generate the second signature value using all of the first set of attributes; The second certificate holding device (30) is configured to verify that the second signature value is valid using a pairing map. The authentication system according to any one of claims 1 to 3.

9. the second digital certificate includes a second set of attributes; the third digital certificate includes a third attribute set that is part of the second attribute set, and is part of the second digital certificate; the fourth signature value is identical to the third signature value; the fourth digital certificate is identical to the third digital certificate; the second certificate holding device (30) is configured to generate the fourth signature value based on all of the second attribute set and present the fourth digital certificate to the verification device (40); The verification device (40) is configured to verify that the fourth signature value is correct using a pairing map. The authentication system according to any one of claims 1 to 3.

10. The storage device (50) is implemented with a public key infrastructure. The authentication system according to any one of claims 1 to 3.

11. The storage device (50) is a publicly verifiable registry. The authentication system according to any one of claims 1 to 3.

12. The storage device (50) is implemented with a blockchain. The authentication system of claim 11.

13. The first certificate holding device (20) and the second certificate holding device (30) are configured to issue a second or third digital certificate using a pairing mapping. The authentication system according to any one of claims 1 to 3.

14. the second certificate holding device (30) and the verification device (40) are configured to verify the second or fourth digital certificate using a pairing mapping; The authentication system according to any one of claims 1 to 3.

15. A certificate holding device (20) having a first private key, Obtaining a first digital certificate including a first signature value generated by an issuing device (10); generating a second signature value using a public key associated with the issuing device to attest to the authenticity of part or all of the first digital certificate; issuing a second digital certificate which is a part or all of the first digital certificate to which the generated second signature value is attached; The second electronic certificate and the second private key corresponding to the first private key that have been issued are entrusted to another certificate holding device (30). Certificate-holding device.

16. the second private key is identical to the first private key; 16. The certificate holding device of claim 15.

17. the second private key is a value obtained by adding a random number to the first private key; 16. The certificate holding device of claim 15.

18. the first digital certificate includes a first set of attributes; the second digital certificate includes a second set of attributes that is part of the first set of attributes, and is part of the first digital certificate; The certificate holding device configured to generate the second signature value using all of the first set of attributes. The certificate holding device according to any one of claims 15 to 17.

19. An authentication method executed by an authentication system including an issuing device (10), a first certificate holding device (20), a second certificate holding device (30), and a verification device (40), comprising: The issuing device generating a first signature value for certifying that the issuing device has issued a digital certificate to the first certificate holding device using an issuer private key held by the issuing device; issuing a first digital certificate to which the generated first signature value is attached; presenting the issued first electronic certificate to the first certificate holding device; the first certificate holding device, generating a second signature value using public information to certify the authenticity of part or all of the first digital certificate; issuing a second digital certificate which is a part or all of the first digital certificate to which the generated second signature value is attached; presenting the issued second digital certificate and a second private key corresponding to the first private key held by the first certificate holding device to the second certificate holding device; the second certificate holding device, verifying, using the second private key, whether the second digital certificate was presented by the first digital certificate holding device; generating a third signature value using the public information to certify the authenticity of a part or all of the second digital certificate; issuing a third digital certificate which is a part or all of the second digital certificate to which the generated third signature value is attached; The verification device receiving a fourth digital certificate to which a fourth signature value based on the third signature value is attached and which is based in part or in whole on the third digital certificate; verifying that the fourth digital certificate has been issued by the issuing device using the fourth signature value and the public information; Authentication method.

20. A certificate entrustment method executed by a certificate holding device (20), comprising: Obtaining a first digital certificate including a first signature value generated by an issuing device (10); generating a second signature value using a public key associated with the issuing device to attest to the authenticity of part or all of the first digital certificate; issuing a second digital certificate which is a part or all of the first digital certificate to which the generated second signature value is attached; entrusting the issued second electronic certificate and a second private key corresponding to the first private key possessed by the certificate holding device to another certificate holding device (30); How the certificate is commissioned.

21. A certificate holding device (20) Obtaining a first digital certificate including a first signature value generated by an issuing device (10); generating a second signature value using a public key associated with the issuing device to attest to the authenticity of part or all of the first digital certificate; issuing a second digital certificate that is a part or all of the first digital certificate to which the generated second signature value is attached; entrusting the issued second electronic certificate and a second private key corresponding to the first private key possessed by the certificate holding device to another certificate holding device (30); program.

Images