Message presentation system, presentation device, and message presentation method

Abstract

To implement a message presentation system that remains secure even when data stored by a user could be leaked.SOLUTION: A presentation device is configured to: hold a template generated on the basis of biometric information for registration relating to a user, a message that has been encrypted, and a proof for issuance generated on the basis of a user public key corresponding to the template, the message, and an issuer secret key corresponding to an entity that has issued the message; use a user secret key, which is generated on the basis of the template and biometric information for presentation relating to the user, to decrypt the message from the encrypted message; generate a partial message from the message on the basis of a presented part that is information for specifying a part to be presented in the message; generate a proof for presentation on the basis of the presented part, the proof for issuance, and the user secret key; and output the partial message and the proof for presentation.SELECTED DRAWING: Figure 1A

Description

[Technical Field]

[0001] The present invention relates to a message presentation system, a presentation device, and a message presentation method. [Background technology]

[0002] A system is known in which a user who has been issued an electronic message and data (issuance certificate) proving the contents of the message by an issuer presents all or part of the message and data (presentation certificate) proving that the message was issued to the user by the issuer to a third-party verifier and is verified.

[0003] For example, Non-Patent Document 1 discloses a system in which an issuer issues data called a Verifiable Credential, which includes a message called a claim and a proof of issuance, and the user who receives the data (called the owner in Non-Patent Document 1) presents data called a Verifiable Presentation, which includes the Verifiable Credential and a proof of presentation, to a verifier.

[0004] It is desirable for a user to be able to present only a portion of an issued message (a partial message) to a verifier, while keeping the remaining portion secret. As a method for performing such selective presentation, Non-Patent Document 1 discloses a method in which an issuer generates a digital signature for a message and includes it in a proof for presentation, and a user includes a zero-knowledge proof related to the digital signature in a proof for presentation. Furthermore, Non-Patent Document 2 discloses ACS (Anonymous Credentials System) as another method for performing selective presentation. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] W3C, “Verifiable Credentials Data Model v1.1,” November 9, 2021 [Retrieved February 4, 2022], Internet<https: / / www.w3.org / TR / 2021 / REC-vc-data-model-20211109 / > [Non-patent document 2] Olivier Sanders, “Efficient redactable signature and application to anonymous credentials,” January 28, 2020 [Retrieved February 4, 2022], Internet<https: / / eprint.iacr.org / 2019 / 1201> Summary of the Invention [Problem to be solved by the invention]

[0006] In the methods described in Non-Patent Document 1 and Non-Patent Document 2, if data stored by a user is leaked, a security threat occurs. For example, in the method described in Non-Patent Document 1, the user needs to store a message and an issuance certificate. If the issuance certificate is leaked, there is a threat that someone other than the user may impersonate the user and present it.

[0007] Furthermore, the method described in Non-Patent Document 2 requires the user to store the user private key, the message, and the issuance certificate. If the user private key is leaked to a verifier who receives a set of a partial message and a presentation certificate for the partial message, there is a threat that the verifier may impersonate the user and present the partial message to another verifier.

[0008] Furthermore, in both Non-Patent Document 1 and Non-Patent Document 2, if a message is leaked, the unpresented part of the message will be known to the verifier or a third party.

[0009] Therefore, one aspect of the present invention provides a message presentation system that maintains security even when data stored by a user may be leaked. [Means for solving the problem]

[0010] In order to solve the above problem, one aspect of the present invention employs the following configuration: A message presentation system includes a presentation device, which holds a template generated based on a user's enrollment biometric information, an encrypted message obtained by encrypting a message including one or more message elements, and an issuance certificate generated based on a user public key corresponding to the template, the message, and an issuer private key corresponding to an issuer of the message, acquires the user's presentation biometric information, generates a user private key corresponding to the user public key based on the template and the presentation biometric information, restores the encrypted message by decrypting it with the user private key, generates a partial message from the message based on a presentation portion that is information specifying a portion of the message to be presented, generates a presentation certificate based on the presentation portion, the issuance certificate, and the user private key, and outputs the partial message and the presentation certificate. [Effects of the Invention]

[0011] According to one aspect of the present invention, a message presentation system is realized that maintains security even when data stored by a user may be leaked.

[0012] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0013] [Figure 1A] 1 is a block diagram showing an example of the configuration of a message presentation system according to a first embodiment. [Figure 1B] 2 is a block diagram showing an example of a functional configuration of an issuer registration device according to the first embodiment. FIG. [Figure 1C] 2 is a block diagram showing an example of a functional configuration of a user registration device according to the first embodiment. FIG. [Figure 1D]2 is a block diagram showing an example of a functional configuration of a verifier registration device according to the first embodiment. FIG. [Figure 1E] 2 is a block diagram showing an example of the functional configuration of an issuing device according to the first embodiment. FIG. [Figure 1F] 2 is a block diagram showing an example of the functional configuration of an acquisition device according to the first embodiment. FIG. [Figure 1G] 1 is a block diagram showing an example of the functional configuration of a presentation device according to a first embodiment. [Figure 1H] FIG. 2 is a block diagram illustrating an example of a functional configuration of a verification device according to the first embodiment. [Figure 1I] 2 is a block diagram illustrating an example of a functional configuration of a log output device according to the first embodiment. FIG. [Figure 2] 2 is a block diagram illustrating an example of the hardware configuration of a computer that constitutes each device included in the message presentation system according to the first embodiment. FIG. [Figure 3] FIG. 10 is a sequence diagram illustrating an example of an issuer registration process according to the first embodiment. [Figure 4] FIG. 10 is a sequence diagram illustrating an example of a user registration process according to the first embodiment. [Figure 5] FIG. 10 is a sequence diagram illustrating an example of a verifier registration process according to the first embodiment. [Figure 6] FIG. 10 is a sequence diagram illustrating an example of an issuing process according to the first embodiment. [Figure 7] FIG. 10 is a sequence diagram illustrating an example of a presentation process according to the first embodiment. [Figure 8] FIG. 10 is a sequence diagram illustrating an example of a log output process according to the first embodiment. [Figure 9] 10 is a flowchart showing an example of transition of a display screen of a presentation device during presentation processing in the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the embodiment is merely an example for realizing the present invention and does not limit the technical scope of the present invention. [Example]

[0015] In Example 1, a message presentation system via a network will be described. A message is any data expressed electronically. For example, electronically expressed driver's licenses, My Number cards, employment history certificates, education certificates, course completion certificates, vaccination certificates, purchase histories, credit card usage histories, employee ID cards, student ID cards, and membership cards are all examples of messages. Hereinafter, messages will be considered to be expressed electronically, and the proviso "electronically expressed" will be omitted.

[0016] A message consists of, for example, one or more message elements. A message element is, for example, a unit that can be partially presented. For example, M1:=(Name: Hitachi Taro, Date of Birth: January 1, 2000, Gender: Male, Address: 1-6-6 Marunouchi, Chiyoda-ku, Tokyo) is an example of a message. However, A1:=A2 indicates that A1 is defined by A2. M1 consists of four message elements, "Name: Hitachi Taro", "Date of Birth: January 1, 2000", "Gender: Male", and Address: "1-6-6 Marunouchi, Chiyoda-ku, Tokyo", separated by commas.

[0017] Note that the method for defining message elements is not limited to the above. For example, M2:=(Last name: Hitachi, Given name: Taro, Date of birth: January 1, 2000, Gender: Male, Prefecture part of address: Tokyo, City part of address and below: 1-6-6 Marunouchi, Chiyoda-ku) is also an example of a message.

[0018] The information that specifies "the part of the message that is presented in the presentation process" is called the presentation part, and the set of message elements that corresponds to the presentation part of the message is called a partial message. For example, if the presentation part in the above M1 is (name, date of birth), the partial message that corresponds to this presentation part is (name: Hitachi Taro, date of birth: January 1, 2000).

[0019] The information that indicates the meaning of each message element is called a key, and the information itself is called a value. For example, in the message element "Name: Hitachi Taro", the key is "Name" and the value is "Hitachi Taro".

[0020] The message structure may be such that each message element consists of a key and a value pair, as in M1 above, or such that each message element consists of a value and structural information is defined separately as follows: For example, M3 is defined only by values, as in M3:=(Taro Hitachi, January 1, 2000, male, 1-6-6 Marunouchi, Chiyoda-ku, Tokyo), and structural information S3 is defined by keys, as in S3:=(name, date of birth, gender, address). By referencing the keys in structural information S3 that correspond to each position of the message elements in message M3, it is possible to know what each message element means.

[0021] When each message element is composed of a value, the structural information may be transmitted, encrypted, and decrypted, for example, together with the message or partial message. At this time, the structural information may be linked to the message or partial message. For example, the structural information may be included in the subject of the signature included in the issuance certificate. Alternatively, the structural information may be stored in a public database (DB) (e.g., a blockchain or a database of a trusted institution) that is difficult to tamper with, and a pointer to the storage location may be included in the subject of the signature included in the issuance certificate.

[0022] Alternatively, the system may define a rule that the structural information is stored in a predetermined location in the message and that the structural information is always presented when the message is presented. For example, if a rule is defined that the first part of a message represents the structural information, then M4:=(S3, Hitachi Taro, January 1, 2000, male, 1-6-6 Marunouchi, Chiyoda-ku, Tokyo) is an example of a message.

[0023] The message may also be accompanied by information about the message, such as the name of the message (e.g., "Driver's License"), the name of the issuer, the validity period, etc. In this case, the presentation process may be configured to present the message only if the validity period attached to the message has not expired, and to cancel the process if the validity period has expired.

[0024] FIG. 1A is a block diagram showing an example of the configuration of a message presentation system. FIG. 1B is a block diagram showing an example of the functional configuration of an issuer registration device 100. FIG. 1C is a block diagram showing an example of the functional configuration of a user registration device 200. FIG. 1D is a block diagram showing an example of the functional configuration of a verifier registration device 300. FIG. 1E is a block diagram showing an example of the functional configuration of an issuing device 400. FIG. 1F is a block diagram showing an example of the functional configuration of an acquiring device 500. FIG. 1G is a block diagram showing an example of the functional configuration of a presentation device 600. FIG. 1H is a block diagram showing an example of the functional configuration of a verification device 700. FIG. 1I is a block diagram showing an example of the functional configuration of a log output device 800.

[0025] The message presentation system 10 includes, for example, an issuer registration device 100, a user registration device 200, a verifier registration device 300, an issuing device 400, an acquisition device 500, a presentation device 600, a verification device 700, a log output device 800, an issuer private key storage DB 901, an issuer public key storage DB 902, a first user DB 903, a verifier private key storage DB 904, a verifier public key storage DB 905, a second user DB 906, and a third user DB 907.

[0026] For example, an issuer registration device 100, a user registration device 200, a verifier registration device 300, an issuing device 400, an acquisition device 500, a presentation device 600, a verification device 700, a log output device 800, an issuer public key storage DB 902, a first user DB 903, a verifier public key storage DB 905, a second user DB 906, and a third user DB 907 are connected to a network 911.

[0027] For example, the issuer registration device 100, the issuing device 400, and the issuer private key storage DB 901 are connected to a network 912. For example, the verifier registration device 300, the verification device 700, and the verifier private key storage DB 904 are connected to a network 913.

[0028] The Internet and a local network within an organization are all examples of the network 911, the network 912, and the network 913. Each of the network 911, the network 912, and the network 913 may be wired or wireless.

[0029] 1A, the networks connected to the devices in the message presentation system 10 are configured by network 912, network 912, and network 913, but this configuration is not necessarily required. For example, only one of network 911, network 912, and network 913 may exist, and all devices included in the message presentation system 10 may be connected to that one network.

[0030] However, when the issuer private key is communicated, it is desirable to take measures to make it difficult for the issuer private key to be leaked, in order to make the issuer private key difficult to misuse. Authentication between the devices performing the communication is one example of such measures. Similarly, it is desirable to take measures to make it difficult for the verifier private key to be used by any device other than the verification device 700, in order to make the verifier private key difficult to misuse.

[0031] The issuer registration device 100 includes, for example, an issuer registration device communication unit 101 and an issuer key generation unit 102, both of which are functional units. The issuer registration device communication unit 101 communicates with devices connected to the issuer registration device 100. The issuer key generation unit 102 generates an issuer private key and an issuer public key of an issuer that issues a message and an issuance certificate (data that certifies the contents of the message) to a user.

[0032] The user registration device 200 includes, for example, a user registration device communication unit 201, a registration biometric information acquisition unit 202, and a user key generation unit 203, which are all functional units. The user registration device communication unit 201 communicates with devices connected to the user registration device 200. The registration biometric information acquisition unit 202 acquires registration biometric information. The user key generation unit 203 generates a pair of a template and a user public key from the registration biometric information.

[0033] The verifier registration device 300 includes, for example, a verifier registration device communication unit 301 and a verifier key generation unit 302, both of which are functional units. The verifier registration device communication unit 301 communicates with devices connected to the verifier registration device 300. The verifier key generation unit 302 generates a verifier private key and a verifier public key.

[0034] The issuing device 400 includes, for example, an issuing device communication unit 401, a user private key knowledge proof verification unit 402, a message acquisition unit 403, an issuing certificate generation unit 404, and a data encryption unit 405, all of which are functional units.

[0035] The issuing device communication unit 401 communicates with devices connected to the issuing device 400. The user private key knowledge proof verification unit 402 performs user private key knowledge proof verification using the user private key knowledge proof and the user public key, which will be described later. The message acquisition unit 403 acquires a message. The issuing certificate generation unit 404 generates an issuing certificate using the user public key, the issuer private key, and the message. The data encryption unit 405 encrypts the message using the user public key.

[0036] The acquisition device 500 includes, for example, an acquisition device communication unit 501, an issuance biometric information acquisition unit 502, a user private key recovery unit 503, and a user private key knowledge proof generation unit 504, which are all functional units. The acquisition device communication unit 501 communicates with devices connected to the acquisition device 500. The issuance biometric information acquisition unit 502 acquires issuance biometric information. The user private key recovery unit 503 recovers the user private key using a template and the issuance biometric information. The user private key knowledge proof generation unit 504 generates a user private key knowledge proof using the recovered user private key.

[0037] The presentation device 600 includes, for example, a presentation consent acquisition unit 621, a presentation device communication unit 601, a presentation biometric information acquisition unit 602, a user private key recovery unit 603, a data decryption unit 604, a template verification unit 605, a presentation proof generation unit 606, a partial message selection unit 607, a data encryption unit 608, and a result output unit 609, all of which are functional units.

[0038] The presentation consent acquisition unit 621 acquires the user's consent to the presentation of a partial message, which will be described later. The presentation device communication unit 601 communicates with devices connected to the presentation device 600. The presentation biometric information acquisition unit 602 acquires presentation biometric information. The user private key recovery unit 603 recovers the user private key using a template and the presentation biometric information. The data decryption unit 604 decrypts the encrypted message using the recovered user private key.

[0039] The template verification unit 605 executes verification processing for the template. The presentation proof generation unit 606 uses the issuance proof and the user private key to generate a presentation proof for the presentation portion of the decrypted message (data for proving that the message from which the partial message to be presented was selected was issued by the issuer). The partial message selection unit 607 selects the presentation portion included in the decrypted message to generate a partial message. The data encryption unit 608 encrypts the partial message using the verifier public key. The data encryption unit 608 also encrypts a log related to the presentation device 600 using the user public key. The result output unit 609 outputs the verification result of the presentation proof by the verification device 700.

[0040] The verification device 700 includes, for example, a verification device communication unit 701, a presentation portion designation unit 702, a data decryption unit 703, and a presentation proof verification unit 704, which are all functional units. The verification device communication unit 701 communicates with devices connected to the verification device 700. The presentation portion designation unit 702 designates a portion of a message to be presented. The data decryption unit 703 decrypts the encrypted partial message using the verifier private key. The presentation proof verification unit 704 performs verification processing on the presentation proof using the issuer public key and the decrypted partial message.

[0041] The log output device 800 includes, for example, a log output device communication unit 801, a log output biometric information acquisition unit 802, a user private key recovery unit 803, a data decryption unit 804, and a log output unit 805, all of which are functional units.

[0042] The log output device communication unit 801 communicates with devices connected to the log output device 800. The log output biometric information acquisition unit 802 acquires log output biometric information. The user private key recovery unit 803 recovers the user private key using a template and the log output biometric information. The data decryption unit 804 decrypts the encrypted log related to the presentation device 600 using the recovered user private key. The log output unit 805 outputs the decrypted log.

[0043] The issuer private key storage DB 901 stores the issuer private key. An example of the issuer private key storage DB 901 is an auxiliary storage device in a PC (Personal Computer). Other examples include a physical token and an IC (Integrated Circuit) card. The issuer private key storage DB 901 may be included in the issuer registration device 100 or the issuing device 400.

[0044] The issuer public key storage DB 902 stores the issuer public key. Examples of the issuer public key storage DB 902 include a DB of a trusted organization, a government DB, a blockchain, distributed ledgers, and decentralized databases. It is desirable that the issuer public key storage DB 902 be public and difficult to tamper with.

[0045] The first user DB 903, the second user DB 906, and the third user DB 907 store information about users. For example, the first user DB 903 stores a user's template and a user public key. For example, the second user DB 906 stores an encrypted message and an issuance certificate. For example, the third user DB 907 stores an encryption log.

[0046] Note that the information stored in the above-described user first DB 903, user second DB 906, and user third DB 907 does not necessarily have to be divided in this manner (that is, the above-described information may be stored in any one of the user first DB 903, user second DB 906, and user third DB 907). Also, the DBs storing information about users do not necessarily have to be divided into three. For example, these three DBs may be combined into one. Examples of the user first DB 903, user second DB 906, and user third DB 907 include cloud storage and servers of organizations such as companies. Also, each DB may be configured with multiple physical devices, and each piece of data may be stored in a divided form. For example, the user first DB 903 may be configured with multiple physical devices, and the user public key may be divided into multiple pieces, and each physical device constituting the user first DB 903 may store each divided part of the user public key.

[0047] The above-mentioned multiple devices may be physically included in one terminal. As an example, an issuer terminal owned by an issuing institution includes an issuer registration device 100, an issuing device 400, and an issuer private key storage DB 901, a user personal terminal includes a user registration device 200, an acquisition device 500, and a presentation device 600, and a verifier terminal owned by a verifier includes a verifier registration device 300, a verification device 700, and a verifier private key storage DB 904.

[0048] As another example, a first issuer terminal owned by an issuing institution includes an issuer registration device 100, an issuing device 400, and an issuer private key storage DB 901; a second issuer terminal owned by the issuing institution includes a user registration device 200 and an acquisition device 500; a first verifier terminal owned by a verifier includes a verifier registration device 300, a verification device 700, and a verifier private key storage DB 904; and a second verifier terminal owned by the verifier includes a presentation device 600. In this example, even if a user does not have their own terminal, they can perform the issuance process and obtain a message using the second issuer terminal owned by the issuing institution, and can perform the presentation process using the second verifier terminal owned by the verifier. In these configuration examples, the log output device 800 is included in, for example, the user's personal terminal or another terminal, and the remaining DBs are implemented as described above.

[0049] 2 is a block diagram illustrating an example of the hardware configuration of a computer constituting each device included in the message presentation system 10 in Example 1. The computer 10000 includes, for example, a CPU (Central Processing Unit) 10001, a memory 10002, an auxiliary storage device 10003, an input device 10004, an output device 10005, a communication device 10006, and a reading device 10007.

[0050] The CPU 10001 includes a processor and executes programs stored in the memory 10002. The memory 10002 includes a ROM (Read Only Memory), which is a non-volatile storage element, and a RAM (Random Access Memory), which is a volatile storage element. The ROM stores unchanging programs (e.g., a BIOS (Basic Input / Output System)). The RAM is a high-speed, volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by the CPU 10001 and data used when the programs are executed.

[0051] The auxiliary storage device 10003 is a large-capacity, non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or flash memory (SSD (Solid State Drive)), and stores programs executed by the CPU 10001 and data used when the programs are executed. That is, the programs are read from the auxiliary storage device 10003, loaded into the memory 10002, and executed by the CPU 10001.

[0052] The input device 10004 is a device such as a keyboard or mouse that receives input from an operator. The output device 10005 is a device such as a display device or printer that outputs the results of program execution in a format that can be viewed by the operator.

[0053] The communication device 10006 is a network interface device that controls communication with other devices in accordance with a predetermined protocol, and includes a serial interface such as a USB (Universal Serial Bus).

[0054] Some or all of the programs executed by CPU 10001 may be provided to computer 10000 from removable media (CD-ROM, flash memory, etc.) which are non-transitory storage media, or from an external computer equipped with a non-transitory storage device via a network, and stored in non-volatile auxiliary storage device 10003 which is also a non-transitory storage medium. Reading device 10007 is an interface device that reads data from removable media.

[0055] Each device included in the message presentation system 10 is a computer system configured on one physical computer or on multiple logically or physically configured computers, and may operate in separate threads on the same computer, or may operate on a virtual computer constructed on multiple physical computer resources.

[0056] For example, the issuer registration device communication unit 101 and the issuer key generation unit 102 of the issuer registration device 100 are included in the CPU 10001 of the computer 10000 that constitutes the issuer registration device 100. For example, the CPU 10001 of the computer 10000 that constitutes the issuer registration device 100 functions as the issuer registration device communication unit 101 by operating in accordance with an issuer registration device communication program loaded into the memory 10002 of the computer 10000, and functions as the issuer key generation unit 102 by operating in accordance with an issuer key generation program loaded into the memory 10002. For other devices included in the message presentation system 10, the relationship between the CPU 10001 of the computer 10000 that constitutes the device, the program loaded into the memory 10002 of the computer 10000, and the functional units included in the device is similar.

[0057] In addition, some or all of the functions of the functional units included in each device included in the message presentation system 10 may be realized by hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array).

[0058] Information held by each device included in the message presentation system 10 is stored in the memory 10002 or auxiliary storage device 10003 of the computer 10000 constituting the device. Note that in this embodiment, the information used by the message presentation system 10 does not depend on the data structure and may be expressed in any data structure. For example, the information can be stored in a data structure appropriately selected from a table, a list, a database, or a queue.

[0059] Although not shown in the figure, the computer 10000 constituting the user registration device 200, acquisition device 500, presentation device 600, and log output device 800 may further include sensors for acquiring biometric information such as face, fingerprint, iris, palm print, and finger veins.

[0060] 3 is a sequence diagram showing an example of issuer registration processing in the first embodiment. In step S1101, the issuer key generation unit 102 generates an issuer private key and an issuer public key. As a method for generating a key pair consisting of an issuer private key and an issuer public key, for example, a key pair generation process in a sanitizable signature scheme or an Anonymous Credentials System (ACS) may be performed, as will be described later.

[0061] In step S1102, issuer registration device communication unit 101 transmits the issuer private key generated in step S1101 to issuer private key storage DB 901. In step S1911, issuer private key storage DB 901 stores the issuer private key transmitted in step S1102.

[0062] In step S1103, issuer registration device communication unit 101 transmits the issuer public key generated in step S1101 to issuer public key storage DB 902. In step S1921, issuer public key storage DB 902 stores the issuer public key transmitted in step S1103.

[0063] 4 is a sequence diagram showing an example of user registration processing in the first embodiment. In step S2201, the registration biometric information acquisition unit 202 acquires registration biometric information from a user. Any type of biometric information, such as face, fingerprint, iris, palm print, or finger vein information, may be used. Also, a combination of multiple types of biometric information may be used.

[0064] In step S2202, the user key generation unit 203 generates a pair of a template and a user public key using the biometric information for registration acquired in step S2201. A specific example of the process in step S2202 will be described later.

[0065] In step S2203, user registration device communication unit 201 transmits the pair of the template and user public key generated in step S2202 to user first DB 903. In step S2931, user first DB 903 stores the pair of the template and user public key transmitted in step S2203.

[0066] 5 is a sequence diagram showing an example of the verifier registration process in the first embodiment. In step S3301, the verifier key generation unit 302 generates a pair of a verifier private key and a verifier public key. A key pair generation algorithm in any encryption method may be used to generate a key pair consisting of a verifier private key and a verifier public key. In addition, a key pair generated by a key pair generation algorithm in any signature method may or may not be included.

[0067] In step S3302, the verifier registration device communication unit 301 transmits the verifier private key generated in step S3301 to the verifier private key storage DB 904. In step S3941, the verifier private key storage DB 904 stores the verifier private key transmitted in step S3302.

[0068] In step S3303, the verifier registration device communication unit 301 transmits the verifier public key generated in step S3301 to the verifier public key storage DB 905. In step S3951, the verifier public key storage DB 905 stores the verifier public key transmitted in step S3303.

[0069] 6 is a sequence diagram illustrating an example of the issuing process in the embodiment 1. In step S4931, the user first DB 903 transmits to the acquisition device 500 a pair of the stored template and user public key.

[0070] In step S4501, the issuance biometric information acquisition unit 502 acquires issuance biometric information from the user. Specifically, for example, the issuance biometric information acquisition unit 502 acquires biometric information of the type used in step S2201 or some of the types.

[0071] In step S4502, the user private key recovery unit 503 recovers the user private key using the template transmitted in step S4931 and the issuance biometric information acquired in step S4501. A specific example of the process in step S4502 will be described later.

[0072] In step S4503, the user private key knowledge proof generation unit 504 generates a user private key knowledge proof using the user private key restored in step S4502. A specific example of the processing in step S4503 will be described later. Note that instead of generating a knowledge proof for the entire user private key, the user private key knowledge proof generation unit 504 may generate a knowledge proof for a part of the user private key (for example, a part used to generate a presentation proof in step S5605).

[0073] In step S4504, the acquisition device communication unit 501 transmits the user private key knowledge proof generated in step S4503 and the user public key transmitted in step S4931 to the issuing device 400. Note that the acquisition device 500 may calculate the user public key from the user private key restored in step S4502, instead of receiving it in step S4931. Not limited to this process, in the presentation process, the presentation device 600 may also calculate it from the user private key, instead of receiving it. If the user public key is calculated from the user private key in both processes, the user public key does not necessarily have to be stored in the first user DB 903.

[0074] In step S4401, the user private key knowledge proof verification unit 402 performs user private key knowledge proof verification using the user private key knowledge proof and the user public key transmitted in step S4504. Note that the user private key knowledge proof generation process in step S4503 and the user private key knowledge verification process in step S4401 may be an interactive method (i.e., a method in which the knowledge proof and knowledge verification processes are completed as a result of one or more round-trip communications between the acquisition device 500 and the issuance device 400 (e.g., a zero-knowledge proof protocol)).

[0075] In step S4402, the message acquisition unit 403 acquires a message to be issued. The message to be issued may be stored in advance in the issuing device 400 or an external DB connected to the issuing device 400, or may be generated by receiving input from an issuer using the issuing device 400 or a user to whom the message is to be issued.

[0076] In step S4911, issuer private key storage DB 901 transmits the stored issuer private key to issuance device 400. In step S4403, issuance certificate generation unit 404 generates an issuance certificate using the user public key transmitted in step S4504, the issuer private key transmitted in step S4911, and the message acquired in step S4402. A specific example of the processing in step S4403 will be described later.

[0077] In step S4404, data encryption unit 405 generates an encrypted message by encrypting the message acquired in step S4402 using the user public key transmitted in step S4504. Any public key encryption method can be used as the encryption method.

[0078] In step S4405, the issuance device communication unit 401 transmits a set of the issuance certificate generated in step S4403 and the encrypted message generated in step S4404 to the user second DB 906. In step S4961, the user second DB 906 stores the set of the encrypted message and issuance certificate transmitted in step S4405.

[0079] 7 is a sequence diagram showing an example of a presentation process in the embodiment 1. In step S5931, the user first DB 903 transmits a pair of a stored template and a user public key to the presentation device 600. In step S5961, the user second DB 906 transmits a pair of a stored encrypted message and an issuance certificate to the presentation device 600.

[0080] In step S5701, the presentable portion designation unit 702 designates the presentable portion. Specifically, for example, the presentable portion is designated by input from a verifier using the verification device 700 or an administrator of the verification device 700. Note that the presentable portion designation process may be performed before the presentable portion is performed. For example, if the presentable portion is performed to verify age at a store, the date of birth (or proof that the date of birth is before a specified date) may be designated as the presentable portion before the presentable portion is performed.

[0081] In step S5702, the verification device communication unit 701 transmits the presentation portion designated in step S5701 to the presentation device 600. When transmitting, the type of message to be presented (message name, issuer, etc.) may also be sent. The type of message to be presented is designated, for example, by input from the verifier using the verification device 700 or the administrator of the verification device 700. Note that this designation may be made prior to the presentation process.

[0082] In step S5621, the presentation consent acquisition unit 621 acquires the user's consent to the presentation of the partial message corresponding to the presentation portion transmitted in step S5702. For example, the presentation consent acquisition unit 621 displays the content to be presented, the presentation recipient, etc. on a display screen (for example, the output device 10005 of the computer 10000 constituting the presentation device 600), displays a message on the screen asking the user whether they agree to the presentation, and has the user select "Yes" or "No."

[0083] If "Yes" is selected, the subsequent processing continues, and if "No" is selected, for example, the processing is stopped. If "No" is selected, the presentation consent acquisition unit 621 may display on the display screen that the processing has been stopped.

[0084] In step S5601, the presentable biometric information acquiring unit 602 acquires presentable biometric information from the user. The presentable biometric information acquiring unit 602 acquires, for example, biometric information of the type used in step S2201 or a part of the types.

[0085] In step S5602, the user private key recovery unit 603 recovers the user private key using the template transmitted in step S5931 and the presentation biometric information acquired in step S5601. If the presentation biometric information is sufficiently close to the enrollment biometric information used to generate the template, a user private key having a fixed value corresponding to the template is recovered. A specific example of the process in step S5602 will be described later.

[0086] In step S5603, the data decryption unit 604 uses the user private key restored in step S5602 to perform decryption processing on the encrypted message sent in step S5961, and obtains the message.

[0087] In step S5604, template verification unit 605 verifies whether the template transmitted in step S5931 has been tampered with. The processing of step S5604 reduces the risk of attacks that illicitly modify the template. A specific example of the processing of step S5604 will be described later. When processing step S5604 is performed, if the verification is successful, the process proceeds to the next step, and if the verification is unsuccessful, for example, subsequent processing is aborted.

[0088] In step S5605, the presentation proof generation unit 606 generates a presentation proof using the presentation portion transmitted in step S5702, the issuance proof transmitted in step S5961, the user private key restored in step S5602, and, if necessary, all or part of the message decrypted in step S5603. A specific example of the method for generating a presentation proof in step S5605 will be described later.

[0089] In step S5606, partial message selection unit 607 generates a partial message by selecting the presentation portion transmitted in step S5702 from the message elements included in the message decrypted in step S5603. Note that if all message elements included in the message are to be presented, partial message selection unit 607 may select all message elements included in the message, or the processing of step S5606 may be omitted.

[0090] In step S5951, the verifier public key storage DB 905 transmits the stored verifier public key to the presentation device 600. In step S5607, the data encryption unit 608 generates an encrypted partial message by encrypting the partial message generated in step S5606 using the verifier public key transmitted in step S5951.

[0091] In step S5608, the presentation device communication unit 601 transmits a set of the partial message encrypted in step S5607 and the presentation proof generated in step S5605 to the verification device 700. In step S5941, the verifier private key storage DB 904 transmits the stored verifier private key to the verification device 700.

[0092] In step S5609, the data encryption unit 608 encrypts the log related to the presentation device 600 by public key cryptography using the user public key transmitted in step S5931, and generates an encrypted log. Note that the data encryption unit 608 may encrypt the log by common key cryptography using the user private key restored in step S5602, instead of the public key cryptography using the user public key transmitted in step S5931.

[0093] The logs to be encrypted include, for example, the presentation date and time, the presentation destination, the presentation content (for example, the content of the presentation portion and the type of message, etc.), the identifier of the presentation device 600 used for the presentation, etc. Note that after receiving the verification result transmitted in step S5705, the processing of step S5609 may be performed, and the verification result in step S5704 may be included in the log.

[0094] In step S5610, the presentation device communication unit 601 transmits the encrypted log generated in step S5609 to the user third DB. In step S5971, the user third DB stores the encrypted log transmitted in step S5610.

[0095] In step S5703, data decryption unit 703 generates a partial message by decrypting the encrypted partial message transmitted in step S5608 using the verifier private key transmitted in step S5941. In step S5921, issuer public key storage DB 902 transmits the stored issuer public key to verification device 700.

[0096] In step S5704, presentation proof verification unit 704 performs verification using the issuer public key transmitted in step S5921, the presentation proof transmitted in step S5608, and the partial message decrypted in step S5703, and obtains a verification result of either success or failure. Note that the presentation proof generation process in step S5605 and the presentation proof verification process in step S5704 may be executed interactively between presentation device 600 and verification device 700.

[0097] The verification device 700 may output at least one of the verification result and the presented partial message. The output destination may be a display screen (e.g., the output device 10005 of the computer 10000 constituting the verification device 700) or another program. For example, if the output destination is a payment program, an example of processing by the payment program is to provide a discount or the like according to the presented partial message (e.g., address, membership information, etc.) and perform payment processing for the user if the verification result is successful. Also, if the output destination is an admission management program (e.g., an admission management program for an event venue), an example of processing by the admission management program is to allow the user to enter (e.g., open a gate or door) if the verification result is successful and the presented partial message satisfies a predetermined condition (e.g., a condition that the test result for a predetermined infectious disease is negative).

[0098] In step S5705, the verification device communication unit 701 transmits the verification result obtained in step S5704 to the presentation device 600. In step S5611, the result output unit 609 outputs the verification result transmitted in step S5705. The output destination may be a display screen (for example, the output device 10005 of the computer 10000 constituting the presentation device 600) or another program (for example, a payment program or an admission management program).

[0099] 8 is a sequence diagram showing an example of a log output process in the embodiment 1. In step S6971, the user third DB 907 transmits the stored encrypted log to the log output device 800. In step S6931, the user first DB 903 transmits the stored template to the log output device 800.

[0100] In step S6801, the log output biometric information acquisition unit 802 acquires log output biometric information from the user. The log output biometric information acquisition unit 802 acquires, for example, biometric information of the type used in step S2201 or some of the types.

[0101] In step S6802, the user private key recovery unit 803 recovers the user private key using the template transmitted in step S6931 and the log output biometric information acquired in step S6801. A specific example of the process in step S6802 will be described later.

[0102] In step S6803, the data decryption unit 804 obtains a log by decrypting the encrypted log transmitted in step S6971 using the user private key restored in step S6802. In step S6804, the log output unit 805 outputs the log decrypted in step S6803. The output destination may be a display screen (for example, the output device 10005 of the computer 10000 constituting the log output device 800) or another program.

[0103] 9 is a flowchart showing an example of the transition of display content on the display screen of the presentation device 600 during the presentation process in Example 1. Display content 51000 is an example of display content in the presentation consent acquisition process in step S5621. Display content 51000 includes, for example, block 51001, block 51002, block 51003, block 51004, and block 51005.

[0104] Block 51001 displays, for example, text indicating that the presentation of information has been requested. Block 51002 displays, for example, the name of the document corresponding to the message being requested to be presented, as well as text indicating the portion of the message to be presented and the recipient. Block 51003 displays, for example, text asking whether the user agrees to the presentation. Block 51004 displays, for example, a "Yes" option. Block 51005 displays, for example, a "No" option.

[0105] Branch 59001 is a branch related to the selection result in the presentation consent process in step S5621. If the presentation is consented to in step S5621, that is, if block 51004 is selected (branch 59001: "Yes"), display content 52000 is displayed. If the presentation is not consented to in step S5621, that is, if block 51005 is selected (branch 59001: "No"), display content 55000 is displayed.

[0106] Display content 52000 is an example of display content in the presentation biometric information acquisition process in step S5601. The display content 52000 includes, for example, a block 52001 and a block 52002.

[0107] For example, text requesting the user to submit biometric information is displayed in block 52001. An image captured by a sensor (such as a camera) for acquiring biometric information is displayed in block 52002. Block 52002 may also include a guide display 52003 indicating an appropriate position for submitting biometric information to the sensor.

[0108] Display content 55000 is an example of the content displayed when "No" is selected in the presentation consent process in step S5621, or when selecting whether to retry in step S5611 if the verification result is a failure. Display content 55000 includes, for example, block 55001 in which a message indicating that the presentation process has been canceled is displayed.

[0109] Branch 59002 is a branch related to the verification result of step S5704. If the verification in step S704 is successful (branch 59002: "verification successful"), display content 53000 is displayed in step S5611. If the verification in step S5704 is unsuccessful (branch 59002: "verification unsuccessful"), display content 54000 is displayed in step S5611. Display content 53000 includes, for example, block 53001 in which text indicating that the presentation process has been completed is displayed.

[0110] Display content 54000 includes, for example, blocks 54001, 54002, and 54003. Block 54001 displays, for example, text indicating that verification has failed (or that the submission process has failed). Block 54002 displays, for example, text asking whether to retry verification. Block 54003 displays a "Yes" option. Block 54004 displays a "No" option.

[0111] If any of the processes up to step S5704 fails, for example, as in the case of verification failure, a transition may be made to display content 54000. In this case, which process failed may be displayed in block 54001.

[0112] Branch 59003 is a branch related to the selection result in display content 54000. If verification is to be retried, that is, if block 54003 is selected (branch 59003: "Yes"), a transition to display content 52000 occurs. If verification is not to be retried, that is, if block 54004 is selected (branch 59003: "No"), a transition to display content 55000 occurs.

[0113] An example of the process up to the display of the display content 51000 is as follows: The presentation device 600 is equipped with a sensor such as a camera, and the sensor reads data such as a two-dimensional barcode displayed on the display screen of the verification device 700.

[0114] The data indicates, for example, a URI (Uniform Resource Identifier) ​​to a web page that includes information such as whether to perform a submission process or an issuance process, the document name, the portion to be submitted, and the destination to be submitted.

[0115] By accessing the web page corresponding to the URI acquired by the sensor, the presentation device 600 can obtain information such as that a presentation process will be performed, the name of the document to be presented, the portion to be presented, and the presentation destination, and can display information such as the text in block 51002. Note that the means for accessing information such as whether a presentation process or an issuance process will be performed, the document name, the portion to be presented, and the destination may be any method other than reading a two-dimensional barcode.

[0116] [Specific examples of user key generation processing and user private key recovery processing] The following describes specific examples of the user key generation process in step S2202 and the user private key restoration process in steps S4502, S5602, and S6802. Note that a specific example of the user private key restoration process will be described with reference to step S4502, and in steps S5602 and S6802, the user private key can be restored by performing the same process as in step S4502, for example.

[0117] In the process, for example, a biometric encryption method is used. In the enrollment process, the biometric encryption method generates a helper string c_E and an enrollment-time private key s_E from an enrollment feature x_E ("_" indicates a subscript). In the restoration process, the biometric encryption method generates a restoration-time private key s_A from a restoration feature x_A and the helper string.

[0118] When x_E and x_A are sufficiently close, s_E=s_A, i.e., the private key at the time of registration is restored. Any method such as Fuzzy Extractor, Fuzzy Signature, Fuzzy Commitment, or Fuzzy Vault can be used as the biometric encryption method.

[0119] In step S2202, the user key generation unit 203 generates a registration feature x_E from the registration biometric information, and generates a helper string c_E and a registration-time private key s_E from the registration feature x_E through a registration process of the biometric encryption method. Then, the user key generation unit 203 determines a template T so as to include the helper string c_E.

[0120] The template T may include data called a pseudo-identifier (for example, a hash value of the registration private key s_E or a public key corresponding to the registration private key s_E). Meanwhile, the user key generation unit 203 generates a user public key upk using the registration private key s_E. The following describes a case where a user private key usk is generated as an internal process at that time, but it is not necessarily required that the user private key usk be generated.

[0121] In step S4502, the user private key recovery unit 503 first extracts a recovery feature x_A from the issuance biometric information, and performs a recovery process of the biometric encryption method using x_A and c_E included in T to generate a recovery private key s_A. When x_E and x_A are sufficiently close, s_E=s_A, that is, the registration private key is recovered.

[0122] The user private key restoration unit 503 may verify whether s_E has been correctly restored using the pseudo identifier, and may abort the process if s_E has not been restored. Instead of aborting the process, the process may proceed to step S5611 and output a message indicating that the user private key restoration has failed. If the registration private key s_E has been correctly restored, the user private key restoration unit 503 performs key restoration processing using s_E in accordance with the method of generating (usk, upk) to restore usk.

[0123] As a first example of a method for generating (usk, upk), the user key generation unit 203 generates a pair of a private key sk1 and a public key pk1 using a key generation algorithm in any public key cryptography or digital signature system. The user key generation unit 203 sets usk:=sk1 and sets upk to include pk1. Furthermore, the user key generation unit 203 generates data Enc(s_E, sk1) by encrypting sk1 using s_E, and includes Enc(s_E, sk1) in the template T. In this case, in the key recovery process, the user private key recovery unit 503 can recover usk by recovering sk1 from Enc(s_E, sk1) using the recovered s_E.

[0124] Note that sk1 may be a set of multiple private keys, and pk1 may be a set of multiple corresponding public keys. In the following examples, the private keys and public keys may each be a set of multiple keys. When the private keys and public keys each consist of multiple keys, encryption, decryption, digital signature generation, and digital signature verification can be performed using predetermined keys from among them.

[0125] As a second example of a method for generating (usk, upk), the user key generation unit 203 may generate sk2 using a private key sk2:=f_1(s_E) by applying a transformation f_1 (for example, an identity transformation or a transformation using a pseudo-random number generator or a hash function) to s_E, generate a public key pk2 corresponding to sk2, set usk:=sk2, and set upk to include pk2. In this case, in the key recovery process, the user private key recovery unit 503 can recover usk by calculating f_1(s_E) for the recovered s_E.

[0126] Note that a user private key and a user public key obtained by concatenating the user private key and the user public key obtained in the first and second examples of the method for generating (usk, upk), respectively, may also be used. Alternatively, if the biometric encryption method registration process is a method that can generate a template after specifying s_E, the user key generation unit 203 may generate (usk, upk) and then generate c_E so that s_E becomes usk. In this case, in the key recovery process, the user private key recovery unit 503 can recover usk by recovering s_E.

[0127] Alternatively, a method obtained by combining the methods described in the first and second examples may be used, as in the following example. First, the user key generation unit 203 generates a pair of a private key sk1 and a public key pk1 using a key generation algorithm in any public key cryptography or digital signature system. Furthermore, the user key generation unit 203 generates sk2 using a private key sk2:=f_1(s_E) by applying a transformation f_1 (e.g., an identity transformation, a transformation using a pseudorandom number generator, or a hash function) to s_E, and generates a public key pk2 corresponding to sk2. Then, the user key generation unit 203 determines (usk, upk) using usk:=(sk1, sk2) and upk:=(pk1, pk2). Furthermore, the user key generation unit 203 generates data Enc(sk2, sk1) by encrypting sk1 using sk2, and includes Enc(sk2, sk1) in the template T. In this case, in the key recovery process, the user private key recovery unit 503 recovers sk2 from the recovered s_E using sk2:=f_1(s_E), and then recovers sk1 from Enc(sk2, sk1) using the recovered sk2, thereby recovering usk.

[0128] In this method, sk1 and sk2 may be used for different processes, for example, sk2 may be used for message decryption processing and sk1 may be used for presentation proof generation processing. To achieve this, for example, message encryption processing may be performed using sk2 or pk2, and the issuance proof generation processing may be performed using pk1. This example is not limiting, and when the private key and public key consist of multiple keys, each key may be used for a different process.

[0129] Furthermore, in order to generate the user private key, secret information (e.g., a password or an additional secret key stored in a DB) may be used in addition to the enrollment biometric information. For example, the user key generation unit 203 may newly define usk as a value obtained by converting data obtained by concatenating the usk generated by the above-described method and the secret information using any function such as a hash function. In this case, the user key generation unit 203 may newly define a user public key so as to correspond to the newly defined usk. The user private key recovery unit 503 can recover the user private key by receiving input of the secret information and using the secret information in addition to the presented biometric information. In this way, using secret information in addition to the enrollment biometric information to generate the user private key reduces the risk of the user private key being fraudulently recovered, thereby improving security.

[0130] [Specific example of user private key knowledge proof generation process and verification process] A specific example of the user private key knowledge proof generation process in step S4503 and the user private key knowledge proof verification process in step S4401 will be described below.

[0131] As a first specific example, the user private key knowledge proof generation unit 504 may generate a knowledge proof in accordance with any knowledge proof protocol such as the Schnorr Protocol. In this case, the user private key knowledge proof verification unit 402 can verify whether the knowledge proof is correct by performing a verification process defined by the protocol.

[0132] As a second specific example, the user private key knowledge proof verification unit 402 transmits data such as a random number (issue challenge) to the acquisition device 500, the user private key knowledge proof generation unit 504 generates an electronic signature for the issue challenge using the user private key, and the user private key knowledge proof verification unit 402 verifies the relationship between the issue challenge, the transmitted user public key, and the electronic signature.

[0133] [Specific examples of generating a certificate for issuance, generating a certificate for presentation, and verifying a certificate for presentation] Here are specific examples of the generation of the proof for issuance in step S4403, the generation of the proof for presentation in step S5605, and the processing for verifying the proof for presentation in step S5704. Assume that the message consists of n (n is a positive integer) message elements m[1], m[2], ..., m[n], and the partial messages consist of m[i_1], m[i_2], ..., m[i_k] ({i_1, i_2, ..., i_k} is a subset of {1, 2, ..., n}).

[0134] In the presentation proof generation process, the presentation proof generation unit 606 generates a presentation proof generation private key usk_S from the user private key usk using usk_S:=f_S(usk), and the corresponding public key upk_S is included in the user public key upk. Examples of the function f_S include an identity transformation and a function that selects a predetermined part of usk.

[0135] In the first specific example, a general signature method and a redactable signature method are used. These will be explained.

[0136] A typical signature method includes a key pair generation process, an electronic signature generation process, and a verification process, which are denoted as Gen_S, Sig_S, and Ver_S, respectively. Each process is as follows: Gen_S generates a pair of a signature key sk_S and a verification key pk_S using (sk_S, pk_S) = Gen_S(). Sig_S generates an electronic signature Q for a message L using sk_S using Q = Sig_S(sk_S, L). Ver_S outputs a verification result Result_S using Result_S = Ver_S(pk_S, L, Q). Result_S indicates whether the verification was successful or not.

[0137] The sanitizable signature method includes a key pair generation process, a digital signature generation process, a sanitization process, and a verification process, which are denoted as Gen_R, Sig_R, Derive_R, and Ver_R, respectively. Each process is as follows:

[0138] Gen_R is a process that generates a pair of a signing key sk_R and a verification key pk_R by (sk_R, pk_R) = Gen_R(). Sig_R is a process that generates a digital signature Q_1 by sk_R for a message (M[1], M[2], ..., M[N]) consisting of N message elements (N is a positive integer) by Q_1 = Sig_R(sk_R, (M[1], M[2], ..., M[N])).

[0139] Derive_R is a process that generates a digital signature Q_2 using sk_R for (M[I_1],M[I_2],...,M[I_K]) by Q_2 = Derive_R({I_1,I_2,...,I_K},(M[1],M[2],...,M[N]),Q_1), where K is a positive integer less than or equal to N, and {I_1,I_2,...,I_K} is a subset of {1,2,...,N}. The ability to generate a digital signature Q_2 using sk_R without needing sk_R is a feature of the sanitizable signature method.

[0140] Ver_R is a process that outputs the verification result Result_R by Result_R=Ver_R(pk_R,(M[I_1],M[I_2],...,M[I_K]),Q_2). Result_R indicates whether the verification was successful or unsuccessful.

[0141] A first specific example using these will be described. First, it is assumed that (usk_S, upk_S) are created to have the same format as the key pair generated by Gen_S(). Furthermore, in the issuer key generation process of step S1101, the issuer key generation unit 102 generates a key pair (isk_R, ipk_R) using Gen_R, and includes isk_R in the issuer private key and ipk_R in the issuer public key.

[0142] In the issuance certificate generation process of step S4403, the issuance certificate generation unit 404 generates an electronic signature q_11 using q_11=Sig_R(isk_R, (m[1], m[2], ..., m[n], upk_S)) and generates an issuance certificate to include the electronic signature q_11.

[0143] In the presentation proof generation process of step S5605 and the presentation proof verification process of step S5704, for example, the following processes are executed. First, the presentation proof verification unit 704 generates data (presentation challenge) R_2 such as a random number and transmits it to the presentation device 600. The presentation proof generation unit 606 generates a digital signature q_12 based on isk_R for (m[i_1], m[i_2], ..., m[i_k], upk_S) using q_12=Derive_R({i_1, i_2, ..., i_k, n+1}, (m[1], m[2], ..., m[n], upk_S), q_11). In addition, the presentation proof generation unit 606 generates a digital signature q_13 based on usk_S for R_2 using q_13=Sig_S(usk_S, R_2). The presentation proof generating unit 606 generates a presentation proof so as to include q_12, q_13, and upk_S.

[0144] Then, the presentation proof verification unit 704 determines Result_S and Result_R using Result_S = Ver_S(upk_S,R_2,q_13) and Result_R = Ver_R(ipk_R,(m[i_1],m[i_2],...,m[i_k],upk_S),q_12), and if both Result_S and Result_R are successfully verified, the verification is deemed successful; otherwise, the verification is deemed unsuccessful. Result_S indicates that it verifies whether the user private key usk_S corresponding to the presented user public key upk_S is used to generate the presentation proof. Result_R indicates that it verifies whether the presented partial message and upk_S are indeed the correct values ​​specified by the issuer.

[0145] In particular, a general signature method can be used to generate the digital signature q_11. For example, n random numbers r[1], r[2], ..., r[n] are generated, and for each i=1, 2, ..., n, h_i:=Hash(m[i], r[i]) is defined. The digital signature for the data obtained by concatenating h_1, h_2, ..., h_n is defined as q_110 using Sig_S, and the set of q_110, h_1, h_2, ..., h_n, and r_1, r_2, ..., r_n is defined as q_11.

[0146] In this case, q_12 can be defined as a set of q_110, h_1, h_2, ..., h_n, and r_[i_1], r_[i_2], ..., r_[i_k]. q_12 can be verified by verifying the relationship between (h_i, m[i], r[i]) for each presented message element and the relationship between q_110 and (h_1, h_2, ..., h_n).

[0147] Note that this is merely an example, and data obtained by performing processing other than concatenation on h_1, h_2, ..., h_n may be used as the data to be signed for generating q_110. For example, Hash(h_1, h_2, ..., h_n) may be used as the data to be signed when generating q_110, or a method called Merkle Hash may be used.

[0148] This has the advantage that any signature method can be used for each process, which eliminates the need to use libraries that perform special encryption and signature calculations or to implement special encryption and signature calculations, and allows implementation using general-purpose encryption and signature libraries (for example, libraries that provide RSA encryption and RSA signature functions).

[0149] Note that using data such as a random number transmitted from the verification device 700 as R_2 makes it more difficult for a verifier who has received a presentation proof to transmit the presentation proof to another verifier. To achieve this effect, the document to be signed for generating q_13 may include, instead of or in addition to R_2, data R_3 such as information about the verifier (such as the verifier's name) and the presentation date and time. When R_3 is generated by the presentation device 600, including R_3 in the presentation proof enables verification of q_13 by the verification device 700. Furthermore, to further clarify the user's consent to presentation, the document to be signed for generating q_13 may include the partial message to be presented.

[0150] A second specific example will be described. The second specific example is a method using ACS described in Non-Patent Document 2, etc. In the issuance certificate generation process in step S4403, the issuance certificate generation unit 404 generates an issuance certificate using the issuer private key isk, upk_S which is part of the user public key, and a message (m[1], m[2], ..., m[n]).

[0151] For example, the issuing certificate generating unit 404 generates a digital signature q_21 using isk for (m[1], m[2], ..., m[n], usk_S). By using the method of Non-Patent Document 2, it is possible to generate such a digital signature, and furthermore, it can be made to have the properties of a sanitizable signature.

[0152] In the presentation proof generation process of step S5605, the presentation proof generation unit 606 communicates with the verification device 700 as necessary, and generates a presentation proof using the message, the user private key, the presentation part, and the issuance certificate. For example, the presentation proof generation unit 606 generates a digital signature q_22 using isk for (m[i_1], m[i_2], ..., m[i_k], usk_S), and further generates a knowledge proof q_23 of usk_S, and generates a presentation proof to include q_22 and q_23.

[0153] In the presentation proof verification process in step S5704, the presentation proof verification unit 704 verifies the relationship between the presented partial message, the presentation proof, and the issuer public key, and outputs whether the verification is successful or unsuccessful. For example, the presentation proof verification unit 704 verifies the relationship between (m[i_1], m[i_2],..., m[i_k]), (q_22, q_23), and ipk, and outputs whether the verification is successful or unsuccessful.

[0154] With this method, it is difficult to achieve successful verification if (m[i_1], m[i_2],..., m[i_k]) has been tampered with, and it is also difficult to generate q_23 that will result in successful verification unless usk_S is known. Furthermore, when generating a presentation proof, the presentation proof generation unit 606 generates the presentation proof using a random number (an example of a presentation challenge) sent from the verification device 700. This reduces the risk of an attack in which a verifier impersonates a user and presents the proof to another verifier.

[0155] [Example of template validation process] A first specific example of the template verification process in step S5604 will be described. First, in step S4504, the acquisition device communication unit 501 transmits a function value f_2(T) calculated using a predetermined function f_2 (e.g., a hash function) for the template T to the issuing device 400. Then, in step S4402, the message acquisition unit 403 defines a message to include the function value f_2(T) as a message element.

[0156] Then, in step S5604, template verification unit 605 calculates a function value for the transmitted template using f_2, and verifies whether it is equal to the value of f_2(T) included in the message. Furthermore, template verification unit 605 verifies whether the function value f_2(T) included in the message has not been tampered with by verifying the relationship between the function value f_2(T) included in the message and the issuance certificate. If template verification unit 605 succeeds in these two verifications, it determines that the verification is successful, and if either verification fails, it determines that the verification is unsuccessful.

[0157] A second specific example of the template verification process in step S5604 will be described. In this second specific example, the template verification unit 605 verifies the validity of the template data value. Assume that the registration feature x_E belongs to a linear space X. Let S be a subspace of X. Consider a case where a helper string c_E is generated by c_E:=x_E-CV(x_E) and the template T includes c_E. Here, assume that CV(x_E) represents the point in S that is closest to x_E. In this case, the c_E included in the template T must satisfy CV(c_E)=0. Therefore, the template verification unit 605 can confirm whether c_E is invalid by verifying whether this condition is met.

[0158] A third specific example of the template verification process in step S5604 will be described. In the third specific example, the template verification unit 605 also verifies the validity of the template data values. Assume that the registration feature x_E is a t-dimensional real-valued vector. The helper string c_E is expressed as c_E:=x_E-B* using a t-dimensional regular matrix B.<B^(-1)*x_E> and template T includes c_E. Here, * is the product of a matrix and a vector, and <> represents the process of truncating the decimal point of each component of the vector. In this case, c_E included in template T must have each component of B^(-1)*c_E greater than or equal to 0 and less than 1. Therefore, template verification unit 605 can confirm whether c_E is invalid by verifying whether this condition is met.

[0159] [Example of process flow changes] In the above processing flow, some of the processing can be changed, for example, as follows.

[0160] If the user first DB 903 is public, in the issuance certificate generation process of step S4403, the issuance certificate generation unit 404 may use information that can identify the user public key instead of using the user public key. Examples of information that can identify the user public key include the location of the user first DB 903. Furthermore, if the user public keys of multiple users are stored in the user first DB 903, examples of information that can identify the user public key include information such as a user ID that identifies which user public key it is.

[0161] Furthermore, the user private key knowledge proof generation process in step S4503 and the user private key knowledge verification process in step S4401 may be omitted, although by performing these processes, it can be verified that the process is being performed by a legitimate user corresponding to the user public key transmitted in step S4504.

[0162] Furthermore, part or all of the issuance certificate generation process in step S4403 may be performed by issuer private key storage DB 901. For example, if the issuance certificate generation process includes a signature generation process using the issuer private key, the issuance device 400 may transmit the data to be signed to the issuer private key storage DB 901, the issuer private key storage DB 901 may perform the signature generation process and transmit the digital signature obtained by the signature generation process to the issuance device 400, and the issuance device 400 may then perform the remaining processes of the issuance certificate generation process using the digital signature. In this manner, the issuer private key is not transmitted outside the issuer private key storage DB 901, thereby improving security.

[0163] Furthermore, the message encryption process in step S4404 may be performed by the user second DB 906 instead of the issuing device 400. In that case, in step S4405, the issuing device communication unit 401 transmits a message instead of an encrypted message. Alternatively, in step S4405, the issuing device communication unit 401 may transmit a message to the acquisition device 500, and the acquisition device 500 may perform the message encryption process. In this case, common key encryption using a user private key may be performed instead of public key encryption using a user public key. However, by having the issuing device 400 perform the message encryption process in step S4404, there is an advantage that the message is protected even in communication from the issuing device 400.

[0164] Alternatively, the acquisition device 500 or the presentation device 600 may verify the relationship between the issued message and the issuance certificate. This allows the authenticity of the issuance certificate to be confirmed. If the message or issuance certificate is encrypted, it can be decrypted using the user's private key.

[0165] Additionally, the presentation portion may, in addition to or instead of indicating the message element to be presented, ask for a given message element whether the message is equal to a given value or whether the value is within a given range.

[0166] For example, if M3 is defined as M3:=(Taro Hitachi, January 1, 2000, male, 1-6-6 Marunouchi, Chiyoda-ku, Tokyo), and structural information S3 is defined as S3:=(name, date of birth, gender, address), and verification device 700 knows that M3 has the structure of S3, the presentation portion may be a combination of the first message element of M3 and content asking whether the second element of M3 is dated before January 1, 2002. In this case, the partial message may be a message consisting of the first message element of M3, and the presentation proof may include proof that the second element is dated before January 1, 2002. An ACS that can provide such proof may be, for example, a Function Credential.

[0167] Furthermore, in step S4404, the data encryption unit 405 may encrypt the issuance certificate in addition to the message. In this case, the encrypted issuance certificate is used instead of the issuance certificate in the communication and storage processes related to the issuance certificate up until step S5603, and in the message decryption process of step S5603, the data decryption unit 604 decrypts the encrypted issuance certificate in addition to the message to obtain the issuance certificate. The message and the issuance certificate may be encrypted separately or together. In addition, in the example of the user key generation method described above, the template includes a portion of the encrypted user private key. In this example, instead of the template including a portion of the encrypted user private key, the data encryption unit 405 may generate an encrypted message by encrypting a portion of the user private key together with the message. In this case, the portion of the user private key is decrypted together with the message by the message decryption process of step S5603, and can be used, for example, in the presentation certificate generation process of step S5605. In this case, in step S5602, the user private key recovery unit 603 does not need to recover a portion of the user private key, but only recovers a portion of the user private key that is necessary for the message decryption process in step S5603. Also, the data encryption unit 405 may encrypt the issuance certificate together with the message and a portion of the user private key.

[0168] The presentation portion may also be specified by the presentation device 600. In this case, for example, the user may be allowed to select the presentation portion in the presentation consent acquisition process in step S5621. In step S5608, the presentation device communication unit 601 transmits information on the presentation portion if necessary.

[0169] Furthermore, in the presentation process, presentation device 600 does not necessarily need all of the message acquired in step S4402. For example, in the method using a general signature method among the methods described in the first specific example of the issuance certificate generation, presentation certificate generation, and presentation certificate verification process, only the partial message (i.e., a set of message elements corresponding to the presentation portion of the message) is required for the processes of steps S5605, S5606, S5607, and S5608.

[0170] In this way, if only a portion of the message obtained in step S4402 is required in the presentation process, the message decrypted in step S5603 (also called the ``message for presentation process'') may be only a portion of the message obtained in step S4402 (also called the ``message for issuance process'').

[0171] Furthermore, the encrypted message sent in step S5961 (also referred to as the "encrypted message for presentation processing") may be only the necessary portion of the encrypted message generated in step S4404 (also referred to as the "encrypted message for issuance processing"). Specifically, the encrypted message for presentation processing may be only the portion of the encrypted message for issuance processing that is necessary for decrypting "the portion of the message for issuance processing that is necessary for the processing in steps S5605, S5606, S5607, and S5608."

[0172] An example of a processing method in which the encrypted message for the presentation process is part of the encrypted message for the issuance process, and the encrypted message for the presentation process is part of the message for the issuance process will be described below. In step S4404, the data encryption unit 405 divides the message for the issuance process into multiple blocks (for example, each block is a message element included in the message for the issuance process), and encrypts each block to generate an encrypted message for the issuance process consisting of multiple blocks.

[0173] In step S5961, the user second DB transmits the necessary portion of the encrypted message for issuance processing to the presentation device 600 as an encrypted message for presentation processing. For example, as in the above example, if it is sufficient for the partial message to be included in the message for presentation processing, the user second DB first receives the presentation portion specified in step S5701 from another device (e.g., the verification device 700 or the presentation device 600). Next, the user second DB identifies the message elements that make up the partial message based on the presentation portion. Next, the user second DB selects encrypted message blocks corresponding to each identified message element from the encrypted message for issuance processing, and transmits the selected blocks to the presentation device 600 as an encrypted message for presentation processing.

[0174] In this way, by sending only the necessary parts of the encrypted message for issuance processing as the encrypted message for presentation processing in step S5961, the risk of leakage of parts of the message for issuance processing that are not included in the message for presentation processing can be reduced.

[0175] If the message for presentation processing matches the partial message, in step S5606, the partial message selection unit 607 may select all message elements included in the message for presentation processing as partial messages.

[0176] Also, the partial message encryption process in step S5607 does not have to be executed. In that case, in step S5608, the presentation device communication unit 601 transmits the partial message instead of the encrypted partial message, and the partial message decryption process in step S5703 can be omitted.

[0177] Furthermore, the presentation device 600 may perform authentication to verify the legitimacy of the verification device 700. A pair of a verifier private key and a verifier public key can be used for this authentication. For example, the presentation device 600 may generate a challenge such as a random number and send it to the verification device 700, and the verification device 700 may generate a digital signature using a part or all of the verifier private key according to an arbitrary signature algorithm, and the presentation device 600 may then perform signature verification. Alternatively, the verification device 700 may prove knowledge of a part or all of the verifier private key according to an arbitrary proof-of-knowledge protocol.

[0178] Furthermore, in the log encryption process of step S5609, encryption using the system administrator's private key or public key may be performed instead of encryption using the user public key or user private key. In this case, the private key and public key may be a key pair in ordinary public key encryption, or a pair generated from the system administrator's biometric information by processing similar to the user registration process may be used. Note that when a pair generated from biometric information is used, in the log encryption process of step S5609, the log output biometric information acquisition unit 802 acquires the biometric information of the system administrator.

[0179] Furthermore, the verifier private key storage DB 904 may include a partial message decryption unit, and the partial message decryption process in step S5703 may be performed by the partial message decryption unit instead of the verification device 700. This prevents the verifier private key from being transmitted outside the verifier private key storage DB 904, improving security.

[0180] Furthermore, to verify the identity of the person who is the subject of the issuance process, for example, the issuer or the issuing device 400 may request the user to present an identification document, and the user may present the identification document. The method of presentation may be a method in which the user presents the identification document to the issuer in person, or a method in which the acquiring device 500 acquires the identification document as electronic data such as a photograph and then transmits it to the issuing device 400. Furthermore, in addition to or instead of presenting the identification document, a presentation process may be performed for a message that the user has already received.

[0181] In addition, the encryption process using the private key in this embodiment may be replaced with encryption process using a public key corresponding to the private key. Furthermore, the encryption process using the public key may be replaced with a process of transmitting or restoring the private key and an encryption process using the transmitted or restored private key. In this case, however, it is desirable to take measures (such as encryption of the communication channel) to reduce the risk of leakage of the transmitted private key.

[0182] Furthermore, instead of storing the issuer private key in issuer private key storage DB901, the issuer private key may be generated from the issuer biometric information, for example, as follows: In step S1101, the issuer key generation unit 102 acquires biometric information (issuer registration biometric information) from the issuer, and generates an issuer template and an issuer public key by performing the same process as the user key generation process in step S2202 on the issuer registration biometric information. The issuer private key storage DB901 stores the generated issuer template instead of the issuer private key.

[0183] In step S4911, issuer private key storage DB901 transmits the generated issuer template to issuance device 400 instead of the issuer private key. In step S4403, issuance certificate generation unit 404 acquires biometric information again (biometric information for issuer private key recovery) from the issuer, and recovers the issuer private key by performing the same process as the user private key recovery process in step S4502 on the issuer private key recovery biometric information and the issuer template. Then, issuance certificate generation unit 404 generates an issuance certificate using the recovered issuer private key.

[0184] In this way, generating the issuer private key from the issuer biometric information eliminates the need to store the issuer private key, thereby reducing the risk of the issuer private key being leaked. Similarly, it is also possible to generate the verifier private key from the verifier biometric information, which also reduces the risk of the verifier private key being leaked. Note that the portion of the biometric information used to generate the issuer private key and the verifier private key does not necessarily have to be the same as the portion of the biometric information used to generate the user private key.

[0185] [Effects of this Example] This embodiment has the advantage that security is maintained even if all data stored by the user (specifically, the template, the encrypted message, the user public key, and the issuance certificate) can be leaked.

[0186] First, in conventional systems such as ACS, if data stored by a user is leaked, parts of the message other than the submitted partial message are also leaked. On the other hand, in the message presentation system 10 of the present embodiment, even if data stored by a user is leaked, it is difficult to decrypt the encrypted message without the biometric information of the legitimate user, so it is difficult to obtain information on parts of the message other than the submitted partial message.

[0187] Furthermore, in conventional systems such as ACS, if data stored by a user is leaked, there is a risk that an unauthorized user may impersonate the user using the user's private key contained in the data. On the other hand, in the message presentation system 10 of the present embodiment, even if data stored by a user is leaked, it is difficult to restore the user's private key without the legitimate user's biometric information, making it difficult for an unauthorized user to impersonate the user.

[0188] In this way, security is maintained even if all data stored by the user (specifically, the template, encrypted message, user public key, and issuance certificate) is leaked, and this data can be stored in an online location such as cloud storage and processed using a terminal that is not necessarily limited as the presentation device 600.

[0189] In a system where security cannot be maintained in the event of a leak of data stored by a user, possible security measures include strictly managing the data stored by the user (for example, offline) or storing a key for encrypting and decrypting the data stored by the user in a specific terminal and allowing the data to be presented only from that specific terminal. However, these measures have the problem that the user can only perform the presentation process from a specific terminal. This problem can also be solved by the message presentation system 10 of this embodiment.

[0190] Furthermore, during the presentation proof generation process of step S5605, the presentation proof generation unit 606 generates a presentation proof using data transmitted from the verification device 700, thereby reducing the risk of an attack in which a verifier masquerades as a user and presents it to another verifier. Furthermore, the template verification process of step S5604 reduces the risk of fraud, such as template tampering. Furthermore, the aforementioned effects of improving security are achieved depending on the specific example of each process.

[0191] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0192] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The above-described configurations, functions, etc. may also be implemented in software, with a processor interpreting and executing a program that implements each function. Information such as the programs, tables, and files that implement each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0193] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the product. In reality, it can be assumed that almost all components are interconnected. [Explanation of symbols]

[0194] 10 message presentation system, 100 issuer registration device, 200 user registration device, 300 verifier registration device, 400 issuing device, 500 acquisition device, 600 presentation device, 700 verification device, 800 log output device, 901 issuer private key storage DB, 902 issuer public key storage DB, 903 user first DB, 904 verifier private key storage DB, 905 verifier public key storage DB, 906 user second DB, 907 user third DB, 10001 CPU, 10002 memory, 10003 auxiliary storage device

Claims

1. 1. A message presentation system, comprising: a presentation device; The presentation device is a template generated based on the user's biometric information for enrollment; an encrypted message in which a message including one or more message elements is encrypted; a user public key corresponding to the template, the message, and an issuing certificate generated based on an issuer private key corresponding to the issuer of the message; Acquire the user's biometric information to be presented; generating a user private key corresponding to the user public key based on the template and the presented biometric information; decrypting the encrypted message using the user private key to recover the message; generating a partial message from the message based on a presentation part that is information specifying a part to be presented in the message; generating a presentation certificate based on the presentation portion, the issuance certificate, and the user private key; A message presentation system that outputs the partial message and the presentation proof.

2. The message presentation system according to claim 1, further comprising a verification device; the verification device transmits a presentation challenge to the presentation device; The presentation device generates the presentation certificate based on the presentation challenge, the presentation portion, the issuance certificate, and the generated private key.

3. The message presentation system according to claim 1, further comprising a verification device; the verification device holds an issuer public key corresponding to the issuer private key and the presentation portion; the presentation device transmits the presentation proof to the verification device; The verifier verifies the presentation proof using the issuer public key, the presentation portion, and the partial message.

4. The message presentation system according to claim 1, The presentation device verifies whether the template has been tampered with based on the template generation algorithm, and if the verification fails, aborts the process of generating the presentation proof.

5. The message presentation system according to claim 1, The presentation device is connected to an input device, The message presentation system executes acquisition of the presented biometric information when input of consent to output the presented portion is received via the input device.

6. The message presentation system according to claim 5, The presentation device is generating data for outputting a display screen for accepting the input of the consent; The display screen includes information indicating message elements of the presentation portion.

7. The message presentation system according to claim 1, A log output device is included, The log output device an encrypted log in which a log relating to the presentation of the presentation portion presented by the presentation device is encrypted with the user public key or the user private key; the template; Acquire the user's biometric information for log output, generating the user private key based on the template and the log output biometric information; decrypting the encrypted log using the user private key; A message presentation system that outputs the decrypted log.

8. The message presentation system according to claim 1, further comprising a verifying device holding a verifier private key; The presentation device is a verifier public key corresponding to said verifier private key; a message presentation system that outputs the partial message to the verification device in a state where the partial message is encrypted using the verifier public key;

9. The message presentation system according to claim 1, DB, the issuing certificate is generated based on the user public key, a message for issuing processing including the message, and the issuer private key; The DB is storing an encrypted message for issuance processing generated by dividing the message for issuance processing into a plurality of parts and encrypting the divided parts; A message presentation system that selects a portion of the encrypted message for issuance as the encrypted message and transmits it to the presentation device.

10. A presentation device for presenting a message, comprising: a processor and a memory, The memory includes: a template generated based on the user's biometric information for enrollment; an encrypted message in which a message including one or more message elements is encrypted; a user public key corresponding to the template, the message, and an issuing certificate generated based on an issuer private key corresponding to the issuer of the message; The processor: Acquire the user's biometric information to be presented; generating a user private key corresponding to the user public key based on the template and the presented biometric information; decrypting the encrypted message using the user private key to recover the message; generating a partial message from the message based on a presentation part that is information specifying a part to be presented in the message; generating a presentation certificate based on the presentation portion, the issuance certificate, and the user private key; a presentation device that outputs the partial message and the presentation proof;

11. A message presentation method using a message presentation system, the message presentation system includes a presentation device; The presentation device is a template generated based on the user's biometric information for enrollment; an encrypted message in which a message including one or more message elements is encrypted; a user public key corresponding to the template, the message, and an issuing certificate generated based on an issuer private key corresponding to the issuer of the message; The message presentation method includes: the presentation device acquires the user's presentation biometric information, the presentation device generates a user private key corresponding to the user public key based on the template and the presentation biometric information; the presentation device recovering the message by decrypting the encrypted message using the user private key; the presentation device generates a partial message from the message based on a presentation portion, which is information specifying a portion of the message to be presented; the presentation device generates a presentation certificate based on the presentation portion, the issuance certificate, and the user private key; The message presentation method, wherein the presentation device outputs the partial message and the presentation proof.

Images