Communication system, aggregation terminal device, server, and program to be executed by computer

Abstract

To provide a communication system capable of minimizing an amount of signature data.SOLUTION: When a signature system is a one-to-one signature system, each of the terminal devices 5 to 7 transmits a data msg detected by itself, identification information id of itself, a signature system type, and the tag tag generated by signing the data msg and the identification information id using a one-to-one signature key to a gateway 3, and the gateway 3 transmits [msg, id, type, tag] received from each of the terminal devices 5 to 7 to a server 1. When the signature system is an aggregate signature system, each of the terminal devices 5 to 7 transmits [msg, id, type, tag' (=tag generated by signing using the aggregate signature key)] to the gateway 3, and the gateway 3 transmits the aggregate tag a_tag and [msg, id] generated by signing msg, id, tag' using the aggregate signature key to the server 1.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a communication system, an aggregation terminal device, a server, and a program to be executed by a computer. [Background technology]

[0002] In networks that collect information from a large number of terminals, such as sensor networks, digital signatures are used to detect data forgery or tampering, or to verify that data is being sent from the correct terminal (Non-Patent Document 1).

[0003] In the case of digital signatures, as the number of terminals increases, the amount of signatures also increases enormously, resulting in an increase in communication volume.

[0004] A digital signature technique called aggregate signature can be used to reduce the amount of signature data by compressing multiple signatures. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] L. Shen, J. Ma, X. Liu, F. Wei and M. Miao, "A secure and efficient ID-based aggregate signature scheme for wireless sensor networks", IEEE Internet Things J., vol. 4, no. 2, pp. 546-554, Apr. 2017. Summary of the Invention [Problem to be solved by the invention]

[0006] However, although aggregate signatures can reduce the amount of signature data when there are many terminals, there is a problem in that the amount of signature data increases when there are only a few terminals.

[0007] Therefore, according to the embodiment of the present invention, a communication system capable of minimizing the amount of signature data is provided.

[0008] Furthermore, according to an embodiment of the present invention, there is provided a program for causing a computer to minimize the amount of signature data.

[0009] Furthermore, according to the embodiment of the present invention, an aggregation terminal device is provided that can minimize the amount of signature data.

[0010] Furthermore, according to the embodiment of the present invention, a server is provided that can minimize the amount of signature data. [Means for solving the problem]

[0011] (Configuration 1) According to an embodiment of the present invention, a communication system includes a server, a first aggregation terminal device, and n1 (n1 is an integer equal to or greater than 1) terminal devices. The server stores data. The first aggregation terminal device transmits data to the server. The n1 terminal devices are located within the communication range of the first aggregation terminal device.

[0012] Then, each of the n1 terminal devices detects its own data msg, and signs the data msg and its own identification information id using one of the following signature keys that reduces the signature size after digital signing: a one-to-one signature key, which is a digital signature key in a one-to-one signature method that performs a digital signature for each set of [identification information, data], and an aggregate signature key, which is a digital signature key in an aggregate signature method that performs a digital signature for each set of [identification information, data] and creates a signature by compressing multiple signatures corresponding to multiple sets of [identification information, data] into one; and creates a tag tag by signing the data msg and its own identification information id, and transmits the identification information id, data msg, signature method type, and tag tag to the first aggregation terminal device via wireless communication.

[0013] The first aggregation terminal device receives n1 sets of [identification information id, data msg, tag] from n1 terminal devices, and when the signing key is a one-to-one signing key, transmits the n1 sets of [identification information id, data msg, tag] to the server; when the signing key is an aggregate signing key, aggregates the n1 sets of [identification information id, data msg, tag] using n1 aggregate signing keys (public keys) corresponding to the n1 identification information ids to create an aggregate tag a_tag, and transmits the n1 sets of [identification information id, data msg] and the aggregate tag a_tag to the server.

[0014] When the server receives n1 sets of [identification information id, data msg, tag] from the first aggregation terminal device, it verifies the data msg using the tag tag based on one set of [identification information id, data msg, tag] among the n1 sets of [identification information id, data msg, tag] and creates verification results for all n1 sets of [identification information id, data msg, tag] and stores the n1 sets of [verification results and data msg], and when it receives n1 sets of [identification information id, data msg] and aggregation tag a_tag from the first aggregation terminal device, it verifies the n1 pieces of data msg included in the n1 sets of [identification information id, data msg] using the aggregation tag a_tag and creates n1 verification results, and stores the [n1 verification results and n1 pieces of data msg].

[0015] (Configuration 2) In configuration 1, the server determines a digital signature scheme DSM to be used from the one-to-one signature scheme and the aggregate signature scheme, and transmits the determined digital signature scheme DSM to a first aggregation terminal device. The first aggregation terminal device receives the digital signature scheme DSM from the server and transmits the received digital signature scheme DSM to n1 terminal devices via wireless communication.

[0016] (Configuration 3) In configuration 2, the server determines the digital signature scheme DSM based on the number of terminal devices present within the communication range of the first aggregation terminal device.

[0017] (Configuration 4) In configuration 3, the server determines the digital signature scheme DSM as the signature scheme that results in the smallest aggregated signature size from the one-to-one signature scheme and the aggregate signature scheme based on a first relational equation that shows the relationship between the aggregated signature size in the one-to-one signature scheme and the number of terminal devices, and a second relational equation that shows the relationship between the aggregated signature size in the aggregate signature scheme and the number of terminal devices.

[0018] (Configuration 5) In configuration 4, the server counts a first number N_A, which is the number of data in the one-to-one signature scheme, and a second number N_B, which is the number of data in the aggregate signature scheme, based on data received from a first aggregation terminal device, calculates the sum N_A+N_B of the first number N_A and the second number N_B as the number of terminal devices, detects a first aggregated signature size corresponding to the sum N_A+N_B based on a first relational expression, and detects a second aggregated signature size corresponding to the sum N_A+N_B based on a second relational expression, and determines the signature scheme when the smaller aggregated signature size of the first aggregated signature size and the second aggregated signature size is obtained as the digital signature scheme DSM.

[0019] (Configuration 6) In configuration 2, the first aggregation terminal device determines whether the digital signature method DSM is different from the signature method in the n1 terminal devices, and when it determines that the digital signature method DSM is different from the signature method in the n1 terminal devices, it transmits the digital signature method DSM to the n1 terminal devices via wireless communication.

[0020] (Configuration 7) Each of the n1 terminal devices determines whether or not it has received the digital signature scheme DSM from the first aggregation terminal device via wireless communication, or whether or not the transmission time of the data msg has arrived, and when it determines that it has received the digital signature scheme DSM from the first aggregation terminal device, it changes the digital signature scheme to the received digital signature scheme DSM.

[0021] (Configuration 8) In configuration 1, the first aggregation terminal device determines a digital signature scheme DSM, which is the digital signature scheme to be used from the one-to-one signature scheme and the aggregate signature scheme, and transmits the determined digital signature scheme DSM to n1 terminal devices via wireless communication.

[0022] (Configuration 9) In configuration 8, the first aggregation terminal device determines the digital signature scheme DSM based on the number of terminal devices present within its own communication range.

[0023] (Configuration 10) In configuration 9, the first aggregation terminal device determines the signature method DSM that results in the smaller signature size after aggregation from among the one-to-one signature method and the aggregate signature method, based on a first relational equation that shows the relationship between the signature size after aggregation in the one-to-one signature method and the number of terminal devices, and a second relational equation that shows the relationship between the signature size after aggregation in the aggregate signature method and the number of terminal devices.

[0024] (Configuration 11) In configuration 10, the first aggregation terminal device detects the number of terminal devices that have sent at least one of data in the one-to-one signature scheme and data in the aggregate signature scheme to itself, detects a first aggregated signature size corresponding to the number of terminal devices based on a first relational expression, and detects a second aggregated signature size corresponding to the number of terminal devices based on a second relational expression, and determines the signature scheme when the smaller aggregated signature size of the first aggregated signature size and the second aggregated signature size is obtained as the digital signature scheme DSM.

[0025] (Configuration 12) In configuration 8, the first aggregation terminal device determines whether the digital signature method DSM is different from the signature method in the n1 terminal devices, and when it determines that the digital signature method DSM is different from the signature method in the n1 terminal devices, it transmits the digital signature method DSM to the n1 terminal devices via wireless communication.

[0026] (Configuration 13) In configuration 8, each of the n1 terminal devices determines whether or not it has received a digital signature scheme DSM from a first aggregation terminal device via wireless communication, or determines whether or not the transmission time of the data msg has arrived, and when it determines that it has received the digital signature scheme DSM from the first aggregation terminal device, it changes the digital signature scheme to the received digital signature scheme DSM.

[0027] (Configuration 14) In configuration 1, the system further includes a second aggregation terminal device and n2 (n2 is an integer equal to or greater than 1) terminal devices. The second aggregation terminal device transmits data to the server. The n2 terminal devices are located within the communication range of the second aggregation terminal device.

[0028] Each of the n2 terminal devices detects its own data, data msg, and uses a signature key between the one-to-one signature key and the aggregate signature key that will result in a smaller signature size after digital signing to sign the data msg and its own identification information, identification information id, to create a tag tag, and then transmits the identification information id, data msg, and tag tag to a second aggregation terminal device via wireless communication.

[0029] The second aggregation terminal device receives n2 sets of [identification information id, data msg, tag] from n2 terminal devices, and when the signing key is a one-to-one signing key, transmits the n2 sets of [identification information id, data msg, tag] to the server; when the signing key is an aggregate signing key, aggregates the n2 sets of [identification information id, data msg, tag] using n2 aggregate signing keys (public keys) corresponding to the n2 identification information ids to create an aggregate tag a_tag, and transmits the n2 sets of [identification information id, data msg] and aggregate tag a_tag to the server.

[0030] When the server receives n2 sets of [identification information id, data msg, tag] from the second aggregation terminal device, it verifies the data msg using the tag tag based on one set of [identification information id, data msg, tag] among the n2 sets of [identification information id, data msg, tag] and creates verification results for all n2 sets of [identification information id, data msg, tag] and stores the n2 sets of [verification results and data msg], and when it receives n2 sets of [identification information id, data msg] and aggregation tag a_tag from the second aggregation terminal device, it verifies the n2 pieces of data msg included in the n2 sets of [identification information id, data msg] using the aggregation tag a_tag and creates n2 verification results, and stores the [n2 verification results and n2 pieces of data msg].

[0031] (Configuration 15) According to an embodiment of the present invention, the program executed by a computer includes: a first step in which the setting means sets, as the signature method to be used, one of a one-to-one signature method in which a digital signature is issued for each set of [identification information, data], and an aggregate signature method in which a digital signature is issued for each set of [identification information, data] and multiple signatures corresponding to multiple sets of [identification information, data] are compressed into one signature; a second step in which the determining means determines whether or not a digital signature scheme DSM, which is a digital signature scheme to be used, has been received after the first step, or whether or not a data transmission time has arrived; a third step in which the control means changes the signature method set in the first step to the digital signature method DSM when it is determined in the second step that the digital signature method has been received; a fourth step in which the signature means, when it is determined in the second step that the data transmission time has arrived, signs the identification information id of the terminal device and the data msg detected in the terminal device using the digital signature method DSM to create a tag tag; The transmitting means is a program for causing a computer to execute a fifth step of transmitting the identification information id of the terminal device, the data msg, and the tag tag to the aggregation terminal device.

[0032] (Configuration 16) Furthermore, according to an embodiment of the present invention, the program executed by the computer includes: a first step in which a determination means determines whether signature data has been received from an aggregation terminal device; The program causes a computer to execute a second step in which, when the verification means determines that signature data has been received in the first step, the verification means verifies and stores the signature data received in the first step.

[0033] (Configuration 17) In configuration 16, a third step in which, when it is determined in the first step that the signature data has been received, the counting means counts the number of pieces of identification information of the terminal device that has detected the signature data received in the first step; a fourth step in which the determination means determines the digital signature method based on the number of pieces of identification information of the terminal device; The method further causes the computer to execute a fifth step in which the transmitting means transmits the digital signature method determined in the fourth step to the aggregation terminal device.

[0034] (Configuration 18) In structure 17, In the fourth step, the determination means detects a first aggregated signature size corresponding to the number of identification information of the terminal devices in a first relational expression showing the relationship between the aggregated signature size and the number of terminal devices in a one-to-one signature method that performs a digital signature for each set of [identification information, data], and a second aggregated signature size corresponding to the number of identification information of the terminal devices in a second relational expression showing the relationship between the aggregated signature size and the number of terminal devices in an aggregate signature method that performs a digital signature for each set of [identification information, data] and creates a signature by compressing multiple signatures corresponding to multiple sets of [identification information, data] into one, and determines the digital signature method by detecting the signature method that results in the smaller of the first aggregated signature size and the second aggregated signature size.

[0035] (Configuration 19) Furthermore, according to an embodiment of the present invention, the aggregation terminal device is an aggregation terminal device that transmits data msg detected by the terminal device to the server, and includes a receiving means and a transmitting means.

[0036] The receiving means receives from n1 (n1 is an integer greater than or equal to 1) terminal devices via wireless communication [identification information id, data msg, signature method type, tag tag] including a tag created by signing data msg and identification information id, which is identification information of the terminal device, using a signature key that reduces the signature size after digital signature, from among a one-to-one signature key, which is a digital signature key in a one-to-one signature method that performs a digital signature for each set of [identification information, data], and an aggregate signature key, which is a digital signature key in an aggregate signature method that performs a digital signature for each set of [identification information, data] and creates a signature by compressing multiple signatures corresponding to multiple sets of [identification information, data] into one, the identification information id, the data msg, and a signature method consisting of either the one-to-one signature method or the aggregate signature method.

[0037] When the signature method is a one-to-one signature method, the sending means transmits to the server n1 pieces of [identification information id, data msg, tag tag] with n1 signature method types removed from the n1 pieces of [identification information id, data msg, signature method type, tag tag] received by the receiving means, and when the signature method is an aggregate signature method, aggregates the n1 pieces of [identification information id, data msg, signature method type, tag tag] with n1 signature method types removed from the n1 pieces of [identification information id, data msg, signature method type, tag tag] received by the receiving means using n1 aggregate signature keys (public keys) corresponding to the n1 pieces of identification information id to generate an aggregate tag a_tag, and transmits the n1 pieces of [identification information id, data ms] and the aggregate tag a_tag to the server.

[0038] (Configuration 20) In configuration 19, the aggregation terminal device further includes a determination means, which determines the signature method type based on the n1 pieces of [tag tag, identification information id, data msg, signature method type] received by the receiving means, based on the sum N_A+N_B of the number N_A of terminal devices whose signature method is the one-to-one signature method and the number N_B of terminal devices whose signature method is the aggregate signature method.

[0039] The transmitting means further transmits the signature method type determined by the determining means to n1 terminal devices by wireless communication.

[0040] (Configuration 21) In configuration 20, when the signature method type determined by the determination means is different from the signature method in the terminal device, the transmission means transmits the signature method determined by the determination means to n1 terminal devices by wireless communication.

[0041] (Configuration 22) Furthermore, according to an embodiment of the present invention, the server receives the data msg detected by the terminal device, and includes a receiving means and a verifying means.

[0042] A signature method that digitally signs each set of [identification information, data] is called a one-to-one signature method, a signature method that digitally signs each set of [identification information, data] and creates a signature that compresses multiple signatures corresponding to multiple sets of [identification information, data] into one is called an aggregate signature method, the digital signature key in the one-to-one signature method is called a one-to-one signature key, and the digital signature key in the aggregate signature method is called an aggregate signature key, When the signature method is a one-to-one signature method, the receiving means receives from the aggregation terminal device [identification information id, data msg, tag tag] including a tag tag created by signing data msg and identification information id, which is identification information of the terminal device, using a one-to-one signature key, the identification information id, and the data msg, and when the signature method is an aggregate signature method, receives from the aggregation terminal device an aggregate tag a_tag created by aggregating multiple [identification information id, data msg, tag] using an aggregate signature key (public key) corresponding to the multiple identification information ids, and multiple [identification information id, data msg].

[0043] The verification means verifies the data msg based on the [identification information id, data msg, tag tag] or [identification information id, data msg] and the aggregation tag a_tag received by the receiving means, and stores the verification result and the data msg.

[0044] (Configuration 23) In configuration 22, the server further includes a determination means. The determination means counts the number N_A of terminal devices whose signature method is the one-to-one signature method based on the [identification information id, data msg, tag] received by the receiving means, counts the number N_B of terminal devices whose signature method is the aggregate signature method based on the [identification information id, data msg] received by the receiving means, and determines the signature method based on the sum N_A+N_B of the numbers N_A and N_B.

[0045] (Configuration 24) In configuration 23, the server further comprises a transmitting means for transmitting the signature scheme determined by the determining means to the aggregation terminal device. [Effects of the Invention]

[0046] The amount of signature data can be minimized. [Brief explanation of the drawings]

[0047] [Figure 1] 1 is a schematic diagram of a communication system in accordance with embodiment 1 of the present invention. [Figure 2] FIG. 1 is a schematic diagram illustrating a comparison between one-to-one signatures and aggregate signatures. [Figure 3] FIG. 2 is a schematic diagram for explaining a data collection operation in the communication system 10 shown in FIG. [Figure 4] FIG. 2 is a schematic diagram of the server 1 shown in FIG. [Figure 5] FIG. 2 is a schematic diagram of the gateway 3 shown in FIG. [Figure 6] FIG. 2 is a schematic diagram of a terminal device 5 shown in FIG. [Figure 7] FIG. 10 is a conceptual diagram illustrating an operation for changing a signature method. [Figure 8] FIG. 1 is a conceptual diagram of a correspondence table TBL1. [Figure 9] FIG. 10 is a diagram illustrating the relationship between the signature size after aggregation and the number of signatures. [Figure 10] 7 is a flowchart for explaining the operation of the terminal device 5 shown in FIG. 6. [Figure 11] 6 is a first flowchart for explaining the operation of the gateway 3 shown in FIG. 5. [Figure 12] 6 is a second flowchart illustrating the operation of the gateway 3 shown in FIG. 5. [Figure 13] 5 is a flowchart for explaining the operation of the server 1 shown in FIG. 4. [Figure 14] FIG. 10 is a schematic diagram of a communication system according to a second embodiment. [Figure 15] FIG. 15 is a schematic diagram of a server 1A shown in FIG. [Figure 16] FIG. 15 is a schematic diagram of the gateway 3A shown in FIG. [Figure 17] FIG. 10 is a conceptual diagram of a correspondence table TBL2. [Figure 18] FIG. 10 is a conceptual diagram of a correspondence table TBL3. [Figure 19] 17 is a first flowchart for explaining the operation of the gateway 3A shown in FIG. 16. [Figure 20] 17 is a second flowchart illustrating the operation of the gateway 3A shown in FIG. [Figure 21] 16 is a flowchart for explaining the operation of the server 1A shown in FIG. 15. DETAILED DESCRIPTION OF THE INVENTION

[0048] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will now be described in detail with reference to the accompanying drawings, in which like or corresponding parts are designated by like reference numerals and will not be described repeatedly.

[0049] [Embodiment 1] 1 is a schematic diagram of a communication system according to embodiment 1 of the present invention. Referring to Fig. 1, a communication system 10 according to embodiment 1 of the present invention includes a server 1, a base station 2, gateways 3 and 4, and terminal devices 5 to 9.

[0050] The server 1, the base station 2, and the gateways 3 and 4 constitute a network NW1. The gateways 3 and 4 and the terminal devices 5 to 9 constitute a network NW2.

[0051] The network NW1 includes, for example, Long Term Evolution (LTE) / 5G, the Internet, etc. The network NW2 includes, for example, a wireless local area network (LAN) and a wireless smart utility network (Wi-SUN).

[0052] The base station 2 is connected to the server 1 by a wired cable. The gateways 3 and 4 are located within the wireless communication range of the base station 2.

[0053] Terminal devices 5 to 7 are located within the wireless communication range of gateway 3. Terminal devices 8 and 9 are located within the wireless communication range of gateway 4.

[0054] The server 1 determines the signature method for the digital signature to be the one-to-one signature method or the aggregate signature method using a method described later. Then, the server 1 transmits the determined signature method to the gateways 3 and 4 via the base station 2.

[0055] The server 1 receives from the gateway 3 via the base station 2 the data msg_3_5 detected by the terminal device 5, the data msg_3_6 detected by the terminal device 6, and the data msg_3_7 detected by the terminal device .

[0056] The server 1 also receives, via the base station 2, from the gateway 4, data msg_4_8 detected by the terminal device 8 and data msg_4_9 detected by the terminal device 9.

[0057] Here, the "3" in the data msg_3_5 represents the gateway 3, and the "5" in the data msg_3_5 represents the terminal device 5. As a result, the data msg_3_5 represents the data msg that was detected by the terminal device 5 and sent to the server 1 via the gateway 3. The same applies to the data msg_3_6 and the data msg_3_7.

[0058] Furthermore, the "4" in the data msg_4_8 represents the gateway 4, and the "8" in the data msg_4_8 represents the terminal device 8. As a result, the data msg_4_8 represents the data msg that was detected by the terminal device 8 and sent to the server 1 via the gateway 4. The same applies to the data msg_4_9. The same applies below.

[0059] Then, the server 1 verifies the data msg_3_5 to data msg_4_9 detected by the terminal devices 5 to 9, respectively, by a method to be described later, creates a verification result, and stores the verification result and the data msg_3_5 to data msg_4_9.

[0060] The gateway 3 receives the signature method transmitted from the server 1 from the base station 2 via wireless communication, holds the received signature method, and transmits the signature method to the terminal devices 5 to 7 via wireless communication.

[0061] The gateway 4 receives the signature method transmitted from the server 1 from the base station 2 via wireless communication, holds the received signature method, and transmits the signature method to the terminal devices 8 and 9 via wireless communication.

[0062] Each of the terminal devices 5 to 7 receives the signature method from the gateway 3 via wireless communication. Each of the terminal devices 8 and 9 receives the signature method from the gateway 4 via wireless communication.

[0063] Each of the terminal devices 5 to 9 detects data using a sensor. Then, each of the terminal devices 5 to 7 periodically transmits the detected data to the gateway 3 via wireless communication using a method to be described later. Also, each of the terminal devices 8 and 9 periodically transmits the detected data to the gateway 4 via wireless communication using a method to be described later.

[0064] In the embodiment of the present invention, the signature schemes include a one-to-one signature scheme and an aggregate signature scheme.

[0065] The one-to-one signature scheme is a scheme in which a digital signature is issued for each pair of [identification information id, data msg]. The one-to-one signature key (private key) is the key used for digital signatures in the one-to-one signature scheme, and the one-to-one signature key (public key) is the key used for verification in the one-to-one signature scheme.

[0066] The aggregate signature scheme is a signature scheme in which a digital signature is issued for each pair of [identification information id, data msg] and multiple signatures corresponding to multiple pairs of [identification information id, data msg] are compressed into one signature. The aggregate signature key (private key) is the digital signature key in the aggregate signature scheme, and the aggregate signature key (public key) is the key for verification in the aggregate signature scheme.

[0067] The server 1 holds in advance "one-to-one signature keys (public keys) in the one-to-one signature method" corresponding to the terminal devices 5 to 9, and "aggregate signature keys (public keys) in the aggregate signature method" corresponding to the terminal devices 5 to 9.

[0068] Gateway 3 holds in advance "aggregate signature keys (public keys) in the aggregate signature method" corresponding to its subordinate terminal devices 5 to 7 and other terminal devices, and gateway 4 holds in advance "aggregate signature keys (public keys) in the aggregate signature method" corresponding to its subordinate terminal devices 8 and 9 and other terminal devices.

[0069] Each of terminal devices 5 to 9 holds in advance a one-to-one signature key (private key) for the one-to-one signature scheme and an aggregate signature key (private key) for the aggregate signature scheme. Then, upon receiving the signature scheme from gateway 3, each of terminal devices 5 to 7 selects a signature key (= “one-to-one signature key (private key)” or “aggregate signature key (private key)”) for the received signature scheme. Furthermore, upon receiving the signature scheme from gateway 4, each of terminal devices 8 and 9 selects a signature key (= “one-to-one signature key (private key)” or “aggregate signature key (private key)”) for the received signature scheme.

[0070] In this way, when all of the terminal devices 5 to 7 located within the wireless communication range of the gateway 3 receive a signature scheme from the gateway 3, they select a signature key for the received signature scheme, and when all of the terminal devices 8 and 9 located within the wireless communication range of the gateway 4 receive a signature scheme from the gateway 4, they select a signature key for the received signature scheme.

[0071] Furthermore, when it is time to send data, each of the terminal devices 5 to 9 selects a pre-determined signature key (= “one-to-one signature key (private key)” or “aggregate signature key (private key)”) before receiving the signature method from the gateway (either gateway 3 or 4).

[0072] Furthermore, the terminal devices present within the wireless communication range of the gateway 3 do not always consist of the terminal devices 5 to 7. Any of the terminal devices 5 to 7 may leave the wireless communication range of the gateway 3, or a new terminal device may enter the wireless communication range of the gateway 3. The same applies to the terminal devices present within the wireless communication range of the gateway 4.

[0073] It is assumed that a "new terminal device" that comes within the wireless communication range of the gateway 3 already holds a one-to-one signature key (private key) and an aggregate signature key (private key).

[0074] The signature is made in the following way:

[0075] (Step 1) The sender sends the one-to-one signature key (public key) and the aggregate signature key (public key) to the receiver in advance.

[0076] (Step 2) The receiver obtains the one-to-one signature key (public key) and the aggregate signature key (public key) from the sender.

[0077] (Step 3) The sender signs the identification information id and the data msg with a one-to-one signature key (private key) or an aggregate signature key (private key) to generate a tag tag.

[0078] In this case, the sender generates a tag by extracting from the "identification information id and data msg" a feature that distinguishes the "identification information id and data msg" from other "identification information id and data msg", for example, using a one-to-one signature key (private key) or an aggregate signature key (private key). Note that in the embodiment of the present invention, the method for generating a tag may be any method that generates a tag based on the "identification information id and data msg".

[0079] (Step 4) The sender transmits the identification information id, the data msg, the signature method type (= one-to-one signature method or aggregate signature method), and the tag tag to the receiver via an intermediary.

[0080] When aggregate signatures are used, aggregation is performed using the following method.

[0081] (Step 5) The intermediary aggregates multiple [identification information id, data msg, tag tag, aggregate signature key (public key) corresponding to identification information id] whose signature method type is the aggregate signature method, and generates an aggregation tag a_tag.

[0082] In this case, the intermediary generates the aggregation tag a_tag by combining multiple [tags] into one using multiple [identification information id, data msg, tag, aggregate signature key (public key) corresponding to the identification information id] and eliminating common features. Note that in the embodiment of the present invention, the method for generating the aggregation tag a_tag may be any method as long as it is a method for generating the aggregation tag a_tag based on multiple [identification information id, data msg, tag].

[0083] (Step 6) The intermediary sends multiple [identification information id, data msg], one signature method type (aggregate signature method), and aggregation tag a_tag to the receiver.

[0084] Verification will be carried out in the following manner:

[0085] (Step 7) The recipient receives the identification information id, data msg, signature method type (= one-to-one signature method) and tag tag, or multiple [identification information id, data msg], one signature method type (aggregate signature method) and aggregate tag a_tag.

[0086] (Step 8) If the signature method type is a one-to-one signature method, the receiver verifies the identification information id and data msg using a one-to-one signature key (public key) corresponding to the identification id and the tag tag, and if the signature method type is an aggregate signature method, the receiver verifies using multiple [identification information id, data msg, aggregate signature keys (public keys) corresponding to the identification information id] and the aggregate tag a_tag.

[0087] 2 is a schematic diagram showing a comparison between one-to-one signatures and aggregate signatures, where (a) in FIG. 2 shows the one-to-one signature scheme, and (b) in FIG. 2 shows the aggregate signature scheme.

[0088] The one-to-one signature method uses a public key cryptosystem that uses a private key and a public key. The sender signs the signature target (identification information id and data msg) using a one-to-one signature key (private key) to generate a tag, and then sends the [identification information id, data msg, tag] to the destination. The destination then verifies the identification information id and data msg using the one-to-one signature key (public key) and tag corresponding to the identification information id to determine whether they have been forged or tampered with.

[0089] In addition, the aggregate signature method uses a public key cryptography method that uses a private key and a public key, and the sender signs the signature target (identification information id and data msg) using an aggregate signature key (private key) to generate a tag tag', and sends [identification information id, data msg, tag tag'] to the aggregator.The aggregator uses an aggregate signature key (public key) corresponding to multiple [identification information id, data msg, tag tag'] and multiple identification information ids to generate an aggregate tag a_tag that is smaller than the total size of multiple tags tag', and sends multiple [identification information id, data msg] and aggregate tag a_tag to the destination.The destination verifies the multiple [identification information id, data msg] using the aggregate signature key (public key) corresponding to the multiple identification information ids and aggregate tag a_tag to determine whether or not they have been forged or tampered with.

[0090] Referring to FIG. 2(a), the terminal device a signs the identification information id_a of the terminal device a and the data msg_a detected by the terminal device a with a one-to-one signature key (private key) to generate a tag tag_a.

[0091] Then, the terminal device a transmits [id_a, msg_a, tag_a] including the identification information id_a, the data msg_a, and the tag tag_a to the gateway by wireless communication.

[0092] Furthermore, terminal device b signs the identification information id_b of terminal device b and the data msg_b detected by terminal device b with a one-to-one signature key (private key) to generate a tag tag_b.

[0093] Then, the terminal device b transmits [id_b, msg_b, tag_b] including the identification information id_b, the data msg_b, and the tag tag_b to the gateway via wireless communication.

[0094] Furthermore, the terminal device c signs the identification information id_c of the terminal device c and the data msg_c detected by the terminal device c with a one-to-one signature key (private key) to generate a tag tag_c.

[0095] Then, the terminal device c transmits [id_c, msg_c, tag_c] including the identification information id_c, the data msg_c, and the tag tag_c to the gateway via wireless communication.

[0096] The gateway receives [id_a, msg_a, tag_a], [id_b, msg_b, tag_b], and [id_c, msg_c, tag_c] from terminal devices a, b, and c, respectively.

[0097] Then the gateway sends [id_a,msg_a,tag_a], [id_b,msg_b,tag_b], and [id_c,msg_c,tag_c] to the server.

[0098] The server verifies [id_a, msg_a] using the one-to-one signature key (public key) corresponding to id_a and tag_a to detect whether it has been tampered with.

[0099] The server determines whether the identification information id_b and data msg_b are authentic or have been tampered with for each of [id_b, msg_b, tag_b] and [id_c, msg_c, tag_c] in the same manner as for [id_a, msg_a, tag_a], and determines whether the identification information id_c and data msg_c are authentic or have been tampered with.

[0100] Referring to FIG. 2(b), terminal device a signs the identification information id_a of terminal device a and data msg_a detected by terminal device a with an aggregate signature key (private key) to generate tag tag'_a.

[0101] Then, the terminal device a transmits [id_a, msg_a, tag'_a] including the identification information id_a, the data msg_a, and the tag tag'_a to the gateway by wireless communication.

[0102] Furthermore, terminal device b signs the identification information id_b of terminal device b and the data msg_b detected by terminal device b with an aggregate signature key (private key) to generate a tag tag'_b.

[0103] Then, the terminal device b transmits [id_b, msg_b, tag'_b] including the identification information id_b, the data msg_b, and the tag tag'_b to the gateway via wireless communication.

[0104] Furthermore, the terminal device c signs the identification information id_c of the terminal device c and the data msg_c detected by the terminal device c with an aggregate signature key (private key) to generate a tag tag'_c.

[0105] Then, the terminal device c transmits [id_c, msg_c, tag'_c] including the identification information id_c, the data msg_c, and the tag tag'_c to the gateway by wireless communication.

[0106] The gateway receives [id_a, msg_a, tag'_a], [id_b, msg_b, tag'_b], and [id_c, msg_c, tag'_c] from terminal devices a, b, and c, respectively.

[0107] Then, the gateway generates the aggregation tag a_tag using [id_a, msg_a, tag'_a], [id_b, msg_b, tag'_b], [id_c, msg_c, tag'_c], the aggregate signing key (public key) corresponding to id_a, the aggregate signing key (public key) corresponding to id_b, and the aggregate signing key (public key) corresponding to id_c.

[0108] The gateway then sends [id_a, msg_a], [id_b, msg_b], [id_c, msg_c] and the aggregation tag a_tag to the server.

[0109] The server receives [id_a, msg_a], [id_b, msg_b], [id_c, msg_c] and the aggregation tag a_tag from the gateway.

[0110] The server then verifies [id_a, msg_a], [id_b, msg_b], and [id_c, msg_c] using the aggregate signing key (public key) corresponding to id_a, the aggregate signing key (public key) corresponding to id_b, the aggregate signing key (public key) corresponding to id_c, and the aggregation tag a_tag, to determine whether they have been tampered with.

[0111] In this way, in the one-to-one signature method, each terminal device signs its own identification information ID and the data MSG detected by itself using a one-to-one signature key (private key) to generate a tag, and then transmits the identification information ID, data MSG, and tag to the gateway.The gateway then transmits the identification information ID, data MSG, and tag received from each terminal device directly to the server, and the server receives the identification information ID, data MSG, and tag from the gateway and verifies the received identification information ID and data MSG using the one-to-one signature key (public key) corresponding to the identification information ID and the tag.

[0112] On the other hand, in the aggregate signature method, each terminal device signs its own identification information id and the data msg detected by itself using an aggregate signature key (private key) to generate a tag tag', and transmits the identification information id, data msg, and tag tag' to the gateway. The gateway generates an aggregate tag a_tag through an aggregation process using the identification information id, data msg, and tag tag' received from each terminal device and the aggregate signature key (public key) corresponding to the identification information id received from each terminal device, and transmits multiple [identification information id, data msg] and aggregate tag a_tag to the server. When the server receives multiple [identification information id, data msg] and aggregate tag a_tag from the gateway, it verifies the multiple [identification information id, data msg] using the aggregate signature key (public key) corresponding to the multiple identification information ids and the aggregate tag a_tag to detect whether or not it has been tampered with.

[0113] Fig. 3 is a schematic diagram for explaining the data collection operation in the communication system 10 shown in Fig. 1. That is, Fig. 3 is a schematic diagram for explaining the data collection operation according to the embodiment of the present invention.

[0114] Referring to FIG. 3, terminal devices 5 to 7 employ the one-to-one signature scheme, and terminal devices 8 and 9 employ the aggregate signature scheme.

[0115] The terminal device 5 signs the identification information id_3_5 and the data msg_3_5 using a one-to-one signature key (private key) according to the one-to-one signature method to generate a tag tag_3_5, and transmits [id_3_5, msg_3_5, type_3_5, tag_3_5] including the identification information id_3_5, the data msg_3_5, the signature method type_3_5 (= one-to-one signature method) and the tag tag_3_5 to the gateway 3 via wireless communication.

[0116] Similarly, the terminal device 7 transmits [id_3_7, msg_3_7, type_3_7, tag_3_7], which includes the identification information id_3_7, data msg_3_7, signature method type_3_7 (= one-to-one signature method), and tag tag_3_7, to the gateway 3 via wireless communication according to the one-to-one signature method.

[0117] The gateway 3 receives [id_3_5, msg_3_5, type_3_5, tag_3_5] to [id_3_7, msg_3_7, type_3_7, tag_3_7] from the terminal devices 5 to 7, respectively.

[0118] Then, gateway 3 sends to server 1 {[id_3_5,msg_3_5,tag_3_5]~[id_3_7,msg_3_7,tag_3_7],gw_id_3,gw_type_3(=one-to-one signature method)}, which combines [id_3_5,msg_3_5,tag_3_5]~[id_3_7,msg_3_7,tag_3_7] with gateway 3's identification information gw_id_3 and gateway 3's signature method gw_type_3(=one-to-one signature method), and [NULL_agg,gw_id_3,gw_type_3(=one-to-one signature method)], which combines ``NULL_agg'', which means that there is no received aggregate signature method data, with gateway 3's identification information gw_id_3 and signature method type(=gw_type_3(one-to-one signature method)).

[0119] Meanwhile, terminal device 8 signs identification information id_4_8 and data msg_4_8 using an aggregate signature key (private key) in accordance with the aggregate signature method to generate tag tag_4_8, and transmits [id_4_8, msg_4_8, type_4_8, tag_4_8] including identification information id_4_8, data msg_4_8, signature method type_4_8 (= aggregate signature method), and tag tag_4_8 to gateway 4 via wireless communication.

[0120] Similarly, the terminal device 9 transmits [id_4_9, msg_4_9, type_4_9, tag_4_9] including identification information id_4_9, data msg_4_9, signature method type_4_9 (=aggregate signature method), and tag tag_4_9 to the gateway 4 via wireless communication in accordance with the aggregate signature method.

[0121] Gateway 4 receives [id_4_8, msg_4_8, type_4_8, tag_4_8] and [id_4_9, msg_4_9, type_4_9, tag_4_9] from terminal device 8 and terminal device 9, respectively.

[0122] Then, gateway 4 aggregates [id_4_8, msg_4_8, tag_4_8], [id_4_9, msg_4_9, tag_4_9], the aggregate signature key (public key) corresponding to identification information id_4_8, and the aggregate signature key (public key) corresponding to identification information id_4_9 to generate aggregation tag a_tag_4.

[0123] Gateway 4 then sends to Server 1 {[id_4_8,msg_4_8], [id_4_9,msg_4_9],a_tag_4,gw_id_4,gw_type_4(aggregate signature method)}, which is a combination of [id_4_8,msg_4_8] and [id_4_9,msg_4_9], the aggregation tag a_tag_4, Gateway 4's identification information gw_id_4, and the signature method type (=gw_type_4(aggregate signature method)), and [NULL_1to1,gw_id_4,gw_type_4(aggregate signature method)], which is a combination of "NULL_1to1", which means that no one-to-one signature method data has been received, Gateway 4's identification information gw_id_4, and the signature method type (=gw_type_4(aggregate signature method)).

[0124] Server 1 receives from Gateway 3 {[id_3_5,msg_3_5,tag_3_5]~[id_3_7,msg_3_7,tag_3_7],gw_id_3,gw_type_3(one-to-one signature method)}, which combines [id_3_5,msg_3_5,tag_3_5]~[id_3_7,msg_3_7,tag_3_7] with Gateway 3's identification information gw_id_3 and Gateway 3's signature method gw_type_3, and [NULL_agg,gw_id_3,gw_type_3(one-to-one signature method)], which combines "NULL_agg", which means that there is no aggregate signature method received data, with Gateway 3's identification information gw_id_3 and signature method type (=aggregate signature method), and From gateway 4, the following is received: {[id_4_8,msg_4_8], [id_4_9,msg_4_9],a_tag_4,gw_id_4,gw_type_4(aggregate signature method)}, which is a combination of [id_4_8,msg_4_8] and [id_4_9,msg_4_9], aggregation tag a_tag_4, gateway 4's identification information gw_id_4, and signature method type (=gw_type_4(aggregate signature method)); and [NULL_1to1,gw_id_4,gw_type_4(aggregate signature method)], which is a combination of "NULL_1to1", which means that no one-to-one signature method data has been received, gateway 4's identification information gw_id_4, and signature method type (=gw_type_4(aggregate signature method)).

[0125] This completes the operation of collecting data from the terminal devices 5 to 9.

[0126] In FIG. 3, the gateway 3 sends to the server 1, by the one-to-one signature method, {[id_3_5,msg_3_5,tag_3_5] to [id_3_7,msg_3_7,tag_3_7],gw_id_3,gw_type_3 (one-to-one signature method)}, which is a combination of [id_3_5,msg_3_5,tag_3_5] to [id_3_7,msg_3_7,tag_3_7],gw_id_3,gw_type_3 (one-to-one signature method)}, which is a combination of the gateway 3's identification information gw_id_3 and the gateway 3's signature method gw_type_3, and "NULL_agg", which means that there is no received data by the aggregate signature method, and the gateway 3's identification information gw_id_3 and the signature method type (=aggregate signature method). Gateway 4 sends to Server 1 using the aggregate signature method {[id_4_8,msg_4_8], [id_4_9,msg_4_9],a_tag_4,gw_id_4,gw_type_4(aggregate signature method)}, which is a combination of [id_4_8,msg_4_8] and [id_4_9,msg_4_9], the aggregation tag a_tag_4, Gateway 4's identification information gw_id_4, and the signature method type (=gw_type_4(aggregate signature method)), and [NULL_1to1,gw_id_4,gw_type_4(aggregate signature method)], which is a combination of "NULL_1to1", which means that there is no received data using the one-to-one signature method, Gateway 4's identification information gw_id_4, and the signature method type (=gw_type_4(one-to-one signature method)).

[0127] Then, the gateway 3 may send to the server 1, by the aggregate signature method, {[id_3_5,msg_3_5] to [id_3_7,msg_3_7],a_tag_3,w_id_3,gw_type_3(aggregate signature method)}, which is a combination of [id_3_5,msg_3_5] to [id_3_7,msg_3_7], the aggregation tag a_tag_3, the gateway 3's identification information gw_id_3, and the signature method type (=gw_type_3(aggregate signature method)), or [NULL_1to1,gw_id_3,gw_type_3(aggregate signature method)], which is a combination of "NULL_1to1", which means that there is no one-to-one signature method received data, the gateway 3's identification information gw_id_3, and the signature method type (=gw_type_3(one-to-one signature method)). Gateway 4 may send to Server 1, by one-to-one signature method, {[id_4_8,msg_4_8,tag_4_8]~[id_4_9,msg_4_9,tag_4_9],gw_id_4,gw_type_4(one-to-one signature method)}, which combines [id_4_8,msg_4_8,tag_4_8]~[id_4_9,msg_4_9,tag_4_9] with Gateway 4's identification information gw_id_4 and Gateway 4's signature method gw_type_4(one-to-one signature method), or [NULL_agg,gw_id_4,gw_type_4(one-to-one signature method)], which combines "NULL_agg", which means that there is no received data using the aggregate signature method, with Gateway 4's identification information gw_id_4 and signature method type (=gw_type_4(one-to-one signature method)).

[0128] Fig. 4 is a schematic diagram of the server 1 shown in Fig. 1. Referring to Fig. 4, the server 1 includes a receiving means 11, a control means 12, a verifying means 13, a determining means 14, a sending means 15, and a database 16.

[0129] In the embodiment of the present invention, a round s (s is an integer equal to or greater than 1) is set as a period during which all of the terminal devices 5 to 9 in the communication system 10 transmit data msg to the server 1 via the gateways 3 and 4.

[0130] In addition, in an embodiment of the present invention, the server 1 sets N_A, which is the result of counting the number of IDs (= number of IDs) of identification information of terminal devices contained in the one-to-one signature data (= multiple [identification information id, data msg, tag tag] from terminal devices 5 to 9).

[0131] Furthermore, in an embodiment of the present invention, the server 1 sets N_B, which is the result of counting the number of IDs (= number of IDs) of the identification information of the terminal devices contained in the aggregate signature data (= multiple [identification information id, data msg, tag a_tag] from terminal devices 5 to 9).

[0132] When the signature method of the gateway 3 is the one-to-one signature method, the receiving means 11 of the server 1 receives from the gateway 3 via the base station 2 {multiple [id, msg, tag], gw_id_3, gw_type_3 (one-to-one signature method)}, which is a combination of multiple [id, msg, tag] including identification information id of multiple terminal devices, data msg of multiple terminal devices, and multiple tags tag, identification information gw_id_3 of the gateway 3, and signature method gw_type_3 (one-to-one signature method) of the gateway 3, and [NULL_agg, gw_id_3, type (one-to-one signature method)], which is a combination of "NULL_agg", which means that there is no received data using the aggregate signature method, identification information gw_id_3 of the gateway 3, and signature method type (one-to-one signature method).

[0133] In addition, when the signature method of the gateway 4 is the aggregate signature method, the receiving means 11 of the server 1 receives from the gateway 4 via the base station 2 {multiple [id, msg], a_tag, gw_id_4, gw_type_4(aggregate signature method)} which combines the identification information id of multiple terminal devices, the data msg of multiple terminal devices, the aggregation tag a_tag, the identification information gw_id_4 of the gateway 4, and the signature method type of the gateway 4 (= gw_type_4(aggregate signature method)), and [NULL_1to1, gw_id_4, gw_type_4(aggregate signature method)] which combines ``NULL_1to1'', which means that there is no received data using the one-to-one signature method, with the identification information gw_id_4 of the gateway 4 and the signature method type (= gw_type_4(aggregate signature method)).

[0134] After the signature method (=one-to-one signature method) is transmitted from the server 1 to the terminal devices 5 to 7, the data msg received by the receiving means 11 of the server 1 is the data msg_1to1 in the signature method (=one-to-one signature method) transmitted to the terminal devices 5 to 7.

[0135] However, after the signature method (= one-to-one signature method) is sent to terminal devices 5 to 7, as described above, when a new terminal device enters the wireless communication range of gateway 3, the new terminal device does not receive the signature method (= one-to-one signature method) sent from server 1, and therefore sends data msg, etc. to server 1 via gateway 3 using any signature method of the one-to-one signature method and the aggregate signature method.

[0136] In this case, each of terminal devices 5 to 7 will send ``data msg_1to1'' to server 1 via gateway 3 when the signature method is the one-to-one signature method, and the new terminal device may also send ``data msg_agg'' to server 1 via gateway 3 when the signature method is the aggregate signature method.

[0137] As a result, the receiving means 11 of the server 1 receives {plurality of [identification information id, data msg, tag tag], identification information gw_id, signature method gw_type (one-to-one signature method)} when the signature method is the one-to-one signature method, and {plurality of [identification information id, data msg], aggregate tag a_tag, identification information gw_id, signature method gw_type (one-to-one signature method)} when the signature method is the aggregate signature method.

[0138] Furthermore, when a new terminal device selects the same signature method (= one-to-one signature method) as terminal devices 5 to 7, the receiving means 11 of server 1 receives {multiple [identification information id, data msg, tag tag], identification information gw_id, signature method gw_type (one-to-one signature method)} and [NULL_agg, identification information gw_id, signature method gw_type (one-to-one signature method)] when the signature method is the one-to-one signature method.

[0139] On the other hand, when the signature method transmitted to the terminal devices 5 to 7 is the aggregate signature method, the receiving means 11 of the server 1 receives the “data msg_agg” of the aggregate signature method from the gateway 3 via the base station 2.

[0140] Then, after the aggregate signature scheme has been sent to terminal devices 5 to 7, when a new terminal device enters the wireless communication range of gateway 3, the new terminal device may send “data msg_1to1” of the one-to-one signature scheme to gateway 3.

[0141] Furthermore, as described above, when the terminal devices 5 to 7 leave the wireless communication range of the gateway 3, the gateway 3 does not receive data from the terminal devices. In response to this, the gateway 3 transmits to the server 1 [NULL_1to1, identification information gw_id, signature method gw_type] including NULL_1to1, which means that no one-to-one signature method data has been received, and [NULL_agg, identification information gw_id, signature method gw_type] including NULL_agg, which means that no aggregate signature method data has been received.

[0142] Therefore, the receiving means 11 of the server 1 generally: When the signature method of Gateway 3 is one-to-one signature method, (1) One of the following: a one-to-one signature scheme {multiple [identification information id, data msg, tag tag], identification information gw_id, signature method gw_type (one-to-one signature scheme)} and [NULL_1to1, identification information gw_id, signature method gw_type (one-to-one signature scheme)]; and an aggregate signature scheme {multiple [id, msg], a_tag, gw_id_3, gw_type_3 (one-to-one signature scheme)} and [NULL_agg, identification information gw_id, signature method gw_type (one-to-one signature scheme)] is received from Gateway 3, When the signature scheme of Gateway 3 is the aggregate signature scheme, (2) Either of the aggregate signature scheme {multiple [id, msg], a_tag, gw_id_3, gw_type_3 (aggregate signature scheme)} and [NULL_agg, identification information gw_id, signature scheme gw_type (aggregate signature scheme)], and either of the one-to-one signature scheme {multiple [identification information id, data msg, tag tag], identification information gw_id, signature scheme gw_type (aggregate signature scheme)} and [NULL_1to1, identification information gw_id, signature scheme gw_type (aggregate signature scheme)] is received from Gateway 3.

[0143] The same applies to the data that the receiving means 11 of the server 1 receives from the gateway 4.

[0144] Here, the data (1) received by the receiving means 11 of the server 1 from the gateways 3 and 4 is referred to as "data msg_gw_1to1", and the data (2) received by the receiving means 11 of the server 1 from the gateways 3 and 4 is referred to as "data msg_gw_agg".

[0145] The control means 12 of the server 1 receives the data msg_gw_1to1, msg_gw_agg from the receiving means 11 and outputs the received data msg_gw_1to1, msg_gw_agg to the verifying means 13.

[0146] Furthermore, when the control means 12 receives the signature method and the gateway to which the signature method is to be sent from the determination means 14, it outputs the received signature method and the gateway to which the signature method is to be sent to the transmission means 15.

[0147] The verification means 13 holds a one-to-one signature key (public key) and an aggregate signature key (public key).

[0148] The verification means 13 receives the data msg_gw_1to1 and msg_gw_agg from the control means 12. Then, the verification means 13 refers to the data msg_gw_1to1 and determines whether or not there is signature data.

[0149] In this case, the verification means 13 determines that the data msg_gw_1to1 contains aggregate signature method data when it consists of {multiple [id, msg], a_tag, gw_id_3, gw_type_3 (aggregate signature method)} and [NULL_1to1, gw_id_3, gw_type_3 (one-to-one signature method)], or when it consists of {multiple [id, msg], a_tag, gw_id_3, gw_type_3 (aggregate signature method)} and {multiple [id, msg, tag], gw_id_3, gw_type_3 (one-to-one signature method)}.

[0150] In addition, the verification means 13 determines that the data msg_gw_1to1 contains data of the one-to-one signature method when it consists of {multiple [id, msg, tag], gw_id_3, gw_type_3 (one-to-one signature method)} and [NULL_agg, gw_id_3, gw_type_3 (= one-to-one signature method)], or when it consists of {multiple [id, msg, tag], gw_id_3, gw_type_3 (one-to-one signature method)} and {multiple [id, msg], a_tag, gw_id_3, gw_type_3 (aggregate signature method)}.

[0151] When the verification means 13 determines that the data msg_gw_1to1 includes "one-to-one signature data", it acquires the "one-to-one signature data" from the data msg_gw_1to1, verifies the acquired "one-to-one signature data" using the method described above, and stores the verification result and the "one-to-one signature data" in the database 16, thereby storing the verification result and the "one-to-one signature data".

[0152] Then, the verification means 13 counts the number of IDs (=number of IDs) of terminal devices included in the ``one-to-one signature data'' in the database 16, and stores the counted number of IDs (=number of IDs) of terminal devices in the database 16, thereby storing the counted number of IDs (=number of IDs) of terminal devices as N_A.

[0153] When the verification means 13 determines that the data msg_gw_1to1 includes "aggregate signature data", it obtains the "aggregate signature data" from the data msg_gw_1to1, verifies the obtained "aggregate signature data" using the method described above, and stores the verification result and the "aggregate signature data" in the database 16, thereby storing the verification result and the "aggregate signature data".

[0154] Then, the verification means 13 counts the number of IDs (=number of ids) of terminal devices included in the "aggregate signature data" in the database 16, and stores the counted number of IDs (=number of ids) of terminal devices in the database 16, thereby storing the counted number of IDs (=number of ids) of terminal devices as N_B.

[0155] On the other hand, when the data msg_gw_1to1 includes [NULL_1to1, identification information gw_id, signature method gw_type (one-to-one signature method)], the verification means 13 determines that the data msg_gw_1to1 does not include "one-to-one signature data".

[0156] Furthermore, when the data msg_gw_1to1 includes [NULL_agg, identification information gw_id, signature method gw_type (aggregate signature method)], the verification means 13 determines that the data msg_gw_1to1 does not include "aggregate signature data."

[0157] When the verification means 13 receives the data msg_gw_agg from the control means 12, it executes the same process for the data msg_gw_agg as for the data msg_gw_1to1 described above.

[0158] The determining means 14 reads out N_A and N_B stored in the database 16, adds up the read out N_A and N_B to calculate N_A+N_B, and sets the number of terminal IDs as N_A+N_B.

[0159] Then, the determination means 14 determines the signature method based on the number of terminal IDs (=N_A+N_B) using a method to be described later.

[0160] Then, the determining means 14 outputs the determined signature method and the destination gateway of the determined signature method to the control means 12.

[0161] When the transmission means 15 receives the determined signature method and the destination gateway of the determined signature method from the control means 12, it transmits the determined signature method to the destination gateway.

[0162] Database 16 stores, in association with the identification information of each gateway, the "one-to-one signature data," the verification result of verifying the "one-to-one signature data," the "aggregate signature data," the verification result of verifying the "aggregate signature data," N_A, and N_B.

[0163] In addition, when the verification means 13 verifies that the identification information id and the data msg are not legitimate based on [identification information id, data msg, tag tag, identification information gw_id, signature method gw_type] and [identification information id, data msg, aggregation tag a_tag, identification information gw_id, signature method gw_type] using the method described above, it discards [identification information id, data msg, tag tag, identification information gw_id, signature method gw_type] and [identification information id, data msg, aggregation tag a_tag, identification information gw_id, signature method gw_type].

[0164] Fig. 5 is a schematic diagram of the gateway 3 shown in Fig. 1. Referring to Fig. 5, the gateway 3 includes antennas 31-1 and 31-2, wireless units 32-1 and 32-2, a control unit 33, and a consolidation unit .

[0165] The antenna 31-1 is connected to the wireless unit 32-1, and the antenna 31-2 is connected to the wireless unit 32-2. The wireless unit 32-1 receives [id_3_5, msg_3_5, type_3_5, tag_3_5] from the terminal device 5 via the antenna 31-1, which includes the identification information id_3_5 of the terminal device 5, the data msg_3_5 detected by the terminal device 5, the signature method type_3_5 of the terminal device 5, and the tag tag_3_5, and outputs the received [id_3_5, msg_3_5, type_3_5, tag_3_5] to the control means 33.

[0166] In addition, the wireless unit 32-1 receives [id_3_6, msg_3_6, type_3_6, tag_3_6] from the terminal device 6 via the antenna 31-1, which includes the identification information id_3_6 of the terminal device 6, the data msg_3_6 detected by the terminal device 6, the signature method type_3_6 of the terminal device 6, and the tag tag_3_6, and outputs the received [id_3_6, msg_3_6, type_3_6, tag_3_6] to the control means 33.

[0167] Furthermore, the wireless unit 32-1 receives [id_3_7, msg_3_7, type_3_7, tag_3_7] from the terminal device 7 via the antenna 31-1, which includes the identification information id_3_7 of the terminal device 7, the data msg_3_7 detected by the terminal device 7, the signature method type_3_7 of the terminal device 7, and the tag tag_3_7, and outputs the received [id_3_7, msg_3_7, type_3_7, tag_3_7] to the control means 33.

[0168] The wireless unit 32-2 receives the one-to-one signature scheme type_1to1 transmitted from the server 1 via the antenna 31-2 by wireless communication, and outputs the received one-to-one signature scheme type_1to1 to the control means 33.

[0169] Furthermore, the wireless unit 32-2 receives the aggregation signature scheme type_agg transmitted from the server 1 via the antenna 31-2 by wireless communication, and outputs the received aggregation signature scheme type_agg to the control means 33.

[0170] When the wireless unit 32-1 receives the one-to-one signature scheme type_1to1 from the control means 33, it transmits the received one-to-one signature scheme type_1to1 to the terminal devices 5 to 7 by wireless communication via the antenna 31-1.

[0171] When wireless unit 32-1 receives the aggregation signature scheme type_agg from control means 33, wireless unit 32-1 transmits the received aggregation signature scheme type_agg to terminal devices 5 to 7 via antenna 31-1 by wireless communication.

[0172] The control means 33 receives the one-to-one signature scheme type_1to1 from the wireless unit 32-2 and holds the received one-to-one signature scheme type_1to1. The control means 33 then outputs the one-to-one signature scheme type_1to1 to the wireless unit 32-1 and controls the wireless unit 32-1 to transmit the one-to-one signature scheme type_1to1 to the terminal devices 5 to 7.

[0173] Furthermore, the control means 33 receives the aggregate signature scheme type_agg from the wireless unit 32-2, holds the received aggregate signature scheme type_agg, and outputs the aggregate signature scheme type_agg to the wireless unit 32-1, and controls the wireless unit 32-1 to transmit the aggregate signature scheme type_agg to the terminal devices 5 to 7.

[0174] Furthermore, the control means 33 receives [id_3_5, msg_3_5, type_3_5, tag_3_5], [id_3_6, msg_3_6, type_3_6, tag_3_6] and [id_3_7, msg_3_7, type_3_7, tag_3_7] from the wireless unit 32-1.

[0175] Then, when the signature methods type_3_5, type_3_6, and type_3_7 are all one-to-one signature method type_1to1, the control means 33 transmits [id_3_5, msg_3_5, tag_3_5], [id_3_6, msg_3_6, tag_3_6], and [id_3_7, msg_3_7, tag_3_7], the identification information gw_id_3 of the gateway 3, and the signature method gw_type_3 of the gateway 3 to the base station 2 by wireless communication via the wireless unit 32-2 and the antenna 31-2, and then transmits them to the server 1 via the base station 2.

[0176] On the other hand, when the signature methods type_3_5, type_3_6, and type_3_7 are all the aggregation signature method type_agg, the control means 33 outputs [id_3_5, msg_3_5, tag_3_5], [id_3_6, msg_3_6, tag_3_6], and [id_3_7, msg_3_7, tag_3_7] to the aggregation means 34, and outputs [id_3_5, msg_3_5, tag_3_5], [id_3_6], and , msg_3_6, tag_3_6] and [id_3_7, msg_3_7, tag_3_7] are aggregated using the aggregation signature key (public key) corresponding to id_3_5, the aggregation signature key (public key) corresponding to id_3_6, and the aggregation signature key (public key) corresponding to id_3_7 to generate aggregation tag a_tag_3, and the aggregation means 34 is controlled to output the generated aggregation tag a_tag_3 to the control means 33.

[0177] Then, when the control means 33 receives the aggregation tag a_tag_3 from the aggregation means 34, it transmits [id_3_5, msg_3_5], [id_3_6, msg_3_6], [id_3_7, msg_3_7], the aggregation tag a_tag_3, the identification information gw_id_3 of the gateway 3, and the signature method gw_type_3 of the gateway 3 to the base station 2 by wireless communication via the wireless unit 32-2 and the antenna 31-2, and then transmits it to the server 1 via the base station 2.

[0178] When the aggregation means 34 receives [id_3_5, msg_3_5, tag_3_5], [id_3_6, msg_3_6, tag_3_6], and [id_3_7, msg_3_7, tag_3_7] from the control means 33, it aggregates [id_3_5, msg_3_5, tag_3_5], [id_3_6, msg_3_6, tag_3_6], and [id_3_7, msg_3_7, tag_3_7] using the aggregation signature key (public key) corresponding to id_3_5, the aggregation signature key (public key) corresponding to id_3_6, and the aggregation signature key (public key) corresponding to id_3_7, in accordance with the control of the control means 33, to generate aggregation tag a_tag_3, and outputs the generated aggregation tag a_tag_3 to the control means 33.

[0179] The gateway 4 shown in FIG. 1 has the same configuration as the gateway 3 shown in FIG.

[0180] The wireless unit 32-1 of the gateway 4 receives [id_4_8, msg_4_8, type_4_8, tag_4_8] from the terminal device 8 via the antenna 31-1, which includes the identification information id_4_8 of the terminal device 8, the data msg_4_8 detected by the terminal device 8, the signature method type_4_8 of the terminal device 8, and the tag tag_4_8, and outputs the received [id_4_8, msg_4_8, type_4_8, tag_4_8] to the control means 33.

[0181] In addition, the wireless unit 32-1 of the gateway 4 receives [id_4_9, msg_4_9, type_4_9, tag_4_9] from the terminal device 9 via the antenna 31-1, which includes the identification information id_4_9 of the terminal device 9, the data msg_4_9 detected by the terminal device 9, the signature method type_4_9 of the terminal device 9, and the tag tag_4_9, and outputs the received [id_4_9, msg_4_9, type_4_9, tag_4_9] to the control means 33.

[0182] Furthermore, the wireless unit 32-2 of the gateway 4 receives the one-to-one signature scheme type_1to1 transmitted from the server 1 via the antenna 31-2 from the base station 2 by wireless communication, and outputs the received one-to-one signature scheme type_1to1 to the control means 33.

[0183] Furthermore, the wireless unit 32-2 of the gateway 4 receives the aggregation signature scheme type_agg transmitted from the server 1 via the antenna 31-2 from the base station 2 by wireless communication, and outputs the received aggregation signature scheme type_agg to the control means 33.

[0184] When the wireless unit 32-1 of the gateway 4 receives the one-to-one signature scheme type_1to1 from the control means 33, it transmits the received one-to-one signature scheme type_1to1 to the terminal devices 8 and 9 by wireless communication via the antenna 31-1.

[0185] When the wireless unit 32-1 of the gateway 4 receives the aggregation signature scheme type_agg from the control means 33, it transmits the received aggregation signature scheme type_agg to the terminal devices 8 and 9 via the antenna 31-1 by wireless communication.

[0186] The control means 33 of the gateway 4 receives the one-to-one signature scheme type_1to1 from the wireless unit 32-2 and holds the received one-to-one signature scheme type_1to1. Then, the control means 33 outputs the one-to-one signature scheme type_1to1 to the wireless unit 32-1 and controls the wireless unit 32-1 to transmit the one-to-one signature scheme type_1to1 to the terminal devices 8 and 9.

[0187] Furthermore, the control means 33 of the gateway 4 receives the aggregation signature scheme type_agg from the wireless unit 32-2, holds the received aggregation signature scheme type_agg, and outputs the aggregation signature scheme type_agg to the wireless unit 32-1, controlling the wireless unit 32-1 to transmit the aggregation signature scheme type_agg to the terminal devices 8 and 9.

[0188] Furthermore, the control means 33 of the gateway 4 receives [id_4_8, msg_4_8, type_4_8, tag_4_8] and [id_4_9, msg_4_9, type_4_9, tag_4_9] from the wireless unit 32-1.

[0189] Then, when the signature methods type_4_8 and type_4_9 are all one-to-one signature method type_1to1, the control means 33 transmits [id_4_8, msg_4_8, tag_4_8] and [id_4_9, msg_4_9, tag_4_9], the identification information gw_id_3 of gateway 3, and the signature method gw_type_4 of gateway 4 to base station 2 by wireless communication via wireless unit 32-2 and antenna 31-2, and then transmits them to server 1 via base station 2.

[0190] On the other hand, when the signature methods type_4_8 and type_4_9 are all the aggregation signature method type_agg, the control means 33 of the gateway 4 outputs [id_4_8, msg_4_8, tag_4_8] and [id_4_9, msg_4_9, tag_4_9] to the aggregation means 34, and controls the aggregation means 34 to aggregate [id_4_8, msg_4_8, tag_4_8] and [id_4_9, msg_4_9, tag_4_9] using the aggregation signature key (public key) corresponding to id_4_8 and the aggregation signature key (public key) corresponding to id_4_9 to generate aggregation tag a_tag_4, and output the generated aggregation tag a_tag_4 to the control means 33.

[0191] Then, when the control means 33 receives the aggregation tag a_tag_4 from the aggregation means 34, it transmits [id_4_8, msg_4_8, tag_4_8] and [id_4_9, msg_4_9, tag_4_9], the aggregation tag a_tag_4, the identification information gw_id_4 of gateway 4 and the signature method gw_type_4 of gateway 4 to base station 2 by wireless communication via wireless unit 32-2 and antenna 31-2, and then transmits it to server 1 via base station 2.

[0192] When the aggregation means 34 receives [id_4_8, msg_4_8, tag_4_8] and [id_4_9, msg_4_9, tag_4_9] from the control means 33, it aggregates [id_4_8, msg_4_8, tag_4_8] and [id_4_9, msg_4_9, tag_4_9] using the aggregation signature key (public key) corresponding to id_4_8 and the aggregation signature key (public key) corresponding to id_4_9 in accordance with the control of the control means 33 to generate aggregation tag a_tag_4, and outputs the generated aggregation tag a_tag_4 to the control means 33.

[0193] Fig. 6 is a schematic diagram of the terminal device 5 shown in Fig. 1. Referring to Fig. 6, the terminal device 5 includes an antenna 51, a wireless unit 52, control means 53, a sensor 54, signature means 55, and a timer 56.

[0194] The wireless unit 52 receives the signature method (one-to-one signature method type_1to1 or aggregate signature method type_agg) from the gateway 3 via the antenna 51, and outputs the received signature method (one-to-one signature method type_1to1 or aggregate signature method type_agg) to the control means 53.

[0195] Furthermore, when the signature method is the one-to-one signature method type_1to1, the wireless unit 52 receives from the control means 53 [id_3_5, msg_3_5, type_3_5, tag_3_5] which includes the identification information id_3_5 of the terminal device 5, the data msg_3_5 detected by the sensor 54 of the terminal device 5, the signature method type_3_5 (= one-to-one signature method type_1to1), and the tag tag_3_5 generated by signing the identification information id_3_5 and the data msg_3_5 with the one-to-one signature key (private key), and transmits [id_3_5, msg_3_5, type_3_5, tag_3_5] to the gateway 3 via the antenna 51.

[0196] On the other hand, when the signature method is the aggregate signature method type_agg, the wireless unit 52 receives from the control means 53 [id_3_5, msg_3_5, type_3_5, tag'_3_5] which includes the identification information id_3_5 of the terminal device 5, the data msg_3_5 detected by the sensor 54 of the terminal device 5, the signature method type_3_5 (=aggregate signature method type_agg), and the tag tag'_3_5 generated by signing the identification information id_3_5 and the data msg_3_5 with the aggregate signature key (private key), and transmits [id_3_5, msg_3_5, type_3_5, tag'_3_5] to the gateway 3 via the antenna 51.

[0197] The control means 53 receives the signature method (one-to-one signature method type_1to1 or aggregate signature method type_agg) from the wireless unit 52, and holds the received signature method (one-to-one signature method type_1to1 or aggregate signature method type_agg).

[0198] The control means 53 also receives data msg from the sensor 54. The control means 53 then holds in advance a transmission time, which is the time when the terminal device 5 transmits the data msg to the server 1.

[0199] The control means 53 refers to the timer 56, and when the transmission time arrives, if the signature method is the one-to-one signature method type_1to1, controls the signature means 55 to output the identification information id_3_5 and data msg_3_5 of the terminal device 5 to the signature means 55, sign the identification information id_3_5 and the data msg_3_5 with a one-to-one signature key (private key) to generate a tag tag_3_5, and output the generated tag tag_3_5 to the control means 53.

[0200] Then, when the control means 53 receives the tag tag_3_5 from the signature means 55, it generates [id_3_5, msg_3_5, type_3_5, tag_3_5] including the identification information id_3_5, the data msg_3_5, the signature method type_3_5 and the tag tag_3_5, outputs the generated [id_3_5, msg_3_5, type_3_5, tag_3_5] to the wireless unit 52, and controls the wireless unit 52 to transmit [id_3_5, msg_3_5, type_3_5, tag_3_5] to the gateway 3.

[0201] On the other hand, when the signature method is the aggregate signature method type_agg, the control means 53 outputs the identification information id_3_5 and data msg_3_5 of the terminal device 5 to the signature means 55, signs the identification information id_3_5 and the data msg_3_5 with an aggregate signature key (private key) to generate a tag tag'_3_5, and controls the signature means 55 to output the generated tag tag'_3_5 to the control means 53.

[0202] Then, when the control means 53 receives the tag tag'_3_5 from the signature means 55, it generates [id_3_5, msg_3_5, type_3_5, tag'_3_5] including the identification information id_3_5, the data msg_3_5, the signature method type_3_5 and the tag tag'_3_5, outputs the generated [id_3_5, msg_3_5, type_3_5, tag'_3_5] to the wireless unit 52, and controls the wireless unit 52 to transmit [id_3_5, msg_3_5, type_3_5, tag'_3_5] to the gateway 3.

[0203] The sensor 54 detects the data msg and outputs the detected data msg to the control means 53. The data msg may be, for example, temperature, humidity, wind speed, rainfall, etc., and may be anything that can be detected by the sensor 54.

[0204] The signature means 55, under control of the control means 53, signs the identification information id_3_5 and the data msg_3_5 using a one-to-one signature key (private key) or an aggregate signature key (private key) to generate a tag tag_3_5 or tag'_3_5, and outputs the generated tag tag_3_5 or tag'_3_5 to the control means 53.

[0205] Each of the terminal devices 6 to 9 shown in FIG. 1 has the same configuration as the terminal device 5 shown in FIG.

[0206] 7 is a conceptual diagram showing the operation of changing the signature method. Referring to FIG. 7, when the server 1 changes the signature method of the gateway 3, the server 1 transmits the changed signature method of the gateway 3, type 1, to the gateway 3.

[0207] When the gateway 3 receives the signature method type 1 from the server 1, it determines whether or not the received signature method type 1 is different from the signature method already being used by the terminal devices 5-7.

[0208] Then, when the gateway 3 determines that the signature method type1 is different from the signature method already used by the terminal devices 5 to 7, it transmits the signature method type1 to the terminal devices 5 to 7.

[0209] Then, the terminal devices 5 to 7 receive the signature method type 1 from the gateway 3 and change the signature method that they are currently using to the signature method type 1.

[0210] Furthermore, when the gateway 4 receives the signature method type 2 from the server 1, it determines whether or not the received signature method type 2 is different from the signature method already being used by the terminal devices 8 and 9.

[0211] If the gateway 4 determines that the signature method type 2 is the same as the signature method already being used by the terminal devices 8 and 9, it does not transmit the signature method type 2 to the terminal devices 8 and 9.

[0212] In this way, each of the gateways 3 and 4 always receives the signature method type from the server 1. Then, each of the gateways 3 and 4 determines whether or not the signature method type differs from the signature method already used in the terminal devices 5 to 7 (or terminal devices 8 and 9), and transmits the signature method type to the terminal devices 5 to 7 (or terminal devices 8 and 9) only when it determines that the signature method type differs from the signature method already used in the terminal devices 5 to 7 (or terminal devices 8 and 9).

[0213] Fig. 8 is a conceptual diagram of correspondence table TBL1. Referring to Fig. 8, correspondence table TBL1 includes round s, gateway, terminal device, one-to-one signature data, aggregate signature data, N_A, and N_B.

[0214] Round s, gateway, terminal device, one-to-one signature data, aggregate signature data, N_A, and N_B are associated with each other.

[0215] Round s consists of 1, 2, .... The gateway consists of gateway identification information gw_id_3, gw_id_4. The terminal device consists of identification information id_5 to id_9 of terminal devices 5 to 9.

[0216] The one-to-one signature data consists of data msg_1to1 and the verification result. The aggregate signature data consists of data msg_agg and the verification result.

[0217] The data msg_1to1 of the one-to-one signature data consists of msg_3_5_1to1, msg_3_6_1to1, msg_4_8_1to1, and msg_4_9_1to1 in round 1, and consists of msg_3_6_1to1, msg_4_8_1to1, and msg_4_9_1to1 in round 2.

[0218] The data msg_agg of the aggregate signature data consists of msg_3_7_agg in round 1, and consists of msg_3_5_agg and msg_3_7_agg in round 2.

[0219] As a result, in round 1, terminal devices id_5 and id_6 send one-to-one signature data data msg_3_5_1to1 and msg_3_6_1to1 to server 1, respectively, via gateway gw_id_3, and terminal device id_7 sends aggregate signature data data msg_3_7_agg to server 1 via gateway gw_id_3.

[0220] Also, in round 1, terminal device id_8 transmits one-to-one signature data data msg_4_8_1to1 to server 1 via gateway gw_id_4, and terminal device id_9 transmits one-to-one signature data data msg_4_9_1to1 to server 1 via gateway gw_id_4.

[0221] In round 1, the verification results of the one-to-one signature data data msg_3_5_1to1 and msg_3_6_1to1 are "regular," and the verification result of the aggregate signature data data msg_3_7_agg is "regular."

[0222] In round 1, the verification result of the one-to-one signature data data msg_4_8_1to1 is "tampered with", and the verification result of the one-to-one signature data data msg_4_9_1to1 is "genuine".

[0223] As a result, in round 1, N_A associated with gateway gw_id_3 is "2" because the verification results of data msg_3_5_1to1 and msg_3_6_1to1 are "regular."

[0224] In addition, in round 1, N_B associated with the gateway gw_id_3 is "1" because the verification result of the data msg_3_7_agg is "regular."

[0225] Furthermore, in round 1, the N_A associated with gateway gw_id_4 is "1" because the verification result of data msg_4_8_1to1 is "tampered" and the verification result of data msg_4_9_1to1 is "genuine." In this way, data msg_4_8_1to1, whose verification result is "tampered," is excluded from the count of N_A.

[0226] In addition, since there was no aggregate signature data associated with the gateway gw_id_4 in round 1, N_B associated with the gateway gw_id_4 is zero (=0).

[0227] In round 2, terminal device id_5 sends aggregate signature data data msg_3_5_agg to server 1 via gateway gw_id_3, terminal device id_6 sends one-to-one signature data data msg_3_6_1to1 to server 1 via gateway gw_id_3, and terminal device id_7 sends aggregate signature data data msg_3_7_agg to server 1 via gateway gw_id_3.

[0228] Also, in round 2, terminal device id_8 transmits one-to-one signature data data msg_4_8_1to1 to server 1 via gateway gw_id_4, and terminal device id_9 transmits one-to-one signature data data msg_4_9_1to1 to server 1 via gateway gw_id_4.

[0229] In round 2, the verification result of data msg_3_5_agg of the aggregate signature data is "tampered", the verification result of data msg_3_6_1to1 of the one-to-one signature data is "genuine", and the verification result of data msg_3_7_agg of the aggregate signature data is "tampered".

[0230] In round 2, the verification result of the one-to-one signature data data msg_4_8_1to1 is "regular", and the verification result of the one-to-one signature data data msg_4_9_1to1 is "tampered with".

[0231] As a result, in round 2, N_A associated with the gateway gw_id_3 is "1" because the verification result of the data msg_3_6_1to1 is "regular."

[0232] In addition, in round 2, N_B associated with gateway gw_id_3 is "1" because the verification result of data msg_3_5_agg is "regular" and the verification result of data msg_3_7_agg is "tampered with."

[0233] Furthermore, in round 2, N_A associated with gateway gw_id_4 is "0" because the verification result of data msg_4_8_1to1 is "tampered" and the verification result of data msg_4_9_1to1 is "tampered".

[0234] In round 2, since there is no aggregate signature data associated with gateway gw_id_4, N_B is "zero (=0)."

[0235] The correspondence table TBL1 is then stored in the database 16 of the server 1.

[0236] 9 is a diagram showing the relationship between the signature size and the number of signatures after aggregation. Referring to Fig. 9, line k1 is a line consisting of [signature size] = 6.3 × [number of signatures (= number of IDs of terminal devices)].

[0237] The line k1 indicates the relationship between the signature size and the number of IDs of terminal devices in the one-to-one signature scheme.

[0238] Also, curve k2 is [signature size] = 0.0607x 3 -1.7617x 2 The curve is +17.252x+6.3 (x=log2(number of terminal device IDs)).

[0239] Curve k2 shows the relationship between the signature size and the number of IDs of terminal devices in the aggregate signature scheme.

[0240] Furthermore, when the number of IDs of terminal devices is "1 to 15", the total signature size is smaller in the one-to-one signature scheme than in the aggregate signature scheme, and when the number of device IDs is "16 or more", the total signature size is smaller in the aggregate signature scheme than in the one-to-one signature scheme.

[0241] The determination means 14 of the server 1 refers to the correspondence table TBL1 shown in Figure 8 and calculates the sum N_A + N_B (=3) of the number of IDs of terminal devices N_A (=2) included in the ``one-to-one signature data'' associated with the gateway gw_id_3 of round 1 and the number of IDs N_B (=1) included in the ``aggregated signature data'' associated with the gateway gw_id_3 of round 1.

[0242] Then, the determination means 14 of the server 1 sets the sum N_A + N_B (= 3) as the number of IDs of the terminal devices shown in Figure 9, detects the signature size SGS_1 for the number of IDs of the terminal devices (= N_A + N_B = 3) based on the straight line k1, and detects the signature size SGS_2 for the number of IDs of the terminal devices (= N_A + N_B = 3) based on the curve k2.

[0243] Then, the determination means 14 of the server 1 detects the signature method that results in the smaller signature size out of the signature sizes SGS_1 and SGS_2, and changes the signature method of the gateway gw_id_3 to the detected signature method.

[0244] When the determination means 14 of the server 1 changes the signature method, it transmits the changed signature method to the gateway gw_id_3 via the control means 12 and the transmission means 15.

[0245] In addition, the determination means 14 of the server 1 refers to the correspondence table TBL1 shown in Figure 8 and calculates the sum N_A + N_B (=1) of the number of IDs of terminal devices included in the ``one-to-one signature data'' associated with the gateway gw_id_4 of round 1 and the number of IDs of terminal devices N_B (=0) included in the ``aggregated signature data'' associated with the gateway gw_id_4 of round 1.

[0246] Then, the determination means 14 of the server 1 sets the sum N_A+N_B (=1) as the number of IDs of the terminal devices shown in Figure 9, detects the signature size SGS_3 for the number of IDs of the terminal devices (=N_A+N_B=1) based on the straight line k1, and detects the signature size SGS_4 for the number of IDs of the terminal devices (=N_A+N_B=0) based on the curve k2.

[0247] Then, the determination means 14 of the server 1 detects the signature method that results in the smaller signature size out of the signature sizes SGS_3 and SGS_4, and changes the signature method of the gateway gw_id_4 to the detected signature method.

[0248] When the determination means 14 of the server 1 changes the signature method, it transmits the changed signature method to the gateway gw_id_4 via the control means 12 and the transmission means 15.

[0249] The determination means 14 of the server 1 also changes the signature methods of the gateways 3 and 4 in round 2 of the correspondence table TBL1 shown in FIG. 8 by the method described above.

[0250] Then, the determining means 14 of the server 1 similarly changes the signature methods of the gateways gw_id_3 and gw_id_4 in rounds 3, 4, . . .

[0251] The determination means 14 of the server 1 changes the signature methods of the gateways gw_id_3 and gw_id_4 by the above-described method when at least one of N_A and N_B is updated.

[0252] The determining means 14 of the server 1 stores the straight line k1 and the curve k2 shown in FIG. 9 in advance.

[0253] Fig. 10 is a flowchart for explaining the operation of the terminal device 5 shown in Fig. 6. Referring to Fig. 10, when the operation of the terminal device 5 is started, the control means 53 of the terminal device 5 sets a predetermined signature method as [signature method to be used] (step S1). Note that in step S1, the terminal device 5 may inquire of the gateway 3 about the signature method to be set, and set the signature method received from the gateway 3 as [signature method to be used].

[0254] After step S1, the control means 53 of the terminal device 5 waits until the time to send the data msg or until it receives the signature method from the gateway 3 (step S2).

[0255] Thereafter, the control means 53 of the terminal device 5 determines whether or not the signature method has been received from the gateway 3, or determines whether or not the transmission time of the data msg has arrived by referring to the timer 56 (step S3). In this case, the control means 53 of the terminal device 5 determines that the transmission time of the data msg has arrived by referring to the timer 56, for example, when it reaches 1 o'clock, 2 o'clock, etc.

[0256] When it is determined in step S3 that the signature method has been received from the gateway 3, the control means 53 of the terminal device 5 changes the signature method set in step S1 to the signature method received from the gateway 3 (step S4).

[0257] On the other hand, when it is determined in step S3 that the transmission time of the data msg has been reached, the control means 53 of the terminal device 5 outputs the identification information id of the terminal device 5 and the data msg detected by the center 54 to the signature means 55, signs the identification information id and the data msg with a one-to-one signature key (private key) or an aggregate signature key (private key) to generate a tag tag, and controls the signature means 55 to output the generated tag tag to the control means 53.

[0258] When the signature means 55 receives the identification information id and data msg from the control means 53, it signs the identification information id and data msg using a one-to-one signature key (private key) or an aggregate signature key (private key) in accordance with the control of the control means 53 to generate a tag tag, and outputs the generated tag tag to the control means 53.

[0259] When the control means 53 receives the tag tag from the signature means 55, it creates [id, msg, type, tag] including the identification information id, the data msg, the signature method type, and the tag tag.

[0260] Then, the control means 53 outputs [id, msg, type, tag] to the wireless unit 52 and controls the wireless unit 52 to transmit [id, msg, type, tag] to the gateway 3.

[0261] When the wireless unit 52 receives [id, msg, type, tag] from the control means 53, it transmits [id, msg, type, tag] to the gateway 3 via the antenna 51 in accordance with the control from the control means 53 (step S5).

[0262] After step S4 or step S5, the operation of the terminal device 5 proceeds to step S2, and thereafter, the above-described steps S2 to S5 are repeatedly executed.

[0263] When steps S2 to S5 are repeatedly executed, if it is determined in step S3 that the sending time of the data msg has been reached before it is determined that the signature method has been received from the gateway 3, [id, msg, type, tag] is periodically sent to the gateway 3.

[0264] On the other hand, if it is determined in step S3 that the signature method has been received from gateway 3 repeatedly before it is determined that the transmission time of data msg has been reached, the signature method will be frequently changed between the one-to-one signature method type_1to1 and the aggregate signature method type_agg.

[0265] Furthermore, when a new terminal device enters the wireless communication range of the gateway 3, the new terminal device will transmit data msg to the gateway 3 in step S5 according to the signature method set by the new terminal device until it is determined in step S3 that it has received the signature method from the gateway 3.

[0266] If the signature method set by the new terminal device is different from the signature method set by terminal device 5, gateway 3 will receive [id, msg, type (= one-to-one signature method), tag (= tag generated using the one-to-one signature key (private key))] from terminal device 5 and [id, msg, type' (= aggregate signature method), tag (= tag generated using the aggregate signature key (private key))] from the new terminal device.

[0267] As a result, for [id, msg, type (= one-to-one signature method), tag (= tag generated using the one-to-one signature key (private key))] from terminal device 5, gateway 3 does not generate an aggregated tag a_tag, but instead combines [id, msg, tag] with gateway 3's identification information gw_id_3 and gateway 3's signature method gw_type_3 and sends it to server 1. However, for [id, msg, type' (= aggregated signature method), tag] from a new terminal device, gateway 3 aggregates the identification information id, data msg and tag (= tag generated using the aggregated signature key (private key)) using the aggregated signature key (public key) corresponding to the identification information id to generate an aggregated tag a_tag, and then combines [id, msg] with the aggregated tag a_tag, identification information gw_id_3 and signature method gw_type_3 and sends it to server 1.

[0268] The operations of each of the terminal devices 6 to 9 are also executed according to the flowchart shown in FIG.

[0269] 11 and 12 are first and second flowcharts, respectively, for explaining the operation of the gateway 3 shown in FIG.

[0270] Referring to FIG. 11, when the operation of the gateway 3 is started, the control means 33 of the gateway 3 sets a predetermined signature method as the "signature method to be used" (step S11).

[0271] Then, the control means 33 of the gateway 3 sets s=1 (step S12), where s is an argument indicating the round.

[0272] After step S12, the control means 33 of the gateway 3 waits until it receives an instruction (=instruction of the signature method) from the server 1, or waits until the transmission time of the terminal device (step S13).

[0273] In this case, the control means 33 of the gateway 13 has a built-in timer and holds the transmission times of the terminal devices 5 to 7 that are located within the wireless communication range of the gateway 3. The control means 33 of the gateway 13 then refers to the timer and waits until the transmission time of the terminal device.

[0274] After step S13, the control means 33 of the gateway 3 determines whether or not an instruction has been received from the server 1, or whether or not the transmission time of the terminal device has arrived (step S14).

[0275] If it is determined in step S14 that the transmission time of the terminal device has arrived, the operation of the gateway 3 proceeds to step S15 in FIG.

[0276] 12, when it is determined in step S14 of Fig. 11 that the transmission time of the terminal device has been reached, the control means 33 of the gateway 3 sets i=0, j=0, k=0 (step S15), where i is a variable for counting the number of terminal devices, j is a variable for counting the number of one-to-one signatures, and k is a variable for counting the number of aggregate signatures.

[0277] After step S15, the gateway 3 waits until it receives data from the terminal device or until the end of the waiting period for receiving data from the terminal device (step S16). Here, the end of the waiting period for receiving data from the terminal device is, for example, 30 minutes after the transmission time of the terminal device. The control means 33 of the gateway 3 also refers to the timer and waits until the end of the waiting period for receiving data.

[0278] After step S16, the control means 33 of the gateway 3 determines whether or not data has been received from the terminal device, or whether or not the period of waiting for receiving data from the terminal device has ended (step S17).

[0279] When it is determined in step S17 that data has been received from the terminal device, the control means 33 of the gateway 3 sets i=i+1 (step S18).

[0280] Then, the control means 33 of the gateway 3 obtains the identification information id_s_i, the data msg_s_i, the signature method type_s_i, and the tag tag_s_i from the received data (step S19).

[0281] Thereafter, the control means 33 of the gateway 3 determines whether the signature method type_s_i is a one-to-one signature (step S20).

[0282] When it is determined in step S20 that the signature method type_s_i is one-to-one signature, the control means 33 of the gateway 3 sets j=j+1 (step S21).

[0283] Then, the control means 33 of the gateway 3 holds the identification information id_s_i, the data msg_s_i and the tag tag_s_i as the identification information id_A_s_j, the data msg_A_s_j and the tag tag_A_s_j, respectively (step S22).

[0284] On the other hand, when it is determined in step S20 that the signature method type_s_i is an aggregate signature, the control means 33 of the gateway 3 sets k=k+1 (step S23).

[0285] Thereafter, the control means 33 of the gateway 3 holds the identification information id_s_i, the data msg_s_i and the tag tag_s_i as the identification information id_B_s_k, the data msg_B_s_k and the tag tag_B_s_k, respectively (step S24).

[0286] After step S22 or step S24, the operation of the gateway 3 proceeds to step S16, and steps S16 to S24 are repeatedly executed until it is determined in step S17 that the data reception waiting period from the terminal device has ended.

[0287] Then, in step S17, when it is determined that the data reception waiting period from the terminal device has ended, the control means 33 of the gateway 3 s = i, N A_s = j and N B_s = k (step S25). s represents the total number of terminal devices in round s, and N A_s represents the total number of data msg in the one-to-one signature scheme in round s, and N B_s represents the total number of data msg in the aggregate signature scheme in round s.

[0288] After step S25, the control means 33 of the gateway 3 s It is determined whether or not is greater than zero (=0) (step S26).

[0289] In step S26, N s If it is determined that the received data is not greater than zero (=0), the control means 33 of the gateway 3 notifies the server 1 that there is no received data (step S27).

[0290] On the other hand, in step S26, N s When it is determined that is greater than zero (=0), the control means 33 of the gateway 3 A_s It is determined whether or not is greater than zero (=0) (step S28).

[0291] Then, in step S28, N A_sis determined to be greater than zero (=0), the control means 33 of the gateway 3 creates [id_A_s_1, msg_A_s_1, tag_A_s_1] including the identification information id_A_s_1, the data msg_A_s_1, and the tag tag_A_s_1, creates [id_A_s_2, msg_A_s_2, tag_A_s_2] including the identification information id_A_s_2, the data msg_A_s_2, and the tag tag_A_s_2, and creates [id_A_s_2, msg_A_s_2, tag_A_s_2] including the identification information id_A_s_N A_s and data msg_A_s_N A_s and tag tag_A_s_N A_s and contains [id_A_s_N A_s ,msg_A_s_N A_s ,tag_A_s_N A_s ] and create [id_A_s_1,msg_A_s_1,tag_A_s_1]~[id_A_s_N A_s ,msg_A_s_N A_s ,tag_A_s_N A_s ], the gateway ID (=identification information ID of the gateway 3) and the signature method type (=one-to-one signature method) are combined and transmitted to the server 1 (step S29).

[0292] On the other hand, in step S28, N A_s When it is determined that is not greater than zero (=0), the control means 33 of the gateway 3 notifies the server 1 that there is no one-to-one signature data (step S30).

[0293] Then, after step S29 or step S30, the control means 33 of the gateway 3 B_s It is determined whether or not is greater than zero (=0) (step S31).

[0294] In step S31, N B_sis determined to be greater than zero (=0), the control means 33 of the gateway 3 creates [id_B_s_1, msg_B_s_1, tag_B_s_1] including the identification information id_B_s_1, the data msg_B_s_1, and the tag tag_B_s_1, creates [id_B_s_2, msg_B_s_2, tag_B_s_2] including the identification information id_B_s_2, the data msg_B_s_2, and the tag tag_B_s_2, and creates [id_B_s_2, msg_B_s_2, tag_B_s_2] including the identification information id_B_s_N B_s and data msg_B_s_N B_s and tag tag_B_s_N B_s and contains [id_B_s_N B_s ,msg_B_s_N B_s ,tag_B_s_N B_s ] to create a

[0295] Then, the control means 33 of the gateway 3 receives [id_B_s_1, msg_B_s_1, tag_B_s_1] to [id_B_s_N B_s ,msg_B_s_N B_s ,tag_B_s_N B_s ] to the aggregation means 34, and [id_B_s_1, msg_B_s_1, tag_B_s_1] to [id_B_s_N B_s ,msg_B_s_N B_s ,tag_B_s_N B_s ] to the aggregate signing key (public key) ~id_B_s_N associated with id_B_s_1 B_s The aggregation unit 34 aggregates the collected data using an aggregation signature key (public key) associated with the collected data to generate an aggregation tag a_tag, and controls the aggregation unit 34 to output the generated aggregation tag a_tag to the control unit 33.

[0296] The aggregation means 34 of the gateway 3 aggregates [id_B_s_1, msg_B_s_1, tag_B_s_1] to [id_B_s_N B_s ,msg_B_s_N B_s ,tag_B_s_N B_s ] from the control means 33, according to the control of the control means 33, [id_B_s_1, msg_B_s_1, tag_B_s_1] to [id_B_s_N B_s,msg_B_s_N B_s ,tag_B_s_N B_s ] to the aggregate signing key (public key) ~id_B_s_N associated with id_B_s_1 B_s The aggregation means 34 of the gateway 3 then aggregates the data using the aggregation signature key (public key) associated with the data to create an aggregation tag a_tag (step S32).

[0297] When the control means 33 of the gateway 3 receives the aggregation tag a_tag from the aggregation means 34, the control means 33 of the gateway 3 transmits the aggregation tag a_tag via the wireless unit 32 and the antenna 31. B_s ,msg_B_s_N B_s ,tag_B_s_N B_s ], the aggregation tag a_tag, the gateway 3's identification information ID, and the signature method type (=aggregate signature method) are combined and transmitted to the server 1 (step S33).

[0298] On the other hand, in step S31, N B_s If it is determined that is not greater than zero (=0), the control means 33 of the gateway 3 notifies the server 1 via the wireless unit 32 and the antenna 31 that there is no aggregate signature data (step S34).

[0299] Then, after step S27, or after step S33, or after step S34, the control means 33 of the gateway 3 sets s=s+1 (step S35).

[0300] Thereafter, the operation of the gateway 1 proceeds to step S13 in FIG.

[0301] Referring to FIG. 11, after step S35 of FIG. 12, the gateway 3 executes step S13 described above, and when it is determined in step S14 that an instruction has been received from the server 1, the control means 33 of the gateway 3 acquires a new signature method from the received data received from the server 1 and stores the acquired signature method as signature method type_GW (step S36).

[0302] Then, the control means 33 of the gateway 3 determines whether s is greater than 1 (step S37).

[0303] If it is determined in step S37 that s is greater than 1, the control means 33 of the gateway 3 determines whether the signature method type_GW is the one-to-one signature method (step S38).

[0304] In step S38, when it is determined that the signature method type_GW is the one-to-one signature method, the control means 33 of the gateway 3 further B_s-1 It is determined whether or not is greater than zero (=0) (step S39). Note that step S39 is a step for determining whether or not there was a terminal device that used the aggregate signature scheme in the previous round s-1.

[0305] In step S39, N B_s-1 is determined to be greater than zero (=0), the control means 33 of the gateway 3 transmits the identification information id_B_(s-1)_1 to id_B_(s-1)_N via the wireless unit 32 and the antenna 31. B_s-1 The new signature method is notified to the terminal device (step S40).

[0306] On the other hand, when it is determined in step S38 that the signature method type_GW is not the one-to-one signature method, the control means 33 of the gateway 3 further A_s-1 It is determined whether or not is greater than zero (=0) (step S41). Note that step S41 is a step for determining whether or not there was a terminal device that used the one-to-one signature scheme in the previous round s-1.

[0307] In step S41, N A_s-1 is determined to be greater than zero (=0), the control means 33 of the gateway 3 transmits the identification information id_A_(s-1)_1 to id_A_(s-1)_N via the wireless unit 32 and the antenna 31. A_s-1 The new signature method is notified to the terminal device (step S42).

[0308] Then, in step S37, when it is determined that s is not greater than 1, or in step S39, N B_s-1 When it is determined that N is not greater than zero (=0), or after step S40, or in step S41, A_s-1 When it is determined that is not greater than zero (=0), or after step S42, the operation of the gateway 3 proceeds to step S13.

[0309] Thereafter, while the communication system 10 is operating, the gateway 3 repeatedly executes steps S13 to S42.

[0310] In the flowcharts shown in FIGS. 11 and 12, steps S18 to S24 are steps in which the gateway 3 classifies and collects data received from the terminal device i into one-to-one signature data or aggregate signature data.

[0311] Steps S21 and S22 are steps for classifying and collecting the data received from terminal device i into one-to-one signature data, and steps S23 and S24 are steps for classifying and collecting the data received from terminal device i into aggregate signature data.

[0312] As a result, there are cases where only one-to-one signature data is collected, cases where only aggregate signature data is collected, and cases where both one-to-one signature data and aggregate signature data are collected.

[0313] Therefore, steps S18 to S24 are steps for collecting at least one type of data from one-to-one signature data and aggregate signature data.

[0314] When one or more terminal devices within the wireless communication range of one gateway g send data to the gateway g after receiving a signature method from the gateway g, the terminal devices sign the data according to the same signature method and send the data to the gateway, so that either [Step S21 and Step S22] or [Step S23 and Step S24] is executed.

[0315] However, if a new terminal device enters the wireless communication range of a gateway g after one or more terminal devices within the wireless communication range of the gateway g have received a signature scheme from the gateway g, the one or more terminal devices will sign the data according to the signature scheme received from the gateway g and send it to the gateway g, and the new terminal device will sign the data according to any of the signature schemes, the "one-to-one signature scheme" and the "aggregate signature scheme," and send it to the gateway g.

[0316] As a result, if the signature method of the data sent by one or more terminal devices is different from the signature method of the data sent by the new terminal device, gateway g receives both the one-to-one signature data and the aggregate signature data.

[0317] Therefore, steps S18 to S24 are steps for collecting both one-to-one signature data and aggregate signature data when multiple terminal devices using different signature methods exist within the wireless communication range of one gateway g.

[0318] Also, in the flowcharts shown in Figures 11 and 12, "i" is incremented by "1" each time step S18 is executed, so the value of "i" when it is determined in step S17 that the reception waiting time has ended is the total number of terminal devices present within the wireless communication range of gateway g.

[0319] Then, the total number of terminal devices “i” present within the wireless communication range of the gateway g is calculated by subtracting N s It is set to (number of terminals in round s).

[0320] Furthermore, since "j" is incremented by "1" each time step S21 is executed, the value of "j" when it is determined in step S17 that the reception waiting time has ended is the total number of terminal devices that are within the wireless communication range of gateway g and have signed data using the one-to-one signature method and transmitted the data to gateway g.

[0321] Then, the total number of terminal devices "j" that use the one-to-one signature scheme and exist within the wireless communication range of the gateway g is calculated by subtracting N A_s (the number of terminals in the one-to-one signature scheme in round s).

[0322] Furthermore, since "k" is incremented by "1" each time step S23 is executed, the value of "k" when it is determined in step S17 that the reception waiting time has ended is the total number of terminal devices that are within the wireless communication range of gateway g and have signed data using the aggregate signature method and sent it to gateway g.

[0323] Then, the total number of terminal devices using the aggregate signature scheme that are present within the wireless communication range of the gateway g, “k”, is calculated by subtracting N B_s It is set to (the number of terminals in the aggregate signature scheme in round s).

[0324] Furthermore, in the flowcharts shown in FIGS. 11 and 12, in step S26, N s If it is determined that the value is not >0, step S27 is executed. s is the total number of terminal devices in the sth round, and N s> 0 means N s This means that the number of terminal devices that transmit data to the gateway g is equal to or less than zero (=0), and therefore there is no terminal device that transmits data to the gateway g.

[0325] Furthermore, in the flowcharts shown in FIGS. 11 and 12, in step S28, N A_s When it is determined that the value is >0, step 29 is executed because gateway g has received data (= one-to-one signature data) addressed to server 1 from a terminal device within its wireless communication range.

[0326] Furthermore, in the flowcharts shown in FIGS. 11 and 12, in step S31, N B_s When it is determined that the value is >0, steps S32 and S33 are executed because gateway g has received data (=aggregated signature data) addressed to server 1 from a terminal device within its wireless communication range.

[0327] Therefore, in the flowcharts shown in Figures 11 and 12, "YES" in step S26 and steps S28 to S33 are steps in which at least one of data using the one-to-one signature method and data using the aggregate signature method is sent from the gth gateway to server 1.

[0328] 11 and 12, when step S14 is executed for the first time, if it is determined in step S14 that an instruction has been received from the server 1, step S36 is executed, and then step S37 is executed. In this case, since s=1 (see step S12), it is determined in step S37 that s is not greater than 1.

[0329] Then, the operation of the gateway 3 returns to step S13, and steps S13 and S14 are executed in sequence.

[0330] As a result, until it is determined in step S14 that the transmission time of the terminal device has arrived, the loop of step S14 → step S36 → "NO" in step S37 → step S13 → step S14 is repeatedly executed.

[0331] Then, in step S14, if it is determined that the transmission time of the terminal device has been reached, steps S15 to S35 are executed in sequence, and then steps S13 and S14 are executed in sequence.If it is determined in step S14 that an instruction has been received from the server 1, step S36 is executed, and then step S37 is executed.

[0332] At this time, since s=2, in step S37, it is determined that s is greater than 1 (="YES" in step S37), and when it is determined in step S38 that type_GW is the one-to-one signature method, step S39 is executed.

[0333] Step S39 is N B_s-1 At this stage, steps S15 to S35 have already been executed in the round of s=1. Therefore, if steps S23 and S24 have been executed at least once in the round of s=1, then in step S39, N B_s-1 (the number of terminal devices of the aggregate signature scheme in the (s-1) round) is determined to be greater than zero (=0), and in step S40, the new signature scheme (=one-to-one signature scheme) is B_s-1 The terminal devices are notified.

[0334] On the other hand, when it is determined in step S38 that type_GW (=new signature method) is not a one-to-one signature method (i.e., when it is determined that type_GW (=new signature method) is an aggregate signature method), step S41 is executed.

[0335] Step S41 is N A_s-1At this stage, steps S15 to S35 have already been executed in the round of s=1. Therefore, if steps S21 and S22 have been executed at least once in the round of s=1, then in step S41, N A_s-1 (the number of terminal devices of the one-to-one signature scheme in the (s-1) round) is determined to be greater than zero (=0), and in step S42, the new signature scheme (=aggregate signature scheme) is A_s-1 The terminal devices are notified.

[0336] As described above, steps S36 to S42 are steps in which the gateway g notifies the terminal devices present within the wireless communication range of the gateway g of the new signature method.

[0337] Fig. 13 is a flowchart for explaining the operation of server 1 shown in Fig. 4. Referring to Fig. 13, when the operation of server 1 starts, control means 12 of server 1 sets s=1 (step S51), sets g=1 (step S52), and sets N_A=0 and N_B=0 (step S53).

[0338] Then, the receiving means 11 of the server 1 receives the data from the g-th gateway (step S54), and outputs the received data to the control means 12.

[0339] When the control means 12 of the server 1 receives the data from the receiving means 11 , it outputs the received data to the verifying means 13 .

[0340] The verification means 13 of the server 1 receives the data from the control means 12 and determines whether the received data indicates "no received data" (step S55).

[0341] If it is determined in step S55 that the data is "no received data", the operation of the gateway g proceeds to step S69.

[0342] On the other hand, when it is determined in step S55 that the data is not "no received data" (= when it is determined that the data is "received data"), the verification means 13 of the server 1 determines whether the received data includes "one-to-one signature data" (step S56).

[0343] When it is determined in step S56 that the received data does not contain "one-to-one signature data," the verification means 13 of the server 1 determines whether the received data contains "aggregate signature data" (step S57).

[0344] If it is determined in step S57 that the received data contains "aggregate signature data", the verification means 13 of the server 1 acquires the "aggregate signature data" from the received data (step S58).

[0345] Then, the verification means 13 of the server 1 verifies the "aggregate signature data" using the method described above, creates a verification result (= verification result consisting of "genuine" or "tampered"), and stores the verification result and the "aggregate signature data" in the database 16, thereby storing the verification result and the "aggregate signature data" (step S59).

[0346] Thereafter, the verification means 13 of the server 1 counts the number of IDs of the terminal devices included in the "aggregate signature data," stores the counted number of IDs as N_B in the database 16, and saves the number of IDs as N_B (step S60).

[0347] On the other hand, if it is determined in step S56 that the received data includes "one-to-one signature data", the verification means 13 of the server 1 acquires the "one-to-one signature data" from the received data (step S61).

[0348] Then, the verification means 13 of the server 1 verifies the "one-to-one signature data" and creates a verification result (= verification result consisting of "genuine" or "tampered"), and stores the verification result and the "one-to-one signature data" in the database 16, thereby storing the verification result and the "one-to-one signature data" (step S62).

[0349] Thereafter, the verification means 13 of the server 1 counts the number of IDs of the terminal devices included in the "one-to-one signature data", stores the counted number of IDs as N_A in the database 16, and saves the number of IDs as N_A (step S63).

[0350] Subsequently, the verification means 13 of the server 1 determines whether or not the received data includes "aggregate signature data" (step S64).

[0351] If it is determined in step S64 that the received data contains "aggregate signature data", the verification means 13 of the server 1 sequentially executes the above-mentioned steps S58 to S60 (step S65).

[0352] After step S60, or when it is determined in step S64 that the received data does not contain "aggregate signature data," or after step S65, the operation of the server 1 proceeds to step S66.

[0353] Then, the determining means 14 of the server 1 reads out N_A and N_B from the database 16, and adds up the read out N_A and N_B to calculate N_A+N_B.

[0354] Then, the determining means 14 of the server 1 sets the number of terminal IDs to N_A+N_B (step S66).

[0355] Thereafter, the determination means 14 of the server 1 determines the signature method by the above-described method based on the number of terminal IDs (=N_A+N_B), the line k1, and the curve k2. That is, the determination means 14 of the server 1 determines the signature method from the number of terminal IDs (=N_A+N_B) (step S67).

[0356] Then, the determination means 14 of the server 1 outputs the determined signature method to the control means 12, and the control means 12 outputs the signature method received from the determination means 14 to the transmission means 15. Upon receiving the signature method from the control means 12, the transmission means 15 of the server 1 notifies the g-th gateway of the received signature method (step S68).

[0357] Then, when it is determined in step S55 that the received data is "no received data," or when it is determined in step S57 that the received data does not contain "aggregate signature data," or after step S68, the control means 12 of the server 1 determines whether g=M (step S69), where M is the total number of gateways.

[0358] If it is determined in step S69 that g is not equal to M, the control means 12 of the server 1 sets g to g+1 (step S70).

[0359] Thereafter, the operation of the server 1 proceeds to step S53, and steps S53 to S70 are repeatedly executed until it is determined in step S69 that g=M.

[0360] Then, when it is determined in step S69 that g=M, the control means 12 of the server 1 sets s=s+1 (step S71).

[0361] Thereafter, the operation of the server 1 proceeds to step S52. Then, while the communication system 10 is operating, the server 1 repeatedly executes the above-described steps S52 to S71.

[0362] In the flowchart shown in Figure 13, when it is determined in step S55 that the received data is "no received data," the number of terminal IDs becomes zero (= 0), and since the line k1 shown in Figure 9 is a line consisting of [signature size] = 6.3 x [number of signatures (= number of IDs of terminal devices)], when the number of terminal IDs is zero (= 0), the signature size becomes zero (= 0).

[0363] Also, curve k2 shown in Figure 9 is [signature size] = 0.0607x 3 -1.7617x 2 The curve is +17.252x+6.3 (x=log2(number of terminal device IDs)), and when the number of terminal IDs is zero (=0), log20 results in an error, so the signature size cannot be determined based on the curve k2.

[0364] As a result, it is not possible to determine a smaller signature size based on the line k1 and the curve k2.

[0365] Therefore, since it is not possible to determine a "signature method" with a smaller signature size for the gth gateway, it is decided to determine a signature method for the next gateway g+1 (see "YES" in step S55 → step S69).

[0366] In addition, in the flowchart shown in FIG. 13, the following patterns (PT1) to (PT4) exist.

[0367] (PT1) "YES" in step S56 → execute steps S61 to S63 → "YES" in step S64 → execute step S65 (PT2) "NO" in step S56 → "YES" in step S57 → Execute steps S58 to S60 (PT3) "YES" in step S56 → execute steps S61 to S63 → "NO" in step S64 (PT4) "NO" in step S56 → "NO" in step S57 Pattern (PT1) is a pattern in which server 1 receives both "one-to-one signature data" and "aggregate signature data" from one gateway g, counts the number of IDs (= number of IDs) of terminal devices that sent "one-to-one signature data" to gateway g and stores it as N_A, and counts the number of IDs (= number of IDs) of terminal devices that sent "aggregate signature data" to gateway g and stores it as N_B.

[0368] In addition, pattern (PT2) is a pattern in which server 1 receives ``aggregated signature data'' from one gateway g, counts the number of IDs (= number of IDs) of terminal devices that sent the ``aggregated signature data'' to gateway g, and stores it as N_B.

[0369] Furthermore, pattern (PT3) is a pattern in which server 1 receives "one-to-one signature data" from one gateway g, counts the number of IDs (=number of IDs) of terminal devices that sent the "one-to-one signature data" to gateway g, and stores N_A as N_A.

[0370] Furthermore, pattern (PT4) is a pattern in which the server 1 does not receive both the "one-to-one signature data" and the "aggregate signature data" from one gateway g. This pattern (PT4) occurs, for example, when one or more terminal devices that were within the wireless communication range of one gateway g all leave the wireless communication range of the gateway g.

[0371] Then, in the case of patterns (PT1) to (PT3), steps S66 to S68 are executed in sequence.

[0372] In this case, after step S65 in pattern (PT1), in step S66, the sum of the number of terminal IDs (=N_A) included in the “one-to-one signature data” and the number of terminal IDs (=N_B) included in the “aggregate signature data” is calculated as the number of terminal IDs, and in step S67, the signature method is determined based on the calculated number of terminal IDs (=N_A+N_B).

[0373] Also, after step S60 in pattern (PT2), in step S66, the number of terminal IDs (=N_B) included in the “aggregate signature data” is calculated, and in step S67, the signature method is determined based on the calculated number of terminal IDs (=N_B).

[0374] Furthermore, after "NO" in step S64 for pattern (PT3), in step S66, the number of terminal IDs (=N_A) included in the "one-to-one signature data" is calculated as the number of terminal IDs, and in step S67, the signature method is determined based on the calculated number of terminal IDs (=N_A).

[0375] Furthermore, in pattern (PT4), server 1 has not received either the "one-to-one signature data" or the "aggregate signature data," which corresponds to no data being received.

[0376] Therefore, after "NO" in step S57, the process proceeds to step S69 (see "NO" in step S57→step S69).

[0377] In this case, a terminal device within the wireless communication range of the gth gateway sends data to the gth gateway using the signature method determined by server 1 in the previous round s-1, and the gth gateway receives "data using the signature method determined by server 1 in round s-1" from the terminal device and sends the received data (= data using the signature method determined by server 1 in round s-1) to server 1.

[0378] Furthermore, in the flowchart shown in Figure 13, the signature method is determined from the number of terminal IDs consisting of N_A + N_B in steps S66 and S67 because server 1 may receive both [one-to-one signature method data] and [aggregate signature method data] from the gth gateway (see step S29 → "YES" in step S31 → steps S32 and S33 in Figure 12).

[0379] Then, in step S67, a signature method with a smaller signature size is determined based on the number of terminal IDs (=N_A+N_B), the line k1, and the curve k2.

[0380] Therefore, in the communication system 10, the amount of signature data can be minimized.

[0381] In the first embodiment, the operation of the terminal device 5 may be performed by software. In this case, the terminal device 5 includes a sensor 54 and a personal computer PC. The personal computer PC includes a CPU (Central Processing Unit), a ROM (Read Only Memory), and a RAM (Random Access Memory).

[0382] The ROM stores a program Prog_A that includes steps S1 to S5 of the flowchart shown in FIG.

[0383] The CPU reads and executes the program Prog_A from the ROM, changes the signature method of the terminal device to the signature method received from the gateway 3, or signs the data msg detected by the sensor 54 according to the signature method, and sends the signed data msg to the gateway 3.

[0384] In this case, the RAM temporarily stores the data msg and the signature scheme received from the gateway 3 .

[0385] The operations of each of the terminal devices 6 to 9 may also be performed by software, similar to the operations of the terminal device 5 described above.

[0386] In the first embodiment, the operation of the gateway 3 may be performed by software. In this case, the gateway 3 includes a personal computer PC. The personal computer PC includes a CPU, a ROM, and a RAM.

[0387] The ROM stores a program Prog_B including steps S11 to S42 shown in FIGS.

[0388] The CPU reads and executes the program Prog_B from the ROM, changes the signature method of one or more terminal devices within the wireless communication range of the gateway 3 to the signature method received from the server 1, and transmits the data msg received from the one or more terminal devices to the server 1.

[0389] In this case, the RAM is s ,N A_s ,N B_s , data msg, signature method, tags tag, a_tag, etc. are temporarily stored.

[0390] The operation of the gateway 4 may also be performed by software in the same manner as the gateway 3 described above.

[0391] Furthermore, in the first embodiment, the operation of the server 1 may be performed by software. In this case, the server 1 includes a personal computer PC. The personal computer PC includes a CPU, a ROM, and a RAM.

[0392] The ROM stores a program Prog_C including steps S51 to S71 shown in FIG.

[0393] The CPU reads and executes the program Prog_C from the ROM, determines a new signature method and notifies the gateways 3 and 4 of it, and also receives and verifies the data msg detected by the terminal devices 5 to 9 from the gateways 3 and 4, and stores the verification results and the data msg.

[0394] In this case, the RAM temporarily stores the ID number of the terminal device and the like.

[0395] In the above description, the communication system 10 includes two gateways 3 and 4, three terminal devices 5 to 7 are present within the wireless communication range of the gateway 3, and two terminal devices 8 and 9 are present within the wireless communication range of the gateway 4. However, in the first embodiment, the communication system 10 is not limited to this, and may include m (m is an integer equal to or greater than 1) gateways g1 to g m In the wireless communication range of the gateway g1, there are n1 (n1 is an integer equal to or greater than 1) terminal devices, and in the wireless communication range of the gateway g2, there are n2 (n2 is an integer equal to or greater than 1) terminal devices, and the gateway g m The wireless communication range of m (n m There may be a total number of terminal devices (where the number is an integer equal to or greater than 1).

[0396] The communication system 10 includes a server 1, m gateways, and n1 terminal devices to n m Even if the system consists of n1 terminal devices to n m The operation of each of the terminal devices is executed according to the flowchart shown in FIG. 10, and the m gateways g1 to g m Each of the operations is performed according to the flowcharts shown in FIGS. 11 and 12, and the operation of server 1 is performed according to the flowchart shown in FIG. 13, which allows the amount of signature data to be minimized.

[0397] [Embodiment 2] Fig. 14 is a schematic diagram of a communication system according to embodiment 2. Referring to Fig. 14, a communication system 10A according to embodiment 2 is the same as communication system 10, except that server 1 of communication system 10 shown in Fig. 1 is replaced with server 1A, and gateways 3 and 4 of communication system 10 shown in Fig. 1 are replaced with gateways 3A and 4A, respectively.

[0398] The server 1A, the base station 2, and the gateways 3A and 4A constitute a network NW1, while the gateways 3A and 4A and the terminal devices 5 to 9 constitute a network NW2.

[0399] The base station 2 is connected to the server 1A by a wired cable. The gateways 3A and 4A are located within the wireless communication range of the base station 2.

[0400] Terminal devices 5 to 7 are located within the wireless communication range of gateway 3A, and terminal devices 8 and 9 are located within the wireless communication range of gateway 4A.

[0401] The server 1A receives, via the base station 2, the data msg detected by the terminal device 5, the data msg detected by the terminal device 6, and the data msg detected by the terminal device 7 from the gateway 3A.

[0402] Furthermore, the server 1A receives, via the base station 2, the data msg detected by the terminal device 8 and the data msg detected by the terminal device 9 from the gateway 4A.

[0403] Then, the server 1A verifies the data msg_5 to msg_9 detected by the terminal devices 5 to 9, respectively, in the same manner as the above-described method used by the server 1, creates verification results, and stores the verification results and the data msg_5 to msg_9.

[0404] In addition, the server 1A previously holds "one-to-one signature keys (public keys) in the one-to-one signature method" corresponding to the terminal devices 5 to 9, and "aggregate signature keys (public keys) in the aggregate signature method" corresponding to the terminal devices 5 to 9.

[0405] Furthermore, the server 1A does not determine the signature method and transmit the determined signature method to the gateways 3A and 4A.

[0406] The gateway 3A determines the signature method using the same method as the server 1 described above, and transmits the determined signature method via wireless communication to the terminal devices 5 to 7. In addition, the gateway 3A performs the same functions as the gateway 3 described above.

[0407] The gateway 4A determines the signature method using the same method as the server 1 described above, and transmits the determined signature method via wireless communication to the terminal devices 8 and 9. In addition, the gateway 4A performs the same functions as the gateway 4 described above.

[0408] In addition, gateway 3A previously holds "aggregate signature keys (public keys) in the aggregate signature method" corresponding to subordinate terminal devices 5 to 7 and terminal devices other than those under its control, and gateway 4A previously holds "aggregate signature keys (public keys) in the aggregate signature method" corresponding to subordinate terminal devices 8 and 9 and terminal devices other than those under its control.

[0409] Fig. 15 is a schematic diagram of server 1A shown in Fig. 14. Referring to Fig. 15, server 1A is the same as server 1 except that determining means 14 and transmitting means 15 of server 1 shown in Fig. 4 are deleted.

[0410] Therefore, the server 1A receives the data msg_5 to msg_7 detected by the terminal devices 5 to 7, respectively, from the gateway 3A, and receives the data msg_8 and msg_9 detected by the terminal devices 8 and 9, respectively, from the gateway 4A.

[0411] Then, the server 1A verifies the data msg_5 to msg_7; msg_8, msg_9 received from the gateways 3A and 4A, respectively, creates a verification result, and stores the verification result and the data msg_5 to msg_7; msg_8, msg_9.

[0412] Fig. 16 is a schematic diagram of the gateway 3A shown in Fig. 14. Referring to Fig. 16, the gateway 3A is the same as the gateway 3, except that a determination means 37 and a database 38 are added to the gateway 3 shown in Fig. 5, the control means 33 of the gateway 3 shown in Fig. 5 is changed to a control means 33A, the wireless unit 32-1 of the gateway 3 shown in Fig. 5 is changed to a wireless unit 32-1A, and the wireless unit 32-2 of the gateway 3 shown in Fig. 5 is changed to a wireless unit 32-2A.

[0413] The wireless unit 32-1A receives the signature scheme from the control means 33A. Then, the wireless unit 32-1A transmits the signature scheme via the antenna 31-1 to the terminal devices 5 to 7. Otherwise, the wireless unit 32-1A performs the same functions as the wireless unit 32-1 described above.

[0414] The wireless unit 32-2A does not receive the one-to-one signature scheme type_1to1 and the aggregation signature scheme type_agg from the server 1A via the antenna 31-2. Otherwise, the wireless unit 32-2A performs the same functions as the wireless unit 32-2 described above.

[0415] The control means 33A receives the data msg from the wireless unit 32-1A, and stores the received data msg in the database 38 in association with the identification information gw_id_3A of the gateway 3A.

[0416] Furthermore, the control means 33A receives the signature method from the determination means 37, outputs the received signature method to the wireless unit 32-1A, and controls the wireless unit 32-1A so as to transmit the signature method to the terminal devices 5 to 7.

[0417] Other than that, the control means 33A performs the same functions as the control means 33 described above.

[0418] The determination means 37 holds the straight line k1 and the curve k2 shown in Fig. 9. Then, the determination means 37 reads out N_A and N_B stored in the database 38, adds up the read out N_A and N_B to calculate N_A+N_B, and sets the number of terminal IDs to N_A+N_B.

[0419] Then, the determination means 37 determines the signature method based on the number of terminal IDs (=N_A+N_B) in the same manner as the determination means 14 of the server 1 described above.

[0420] Then, the determining means 37 outputs the determined signature method to the control means 33A.

[0421] The database 38 stores the data msg_5 to msg_7 in association with the identification information gw_id_3A of the gateway 3A.

[0422] The gateway 4A has the same configuration as the gateway 3A shown in FIG.

[0423] Fig. 17 is a conceptual diagram of correspondence table TBL2. Referring to Fig. 17, correspondence table TBL2 is the same as correspondence table TBL1 except that N_A and N_B are deleted from correspondence table TBL1 shown in Fig. 8, gw_id_3 is changed to gw_id_3A, and gw_id_4 is changed to gw_id_4A. Correspondence table TBL2 is stored in database 16 of server 1A.

[0424] Fig. 18 is a conceptual diagram of correspondence table TBL3. Referring to Fig. 18, correspondence table TBL3 is the same as correspondence table TBL1 except that the "verification result" of correspondence table TBL1 shown in Fig. 8 is deleted, gateway gw_id_4, terminal devices id_8, id_9 and data msg_4_8_1to1, msg_4_9_1to1 associated with gateway gw_id_4 of correspondence table TBL1 are deleted, and N_A and N_B associated with gateway gw_id_4 are deleted, gw_id_3 is changed to gw_id_3A, and gw_id_4 is changed to gw_id_4A.

[0425] In the correspondence table TBL3, N_B associated with the gateway gw_id_3A is changed from "1" to "2" in round 2. This is because the data msg is not verified in the gateway gw_id_3A.

[0426] Referring to FIG. 18, in round 1, the one-to-one signature data associated with gateway gw_id_3A is data msg_3_5_1to1 and msg_3_6_1to1, and the aggregate signature data associated with gateway gw_id_3 is data msg_3_7_agg.

[0427] As a result, in round 1, N_A associated with gateway gw_id_3A is "2" and N_B is "1".

[0428] In round 2, the one-to-one signature data associated with gateway gw_id_3A is data msg_3_6_1to1, and the aggregate signature data associated with gateway gw_id_3A is data msg_3_5_agg and msg_3_7_agg.

[0429] As a result, in round 2, N_A associated with gateway gw_id_3A is "1" and N_B is "2".

[0430] The correspondence table TBL3 is then stored in the database 38 of the gateway 3A.

[0431] A correspondence table similar to the correspondence table TBL3 is stored in the database 38 of the gateway 4A.

[0432] 19 and 20 are first and second flowcharts, respectively, for explaining the operation of the gateway 3A shown in FIG.

[0433] The flowcharts shown in Figures 19 and 20 are the same as the flowcharts shown in Figures 11 and 12, except that steps S36 and S37 of the flowcharts shown in Figures 11 and 12 are replaced with step S37, and steps S13 and S14 of the flowcharts shown in Figures 11 and 12 are replaced with step S13A.

[0434] Referring to FIG. 19, when the operation of the gateway 3A is started, the above-mentioned steps S11 and S12 are executed in sequence.

[0435] After step S12, the gateway 3A waits until the transmission time of the terminal device (step S13A).

[0436] Thereafter, the operation of the gateway 3A proceeds to step S15 of the flowchart shown in FIG.

[0437] Then, the above-mentioned steps S15 to S34 are executed in order. Then, after step S27, or after step S33, or after step S34, the operation of the gateway 3A proceeds to step S35 in FIG.

[0438] Referring to FIG. 19, after step S35 is executed, the determining means 37 of the gateway 3A determines the number of IDs N of the terminal devices based on the correspondence table TBL3, the line k1 and the curve k2 stored in the database 38. s (=N A_s +N B_s ) to determine the signature method type_GW (step S37A), and outputs the determined signature method type_GW to the control means 33A.

[0439] Thereafter, the above-mentioned steps S38 to S42 are executed in sequence. Then, in step S39, N B_s-1 When it is determined that N is not greater than "zero (=0)", or after step S40, or in step S41, A_s-1 When it is determined that is not greater than "zero (=0)", or after step S42, the operation of the gateway 3A proceeds to step S13A.

[0440] Then, while the communication system 10A is operating, steps S15 to S35, step S37A, and steps S38 to S42 are repeatedly executed.

[0441] In the flowchart shown in FIG. 19, after step S12, or after "NO" in step S39, or after step S40, or after "NO" in step S41, or after step S42, in step S13A, the gateway 3A waits until the transmission time of the terminal device because, in embodiment 2, the gateway 3A does not receive instructions (=instructions on the signature method) from the server 1.

[0442] In the flowchart shown in FIG. 19, in step S37A, the number of IDs of the terminal devices N s The reason why the gateway 3A determines the signature method type_GW from the above is because the gateway 3A determines the signature method of the terminal device present within its own wireless communication range.

[0443] Furthermore, in the flowchart shown in FIG. 19, when the signature method type_GW is determined in step S37A, the control means 33A of the gateway 3A determines whether the signature method type_GW is the one-to-one signature method in step S38.

[0444] Then, when the control means 33A of the gateway 3A determines in step S38 that the signature method type_GW is the one-to-one signature method, in step S39, B_s-1 Determine whether is greater than zero (=0).

[0445] And N B_s-1 represents the number of IDs of terminal devices that transmitted data msg to the gateway 3A using the aggregate signature scheme in round s-1.

[0446] As a result, in step S39, N B_s-1is determined to be greater than zero (=0), it is equivalent to confirming that the signature scheme in round s-1 (=aggregate signature scheme) is different from the signature scheme type_GW (=one-to-one signature scheme) in round s, since the signature scheme type_GW determined in step S37A in round s is determined to be the one-to-one signature scheme (see "YES" in step S38).

[0447] Then, after confirming that the signature method in round s-1 (=aggregate signature method) is different from the signature method type_GW (=one-to-one signature method) in round s (=after "YES" in step S39), the terminal devices (=id_B_(s-1)_1 to id_B_(s-1)_N) that transmitted the data msg using the aggregate signature method in round s-1 are B_s-1 The new signature method (=one-to-one signature method) is notified to the terminal device (see step S40).

[0448] On the other hand, N B_s-1 is determined to be not greater than zero (=0), this means that there was no terminal device that sent data msg using the aggregate signature method in round s-1 (i.e., the terminal device sent data msg using the one-to-one signature method in round s-1), so it was decided not to notify the terminal device of the new signature method (= one-to-one signature method).

[0449] Furthermore, when the control means 33A of the gateway 3A determines in step S38 that the signature method type_GW is not the one-to-one signature method (that is, when the control means 33A determines that the signature method type_GW is the aggregate signature method), in step S41, A_s-1 Determine whether is greater than zero (=0).

[0450] In step S41, N A_s-1is determined to be greater than zero (=0), it is equivalent to confirming that the signature scheme in round s-1 (=one-to-one signature scheme) is different from the signature scheme type_GW (=aggregate signature scheme) in round s, since the signature scheme type_GW determined in step S37A in round s is determined to be the aggregate signature scheme (see "NO" in step S38).

[0451] Then, after confirming that the signature method in round s-1 (= one-to-one signature method) is different from the signature method type_GW (= aggregate signature method) in round s (= after "YES" in step S41), the terminal devices (= id_A_(s-1)_1 to id_A_(s-1)_N) that transmitted the data msg using the one-to-one signature method in round s-1 are A_s-1 The new signature method (=aggregate signature method) is notified to the terminal device (see step S42).

[0452] On the other hand, N A_s-1 is determined to be not greater than zero (=0), this means that there was no terminal device that sent data msg using the one-to-one signature method in round s-1 (i.e., the terminal device sent data msg using the aggregate signature method in round s-1), so it was decided not to notify the terminal device of the new signature method (=aggregate signature method).

[0453] The explanation of steps S15 to S34 shown in FIG. 20 is the same as that in the first embodiment.

[0454] The operation of the gateway 4A is also executed in accordance with the flowcharts shown in FIGS.

[0455] Fig. 21 is a flowchart for explaining the operation of the server 1A shown in Fig. 15. The flowchart shown in Fig. 21 comprises steps S51, S52, S54 to S59, S61, S62, and S69 to S71 of the flowchart shown in Fig. 13.

[0456] Referring to FIG. 21, when the operation of the server 1A is started, the control means 12 of the server 1A sequentially executes the above-mentioned steps S51 and S52.

[0457] After step S52, the receiving means 11 of the server 1A executes step S54 described above, and outputs the data received in step S54 to the control means 12.

[0458] Thereafter, the verification means 13 of the server 1A receives the data from the control means 12 and executes step S55 described above.

[0459] If the verification means 13 of the server 1A determines in step S55 that the received data is not "no received data", it executes step S56 described above.

[0460] If it is determined in step S56 that the received data contains "one-to-one signature data", the verification means 13 of the server 1A sequentially executes the above-mentioned steps S61 and S62.

[0461] Then, when it is determined in step S56 that the received data does not contain "one-to-one signature data," or after step S62, the verification means 13 of the server 1A executes the above-mentioned step S57.

[0462] If it is determined in step S57 that the received data contains "aggregate signature data", the verification means 13 of the server 1A sequentially executes the above-mentioned steps S58 and S59.

[0463] Then, when it is determined in step S55 that the received data is "no received data," or when it is determined in step S57 that the received data does not contain "aggregate signature data," or after step S59, the operation of server 1A proceeds to step S69, and step S69 is executed.

[0464] If it is determined in step S69 that g is not equal to M, the control means 12 of the server 1A executes step S70 described above.

[0465] Thereafter, steps S54, S55, S56, S61, S62, S57 to S59, S69, and S70 are repeatedly executed until it is determined in step S69 that g=M.

[0466] Then, if it is determined in step S69 that g=M, the control means 12 of the server 1A executes step S71 described above.

[0467] After step S71, while the communication system 10A is operating, the above-described steps S52, S54 to S56, S61, S62, S57 to S59, and S69 to S71 are repeatedly executed.

[0468] [YES in step S56 → step S61 → step S62] shown in FIG. 21 is a step of acquiring one-to-one signature data from the received data, verifying the acquired one-to-one signature data, and storing it.

[0469] Also, ["YES" in step S57 → step S58 → step S59] shown in FIG. 21 is a step of acquiring aggregate signature data from the received data, verifying the acquired aggregate signature data, and storing it.

[0470] In the flowchart shown in FIG. 21, the following routes (Route 1 to Route 4) exist as routes from "NO" in step S55 to step S69.

[0471] (Route 1) "NO" in step S55 → "YES" in step S56 → step S61 → step S62 → "YES" in step S57 → step S58 → step S59 → step S69 (Route 2) "NO" in step S55 → "YES" in step S56 → step S61 → step S62 → "NO" in step S57 → step S69 (Route 3) "NO" in step S55 → "NO" in step S56 → "YES" in step S57 → step S58 → step S59 → step S69 (Route 4) "NO" in step S55 → "NO" in step S56 → "NO" in step S57 → Step S69 [Step S56 "YES" → Step S61 → Step S62] is a step for verifying and storing the "one-to-one signature data," and [Step S57 "YES" → Step S58 → Step S59] is a step for verifying and storing the "aggregate signature data."

[0472] The result of executing ["YES" in step S56 → step S61 → step S62] (= verification result) is not used in any steps other than ["YES" in step S56 → step S61 → step S62], and the result of executing ["YES" in step S57 → step S58 → step S59] (= verification result) is not used in any steps other than ["YES" in step S57 → step S58 → step S59].

[0473] Therefore, even if there are four routes Route1 to Route4 as routes from "NO" in step S55 to step S69, this does not hinder the operation of the server 1A.

[0474] In other words, since server 1A does not determine the signature method but only verifies and stores the data msg, even if there is a path ["NO" in step S56 → "NO" in step S57 → step S69], server 1A can perform operations according to the flowchart shown in Figure 21.

[0475] In the second embodiment, the operations of each of the terminal devices 5 to 9 are executed according to the flowchart shown in FIG.

[0476] In the second embodiment, in step S37A of FIG. 19, the number of IDs of the terminal devices (=N s), the line k1 and the curve k2, a signature scheme with a smaller signature size is determined.

[0477] Therefore, in the communication system 10A, the amount of signature data can be minimized.

[0478] In the second embodiment, the operations of the gateways 3A and 4A may be performed by software. In this case, each of the gateways 3A and 4A includes a personal computer PC. The personal computer PC includes a CPU, a ROM, and a RAM.

[0479] The ROM stores a program Prog_D that includes steps S11, S12, S13A, S15 to S34, S35, S37A, and S38 to S42 shown in FIGS.

[0480] The CPU reads and executes the program Prog_D from the ROM, determines the signature method of one or more terminal devices present within the wireless communication range of the gateway 3A, notifies the one or more terminal devices of the signature method of the one or more terminal devices, and transmits the data msg (= data of the one-to-one signature method and / or data of the aggregate signature method) received from the one or more terminal devices to the server 1A.

[0481] In this case, the RAM is s ,N A_s ,N B_s , data msg, signature method, tags tag, a_tag, etc. are temporarily stored.

[0482] The operation of the gateway 4A may also be performed by software in the same manner as the gateway 3A described above.

[0483] Furthermore, in the second embodiment, the operation of the server 1A may be performed by software. In this case, the server 1A includes a personal computer PC. The personal computer PC includes a CPU, a ROM, and a RAM.

[0484] The ROM stores a program Prog_E including steps S51, S52, S54 to S56, S61, S62, S57 to S59, and S69 to S71 shown in FIG.

[0485] The CPU reads out and executes the program Prog_E from the ROM, receives and verifies the data msg detected by the terminal devices 5 to 9 from the gateways 3A and 4A, and stores the data msg and the verification results.

[0486] In this case, the RAM temporarily stores the data msg, the verification result, and the like.

[0487] In the above description, the communication system 10A includes two gateways 3A and 4A, and three terminal devices 5 to 7 are present within the wireless communication range of the gateway 3A, and two terminal devices 8 and 9 are present within the wireless communication range of the gateway 4A. However, in the second embodiment, the communication system 10A is not limited to this, and includes m gateways 1 to m, n1 terminal devices are present within the wireless communication range of the gateway g1, n2 terminal devices are present within the wireless communication range of the gateway g2, and so on. m The wireless communication range of m There may be terminal devices.

[0488] The communication system 10A includes a server 1A, m gateways, and n1 terminal devices to n m Even if the system consists of n1 terminal devices to n m The operation of each of the terminal devices is executed according to the flowchart shown in FIG. 10, and the m gateways g1 to g m Each of the operations in (a) and (b) is executed according to the flowcharts shown in FIGS. 19 and 20, and the operation of the server 1A is executed according to the flowchart shown in FIG. 21, which makes it possible to minimize the amount of signature data.

[0489] Other aspects of the second embodiment are the same as those of the first embodiment.

[0490] The communication system 10 according to the first embodiment and the communication system 10 according to the second embodiment each include a server (either server 1 or 1A) that stores data, a gateway (either gateway 3 or 3A) that transmits data to the server (either server 1 or 1A), and three terminal devices 5 to 7 that are arranged within a wireless communication range of the gateway (either gateway 3 or 3A); Each of the three terminal devices 5 to 7 signs the data msg and its own identification information id using a signature key that will result in a smaller signature size after signing, either the one-to-one signature key in the one-to-one signature scheme or the aggregate signature key in the aggregate signature scheme, to create a tag tag, and transmits the identification information id, the data msg, the signature scheme type, and the tag tag to a gateway (either the gateway 3 or 3A) by wireless communication; The gateway (either gateway 3 or 3A) receives three sets of [identification information id, data msg, tag] from each of the three terminal devices 5 to 7, and when the signing key is a one-to-one signing key, transmits the three sets of [identification information id, data msg, tag] to the server (either server 1 or 1A), and when the signing key is an aggregate signing key, aggregates the three sets of [identification information id, data msg] using an aggregate signing key (public key) corresponding to the three pieces of identification information to create an aggregate tag a_tag, and transmits the three sets of [identification information id, data msg] and the aggregate tag a_tag to the server (either server 1 or 1A), The server (either Server 1 or 1A) has in common the following features: when it receives three sets of [identification information id, data msg, tag] from a gateway (either Gateway 3 or 3A), it verifies the data msg using the tag tag based on one of the three sets of [identification information id, data msg, tag] [identification information id, data msg, tag] and creates verification results for all three sets of [identification information id, data msg, tag], and stores the three sets of [verification results and data msg]; and when it receives three sets of [identification information id, data msg] and the aggregation tag a_tag from a gateway (either Gateway 3 or 3A), it verifies the three data msg included in the three sets of [identification information id, data msg] using the aggregation tag a_tag, creates three verification results, and stores the [three verification results and three data msg].

[0491] Therefore, according to an embodiment of the present invention, a communication system comprises: A server that stores data; a first aggregation terminal device that transmits data to a server; n1 (n1 is an integer equal to or greater than 1) terminal devices arranged within a communication range of a first aggregation terminal device; Each of the n1 terminal devices detects data msg, which is its own data, and signs the data msg and its own identification information id using one of a one-to-one signature key, which is a digital signature key in a one-to-one signature scheme that performs a digital signature for each pair of [identification information, data], and an aggregate signature key, which is a digital signature key in an aggregate signature scheme that performs a digital signature for each pair of [identification information, data] and creates a signature by compressing multiple signatures corresponding to multiple pairs of [identification information, data] into one, whichever signature key reduces the signature size after digital signing, to create a tag tag, and transmits the identification information id, the data msg, the signature scheme type, and the tag tag to the first aggregation terminal device by wireless communication; a first aggregation terminal device receives n1 sets of [identification information id, data msg, tag] from n1 terminal devices, and when the signing key is a one-to-one signing key, transmits the n1 sets of [identification information id, data msg, tag] to the server; when the signing key is an aggregate signing key, aggregates the n1 sets of [identification information id, data msg] using an aggregate signing key (public key) corresponding to the n1 pieces of identification information id to create an aggregate tag a_tag, and transmits the n1 sets of [identification information id, data msg] and the aggregate tag a_tag to the server; When the server receives n1 sets of [identification information id, data msg, tag] from the first aggregation terminal device, it verifies the data msg using the tag tag based on one set of [identification information id, data msg, tag] among the n1 sets of [identification information id, data msg, tag] and creates verification results for all n1 sets of [identification information id, data msg, tag] and stores the n1 sets of [verification results and data msg], and when it receives n1 sets of [identification information id, data msg] and aggregation tag a_tag from the first aggregation terminal device, it verifies the n1 pieces of data msg included in the n1 sets of [identification information id, data msg] using the aggregation tag a_tag and creates n1 verification results, and stores the [n1 verification results and n1 pieces of data msg].

[0492] If a communication system has the above configuration, each of the n1 terminal devices signs the data msg and its own identification information, i.e., identification information id, using the signature key between the one-to-one signature key and the aggregate signature key, whichever results in a smaller signature size after digital signing, and sends n1 sets of [identification information id, data msg, tag tag] or n1 sets of [identification information id, data msg] and the aggregation tag a_tag to the server via the first aggregation terminal device, and the server verifies the n1 pieces of data msg using the tag tag, or verifies the n1 pieces of data msg using the aggregation tag a_tag and stores the n1 verification results and the n1 pieces of data msg, thereby minimizing the amount of signature data.

[0493] In the embodiment of the present invention, each of the gateways 3, 4, 3A, and 4A constitutes an "aggregation terminal device."

[0494] Furthermore, in an embodiment of the present invention, when each of terminal devices 5 to 7 executes step S5 of Figure 10, this corresponds to "each of the n1 terminal devices detects the data msg, which is its own data, and signs the data msg and its own identification information id using one of the following signature keys that reduces the signature size after digital signature: a one-to-one signature key, which is a digital signature key in a one-to-one signature method that performs a digital signature for each set of [identification information, data], and an aggregate signature key, which is a digital signature key in an aggregate signature method that performs a digital signature for each set of [identification information, data] and creates a signature by compressing multiple signatures corresponding to multiple sets of [identification information, data] into one; and creates a tag tag by signing the data msg and its own identification information id, and then transmits the identification information id, data msg, signature method type, and tag tag to the first aggregation terminal device via wireless communication."

[0495] Furthermore, in the embodiment of the present invention, the one-to-one signature key (private key) or the aggregate signature key (private key) constitutes a "signature key."

[0496] Furthermore, in an embodiment of the present invention, when either gateway 3 or 4 executes step S29 of the flowchart shown in Figure 12 or 20, this corresponds to "the first aggregation terminal device receiving n1 sets of [identification information id, data msg, tag] from n1 terminal devices, and when the signing key is a one-to-one signing key, sending the n1 sets of [identification information id, data msg, tag] to the server."

[0497] Furthermore, in an embodiment of the present invention, when either of the gateways 3 and 4 executes steps S32 and S33 of the flowchart shown in FIG. 12 or 20, this corresponds to "when the signing key is an aggregate signing key, signing n1 sets of [identification information id, data msg] with the aggregate signing key to create an aggregation tag a_tag, and sending the n1 sets of [identification information id, data msg] and the aggregation tag a_tag to the server."

[0498] Furthermore, in an embodiment of the present invention, when the server 1 executes steps S61 and S62 shown in Figure 13 n1 times, this corresponds to "when the server receives n1 sets of [identification information id, data msg, tag] from the first aggregation terminal device, it verifies the data msg using the tag tag based on one set of [identification information id, data msg, tag] out of the n1 sets of [identification information id, data msg, tag] and creates a verification result, performing this for all n1 sets of [identification information id, data msg, tag] and storing the n1 sets of [verification result and data msg]."

[0499] Furthermore, in an embodiment of the present invention, when server 1 executes steps S58 and S59 shown in Figure 13 n1 times, this corresponds to "when the server receives n1 pairs of [identification information id, data msg] and aggregation tag a_tag from the first aggregation terminal device, it uses the aggregation tag a_tag to verify the n1 pieces of data msg contained in the n1 pairs of [identification information id, data msg] to create n1 verification results, and stores the [n1 verification results and n1 pieces of data msg]."

[0500] Furthermore, in an embodiment of the present invention, when server 1 executes steps S66 to S68 shown in Figure 13, this corresponds to "the server determining the digital signature scheme DSM, which is the digital signature scheme to be used from the one-to-one signature scheme and the aggregate signature scheme, and transmitting the determined digital signature scheme DSM to the first aggregation terminal device."

[0501] Furthermore, in an embodiment of the present invention, when either gateway 3 or 4 executes steps S36 to S42 of FIG. 11, this corresponds to "the first aggregation terminal device receiving the digital signature method DSM from the server and transmitting the received digital signature method DSM to n1 terminal devices via wireless communication."

[0502] Furthermore, in an embodiment of the present invention, when server 1 executes step S67 shown in Figure 13, this corresponds to "the server determining the digital signature scheme DSM based on the number of terminal devices present within the communication range of the first aggregation terminal device."

[0503] Furthermore, in an embodiment of the present invention, the execution of steps S66 and S67 shown in FIG. 13 by the server 1 based on the straight line k1 and curve k2 shown in FIG. 9 corresponds to "the server determining, as the digital signature scheme DSM, the signature scheme that will result in the smallest post-aggregation signature size from the one-to-one signature scheme and the aggregate signature scheme, based on a first relational expression showing the relationship between the post-aggregation signature size in the one-to-one signature scheme and the number of terminal devices, and a second relational expression showing the relationship between the post-aggregation signature size in the aggregate signature scheme and the number of terminal devices."

[0504] Furthermore, in an embodiment of the present invention, the execution of step S67 shown in FIG. 13 by the server 1 based on the straight line k1 and the curve k2 shown in FIG. 9 corresponds to "the server counting a first number N_A, which is the number of data in the one-to-one signature scheme, and a second number N_B, which is the number of data in the aggregate signature scheme, based on the data received from the first aggregation terminal device, calculating the sum N_A+N_B of the first number N_A and the second number N_B as the number of terminal devices, detecting a first aggregated signature size corresponding to the sum N_A+N_B based on the first relational expression, and detecting a second aggregated signature size corresponding to the sum N_A+N_B based on the second relational expression, and determining the signature scheme when the smaller aggregated signature size of the first aggregated signature size and the second aggregated signature size is obtained as the digital signature scheme DSM."

[0505] Furthermore, in an embodiment of the present invention, when either of gateways 3 and 4 selects "YES" at step S39 in FIG. 11 and executes step S40, or selects "YES" at step S41 in FIG. 11 and executes step S42, this corresponds to "the first aggregation terminal device determining whether the digital signature method DSM is different from the signature method in the n1 terminal devices, and when it determines that the digital signature method DSM is different from the signature method in the n1 terminal devices, transmitting the digital signature method DSM to the n1 terminal devices via wireless communication."

[0506] Furthermore, in an embodiment of the present invention, when each of terminal devices 5 to 9 executes steps S3 and S4 of Figure 10, this corresponds to "each of n1 terminal devices determining whether or not it has received the digital signature method DSM from the first aggregation terminal device via wireless communication, or determining whether or not the transmission time of the data msg has arrived, and when it determines that it has received the digital signature method DSM from the first aggregation terminal device, changing the digital signature method to the received digital signature method DSM."

[0507] Furthermore, in an embodiment of the present invention, when either gateway 3A or 4A executes steps S37A, S38 to S42 of FIG. 19, this corresponds to "the first aggregation terminal device determining the digital signature scheme DSM, which is the digital signature scheme to be used from the one-to-one signature scheme and the aggregation signature scheme, and transmitting the determined digital signature scheme DSM to n1 terminal devices via wireless communication."

[0508] Furthermore, in an embodiment of the present invention, when either gateway 3A or 4A executes steps S37A to S42 of FIG. 19, this corresponds to "the first aggregation terminal device determining the digital signature scheme DSM, which is the digital signature scheme to be used from the one-to-one signature scheme and the aggregation signature scheme, and transmitting the determined digital signature scheme DSM to n1 terminal devices via wireless communication."

[0509] Furthermore, in an embodiment of the present invention, when either gateway 3A or 4A executes step S37A in FIG. 19, this corresponds to "the first aggregation terminal device determining the digital signature method DSM based on the number of terminal devices present within its communication range."

[0510] Furthermore, in the embodiment of the present invention, the execution of step S37A in FIG. 19 by either gateway 3A or 4A based on line k1 and curve k2 shown in FIG. 9 means that "the first aggregation terminal device determines, as the digital signature scheme DSM, the signature scheme that will result in the smallest post-aggregation signature size from the one-to-one signature scheme and the aggregate signature scheme, based on a first relational expression indicating the relationship between the post-aggregation signature size in the one-to-one signature scheme and the number of terminal devices, and a second relational expression indicating the relationship between the post-aggregation signature size in the aggregate signature scheme." This is equivalent to:

[0511] Furthermore, in an embodiment of the present invention, when either of gateways 3A and 4A executes step S37A in FIG. 19 based on the straight line k1 and the curve k2 shown in FIG. 9, this corresponds to "a first aggregation terminal device detecting the number of terminal devices that have sent at least one of data in the one-to-one signature scheme and data in the aggregate signature scheme to itself, detecting a first aggregated signature size corresponding to the number of terminal devices based on a first relational expression, and detecting a second aggregated signature size corresponding to the number of terminal devices based on a second relational expression, and determining the signature scheme when the smaller aggregated signature size of the first aggregated signature size and the second aggregated signature size is obtained as the digital signature scheme DSM."

[0512] Furthermore, in an embodiment of the present invention, when either gateway 3A or 4A executes steps S37A to S42 of FIG. 19, this corresponds to "the first aggregation terminal device determining whether the digital signature method DSM is different from the signature method in the n1 terminal devices, and when it determines that the digital signature method DSM is different from the signature method in the n1 terminal devices, transmitting the digital signature method DSM to the n1 terminal devices via wireless communication."

[0513] Furthermore, in the embodiment of the present invention, step S1 in FIG. 10 corresponds to "a first step in which the setting means sets, as the signature method to be used, either a one-to-one signature method in which a digital signature is generated for each set of [identification information, data], or an aggregate signature method in which a digital signature is generated for each set of [identification information, data] and multiple signatures corresponding to multiple sets of [identification information, data] are compressed into one signature."

[0514] Furthermore, in this embodiment of the present invention, step S3 in Figure 10 corresponds to "a second step in which the determination means determines whether or not the digital signature method DSM, which is the digital signature method to be used, has been received after the first step, or whether or not the data transmission time has arrived."

[0515] Furthermore, in an embodiment of the present invention, determining that a digital signature method has been received in step S3 of FIG. 10 and executing step S4 corresponds to "a third step in which the control means changes the signature method set in the first step to the digital signature method DSM when it is determined in the second step that the digital signature method has been received."

[0516] Furthermore, in an embodiment of the present invention, determining that "the transmission time has arrived" in step S3 of Figure 10 and executing step S5 corresponds to executing "a fourth step in which, when the signature means determines in the second step that the data transmission time has arrived, the signature means signs the identification information id of the terminal device and the data msg detected in the terminal device using the digital signature method DSM to create a tag tag."

[0517] Furthermore, in the embodiment of the present invention, step S5 in FIG. 10 corresponds to "a fifth step in which the transmitting means transmits the identification information id of the terminal device, the data msg, and the tag tag to the aggregation terminal device."

[0518] Furthermore, in the embodiment of the present invention, executing step S55 in FIG. 13 corresponds to "a sixth step in which the determining means determines whether or not signature data has been received from the aggregation terminal device."

[0519] Furthermore, in an embodiment of the present invention, executing step S60 or step S63 in FIG. 13 corresponds to executing "a seventh step in which, when the verification means determines in the first step that signature data has been received, the verification means verifies and stores the signature data received in the first step."

[0520] Furthermore, in an embodiment of the present invention, executing step S59 or step S62 in Figure 13 corresponds to executing "an eighth step in which, when it is determined that data has been received in the first step, the counting means counts the number of identification information pieces of terminal devices that detected the data received in the first step."

[0521] Furthermore, in this embodiment of the present invention, executing step S67 in FIG. 13 corresponds to executing "a step in which the determination means determines the digital signature method based on the number of pieces of identification information of the terminal device."

[0522] Furthermore, in an embodiment of the present invention, executing step S68 in Figure 13 corresponds to executing "a ninth step in which the transmitting means transmits the digital signature method determined in the fifth step to the aggregation terminal device."

[0523] The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the description of the above embodiments, and is intended to include all modifications within the meaning and scope of the claims. [Industrial Applicability]

[0524] The present invention is applied to a communication system, an aggregation terminal device, a server, and a program to be executed by a computer. [Explanation of symbols]

[0525] 1,1A server, 2 base station, 3,4,3A,4A gateway, 5-9 terminal device, 10,10A communication system, 11 receiving means, 12,33,33A,53 control means, 13 verification means, 14,37 determination means, 15 transmitting means, 16,38 database, 20 wired cable, 31-1,31-2,51 antenna, 32-1,32-2,32-2A,52 wireless unit, 34 aggregation means, 55 signature means, 54 sensor, 56 timer.

Claims

1. A server that stores data; a first aggregation terminal device that transmits the data to the server; n terminals arranged within the communication range of the first aggregation terminal device 1 (n 1 and (wherein each is an integer greater than or equal to 1) terminal devices, The n 1 each of the terminal devices detects data msg, which is its own data, and signs the data msg and its own identification information id using a signature key that reduces the signature size after digital signing from among a one-to-one signature key, which is a digital signature key in a one-to-one signature scheme that performs a digital signature for each set of [identification information, data], and an aggregate signature key, which is a digital signature key in an aggregate signature scheme that performs a digital signature for each set of [identification information id, data msg] and creates a signature by compressing multiple signatures corresponding to multiple sets of [identification information id, data msg] into one, to create a tag tag; and transmits the identification information id, the data msg, the signature scheme type, and the tag tag to the first aggregation terminal device by wireless communication; The first aggregation terminal device is n 1 The set of [the identification information id, the data msg, the tag tag] is respectively 1 When the signature key is the one-to-one signature key, 1 A set of [the identification information id, the data msg, the tag tag] is sent to the server, and when the signing key is the aggregate signing key, 1 The set of [the identification information id, the data msg, the tag tag] is n 1 n corresponding to the identification information id 1 The n public keys are aggregated to generate an aggregate tag a_tag, 1 Sending the set of [the identification information id, the data msg] and the aggregation tag a_tag to the server; The server 1 When the set of [the identification information id, the data msg, the tag tag] is received from the first aggregation terminal device, 1 The n sets of [the identification information id, the data msg, the tag] are used to verify the data msg using the tag tag based on one set of [the identification information id, the data msg, the tag], and generate a verification result. 1 Execute this for all of the pairs [the identification information id, the data msg, the tag tag] and 1 The set of [verification result and said data msg] is stored, and said n 1 When the set of [the identification information id, the data msg] and the aggregation tag a_tag is received from the first aggregation terminal device, the n 1 n included in the set [the identification information id, the data msg] 1 Verify the data msg and 1 Create verification results, and 1 verification results and n 1 A communication system that stores [number of data msg].

2. the server determines a digital signature scheme DSM that is a digital signature scheme to be used from the one-to-one signature scheme and the aggregate signature scheme, and transmits the determined digital signature scheme DSM to the first aggregation terminal device; The first aggregation terminal device receives the digital signature method DSM from the server, and transmits the received digital signature method DSM to the n 1 The communication system according to claim 1 , wherein the signal is transmitted to a plurality of terminal devices.

3. The communication system according to claim 2 , wherein the server determines the digital signature scheme DSM based on the number of the terminal devices present within the communication range of the first aggregation terminal device.

4. 4. The communication system of claim 3, wherein the server determines, as the digital signature scheme DSM, one of the one-to-one signature scheme and the aggregate signature scheme that results in a smaller signature size after aggregation, based on a first relational expression that indicates the relationship between the signature size after aggregation in the one-to-one signature scheme and the number of the terminal devices, and a second relational expression that indicates the relationship between the signature size after aggregation in the aggregate signature scheme and the number of the terminal devices.

5. 5. The communication system according to claim 4, wherein the server counts a first number N_A, which is the number of data in the one-to-one signature scheme, and a second number N_B, which is the number of data in the aggregate signature scheme, based on the data received from the first aggregation terminal device; calculates the sum N_A+N_B of the first number N_A and the second number N_B as the number of terminal devices; detects a first aggregated signature size corresponding to the sum N_A+N_B based on the first relational expression, and detects a second aggregated signature size corresponding to the sum N_A+N_B based on the second relational expression; and determines as the digital signature scheme DSM the signature scheme that results in the smaller aggregated signature size of the first aggregated signature size and the second aggregated signature size.

6. The first aggregation terminal device is configured to 1 It is determined whether the digital signature scheme DSM is different from the signature scheme in the n terminal devices, and 1 When it is determined that the signature scheme is different from the signature scheme in the n terminal devices, the digital signature scheme DSM is transmitted to the n terminal devices by wireless communication. 1 The communication system according to claim 2, wherein the signal is transmitted to a plurality of terminal devices.

7. The n 1 3. The communication system of claim 2, wherein each of the terminal devices determines whether or not it has received the digital signature scheme DSM from the first aggregation terminal device via wireless communication, or determines whether or not the transmission time of the data msg has arrived, and when it determines that it has received the digital signature scheme DSM from the first aggregation terminal device, it changes the digital signature scheme to the received digital signature scheme DSM.

8. The first aggregation terminal device determines a digital signature scheme DSM that is a digital signature scheme to be used from the one-to-one signature scheme and the aggregate signature scheme, and transmits the determined digital signature scheme DSM to n terminals by wireless communication. 1 The communication system according to claim 1 , wherein the signal is transmitted to a plurality of terminal devices.

9. The communication system according to claim 8 , wherein the first aggregation terminal device determines the digital signature scheme DSM based on the number of the terminal devices present within its communication range.

10. The communication system described in claim 9, wherein the first aggregation terminal device determines, as the digital signature scheme DSM, one of the one-to-one signature scheme and the aggregate signature scheme that results in a smaller signature size after aggregation, based on a first relational expression that indicates the relationship between the signature size after aggregation in the one-to-one signature scheme and the number of the terminal devices, and a second relational expression that indicates the relationship between the signature size after aggregation in the aggregate signature scheme and the number of the terminal devices.

11. 11. The communication system of claim 10, wherein the first aggregation terminal device detects the number of terminal devices that have transmitted at least one of data in the one-to-one signature scheme and data in the aggregate signature scheme to itself, detects a first aggregated signature size corresponding to the number of terminal devices based on the first relational expression, and detects a second aggregated signature size corresponding to the number of terminal devices based on the second relational expression, and determines the signature scheme when the smaller aggregated signature size of the first aggregated signature size and the second aggregated signature size is obtained as the digital signature scheme DSM.

12. The first aggregation terminal device is configured to 1 It is determined whether the digital signature scheme DSM is different from the signature scheme in the n terminal devices, and 1 When it is determined that the signature scheme is different from the signature scheme in the n terminal devices, the digital signature scheme DSM is transmitted to the n terminal devices by wireless communication. 1 The communication system according to claim 8, wherein the signal is transmitted to a plurality of terminal devices.

13. The n 1 9. The communication system of claim 8, wherein each of the terminal devices determines whether or not it has received the digital signature scheme DSM from the first aggregation terminal device via wireless communication, or determines whether or not the transmission time of the data msg has arrived, and when it determines that it has received the digital signature scheme DSM from the first aggregation terminal device, it changes the digital signature scheme to the received digital signature scheme DSM.

14. a second aggregation terminal device that transmits the data to the server; n located within the communication range of the second aggregation terminal device 2 (n 2 and (wherein each is an integer greater than or equal to 1) terminal devices, The n 2 each of the terminal devices detects data msg that is its own data, signs the data msg and identification information id that is its own identification information using a signature key that will have a smaller signature size after digital signing out of the one-to-one signature key and the aggregate signature key, to create a tag tag, and transmits the identification information id, the data msg, and the tag tag to the second aggregation terminal device by wireless communication; The second aggregation terminal device is n 2 The set of [the identification information id, the data msg, the tag tag] is respectively 2 When the signature key is the one-to-one signature key, 2 A set of [the identification information id, the data msg, the tag tag] is sent to the server, and when the signing key is the aggregate signing key, 2 The set of [the identification information id, the data msg, the tag tag] is n 2 n corresponding to the identification information id 2 The n aggregate signature keys (public keys) are aggregated to generate an aggregate tag a_tag, 2 Sending the set of [the identification information id, the data msg] and the aggregation tag a_tag to the server; The server 2 When the set of [the identification information id, the data msg, the tag tag] is received from the second aggregation terminal device, 2 The n sets of [the identification information id, the data msg, the tag] are used to verify the data msg using the tag tag based on one set of [the identification information id, the data msg, the tag], and generate a verification result. 2 Execute this for all of the pairs [the identification information id, the data msg, the tag tag] and 2 The set of [verification result and said data msg] is stored, and said n 2 When the set of [the identification information id, the data msg] and the aggregation tag a_tag is received from the second aggregation terminal device, the aggregation tag a_tag is used to 2 n included in the set [the identification information id, the data msg] 2 Verify the data msg and 2 Create verification results, and 2 verification results and n 2 2. The communication system according to claim 1, wherein the communication system stores the following data:

15. a first step in which a setting means sets, as the signature method to be used, one of a one-to-one signature method in which a digital signature is issued for each set of [identification information, data], and an aggregate signature method in which a digital signature is issued for each set of [identification information, data] and multiple signatures corresponding to multiple sets of [identification information, data] are compressed into one signature; a second step in which a determination means determines whether or not a digital signature method DSM, which is a digital signature method to be used, has been received after the first step, or whether or not a data transmission time has arrived; a third step in which, when it is determined in the second step that the digital signature method has been received, the control means changes the signature method set in the first step to the digital signature method DSM; a fourth step in which, when it is determined in the second step that the data transmission time has arrived, the signature means signs the identification information id of the terminal device and the data msg detected in the terminal device in accordance with the digital signature method DSM to create a tag tag; a fifth step in which a transmitting means transmits the identification information id of the terminal device, the data msg, and the tag tag to the aggregation terminal device.

16. a first step in which a determination means determines whether signature data has been received from an aggregation terminal device; a second step in which, when it is determined in the first step that the signature data has been received, the verification means verifies and stores the signature data received in the first step; a third step in which, when it is determined in the first step that the signature data has been received, a counting means counts the number of pieces of identification information of terminal devices that have detected the signature data received in the first step; a fourth step in which a determination means determines a digital signature method based on the number of pieces of identification information of the terminal device; a fifth step in which a transmitting means transmits the digital signature method determined in the fourth step to the aggregation terminal device; a first aggregated signature size corresponding to the number of pieces of identification information of the terminal devices in a first relational expression showing the relationship between the aggregated signature size and the number of terminal devices in a one-to-one signature scheme that performs a digital signature for each set of [identification information, data] and creates a signature by compressing multiple signatures corresponding to multiple sets of [identification information, data] into one; and a second aggregated signature size corresponding to the number of pieces of identification information of the terminal devices in a second relational expression showing the relationship between the aggregated signature size and the number of terminal devices in an aggregate signature scheme that performs a digital signature for each set of [identification information, data] and creates a signature by compressing multiple signatures corresponding to multiple sets of [identification information, data]; and determines the digital signature scheme by detecting the signature scheme that results in the smaller of the first aggregated signature size and the second aggregated signature size.

17. An aggregation terminal device that transmits data msg detected by a terminal device to a server, a one-to-one signature key that is a digital signature key in a one-to-one signature scheme that performs a digital signature for each set of [identification information, data], and an aggregate signature key that is a digital signature key in an aggregate signature scheme that performs a digital signature for each set of [identification information, data] and creates a signature in which multiple signatures corresponding to multiple sets of [identification information, data] are compressed into one; a tag that is created by signing the data msg and identification information id that is identification information of a terminal device using a signature key that reduces the signature size after digital signing; and [identification information id, data msg, signature scheme type, tag] that includes the identification information id, the data msg, and a signature scheme consisting of either the one-to-one signature scheme or the aggregate signature scheme. 1 (n 1 a receiving means for receiving from a number of terminal devices (wherein the number is an integer equal to or greater than 1); When the signature method is the one-to-one signature method, the n 1 [identification information id, data msg, signature method type, tag tag] 1 n signature types deleted 1 [identification information id, data msg, tag tag] is transmitted to the server, and when the signature method is the aggregate signature method, the n 1 [identification information id, data msg, signature method type, tag tag] 1 n signature types deleted 1 [identification information id, data msg, tag tag] 1 n corresponding to the identification information id 1 n aggregate signature keys (public keys) are aggregated to generate an aggregate tag a_tag, 1 and a transmitting means for transmitting the identification information id, data ms and the aggregation tag a_tag to a server.

18. The n received by the receiving means 1 a determination means for determining the signature scheme type based on the sum N_A+N_B of the number N_A of terminal devices whose signature scheme is the one-to-one signature scheme and the number N_B of terminal devices whose signature scheme is the aggregate signature scheme, based on the number [tag tag, identification information id, data msg, signature scheme type]; The transmission means further transmits the signature method type determined by the determination means to the n 1 18. The aggregation terminal device of claim 17, wherein the aggregation terminal device transmits to a plurality of terminal devices.

19. When the signature method type determined by the determination means is different from the signature method in the terminal device, the transmission means transmits the signature method type determined by the determination means to the n 1 20. The aggregation terminal device of claim 18, wherein the aggregation terminal device transmits to a plurality of terminal devices.

20. A server that receives data msg detected by a terminal device, A signature scheme that performs a digital signature for each set of [identification information, data] is called a one-to-one signature scheme, a signature scheme that performs a digital signature for each set of [identification information, data] and creates a signature by compressing multiple signatures corresponding to multiple sets of [identification information, data] into one is called an aggregate signature scheme, the digital signature key in the one-to-one signature scheme is called a one-to-one signature key, and the digital signature key in the aggregate signature scheme is called an aggregate signature key, a receiving means for receiving from an aggregation terminal device, when the signature method is the one-to-one signature method, a tag created by signing the data msg and identification information id that is identification information of a terminal device using the one-to-one signature key, and [the identification information id, the data msg, the tag] including the identification information id and the data msg, and when the signature method is the aggregate signature method, receiving from the aggregation terminal device an aggregate tag a_tag created by aggregating a plurality of [the identification information id, the data msg, the tag] using aggregate signature keys (public keys) corresponding to a plurality of the identification information ids, and a plurality of [the identification information id, the data msg]; A server comprising a verification means for verifying the data msg based on the [identification information id, the data msg, the tag tag] received by the receiving means, or the [identification information id, the data msg] and the aggregation tag a_tag, and storing the verification result and the data msg.

21. The server according to claim 20, further comprising a determination means for counting the number N_A of terminal devices for which the signature method is the one-to-one signature method based on the [identification information id, the data msg, the tag] received by the receiving means, counting the number N_B of terminal devices for which the signature method is the aggregate signature method based on the [identification information id, the data msg] received by the receiving means, and determining the signature method based on the sum N_A+N_B of the numbers N_A and N_B.

22. 22. The server according to claim 21, further comprising a sending means for sending the signature scheme determined by said determining means to said aggregation terminal device.

Images