Watermark embedding device and program

Abstract

This watermark embedding device includes: a watermark embedding unit that receives an electronic watermark and outputs embedding information for specifying a signature generation circuit in which the electronic watermark is embedded; and a signature generation unit that receives messages and outputs electronic signatures obtained by applying the signature generation circuit to the messages. However, the probability of how well the content of the electronic watermark can be identified by an interactive device on the basis of an operation is equal to or less than a reference, said interactive device performing said operation involving issuing any of the messages to a trial device to which the signature generation circuit can be applied and receiving the electronic signature obtained by applying the signature generation circuit to the message with the trial device.

Description

Watermark embedding device and program

[0001] The present invention relates to digital watermarking technology.

[0002] A digital watermark embedding signature scheme is known that allows a digital watermark to be embedded in a circuit that generates a digital signature (signature generation circuit) (see, for example, Non-Patent Document 1).

[0003] Rishab Goyal, Sam Kim, Nathan Manohar, Brent Waters, and David J. Wu. "Watermarking public-key cryptographic primitives," In Alexandra Boldyreva and Daniele Micciancio, editors, CRYPTO 2019, Part III, volume 11694 of LNCS, pages 367398. Springer, Heidelberg, August 2019. (Cited on page 3.)

[0004] However, in the conventional digital watermark embedding signature scheme, the confidentiality of the digital watermark embedded in the signature generation circuit has not been taken into consideration.

[0005] In view of the above, the present invention provides a digital watermark embedding signature scheme that ensures the confidentiality of the digital watermark embedded in the signature generation circuit.

[0006] The watermark embedding device has a watermark embedding unit that receives a digital watermark and outputs embedding information for identifying a signature generation circuit in which the digital watermark is embedded, and a signature generation unit that receives a message and outputs a digital signature obtained by applying the signature generation circuit to the message, provided that an interactive device that performs an operation of providing an arbitrary message to a trial device capable of applying the signature generation circuit and receiving the digital signature obtained by applying the signature generation circuit to the message on the trial device can identify the content of the digital watermark based on the operation with a probability below a reference value.

[0007] This ensures the confidentiality of the digital watermark embedded in the signature generation circuit.

[0008] FIG. 1 is a block diagram illustrating the configuration of a signature system according to a first embodiment. FIG. 2 is a block diagram illustrating the configurations of a key generation device and a signature generation device (watermark embedding device) according to the first embodiment. FIG. 3A is a block diagram illustrating the configuration of a signature verification device according to the first and second embodiments. FIG. 3B is a block diagram illustrating the configuration of a watermark extraction device according to the first and second embodiments. FIG. 4 is a block diagram illustrating the configuration of a signature system according to a second embodiment. FIG. 5 is a block diagram illustrating the configurations of a key generation device, a signature generation device, and a watermark embedding device (watermark embedding device) according to the second embodiment. FIG. 6 is a block diagram illustrating the hardware configuration of each device according to the embodiments.

[0009] Hereinafter, embodiments of the present invention will be described. [Notation] First, notation used in the embodiments will be described. x←X represents randomly (for example, uniformly randomly) selecting an element x from a finite set X. x←$ represents uniformly randomly selecting an element from a finite set $. B(x)→C represents a process of calculating a function value B(x) for an input x and outputting a calculation result C of the function value B(x). B(x)→C may also be written as C←B(x), but B(x)→C and C←B(x) have the same meaning. [ν] represents a set {1,...,ν} of positive integers less than or equal to ν. ν is a positive integer. λ represents a security parameter. λ is a positive integer. A function value f(λ) for an input λ is 1 / (λ) for all constants c>0. c), a function f(λ) is said to be negligible. The negligibility of a function value f(λ) is expressed as f(λ) = negl(λ), where the constant c is a positive integer. Probabilistic polynomial time is abbreviated as PPT. A PPT device is a device that operates in probabilistic polynomial time by repeating input and output. For example, each of the following devices is a PPT device. MS represents the message space (the set of messages from which a digital signature can be generated). MK represents the watermark space (the set of digital watermarks that can be embedded). ν1:=ν2 represents setting ν2 as ν1. In other words, ν1:=ν2 represents substituting ν2 for ν1.

[0010] [Principle] The principle of the embodiment will be described. The signature system of the embodiment includes a watermark embedding unit that receives a digital watermark and outputs embedding information for identifying the signature generation circuit in which the digital watermark is embedded, and a signature generation unit that receives a message and outputs a digital signature obtained by applying the signature generation circuit to the message. This signature system is characterized in that an interactive device that provides an arbitrary message to a trial device capable of applying the signature generation circuit and receives a digital signature obtained by applying the signature generation circuit to the message on the trial device has a probability of identifying the content of the digital watermark based on the operation that is below a certain level. In this way, the signature system of the embodiment ensures the confidentiality of the digital watermark embedded in the signature generation circuit (watermark confidentiality). No digital watermark embedding signature scheme that maintains the confidentiality of the watermark embedded in the signature generation circuit is known. This scheme will be referred to as the White-Box Watermarking Signatures (WMSIG) scheme. The above-mentioned "criterion" is an example of a value (a positive real number) of a magnitude that can be ignored, for example, negl(λ).

[0011] A signature generation circuit is a circuit that generates an electronic signature for an input message using a signature key and outputs the electronic signature. A circuit processes input information and outputs the results obtained from the processing. Examples of circuits are maps, functions, algorithms, programs, electronic circuits, processors, and combinations thereof. A trial device is a device that receives a message, applies a signature generation circuit to the message to obtain an electronic signature, and outputs the electronic signature. An interactive device is a device that provides a message to a trial device and receives from the trial device the electronic signature obtained for the message. A device processes input information and outputs the results obtained from the processing. An interactive device is, for example, a device designed to be used by an attacker. An interactive device and trial device is, for example, a PPT device. Examples of devices are maps, functions, algorithms, programs, electronic circuits, processors, and combinations thereof.

[0012] The embedding of a digital watermark into the signature generation circuit may be performed when generating the verification key and the signature key, or after the verification key and the signature key are generated. The former will be called the first method, and the latter will be called the second method.

[0013] <First Method> In the first method, a digital watermark is embedded in a signature key, and a signature generation circuit uses the signature key with the digital watermark embedded to generate and output a digital signature for a message. That is, the embedded information output by the watermark embedding unit is a verification key and signature key with the digital watermark embedded, and the signature generation circuit obtains a digital signature using the signature key. In the first method, the signature key with the digital watermark embedded is set in the signature generation circuit, and therefore the signature generation circuit that uses this signature key becomes a signature generation circuit with the digital watermark embedded.

[0014] In the first method, the interactive device performs the following operations: provide a first digital watermark candidate and a second digital watermark candidate to a trial device; receive from the trial device a verification key in which a digital watermark selected from the first digital watermark candidate and the second digital watermark candidate is embedded; provide an arbitrary message to the trial device; and receive a digital signature obtained by applying a signature generation circuit using the signature key in which the digital watermark is embedded to the message. The digital watermark is selected from the first digital watermark candidate and the second digital watermark candidate, for example, randomly (e.g., uniformly randomly). In the first method, the difference between the probability that the interactive device will determine that the digital watermark is the second digital watermark candidate based on the operation when the digital watermark is the first digital watermark candidate and the probability that the interactive device will determine that the digital watermark is the second digital watermark candidate based on the operation when the digital watermark is the second digital watermark candidate is equal to or less than a reference value. Alternatively, the difference between the probability that the interactive device will determine that the digital watermark is the first digital watermark candidate based on the operation when the digital watermark is the first digital watermark candidate and the probability that the interactive device will determine that the digital watermark is the first digital watermark candidate based on the operation when the digital watermark is the second digital watermark candidate may be equal to or less than a criterion. An example of this "criterion" is a value (a positive real number) of negligible magnitude, such as negl(λ).

[0015] <Specific Example of the First Scheme> A signature system using the first scheme includes, for example, the following key generation device KeyGen, signature generation device Sign, signature verification device Vrfy, and watermark extraction device Extract. These devices are, for example, PPT devices. The processing of the key generation device is sometimes represented as KeyGen, the processing of the signature generation device as Sign, the processing of the signature verification device as Vrfy, and the processing of the watermark extraction device as Extract. The first scheme is represented as PWMSIG. (KeyGen, Sign, Vrfy, Extract). Furthermore, KeyGen in PWMSIG. (KeyGen, Sign, Vrfy, Extract) is represented as PWMSIG.KeyGen, Sign as PWMSIG.Sign, Vrfy as PWMSIG.Vrfy, and Extract as PWMSIG.Extract.

[0016] Key generation device KeyGen(1 λ , μ) → (vk, sk): The key generator KeyGen generates the security parameter 1 λand a digital watermark μ∈MK as input, and outputs a verification key vk and a signing key sk. In the first method, a digital watermark μ is embedded in the verification key vk and the signing key sk. Signature generation device Sign(sk, m) → σ: The signature generation device Sign takes the signing key sk and a message m∈MS as input, and outputs a digital signature σ. Signature verification device Vrfy(vk, m, σ) → 0 / 1: The signature verification device Vrfy takes the verification key vk and the digital signature σ as input, and outputs 0 or 1. Here, 0 indicates that the verification result of the digital signature σ is unsuccessful, and 1 indicates that the verification result of the digital signature σ is successful. Watermark extraction device Extract(vk, Ĉ', ε) → μ': The watermark extraction device Extract takes the verification key vk, information Ĉ' representing the signature generation circuit, and a success rate parameter ε as input, and outputs a digital watermark μ'∈MK∪{⊥}. Here, ⊥ is a special symbol indicating an error. The watermark extraction device Extract outputs ⊥ when it determines that it cannot extract a correct digital watermark. The signature generation circuit represented by Ĉ' generates and outputs a digital signature for a message using, for example, a signature key sk in which a digital watermark μ is embedded. The success rate parameter ε is a parameter representing the probability that a correct digital signature can be generated by the signature generation circuit represented by information Ĉ' representing the signature generation circuit. The larger the value of the success rate parameter ε, the higher the probability (success rate) of generating a correct digital signature. For example, the success rate parameter ε is the probability that a correct digital signature can be generated. The success rate parameter ε may be obtained from the signature generation circuit, may be obtained by statistical processing of the digital signature generated by the signature generation circuit, or may be predetermined. Usually, the larger the value of the success rate parameter ε, the easier it is to extract a correct digital watermark. Ideally, however, it is desirable that the value of the success rate parameter ε is large and the probability of extracting a correct digital watermark is high. Unless there is any particular confusion, the information C~' representing the signature generation circuit will be simply expressed as the signature generation circuit C~'. Furthermore, the "~" in "C~'" should be written directly above the "C", but due to limitations on notation, it may be written to the upper right of the "C".

[0017] <Watermark Confidentiality> The following steps (1-1-1) to (1-1-4) are performed by Expt priv A,PWMSIG (1 λ , coin). priv A,PWMSIG (1 λ ,coin), μ coin =μ0 to Expt priv A,PWMSIG (1 λ , 0), and μ coin = μ1 to Expt priv A,PWMSIG (1 λ , 1). priv A,PWMSIG "A,PWMSIG" in "private" should be written directly below "private", but due to limitations on notation, it may be written to the right below "private". (1-1-1) The interactive device is λ Take (μ0, μ1)∈MK 2 is output and sent to the trial device. λ means a string of λ 1s. μ0∈MK represents the first digital watermark candidate, and μ1∈MK represents the second digital watermark candidate. (1-1-2) The trial device receives (μ0, μ1), generates a random bit coin←{0, 1}, and then generates the digital watermark μ=μ coin For ∈{μ0, μ1}, generate a verification key vk and a signing key sk (KeyGen(1 λ , μ coin ) → (vk, sk)), and send the generated verification key vk to the interactive device. coindenotes a digital watermark selected from the first digital watermark candidate μ0 and the second digital watermark candidate μ1. (1-1-3) The interactive device executes the following signature queries as many times as desired. Signature query: The interactive device sends an arbitrary message m∈MS to the trial device. The trial device receives the message m, applies a signature generation circuit using a signature key sk to the message m to generate a digital signature σ (Sign(sk, m)→σ), and sends the digital signature σ to the interactive device. The interactive device receives the digital signature σ. (1-1-4) The interactive device outputs coin'∈{0, 1} and stops. coin' is the digital watermark μ identified by the interactive device based on the operations of steps (1-1-1) to (1-1-3). coin' ∈{μ0, μ1}. The trial device outputs coin∈{0, 1} and stops. coin is the actual embedded digital watermark μ coin ∈{μ0, μ1}.

[0018] The first method satisfies the relationship of the following formula (1) for all interactive devices: That is, the first method satisfies watermark confidentiality. Here, Pr[Θ] represents the probability that the event is Θ. priv A,PWMSIG (1 λ , 0)=1] is Expt priv A,PWMSIG (1 λ , 0) represents the probability that coin'=1, and Pr[Expt priv A,PWMSIG (1 λ , 1)=1] is Expt priv A,PWMSIG (1 λ , 1) represents the probability that coin'=1. Also, |ζ| is the absolute value of ζ. That is, equation (1) represents the probability that the digital watermark μ coin is the first digital watermark candidate μ0, the interactive device selects the digital watermark μ based on the operations of steps (1-1-1) to (1-1-3). coin The probability that the second watermark candidate μ1 is determined to be the second watermark candidate μ coin is the second digital watermark candidate μ1, the interactive device generates the digital watermark μ based on the operation.coin is the second digital watermark candidate μ1, and the difference between μ1 and μ2 is equal to or less than the reference negl(λ).

[0019] In other words, the first method satisfies the relationship of the following formula (2) for all interactive devices. where Pr[Expt priv A,PWMSIG (1 λ , 0)=0] is Expt priv A,PWMSIG (1 λ , 0) represents the probability that coin'=0, and Pr[Expt priv A,PWMSIG (1 λ , 1)=0] is Expt priv A,PWMSIG (1 λ , 1) represents the probability that coin'=0. That is, equation (2) represents the probability that the digital watermark μ coin is the first digital watermark candidate μ0, the interactive device selects the digital watermark μ based on the operations of steps (1-1-1) to (1-1-3). coin The probability that the first watermark candidate μ is determined to be μ 0 and the probability that the watermark μ coin is the second digital watermark candidate μ1, the interactive device generates the digital watermark μ based on the operation. coin is the first digital watermark candidate μ0, and the difference between is equal to or less than the reference negl(λ).

[0020] Preferably, the first method satisfies the following requirements: verification validity, signature forgery impossibility, and watermark removal impossibility. <Verification validity> The following steps (1-2-1) to (1-2-4) are performed by Expt. scorrect A,PWMSIG (1 λ ) is expressed as "Expt scorrect A,PWMSIG "A,PWMSIG" in "scorrect" should be written directly below "scorrect", but due to limitations on notation, it may be written to the right below "scorrect". (1-2-1) The interactive device outputs a digital watermark μ∈MK and sends it to the trial device. (1-2-2) The trial device receives μ. The trial device receives the initial input 1λ Using the above, a verification key vk and a signature key sk are generated for the digital watermark μ (KeyGen(1 λ , μ)→(vk, sk)) and sends the generated verification key vk to the interactive device. (1-2-3) The interactive device executes the following signature queries as many times as desired. Signature query: The interactive device sends an arbitrary message m∈MS to the trial device. The trial device receives the message m, applies a signature generation circuit using a signature key sk to the message to generate a digital signature σ (Sign(sk, m)→σ), and sends the digital signature σ to the interactive device. The interactive device receives the digital signature σ. (1-2-4) The interactive device executes the following signature queries as desired. Signature query: The interactive device executes the following signature queries as many times as desired. Signature query: The interactive device executes the following signature queries as desired. * The trial device outputs message m * The digital signature Sign(sk, m * ) verification result is failed (Vrfy(vk, m * , Sign(sk, m * ))=0) then Expt scorrect A,PWMSIG (1 λ )=1, otherwise Expt scorrect A,PWMSIG (1 λ )=0 is output as the final output. In this case, when the relationship of the following formula (3) is satisfied for all interactive devices, the first method satisfies verification correctness.

[0021] <Signature forgery impossibility> The following steps (1-3-1) to (1-3-4) are executed by Expt euf-cma A,PWMSIG (1 λ ) is expressed as "Expt euf-cma A,PWMSIG "A,PWMSIG" in "euf-cma" should be written directly below "euf-cma", but due to limitations on notation, it may be written to the right below "euf-cma". (1-3-1) The interactive device outputs a digital watermark μ∈MK and sends it to the trial device. (1-3-2) The trial device receives μ. The trial device receives the initial input 1 λ Using the above, a verification key vk and a signing key sk are generated for μ (KeyGen(1λ , μ)→(vk, sk)) and sends the generated verification key vk to the interactive device. (1-3-3) The interactive device executes the following signature queries as many times as desired. Signature query: The interactive device sends an arbitrary message m∈MS to the trial device. The trial device receives message m, applies a signature generation circuit using a signature key sk to the message to generate a digital signature σ (Sign(sk, m)→σ), and sends the digital signature σ to the interactive device. The interactive device receives the digital signature σ. (1-3-4) The interactive device executes the following signature queries as many times as desired. Signature query: The interactive device executes the following signature queries as desired. * ∈MS and its digital signature σ * (=Sign(sk, m * )) and the pair (m * , σ * ) and stop. The trial device outputs m * ∈Q and the digital signature σ * The verification result of Vrfy(vk, m * , σ * )=0) then Expt euf-cma A,PWMSIG (1 λ )=1, otherwise Expt euf-cma A,PWMSIG (1 λ ) = 0 as the final output. Here, Q represents the set of messages m sent by the interactive device to the trial device in step (1-2-3). In this case, the first method satisfies the unforgeability of signatures when the relationship in the following formula (4) is satisfied for all interactive devices.

[0022] <Watermark removal is impossible> The following steps (1-4-1) to (1-4-4) are performed using Expt urmv A,PWMSIG (1 λ ) is expressed as "Expt urmv A,PWMSIG "A,PWMSIG" in "urmv" should be written directly below "urmv", but due to limitations on notation, it may be written to the right below "urmv". (1-4-1) The interactive device outputs a digital watermark μ∈MK and sends it to the trial device. (1-4-2) The trial device receives μ. The trial device receives the initial input 1 λUsing the above, a verification key vk and a signing key sk are generated for μ (KeyGen(1 λ , μ) → (vk, sk)), and sends the generated (vk, sk) to the interactive device. (1-4-3) The interactive device generates a digital signature σ for the message m using the signature key sk. * and its success rate parameter ε. (1-4-4) The trial device outputs the signature generation circuit C * and the success rate parameter ε, and the signature generation circuit C~ * Extract the watermark μ'∈MK∪{⊥} from * , ε)→μ'). Here, the following probabilistic events are defined for the processing of steps (1-4-1) to (1-4-4) above. Good: Good means that the interactive device can obtain a valid digital signature σ for a randomly generated message m with a success rate represented by a success rate parameter ε. * That is, the interactive device outputs a signature generation circuit C~ that satisfies the following formula (5): * Outputting this is called Good. Here, C~ * (m) is a signature generation circuit C~ using a signature key sk. * represents the digital signature generated for message m. GoodExt: GoodExt means that μ'≠⊥ holds. BadExt: BadExt means that μ'∈{μ, ⊥} does not hold. In this case, for all interactive devices, if the relationship of the following formula (6) holds, the first method satisfies the watermark removal impossibility. Pr[BadExt]≦negl(λ) and Pr[GoodExt]≧Pr[Good]-negl(λ) (6)

[0023] <Second Method> In the second method, a digital watermark is not embedded when generating a signature key, but is embedded in the signature generation circuit after the signature key is generated. That is, the embedding information output by the watermark embedding unit is the signature generation circuit in which a digital watermark is embedded, and the signature generation circuit obtains a digital signature using the signature key in which the digital watermark is not embedded.

[0024] In the second method, the interactive device performs the following operations: provide a trial device with a signature key, a verification key corresponding to the signature key, and a first and second digital watermark candidates; provide an arbitrary message to the trial device; and receive a digital signature obtained by applying a signature generation circuit, into which a digital watermark selected from the first and second digital watermark candidates is embedded, to the message. In the second method, too, the difference between the probability that the interactive device will determine, based on the operation, that the digital watermark is the second digital watermark candidate when the digital watermark is the first digital watermark candidate, and the probability that the interactive device will determine, based on the operation, that the digital watermark is the second digital watermark candidate when the digital watermark is the second digital watermark candidate, is below a reference value. Alternatively, the difference between the probability that the interactive device will determine that the digital watermark is the first digital watermark candidate based on the operation when the digital watermark is the first digital watermark candidate and the probability that the interactive device will determine that the digital watermark is the first digital watermark candidate based on the operation when the digital watermark is the second digital watermark candidate may be equal to or less than a criterion. An example of this "criterion" is a value (a positive real number) of negligible magnitude, such as negl(λ).

[0025] <Specific Example of the Second Scheme> A signature system using the second scheme includes, for example, a key generation device KeyGen, a signature generation device Sign, a signature verification device Vrfy, a watermarking device Mark, and a watermark extraction device Extract. The processing of the key generation device is sometimes represented as KeyGen, the processing of the signature generation device as Sign, the processing of the signature verification device as Vrfy, the processing of the watermarking device as Mark, and the processing of the watermark extraction device as Extract. These devices are, for example, a PPT device. The second scheme is represented as WMSIG. (KeyGen, Sign, Vrfy, Mark, Extract). Furthermore, in WMSIG. (KeyGen, Sign, Vrfy, Mark, Extract), KeyGen is represented as WMSIG.KeyGen, Sign as WMSIG.Sign, Vrfy as WMSIG.Vrfy, Mark as WMSIG.Mark, and Extract as WMSIG.Extract.

[0026] Key generation device KeyGen(1 λ ) → (vk, sk): The key generator KeyGen generates security parameters 1 λ and outputs a verification key vk and a signing key sk. In the second method, a digital watermark μ is not embedded in the verification key vk and the signing key sk. Signature generation device Sign(sk, m) → σ: The signature generation device Sign takes a signing key sk and a message m∈MS as input and outputs a digital signature σ. Signature verification device Vrfy(vk, m, σ) → 0 / 1: The signature verification device Vrfy takes a verification key vk and a digital signature σ as input and outputs 0 or 1. Here, 0 indicates that the verification result of the digital signature σ is unsuccessful, and 1 indicates that the verification result of the digital signature σ is successful. Watermarking device Mark(sk, μ) → C~: The watermarking device Mark takes a signing key sk and a digital watermark μ∈MK as input and outputs a signature generation circuit C~ in which the digital watermark μ is embedded. The signature generation circuit C~ generates and outputs a digital signature for a message using the signing key sk. Furthermore, the "~" in "C~" should be written directly above the "C", but due to limitations on notation, it may be written to the upper right of the "C". Watermark extraction device Extract(vk, C~', ε, q) → μ': The watermark extraction device Extract takes as input a verification key vk, information C~' representing a signature generation circuit, a success rate parameter ε, and an input parameter q, and outputs a digital watermark μ'∈MK∪{⊥}. Here, the input parameter q is a parameter representing the number of signature generation circuits C~ into which the generated digital watermark μ is embedded. q is, for example, a positive integer. The key generation device KeyGen, the signature generation device Sign, the signature verification device Vrfy, the watermarking device Mark, and the watermark extraction device Extract do not depend on the input parameter q. The input parameter q is used to ensure that the watermark extraction device Extract can be executed in polynomial time. However, the input parameter q may be omitted. That is, the watermark extraction device Extract may be the watermark extraction device Extract(vk, C', ε)→μ'.

[0027] <Watermark Confidentiality> The following steps (2-1-1) to (2-1-4) are performed by Expt priv A,WMSIG (1 λ , coin). priv A,WMSIG " "PWMSIG" in "priv" should be written directly below "priv", but due to limitations on notation, it may be written to the right below "priv". (2-1-1) An interactive device is a device with (vk, sk) and (μ0, μ1)∈MK 2 and sends it to the trial device. That is, the interactive device provides the trial device with the signing key sk, the verification key vk corresponding to the signing key sk, and the first and second digital watermark candidates μ0 and μ1. (2-1-2) The trial device receives (μ0, μ1), generates a random bit coin←{0, 1}, and then generates the digital watermark μ=μ coin ∈{μ0, μ1} embedded signature generation circuit C~ coin Generate Mark(sk, μ coin )→C~ coin ). Digital Watermark μ coin represents a watermark selected from the first watermark candidate μ0 and the second watermark candidate μ1. (2-1-3) The interactive device executes the following signature queries as many times as desired. Signature query: The interactive device sends an arbitrary message m∈MS to the trial device. The trial device receives the message m and generates a watermark μ=μ coin ∈{μ0, μ1} embedded signature generation circuit C~ coin to the message m to generate a digital signature σ (Sign(sk, m) → σ), and send the digital signature σ to the interactive device. The interactive device receives the digital signature σ. (2-1-4) The interactive device outputs coin'∈{0, 1} and stops. coin' is the digital watermark μ identified by the interactive device based on the operations from steps (2-1-1) to (2-1-3). coin' ∈{μ0, μ1}. The trial device outputs coin∈{0, 1} and stops. coin is the actual embedded digital watermark μ coin ∈{μ0, μ1}.

[0028] The second method satisfies the relationship obtained by replacing "PWMSIG" with "WMSIG" in the above formula (1) for all interactive devices. In other words, the second method satisfies the relationship of the following formula (7) for all interactive devices. In other words, the second method satisfies watermark confidentiality. where Pr[Expt priv A,WMSIG (1 λ , 0)=1] is Expt priv A,WMSIG (1 λ , 0) represents the probability that coin'=1, and Pr[Expt priv A,WMSIG (1 λ , 1)=1] is Expt priv A,WMSIG (1 λ , 1) represents the probability that coin'=1. That is, equation (7) represents the probability that the digital watermark μ coin is the first digital watermark candidate μ0, the interactive device selects the digital watermark μ based on the operations of steps (2-1-1) to (2-1-3). coin The probability that the second watermark candidate μ1 is determined to be the second watermark candidate μ coin is the second digital watermark candidate μ1, the interactive device generates the digital watermark μ based on the operation. coin is the second digital watermark candidate μ1, and the difference between μ1 and μ2 is equal to or less than the reference negl(λ).

[0029] In other words, the second method satisfies the relationship obtained by replacing "PWMSIG" with "WMSIG" in the above-mentioned formula (2). That is, the second method satisfies the relationship of the following formula (8) for all interactive devices. where Pr[Expt priv A,WMSIG (1 λ , 0)=0] is Expt priv A,WMSIG (1 λ , 0) represents the probability that coin'=0, and Pr[Expt priv A,WMSIG (1 λ , 1)=0] is Expt priv A,WMSIG (1λ , 1) represents the probability that coin'=0. That is, equation (8) represents the probability that the digital watermark μ coin is the first digital watermark candidate μ0, the interactive device selects the digital watermark μ based on the operations of steps (2-1-1) to (2-1-3). coin The probability that the first watermark candidate μ is determined to be μ 0 and the probability that the watermark μ coin is the second digital watermark candidate μ1, the interactive device generates the digital watermark μ based on the operation. coin is the first digital watermark candidate μ0, and the difference between is equal to or less than the reference negl(λ).

[0030] Preferably, the second method satisfies the requirements of verification validity, signature unforgeability, and watermark unremovability. The requirements of verification validity, signature unforgeability, and watermark unremovability in the second method are obtained by replacing "PWMSIG" with "WMSIG" in the descriptions of verification validity, signature unforgeability, and watermark unremovability in the first method.

[0031] [First Embodiment] Next, a first embodiment of the present invention will be described with reference to the drawings. The first embodiment is based on the first method.

[0032] 1, the signature system 1 of this embodiment includes a key generation device 111, a signature generation device 112, a watermark extraction device 131, and a signature verification device 121. The key generation device 111 and the signature generation device 112 of this embodiment constitute a watermark embedding device 11. The key generation device 111, the signature generation device 112, the watermark extraction device 131, and the signature verification device 121 are capable of communicating with each other via, for example, a network (not shown) or the like.

[0033] As illustrated in FIG. 2, the key generation device 111 of this embodiment includes an input unit 111a, a key generation unit 111b, a communication unit 111c, a storage unit 111y, and a control unit 111z. The key generation device 111 executes each process under the control of the control unit 111z. The signature generation device 112 of this embodiment includes an input unit 112a, a signature generation unit 112b, a communication unit 112c, and a control unit 112z. The signature generation device 112 executes each process under the control of the control unit 112z. As illustrated in FIG. 3A, the signature verification device 121 of this embodiment includes an input unit 121a, a signature verification unit 121b, a communication unit 121c, and a control unit 121z. The signature verification device 121 executes each process under the control of the control unit 121z. 3B, the watermark extraction device 131 of this embodiment includes an input unit 131a, a watermark extraction unit 131b, a communication unit 131c, and a control unit 131z. The watermark extraction device 131 executes each process under the control of the control unit 131z. In either device, input information and information obtained by each processing unit are stored one by one in a memory (not shown), and are read out as needed and used for other processes.

[0034] <Key Generation Process> The input unit 111a of the key generation device 111 (FIG. 2) receives the digital watermark μ∈MK and 1 λ is entered. 1 λ is sent to the key generation unit 111b. The digital watermark μ is stored in the storage unit 111y and sent to the key generation unit 111b. The key generation unit 111b (watermark embedding unit) λ and the digital watermark μ. The key generation unit 111b receives λ and outputs a verification key vk and a signature key sk (embedded information for identifying the signature generation circuit in which the digital watermark is embedded) in which the digital watermark is embedded (KeyGen(1 λ , μ)→(vk, sk)). In this embodiment, a digital watermark μ is embedded in the verification key vk and the signature key sk. The verification key vk and the signature key sk are stored in the storage unit 111y.

[0035] <Signature Generation Process> A message m∈MS to be digitally signed is input to the input unit 112a of the signature generation device 112 (FIG. 2). The message m is sent to the signature generation unit 112b. The signature key sk stored in the memory unit 111y of the key generation device 111 is sent to the communication unit 111c and transmitted to the signature generation device 112. The signature key sk is received by the communication unit 112c of the signature generation device 112 and transmitted to the signature generation unit 112b. The signature generation unit 112b receives the message m and the signature key sk. The signature generation unit 112b applies a signature generation circuit using the signature key sk to the message m, and generates and outputs a digital signature σ for the message m (Sign(sk, m)→σ). The message m and the digital signature σ are sent to the communication unit 112c, which then transmits the message m and the digital signature σ.

[0036] <Signature Verification Process> A message m and a digital signature σ are input to the input unit 121a of the signature verification device 121 (FIG. 3A). The message m and the digital signature σ are sent to the signature verification unit 121b. The verification key vk stored in the memory unit 111y of the key generation device 111 (FIG. 2) is sent to the communication unit 111c and transmitted to the signature verification device 121. The verification key vk is received by the communication unit 121c of the signature verification device 121 (FIG. 3A) and sent to the signature verification unit 121b. The signature verification unit 121b receives the verification key vk, the message m, and the digital signature σ. The signature verification unit 121b performs signature verification of the digital signature σ using the verification key vk and the message m (Vrfy(vk, m, σ) → 0 / 1) and outputs 0 or 1 representing the verification result.

[0037] <Watermark Extraction Process> The signature generation circuit C~' and its success rate parameter ε are input to the input unit 131a of the watermark extraction device 131 (FIG. 3B). The signature generation circuit C~' and the success rate parameter ε are sent to the watermark extraction unit 131b. The verification key vk stored in the memory unit 111y of the key generation device 111 (FIG. 2) is sent to the communication unit 111c and transmitted to the watermark extraction device 131. The verification key vk is received by the communication unit 131c of the watermark extraction device 131 (FIG. 3B) and sent to the watermark extraction unit 131b. The watermark extraction unit 131b receives the verification key vk, the signature generation circuit C~', and the success rate parameter ε. The watermark extraction unit 131b uses the verification key vk, the signature generation circuit C~', and the success rate parameter ε to extract and output the digital watermark μ'∈MK∪{⊥} embedded in the signature generation circuit C~' (Extract(vk, C~', ε)→μ').

[0038] The signature system 1 satisfies the above-mentioned watermark confidentiality. Preferably, the signature system 1 satisfies the above-mentioned verification correctness, signature unforgeability, and watermark unremovability.

[0039] <Specific Example of Processing by Each Device (Method 1)> Below, a specific example of the processing PWMSIG. (KeyGen, Sign, Vrfy, Extract) by each device in the signature system 1 is shown. This specific example satisfies not only the watermark confidentiality described above, but also the verification legitimacy, the impossibility of signature forgery, and the impossibility of watermark removal described above. However, this specific example is merely an example and does not limit the present invention. In other words, other processing PWMSIG. (KeyGen, Sign, Vrfy, Extract) may be executed as long as it satisfies watermark confidentiality.

[0040] <Preparation> First, we define the symbols used in specific examples of processing by each device. <Ciphertext Pseudorandom FE for 1-out-of-2 OT Functionality> The pseudorandom ciphertext FE for 1-out-of-2 OT functionality is expressed as follows: F[[β]](i, x0, x1)=xβ[[i]] where β∈{0, 1} Lout represents the Lout bit string, Lout represents a positive constant, i represents a positive integer, and β[[i]]∈{0, 1} represents the i-th bit of β. Note that β is a point function f α,β This is the output.

[0041] The well-known public key cryptosystem PKE is represented as PKE=PKE.(KG, Enc, Dec). Preferably, the ciphertext obtained by the public key cryptosystem PKE has pseudo-randomness and uniformity. Note that KG represents the key generation process, Enc represents the encryption process, and Dec represents the decryption process. Furthermore, KG in PKE.(KG, Enc, Dec) is represented as PKE.KG, Enc as PKE.Enc, and Dec as PKE.Dec. This also applies to the other notations below.

[0042] The pseudorandom ciphertext FE method for the 1-out-of-2 OT function, Setup, Enc, KG, and Dec of FE.(Setup, Enc, KG, Dec), are defined as follows: Setup(1 λ ): Setup executes the following: Generate (pk j,b , sk j,b )←PKE.KG(1 λ ) for every j∈[n] and b∈{0, 1}, where Generate (pk j,b , sk j,b )←PKE.KG(1 λ ) for every j∈[n] and b∈{0, 1} means that for every j∈[n] and b∈{0, 1}, PKE.KG(1 λ )→(pk j,b , sk j,b ) and run (pk j,b , sk j,b ) (same below). PKE.KG(1 λ ) is 1 λ It takes the input and generates a public key and a private key according to the public key encryption method PKE. j,b represents the public key, and sk j,brepresents the private key. n is a positive integer. Output pk=(pk j,b ) j,b and msk=(sk j,b ) j,b Here, Output pk=(pk j,b ) j,b and msk=(sk j,b ) j,b That is, pk=(pk j,b ) j,b and msk=(sk j,b ) j,b (The same applies below.) Here, (pk j,b ) j,b is the value of the position corresponding to (j, b) (for example, the jb-th bit position) is pk j,b pk = (pk j,b ) j,b is the position corresponding to (j,b) where pk j,b Similarly, (sk j,b ) j,b is the value of the position corresponding to (j,b) (for example, the jbth bit position) is sk j,b That is, msk=(sk j,b ) j,b is the value of the position corresponding to (j,b) j,b This means that the column where is msk (same below).

[0043] Enc(pk, (i, x0, x1)): Enc executes the following: Parse (pk j,b ) j,b ←pk. Here, Parse (pk j,b ) j,b ←pk means pk (pk j,b ) j,b (The same applies below.) ・Generate s j ←{0, 1} λ for every j∈[n]\{i} and compute pke.ct j,b ←PKE.Enc(pk j,b , s j) for every j∈[n]\{i} and b∈{0, 1}, where [n]\{i} represents the set difference obtained by removing {i} from the set [n]. compute pke.ct j,b ←PKE.Enc(pk j,b ,s j ) is PKE.Enc(pk j,b , s j ) → pke.ct j,b Calculate the ciphertext pke.ct j,b (The same applies below.) PKE.Enc(pk j,b , s j ) is the public key pk j,b Using s j This means encrypting the set s according to the public key encryption method PKE. i,b :=x b (+)(+) j∈[n]\{i} s j and compute pke.ct i,b ←PKE.Enc(pk i,b ,s i,b ) for every b∈{0, 1}, where Set s i,b :=x b (+)(+) j∈[n]\{i} s j is x b (+)(+) j∈[n]\{i} s j s i,b In other words, Set s i,b :=x b (+)(+) j∈[n]\{i} s j What is x b (+)(+) j∈[n]\{i} s j s i,b Also, x b (+)(+) j∈[n]\{i} s j is x b and s for all j∈[n]\{i} j Exclusive OR with x b (+)s1(+)...(+)s i-1 (+)s i+1 (+)...(+)s n・Return ct:=(pke.ct j,b ) j,b Here, Return ct:=(pke.ct j,b ) j,b That is, ct:=(pke.ct j,b ) j,b is returned as output (same below).

[0044] KG(msk, β): KG executes the following: Parse(sk j,b ) j,b ←msk. ・Return fsk:=(β, (sk j,β[[j]] ) j ). Here, (sk j,β[[j]] ) j is the value of the jth position (e.g., the jth bit position) is sk j,β[[j]] represents a string (e.g., a bit string) where

[0045] Dec(fsk, ​​ct): Dec executes the following: Parse(β, (sk i ) i )←fsk and (pke.ct j,b ) j,b ← Execute ct. ・Compute s j ←PKE.Dec(sk j , ct j,β[[j]] ) for every j∈[n]. Here, PKE.Dec(sk j , ct j,β[[j]] ) is sk j is used as the private key, and ct j,β[[j]] This represents decryption according to the public key encryption method PKE. ・Output (+) j∈[n] s j Execute where (+) j∈[n] s j is the sum of s for all j∈[n] j The exclusive OR of s1(+)s2(+)...(+)s n Represents.

[0046] <Unobfuscatable Point Function (UOPF)> Message space MS (input space {0, 1}Lin and the output space {0, 1} Lout ) we define Gen and Extract of the unobfuscable point function UOPF.(Gen, Extract) as follows, where Lin and Lout are positive constants. λ , μ)→(f α,β , aux): Gen is 1 λ and μ as inputs, and the point function f α,β and auxiliary information aux. Here, the point function f α,β : {0, 1} Lin →{0, 1} Lout is the input α∈{0, 1} Lin If β∈{0, 1} Lout otherwise 0 Lout This is a function that outputs 0. Lout represents a sequence 0...0 of Lout zeros. Extract(aux, C~') → μ': Extract takes aux and C~' as input and outputs μ'∈MS∪{⊥}.

[0047] <Injective PRG (Pseudorandom Generator)> Injective PRG g: g is a pseudorandom number generator in the input space {0, 1} Lin and the output space {0, 1} 2Lin That is, g is a projective pseudorandom number generator for α∈{0, 1} Lin The input is a pseudorandom number g(α)∈{0, 1} with projectivity. 2Lin Output.

[0048] <Statistically Binding Equivocal Commitment Scheme> Setup, Commit, EqSetup, and Open in the statistically binding equivocal commitment scheme Com.(Setup, Commit, EqSetup, Open) are defined as follows: Setup(1 λ ) → ck: Setup is 1 λIt takes as input a commitment key ck and outputs a commitment key ck. Commit(ck, m, r) → com: Commit takes as input a commitment key ck, a message m ∈ MS, and a random coin r ∈ RM, and outputs a commitment com. Here, RM represents the random coin space. EqSetup(1 λ )→(ck * , com * , td): EqSetup is 1 λ Takes as input the commitment key ck * ,commitment.com * , and trapdoor td. Open(td, m, com * )→r * : Open is a trapdoor td, a message m∈MS, and a commitment com * takes as input a random coin r * ∈Output RM.

[0049] <Non-interactive zero-knowledge proof (NIZK)> Setup, Prove, and Vrfy of NIZK.(Setup, Prove, Vrfy) are defined as follows: Setup(1 λ ) → crs: Setup is 1 λ It takes as input a common reference string crs, a proposition x∈R, and a witness w∈R, and outputs a proof π. Vrfy(crs, x, π)→1 / 0: Vrfy takes as input a common reference string crs, a proposition x, and a proof π, and outputs 1 if the proof is valid, and 0 otherwise. Note that if the following holds, then (x=(ck, com, m, γ), w=(fsk1, fsk2, r))∈R. As will be explained later, γ=g(α) and fsk θ =FE.KG(fe.msk θ , β θ) for θ∈[2]. Com.Commit(ck, fsk1|fsk2, r)=com∧g(FE.Dec(fsk1,m))≠γ∧g(FE.Dec(fsk2,m))≠γ

[0050] Next, a specific example of the process PWMSIG. (KeyGen, Sign, Vrfy, Extract) performed by each device in this embodiment will be shown. <Processing by the key generating unit 111b of the key generating device 111> The KeyGen(1) by the key generating unit 111b of the key generating device 111 (FIG. 2) λ , μ)→(vk, sk) is shown below. The key generation unit 111b executes, for example, the following: Generate crs←NIZK.Setup(1 λ ). Generate (f α,β , aux)←UOPF.Gen(1 λ , μ). ・Let β=β1|β2 and compute γ←g(α). Here, Let β=β1|β2 means setting β1 and β2 so that β=β1|β2. Here, β1|β2 means bit concatenation (bit joining) of β1 and β2. ・Generate (fe.pk θ , fe.msk θ )←FE.Setup(1 λ ) for θ∈[2]. ・Generate fsk θ ←FE.KG(fe.msk θ , β θ ) for θ∈[2]. ・Generate ck←Com.Setup(1 λ ) and r←$, and generate com←Com.Commit(ck, fsk1|fsk2, r). ・Output vk:=(crs, γ, fe.pk1, fe.pk2, ck, com, aux) and sk:=(vk, fsk1, fsk2, r).

[0051] <Processing by Signature Generation Unit 112b of Signature Generation Device 112> An example of processing Sign(sk, m) → σ by the signature generation unit 112b of the signature generation device 112 (FIG. 2) is shown below. The signature generation unit 112b executes, for example, the following: Parse sk=(vk, fsk1, fsk2, r) and vk=(crs, γ, fe.pk1, fe.pk2, ck, com, aux). For any θ∈[2], FE.Dec(fsk θ If (, m)=α, output ⊥ and terminate the process. Here, ⊥ indicates that the signature cannot be generated correctly. Otherwise, proceed to the next step. ・Compute π←NIZK.Prove(crs, x, w), where x=(ck, com, m, γ) and w=(fsk1, fsk2, r). ・Output σ:=π.

[0052] <Processing by Signature Verification Unit 121b of Signature Verification Device 121> An example of processing Vrfy(vk, m, σ)→0 / 1 by the signature verification unit 121b of the signature verification device 121 (FIG. 3A) is shown below. The signature verification unit 121b executes, for example, the following: Parse vk=(crs, γ, fe.pk1, fe.pk2, ck, com, aux) and σ=π. Output the result of NIZK.Vrfy(crs, x, π)→1 / 0, where x=(ck, com, m, γ).

[0053] <Processing by the Watermark Extraction Unit 131b of the Watermark Extraction Device 131> An example of the Extract(vk, C~', ε) → μ' processing by the watermark extraction unit 131b of the watermark extraction device 131 (FIG. 3B) is shown below. The watermark extraction unit 131b executes, for example, the following: Parse vk=(crs, γ, fe.pk1, fe.pk2, ck, com, aux). Uses the signature generation circuit C~' to set a randomization function P'[[C~']] that performs the following operations: P'[[C~']](x): 1. Compute β' θ[i]←SearchOutput(vk, C~', x, θ, i, ε) for every θ∈[2] and i∈[Lout]. The processing of SearchOutput(vk, C~', x, θ, i, ε) will be described later. 2. Output β'1[1]|...|β'1[Lout]|...|β'2[1]|...|β'2[Lout]. ・Compute μ'← UOPF.Extract(aux, P'[[C~']]).

[0054] <Processing SearchOutput(vk, C~', x, θ, i, ε)> SearchOutput(vk, C~', x, θ, i, ε) performs the following process. 1. Parse vk=(crs, γ, fe.pk1, fe.pk2, ck, com, aux), and set ω:=λ / ε. 2. Execute the following loop process (L2-1-1) to (L2-1-4) for all j∈[ω] (repeated ω times). (L2-1-1) Generate u i,j θ ←{0,1} λ (L2-1-2) Generate fe.ct i,j θ ←FE.Enc(fe.pk θ , (i, x, u i,j θ )). (L2-1-3) Compute σ i,j θ ←C~'(fe.ct i,j θ ), where σ i,j θ ←C~'(fe.ct i,j θ ) uses the signature generation circuit C~' to generate the message fe.ct i,j θ Digital signature σ for i,j θ (L2-1-4) Compute v i,j θ ←NIZK.Vrfy(crs, x, σ i,j θ ) where x=(ck, com, fe.cti,j θ , γ). 3. If v for all j∈[ω] i,j θ If = 0, output 0. Otherwise, output 1.

[0055] [Second embodiment] Next, a second embodiment of the present invention will be described with reference to the drawings. The second embodiment is based on the second method. Note that the same reference numerals will be used to refer to matters that have already been described, and the description will be simplified.

[0056] 4, the signature system 2 of this embodiment includes a key generation device 211, a signature generation device 212, a watermark extraction device 231, a signature verification device 221, and a watermarking device 213. The signature generation device 212 and the watermarking device 213 of this embodiment constitute a watermark embedding device 21. The key generation device 211, the signature generation device 212, the watermark extraction device 231, the signature verification device 221, and the watermarking device 213 are capable of communicating with each other via, for example, a network (not shown) or the like.

[0057] As illustrated in Fig. 5, the key generation device 211 of this embodiment includes an input unit 211a, a key generation unit 211b, a communication unit 111c, a storage unit 111y, and a control unit 111z. The key generation device 211 executes each process under the control of the control unit 111z. The signature generation device 212 of this embodiment includes an input unit 112a, a signature generation unit 212b, a communication unit 112c, and a control unit 112z. The signature generation device 212 executes each process under the control of the control unit 112z. The watermark extraction device 231 includes an input unit 213a, a watermark attachment unit 123b, a communication unit 213c, and a control unit 213z. The watermark extraction device 231 executes each process under the control of the control unit 213z. As illustrated in Fig. 3A, the signature verification device 221 of this embodiment has an input unit 121a, a signature verification unit 221b, a communication unit 121c, and a control unit 121z. The signature verification device 221 executes each process under the control of the control unit 121z. As illustrated in Fig. 3B, the watermark extraction device 231 of this embodiment has an input unit 131a, a watermark extraction unit 231b, a communication unit 131c, and a control unit 131z. The watermark extraction device 231 executes each process under the control of the control unit 131z. In either device, input information and information obtained by each processing unit are stored one by one in a memory (not shown), and are read out as needed and used for other processes.

[0058] <Key Generation Processing> The input unit 211a of the key generation device 111 (FIG. 5) receives λ is entered. 1 λ is sent to the key generation unit 211b. λ The key generation unit 211b receives λ Using this, the verification key vk and the signing key sk are output (KeyGen(1 λ )→(vk, sk)). In this embodiment, the verification key vk and the signature key sk do not have the digital watermark μ embedded in them. The verification key vk and the signature key sk are stored in the storage unit 111y.

[0059] <Signature Generation Process> A message m∈MS to be digitally signed is input to the input unit 212a of the signature generation device 212 (FIG. 5). The message m is sent to the signature generation unit 212b. The signature key sk stored in the memory unit 111y of the key generation device 211 is sent to the communication unit 111c and transmitted to the signature generation device 212. The signature key sk is received by the communication unit 212c of the signature generation device 212 and transmitted to the signature generation unit 212b. The signature generation unit 212b receives the message m and the signature key sk. The signature generation unit 212b applies a signature generation circuit using the signature key sk to the message m, and generates and outputs a digital signature σ for the message m (Sign(sk, m)→σ). The message m and the digital signature σ are sent to the communication unit 112c, which then transmits the message m and the digital signature σ.

[0060] <Watermarking Process> An electronic watermark μ∈MK is input to the input unit 213a of the watermarking device 213 (FIG. 5). The electronic watermark μ is sent to the watermarking unit 213b. The signature key sk stored in the memory unit 111y of the key generation device 211 is sent to the communication unit 111c and transmitted to the watermarking device 213. The signature key sk is received by the communication unit 213c of the watermarking device 213 and sent to the watermarking unit 213b. The watermarking unit 213b receives the electronic watermark μ and the signature key sk. The watermarking unit 213b uses the electronic watermark μ and the signature key sk to generate and output a signature generation circuit C~ in which the electronic watermark μ is embedded (Mark(sk, μ)→C~).

[0061] <Signature Verification Process> A message m and a digital signature σ are input to the input unit 121a of the signature verification device 221 (FIG. 3A). The message m and the digital signature σ are sent to the signature verification unit 221b. The verification key vk stored in the memory unit 111y of the key generation device 211 (FIG. 5) is sent to the communication unit 111c and transmitted to the signature verification device 221. The verification key vk is received by the communication unit 121c of the signature verification device 221 (FIG. 3A) and sent to the signature verification unit 221b. The signature verification unit 221b receives the verification key vk, the message m, and the digital signature σ. The signature verification unit 221b performs signature verification of the digital signature σ using the verification key vk and the message m (Vrfy(vk, m, σ) → 0 / 1) and outputs 0 or 1 representing the verification result.

[0062] <Watermark Extraction Process> The signature generation circuit C~′, its success rate parameter ε, and the input parameter q are input to the input unit 131a of the watermark extraction device 131 (FIG. 3B). The signature generation circuit C~′ and the success rate parameter ε are sent to the watermark extraction unit 231b. The signature generation circuit C~′ is, for example, the signature generation circuit C~. The verification key vk stored in the memory unit 111y of the key generation device 211 (FIG. 5) is sent to the communication unit 111c and transmitted to the watermark extraction device 231. The verification key vk is received by the communication unit 131c of the watermark extraction device 231 (FIG. 3B) and sent to the watermark extraction unit 231b. The watermark extraction unit 231b receives the verification key vk, the signature generation circuit C~′, the success rate parameter ε, and the input parameter q. The watermark extraction unit 231b uses the verification key vk, the signature generation circuit C~', the success rate parameter ε, and the input parameter q to extract and output the digital watermark μ'∈MK∪{⊥} embedded in the signature generation circuit C~' (Extract(vk, C~', ε, q)→μ').

[0063] The signature system 2 satisfies the above-mentioned watermark confidentiality. Preferably, the signature system 2 satisfies the above-mentioned verification correctness, signature unforgeability, and watermark unremovability.

[0064] <Specific Example of Processing by Each Device (Method 2)> Below, a specific example of processing WMSIG. (KeyGen, Sign, Vrfy, Mark, Extract) by each device of signature system 2 is shown. This specific example satisfies not only the watermark confidentiality described above, but also the verification legitimacy, the impossibility of signature forgery, and the impossibility of watermark removal described above. However, this specific example is merely an example and does not limit the present invention. In other words, other processing WMSIG. (KeyGen, Sign, Vrfy, Mark, Extract) may be executed as long as it satisfies watermark confidentiality.

[0065] <Preparation> First, the symbols used in the specific examples of processing by each device are defined. The definitions explained in <Preparation> of the first embodiment are also used below.

[0066] The well-known digital signature method SIG is represented as SIG. (KeyGen, Sign, Vrfy). Note that KeyGen represents the key generation process, Sign represents the signature generation process, and Vrfy represents the signature verification process. As mentioned above, the first method is represented as PWMSIG. (KeyGen, Sign, Vrfy, Extract).

[0067] Next, a specific example of the processing WMSIG. (KeyGen, Sign, Vrfy, Mark, Extract) performed by each device in this embodiment will be shown. <Processing by the key generating unit 211b of the key generating device 211> The KeyGen(1) by the key generating unit 211b of the key generating device 211 (FIG. 5) λ ) → (vk, sk) processing example. The key generation unit 211b executes the following, for example: Generate (sig.vk, sig.sk)←SIG.KeyGen(1 λ ) where sig.vk represents the verification key and sig.sk represents the verification key. Output vk:=sig.vk and sk:=sig.sk.

[0068] <Processing by Signature Generation Unit 212b of Signature Generation Device 212> An example of processing Sign(sk, m) → σ by the signature generation unit 212b of the signature generation device 212 (FIG. 5) is shown below. The signature generation unit 212b executes, for example, the following: Parse sk = sig.sk. Generate sig.σ ← SIG.Sign(sig.sk, 0|m). Here, SIG.Sign(sig.sk, 0|m) indicates that a digital signature for message 0|m is generated in accordance with the digital signature method SIG using sig.sk as the signature key. Output σ = (sig.σ, ⊥, ⊥).

[0069] <Processing by the watermarking unit 213b of the watermarking device 213> An example of processing Mark(sk, μ)→C by the watermarking unit 213b of the watermarking device 213 (FIG. 5) is shown below. The watermarking unit 213b executes the following, for example: Parse sk=sig.sk. Generate (pwm.vk, pwm.sk)←PWMSIG.KeyGen(1 λ , μ). ・Generate sig.σ←SIG.Sign(sig.sk, 1|pwm.vk). Here, SIG.Sign(sig.sk, 1|pwm.vk) represents generating an electronic signature for message 1|pwm.vk using sig.sk as the signing key in accordance with the digital signature method SIG. ・Output C~[[sig.σ, pwm.vk, pwm.sk]]. Here, C~[[sig.σ, pwm.vk, pwm.sk]] represents the signature generation circuit C~ specified by sig.σ, pwm.vk, and pwm.sk (same below). C~[[sig.σ, pwm.vk, pwm.sk]] is a circuit that performs probabilistic calculations that perform the following operations: 1. Take m as input. 2. Generate pwm.σ←PWMSIG.Sign(pwm.sk, m). 3. Output σ=(sig.σ, pwm.vk, pwm.σ).

[0070] <Processing by Signature Verification Unit 221b of Signature Verification Device 221> An example of processing Vrfy(vk, m, σ) → 0 / 1 by the signature verification unit 221b of the watermarking device 213 (FIG. 3A) is shown below. The signature verification unit 221b executes, for example, the following: Parse vk=sig.vk and σ=(sig.σ, pwm.vk, pwm.σ). If pwm.vk=⊥, output SIG.Vrfy(sig.vk, 0|m, sig.σ) and end processing. Here, SIG.Vrfy(sig.vk, 0|m, sig.σ) indicates that the digital signature sig.σ for the message 0|m is verified using the verification key sig.vk in accordance with the digital signature method SIG, and the verification result 1 / 0 is output (the same applies below). 0 indicates that the verification of the digital signature sig.σ has failed, and 1 indicates that the verification of the digital signature sig.σ has passed. If pwm.vk=⊥ is not true, proceed to the next step. If SIG.Vrfy(sig.vk, 1|pwm.vk, sig.σ)=1, output PWMSIG.Vrfy(pwm.vk, m, pwm.σ). Otherwise, output 0.

[0071] <Processing by Signature Verification Unit 221b of Signature Verification Device 221> An example of processing Extract(vk, C~', ε, q) → μ' by the watermark extraction unit 231b of the watermark extraction device 231 (FIG. 3B) is shown below. The watermark extraction unit 231b executes, for example, the following: Parse vk=sig.vk. Set δ=ε / 2q. Compute List←Listup(sig.vk, C~', δ). The processing of Listup(sig.vk, C~', δ) will be described later. If List is empty, output ⊥. Otherwise, proceed to the next step. Set ρ=ε / 6q. Compute η i ←Estimate(sig.vk, C~', pwm.vk i , ρ) for every pwm.vk i ∈List. Estimate(sig.vk, C~', pwm.vk i , ρ) will be described later. i* =max η iThe index i * where max η i is η i The maximum value of the circuit C~ pwm Set [[C~']]. 1. Take message m as input. 2. Compute (sig.σ, pwm.vk, pwm.σ)←C~'(m). Here, (sig.σ, pwm.vk, pwm.σ)←C~'(m) represents applying the signature generation circuit C~' to message m to generate (sig.σ, pwm.vk, pwm.σ) (same below). 3. Output pwm.σ. ・Output μ i * ←PWMSIG.Extract(pwm.vk i* , C~ pwm [[C~']], ρ).

[0072] <Listup(sig.vk, C~', δ) processing> Listup(sig.vk, C~', δ) takes sig.vk, C~', δ as input and executes the following processing. 1. Initialize the elements of the list List to empty. 2. Repeat the following loop processing (L2-2-1) and (L2-2-2) λ / δ times. (L2-2-1) Randomly select a message m and (sig.σ, pwm.vk i , pwm.σ)←C~'(m). (L2-2-2) If SIG.Vrfy(sig.vk, 1|pwm.vk i , sig.σ)=1 and PWMSIG.Vrfy(pwm.vk i , m, pwm.σ)=1 and pwm.vk i If it does not appear in the loop processing of (L2-2-1) and (L2-2-2) so far, pwm.vk i Add to the elements of the list List. 2. Output the list List.

[0073] <Estimate(sig.vk, C~', pwm.vk i , ρ) Processing > Estimate(sig.vk, C~', pwm.vk i, ρ) is sig.vk, C~', pwm.vk i , ρ is taken as input and the following process is executed. 1. The following loop process (L1-3-1) and (L1-3-2) is executed for all j∈[τ] (repeated τ times). Here, τ=λ / ρ 2 (L1-3-1) Randomly select a message m and (sig.σ, pwm.vk i , pwm.σ)←C~'(m) is executed. (L1-3-2) If pwm.vk=pwm.vk i And PWMSIG.Vrfy(pwm.vk i , m, pwm.σ)=1, then v j = 1, otherwise v j Set =0. 2. Output (Σ j∈[τ] v j ) / τ.

[0074] [Hardware Configuration] The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), a CPU (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0075] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0076] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0077] For example, the device in each embodiment is configured by a general-purpose or dedicated computer having a processor (hardware processor) such as a central processing unit (CPU) and memories such as random-access memory (RAM) and read-only memory (ROM) executing a predetermined program. That is, the device in each embodiment has, for example, a processing circuit configured to implement each unit. This computer may have one processor and memory, or multiple processors and memories. This program may be installed on the computer or may be pre-recorded in a ROM or the like. Furthermore, some or all of the processing units may be configured using electronic circuits that independently realize processing functions, rather than electronic circuits that realize functional configurations by loading programs, such as a CPU. Furthermore, the electronic circuits constituting one device may include multiple CPUs.

[0078] FIG. 6 is a block diagram illustrating the hardware configuration of each device in each embodiment. As illustrated in FIG. 6, the device in this example includes a CPU (Central Processing Unit) 10a, an input unit 10b, an output unit 10c, a RAM (Random Access Memory) 10d, a ROM (Read Only Memory) 10e, an auxiliary storage device 10f, a communication unit 10h, and a bus 10g. The CPU 10a in this example includes a control unit 10aa, a calculation unit 10ab, and a register 10ac, and executes various calculation processes according to various programs loaded into the register 10ac. The input unit 10b is an input terminal, keyboard, mouse, touch panel, etc., through which data is input. The output unit 10c is an output terminal, display, etc., through which data is output. The communication unit 10h is a LAN card, etc., controlled by the CPU 10a that has loaded a predetermined program. The RAM 10d is a static random access memory (SRAM), dynamic random access memory (DRAM), or the like, and has a program area 10da where predetermined programs are stored and a data area 10db where various data are stored. The auxiliary storage device 10f is a hard disk, magneto-optical disc (MO), semiconductor memory, or the like, and has a program area 10fa where predetermined programs are stored and a data area 10fb where various data are stored. The bus 10g connects the CPU 10a, input unit 10b, output unit 10c, RAM 10d, ROM 10e, communication unit 10h, and auxiliary storage device 10f so that information can be exchanged. The CPU 10a writes the program stored in the program area 10fa of the auxiliary storage device 10f to the program area 10da of RAM 10d in accordance with the loaded OS (Operating System) program. Similarly, the CPU 10a writes various data stored in the data area 10fb of the auxiliary storage device 10f to the data area 10db of the RAM 10d. The addresses in the RAM 10d where the programs and data are written are then stored in the register 10ac of the CPU 10a.The control unit 10aa of the CPU 10a sequentially reads out these addresses stored in the register 10ac, reads out programs and data from the areas on the RAM 10d indicated by the read addresses, causes the calculation unit 10ab to sequentially execute the calculations indicated by the programs, and stores the calculation results in the register 10ac. With this configuration, the functional configuration of each device is realized.

[0079] The program describing this processing can be recorded on a computer-readable recording medium. Examples of computer-readable recording media are non-transitory recording media. Examples of such recording media include magnetic recording devices, optical disks, magneto-optical recording media, and semiconductor memories.

[0080] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0081] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0082] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0083] [Other Modifications] The present invention is not limited to the above-described embodiment. For example, in the above-described process, the initial input 1 λ Alternatively, other information specifying the security parameter λ may be input instead of inputting the initial input 1. If the security parameter λ is predetermined, the initial input 1 may be input. λ The input of information specifying the security parameter λ may be omitted.

[0084] Furthermore, the various processes described above may not only be executed in chronological order as described, but may also be executed in parallel or individually depending on the processing capacity of the device executing the processes or as necessary. Needless to say, other modifications are possible within the scope of the present invention.

[0085] The digital watermark embedding signature scheme of this embodiment has the property that a digital watermark can be embedded in the signature generation circuit, and the embedded digital watermark information cannot be discovered simply by observing the digital signature generated using the signature key (digital watermark confidentiality). A digital watermark embedding signature scheme with such digital watermark confidentiality has not been known up to now.

[0086] Therefore, conventional digital watermark embedding signature methods have been unable to embed sensitive information such as personal information as a digital watermark into a signature generation circuit, because if a digital signature generated using the signature generation circuit is distributed to a third party, the embedded sensitive information will be leaked to the third party.

[0087] In contrast, the digital watermark embedding signature scheme of this embodiment maintains the confidentiality of the digital watermark. Therefore, in this embodiment, sensitive information such as personal information can be embedded as a digital watermark in the signature generation circuit, and even if a digital signature generated using this signature generation circuit is distributed to a third party, the embedded sensitive information can be prevented from leaking to the third party. As a result, this embodiment can be used, for example, in applications where a signature generation circuit in which sensitive information such as personal information is embedded as a digital watermark, or a signature key in which the digital watermark is embedded, is loaned to a third party.

[0088] 1, 2 Signature system 11, 21 Watermark embedding device 111, 211 Key generation device 112, 212 Signature generation device 213 Watermarking device 121, 221 Signature verification device 131, 231 Watermark extraction device

Claims

1. A watermark embedding device comprising: a watermark embedding unit that receives a digital watermark and outputs embedding information for identifying a signature generation circuit in which the digital watermark is embedded; and a signature generation unit that receives a message and outputs a digital signature obtained by applying the signature generation circuit to the message, wherein an interactive device that performs an operation of providing an arbitrary message to a trial device that can apply the signature generation circuit and receiving the digital signature obtained by applying the signature generation circuit to the message on the trial device has a probability that indicates to what extent the contents of the digital watermark can be identified based on the operation, which is below a standard.

2. A watermark embedding device according to claim 1, wherein the embedding information is a verification key and a signature key in which the digital watermark is embedded, and the signature generation circuit obtains the digital signature using the signature key, and the operations include providing a first digital watermark candidate and a second digital watermark candidate to the trial device, receiving from the trial device the verification key in which the digital watermark selected from the first digital watermark candidate and the second digital watermark candidate is embedded, providing any one of the messages to the trial device, and receiving the digital signature obtained by applying the signature generation circuit using the signature key in which the digital watermark is embedded to the message.

3. A watermark embedding device according to claim 1, wherein the embedding information is the signature generation circuit in which the digital watermark is embedded, and the signature generation circuit obtains the digital signature using a signature key, and the operations include providing the signature key, a verification key corresponding to the signature key, and a first digital watermark candidate and a second digital watermark candidate to the trial device, providing any of the messages to the trial device, and receiving the digital signature obtained by applying the signature generation circuit in which the digital watermark selected from the first digital watermark candidate and the second digital watermark candidate is embedded to the message.

4. A watermark embedding device according to claim 2 or 3, wherein the difference between the probability that, when the digital watermark is the first digital watermark candidate, the interactive device will determine that the digital watermark is the second digital watermark candidate based on the operation, and the probability that, when the digital watermark is the second digital watermark candidate, the interactive device will determine that the digital watermark is the second digital watermark candidate based on the operation, is less than a standard, or the difference between the probability that, when the digital watermark is the first digital watermark candidate, the interactive device will determine that the digital watermark is the first digital watermark candidate based on the operation, and the probability that, when the digital watermark is the second digital watermark candidate, the interactive device will determine that the digital watermark is the first digital watermark candidate based on the operation, is less than a standard.

5. A program for causing a computer to function as the watermark embedding device of any one of claims 1 to 3.

Images