Certification device, method, program, and vp system

Abstract

A certification device according to one aspect of the disclosed technology comprises: a signature disturbance unit 21 that performs disturbance on a signature σ, which is included in a certificate that has been received from a VC issuance device 1, to generate a post-disturbance signature σ'; an identification information disturbance unit 22 that performs disturbance on unique identification information using a value r to generate post-disturbance identification information; and a certification information generation unit 23 that uses the post-disturbance signature σ' and the post-disturbance identification information to generate certification information which is for certifying that a secret key sk corresponding to the unique identification information is known and that attribute information to be disclosed is written in the certificate.

Description

Certification devices, methods, programs, and VP systems

[0001] The disclosure technology relates to verifiable presentation technology.

[0002] A new type of attribute certificate, the Verifiable Credential (VC), is being considered by the W3C. A key function of VC is selective disclosure. Selective disclosure allows the Holder to choose which attributes to present to the Verifier and, using Verifiable Presentation, convert the VC into a presentable state, presenting only the selected attributes.

[0003] In this case, it is important that the same holder is identified among the Verifiers, and that the disclosed attributes are not linked, thus satisfying the property of unlinkability. The property of unlinkability is achieved by randomizing the signature presented from the Holder to the Verifier (see, for example, Non-Patent Document 1).

[0004] Furthermore, it is crucial to take measures against VC impersonation, where a VC steals another person's VC to create a VP. This can be achieved through identity verification (see, for example, Non-Patent Document 2).

[0005] Andrea Flamini, Giada Sciarretta, Mario Scuro, Amir Sharif, Alessandro Tomasi, Silvio Ranise, "On cryptographic mechanisms for the selective disclosure of verifiable credentials", Journal of Information Security and Applications, Volume 83, 2024, 103789, ISSN 2214-2126, https: / / doi.org / 10.1016 / j.jisa.2024.103789.CP Schnorr, "Efficient signature generation by smart cards", Journal of Cryptology, Volume 4, Issue 3, Pages 161 - 174, https: / / doi.org / 10.1007 / BF00196725.

[0006] However, it is difficult to implement unlinkability and anti-spoofing measures simultaneously. A simple anti-spoofing measure is to present the DID to the Verifier and prove that it knows the secret key, but the Verifier can then learn the Holder's DID, thus failing to satisfy the unlinkability property.

[0007] The disclosed technology aims to provide a certification device, method, program, and VP system that achieves both anti-spoofing and unlinkability characteristics.

[0008] A certification device, which is one aspect of the disclosure technology, comprises: a signature disruption unit that disrupts the signature σ contained in a certificate received from a VC issuing device and generates a disrupted signature σ'; an identification information disruption unit that disrupts unique identification information using a value r and generates disrupted identification information; and a certification information generation unit that uses the disrupted signature σ' and the disrupted identification information to generate certification information which is information for proving that the private key sk corresponding to the unique identification information is known and that the attribute information to be disclosed is described in the certificate.

[0009] According to the disclosed technology, both anti-spoofing measures and unlinkability features can be achieved.

[0010] Figure 1 shows an example of the functional configuration of a certification device. Figure 2 shows an example of the processing procedure for a certification method. Figure 3 shows an example of the functional configuration of a computer.

[0011] Embodiments of the disclosed technology will be described below with reference to the drawings. Note that components having the same function are numbered identically in the drawings, and redundant explanations are omitted.

[0012] The VC system comprises a VC issuing device 1, a certification device 2, and a verification device 3. The VC system method is implemented, for example, by having each component of the VC system perform the processing described in steps S21 to S3. In the VC system method, the processing in step S1 may be performed further.

[0013] As shown in Figure 1, the certification device 2 includes, for example, a signature disruption unit 21, an identification information disruption unit 22, and a certification information generation unit 23. The certification method is realized, for example, by each component of the certification device performing the processing described in steps S21 to S23.

[0014] <VC Issuing Device 1> The VC issuing device 1 has unique identification information for identifying the certification device 2 and attribute information m1, ..., m of the certification device 2. L A VC is issued for (step S1). L is the number of attribute information items that the certification device 2 possesses.

[0015] A VC is simply called a certificate. A certificate contains attribute information m1, ..., m L It includes a signature σ to guarantee its legitimacy. The signature σ can be generated, for example, by an existing signature scheme such as CL (Camenisch-Lysyanskaya) signature, PS (Pointcheval-Sanders) signature, or BBS(+) (Boneh-Boyen-Shacham Plus) signature.

[0016] The certificate is sent to the certification device 2.

[0017] <Certification device 2> Certification device 2 includes a signature disruption unit 21, an identification information disruption unit 22, and a certification information generation unit 23.

[0018] <<Signature Disruption Unit 21>> The signature disruption unit 21 receives the signature σ contained in the certificate received from the VC issuing device 1.

[0019] The signature disruption unit 21 disrupts the signature σ and generates a disrupted signature σ' (step S21).

[0020] The disrupted signature σ' is output to the certification information generation unit 23.

[0021] The signature disruption unit 21 can generate a disrupted signature σ' by an existing method such as the method described in Non-Patent Literature 1.

[0022] <Identification Information Disruption Unit 22> Unique identification information and the value r are input to the identification information disruption unit 22.

[0023] The identification information disruption unit 22 disrupts the unique identification information using the value r and generates disrupted identification information (step S22).

[0024] The disrupted identification information is output to the certification information generation unit 23.

[0025] Unique identification information is information used to identify the proof device 2. An example of unique identification information is a DID (Decentralized IDentifier). A DID is an identifier in a system that uses decentralized technologies such as blockchain to prove and manage identity (identity information) without the need for a centralized administrator.

[0026] The identification information disruption unit 22 generates the disrupted identification information DID' using, for example, a function f that takes DID and r as arguments.

[0027] DID'=f(DID,r) The function f is any function that includes hash value calculation, addition, multiplication, etc. An example of the function f is f=(DID+r). In this specific example of function f, the numerical values ​​DID and r are added over a finite field.

[0028] <Certification Information Generation Unit 23> The certification information generation unit 23 receives the distorted signature σ' and the distorted identification information as input.

[0029] The certification information generation unit 23 uses the disrupted signature σ' and the disrupted identification information to generate certification information, which is information that proves that it knows the private key sk corresponding to the unique identification information and that the attribute information to be disclosed is described in the certificate (step S23).

[0030] The certification information is transmitted to the verification device 3. The certificate includes the distorted identification information, the distorted signature σ' instead of the signature σ, and attribute information m1,…,m L The attribute information to be disclosed to the verification device i The following information is also transmitted to the verification device 3: attribute information m i This is attribute information m1, ..., m L It is at least one attribute piece of information within it.

[0031] The proof information may be proof information of a zero-knowledge proof, generated by zero-knowledge proofs such as Groth16, PLONK, Ligero, or Bulletproofs. When generating proof information using zero-knowledge proofs, the proof information generation unit 23 may represent what is to be proven with a circuit and generate the proof information of a zero-knowledge proof from that circuit.

[0032] The following are examples of generating proof information, namely <Example 1> and <Example 2>.

[0033] <Example 1> The certification information generation unit 23 may separately generate certification information that proves it knows the private key sk corresponding to the unique identification information, and certification information that proves the attribute information to be disclosed is contained in the certificate.

[0034] In this case, if the identification information disruption unit 22 generates disrupted identification information by adding DID and r, the proof information generation unit 23 may include information to prove that it knows the value r in the proof information that proves it knows the secret key sk corresponding to the unique identification information.

[0035] <Example 2> The proof information generation unit 23 may generate one piece of proof information for proving both that it knows the secret key sk corresponding to the unique identification information and that the attribute information to be disclosed is described in the certificate.

[0036] <Verification device 3> The verification device 3 includes a verification unit 31.

[0037] <<Verification unit 31>> The verification unit 31 receives the scrambled identification information received from the proof device 2, the certificate including the scrambled signature σ' instead of the signature σ, and the attribute information m1,..., m L among which the attribute information m i to be disclosed to the verification device is input.

[0038] The verification unit 31 uses these pieces of information to verify that the proof device 2 knows the secret key sk corresponding to the unique identification information and that the attribute information m i is described in the certificate (step S31).

[0039] Note that the verification unit 31 may further verify that the unique identification information is described in the certificate using these pieces of information.

[0040] As in <Example 1>, which is an example of the generation of proof information, when the proof information for proving that the secret key sk corresponding to the unique identification information is known (hereinafter referred to as the first proof information) and the proof information for proving that the attribute information to be disclosed is described in the certificate (hereinafter referred to as the second proof information) are generated separately, the verification unit 31 may separately verify that the proof device 2 using the first proof information knows the secret key sk corresponding to the unique identification information and that the proof device 2 using the second proof information has the attribute information m i described in the certificate.

[0041] Note that when the identification information scrambling unit 22 obtains the scrambled identification information DID' by adding DID and r, and the proof information generation unit 23 separately generates the first proof information and the second proof information, and includes information for proving that the value r is known in the first proof information, proof and verification can be performed at high speed. In this case, when creating the second proof information, by using a zero-knowledge proof without a circuit representation, it is possible to perform proof and verification faster than a zero-knowledge proof with a circuit representation.

[0042] As in <Example 2> which is an example of generating proof information, when one proof information for proving both that the proof information generation unit 23 knows the secret key sk corresponding to the unique identification information and that the attribute information to be disclosed is described in the certificate is generated, the verification unit 31 uses this one proof information to verify that the secret key sk corresponding to the unique identification information is known and that the attribute information m i is described in the certificate.

[0043] In this way, by performing authentication of the person after scrambling the unique identification information (proof and verification of knowing the secret key sk corresponding to the unique identification information) and proof and verification of selective disclosure after scrambling the signature σ (proof and verification that the attribute information m i is described in the certificate), it is possible to realize both countermeasures against impersonation and unlinkability characteristics.

[0044] As proof and verification of selective disclosure after scrambling the signature σ (proof and verification that the attribute information m i is described in the certificate), an existing method such as the method described in Non-Patent Document 1 can be used. Therefore, it is possible to realize the above-described embodiment by improving the conventional protocol without newly constructing a protocol.

[0045] [Modification Example] The specific configuration of the embodiment of the disclosed technology is not limited to the configuration described so far. The specific configuration of the embodiment of the disclosed technology can be appropriately changed in design and the like without departing from the spirit of the embodiment of the disclosed technology.

[0046] The various processes described in the embodiments of the disclosed technology may be performed not only in chronological order according to the order described, but also in parallel or individually as required by the processing capacity of the device performing the processes.

[0047] For example, data exchange between components of the VC system may occur directly, or it may occur via a storage unit not shown in the diagram.

[0048] Furthermore, the present invention may also include a device (terminal) for using the apparatus, system, or method of the present invention via a network (telecommunication line). The "device (terminal) for use" may be equipped with functions necessary to obtain the effects of implementing the apparatus, system, or method of the present invention (for example, control functions, decoding functions, restoration functions, input / output functions, etc.).

[0049] It goes without saying that the invention may be modified as appropriate without departing from its spirit.

[0050] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually described as being incorporated by reference.

[0051] [Programs, Recording Media] The functions realized by the components described herein may be implemented in a circuitry or processing circuitry, including a general-purpose processor, an application-specific processor, an integrated circuit, an ASIC (Application Specific Integrated Circuit), a CPU (a Central Processing Unit), conventional circuits, and / or a combination thereof, programmed to realize the functions described herein. A processor includes transistors and other circuits and is considered a circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in memory.

[0052] In this specification, circuitry, unit, and means are hardware programmed to perform or execute the functions described herein. Such hardware may be any hardware disclosed herein, or any hardware known to be programmed to perform or execute the functions described herein.

[0053] If the hardware is a processor that is considered to be a type of circuitry, then the circuitry, means, or unit is a combination of hardware and software used to constitute the hardware and / or processor.

[0054] The various processes described above can be carried out by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 3, and then causing the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc. to operate.

[0055] The program describing this process can be recorded on a computer-readable recording medium. Any computer-readable recording medium can be used, such as a magnetic recording device, optical disc, magneto-optical recording medium, or semiconductor memory.

[0056] A program describing this process may be included in a computer program product.

[0057] Furthermore, this program may be distributed, for example, by selling, transferring, or lending portable recording media such as DVDs or CD-ROMs on which the program is recorded. Alternatively, the program may be stored in the storage device of a server computer and distributed by transferring the program from the server computer to other computers via a network.

[0058] A computer executing such a program may, for example, first store the program recorded on a portable storage medium or a program transferred from a server computer in its own storage device. Then, when processing is to be executed, the computer reads the program stored on its own storage medium and executes the processing according to the read program. Alternatively, the computer may directly read the program from the portable storage medium and execute the processing according to that program, or it may sequentially execute the processing according to the received program each time a program is transferred to it from a server computer. Furthermore, the processing may be executed using a so-called ASP (Application Service Provider) type service, where the processing function is realized only by issuing execution instructions and obtaining results, without transferring the program from the server computer to this computer.In addition, the processing may be executed using a so-called SaaS (Software as a Service) type service, where a part of the server computer is made available to the user along with the program. Furthermore, the term "program" in this form includes information used for processing by an electronic computer that is equivalent to a program (data, etc., that is not a direct instruction to the computer but has the property of defining the processing of the computer).

[0059] Furthermore, in this configuration, the device is configured by executing a predetermined program on a computer, but at least a part of these processes may be implemented in hardware.

Claims

1. A certification device comprising: a signature disruption unit that disrupts the signature σ contained in a certificate received from a VC issuing device and generates a disrupted signature σ'; an identification information disruption unit that disrupts unique identification information using a value r and generates disrupted identification information; and a certification information generation unit that uses the disrupted signature σ' and the disrupted identification information to generate certification information which is information for proving that the private key sk corresponding to the unique identification information is known and that the attribute information to be disclosed is described in the certificate.

2. A proof device according to claim 1, wherein the proof information includes information for proving that the value r is known.

3. A proof method comprising: a signature disruption step in which a signature disruption unit disrupts a signature σ contained in a certificate received from a VC issuing device and generates a disrupted signature σ'; an identification information disruption step in which an identification information disruption unit disrupts a unique identification information using a value r and generates a disrupted identification information; and a proof information generation step in which a proof information generation unit uses the disrupted signature σ' and the disrupted identification information to generate proof information which is information for proving that the private key sk corresponding to the unique identification information is known and that the attribute information to be disclosed is described in the certificate.

4. A VP system including a certification device and a verification device, wherein the certification device includes (1) a signature disruption unit that disrupts the signature σ contained in a certificate received from a VC issuing device and generates a disrupted signature σ', (2) an identification information disruption unit that disrupts unique identification information using a value r and generates disrupted identification information, and (3) a certification information generation unit that uses the disrupted signature σ' and the disrupted identification information to generate certification information which is information for proving that the private key sk corresponding to the unique identification information is known and that the attribute information to be disclosed is described in the certificate, and the verification device includes the disrupted identification information, a certificate containing the disrupted signature σ' in place of the signature σ, and attribute information m1,...,m received from the certification device L The attribute information to be disclosed to the verification device i Using this, the certification device knows the secret key sk corresponding to the unique identification information, and attribute information m i A VP system including a verification unit that verifies that the information is as stated in the aforementioned certificate.

5. A program for causing a computer to perform each step of the proof method of claim 3.

Images