Image Processing Apparatus, Electronic Signature Generation System, Electronic Signature Key Generation Method, Image Processing Method, and Program

• US 20100281267A1
• Filed: 04/23/2010
• Published: 11/04/2010
• Est. Priority Date: 04/30/2009
• Status: Active Grant

• Current Assignee: Sony Corporation (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.)
• Inventors: Sakumoto, Koichi
• Granted Patent: US 8,452,974 B2
• Time in Patent Office: Days
• US Class Current: 713/180
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

An image processing apparatus includes a first partial information providing unit that provides first partial information to another device holding a first signing key KS corresponding to a first verification key KV, the first partial information constituting a part of a second verification key KV′ (KV′≠KV) that is capable of verifying an electronic signature σ generated using the first signing key KS and being unable to identify the second verification key KV′; a second partial information acquisition unit that acquires second partial information which is generated by the another device using the first partial information and the first signing key KS, and which is unable to identify the first signing key KS and used for generating the remaining part of the second verification key KV′; and a second verification key generation unit that generates the second verification key KV′ based on the first and second partial information.

Claims

1. An image processing apparatus comprising:

a first partial information providing unit that provides first partial information to another device holding a first signing key KS corresponding to a first verification key KV, the first partial information constituting a part of a second verification key KV′

(KV′

≠

KV) that is capable of verifying an electronic signature σ

generated using the first signing key KS and being unable to identify the second verification key KV′

;

a second partial information acquisition unit that acquires second partial information which is generated by the other device using the first partial information and the first signing key KS, and which is unable to identify the first signing key KS and is used for generating the remaining part of the second verification key KV′

excluding the first partial information; and

a second verification key generation unit that generates the second verification key KV′

based on the first partial information and the second partial information.

2. The image processing apparatus according to claim 1, wherein:

the first signing key KS is configured to include N1 (N1≧

2) parameters; and

the second partial information acquisition unit acquires the second partial information which is generated using parameters generated using the first partial information and the N1 parameters included in the first signing key KS, and which is unable to identify the individual parameters included in the first signing key KS.

3. The image processing apparatus according to claim 2, wherein:

the second verification key KV′

is configured to include N2 (N2≧

2) parameters; and

the first partial information providing unit provides M2 (M2<

N2) parameters included in the second verification key KV′

as the first partial information.

4. The image processing apparatus according to claim 2, wherein:

the second verification key KV′

is configured to include N2 (N2≧

2) parameters; and

the first partial information providing unit provides hash values of M2 (M2<

N2) parameters included in the second verification key KV′ and

(N2−

M2) parameters excluding the M2 parameters as the first partial information.

5. The image processing apparatus according to claim 1, wherein:

if predetermined arithmetic processing based on random numbers generated by the other device has been subjected to the first partial information when the partial information is generated, the second partial information acquisition unit acquires the random numbers generated by the other device together with the second partial information; and

the second verification key generation unit generates the second verification key KV′

based on the first partial information, the second partial information, and the random number.

17. The image processing apparatus according to claim 1, wherein:

the other device is a certificate authority server;

the image processing apparatus further comprises an ID notification unit that notifies the other device of ID information for identifying itself; and

the image processing apparatus generates an electronic document m_ID that includes the ID information generated by the other device having receiving a notification from the ID notification unit and a second verification key KV′

that accepts an electronic signature σ

_ID generated using the first signing key KS with respect to the electronic document m_ID using the first partial information providing unit, the second partial information acquisition unit, and the second verification key generation unit, and uses the electronic document m_ID and the electronic signature σ

_ID as an electronic certificate for certifying validity of the second verification key KV′

.

18. The image processing apparatus according to claim 1, wherein:

the first device is a proxy terminal used by a proxy that substitutes for an electronic signature of a client;

the other device is a client terminal used by the client; and

the image processing apparatus generates an electronic document m_w that includes at least a content of a signing power that the client transfers to the proxy and a second verification key KV′

that accepts an electronic signature σ

_w generated using the first signing key KS with respect to the electronic document m_w using the first partial information providing unit, the second partial information acquisition unit, and the second verification key generation unit, and uses the electronic document m_w and the electronic signature σ

_w as a certificate for certifying that the second verification key KV′

is recognized by the client.

6. An image processing apparatus comprising:

a storage unit that stores a first verification key KV and a first signing key KS which are in pair;

a first partial information acquisition unit that acquires first partial information which constitutes a part of a second verification key KV′

(KV′

≠

KV) that is capable of verifying an electronic signature σ

generated using the first signing key KS, and which is unable to identify the second verification key KV′

;

a second partial information generation unit that generates second partial information using the first partial information acquired by the first partial information acquisition unit and the first signing key KS, the second partial information being unable to identify the first verification key KV and being used for generating the remaining part of the second verification key KV′

excluding the first partial information; and

a second partial information providing unit that provides the second partial information generated by the second partial information generation unit to another device that provided the first partial information.

7. The image processing apparatus according to claim 6, wherein:

the first signing key KS is configured to include N1 (N1≧

2) parameters; and

the second partial information generation unit generates the second partial information using parameters generated using the first partial information and the N1 parameters included in the first signing key KS, the second partial information being unable to identify the individual parameters included in the first signing key KS.

8. The image processing apparatus according to claim 7, wherein:

the second verification key KV′

is configured to include N2 (N2≧

2) parameters; and

the first partial information acquisition unit acquires M2 (M2<

N2) parameters included in the second verification key KV′

as the first partial information.

9. The image processing apparatus according to claim 7, wherein:

the second verification key KV′

is configured to include N2 (N2≧

2) parameters; and

the first partial information acquisition unit provides hash values of M2 (M2<

N2) parameters included in the second verification key KV′ and

(N2−

M2) parameters excluding the M2 parameters as the first partial information.

10. The image processing apparatus according to claim 6, further comprising:

a random number generator that generates random numbers; and

an arithmetic processing unit that performs predetermined arithmetic processing on the first partial information using the random numbers generated by the random number generator, wherein;

the second partial information generation unit generates the second partial information using the first partial information having subjected to the predetermined arithmetic processing by the arithmetic processing unit and the first signing key KS; and

the second partial information providing unit provides the random numbers used by the arithmetic processing unit together with the second partial information to the other device.

11. An electronic signature generation system comprising:

a first image processing apparatus;

a second image processing apparatus, wherein;

the first image processing apparatus comprises;

a storage unit that stores a first verification key KV and a first signing key KS which are in pair;

a first partial information acquisition unit that acquires, from the second image processing apparatus, first partial information which constitutes a part of a second verification key KV′

(KV′

≠

KV) that is capable of verifying an electronic signature σ

generated using the first signing key KS, and which is unable to identify the second verification key KV′

;

a second partial information generation unit that generates second partial information using the first partial information acquired by the first partial information acquisition unit and the first signing key KS, the second partial information being unable to identify the first verification key KV and being used for generating the remaining part of the second verification key KV′

excluding the first partial information; and

a second partial information providing unit that provides the second partial information generated by the second partial information generation unit to the second image processing apparatus that provided the first partial information; and

,

the second image processing apparatus comprises;

a first partial information providing unit that provides the first partial information to the first image processing apparatus;

a second partial information acquisition unit that acquires the second partial information; and

a second verification key generation unit that generates the second verification key KV′

based on the first partial information and the second partial information.

12. An electronic signature key generation method comprising:

a first partial information providing step of providing first partial information to another device holding a first signing key KS corresponding to a first verification key KV, the first partial information constituting a part of a second verification key KV′

(KV′

≠

KV) that is capable of verifying an electronic signature σ

generated using the first signing key KS and being unable to identify the second verification key KV′

;

a second partial information acquisition step of acquiring second partial information which is generated by the other device using the first partial information and the first signing key KS, and which is unable to identify the first signing key KS and is used for generating the remaining part of the second verification key KV′

excluding the first partial information; and

a second verification key generation step of generating the second verification key KV′

based on the first partial information and the second partial information.

13. An image processing method comprising:

a first partial information acquisition step of acquiring first partial information which constitutes a part of a second verification key KV′

(KV′

≠

KV) that is capable of verifying an electronic signature σ

generated using a first signing key KS that pairs with a first verification key KV, and which is unable to identify the second verification key KV′

;

a second partial information generation step of generating second partial information using the first partial information acquired in the first partial information acquisition step and the first signing key KS, the second partial information being unable to identify the first verification key KV and being used for generating the remaining part of the second verification key KV′

excluding the first partial information; and

a second partial information providing step of providing the second partial information generated in the second partial information generation step to another device that provided the first partial information.

14. An electronic signature key generation method comprising:

a first partial information acquisition step where a second image processing apparatus provides first partial information which constitutes a part of a second verification key KV′

(KV′

≠

KV) that is capable of verifying an electronic signature σ

generated using a first signing key KS that pairs with a first verification key KV, and which is unable to identify the second verification key KV′

;

a first partial information acquisition step where a first image processing apparatus acquires the first partial information from the second image processing apparatus;

a second partial information generation step where the first image processing apparatus generates second partial information using the first partial information acquired in the first partial information acquisition step and the first signing key KS, the second partial information being unable to identify the first verification key KV and being used for generating the remaining part of the second verification key KV′

excluding the first partial information;

a second partial information providing step where the first image processing apparatus provides the second partial information generated in the second partial information generation step to the second image processing apparatus that provided the first partial information;

a second partial information acquisition step where the second image processing apparatus acquires the second partial information; and

a second verification key generation step where the second image processing apparatus generates the second verification key KV′

based on the first partial information and the second partial information.

15. A program for causing a computer to implement:

a first partial information providing function of providing first partial information to another device holding a first signing key KS corresponding to a first verification key KV, the first partial information constituting a part of a second verification key KV′

(KV′

≠

KV) that is capable of verifying an electronic signature σ

generated using the first signing key KS and being unable to identify the second verification key KV′

;

a second partial information acquisition function of acquiring second partial information which is generated by the other device using the first partial information and the first signing key KS, and which is unable to identify the first signing key KS and is used for generating the remaining part of the second verification key KV′

excluding the first partial information; and

a second verification key generation function of generating the second verification key KV′

based on the first partial information and the second partial information.

16. A program for causing a computer to implement:

a first partial information acquisition function of acquiring first partial information which constitutes a part of a second verification key KV′

(KV′

≠

KV) that is capable of verifying an electronic signature σ

generated using a first signing key KS that pairs with a first verification key KV, and which is unable to identify the second verification key KV′

;

a second partial information generation function of generating second partial information using the first partial information acquired by the first partial information acquisition function and the first signing key KS, the second partial information being unable to identify the first verification key KV and being used for generating the remaining part of the second verification key KV′

excluding the first partial information; and

a second partial information providing function of providing the second partial information generated by the second partial information generation function to another device that provided the first partial information.