Signature Generation and Verification System and Signature Verification Apparatus

• US 20140019766A1
• Filed: 07/10/2013
• Published: 01/16/2014
• Est. Priority Date: 07/11/2012
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: TAKAHASHI, Kenta, NISHIGAKI, Masakatsu, YONEYAMA, Yuta, HONBU, Eisei
• Granted Patent: US 9,565,023 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A signature generation and verification system including a signature generation apparatus and a signature verification apparatus is provided. Based on signer certification information possessed by a signer, the signature generation apparatus generates a digital signature and verification data corresponding to a given electronic document and outputs the set of the digital signature and the verification data as signature data. Upon receipt of the electronic document and the signature data, the signature verification apparatus verifies the digital signature using the verification data to verify the integrity of the electronic document. As needed, the signature verification apparatus performs user identification ex-post facto by authenticating that the signer certification information from which the verification data was generated belongs to a legitimate user without knowledge of the signer certification information.

Claims

1. A signature generation and verification system comprising a signature verification apparatus and a user certification apparatus,

wherein the signature verification apparatus includes:

a signed electronic document input section which acquires electronic document data generated by a signature generation apparatus, and signature data made of a set of a digital signature and verification data;

an integrity verification section which verifies the integrity of the set of the electronic document data and the electronic signature using the verification data;

an identification section which transmits to the user certification apparatus authentication data for authenticating that the verification data was generated based on predetermined user certification information unique to a user, the identification section identifying the user based on the digital signature transmitted from the signature generation apparatus; and

an output section which provides either “

accept”

or “

reject”

output based on either or both of the result of integrity verification by the integrity verification section and the result of identification by the identification section, and

wherein the user certification apparatus includes;

a user certification information input section which receives the input of the user certification information; and

a digital signature generation section which generates the digital signature based on the authentication data received from the signature verification apparatus and transmits the digital signature to the signature verification apparatus.

2. The signature generation and verification system according to claim 1,

wherein said signature generation apparatus includes:

a signer certification information input section which receives signer certification information possessed only by a signer;

a signature data generation section which generates the digital signature and the verification data, the digital signature and the verification data corresponding to the electronic document data, based on the signer certification information; and

a signature data output section which transmits as the signature data the set of the digital signature and the verification data to the signature verification apparatus.

3. The signature generation and verification system according to claim 2,

wherein said signature data generation section of said signature generation apparatus

generates a pair of a secret key and a public key based on the signer certification information, and

generates the digital signature corresponding to the electronic document data using the secret key;

wherein said signature data output section

transmits the signature data including the digital signature and the public key to the signature verification apparatus;

wherein said integrity verification section

verifies the integrity of the pair of the electronic document data and the digital signature using the public key included in the signature data;

wherein said identification section

transmits a challenge code including authentication data to the user certification apparatus;

wherein said user certification apparatus

transmits a digital signature corresponding to the challenge code to the signature verification apparatus;

wherein said signature verification apparatus

receives the digital signature, and

has the function of verifying the digital signature (response) using the public key, and determining that identification is successful if the digital signature is successfully verified; and

wherein said digital signature generation section of said user certification apparatus

generates a secret key based on the user certification information,

receives the challenge code,

generates the digital signature corresponding to the challenge code using the secret key, and

transmits the digital signature to the signature verification apparatus.

4. The signature generation and verification system according to claim 2,

wherein said signature data generation section of said signature generation apparatus

randomly generates a pair of a secret key and a public key,

generates a digital signature corresponding to the electronic document data using the secret key, and

generates verification commitment information from the signer certification information and the secret key;

wherein said signature data output section

transmits the signature data including the digital signature, the public key, and the verification commitment information to the signature verification apparatus;

wherein said digital signature generation section of said user certification apparatus

receives a challenge code from the identification section,

randomly generates a pair of a temporary secret key and a temporary public key,

generates a digital signature corresponding to the challenge code using the temporary secret key,

generates temporary commitment information from the user certification information and the temporary secret key,

generates a response including the digital signature corresponding to the challenge code, the temporary public key, and the temporary commitment information, and

transmits the response to the signature verification apparatus; and

wherein said identification section of said signature verification apparatus

transmits a challenge code to the user certification apparatus,

receives the response from the user certification apparatus,

verifies the digital signature corresponding to the challenge code using the temporary public key, and

generates a difference secret key by suitably operating on the verification commitment information and on the temporary commitment information while performing commitment authentication by verifying correspondence among the public key, the temporary public key, and the difference secret key.

9. The signature generation and verification system according to claim 2,

wherein the signer certification information is secret information known only to the signer, and

wherein the user certification information is secret information known only to the user.

10. The signature generation and verification system according to claim 2,

wherein the signer certification information is biometric data acquired from the biological body of the signer;

and

wherein the user certification information is biometric data acquired from the biological body of the user.

11. The signature generation and verification system according to claim 4,

wherein the signer certification information is signer biometric data acquired from the biological body of the signer;

wherein the user certification information is user biometric data acquired from the biological body of the user; and

wherein the commitment authentication is deemed successful when the signer biometric data and the user biometric data are substantially similar to each other.

13. The signature generation and verification system according to claim 3,

wherein the signer certification information is secret information known only to the signer, and

wherein the user certification information is secret information known only to the user.

14. The signature generation and verification system according to claim 4,

wherein the signer certification information is biometric data acquired from the biological body of the signer;

and

wherein the user certification information is biometric data acquired from the biological body of the user.

5. A signature verification apparatus comprising:

an integrity verification section which

receives the input of first electronic document data and first signature data made of a set of a first digital signature and first verification data, and the input of second signature data made of second electronic document data and a set of a second digital signature and second verification data,

verifies the integrity of the set of the first electronic document data and the first digital signature using the first verification data, and

verifies the integrity of the set of the second electronic document data and the second digital signature using the second verification data;

a signer identity verification section which

transmits to a user certification apparatus authentication data for authenticating that the first verification data and the second verification data were generated based on signer certification information possessed by the same signer, and

performs the authentication based on the digital signature received from the user certification apparatus without knowledge of the signer certification information; and

an output section which provides “

accept”

output when both the integrity verification by the integrity verification section and the authentication by the signer identity verification section are successful, and gives “

reject”

output otherwise.

6. A signature generation and verification system comprising a signature verification apparatus according to claim 5 and a signature generation apparatus,

wherein said signature generation apparatus includes:

a signer certification information input section which receives signer certification information possessed only by a signer;

a signature data generation section which generates the digital signature and the verification data, the digital signature and the verification data corresponding to the electronic document data, based on the signer certification information; and

a signature data output section which outputs the set of the digital signature and the verification data as the signature data.

7. The signature generation and verification system according to claim 6,

wherein said signature data generation section of said signature generation apparatus

has the function of generating a pair of a secret key and a public key based on the signer certification information, and

generates either the first digital signature corresponding to the first electronic document data or the second digital signature corresponding to the second electronic document data using the secret key;

wherein said signature data output section

outputs either the first signature data including the first digital signature and the first public key or the second signature data including the second digital signature and the second public key to the signature verification apparatus;

wherein said integrity verification section of said signature verification apparatus

verifies the integrity of the set of the first electronic document data and the first digital signature using the first public key included in the first signature data, and

verifies the integrity of the set of the second electronic document data and the second digital signature using the second public key included in the second signature data; and

wherein said signer identity verification section

determines whether the first public key and the second public key are the same.

8. The signature generation and verification system according to claim 6,

wherein said signature data generation section of said signature generation apparatus

randomly generates a pair of a secret key and a public key,

generates the first (or second) digital signature corresponding to the first (or second) electronic document data using the secret key, and

generates first (or second) verification commitment information from first (or second) signer certification information and the first (or second) secret key;

wherein said signature data output section

has the function of outputting the first signature data including the first digital signature, the first public key, and the first verification commitment information, and

has the function of outputting the second signature data including the second digital signature, the second public key, and the second verification commitment information;

wherein said signer integrity verification section of said signature verification apparatus

generates a difference secret key by suitably operating on the first verification commitment information and on the second verification commitment information, and

performs commitment collation by authenticating correspondence among the first public key, the second public key, and the difference secret key.

12. The signature generation and verification system according to claim 8,

wherein the signer certification information is signer biometric data acquired from the biological body of the signer;

and

wherein the commitment collation is deemed successful when first signer biometric data in effect upon generation of the first verification commitment information and second signer biometric data in effect upon generation of the second verification commitment information are substantially similar to each other.