A Chameleon Hash-based Method for Proving Execution of Business Processes

Abstract

Remote work is becoming common for many companies due to the impact of the COVID-19 pandemic. Companies need to be able to operate every business process with high reliability, even in circumstances where lack of direct conversation or cross-checking makes it difficult to confirm or verify the works have been done correctly. In recent years, cloud-based electronic contract services have emerged, and by executing business processes in accordance with workflows in the cloud, it is possible to prove the execution of business processes even in a remote work environment. However, when a person uses a cloud-based electronic contract service that signs digitally without his/her own signature key, there is a problem associated with the reliability; nobody can prove the business processes have been really executed based on the person's own intention. One way to solve the problem is to apply a principal-signing electronic contract service or a client-side trivial digital signature scheme. However, these do not provide direct proof that the business processes have been done by pre-assigned members. In this paper we propose a chameleon hashbased method for proving execution of business processes. This method makes it very easy for a verifier to prove that a series of business processes in a workflow, including identity authentication, document edits and approval, have been executed by "the principals who are designated in advance". In addition, since this method can prove that the principal has the intention of editing the document, it is possible to show the authenticity of the document in accordance with the recent interpretation of the Act on Electronic Signatures and Certification Business. We have developed a prototype system and implemented this method. We have confirmed that the prototype system has been able to compute the proposed method at high speed without burdening the PC during editing business documents in our daily works, and to easily verify that the processes have been executed correctly.