Digital signature system and method, and recording medium

Abstract

To simultaneously reduce risks of both key loss and leakage in digital signatures.SOLUTION: A digital signature system includes a first signature generation device (biological body-utilization signature generation device) and a second signature generation device (key-utilization signature generation device) each of which has at least a processor and a communication interface and is communicatively connected to each other. The second signature generation device receives a first parameter created using at least first biometric information and stores the first parameter in a storage unit, and the first signature generation device generates a second parameter using at least second biometric information and transmits the second parameter and a message to be signed to the second signature generation device. The second signature generation device generates a second signature for the message from the first parameter and the second parameter and transmits the second signature to the first signature generation device, and the first signature generation device generates and outputs a first signature for the message on the basis of at least the second signature.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a digital signature system, method, and recording medium. [Background technology]

[0002] Digital signatures are a technology that can verify the creator of a document and that it has not been tampered with since its creation.

[0003] <Digital signature algorithm> Key generation: Generate a pair of signing key (private key) sk and verification key (public key) vk. (sk, vk)←KeyGen(1 κ ) …(1) κ is a security parameter.

[0004] In some cases, instead of the key generation algorithm receiving the security parameters directly, the setup algorithm receives common (public) parameters generated from the security parameters and generates a pair of a signing key (private key) sk and a verification key (public key) vk.

[0005] Signature: Generate a signature σ for a message (document) M using a signing key sk. In other words, generate a signature σ using the signing key (private key) sk for the message M to be signed or the hash value (message digest) obtained by inputting the message M into a hash function. σ←Sign(sk, M) …(2)

[0006] Verification: Verify the correctness of the pair of message (document) M and signature σ using the verification key vk. 0 / 1←Verify(vk, M, σ) …(3) Here, acceptance is set to 1, and rejection is set to 0.

[0007] In a digital signature, if the public key is made public, anyone who obtains the pair of the document and the signature can verify it. In other words, whether or not the signature was generated for the document is verified using a public key, which is the verification key, and a private key, which corresponds to the public key, which is the signature key. Digital signatures are used for various purposes, such as protecting e-mail (S / MIME (Secure / Multipurpose Internet Mail Extensions)) and electronic contracts. For example, instead of a seal on a written contract, the contracting party's digital signature is added to the electronic data of the contract. In addition, when transferring virtual currency, a message containing information such as "how much to send to which address" and the sender's digital signature for that message are recorded in the blockchain. The transfer process is completed when this signature is correctly verified.

[0008] Digital signatures lose security if the signing key is lost or stolen, but it is difficult for general users to properly manage signing keys. If signing keys are not properly managed, there is a risk that they may be lost or stolen. If signing keys are not properly managed, the "signer" may not be able to generate a correct signature (e.g., if the signing key is lost), or someone other than the "signer" may be able to generate a correct signature (e.g., if the signing key is stolen).

[0009] The security of digital signatures is based on the fact that the signing key is managed secretly. If an attacker obtains a signing key, he or she can generate a correct signature. In other words, what a digital signature guarantees is that "the person who holds the signing key has affixed a signature to a document," not that "a 'signer' has affixed a signature to a document." The more keys a user manages, the more difficult management becomes. Non-patent document 1, for example, can be seen as an example of digital signatures that enable distributed key management, such as multi-signatures.

[0010] A digital signature using biometric information has been proposed as a biometric signature (fuzzy signature) (Patent Document 1).

[0011] Key generation: A verification key is generated from the biometric information.

[0012] Signature: Generate a signature σ for document M using biometric information.

[0013] Verification: The correctness of the message and signature pair is verified using the verification key. [Prior art documents] [Patent documents]

[0014] [Patent Document 1] Patent No. 5707311 [Patent Document 2] Patent Publication No. 2021-087167 [Non-patent literature]

[0015] [Non-Patent Document 1] Antonio Nicolosi, et al., "Proactive Two-Party Signatures for User Authentication," Conference: Proceedings of the Network and Distributed System Security Symposium, NDSS 2003, San Diego, California, USA. [Non-Patent Document 2] David Derler1, et al., "Key-Homomorphic Signatures: Definitions and Applications to Multiparty Signatures and Non-Interactive Zero-Knowledge," Designs, Codes and Cryptography 87, 1372-1413, 2019 Summary of the Invention [Problem to be solved by the invention]

[0016] In a digital signature using biometric information, the risk of losing a key is reduced more than with a digital signature by using biometric information instead of a key. However, when using a key that depends on biometric information, leakage of the biometric information means leakage of the key. Since it is difficult to change biometric information, once biometric information is leaked, the key generated from the biometric information can no longer be used safely.

[0017] An object of the present invention is to provide a system, method, and program recording medium that simultaneously reduces the risks of both key loss and key leakage in digital signatures. [Means for solving the problem]

[0018] A digital signature system according to one aspect of the present invention includes a first signature generation device and a second signature generation device, each of which includes at least a processor and a communication interface and is communicatively connected to each other; the second signature generating device executes a process of receiving a first parameter created using at least the first biometric information and storing the first parameter in a storage unit; the first signature generation device executes a process of generating a second parameter using at least a second biometric information and transmitting the second parameter to the second signature generation device; the second signature generation device executes a process of generating a second signature for a message to be signed from the first parameters and the second parameters, and transmitting the second signature to the first signature generation device; The first signature generation device executes a process of generating and outputting a first signature for the message based on at least the second signature.

[0019] A digital signature method according to one aspect of the present invention includes the steps of: A second node receives a first parameter created using at least the first biometric information and stores the first parameter in a storage unit; a first node generating second parameters using at least the second biometric information and transmitting the second parameters to the second node; the second node generates a second signature for the message to be signed from the first parameter and the second parameter and transmits the second signature to the first node; The first node generates and outputs a first signature for the message based on the second signature.

[0020] According to one aspect of the present invention, a process of receiving a first parameter created using at least the first biometric information and storing the first parameter in a storage unit by a second processing device; A process of generating a second parameter using at least the second biometric information by a first processing device and transmitting the second parameter to the second processing device; a process by the second processing device of generating a second signature for a message to be signed from the first parameter and the second parameter and transmitting the second signature to the first processing device; A recording medium (non-transitory computer-readable medium) is provided that stores a program that causes the first and second processing devices, which are communicatively connected to each other, to each execute a process in which the first processing device uses at least the second signature to generate and output a first signature for the message. Effect of the Invention

[0021] According to the present invention, it is possible to simultaneously reduce the risks of both key loss and key leakage in digital signatures. [Brief description of the drawings]

[0022] [Figure 1] FIG. 1 is a diagram illustrating an embodiment. [Diagram 2] FIG. 4 is an explanatory diagram for explaining a calculation process according to an embodiment. [Diagram 3] FIG. 1 is a diagram illustrating a configuration of an embodiment. [Figure 4] FIG. 2 is a diagram illustrating a processing sequence according to an embodiment. [Diagram 5] FIG. 2 is a diagram illustrating a processing sequence according to an embodiment. [Figure 6]FIG. 2 is a diagram illustrating a processing sequence according to an embodiment. [Figure 7] FIG. 11 is an explanatory diagram for explaining a calculation process according to the second embodiment. [Figure 8] FIG. 11 is a diagram illustrating a processing sequence according to the second embodiment. [Figure 9] FIG. 11 is a diagram illustrating a processing sequence according to the second embodiment. [Figure 10] FIG. 11 is a diagram illustrating a processing sequence according to the second embodiment. [Figure 11] 13(A), (B), and (C) are diagrams illustrating a second embodiment. [Figure 12] FIG. 13 is an explanatory diagram for explaining a calculation process according to the third embodiment. [Figure 13] FIG. 13 is a diagram illustrating a configuration of a third embodiment. [Figure 14] FIG. 13 is a diagram illustrating a processing sequence according to the third embodiment. [Figure 15] FIG. 13 is an explanatory diagram for explaining a calculation process according to the fourth embodiment. [Figure 16] FIG. 13 is a diagram illustrating a configuration of a fourth embodiment. [Figure 17] FIG. 13 is a diagram illustrating a processing sequence according to the fourth embodiment. [Figure 18] FIG. 13 is a diagram illustrating a fourth embodiment. [Figure 19] 13(A) and 13(B) are diagrams for explaining an example of implementation on a computer. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] An embodiment of the present invention will be described. The feature of biometric information is that it is difficult to link with others (≒ difficult to steal) and difficult to lose the link with the person (≒ difficult to lose). Instead of generating a signature using only biometric information, one of two signature keys distributed and held by two parties is replaced with biometric information. Since the signature key generated from biometric information is used in pair with another signature key, it is possible to link one body part (e.g. face, fingerprint, finger vein, iris, etc.) with multiple keys by changing the other signature key. The storage location of the other signature key paired with the biometric information may be a device such as a computer, smartphone, token, or IC card at the user's hand, a cloud server, or a server managed by a service provider. According to this embodiment, it is possible to simultaneously reduce the risks of both key loss and leakage in digital signatures. According to this embodiment, the final processing to complete the signature is performed on the user (client) device. Therefore, even if the server device commits fraud in creating a signature, the user device can detect if it uses parameters (key parameters) other than those specified by verifying the completed signature before sending it.

[0024] Fig. 1 is a diagram for explaining a schematic configuration example of an embodiment of the present disclosure. Referring to Fig. 1, a digital signature system 100 includes a key generation device 120, a key-based signature generation device 130, a biometrics-based signature generation device 140, and a verification device 150.

[0025] In the key registration phase, the key generation device 120 generates a private key sk and a public key vk from the security parameters κ using a key generation algorithm KeyGen. (sk, vk)←KeyGen(1 κ ) …(4) This key generation algorithm KeyGen returns a pair of a private key sk and a public key vk as return values ​​at the same time. Note that KeyGen may receive a common parameter generated from a security parameter in the setup algorithm, and generate a pair of a private key sk and a public key vk. In key generation, the public key vk may be generated from the private key sk using a one-way hash function (cryptographic hash function, linear hash function). Alternatively, the public key vk may be generated by vk=g^φ(sk) using a generator g of a multiplicative group G of a prime number p and a mapping φ (a mapping from a set to which the private key sk belongs to Z (Z is a set of all integers)). Alternatively, a keyed hash function or the like may be used. Hereinafter, this private key sk is referred to as a first signature key x. The public key vk is referred to as a verification key. The key generation device 120 transmits the verification key vk to the verification device 150. The key generation device 120 and the verification device 150 may be configured to be communicatively connected via a network (e.g., at least one of a wired LAN (Local Area Network), a wireless LAN, a WAN (Wide Area Network), a mobile communication network, a virtual network, and the like). The verification key vk may not be transmitted to the verification device 150, but may be registered and stored in a key server (public key database) or the like in association with a key ID, and the verification device 150 may obtain the verification key vk from the key server (public key database) or the like as necessary.

[0026] The key generating device 120 acquires the first biometric information w. The key generating device 120 performs an encoding function (encoding algorithm) (Encode, ENC) on the first signature key x to convert it into an encoding key c←Encode(x), and synthesizes (for example, by addition or exclusive OR) the encoding key ENC(x) and the first biometric information w to generate a first parameter s. The first parameter s obtained by encoding the first signature key x and embedding it in the first biometric information w is also referred to as a first key parameter. s:=ENC(x)+w …(5)

[0027] The key generation device 120 transmits the generated first parameter s to the key-based signature generation device 130. The key generation device 120 and the key-based signature generation device 130 may be configured to be communicatively connected via a network (e.g., at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and others). Note that applying an encoding function (Encode) / decoding function (Decode) is referred to as encoding / decoding.

[0028] The key generating device 120 may transmit the first parameter s based on the first biometric information w only to the key-based signature generating device 130. Nothing may be transmitted from the key generating device 120 to the biometric signature generating device 140. In Fig. 1, the arrows to which the information to be transmitted, such as the first parameter s and the verification key vk, are added are illustrative of an example of the transmission of the information (handshaking between the sender and the destination is omitted), and of course do not mean that the communication between the sender and the destination is one-way communication. The same applies to the subsequent drawings.

[0029] In the biometric signature generating device 140, in the stage of actually signing (signature phase), the second biometric information w' and the message M for signing are acquired, and a differential key Δ is generated, and an encoding key ENC(Δ) is generated by applying an encoding function (Encode) to the differential key Δ, and the second biometric information w' is combined to generate a second parameter s'. s' is also called a second key parameter. s'=ENC(Δ)+w' …(6) Δ is also called the shift amount.

[0030] The biometric signature generation apparatus 140 transmits the second parameter s' (=ENC(Δ)+w') and the message M to the key-based signature generation apparatus 130. The key-based signature generation apparatus 130 and the biometric signature generation apparatus 140 may be configured to be communicatively connected via a network (e.g., at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and the like).

[0031] The key-based signature generation device 130 receives the second parameter s' and the message M from the biometric signature generation device 140. The key-based signature generation device 130 inputs the difference s-s' between the first parameter s and the second parameter s' to a decryption function Decode to generate a second signature key x'. x'←Decode(s - s') ... (7)

[0032] Alternatively, instead of the decryption function Decode, which inputs the difference s-s' between the first parameter s and the second parameter s' as an argument, a key difference recovery function (algorithm) Diff(DiffRec), which inputs the first parameter s and the second parameter s' as arguments and recovers the key difference corresponding to s and s', may be used to determine the key difference x' between the first signing key x and the differential key Δ (it can also be said that the only difference between Diff and Decode is whether s and s' are input as two arguments or a single argument (s-s') is input).

[0033] The key-utilizing signature generation device 130 generates a signature (second signature) σ′ for a message (document) M using a second signature key x′. σ'← Sign(x', M) …(8)

[0034] The key-based signature generation device 130 transmits the second signature σ′ to the biometrics-based signature generation device 140 .

[0035] The biometric signature generation device 140 receives the second signature σ′ and generates a first signature σ(=Sign(x,M)) for the message M using the first signature key x by the key homomorphic operation KHom(Δ,σ′). σ(=Sign(x,M))← KHom(Δ,σ') …(9)

[0036] The biometric signature generating device 140 transmits the first signature σ and the message M to the verification device 150. However, the destination of the first signature σ is not limited to the verification device 150, and may be any device (node) not shown. In other words, the destination of the first signature σ is not limited to the verification device 150, and a pair of the signature and the message may be transmitted to and stored in a device other than the verification device 150, and the pair of the signature and the message stored in the other device may be acquired by a device performing the verification (which may be the other device) and the signature may be verified. In this case, there is a difference in timing between the generation and verification of the signature, and multiple signatures may be verified together. For example, in a blockchain network, the pair of the signature and the message is transmitted to, for example, the nearest node and temporarily stored, and the signature is verified by the node, and when it is accepted, the procedure of propagating it to other nodes is repeated.

[0037] The verification device 150 receives and registers the verification key vk from the key generation device 120. The verification device 150 receives the first signature σ and the message M transmitted from the biometric signature generation device 140. The verification device 150 verifies the correctness of the pair of the message M and the first signature σ by using the verification key vk. 0 / 1 ←Verify(vk, M, σ) …(10) In the case of accept, it is set to 1, and in the case of reject, it is set to 0. The verification device 150 may transmit the verification result to, for example, the biometric signature generation device 140 which is the sender of the first signature σ. The biometric signature generation device 140 and the verification device 150 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, and the like).

[0038] 1, the key-based signature generation device 130 may be called a second signature generation device because it generates a second signature σ' for a message M using a second signature key x', and the biometrics-based signature generation device 140 may be called a first signature generation device because it generates a first signature σ when signing a message M using a first signature key x. The same applies to the figures following FIG. 1.

[0039] Figure 2 illustrates the calculation process in each device described above with reference to Figure 1. Although some of the explanation overlaps with the above, the calculations are explained below. Note that in Figure 2, the numbers in parentheses next to each device indicate the processing number (step) in that device.

[0040] The key generating device 120 acquires first biometric information w for user registration (1). The first biometric information w is, for example, an n-dimensional vector.

[0041] The key generating device 120 executes the setup algorithm of the digital signature scheme. The parameter pp is determined in advance according to the security parameter κ and is made public to the user (setup) (2). pp ← Setup(1 κ ) …(11)

[0042] The parameters pp are composed of information related to groups, hash functions, etc., and are parameters common to the system, and are referred to here as public parameters. The setup may be performed, for example, before the system is operated, and each of the devices 120, 130, 140, and 150 in the digital signature system 100 can use (share) the public parameters pp.

[0043] The key generation device 120 generates a pair of a signature key (private key) and a verification key (public key) in accordance with the public parameters pp (3). (sk,vk) ← KeyGen(pp) …(12) Let private key (signature key) sk be the first signature key x.

[0044] The key generating device 120 encodes the first signature key x to convert it into an encoding key ENC(x), and generates a first parameter s by combining the encoding key ENC(x) with the first biometric information w (4). s := ENC(x) + w …(13)

[0045] The key generation device 120 transmits the verification key vk to the verification device 150 (5). The verification device 150 receives and stores the verification key vk (1).

[0046] The key generation device 120 transmits the first parameter s to the key-based signature generation device 130 (6). The key generation device 120 may transmit the verification key vk before the generation process of the first parameter s (4).

[0047] The encoding function Encode converts plaintext m contained in the source space into code c. The decode function Decode converts code c back into plaintext m. c←Encode(m) …(14) m← Decode(c) …(15)

[0048] Here, for a code c' whose difference from c, which is the code of any plaintext m included in the information source space, is within the correction capability, m = DEC(c') ... (16) needs to be true.

[0049] As will be described below, the embodiment uses a linear code, which has linearity with respect to the code.

[0050] Linearity: ENC(m1) + ENC(m2) …(17) is the codeword of m1+m2, i.e., m1 + m2 = DEC(ENC(m1) + ENC(m2)) …(18) In formula (18), the “+” on the left and right sides do not have to be the same operator.

[0051] Regarding the coding, for example, an error-correcting code (Hamming code, BCH (Bose-Chaudhuri-Hocquenghem code), RS (Reed-Solomon) code, LDPC (low-density parity-check code), etc.) may be used. Alternatively, for example, lattice coding may be used. More specifically, methods using integer lattices, methods using triangular lattices, and methods using more complicated lattices are known (see Patent Document 2, etc.).

[0052] The key-utilizing signature generation device 130 receives and stores the first parameter s from the key generation device 120 (1).

[0053] The biometric signature generation device 140 acquires the second biometric information w' of the user (1), acquires the message M to be signed (2), and selects a differential key Δ (a non-negative integer) uniformly at random from the information source (3). Δ is also called a shift or temporary key. The biometric signature generation device 140 generates a second parameter s' from the encoded value of the differential key Δ and the second biometric information w' (4). s'=ENC(Δ)+w' …(19)

[0054] The second biometric information w' is, for example, an n-dimensional vector.

[0055] The biometrics-based signature generation apparatus 140 transmits the second parameter s′ and the message M to the key-based signature generation apparatus 130 (5).

[0056] The key-utilizing signature generating device 130 receives the second parameter s′ and the message M (2), x'←Decode(s - s') ... (20) The key-based signature generation device 130 generates a second signature key x' for the message M using the second signature key x' (3), and transmits the second signature σ' to the biometric signature generation device 140 (5). The biometric signature generation device 140 receives the second signature σ' (6), and uses the key homomorphic operation KHom(Δ, σ') to generate a first signature σ(=Sign(x,M)) for the message M using the first signature key x (7).

[0057] σ(=Sign(x,M))← KHom(Δ,σ') …(21)

[0058] The biometric signature generation device 140 transmits the first signature σ and the message M to the verification device 150 (8). As described above, the destination of the first signature σ and the message M may be a device other than the verification device 150.

[0059] The key homomorphic operation in equation (21): σ ← KHom(Δ, σ') indicates that an algorithm can be constructed to generate a signature σ for a message M using a first signing key x from a second signature σ' for the message M using a second signing key x' (=x-Δ) and the differential key Δ.

[0060] A brief explanation of key homomorphism will be given below. As an example, Schnorr signature having key homomorphism will be used for explanation (see Non-Patent Document 2). In the following, the private key sk and the public key pk in Non-Patent Document 2 will be written as the signature key sk and the verification key vk, respectively.

[0061] <Example 1: Schnorr signature> set up : Setup(1 κ ), we consider a prime number p (i.e., TIFF2025002445000002.tif6150TIFF2025002445000003.tif12153However, TIFF2025002445000004.tif18153 is a ceiling function that represents rounding up to an integer value), and select g uniformly at random from G (g← R G), hash function H : G × {0, 1} * → {0, 1} n Let us consider the family of hash functions {H k} k Let (G, g, H) be the public parameters pp, chosen uniformly at random from pp ← (G,g,H) …(23)

[0062] key generation : In KeyGen(pp), a signing key and a verification key are generated according to the public parameters pp. x is chosen uniformly at random from Zp (the set of integers 0 to p (=Z / pZ)). x← R Zp …(24) The verification key and signing key are determined and output as follows: Verification key: vk ← g x , Signing key: sk ← x …(25)

[0063] signature : In Sign(sk, M), r is chosen uniformly at random from Zp (r← R Zp), and output the signature σ calculated as follows: c ← H(g r ,M) y ← r + x c mod p σ ← (c, y) …(26)

[0064] verification : In Verify(vk,M,σ), c = H(((g x ) -c g y ), M) …(27) If true, output 1; if false, output 0.

[0065] Key homomorphic operations : If signature σ (=Sign(sk, M)= (c, y)) is a correct signature for message M under verification key vk, then the new signature calculated using σ and Δ is: σ' ← (c, y') y' ← y + Δ c mod p …(28) is the verification key vk'=g x+Δ …(29) It can be seen that this is a valid signature for message M under the above conditions. That is, the following holds: H(vk' -c g y' , M) =H({g (x+Δ)} -c ·g {r+(x+Δ)c} , M) =H(g -(x+Δ)c ·g r ·g (x+Δ)c , M) =H(g r , M)=c …(30)

[0066] Non-Patent Document 2 discloses an algorithm Adapt that includes a conversion process for converting a signature σ based on a signing key sk into a signature σ' based on sk+Δ. In this embodiment, an algorithm for converting a second signature σ' based on a second signing key x' (=x-Δ) for a message M into a first signature σ based on a first signature x (=(x-Δ)+Δ) for the message M is called KHom. Although KHom does not match Adapt in Non-Patent Document 2, the shift Δ in Adapt may be made to correspond to the differential key Δ in this embodiment (if sk in Adapt in Non-Patent Document 2 is made to correspond to x-Δ, KHom can be made to partially correspond to Adapt in Non-Patent Document 2).

[0067] The verification device 150 receives the first signature σ and the message M transmitted from the biometric signature generation device 140 (2), and verifies the correctness of the pair of the message M and the first signature σ using the verification key vk (3).

[0068] 3 is a diagram for explaining an example of the configuration of each device in FIG. 1. The key generating device 120 includes a biometric information acquiring unit 121 having a sensor (not shown) for acquiring first biometric information w of a user (or an interface for receiving the first biometric information w acquired by an external sensor via a network such as a communication line), a signature key / verification key generating unit 122 for generating a first signature key x and a verification key vk, a first parameter generating unit 123 for generating a first parameter s by using the first signature key x and the first biometric information w, a verification key transmitting unit 124 for transmitting the verification key vk to the verification device 150, and a first parameter transmitting unit 125 for transmitting the first parameter s to the key-utilizing signature generating device 130. The verification key transmitting unit 124 may transmit the verification key vk to a key server (public key database) or the like.

[0069] The key-based signature generation device 130 includes a first parameter receiving unit 131 that receives a first parameter s transmitted from the key generation device 120, a storage unit 132 that stores the first parameter s received by the first parameter receiving unit 131, and a signature generation unit 134 that transmits and receives information to and from the key-based signature generation device 130 and generates a second signature σ' for a message M. The signature generation unit 134 includes a second parameter / message receiving unit 1341 that receives the second parameter s' and the message M transmitted from the biometric signature generation device 140, a second signature key generation unit 1342 that generates a second signature key x', a second signature generation unit 1343 that generates a second signature σ' for the message M using the second signature key x', and a second signature transmission unit 1344 that transmits the second signature σ' to the biometric signature generation device 140.

[0070] The biometric signature generation device 140 includes a biometric information acquisition unit 141 equipped with a sensor (not shown) for acquiring the user's second biometric information w′, a message acquisition unit 142 for acquiring the message M to be signed, a signature generation unit 144 for transmitting and receiving information with the key-based signature generation device 130 and generating a first signature σ for the message M using the first signature key x, and a transmission unit 145 for transmitting the first signature σ and the message M to the verification device 150. The signature generation unit 144 includes a differential key generation unit 1441 that generates a differential key Δ, a second parameter generation unit 1442 that generates a second parameter s' using the differential key Δ and the second biometric information w', a second parameter / message transmission unit 1443 that transmits the second parameter s' and a message M to the signature generation unit 134 of the key-based signature generation device 130, a second signature reception unit 1444 that receives the second signature σ' generated by the signature generation unit 134 of the key-based signature generation device 130, and a first signature generation unit 1445 that generates a first signature σ for the message M using the first signature key x from the second signature σ' and the differential key Δ using a key homomorphic operation. Note that a sensor (not shown) in the biometric information acquisition unit 141 is preferably configured in the same manner as a sensor (not shown) in the biometric information acquisition unit 121 of the key generation device 120.

[0071] The verification device 150 includes a verification key receiving unit 151 that receives a verification key vk generated by the key generating device 120, a storage unit 152 that stores the received verification key vk, a signature / message receiving unit 153 that receives the first signature σ and the message M transmitted from the biometric signature generating device 140, and a signature verification unit 154 that verifies the correctness of a pair of the message M and the first signature σ by using the verification key vk generated by the key generating device 120. The verification key receiving unit 151 may receive the verification key vk from a key server (public key database) (not shown) or the like.

[0072] Fig. 4 is a diagram for explaining an example of a processing operation at the key registration stage in the present embodiment shown in Fig. 3. The biometric information acquisition unit 121 of the key generation device 120 acquires first biometric information w for user registration (step A1).

[0073] The signature key / verification key generation unit 122 of the key generation device 120 generates a pair of a first signature key x and a verification key vk corresponding to the first signature key x (step A2).

[0074] The first parameter generation unit 123 of the key generation device 120 encodes the first signature key x, combines the encoded encoding key ENC(x) with the first biometric information w, and generates a first parameter s s := ENC(x) + w …(31) (Step A3).

[0075] In the following, as a non-limiting example, equation (31) will be described based on an example in which a square lattice is used for encoding (Patent Document 2, etc.). The first biometric information w and the second biometric information w' are n-dimensional real vectors. w = (w1, …, w n ), w' = (w'1,…, w' n ) …(32)

[0076] The distance between the first biometric information w and the second biometric information w' is, for example, L ∞ Distance (L ∞ Norm: Maximum norm) is expressed as follows: d (n) ∞ (w,w') = max {|w i -w' i |, i=1,…,n}…(33) Distance d (n) ∞ (w, w') is a given threshold t h Below(d (n) ∞ (w,w')≦t h ) then it is considered a match (same organism).

[0077] The lattice point set L is defined as follows. L = {Y = (y1, …, y n )| y i is a non-negative integer, 0≦y i ≦K} …(34) Here, K is t h ya|w i| is a predetermined integer that is sufficiently larger than

[0078] The function int() that corresponds to an integer z for an N-dimensional integer vector Y∈L is defined as follows. z←int(Y)=Σ[i=1, n]y i (2K) i-1 …(35) Inverse function int -1 () is the function that maps an integer z to an n-dimensional integer vector Y. Y ← int -1 (z) …(36)

[0079] The first signing key x (an integer) is converted to the inverse function int -1 When input into (), you get an n-dimensional integer vector A. A = (a1, …, a n )←int -1 (x) …(37)

[0080] Here, we use the encoding function Encode() as h *int -1 (), the encoding key c obtained by encoding the first signing key x is an n-dimensional vector given by: c = (c1, …, c n )←Encode(x)=2t h *int -1 (x)=2t h *(a1,…, a n ) …(38)

[0081] Therefore, the first parameter s is given by: s := ENC(x) + w = ​​2t h *(a1,…, a n )+(w1,…, w n ) =(2t h *a1+w1,…,2t h *a n +w n ) …(39)

[0082] The verification key transmission unit 124 of the key generation device 120 transmits the generated verification key vk to the verification device 150 (step A4). Note that the key generation device 120 may upload the verification key vk to a key server (public key database) (not shown) or the like and make it publicly available on the Internet or the like.

[0083] First parameter transmitting unit 125 of key generating device 120 transmits first parameter s to key-utilizing signature generating device 130 (step A5). Note that steps A4 and A5 may be interchanged in order.

[0084] The verification key receiving unit 151 of the verification device 150 receives the verification key vk (step D1) and stores the verification key vk in the storage unit 152 (step D2). The verification key receiving unit 151 of the verification device 150 may receive and store the verification key vk from a key server (not shown) or the like that registers the verification key.

[0085] The first parameter receiving unit 131 of the key-based signature generating device 130 receives the first parameter s (step B1), and stores it in the storage unit 132 (step B2).

[0086] FIG. 5 is a diagram for explaining an example of a processing operation at the signature creation stage in the present embodiment shown in FIG.

[0087] The biometric information acquisition unit 141 of the biometric signature generation device 140 acquires second biometric information w' for a user's signature (Step C1).

[0088] The message acquisition unit 142 of the biometric signature generation apparatus 140 acquires the message M (step C2).

[0089] The differential key generating unit 1441 of the biometric signature generating apparatus 140 uniformly randomly selects a random number Δ from the information source and sets it as a differential key (step C3).

[0090] The second parameter generating unit 1442 of the biometric signature generating apparatus 140 generates a second parameter s' by combining a value ENC(Δ) obtained by encoding the differential key Δ with the second biometric information w' (step C4). s':=ENC(Δ)+w' …(40)

[0091] As a non-limiting example, if a square lattice is used as the encoding as well as the first parameter s, c' = (c'1, ..., c' n )←Encode(Δ)=2t h *int -1 (x)=2t h *(a'1,…, a' n ) …(41) Therefore, the second parameter s' is an n-dimensional real-valued vector. s':= 2t h *int -1 (Δ)+w' = 2t h *(a'1,…, a' n )+(w'1,…,w' n ) =(2t h *a'1+w'1,…,2t h *a' n +w' n ) …(42)

[0092] The second parameter / message transmitting unit 1443 of the biometric signature generation apparatus 140 transmits the second parameter s' and the message M to the key-based signature generation apparatus 130 (Step C5).

[0093] The second parameter / message receiving unit 1341 of the key-based signature generation apparatus 130 receives the second parameter s' and the message M transmitted from the biometric signature generation apparatus 140 (step B3).

[0094] The second signature key generation unit 1342 of the key-utilized signature generation device 130 inputs the difference s-s' between the first parameter s and the second parameter s' to the decryption function Decode, and decrypts the value to obtain the second signature key x' (step B4). x'←Decode(s-s') …(43)

[0095] s-s' is expressed as follows due to the linearity of the code: ENC(x)-ENC(Δ)=ENC(x-Δ). s-s' = (w1,…, w n )+ENC(x) - {(w'1,...,w' n ) +ENC(Δ)} = (w1,…, w n ) - (w'1,…, w' n ) +ENC(x) -ENC(Δ) =(w1-w'1,…,w n -w' n )+ENC(x-Δ) …(44)

[0096] The difference between the first biometric information w and the second biometric information w' is w-w'=(w1-w'1..., w n -w' n ) is equal to or less than the correction capability of the linear code, the difference is absorbed by the decoding function Decode, and from equation (44), equation (43) becomes x'←Decode(s-s')= DEC (ENC(x - Δ)) …(45) From equation (45), x'=x - Δ …(46) It becomes.

[0097] As a non-limiting example, a square lattice is used for encoding, and the encoding function Encode is 2t h *int -1 When () is used, the decryption function Decode is Decode(c) = int(c / 2t h ) …(47) It is also possible to use the following.

[0098] In this case, Decode(s-s') is int since x and Δ are integer values. -1 (x)-int -1 (Δ)=int -1 Since (x-Δ) holds, TIFF2025002445000005.tif25156 …(48) For the first biometric information w and the second biometric information w′, d (n) ∞ (w,w')=max { |w i -w' i |, i=1,…,n} ≦t h …(49) Then, in equation (48), n-dimensional vector (w-w') / 2t h Each component of is less than ±1 / 2, and equation (48) is int(int -1 (x-Δ)). Therefore, the value x' of Decode(s-s') in equation (45) is x'=int(int -1 (x-Δ))=x-Δ …(50) It becomes.

[0099] From the above, it can be confirmed that the difference x-Δ between the first signing key x and the differential key Δ is correctly restored by the decryption function Decode. That is, since the coding key obtained by coding the first signing key x and the differential key Δ and the first and second biometric information are respectively combined by vector addition, the key-utilized signature generation device 130 can correctly calculate the second signing key x', which is the difference x-Δ between the first signing key x and the differential key Δ, by decrypting the subtraction between the first parameter s and the second parameter s'.

[0100] The second signature generation unit 1343 of the key-utilizing signature generation device 130 generates a second signature for the message M using the second signature key x′: σ'←Sign(x', M) …(51) (Step B5).

[0101] The second signature transmitting unit 1344 of the key-based signature generation apparatus 130 transmits the second signature σ′ to the biometrics-based signature generation apparatus 140 (Step B6).

[0102] The second signature receiving unit 1444 of the biometric signature generation apparatus 140 receives the second signature σ′ transmitted from the key-based signature generation apparatus 130 (Step C6).

[0103] The first signature generation unit 1445 of the biometric signature generation device 140 performs key homomorphic computation using the second signature σ′ and the differential key Δ. σ←KHom(Δ,σ') …(52) Thus, a first signature σ for the message M is generated using the first signature key x from the second signature σ' for the message M using the second signature key x' (step C7).

[0104] FIG. 6 is a diagram for explaining an example of the operation of the signature verification process in the present embodiment shown in FIG.

[0105] The transmitting unit 145 of the biometric signature generation device 140 transmits the first signature σ and the message M to the verification device 150 (step C8).

[0106] The signature / message receiving unit 153 of the verification device 150 receives the first signature σ and the message M transmitted from the biometric signature generation device 140 (step D3).

[0107] The signature verification unit 154 verifies the correctness of the pair of the message M and the first signature σ by using the verification key vk (step D4).

[0108] The verification device 150 may transmit the verification result (acceptance / rejection notification) to the source, the biometric signature generation device 140 (step D5). In this case, the biometric signature generation device 140 receives the acceptance / rejection notification (step C9).

[0109] The timing of the verification process is arbitrary. For example, when a stored message M is to be used, the signature stored together with the message M can be verified to verify that the message M has not been tampered with, including during storage. Also, one pair of message M and signature may be verified multiple times.

[0110] FIG. 7 is a diagram for explaining the second embodiment, and corresponds to FIG. 2 described above. The system configuration of the second embodiment is basically the same as that shown in FIG. 3. The difference from FIG. 2 is that the first parameter s and the verification key vk can be specified by an ID (e.g., an account ID). A plurality of key pairs (signature key, verification key) can be used for the same first biometric information of the same user. A user who registers the first biometric information w can specify the first parameter and the verification key vk by a plurality of IDs for each user (the case where there is one ID corresponds to the first embodiment). This ID is also called a key ID, and is not an ID for user identification, and one user can have a plurality of IDs. This embodiment can be applied to a system in which, for example, when a user who holds two types of crypto assets, A coin and B coin, wishes to send 100 units of A coin, the user requests the key-based signature generation device 130 to generate a second signature σ' using a first parameter s for A coin in response to a message to that effect, and the first signature σ generated by the biometric signature generation device 140 is sent to the A coin chain.

[0111] The key generating device 120 acquires the first biometric information w for user registration (1). The key generating device 120 executes a key generation algorithm for a digital signature system. The parameter pp is determined in advance according to the security parameter κ and is made public to the user (setup) (2).

[0112] The key generating device 120 repeats the processes (3) and (4) for each of the user's IDs. For example, if the user's IDs are ID1, ID2, and ID3, the key generating device 120 may repeat the processes (3) and (4) for each of the IDs.

[0113] The key generation device 120 generates a first signature key x and a verification key vk (3).

[0114] The key generating device 120 encodes the first signature key x to convert it into an encoding key, and combines the encoding key ENC(x) with the first biometric information w to generate a first parameter s (= ENC(x) + w) (4).

[0115] The key generating device 120 transmits the verification keys vk generated for ID1, ID2, and ID3 to the verification device 150 together with the IDs (5).

[0116] The key generation device 120 transmits the first parameter s generated for each of ID1, ID2, and ID3 to the key-utilized signature generation device 130 together with the IDs (6).

[0117] Note that process (5) may be performed following process (3), and process (6) may be performed following process (4).

[0118] The key generation device 120 may transmit the signature keys vk generated for ID1, ID2, and ID3 and the corresponding IDs to the verification device 150 individually, or may transmit them together in one data ((vk1, ID1), (vk2, ID2), (vk3, ID3)) at once. The key generation device 120 may transmit the first parameters s generated for ID1, ID2, and ID3 and the corresponding IDs to the key-utilized signature generation device 130 individually, or may transmit them together in one data ((s1, ID1), (s2, ID2), (s3, ID3)).

[0119] The key-utilizing signature generation device 130 receives and stores the first parameter s and the ID from the key generation device 120 (1).

[0120] The biometric signature generation device 140 newly acquires second biometric information w' of a user (1), acquires a message M to be signed (2), and selects a differential key Δ uniformly at random from an information source (3).

[0121] The biometric signature generation device 140 generates a second parameter s' (=ENC(Δ)+w') from the encoded value of the differential key Δ and the second biometric information w' (4).

[0122] The biometrics-based signature generation device 140 receives the ID from an input device (not shown) (5), and transmits the second parameter s', the message M to be signed, and the ID to the key-based signature generation device 130 (6).

[0123] The key-utilizing signature generation device 130 receives the second parameter s', the message M, and the ID (2).

[0124] The key-based signature generation device 130 acquires the first parameter s corresponding to the ID, and decrypts the difference between the first parameter s corresponding to the ID and the second parameter s' to generate a second signature key x' (3). x'←Decode(s - s') ... (53)

[0125] The key-utilizing signature generation device 130 generates a second signature σ′ using the second signature key x′ for the message M to be signed (4). σ'←Sign(x', M) …(54)

[0126] Here, when generating the second signature σ′ using the second signature key x′ for the message M to be signed, the key-utilizing signature generation device 130 may generate a signature for the message M and the ID as follows. σ'←Sign(x', (ID, M)) …(55)

[0127] The signature for the message M and ID is not limited to the above formula (54). For example, the method of combining the ID and the message M is as follows: hash the concatenation of the ID and the message M, or Any method may be used, such as concatenating the hash values ​​H(M) and H(ID) of the ID and message M, respectively.

[0128] The key-based signature generation device 130 transmits the second signature σ′ to the biometrics-based signature generation device 140 (5).

[0129] The biometric signature generation device 140 receives the second signature σ' (7), and generates a first signature σ for the message M using the first signing key x by performing a key homomorphic operation KHom(Δ, σ') on the second signature σ' (8). The first signature σ is the second signature σ' In the case of equation (54), σ←Sign(x,M) …(56) In the case of equation (55), σ←Sign(x,(ID,M)) …(57) It becomes.

[0130] Here, the ID indicates that the message M is signed by the first signature key x corresponding to the ID.

[0131] The biometric signature generation device 140 transmits the first signature σ, the message M, and the ID to the verification device 150 (9). The destination of the first signature σ and the message M is not limited to the verification device 150, and they may be configured to be transmitted to any device (node) not shown. A device performing verification may acquire and verify a set of a signature and a message that is transmitted to and stored in a device other than the verification device 150. In this case, there is a lag between the timing of signature generation and verification, and multiple signatures may be verified together. Acquisition of the ID in the verification device 150 or any device (node) may be performed separately from the transmission and reception of the first signature σ and the message M.

[0132] The verification device 150 receives the first signature σ, the message M, and the ID from the biometric signature generation device 140 (3), and verifies the correctness of the pair of the message M and the first signature σ (equation (56) or (57)) using a verification key vk corresponding to the ID (4). Verify(vk, ID, M, σ) …(58)

[0133] In formula (58), ID indicates that the correctness of the pair of the first signature σ and the message M is verified using the verification key vk corresponding to the ID.

[0134] Fig. 8 is a diagram for explaining an example of processing operations at the key registration stage in the second embodiment. In the following, Fig. 3 is referred to for the configuration of each device.

[0135] The biometric information acquisition unit 121 of the key generation device 120 acquires the first biometric information w of the user (step A1).

[0136] The signing key / verification key generation unit 122 generates a first signing key x and a verification key vk (step A2).

[0137] The first parameter generation unit 123 of the key generation device 120 encodes the first signature key x, and adds the first biometric information w to the encoded first signature key ENC(x) to generate a first parameter s (=ENC(x)+w) (step A3). When simultaneously generating keys for multiple IDs (accounts) of the same user, the key generation device 120 may be configured to execute step A1 of acquiring the first biometric information w of the user, and then repeat steps A2 and A3 for the number of IDs (accounts) of the user.

[0138] The verification key transmission unit 124 of the key generation device 120 transmits the verification key vk generated for each ID and the ID to the verification device 150 (step A4). Note that the key generation device 120 may upload the verification key vk and the ID to a key server (not shown) and make them publicly available on the Internet, etc.

[0139] The first parameter transmission unit 125 of the key generation device 120 transmits the first parameter s of each ID (having different first signature keys x) generated from the same first biometric information w together with the ID to the key-utilized signature generation device 130 (step A5). Note that the order of steps A4 and A5 may be reversed.

[0140] The ID received by the key generating device 120, The ID that the key generation device 120 transmits to the key-utilizing signature generation device 130, An ID stored in the key-utilizing signature generation device 130, An ID that the key generating device 120 sends together with the verification key, The IDs stored in the verification device 150 may be different from each other. For example, the verification key receives and stores publicly available information as an ID (such as the hash value of the verification key vk), It is also possible to store information (such as account name) that the user uses when specifying each key in the key-based signature generation device 130. If the ID transmitted and received is different from the stored ID, additional calculation processing (e.g. hash calculation) may be required at the time of storage in order to correlate them with each other.

[0141] The verification key receiving unit 151 of the verification device 150 receives the verification key vk and the ID (step D1) and stores them in the storage unit 152 (step D2). For example, as shown in Fig. 11(A), the verification key vk and the ID may be stored in the storage unit 152 as a table in which they are associated with each other. Note that Fig. 11(A) shows a correspondence table between the verification key vk and the ID (account) of one user, but it goes without saying that the management of the verification key vk and the ID does not have to be for each user.

[0142] The verification key receiving unit 151 of the verification device 150 may receive and store the verification key vk and the ID from a key server (not shown) or the like in which the verification key is registered.

[0143] The first parameter receiving unit 131 of the key-based signature generating device 130 receives the first parameter s and the ID (step B1) and stores them in the storage unit 132 (step B2). For example, as shown in Fig. 11(B), the first parameter s may be stored in the storage unit 132 in a table format in which the first parameter s and the ID are associated with each other. Note that Fig. 11(B) shows a correspondence table between the first parameter s and the ID (account) of one user. This correspondence table may be managed for each user.

[0144] FIG. 9 is a diagram for explaining an example of a processing operation at the signature creation stage in the second embodiment.

[0145] In the biometric signature generation device 140, the steps of obtaining the user's second biometric information w' (step C1), obtaining the message M to be signed (step C2), generating a differential key (step C3), and generating the second parameter s' (=ENC(Δ)+w') (step C4) are the same as those shown in FIG. 5 in the description of the above embodiment.

[0146] The second parameter / message sending unit 1443 of the biometric signature generation device 140 receives the user ID (account) input from an input device not shown (step C5), and sends the second parameter s', the message M to be signed, and the ID (account) to the key-based signature generation device 130 (step C6).

[0147] The second parameter / message receiving unit 1341 of the key-based signature generation apparatus 130 receives the second parameter s' and the message M and ID to be signed, which are transmitted from the biometrics-based signature generation apparatus 140 (step B3).

[0148] The second signature key generation unit 1342 of the key-based signature generation device 130 obtains the first parameter s corresponding to the ID from the memory unit 132, and sets the decrypted value s-s' of the first parameter s and the second parameter s' (DEC(s-s')) as the second signature key x' (step B4).

[0149] The second signature generation unit 1343 of the key-based signature generation device 130 uses the second signature key x' to generate a second signature σ'=Sign(x',M) for the message M, or a signature σ'=Sign(x'(ID,M)) for the message M and the ID (step B5). Note that, as described above, the signature for the message M and the ID is not limited to the above, and the ID and the message M may be linked in any manner, such as linking the ID and the message M as they are, or hashing the ID and the message M separately and linking the respective hash values.

[0150] The second signature transmitting unit 1344 of the key-based signature generation apparatus 130 transmits the second signature σ′ to the biometrics-based signature generation apparatus 140 (step B6).

[0151] The second signature receiving unit 1444 of the biometric signature generation apparatus 140 receives the second signature σ′ transmitted from the key-based signature generation apparatus 130 (Step C7).

[0152] The first signature generation unit 1445 of the biometric signature generation device 140 generates a first signature σ=Sign(x,M) or σ=Sign(x,(ID,M)) using the first signature key x from the second signature σ' for the message M using the second signature key x' by the key homomorphic operation KHom(Δ,σ') using the second signature σ' and the differential key Δ.

[0153] 10 is a diagram for explaining an example of the operation of the signature verification process in the second embodiment. The transmitting unit 145 of the biometric signature generation device 140 transmits the first signature σ, the message M, and the ID to the verification device 150 (step C9). The signature / message receiving unit 153 of the verification device 150 receives the first signature σ, the message M, and the ID transmitted from the biometric signature generation device 140 (step D3). The ID in the verification device 150 may be obtained by a method other than receiving the ID directly transmitted from the biometric signature generation device 140 (for example, obtaining it from a key server, etc.).

[0154] The signature verification unit 154 of the verification device 150 obtains the verification key vk corresponding to the ID from the storage unit 152, and verifies the correctness of the pair of the message M and the first signature σ using the verification key vk (step D4).

[0155] Step D5 of the verification device 150 and step C10 of the biometric signature generation device 140 are similar to steps D5 and C9 in FIG. 6, and therefore description thereof will be omitted.

[0156] As shown in Fig. 11(C), the storage unit 152 of the verification device 150 may store a hash value (H(vk)) of the verification key vk as the ID in Fig. 11(A). In this case, the signature key / verification key generation unit 122 of the key generation device 120 transmits the verification keys vk for the number of user IDs (accounts) and the hash values ​​of the verification keys vk to the verification device 150, and the verification device 150 stores the verification keys vk in association with their hash values ​​(H(vk)) in the storage unit 152. 10, the transmitting unit 145 of the biometric signature generation device 140 transmits the first signature σ, the message M, and the hash value (H(vk)) corresponding to the ID to the verification device 150, and the signature / message receiving unit 153 of the verification device 150 receives the first signature σ, the message M, and the hash value (H(vk)) transmitted from the biometric signature generation device 140 (step D3), and the signature verification unit 154 of the verification device 150 obtains the verification key vk corresponding to the hash value (H(vk)) from the storage unit 152 and verifies the correctness of the set of the message M and the first signature σ using the verification key vk (step D4). The biometric signature generation device 140 may be configured to obtain the correspondence between the ID and the hash value (H(vk)) of the verification key vk from the signature / verification key generation unit 122 and store it in a storage unit (not shown).

[0157] In this embodiment, the communication protocol is such that in response to a communication in which the biometric signature generation device 140 transmits the second parameter s', the message M, and the ID to the key-based signature generation device 130, the key-based signature generation device 130 returns one second signature σ' generated by the key-based signature generation device 130 to the key-based signature generation device 140. Therefore, even if the key-based signature generation device 130 tampers by generating and returning multiple second signatures corresponding to multiple first parameters s in response to the transmission of the second parameter s', the message M, and the ID by the biometric signature generation device 140, the biometric signature generation device 140 can detect the tampering before the signature generation and can take measures such as interrupting the signature generation.

[0158] FIG. 12 is a diagram for explaining an example of the operation of the digital signature system 100 of the third embodiment. The difference from FIG. 7 referred to in the explanation of the second embodiment is that in this embodiment, a process (8A): Verify(vk, ID, M, σ) for verifying the first signature σ, which verifies the correctness of a set of the message M and the first signature σ (equation (56) or (57)) using a verification key vk corresponding to the ID, is added between the process (8) for generating the first signature σ and the process (9) for transmitting the first signature σ, the message M, and the ID to the verification device 150 in the biometric signature generating device 140. Note that the correspondence between the verification key vk and the ID is transmitted in advance from the key generating device 120 to the biometric signature generating device 140, and the biometric signature generating device 140 may be provided with a storage unit for storing the correspondence between the verification key and the key ID as shown in FIG. 11(A). Alternatively, the biometric signature generating device 140 may receive the correspondence between the verification key and the key ID from a key server or the like.

[0159] Fig. 13 is a diagram showing an example of the configuration of each device of the third embodiment. In contrast to the example of Fig. 3, a biometric signature generating device 140 includes a signature verifying unit 146. The key generating device 120, the key-based signature generating device 130, and the verifying device 150 have the same configuration as those in Fig. 3.

[0160] Fig. 14 is a diagram for explaining an example of processing operations at the signature creation stage in the third embodiment. In the third embodiment, processing operations at the key registration stage and signature verification stage are the same as the examples shown in Figs. 8 and 10.

[0161] In Fig. 14, steps C1 to C8 in the biometric signature generation device 140 and steps B3 to B6 in the key-based signature generation device 130 are the same as steps C1 to C8 and steps B3 to B6 in Fig. 9, so their explanation will be omitted. The biometric signature generation device 140 obtains a verification key vk corresponding to the ID from the storage unit 152, and uses the verification key vk to verify the correctness of the pair of the message M and the first signature σ (C11).

[0162] If the verification of the first signature σ results in acceptance (Yes in C12), the biometric signature generation device 140 transmits the first signature σ, the message M, and the ID to the verification device 150 (C9). If the verification of the first signature σ results in rejection (No in C12), the process is interrupted (C13). In this case, the set of the first signature σ, the message M, and the ID is not transmitted to the verification device 150.

[0163] If the result of the verification of the first signature σ is acceptable (Yes in C12), the signature / message receiving unit 153 of the verification device 150 receives the first signature σ, the message M, and the ID transmitted from the biometric signature generation device 140 (step D3 in FIG. 10). The signature verification unit 154 of the verification device 150 obtains the verification key vk corresponding to the ID from the storage unit 152, and verifies the correctness of the pair of the message M and the first signature σ using the verification key vk (step D4 in FIG. 10).

[0164] Since the final process for completing the signature is performed by the biometric signature generation device 140 on the user side, even if the key-based signature generation device 130 commits fraud, the signature completed by the biometric signature generation device 140 is verified and then transmitted to the verification device 150, so that if the key-based signature generation device 130 generates the second signature key x' and the second signature σ' using a first parameter other than the first parameter s1 designated by ID=1, this can be detected. As a modification of the third embodiment, a process corresponding to a process for verifying the first signature σ (8A in FIG. 12) may be added between the process (7) for generating the first signature σ and the process (8) for transmitting the first signature σ to the verification device 150 in the biometric signature generation device 140 in FIG. 2 referred to in the description of the above embodiment.

[0165] Fig. 15 is a diagram for explaining an example of the operation of the digital signature system 100 of the fourth embodiment. The difference from Fig. 7 referred to in the explanation of the second embodiment is that in this embodiment, the key-based signature generation device 130 adds the following between process (3) for decrypting the difference between the first parameter s and the second parameter s' to generate the second signature key x', and process (4) for generating the second signature σ': d = s - s' - ENC(x') ... (59) The difference is that a process (3A) is added to calculate and check whether a value corresponding to the difference between the first biometric information w and the second biometric information w′ satisfies a predetermined condition.

[0166] When the difference between the first biometric information w and the second biometric information w' is equal to or smaller than the correction capability of the linear code, the calculation result of Decode(s-s') in equation (43) is expressed as follows, based on the linearity of the code: x'=x-Δ …(60) It becomes.

[0167] As a further verification, the key-utilized signature generation device 130 checks whether d in formula (59) satisfies a predetermined condition, and if it does not, rejects it (interrupts the process). The predetermined condition is, for example, that the similarity (e.g., Euclidean distance or cosine similarity) between the first biometric information w and the second biometric information w' is within a predetermined range. The reason for rejecting is that when the range of biometric information that should be determined to be biometric information of the same person is different from the difference absorbed by the correction ability of the code, by adding this rejection process, the signature is not accepted even if it was generated using biometric information that should be determined to be of a person different from that at the time of key generation, but the difference between the two pieces of biometric information is absorbed by the correction ability of the code. In the following, as a non-limiting example, the biometric information is a two-dimensional vector, and the Euclidean distance (L of the difference vector) is used as the similarity between the vectors of the two pieces of biometric information. 2 In FIG. 18, when the origin (black dot in the center) is the first biometric information w, the range of biometric information that should be determined to be biometric information of the same person is inside a circle (71) in which the Euclidean distance between two pieces of biometric information is within a predetermined range. However, when the Chebyshev distance (difference L ∞ The difference absorbed when evaluating the difference with the Euclidean distance (L norm) is inside the square (72) in FIG. 18. Therefore, inside the square (72), 2Although the biometric information in the area outside the circle (71) of the L norm is not the same person's biometric information as the biometric information w at the origin, it is determined to be a signature by the person because the difference is absorbed in a biometric signature, etc. When evaluating the difference in biometric information using a triangular lattice, the difference that is absorbed is inside the hexagon (73) in Figure 18, and ∞ The same thing happens with the norm. Euclidean distance and L ∞ The difference in range with norms etc. becomes greater in higher dimensions.

[0168] The Manhattan distance (L of the difference vector) is used as the similarity between two biometric vectors. 1 In FIG. 18, when the origin (black dot in the center) is the first biometric information w, the range of biometric information that should be determined as being of the same person is inside a rectangle (74) in which the Manhattan distance of two pieces of biometric information is within a predetermined range. ∞ The difference absorbed when evaluating the difference with the Euclidean distance (L norm) is inside the square (72) in FIG. 18. Therefore, inside the square (72), 2 Although the biometric information in the area outside the rectangle (74) of the L norm is not the same person's biometric information as the biometric information w at the origin, it is determined to be a signature by the person because the difference is absorbed in a biometric signature, etc. When evaluating the difference in biometric information using a triangular lattice, the difference that is absorbed is inside the hexagon (73) in Figure 18, and ∞ The same thing happens with the norm. Manhattan distance and L ∞ The difference in range with norms etc. becomes greater in higher dimensions.

[0169] The two pieces of biometric information, the first biometric information w and the second biometric information w', are not known to the key-based signature generation apparatus 130 (nor to the other apparatuses 120, 140, and 150). The encoding key ENC(x) and the first biometric information w cannot be separated from each other from the first parameter s in which the encoding key ENC(x) is embedded in the first biometric information w. Similarly, the encoding key ENC(Δ) and the second biometric information w' cannot be separated from the second parameter s'. Therefore, the key-based signature generation apparatus 130 calculates d in equation (59), and rejects d if it does not satisfy a predetermined condition. Note that the values ​​of ENC(x), ENC(Δ), and ENC(x-Δ) are not given to the key-based signature generation apparatus 130, and these values ​​cannot be directly known. For this reason, the second signature key generation unit 1342 of the key-based signature generation apparatus 130 uses the value ENC(x') obtained by encoding the second signature x' restored by the second signature key generation unit 1342 to generate the following: d = s - s' - ENC(x') ... (61) Calculate.

[0170] From equation (60), equation (61) is obtained as follows: d= s - s' - ENC(x') = s - s' - ENC(x-Δ) …(62) Then, by expanding s and s', the following holds due to the linearity of the code: d = (d1,…, d n ) =(w1,…, w n ) + ENC(x) - {(w'1, ..., w' n )+ENC(Δ)} - ENC(x-Δ) =(w1,…, w n ) -(w'1,…,w' n ) + ENC(x-Δ) - ENC(x-Δ) =(w1- w'1, … , w n -w' n ) …(63)

[0171] That is, under a linear code, d in equation (61) corresponds to the difference (vector subtraction) between the first biometric information w and the second biometric information w', which are n-dimensional vectors. The key-utilized signature generation device 130 verifies whether the difference between the first biometric information w and the second biometric information w' satisfies a predetermined condition.

[0172] The predetermined condition is the L of the difference d between the first biometric information w and the second biometric information w'. 2 The norm may be within a predetermined range. 2 The norm L2(d) corresponds to the distance between the vectors of the first biometric information w and the second biometric information w'. TIFF2025002445000006.tif24153 …(64) If Ld(2) is equal to or smaller than a predetermined threshold (L2(d)≦Th), the key-based signature generation device 130 generates a second signature σ′ for the message M using the second signature key x′ (=DEC(s-s′)) (4), and transmits the second signature σ′ to the biometric signature generation device 140 (5).

[0173] The predetermined condition is the L of the difference d between the first biometric information w and the second biometric information w'. 1 The norm may be within a predetermined range. In this case, the key-utilizing signature generation device 130 uses L of d instead of equation (64). 1 Norm TIFF2025002445000007.tif21153 …(65) and checks whether L1(d) is equal to or smaller than a predetermined threshold Th. If L1(d) is equal to or smaller than the predetermined threshold Th, the key-based signature generation device 130 generates a second signature σ' for the message M using the second signature key x' (=DEC(s-s')) (4), and transmits the second signature σ' to the biometric signature generation device 140 (5).

[0174] According to this embodiment, a value corresponding to the difference w-w' between the first biometric information w and the second biometric information w' is calculated from a first parameter s generated from the first biometric information w and a second parameter s' generated from the second biometric information w', and by verifying whether or not the value satisfies a predetermined condition, it is possible to improve the accuracy of confirming whether or not the first biometric information w and the second biometric information w' belong to the same person.

[0175] FIG. 16 is a diagram showing a schematic example of the configuration of each device of the fourth embodiment. In this embodiment, in contrast to the second embodiment (configuration shown in FIG. 3), the key-based signature generating device 130 is provided with a similarity verifying unit 1345. The configurations and processes of the key generating device 120, the biometric signature generating device 140, and the verification device 150 are the same as those of the second embodiment. The similarity verifying unit 1345 inputs a first parameter s and a second parameter s', and verifies whether or not the difference between the first biometric information w and the second biometric information w' satisfies a predetermined condition. The predetermined condition may be, for example, that the norm of the difference vector is within a predetermined range. In this case, the norm may be, for example, L 2 As an example, the similarity verification unit 1345 receives the first parameter s and the second parameter s', and calculates the L of the difference (d=s-s'-ENC(x')) between the first biometric information w and the second biometric information w' using the second signature key x' generated by the second signature key generation unit 1342. 2 The norm L2(d) (equation (64)) is calculated, and it is verified whether L2(d) is equal to or smaller than a predetermined threshold value Th.

[0176] FIG. 17 is a diagram for explaining an example of processing operations at the signature creation stage in the fourth embodiment. In the fourth embodiment, the processing operations at the key registration stage and signature verification are the same as the examples shown in FIG. 8 and FIG. 10 referred to in the description of the second embodiment. The difference between this embodiment and FIG. 9 referred to in the description of the second embodiment is that, as shown in FIG. 17, between the generation process of the second signature key x' (step B4) and the generation process of the second signature σ' (step B5), a verification is performed (step B7) as to whether the difference between the first biometric information w and the second biometric information w' satisfies a predetermined condition, and if the predetermined condition is satisfied (Yes branch of step B8), the generation process of the second signature σ' (step B5) is performed, and if the predetermined condition is not satisfied (No branch of step B8), the process is interrupted (step B9).

[0177] As a modification of the fourth embodiment, steps B7 and B8 in Fig. 17 may be inserted between the process of generating the second signature key x' (step B4) and the process of generating the second signature σ' (step B5) in Fig. 5 referred to in the description of the above embodiment. That is, in the key-utilizing signature generating device 130 in Fig. 2 referred to in the description of the above embodiment, a process of checking whether or not a value d corresponding to a difference between the first biometric information w and the second biometric information w' satisfies a predetermined condition (3A in Fig. 15) may be added between the process (3) of generating the second signature key x' by decrypting the difference between the first parameter s and the second parameter s' and the process (4) of generating the second signature σ'.

[0178] In the first to fourth embodiments, the key homomorphic computation algorithm for converting the second signature σ′ for a message M using the second signature key x′ into the first signature σ for the message M using the first signature key x (=x′+Δ) may be, in addition to σ←KHom(Δ,σ), one including Δ, σ, and the message M as in equation (66) (Non-Patent Document 2: 4.7 Randomizable SPS by Abe et al.), or one including Δ, σ, and M as in equation (67) (Non-Patent Document 2: 4.8 Ghadafi's Short SPS), in accordance with the signature algorithm. σ← KHom(Δ,σ',M) …(66) σ← KHom(Δ,σ', M, vk) …(67)

[0179] In the following, as another non-limiting example of the first to third embodiments, a case will be described in which biometric information is binary coded into binary data. · Number of bits in the codeword: n, - Number of allowable error bits: D, The first parameter generation unit 123 of the key generation device 120 encodes the first signature key x, and generates a first parameter s by bitwise exclusive or (xor) the encoded first signature key ENC(x) and the first biometric information w (n-bit binary data). s:=ENC(x) xor w …(68)

[0180] The first parameter generation unit 123 inputs the first signature key x (L bits) to an error correction encoding algorithm (Encode) and executes it to obtain an encoding key c (n bits). c = [c1, …, c n ] ← Encode(x) …(69) ci (i = 1, ... n) is the value of the i-th bit of c.

[0181] The coding key c for error correction coding may have a sum of the length of the information bits and the code bits of n bits. For example, in the Hamming code, the code length n = 2 k -1, the length of the information bit is L=nk.

[0182] Next, the first parameter generation unit 123 calculates the exclusive OR of the first biometric information w (n bits) and the encoding key c for each bit, and outputs the result as a first parameter s (n bits). s := w xor c = [w1xor c1,…, w n xor c n ] …(70)

[0183] The second parameter generation unit 1442 of the biometric signature generation device 140 generates a second parameter s' from the bitwise exclusive OR of the value ENC(Δ) obtained by encoding the differential key Δ and the second biometric information w' (step C4 in FIG. 5). s':=ENC(Δ) xor w' …(71)

[0184] The second parameter generation unit 1442 inputs the differential key Δ (L bits) to the encoding algorithm (Encode) of the error correction code and executes it, resulting in an n-bit encoding key c′. As described above, in the case of the Hamming code, the length of the codeword (information bits + code bits) n=2 k −1 (k is an integer equal to or greater than 3), and the length of the information bits is L. c' = [c'1, …, c' n ] ← Encode(Δ) …(72) c' i (i=1,…,n) is the value of the i-th bit of c'.

[0185] Next, the second parameter generation unit 1442 calculates the exclusive OR of the second biometric information w' (n bits) and the encoding key c' for each bit, and outputs the result as a second parameter s' (n bits). s'← w' xor c' = [w'1xor c'1, w'2xor c'2,…, w' n xor c' n ] …(73)

[0186] The second parameter / message transmitting unit 1443 of the biometric signature generation apparatus 140 transmits the second parameter s' and the message M to the key-based signature generation apparatus 130 (step C5 in FIG. 5).

[0187] The second signature key generation unit 1342 of the key-utilizing signature generation device 130 performs a bitwise exclusive OR of the first parameter s and the second parameter s′: t:=s xor s' …(74) The decrypted value is set as the second signature key x' (Step B4 in FIG. 5). x'←Decode(t) …(75)

[0188] t=s xor s' =[w1xor c1, …, w n xor c n ] xor [w'1 xor c'1,…, w' n xor c' n ] = [(w1xor c1) xor (w'1xor c'1), …, (w n xor c n ) xor (w' n xor c' n )] =[w1xor w'1, …, w n xor w' n ] xor [c1 xor c'1, …, c n xor c' n ] = (w xor w') xor (ENC(x) xor ENC(Δ)) …(76)

[0189] Since we use linear codes, equation (76) becomes t= (w xor w') xor ENC(x xor Δ) …(77) It becomes.

[0190] When the difference (Hamming distance) between the first biometric information w and the second biometric information w′ is equal to or smaller than the error correction capability D of the linear code, the distance between ENC(x xor Δ) and t is also equal to or smaller than D.

[0191] because, ENC(x xor Δ) xor t =ENC(x xor Δ) xor ((w xor w′)xor ENC(x xor Δ)) =w xor w′ …(78) This is because the difference between ENC(x xor Δ) and t is equal to the difference (Hamming distance) between the first biometric information w and the second biometric information w′.

[0192] Therefore, (x xor Δ) is restored by executing the restoration algorithm Decode(t) from t whose difference with the codeword ENC(x xor Δ) obtained by encoding (x xor Δ) is less than or equal to D. x'=(x xor Δ)←Decode(t) …(79)

[0193] That is, it is possible to verify that the second signing key x'=x xor Δ is correctly calculated from the bitwise exclusive-OR operation of the first parameter s and the second parameter s'.

[0194] FIG. 19 is a schematic diagram for explaining an example in which each device (120, 130, 140, 150) of the above-mentioned digital signature system 100 is implemented by a computer having a communication function and communicatively connectable with each other via a network. In FIG. 19(A), each device (120, 130, 140, 150) includes a processor 201, a storage device 202, an input device / output device 203, and a communication interface 204. The storage device 202 may be configured to include semiconductor storage such as a RAM (Random Access Memory), a ROM (Read Only Memory), or an EEPROM (Electrically Erasable and Programmable ROM), a HDD (Hard Disk Drive), a CD (Compact Disc), a DVD (Digital Versatile Disc), etc. The processor 201 executes a program (not shown) stored in the storage device 202 to realize the processing and functions of each device. The input device / output device 203 may be configured to include a keyboard and a display. For example, the key-based signature generation device 130 may be configured to display and output the verification result (acceptance / rejection) in the verification device 150 on an output device such as a display. In the key generation device 120 and the biometric signature generation device 140 that acquire biometric information, the input device / output device 203 may be configured to include a sensor that acquires biometric information. In this case, the sensor may be an image sensor (camera) when the biometric information is a face, iris, etc., or a fingerprint sensor when the biometric information is a fingerprint, or a near-infrared camera that captures the light that has passed through the finger when the biometric information is a fingerprint. The sensor may be, for example, an LED (Light Emitting Diode) that irradiates near-infrared rays and a near-infrared camera that captures the light that has passed through the finger. The sensor may be a removable sensor such as a USB (Universal Serial Bus) device. The communication interface 204 may be configured to include a network interface card, a transceiver, etc., and to be communicatively connected to each other via a LAN (Local Area Network), a WAN (Wide Area Network) such as the Internet, a wireless LAN, a mobile communication network, etc.Furthermore, the communication interface 204 may be configured to include an interface for communicating with an external sensor (such as a Bluetooth (registered trademark)-connected sensor) in the key generating device 120 or the biometric signature generating device 140 and receiving biometric information acquired by the external sensor.

[0195] FIG. 19(B) is a diagram for explaining an example in which the above-mentioned devices (120, 130, 140, 150) of the digital signature system 100 are implemented as virtual machines using server virtualization technology. A plurality of virtual machines VM run on a virtualization platform 302 such as a hypervisor implemented on a physical machine 301 of a server. One or more of the devices (120, 130, 140, 150) of the digital signature system 100 may be implemented as a virtual machine VM. Although there is one physical server, a virtual server environment in which multiple servers run is provided. Each virtual machine VM is preferably set to operate in an isolated environment in memory space. In this case, in the virtual machine VM, a program for realizing the processing of any one of the devices (120, 130, 140, 150) runs on the virtual OS (Operating System) of the virtual machine. A virtual machine VM that virtually realizes any of the devices (120, 130, 140, 150) may be configured to communicate with other virtual machines via a virtual network, or may be configured to communicate with other devices among the devices (120, 130, 140, 150) via a physical interface (communication interface) of the physical machine 301 via a LAN, a WAN such as the Internet, or the like.

[0196] In the above embodiment, a system that performs processing based on biometric information has been described as an example, but the present disclosure is not limited to biometric information and can be realized using fuzzy information other than biometric information. For example, the present disclosure may be applied to a PUF (Physically Unclonable Function: a technology that uses individual differences that occur during the manufacturing process of IC chips to identify individuals (IC chips) like human fingerprints) that identifies semiconductor devices (IC (Integrated Circuit) chips.

[0197] Although the example of using a square lattice for encoding in equations (31), (40), etc. has been described as a non-limiting example, it is of course possible to use error correction codes such as RS codes, BCH codes, etc. Furthermore, the biometric information is not limited to real vectors, and it is of course possible to use integer vectors.

[0198] The above-described embodiment is supplemented as follows (but is not limited to the following).

[0199] (Supplementary Note 1) A digital signature system includes a first signature generation device and a second signature generation device, each of which includes at least a processor and a communication interface, and which are communicatively connected to each other. the second signature generating device executes a process of receiving a first parameter created using at least the first biometric information and storing the first parameter in a storage unit; the first signature generation device executes a process of generating a second parameter using at least a second biometric information and transmitting the second parameter to the second signature generation device; the second signature generation device executes a process of generating a second signature for a message to be signed from the first parameters and the second parameters, and transmitting the second signature to the first signature generation device; The first signature generation device executes a process of generating and outputting a first signature for the message based on at least the second signature.

[0200] (Supplementary Note 2) In the digital signature system of Supplementary Note 1, the first signature generating device generates the second parameter by using the second biometric information and a differential key; the second signature generation device generates a second signature key from the first parameters and the second parameters, and generates the second signature key for the message using the second signature key; The first signature generation device uses the differential key and the second signature to generate the first signature when signing the message with a first signature key.

[0201] (Supplementary Note 3) In the digital signature system of Supplementary Note 1, the second signature generating device storing one or more of the first parameters in the storage unit in association with an ID (identifier) ​​that identifies the first parameters; The first signature generating device Sending an ID corresponding to the first parameter to be selected to the second signature generating device; The second signature generating device The first parameter corresponding to the ID transmitted from the first signature generation device is obtained from the memory unit, and the second signature for the message is generated from the first parameter corresponding to the ID and the second parameter.

[0202] (Appendix 4) In the digital signature system of Appendix 2, comprising at least a processor and a communication interface; generating a first signing key and a verification key corresponding to the first signing key; acquiring the first biometric information, generating the first parameter using the first signature key and the first biometric information, and transmitting the first parameter to the second signature generating device; A key generating device for executing the process; comprising at least a processor and a communication interface; verifying the authenticity of the message and the first signature pair using the verification key; A verification device for executing the process; It further comprises:

[0203] (Appendix 5) In the digital signature system of Appendix 3, a key generation device including at least a processor and a communication interface, and configured to execute the following processes: generate the first signature key and a verification key corresponding to the first signature key, obtain the first biometric information, generate the first parameter using the first signature key and the first biometric information, and transmit the first parameter to the first signature generation device; and a verification device that has at least a processor and a communication interface, and that executes a process of verifying the correctness of the pair of the message and the first signature using the verification key. the key generation device generates a plurality of the first parameters corresponding to a plurality of pairs of the first signature key and the verification key, and transmits the plurality of first parameters to the second signature generation device; the first signature generation device transmits the first signature generated using at least a differential key and the second signature and the message together with the ID to the verification device; The verification device receives the first signature, the message, and the ID, obtains the verification key corresponding to the ID, and verifies the correctness of the set of the message and the first signature using the verification key corresponding to the ID.

[0204] (Supplementary Note 6) In the digital signature system according to any one of Supplements 1 to 4, the first parameter is generated using a coding key obtained by coding the first signature key and the first biometric information.

[0205] (Supplementary Note 7) In the digital signature system of Supplementary Note 5, the ID is a hash value of the verification key.

[0206] (Supplementary Note 8) In the digital signature system of Supplementary Note 2 or 4, the first signature generation device performs a process of verifying the correctness of the pair of the message and the first signature using a verification key corresponding to the first signature key.

[0207] (Supplementary Note 9) In any of the digital signature systems of Supplements 1 to 7, the second signature generation device calculates a difference between the first and second biometric information based on at least the first parameter and the second parameter, verifies whether the difference satisfies a predetermined condition, and interrupts processing if the difference does not satisfy the predetermined condition.

[0208] (Supplementary Note 10) In the digital signature system of Supplementary Note 9, the predetermined condition is that the norm of the difference between the first biometric information and the second biometric information is included within a predetermined range.

[0209] (Appendix 11) In the digital signature system of appendix 10, the norm is L 2 This is the norm.

[0210] (Appendix 12) A digital signature method includes a step of: a second node receives a first parameter created using at least a first biometric information and stores the first parameter in a storage unit; A first node generates second parameters using at least a second biometric, and transmits the second parameters and a message to be signed to the second node; the second node generates a second signature for the message from the first parameters and the second parameters and sends the second signature to the first node; The first node generates and outputs a first signature for the message based on the second signature.

[0211] (Supplementary Note 13) In the digital signature method according to Supplementary Note 12, the first node generates the second parameter by using the second biometric information and a differential key; the second node generates a second signing key from the first parameters and the second parameters, and uses the second signing key to generate the second signing key for the message; The first node uses the difference key and the second signature to generate the first signature when signing the message with a first signature key.

[0212] (Supplementary Note 14) In the digital signature method according to Supplementary Note 12, the second node stores the one or more first parameters in the storage unit in association with an ID (identifier) ​​that identifies the first parameters; The first node transmits an ID corresponding to the first parameter to be selected to the second node; The second node retrieves the first parameter corresponding to the ID transmitted from the first node from the memory unit, and generates the second signature for the message from the first parameter corresponding to the ID and the second parameter.

[0213] (Supplementary Note 15) In the digital signature method of Supplementary Note 13, a third node generates the first signing key and a verification key corresponding to the first signing key, obtains the first biometric information, generates the first parameter using the first signing key and the first biometric information, and transmits the first parameter to the second node; A fourth node verifies the accuracy of the message and the first signature pair using the verification key.

[0214] (Supplementary Note 16) In the digital signature method of Supplementary Note 14, a third node generates the first signing key and a verification key corresponding to the first signing key, obtains the first biometric information, generates the first parameter using the first signing key and the first biometric information, and transmits the first parameter to the first node; a fourth node executes a process for verifying the correctness of a pair of the message and the first signature, the third node generates a plurality of the first parameters corresponding to a plurality of pairs of the first signature key and the verification key, and transmits the plurality of first parameters to the second node; The first node transmits the first signature generated using at least a differential key and the second signature and the message together with the ID to the fourth node; The fourth node receives the first signature, the message, and the ID, obtains the verification key corresponding to the ID, and verifies the correctness of the pair of the message and the first signature using the verification key corresponding to the ID.

[0215] (Supplementary Note 17) In the digital signature method according to any one of Supplementary Notes 13 to 16, the first parameter is generated using a coding key obtained by coding the first signature key and the first biometric information.

[0216] (Appendix 18) In the digital signature method of appendix 14 or 15, The ID is the hash value of the verification key.

[0217] (Supplementary Note 19) In any of the digital signature methods of Supplementary Notes 12 to 18, the first node performs a process of verifying the correctness of a pair of the message and the first signature using a verification key corresponding to the first signature key.

[0218] (Supplementary Note 20) In any of the digital signature methods of Supplementary Notes 12 to 18, the second node calculates a difference between the first and second biometric information based on at least the first parameter and the second parameter, verifies whether the difference satisfies a predetermined condition, and interrupts processing if the difference does not satisfy the predetermined condition.

[0219] (Supplementary Note 21) In the digital signature method of Supplementary Note 20, the predetermined condition is that the norm of the difference between the first biometric information and the second biometric information is included within a predetermined range.

[0220] (Appendix 22) In the digital signature method of appendix 21, the norm is L 2 This is the norm.

[0221] (Appendix 23) The recording medium is A process by a second processing device to receive a first parameter created using at least the first biometric information and store the first parameter in a storage unit; A process by a first processing device of generating second parameters using at least the second biometric information and transmitting the second parameters and a message to be signed to the second processing device; a process of generating a second signature for the message from the first parameter and the second parameter by the second processing device, and transmitting the second signature to the first processing device; The device stores a program that causes the first and second processing devices, which are communicatively connected to each other, to each execute a process by the first processing device to generate and output a first signature for the message using at least the second signature.

[0222] The disclosures of the above Patent Documents 1 and 2 and Non-Patent Documents 1 and 2 are incorporated herein by reference. Modifications, adjustments, and combinations of the embodiments and examples are possible within the scope of the disclosure of this application (including the scope of claims), and further based on the basic technical ideas. Furthermore, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each example, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. In other words, the present disclosure naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure, including the scope of claims, and the technical ideas. [Explanation of symbols]

[0223] 71 L 2 Norm (circle) 72 L ∞ Norm(square) 73 Triangular lattice (hexagon) 74 L 1 Norm 100 Digital Signature System 120 Key generation device 121 Biometric information acquisition unit 122 Signing and Verification Key Generation Unit 123 First parameter generation unit 124 Verification key transmission unit 125 First parameter transmission unit 130 Key-based signature generation device 131 First parameter receiving unit 132 Storage section 134 Signature generation section 1341 Second parameter message receiver 1342 Second Signature Key Generation Unit 1343 Second Signature Generation Unit 1344 Second signature transmission section 1345 Similarity Verification Department 140 Biometric signature generation device 141 Biometric information acquisition unit 142 Message Acquisition Unit 144 Signature generation section 1441 Differential key generation unit 1442 Second Parameter Generation Unit 1443 Second parameter message sender 1444 Second Signature Receiving Unit 1445 First Signature Generation Unit 145 Transmitter 146 Signature Verification Unit 150 Verification Device 151 Verification key receiver 152 Storage section 153 Signature and Message Reception Department 154 Signature Verification Unit 200 Computers 201 Processor 202 Storage device 203 Input Device / Output Device 204 Communication Interface 300 Servers 301 Physical Machine 302 Virtualization Platform 303 Virtual Machines

Claims

1. a first signature generation device and a second signature generation device, each of which has at least a processor and a communication interface and is communicatively connected to each other; The second signature generating device Executing a process of receiving a first parameter created using at least the first biometric information and storing the first parameter in a storage unit; The first signature generating device performing a process of generating second parameters using at least second biometric information and transmitting the second parameters to the second signature generating device; The second signature generating device generating a second signature for a message to be signed from the first parameters and the second parameters, and transmitting the second signature to the first signature generating device; The first signature generating device and performing a process to generate and output a first signature for the message based on at least the second signature.

2. The first signature generating device generating the second parameter using the second biometric information and a differential key; The second signature generating device generating a second signing key from the first parameters and the second parameters, and using the second signing key to generate the second signing key for the message; The first signature generating device 2. The digital signature system according to claim 1, further comprising: a first signature generating unit configured to generate the first signature when the message is signed with a first signature key using the difference key and the second signature.

3. The second signature generating device storing one or more of the first parameters in the storage unit in association with an ID (identifier) ​​that identifies the first parameters; The first signature generating device Sending an ID corresponding to the first parameter to be selected to the second signature generating device; The second signature generating device 3. The digital signature system of claim 2, further comprising: obtaining from the memory unit the first parameter corresponding to the ID transmitted from the first signature generation device; and generating the second signature for the message from the first parameter corresponding to the ID and the second parameter.

4. comprising at least a processor and a communication interface; generating a first signature key and a verification key corresponding to the first signature key; acquiring the first biometric information, generating the first parameter using the first signature key and the first biometric information, and transmitting the first parameter to the second signature generating device; A key generating device for executing the process; comprising at least a processor and a communication interface; verifying the authenticity of the message and the first signature pair using the verification key; A verification device for executing the process; The digital signature system of claim 2 further comprising:

5. comprising at least a processor and a communication interface; generating a first signature key and a verification key corresponding to the first signature key; acquiring the first biometric information, and generating the first parameter using the first signature key and the first biometric information; transmitting the first parameters to the first signature generation device; A key generating device for executing the process; comprising at least a processor and a communication interface; a verification device that uses the verification key to verify the authenticity of a pair of the message and the first signature; Equipped with The key generating device includes: generating a plurality of the first parameters corresponding to a plurality of pairs of the first signature key and the verification key, and transmitting the plurality of first parameters to the second signature generating device; The verification device includes:

4. The digital signature system of claim 3, further comprising: receiving the first signature, the message, and the ID; obtaining the verification key corresponding to the ID; and verifying the correctness of the set of the message and the first signature using the verification key corresponding to the ID.

6. 6. The digital signature system according to claim 4, wherein the first parameter is generated using a coding key obtained by coding the first signature key and the first biometric information.

7. 6. The digital signature system according to claim 5, wherein the ID is a hash value of the verification key.

8. 5. The digital signature system according to claim 2, wherein the first signature generation device executes a process of verifying the correctness of a pair of the message and the first signature by using a verification key corresponding to the first signing key.

9. 6. The digital signature system according to claim 1, wherein the second signature generation device calculates a difference between the first biometric information and the second biometric information based on at least the first parameter and the second parameter, verifies whether the difference satisfies a predetermined condition, and interrupts processing if the difference does not satisfy the predetermined condition.

10. 10. The digital signature system according to claim 9, wherein the predetermined condition is that the norm of the difference between the first biometric information and the second biometric information is included within a predetermined range.

11. The norm is L ２ 11. The digital signature system of claim 10, wherein the signature is a norm.

12. A second node receives a first parameter created using at least the first biometric information and stores the first parameter in a storage unit; A first node generates a second parameter using at least a second biometric, and transmits the second parameter and a message to be signed to the second node; the second node generates a second signature for the message from the first parameter and the second parameter and transmits the second signature to the first node; The digital signature method, wherein the first node generates and outputs a first signature for the message based on the second signature.

13. A process by a second processing device to receive a first parameter created using at least the first biometric information and store the first parameter in a storage unit; A process by a first processing device of generating a second parameter using at least the second biometric information and transmitting the second parameter and a message to be signed to the second processing device; a process of generating a second signature for the message from the first parameter and the second parameter by the second processing device, and transmitting the second signature to the first processing device; A recording medium having recorded thereon a program that causes the first processing device and the second processing device, which are communicatively connected to each other, to each execute a process in which the first processing device uses at least the second signature to generate and output a first signature for the message.

Images