Key generation method and key generation system

Abstract

To provide a key generation method and a key generation system capable of achieving encryption with high security even when supplementary information is leaked.SOLUTION: The key generation system executes the following steps: storing a feature vector for registration obtained by applying the predetermined algorithm to a piece of measurement information for registration; randomly generating a conversion parameter; converting the feature vector for registration into a conversion feature vector for registration based on a predetermined conversion function and a conversion parameter; generating a piece of supplementary information and a registration key based on a conversion feature vector for registration; and storing the conversion parameters and the supplementary information. The predetermined conversion function is a function that preserves the distance between feature vectors.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a key generation method and a key generation system. [Background technology]

[0002] Biometric authentication technology that authenticates individuals based on biometric information such as fingerprints, veins, faces, and irises is widely used. Conventional biometric authentication technology registers feature data (auxiliary information) extracted from a user's biometric information in a system when the user is registered, and when the user is authenticated, if the distance between the feature data extracted from the user's biometric information and the auxiliary information is sufficiently close, the authentication is determined to be successful, and if not, the authentication is determined to be unsuccessful.

[0003] However, since biometric information is generally irreplaceable, once it is leaked, it becomes a major problem. In response to this problem, research and development is being conducted on supplementary information protection type biometric authentication technology that authenticates while keeping biometric information secret. Among supplementary information protection type biometric authentication technologies, a technology called biometric encryption, which generates key data from biometric information and performs processes such as cryptographic authentication, encryption, and signature generation, is attracting attention.

[0004] In biometric encryption, auxiliary information H, key K, and verification information V for key K are created from biometric information feature data X at the time of enrollment, and only the auxiliary information H and verification information V are stored. After that, biometric encryption restores key K' from newly acquired biometric information feature data X' and auxiliary information H, and verifies whether K'=K using the verification information V.

[0005] In biometric encryption, if the restoration is successful (K' = K), the key K can be used to perform processes such as cryptographic authentication, encryption, decryption, and digital signature generation. In biometric encryption, it must be sufficiently difficult to restore or estimate the feature data X from the auxiliary information H (security requirement). Also, in biometric encryption, if and only if the distance between the feature data X' and the feature data X is close, the key restoration process must be successful.

[0006] The method of implementing biometric encryption varies depending on the mathematical properties of the feature data space, and various methods have been proposed. Patent Document 1 (JP 2021-087167 A) shows a method applicable to a feature data space that is an n-dimensional Euclidean space (a real vector space in which distance is defined by Euclidean distance), Non-Patent Document 1 shows a method applicable to a feature data space that is an n-dimensional L∞ space (a real vector space in which distance is defined by L∞ distance), and Non-Patent Document 2 shows a method applicable to a feature data space that is an n-dimensional Hamming space (an n-bit space in which distance is defined by Hamming distance).

[0007] In all of the methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2, auxiliary information H is generated by H=X+C using a vector C that is randomly selected from a finite subset of the feature vector space (a lattice in Patent Document 1 and Non-Patent Document 1, and a codebook of error-correcting codes in Non-Patent Document 2) and appropriately scaled (multiplied by a constant).

[0008] In the methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2, the key K and the verification information V are generated from pseudorandom numbers obtained by inputting the vector C or the feature data X (and an externally provided random number as necessary) to a cryptographic hash function or a pseudorandom number function. The verification information V may be such that (K, V) is a pair of (private key, public key) in a public key cryptography algorithm, or may be obtained by V=Hash(K) using a hash function Hash.

[0009] The methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2 have the advantage that even if auxiliary information H is leaked, the feature data X is kept secret due to the randomness of vector C, and the key K is difficult to calculate even if verification information V is leaked. Therefore, the methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2 achieve higher security than a normal biometric authentication system that needs to store feature data and a normal encryption system that needs to store a key. [Prior art documents] [Patent documents]

[0010] [Patent Document 1] Patent Publication No. 2021-087167 [Non-patent literature]

[0011] [Non-Patent Document 1] Dodis Y., Reyzin L., Smith A. “Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data”, In: Cachin C., Camenisch JL (eds) “Advances in Cryptology - EUROCRYPT 2004”, Lecture Notes in Computer Science, vol 3027, pages 523-540, Springer, Berlin, Heidelberg, 2004 [Non-Patent Document 2] Gang Zheng, Wanqing Li, and Ce Zhan. “Cryptographic key generation from biometric data using lattice mapping”, In 18th International Conference on Pattern Recognition (ICPR'06), volume 4, pages 513-516. IEEE, 2006 Summary of the Invention [Problem to be solved by the invention]

[0012] However, in all of the methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2, auxiliary information H is generated by H=X+C, but vector C is an element of a subset of the feature vector space, so the feature data X cannot be kept completely secret. Therefore, in the methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2, if the auxiliary information H is leaked and falls into the hands of an attacker, the attacker may obtain partial information regarding X.

[0013] Therefore, one aspect of the present invention aims to make it difficult for an attacker to obtain partial information of feature data from auxiliary information, and ultimately to realize encryption that has high security even if the auxiliary information is leaked. [Means for solving the problem]

[0014] In order to achieve the above object, one aspect of the present invention employs the following configuration: In a key generation method in which a key generation system generates an error-free key from measurement information measured with error, the key generation system holds a feature vector for registration obtained by applying a predetermined algorithm to measurement information for registration, randomly generates transformation parameters, transforms the feature vector for registration into a transformed feature vector for registration based on a predetermined transformation function and the transformation parameters, generates auxiliary information and a key for registration based on the transformed feature vector for registration, stores the transformation parameters and the auxiliary information in the memory, and the predetermined transformation function is a function that preserves a distance between feature vectors. Effect of the Invention

[0015] According to one aspect of the present invention, it is possible to realize encryption that is highly secure even if auxiliary information is leaked.

[0016] Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0017] [Figure 1]1 is a block diagram showing a configuration example of a biometric authentication system according to a first embodiment. [Diagram 2] 2 is a block diagram showing an example of the hardware configuration of a registration terminal, a usage terminal, and a server according to the first embodiment. FIG. [Diagram 3] 11 is a flowchart illustrating an example of a registration process according to the first embodiment. [Figure 4] 11 is a flowchart illustrating an example of a key use process according to the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components are generally designated by the same reference numerals, and repeated explanations are omitted. Note that this embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention. EXAMPLES

[0019] In this embodiment, a biometric authentication system using biometric encryption will be described. The biometric authentication system extracts feature data X from a user's biometric information, and converts and conceals X based on a random conversion parameter P. The biometric authentication system creates auxiliary information H, a key K, and verification information V, and registers the conversion parameter P, auxiliary information H, and verification information V. When using the key, the biometric authentication system restores the key K using the conversion parameter P, auxiliary information H, and newly acquired biometric information, verifies proof information (described later) using the verification information V, and performs encryption-related processing (e.g., authentication, electronic signature, and / or data encryption / decryption, etc.) using the key K. The biometric authentication system is an example of a key generation system.

[0020] 1 is a block diagram showing an example of the configuration of a biometric authentication system. The biometric authentication system includes a registration terminal 100, a user terminal 110, and a server 130, which are connected to each other via a network 140 such as the Internet.

[0021] The registration terminal 100 acquires biometric information of the user, generates a conversion parameter P, auxiliary information H, a key K, and verification information V, and registers the conversion parameter P, auxiliary information H, and verification information V in the server 130. The usage terminal 110 acquires biometric information of the user, restores the key K, and performs encryption-related processing. The server 130 registers and manages the conversion parameter P, auxiliary information H, and verification information V.

[0022] Any two or all three of the registration terminal 100, the use terminal 110, and the server 130 may be implemented in the same machine or device. Also, when all three of the registration terminal 100, the use terminal 110, and the server 130 are implemented in the same machine or device, the network 140 may not be necessary. Also, when the registration terminal 100 and the use terminal 110 are separate devices, the registration terminal 100 and the use terminal 110 do not have to be connected by the network 140.

[0023] The registration terminal 100 has, for example, an ID input function 101, a biometric information acquisition function 102, a feature extraction function 103, a conversion parameter generation function 104, a feature conversion function 105, an auxiliary information generation function 106, a key / verification information generation function 107, a cryptography-related function 108, and a registration function 109.

[0024] The ID input function 101 accepts input of a user ID. The biometric information acquisition function 102 acquires biometric information for registration, such as the user's face and veins, via a biometric sensor described below. The feature extraction function 103 extracts feature data X for registration from the biometric information for registration.

[0025] The conversion parameter generation function 104 generates conversion parameters P for converting the registration feature data X. The feature conversion function 105 converts the registration feature data X using the conversion parameters P to generate registration converted feature data Y. The auxiliary information generation function 106 generates auxiliary information H from the registration converted feature data Y.

[0026] The key and verification information generation function 107 generates a key K and verification information V from the registration transformation characteristic data Y and auxiliary information H. The encryption-related function 108 performs any processing using the key K, such as digital signature or encryption. The registration function 109 registers the transformation parameters P, the auxiliary information H, and the verification information V in the server 130.

[0027] The user terminal 110 has, for example, an ID input / search function 111 , a biometric information acquisition function 112 , a feature extraction function 113 , a feature conversion function 114 , a key recovery function 115 , a proof information generation function 116 , and a cryptography-related function 117 .

[0028] The ID input / search function 111 accepts input of a user ID, requests the server 130 to search for conversion parameters P and auxiliary information H corresponding to the input user ID, and acquires the searched conversion parameters P and auxiliary information H from the server 130. The biometric information acquisition function 112 acquires registration biometric information such as the user's face, veins, etc. via a biometric sensor described later.

[0029] The feature extraction function 113 extracts feature data X' from the biometric information acquired by the biometric information acquisition function 112. The feature conversion function 114 converts the feature data X' using the conversion parameter P to generate converted feature data Y'.

[0030] The key recovery function 115 recovers the key K' from the conversion characteristic data Y' and the auxiliary information H. The proof information generation function 116 generates proof information for proving that the key K' is equal to the key K, and transmits it to the server 130. The encryption-related function 117 performs processes such as authentication, encryption, decryption, and / or digital signature generation using the key K'.

[0031] The server 130 includes, for example, a registration function 131, a search function 132, and a proof verification function 133. The registration function 131 registers the conversion parameters P, the auxiliary information H, and the verification information V in a DB (DataBase) by linking them with a user ID.

[0032] The search function 132 searches each DB for the conversion parameters P, auxiliary information H, and verification information V using the user ID received from the user terminal 110 as a key, and transmits the searched conversion parameters P and auxiliary information H to the user terminal 110. The proof verification function 133 compares the proof information received from the user terminal 110 with the verification information V searched by the search function 132, and verifies whether the key K' and the key K are equal.

[0033] The server 130 has a conversion parameter DB 134, an auxiliary information DB 135, and a verification information DB 136. The conversion parameter DB 134 holds the conversion parameter P of each user in association with the user ID of the user. The auxiliary information DB 135 holds the auxiliary information H of each user in association with the user ID of the user. The verification information DB 136 holds the verification information V of each user in association with the user ID of the user ID.

[0034] The DBs held by server 130 may be managed as one DB, or may be managed under different administrator authority, or each DB may be managed by a different server 130.

[0035] Furthermore, one or more of the conversion parameters P, auxiliary information H, and verification information V may be stored and managed in the user terminal 110, or in a portable medium such as an integrated circuit (IC) card, a universal serial bus (USB) memory, a mobile terminal, or a two-dimensionally coded and printed paper. In this manner, the conversion parameters P, auxiliary information H, and verification information V are managed in a distributed manner, thereby improving safety against the risk of leakage of the conversion parameters P, auxiliary information H, and verification information V.

[0036] 2 is a block diagram showing an example of the hardware configuration of each of the registration terminal 100, the user terminal 110, and the server 130. Each of the registration terminal 100, the user terminal 110, and the server 130 is configured by a computer having, for example, a CPU (Central Processing Unit) 400, a memory 401, a storage 402, an input device 403, an output device 404, a communication device 405, and a biosensor 406. However, the computer configuring the server 130 does not need to have the biosensor 406.

[0037] The CPU 400 includes a processor and executes programs stored in the memory 401. The memory 401 includes a ROM (Read Only Memory), which is a non-volatile storage element, and a RAM (Random Access Memory), which is a volatile storage element. The ROM stores immutable programs (e.g., a Basic Input / Output System (BIOS)). The RAM is a high-speed, volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by the CPU 400 and data used when the programs are executed.

[0038] The storage 402 is, for example, a large-capacity nonvolatile auxiliary storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or a flash memory (SSD (Solid State Drive)), and stores programs executed by the CPU 400 and data used when the programs are executed. That is, the programs are read from the storage 402, loaded into the memory 401, and executed by the CPU 400.

[0039] The input device 403 is a device such as a keyboard or a mouse that receives input from an operator. The output device 404 is a device such as a display device or a printer that outputs the results of program execution in a format that can be viewed by the operator.

[0040] The communication device 405 is a network interface device that controls communication with other devices in accordance with a predetermined protocol, and includes a serial interface such as a Universal Serial Bus (USB).

[0041] The biosensor 406 is a sensor for acquiring a predetermined type of biometric information. The biosensor 406 of the registration terminal 100 and the biosensor 406 of the utilization terminal 110 are sensors for acquiring the same type of biometric information.

[0042] Some or all of the programs executed by CPU 400 may be provided to the computers constituting registration terminal 100, user terminal 110, and server 130 from removable media (CD-ROM, flash memory, etc.) which are non-transitory storage media or from an external computer equipped with a non-transitory storage device via network 140, and stored in non-volatile storage 402 which is a non-transitory storage medium. For this reason, the computers constituting registration terminal 100, user terminal 110, and server 130 may each have an interface for reading data from removable media.

[0043] Each of the registration terminal 100, the usage terminal 110, and the server 130 is a computer system configured on a single physical computer, or on multiple logically or physically configured computers, and may operate in separate threads on the same computer, or may operate on a virtual computer constructed on multiple physical computer resources.

[0044] A CPU 400 of a computer constituting the registration terminal 100 operates according to an ID input program loaded into a memory 401 of the computer to function as an ID input function 101, and operates according to a biometric information acquisition program loaded into the memory 401 of the computer to function as a biometric information acquisition function 102. The relationships between the programs and other functions of the registration terminal 100 are similar. The relationships between the programs and other functions of the user terminal 110 and the server 130 are similar.

[0045] Some or all of the functions of the registration terminal 100, the usage terminal 110, and the server 130 may be realized by hardware such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0046] The storage 402 of the computer constituting the server 130 stores each DB of the server 130. Note that in this embodiment, the information used by the authentication system may be expressed in any data structure independent of the data structure. For example, the information may be stored in a data structure appropriately selected from a table, a list, a database, or a queue.

[0047] 3 is a flowchart showing an example of the registration process. The ID input function 101 of the registration terminal 100 starts the registration process in response to an input from a user or an operator to the input device 403 of the registration terminal 100, and acquires the user ID (S201).

[0048] The biometric information acquisition function 102 acquires the user's biometric information for registration (an example of the measurement information for registration) via the biometric sensor 406 of the registration terminal 100 (S202). Here, the biometric information may be an image or a moving image of a part of the body such as a face, a hand, a finger, an eye, a vein, an iris, or a retina, captured with light of any predetermined wavelength such as visible light, infrared light, near-infrared light, or X-rays, or may be a voice signal when speaking or signal information obtained as a result of various body measurements. The biometric information may also be data obtained by measuring a handwritten sign, a gesture, or a behavior. The same applies to the biometric information for key recovery in the key use process described later.

[0049] The feature extraction function 103 extracts feature data X for registration (an example of a feature vector for registration) from the biometric information for registration acquired in step S202 using a predetermined algorithm (S203). The feature data X for registration may be expressed in the form of an image, a vector, a signal, or one or more numerical values, but can be mathematically interpreted as a vector in a vector space (distance vector space) in which a predetermined distance function d(·,·) is defined.

[0050] The conversion parameter generation function 104 randomly generates the conversion parameters P (S204). A specific example of a method for generating the conversion parameters P will be described later.

[0051] The feature transformation function 105 transforms the feature data X for registration using a predetermined transformation function f and transformation parameters P to generate transformed feature data Y for registration = f(X,P) (an example of a transformed feature vector for registration) (S205). Here, the transformation function f satisfies a condition d(f(X,P),f(X',P)) = d(X,X') (hereinafter referred to as condition 1) for any transformation parameter P and any pair of feature data X and X'. Therefore, the transformation function f is configured to preserve the distance between any two vectors when the transformation parameters are fixed. A specific example of the transformation method will be described later.

[0052] The transformation function f may be a function that keeps the distance between any two vectors constant (the distance between the two vectors before transformation is equal to the distance between the two vectors after transformation) as in condition 1, or may be a function that preserves the distance between any two vectors so that they generally match (that is, the difference between the distance between the two vectors before transformation and the distance between the two vectors after transformation is equal to or less than a predetermined value). In other words, preserving the distance between any two vectors may be a concept that includes both keeping the distance between any two vectors constant and making the distance between any two vectors generally match.

[0053] The auxiliary information generating function 106 generates auxiliary information H from the registration conversion feature data Y (S206). A specific example of a method for generating the auxiliary information H will be described later.

[0054] The key / verification information generation function 107 generates (S207) a key K (an example of a registration key) and verification information V from the registration conversion characteristic data Y and auxiliary information H. A specific example of a method for generating the key K and the verification information V will be described later.

[0055] The encryption-related function 108 performs encryption-related processing using the key K (S208). The encryption-related processing includes, for example, encryption of predetermined data and generation of a digital signature.

[0056] The registration function 109 transmits the user ID, the conversion parameters P, the auxiliary information H, and the verification information V to the server 130 (S209). The registration function 131 of the server 130 associates the received conversion parameters P with the user ID and registers them in the conversion parameter DB 134, associates the received auxiliary information H with the user ID and registers them in the auxiliary information DB 135, and associates the received verification information V with the user ID and registers them in the verification information DB 136 (S210).

[0057] 4 is a flowchart showing an example of key use processing. The ID input / search function 111 of the user terminal 110 acquires a user ID from an input by a user or operator to the input device 403 of the user terminal 110, and transmits the acquired user ID to the server 130 (S301).

[0058] The search function 132 of the server 130 searches the conversion parameter DB 134, the auxiliary information DB 135, and the verification information DB 136 using the user ID as a key, obtains the conversion parameters P, the auxiliary information H, and the verification information V, and transmits the obtained conversion parameters P and auxiliary information H to the user terminal 110 (S302).

[0059] The biometric information acquisition function 112 of the user terminal 110 acquires the user's biometric information (an example of measurement information for key recovery) via the biometric sensor 406 of the user terminal 110 (S303). The feature extraction function 113 extracts feature data X' (an example of a feature vector for key recovery) from the biometric information acquired in step S303 (S304). Note that a common feature extraction algorithm (an algorithm for generating feature data) is used in the process of step S203 and the process of step S303.

[0060] The feature conversion function 114 converts the feature data X' using the same conversion function f used in step S205 and the conversion parameter P received in step S302 to generate converted feature data Y'=f(X',P) (an example of a converted feature vector for key recovery) (S305). A specific example of the conversion method will be described later.

[0061] The key recovery function 115 recovers the key K' from the auxiliary information H received in step S302 and the conversion characteristic data Y' generated in step S305 (S306). A specific example of a method for recovering the key K' will be described later.

[0062] The certification information generating function 116 generates certification information from the key K', and transmits the generated certification information to the server 130 (S307). A specific example of a method for generating certification information will be described later.

[0063] The certificate verification function 133 of the server 130 verifies the received certificate information using the verification information V acquired in step S302, determines whether to accept (key K' matches key K) or reject (key K' does not match key K), and transmits a verification result indicating the result of the determination to the user terminal 110 (S308). A specific example of the verification method will be described later.

[0064] If the verification result received in step S308 indicates acceptance (key K' matches key K), the encryption-related function 117 of the user terminal 110 executes encryption processing using key K' (S309). The encryption-related processing includes decryption processing for predetermined data and generation of a digital signature.

[0065] Specific examples of the processes in steps S204, S205, S207, S305, S306, and S307 will be described below for three separate cases.

[0066] <Case 1> In case 1, it is assumed that the registration feature data X and feature data X' can be expressed as vectors in an n-dimensional Euclidean space for a given integer n. In other words, it is assumed that the distance between X=(x_1,x_2,...,x_n) and X'=(x'_1,x'_2,...,x'_n) is defined as the Euclidean distance d(X,X')=||X-X'||_2=((x_1-x'_1)^2+...+(x_n-x'_n)^2)^(1 / 2) ("_" indicates a subscript and "^" indicates a power). Here, ||A||_2 indicates the Euclidean norm of vector A.

[0067] In this case, the conversion parameter P and the conversion function f in steps S204, S205, and S305 can be configured as follows.

[0068] In step S204, the transformation parameter generation function 104 randomly generates an n-dimensional orthogonal matrix M and an n-dimensional vector R, and generates a transformation parameter P=(M, R).

[0069] In step S205, the feature transformation function 105 uses the transformation function f, the feature data for registration X, and the transformation parameters P=(M,R) to calculate the transformed feature data for registration Y by Y=f(X,P)=MX+R (where MX is the matrix product of the matrix M and the vector X).

[0070] In step S305, the feature transformation function 114 uses the transformation function f, the feature data X', and the transformation parameters P = (M, R) to calculate the transformed feature data Y' by Y' = f (X', P) = MX' + R (where MX' is the matrix product of the matrix M and the vector X').

[0071] In this case, d(Y,Y') =d(f(X,P),f(X',P)) =||f(X,P)-f(X',P)||_2 =||(MX+R)-(MX'-R)||_2 =||M(X-X')||_2 =||X-X'||_2 (because orthogonal matrices preserve the Euclidean norm) =d(X,X') Therefore, the above-mentioned condition 1 is satisfied.

[0072] As a specific example of step S206 and step S306 in case 1, the method described in Patent Document 1 is adopted. Specifically, for example, in step S206, the auxiliary information generating function 106 configures a lattice L (the lattice L may be configured in advance) having a sphere-packing structure that is as dense as possible (for example, density is less than 1 and higher than a predetermined value) or a sphere-covering structure that is as sparse as possible (for example, density is 1 or more and lower than a predetermined value) in an n-dimensional space, randomly selects a lattice point S from the configured lattice L, and calculates auxiliary information H by H=Y+aS using a predetermined scaling constant (scalar value) a.

[0073] In step S207, the key / verification information generation function 107 inputs the lattice point S to a predetermined cryptographic hash function or a predetermined pseudo-random number generation function h() to generate a key K. Also, in step S207, the key / verification information generation function 107 may generate a hash value of the key K as the verification information V, or may generate the verification information V such that (K, V) is a pair of (private key, public key) of a predetermined electronic signature algorithm.

[0074] In step S306, the key recovery function 115 calculates the lattice point S'=CV((1 / a)(H-Y')) using a predetermined algorithm CV(Z) that outputs the lattice point of L closest to the input vector Z, and generates a key K' from the lattice point S', as in the specific example of step S207 described above.

[0075] If the verification information V is a hash value of the key K, in step S307, the proof information generation function 116 generates the hash value of the key K' as the proof information, and in step S308, the proof verification function 133 determines whether the hash value matches the verification information V and accepts it, or whether it does not match and rejects it.

[0076] If the verification information V is a public key when the key K is the private key, in step S307, the proof information generation function 116 generates, as proof information, an electronic signature generated for a random number or a specified message using the key K' as the private key, and in step S308, the proof verification function 133 verifies the electronic signature using the verification information V, which is the public key, and determines whether the verification is successful or rejected if it is unsuccessful.

[0077] <Case 2> In Case 2, it is assumed that the registration feature data X and feature data X' can be expressed as vectors in an n-dimensional Hamming space for a given integer n. In other words, it is assumed that the registration feature data X and feature data X' can be expressed in n bits, and the distance between them is defined as the Hamming distance d(X, X') = HW(X + X').

[0078] In case 2, the countable "+" indicates exclusive OR, and HW(Z) indicates the Hamming weight (the number of 1s) of the bit string Z. Similarly, the registration feature data X and feature data X' can be expressed as n-dimensional vectors on a finite field F_2 of order 2, in which case the Hamming distance is equivalent to the L_1 distance d(X, X') = |x_1-x'_1|+...+|x_n-x'_n|. Here, "-" indicates subtraction on F_2, and the calculation result will be the same even if it is replaced with "+" for addition on F_2 (for example, 1+1=1-1=0, and 0+1=0-1=1).

[0079] At this time, the conversion parameter P and the conversion function f in steps S204, S205, and S305 can be configured as follows.

[0080] In step S204, the transformation parameter generation function 104 randomly generates an n-bit permutation (a transformation in which the positions of each bit are swapped) σ and an n-bit string R, and calculates a transformation parameter P by P=(σ, R).

[0081] In step S205, the feature transformation function 105 calculates transformed feature data Y for registration by Y=f(X,P)=σ(X)+R using the transformation function f, feature data X for registration, and transformation parameters P=(σ,R).

[0082] In step S305, the feature transformation function 114 uses the transformation function f, the feature data X', and the transformation parameters P=(σ,R) to calculate transformed feature data Y' by Y'=f(X',P)=σ(X')+R.

[0083] In this case, d(Y,Y') =d(f(X,P),f(X',P)) =HW(f(X,P)+f(X',P)) =HW((σ(X)+R)+(σ(X')+R)) =HW(σ(X)+σ(X')) =HW(σ(X+X')) =HW(X+X') =d(X,X') Therefore, the above-mentioned condition 1 is satisfied.

[0084] As a specific example of step S206 and step S306 in case 2, the method described in Non-Patent Document 1 is adopted. Specifically, for example, in step S206, the auxiliary information generating function 106 configures an error correcting code C of a predetermined code length n (the error correcting code C may be configured in advance), randomly selects a codeword S from the error correcting code C, and calculates the auxiliary information H by H=Y[+]S.

[0085] In step S207, the key / verification information generation function 107 inputs the codeword S to a predetermined cryptographic hash function or a predetermined pseudo-random number generation function h() to generate a key K. A specific example of step S207 is similar to the method described in case 1.

[0086] In step S306, the key recovery function 115 calculates S'=Dec(H[+]Y') using the decoding (error correction) algorithm Dec() for the error correction code C, and generates a key K' from the code word S' in the same manner as in the specific example of step S207 described above.

[0087] The specific examples of steps S307 and S308 are similar to the method described in case 1.

[0088] <Case 3> In Case 3, it is assumed that the registration feature data X and feature data X' can be expressed as vectors in an n-dimensional L∞ space for a given integer n. Here, the L∞ space is assumed to be defined as the distance between vectors X=(x_1,x_2,...,x_n) and X'=(x'_1,x'_2,...,x'_n) as the L∞ distance d(X,X')=||X-X'||_∞=max{|x_1-x'_1|,...,|x_n-x'_n|}. Here, ||A||_∞ represents the L∞ norm of vector A.

[0089] In this case, the conversion parameter P and the conversion function f in steps S204, S205, and S305 can be configured as follows.

[0090] In step S204, the transformation parameter generation function 104 randomly generates an n-dimensional permutation matrix M, a diagonal matrix F whose diagonal elements are either 1 or -1, and an n-dimensional vector R, and calculates the transformation parameter P by P=(FM, R) (where FM is the matrix product of matrices F and M).

[0091] In step S205, the feature transformation function 105 uses the transformation function f, the feature data for registration X, and the transformation parameters P=(FM, R) to calculate the transformed feature data for registration Y by Y=f(X,P)=FMX+R (where FMX is the matrix product of the matrix FM and the vector X).

[0092] In step S305, the feature transformation function 114 uses the transformation function f, the feature data X', and the transformation parameters P = (FM, R) to calculate the transformed feature data Y' by Y' = f (X', P) = FMX' + R (where FMX' is the matrix product of the matrix FM and the vector X').

[0093] In this case, d(Y,Y') =d(f(X,P),f(X',P)) =||f(X,P)-f(X',P)||_∞ =||(FMX+R)-(FMX'-R)||_∞ =||FM(X-X')||_∞ =||M(X-X')||_∞ (because the sign does not affect the absolute value) =||X-X'||_∞ (because the component with the maximum absolute value remains unchanged even when replaced) =d(X,X') Therefore, the above-mentioned condition 1 is satisfied.

[0094] As a specific example of step S206 and step S306 in case 3, the method of non-patent document 2 is adopted. Specifically, for example, in step S206, the auxiliary information generation function 106 randomly selects an n-dimensional integer vector S, and calculates auxiliary information H by H=Y+aS using a predetermined scaling constant (scalar value) a.

[0095] In step S207, the key / verification information generation function 107 inputs the n-dimensional integer vector S to a predetermined cryptographic hash function or a predetermined pseudo-random number generation function h() to generate a key K. A specific example of step S207 is similar to the method described in case 1.

[0096] In step S306, the key recovery function 115 calculates S'=[(1 / a)(H-Y')] using an operation [Z] that converts each dimensional component z_i of the real vector Z=(z_1, ..., z_n) into an integer vector by rounding it to the nearest integer (rounding off the components after the decimal point), and generates a key K' from the integer vector S' in the same manner as the specific example of step S207 described above.

[0097] The specific examples of steps S307 and S308 are similar to the method described in case 1.

[0098] In the above example, the conversion parameter P generated by the conversion parameter generation function 104 of the registration terminal 100 is stored in the conversion parameter DB 134 of the server 130, and in the key usage process, the usage terminal 110 obtains the conversion parameter P from the server 130. However, the conversion parameter P may not be stored in the server 130, and the usage terminal 110 may generate the conversion parameter P in the usage process.

[0099] Specifically, for example, in the registration process, the conversion parameter generation function 104 may generate a conversion parameter P based on a password entered by the user (for example, by generating a hash value of the password using a predetermined cryptographic hash function as the conversion parameter P), and in the key usage process, the usage terminal 110 may accept input of a password from the user and generate the conversion parameter P based on the password.

[0100] In the above example, the transformation parameters P, auxiliary information H, and verification information V are each linked to a user ID and stored in the server 130, and in the key usage process, the usage terminal 110 transmits the user ID to 130, thereby performing 1:1 authentication to obtain the transformation parameters P and auxiliary information H corresponding to the user ID, but 1:N authentication may also be performed.

[0101] Specifically, for example, in the registration process, the registration terminal 100 does not need to accept input of a user ID, and the server 130 associates the conversion parameters P, auxiliary information H, and verification information V transmitted from the registration terminal 100 and stores them as a combination.

[0102] Furthermore, in the key usage process, the usage terminal 110 does not accept input of a user ID, but obtains all combinations of corresponding transformation parameters P and auxiliary information H from the server 130, and steps S305 to S308 are executed for all combinations of the transformation parameters P, auxiliary information H, and verification information V.

[0103] In step S308, if there is a combination of conversion parameters P, auxiliary information H, and verification information V for which a verification result indicating acceptance has been obtained, the proof verification function 133 of the server 130 sends information indicating that the verification result is acceptance to the user terminal 110, and notifies the user terminal 110 of the conversion parameters P and auxiliary information H for the combination for which a verification result indicating acceptance has been obtained, thereby enabling the user terminal 110 to identify the correct recovery key.

[0104] Furthermore, in step S308, if there is no combination of the conversion parameter P, the auxiliary information H, and the verification information V for which a verification result indicating acceptance has been obtained, information indicating that the verification result is rejection is transmitted to the user terminal 110. By the above-mentioned processing, this embodiment can be applied to 1:N authentication.

[0105] In this embodiment, the process of generating and restoring a key from biometric information has been described. However, the present invention can be applied to the process of generating and restoring an error-free key from any information (e.g., a Fingerprint of a Thing) that is measured with errors, such as biometric information.

[0106] As described above, in all of the methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2, when generating auxiliary information H from feature data X, a vector S is randomly selected from a subset (e.g., a lattice, an error correcting code, or a set of integer vectors) of the space of feature data (e.g., Euclidean space, Hamming space, or L∞ space), and auxiliary information g(X,S) is generated using the function g(X,S)=X+aS (where a is a predetermined constant (a=1 in Case 2)).

[0107] In the methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2, the feature data X is masked (hidden) with the vector S, and the vector S is immediately deleted without being stored anywhere on the system. Therefore, in the methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2, even if the stored auxiliary information g(X, S) is leaked and falls into the hands of an attacker, the feature data X cannot be immediately identified, and the confidentiality of the feature data X can be maintained.

[0108] However, in the methods described in Patent Document 1, Non-Patent Document 1, and Non-Patent Document 2, the vector S is selected from a subset of the feature data space, so the feature data X cannot be completely concealed, and part of the information of the feature data X remains in the auxiliary information g(X, S). Therefore, if an attacker obtains the auxiliary information g(X, S), there is a problem that it may provide a clue to narrow down candidates for the feature data X.

[0109] In contrast, according to this embodiment, the auxiliary information H=g(Y,S) is generated not from the enrollment feature data X but from the enrollment transformed feature data Y obtained by transforming the enrollment feature data X with a random transformation parameter P, making it more difficult to narrow down candidates for the enrollment feature data X from the auxiliary information H. Therefore, this embodiment can realize a more secure biometric encryption system even if the auxiliary information H is leaked.

[0110] Furthermore, this embodiment is characterized in that the transformation function f for generating the transformed feature data Y for registration from the transformed feature data X for registration and the function g for generating the auxiliary information H from the transformed feature data Y for registration are non-commutative.

[0111] For example, in the above mentioned Case 1, H = g(f(X, P), S) = MX + R + aS, but if the order of the operations using function f and function g is swapped, H' = f(g(X, S), P) = M(X + aS) + R = MX + aMS + R, and H and H' do not match.

[0112] For this reason, in this embodiment, even if an attacker were able to obtain the transformation parameter P in addition to the auxiliary information H, it would be difficult to launch an attack such as applying the inverse function of the function f(·,P) to the auxiliary information H to calculate the auxiliary information g(X,S)=X+aS in the conventional technology and narrowing down the candidates for X.

[0113] As described above, according to this embodiment, an attacker who has obtained the transformation parameter P cannot perform inverse transformation from the auxiliary information H, despite the use of a reversible (inverse transformation is calculable) transformation function f, and thus has the effect of realizing high security. Therefore, even if one server 130 manages the auxiliary information H and the transformation parameter P as in this embodiment, security can be ensured.

[0114] In addition, in this embodiment, by determining the hash value of key K, or the public key corresponding to the private key when key K is the private key, as the verification information V, it becomes difficult to calculate key K from the verification information V, so that security can be ensured even if the auxiliary information H, the transformation parameter P, and the verification information V are leaked simultaneously.

[0115] However, in this embodiment, by managing some or all of the auxiliary information H, the transformation parameters P, and the verification information V on multiple different servers 130 or media, it is possible to reduce the risk of these being leaked simultaneously and to increase security.

[0116] Furthermore, in this embodiment, in the unlikely event that this information is leaked, it is possible to invalidate the leaked information by randomly generating a new transformation parameter P', transforming the registration feature data X or newly acquired and extracted registration feature data with the new transformation parameter P', generating new auxiliary information H, key K, and verification information V, and updating each DB of the server 130.

[0117] For the above reasons, according to this embodiment, a highly secure biometric encryption can be realized.

[0118] The present invention is not limited to the above-mentioned embodiment, and various modifications are included. For example, the above-mentioned embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all the configurations described. It is also possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0119] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0120] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0121] 100 Registration terminal, 102 Biometric information acquisition function, 103 Feature extraction function, 104 Conversion parameter generation function, 105 Feature conversion function, 106 Auxiliary information generation function, 107 Key / verification information generation function, 109 Registration function, 110 User terminal, 112 Biometric information acquisition function, 113 Feature extraction function, 114 Feature conversion function, 115 Key recovery function, 116 Proof information generation function, 130 Server, 131 Registration function 131, 132 Search function 132, 133 Proof verification function, 134 Conversion parameter DB, 135 Auxiliary information DB, 136 Verification information DB, 400 CPU, 401 Memory, 402 Storage, 405 Communication device, 406 Biometric sensor

Claims

1. A key generation method in which a key generation system generates an error-free key from measurement information measured with errors, comprising the steps of: the key generation system holds a registration feature vector obtained by applying a predetermined algorithm to the registration measurement information; The key generation method includes: the key generation system randomly generates transformation parameters; the key generation system converts the registration feature vector into a registration transformed feature vector based on a predetermined transformation function and the transformation parameters; the key generation system generates auxiliary information and a registration key based on the registration transformation feature vector; the key generation system stores the transformation parameters and the auxiliary information; A key generation method, wherein the predetermined transformation function is a function that preserves distances between feature vectors.

2. 2. The method of claim 1 , further comprising the steps of: the key generation system holds a key recovery feature vector obtained by applying the predetermined algorithm to the key recovery measurement information; The key generation method includes: the key generation system converts the key recovery transformation feature vector into a key recovery transformation feature vector based on the predetermined transformation function and the transformation parameter; The key generation method, wherein the key generation system recovers a key from the auxiliary information and the key recovery transformation feature vector.

3. 3. A key generation method according to claim 1, further comprising the steps of: the key generation system randomly selects a vector S from a predetermined set; the key generation system calculates a vector aS by multiplying the selected vector S by a predetermined constant a; The key generation method, wherein the key generation system generates the auxiliary information by adding the vector aS to the registration feature vector.

4. 4. A method for generating a key according to claim 3, comprising the steps of: the key generation system randomly generates an orthogonal matrix M and a vector R as the transformation parameters; A key generation method, wherein the transformation function is a function that applies the orthogonal matrix M in a Euclidean space and then adds the vector R.

5. 5. A method for generating a key according to claim 4, comprising the steps of: The method of claim 1, wherein the predetermined set is a lattice in the Euclidean space.

6. 4. A method for generating a key according to claim 3, comprising the steps of: the key generation system randomly generates a permutation σ and a bit string R as the transformation parameters; The key generation method, wherein the transformation function is a function that performs an exclusive OR on the bit string R after applying the substitution σ in a Hamming space.

7. 7. A method for generating a key according to claim 6, comprising the steps of: The method of claim 1, wherein the predetermined set is an error correcting code in the Hamming space.

8. 4. A method for generating a key according to claim 3, comprising the steps of: the key generation system randomly generates, as the transformation parameters, a permutation matrix M, a diagonal matrix F whose diagonal elements are each 1 or −1, and a vector R; A key generation method, wherein the transformation function is a function that applies the permutation matrix M and the diagonal matrix F in an L∞ space and then adds the vector R.

9. 9. A method for generating a key according to claim 8, comprising the steps of: A key generation method, wherein the predetermined set is an integer vector in the L∞ space.

10. 2. The method of claim 1 , further comprising the steps of: A key generation method, wherein the measurement information measured with error is biometric information.

11. A key generation system for generating an error-free key from measurement information measured with errors, comprising: A processor and a memory, The memory holds a feature vector for registration obtained by applying a predetermined algorithm to the measurement information for registration; The processor, Randomly generate transformation parameters, Transforming the registration feature vector into a registration transformed feature vector based on a predetermined transformation function and the transformation parameters; generating auxiliary information and a registration key based on the registration transformation feature vector; storing the transformation parameters and the auxiliary information in the memory; A key generation system, wherein the predetermined transformation function is a function that preserves distances between feature vectors.

12. 12. The key generation system of claim 11, the memory holds a key recovery feature vector obtained by applying the predetermined algorithm to the key recovery measurement information; The processor, converting the key recovery transformation feature vector into a key recovery transformation feature vector based on the predetermined transformation function and the transformation parameters; A key generation system that recovers a key from the auxiliary information and the key recovery transformation feature vector.

Images