Sketch generation device and method, digital signature system and method, and program

Abstract

To increase security by preventing the leakage of differential information between first and second data from first and second sketches for the first and second data.SOLUTION: In a registration phase, a first sketch is generated and registered using first biometric information for one of the two halves of first data, and in the restoration phase, a second sketch is generated using the second biometric information for the value obtained by subtracting the other of the two halves of the first data from second data, and sent to the restoration destination.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a sketch generation device and method, a digital signature system and method, and a program. [Background technology]

[0002] Linear sketching is used for digital signatures in commitment schemes that use biometric information. It can extract the difference between committed data from two commitments generated using the same person's biometric information (e.g., registered biometric information and matching biometric information) (Patent Document 1, etc.).

[0003] For example, the generation and reconstruction of a linear sketch is as follows: <Sketch generation> s←Gen(x,w) …(1) Gen is a sketch generation function (algorithm) that receives data x and biometric information w as input arguments and generates a sketch s for data x using the biometric information w.

[0004] <Restore> x" ← Rec(s,s') …(2) Rec is a restoration function (algorithm). Rec receives as input arguments a first sketch s for first data x1 using first biometric information w generated by the sketch generation function Gen and a second sketch s' for second data x2 using second biometric information w' generated by the sketch generation function Gen. If the first biometric information w and the second biometric information w' belong to the same person, it outputs the difference Δ=x1-x2 between the first data x1 and the second data x2 as x". Whether the biometric information belongs to the same person is determined based on, for example, the distance between the first biometric information w and the second biometric information w'. If the distance between the first biometric information w and the second biometric information w' is within a predetermined threshold, it is determined that the information belongs to the same person. The distance |w-w'| between the first biometric information w and the second biometric information w' can be, for example, Euclidean distance or Hamming distance.

[0005] As a sketch, a sketch based on code offset (CODE-OFFSET CONSTRUCTION) (secure sketch) as shown below is also known (Reference 1).

[0006] <Sketch generation> s← Gen(x,w): The sketch generation function (algorithm) Gen encodes the data x (c=ENC(x)) using the encoding function ENC as shown in the following equation (3), and generates a sketch by adding the code c and the biometric information w. s = Gen(x,w) = ENC(x) + w …(3) In addition, in equation (3), the operation between w and ENC(x) may be subtraction. For example, if the sketch s is in a metric space (a space where distance is defined), M=F n (When F is in the field of F=Z / 2Z={0,1}), addition and subtraction are equivalent. Alternatively, the operation between w and ENC(x) may be a logical operation such as bitwise exclusive or (xor). Note that in the Secure Sketch of Reference 1, the encoding function ENC is an error-correcting code (not necessarily linear) with a code bit length of n, a number of information bits of k, and capable of correcting at least t errors, but in this disclosure, it is assumed to have linearity, as described below.

[0007] <Restore> x"← Rec(s, s'): The restoration function (algorithm) Rec is calculated using the decoding function DEC. x"= Rec(s, s') = DEC(s-s') …(4) The decoding function DEC receives as input, as an argument, the difference between a first sketch s for first data x1 using first biometric information w generated by the sketch generation function Gen and a second sketch s' for second data x2 using second biometric information w' also generated by the sketch generation function Gen, and outputs, as x" the difference Δ=x1-x2 between the first data x1 and the second data x2, if the first biometric information w and the second biometric information w' are of the same person.

[0008] For more information, First sketch: s = ENC(x1) + w …(5) Second sketch: s' = ENC(x2) + w' …(6) In this case, if the distance |w-w'| between the first biometric information w and the second biometric information w' is within the correction range (within the threshold), x"=DEC(ENC(x1)+ w - (ENC(x2)+w'))=DEC(ENC(x1-x2)+w-w'))=x1-x2 …(7)

[0009] Here, the encoding function ENC and the decoding function DEC are given as follows: <encoding> c←ENC(x) …(8) The encoding function ENC transforms plaintext x into a codeword c.

[0010] <Decryption> x←DEC(y) …(9) The decoding function DEC converts y=c+e back into plaintext x for a codeword c=ENC(x) and e included in the correction range.

[0011] Furthermore, we assume that the encoding function ENC is a linear error-correcting code, where linearity means that the following holds for the encoding function with respect to plaintexts x and x': ENC(x1) + ENC(x2) = ENC(x1 + x2) …(10)

[0012] When both sides of equation (10) are decoded using the decoding function DEC, the right-hand side becomes DEC(ENC(x1 + x2)) = x1 + x2 Therefore, DEC(ENC(x1) + ENC(x2)) = x1 + x2 …(11) However, the addition operation "+" on the left side and the addition operation "+" on the right side do not have to be the same operation.

[0013] An example of registration and decryption in a system that implements the above-described sketch will be described with reference to FIG. 1(A).

[0014] <Registration phase> Step 1: The first device 10A generates a first sketch s (= Gen(x1, w)) for the first data x1 using the first biometric information w. The first device 10A may be a terminal (client) or the like.

[0015] Step 2: The first device 10A transmits the first sketch s to the second device 20A and registers it in the storage unit 22 of the second device 20A. The second device 20A may be a terminal or a server. The storage unit 22 may be a remote repository or the like separate from the second device 20A.

[0016] <Restore phase> Step 3: The first device 10A generates a second sketch s' (=Gen(x2, w')) for the second data x2 using the second biometric information w'.

[0017] Step 4: The first device 10A transmits the second sketch s' to the second device 20A. In normal operation, the second biometric information w' is biometric information of the same user as the first biometric information w. The first data x1 and the second data x2 may be confidential information (data to be protected) such as the user's personal information or private key.

[0018] Step 5: The second device 20A acquires (reads) the first sketch s stored in the memory unit 22.

[0019] Step 6: The second device 20A inputs the first sketch s and the second sketch s' sent from the first device 10A into the restoration function Rec to restore the difference Δ=x1-x2 between the first data x1 and the second data x2.

[0020] In the following, since a secure sketch generated using a linear encoding function also has linearity as described above, when there is no need to specifically distinguish between a linear sketch and a secure sketch, it will simply be referred to as a sketch. [Prior art documents] [Patent documents]

[0021] [Patent Document 1] Patent No. 5707311 Summary of the Invention [Problem to be solved by the invention]

[0022] The following is an analysis by the inventors of the present invention.

[0023] For example, as shown in FIG. 1B, for first and second biometric information w and w' of the same person, in the enrollment phase, the first device 10A generates a first sketch s for the first data x1 using the first biometric information w, and transmits the first sketch s to the second device 20B to register it in the storage unit 22 (steps 1 and 2). Furthermore, in step 3 of the enrollment phase, the first device 10A generates a second sketch s' for the second data x2 using the second biometric information w', and in step 4, transmits the second sketch s' to the second device 20B to register it in the storage unit 22. In this case, the second device 20B reads out the first sketch s and the second sketch s' registered in the storage unit 22 (step 5) and executes a restoration function Rec(s, s') (step 6), thereby obtaining the difference Δ=x1-x2 between the first data x1 and the second data x2. In this case, information about the difference Δ=x1-x2 between the first data x1 and the second data x2 may be leaked from the second device 20B. Alternatively, if the storage unit 22 is a server repository or the like, and the restoration function Rec(s, s') is executed at a node that can acquire the first sketch s and the second sketch s' from the storage unit 22, information about the difference Δ=x1-x2 between the first data x1 and the second data x2 may be leaked.

[0024] The present disclosure has been devised in consideration of the above-mentioned problems, and one of its main objectives is to provide a sketch generation device and method, a digital signature system and method, and a program that can prevent the leakage of differential information between the first and second data from the first and second sketches for the first and second data, thereby increasing security. [Means for solving the problem]

[0025] According to the present disclosure, a sketch generation device includes: means for generating a first sketch from one of two pieces of first data by using first biometric information; The device further comprises means for generating a second sketch using second biometric information for a value obtained by dividing the first data into two and calculating the other of the two.

[0026] According to the present disclosure, a digital signature system includes a key generation device having at least a processor and a communication interface, and performing a process of generating a first sketch using first biometric information for a first share, which is one of two shares of a first signature key, and transmitting the first sketch to the second signature generation device, and a first signature generation device having at least a processor and a communication interface. the first signature generation device, a process of communicating with the key generation device to obtain a second share that is the other share of the first signature key; generating a second sketch using second biometric information from a value obtained by calculating the second share of a second signature key; transmitting the second sketch to the second signature generation device; receiving a second signature from the second signature generation device that generates a second signature for the message to be signed using the first sketch and the second sketch; A process is executed to generate and output a first signature for the message from the second signature.

[0027] According to the present disclosure, the sketch generation method includes, in a registration phase, generating a first sketch for one of two pieces of divided first data using first biometric information, and registering the first sketch; In the restoration phase, a second sketch is generated using the second biometric information from the value obtained by dividing the first data into two halves and calculating the other halves, and the second sketch is sent to the restoration destination.

[0028] According to the present disclosure, a digital signature method includes the following steps. The key generation device generates a first sketch using the first biometric information for a first share, which is one of two shares of the first signature key, and transmits the first sketch to the second signature generation device. a first signature generation device communicates with the key generation device to obtain a second share that is the other share of the first signature key; generating a second sketch using second biometric information for a value obtained by calculating the second share of a second signature key; sending the second sketch to the second signature generation device; receiving a second signature from the second signature generation device that generates a second signature for the message to be signed using the first sketch and the second sketch; A first signature for the message is generated from the second signature and output.

[0029] According to the present disclosure, a computer is provided with a process for generating a first sketch using first biometric information for one of two pieces of divided first data; A program is disclosed that executes a process of generating a second sketch using second biometric information for the value obtained by dividing the first data into two and calculating the other half of the first data. [Effects of the Invention]

[0030] According to the present disclosure, in a sketch generating device, it is possible to prevent leakage of differential information between the first and second data from the first and second sketches for the first and second data, respectively, using the first and second biometric information of the same person, thereby increasing security. [Brief explanation of the drawings]

[0031] [Figure 1] 1A and 1B are diagrams illustrating related art. [Figure 2] FIG. 1 is a diagram illustrating an embodiment of the present disclosure. [Figure 3] FIG. 1 is a diagram illustrating an example of a configuration of an embodiment of the present disclosure. [Figure 4] FIG. 1 is a diagram illustrating an example of an embodiment of the present disclosure. [Figure 5] FIG. 1 is a diagram illustrating an example of an embodiment of the present disclosure. [Figure 6] FIG. 1 is a diagram illustrating a schematic diagram of an example of a configuration of the present disclosure. [Figure 7] FIG. 2 is an explanatory diagram illustrating a calculation process according to the present disclosure. [Figure 8] FIG. 1 is a diagram illustrating an example of a configuration of the present disclosure. [Figure 9] FIG. 2 is a diagram illustrating a processing sequence of the present disclosure. [Figure 10] FIG. 2 is a diagram illustrating a processing sequence of the present disclosure. [Figure 11] FIG. 2 is a diagram illustrating a processing sequence of the present disclosure. [Figure 12] FIG. 10 is a diagram illustrating another example of the processing sequence of the present disclosure. [Figure 13] FIG. 1 is a diagram illustrating an example of an embodiment of the present disclosure. [Figure 14] (A) and (B) are diagrams illustrating an example of implementation on a computer. DETAILED DESCRIPTION OF THE INVENTION

[0032] Several embodiments of the present disclosure will be described. In one aspect of the present disclosure, a sketch generating device includes a first means (module, device) for generating a first sketch (s) by using first biometric information (w) for one of two halves (x11) of first data (x1), and a second means (module, device) for generating a second sketch (s') by using second biometric information (w') for a value obtained by calculating the other of two halves (x12) of the first data (x1) for second data (x2). Here, the sketch may be generated by a sketch generation function Gen that takes data and biometric information as arguments. Alternatively, it may be a sketch obtained by combining a code (codeword) encoded using a linear encoding function (algorithm) ENC with the biometric information. The first and second means may be integrated into a single device (unit) or may be distributed across two units that are connected to each other via a communication means.

[0033] An example of the present disclosure will be described with reference to FIG.

[0034] <Registration phase> Step 1: The first device 10 receives the first data x1. x1 = x11 + x12 …(12) is divided into a first variance value x11 and a second variance value x12.

[0035] Step 2: The first device 10 generates a first sketch s for the first variance value x11 using the first biometric information w. s = Gen(x11, w) …(13)

[0036] Step 3: The first device 10 transmits the first sketch s to the second device 20, and the second device 20 registers the first sketch s in the storage unit 22.

[0037] <Restore phase> Step 4: The first device 10 generates a second sketch s' using the second biometric information w' for the difference x2-x12 between the second data x2 and the second variance value x12 of the first data x1. s' = Gen(x2 - x12, w') …(14) Step 5: The first device 10 sends the second sketch s′ to the second device 20 .

[0038] Step 6: The second device 20 reads the first sketch s stored in the memory unit 22.

[0039] Step 7: The second device 20 can restore the difference Δ(=x1-x2) between the first data x1 and the second data x2 using the restoration function Rec(s, s') using the first sketch s (=Gen(x11, w)) and the second sketch s'=Gen(x2-x12, w') transmitted from the first device 10. After inputting the second sketch s' received from the first device 10 into the restoration function Rec(s, s') and executing it, the second device 20 either clears s' to zero (for example, resets it to 0) or deletes it (does not leave s' in the second device 20).

[0040] Although not particularly limited, when the first data x1 is a positive integer, the division into the first variance value x11 and the second variance value x12 can be expressed as follows: (x11, x12) = (x1 - m, m) …(15) It may also be possible to use the following. s = Gen(x11, w)= Gen(x1 - m, w) s' = Gen((x2 - x12), w') = Gen((x2 -m), w') twist, Δ=Rec(s, s')=(x1 - m) - (x2 - m) =x1-x2 …(16) holds. Or, (x11, x12) = (x1 + m, (-m)) …(17) It may also be possible to use the following. s = Gen(x11, w)= Gen(x1 + m, w) s'= Gen((x2 - x12), w') = Gen((x2 -(-m)), w') twist, Δ=Rec(s, s')=(x1 + m)-(x2 - (-m)) = (x1 + m)-(x2 + m)) = x1-x2 …(18) holds. Note that the operations (sum, difference) of x1 and x2 and the inverse of m (-m) may be operations (modulo operations) using a remainder set modulo n (n is a positive integer), for example. Also, x1, x2, m ∈ Z / qZ = {0, 1, .., q-1} (q is, for example, a prime number). Note that the sketch generation function Gen may generate a sketch s by combining a codeword c = ENC(x) obtained by encoding data x using the encoding function ENC with biometric information w. In this case, the restoration function Rec may be a decoding function DEC that decodes the difference s - s' between the first sketch and the second sketch s'.

[0041] The division of the first data x1 into the first variance value x11 and the second variance value x12 may be such that the additive operation of the first variance value x11 and the second variance value x12 becomes the first data x1 (additive distribution) as described above, but may also be such that, for example, with respect to binary data, a bit-by-bit logical operation (e.g., exclusive OR (xor)) of the first variance value x11 and the second variance value x12 becomes the first data x1 (x1 = x11 xor x12). In this case, as shown in the following equation (19), the first variance value x11 and The exclusive OR (difference) of the second data x2 and the second variance value x12 (x2 xor x12), The exclusive OR (difference) of the first data x1 and the second data x2 is the exclusive OR (difference) of the first data x1 and the second data x2 (x1 xor x2). x11 xor (x2 xor x12)=(x11 xor x12) xor x2 = x1 xor x2 …(19)

[0042] As shown in Figure 3, in steps 1 to 3 of the registration phase, as in Figure 2, the first device 10 generates a first sketch s (= Gen(x11, w)) for the first variance value x11 using the first biometric information w, transmits the first sketch s to the second device 20, and the second device 20 registers the first sketch s in the memory unit 22.

[0043] Further, in step 4 of the registration phase, the first device 10 transmits the second data x2 as x2 = x21 + x22 …(20) The first variance value x21 and the second variance value x22 are obtained as follows:

[0044] Step 5: The first device 10 generates a sketch s" (= Gen(x21, w')) for one variance value (e.g., x21) of the second data x2 using the second biometric information w'.

[0045] Step 6: The first device 10 transmits the sketch s" to the second device 20 as a second sketch, and the second device 20 registers the sketch s" in the storage unit 22 as the second sketch.

[0046] When the restoration function Rec(s, s") is executed on the first sketch s (= Gen(x11, w)) registered in the storage unit 22 of the second device 20 and the second sketch s" (= Gen(x21, w')) registered in the storage unit 22 as the second sketch, even if the first biometric information w and the second biometric information w' are biometric information of the same person, only the difference x11-x21 between x11 and x21 is restored, and the difference Δ=x1-x2 between the first data x1 and the second data x2 cannot be restored. Note that the storage unit 22 may manage the sketch s" as a second sketch using the second biometric information w' together with the first sketch s, with an ID (identification code) or the like assigned. However, as will be described below, when restoring the difference Δ(= x1-x2), the first sketch s registered in the storage unit 22 is used, but the sketch s" (= Gen(x21, w')) is not used.

[0047] In step 7 of the decoding phase, the first device 10 generates a second sketch s' for the difference x2-x12 between the second data x2 and the second variance value x12 of the first data x1. s' = Gen(x2 - x12, w') …(21)

[0048] Step 8: The first device 10 sends the second sketch s′ to the second device 20.

[0049] Step 9: The second device 20 reads the first sketch s (= Gen(x11, w)) registered in the storage unit 22.

[0050] Step 10: The second device 20 uses the first sketch s (= Gen(x11, w)) and the second sketch s' (= Gen(x2 - x12, w')) sent from the first device 10 to restore the difference Δ (= x1 - x2) between the first data x1 and the second data x2 using the restoration function Rec(s, s'). As in Figure 2, the second device 20 inputs the second sketch s' received from the first device 10 into the restoration function Rec(s, s') and executes it, after which it clears it to zero (resets the variable s' to 0, for example) or deletes it.

[0051] 4 is a diagram illustrating an example of the device configuration of the present disclosure. The first device 10 may be referred to as a data protection device. The second device 20 may be referred to as a data recovery device. The first device 10 and the second device 20 each include at least one processor and a communication device (communication interface) for communicating with each other via a communication path (network).

[0052] The first device 10 includes a biometric information acquisition unit 11, a data acquisition unit 12, a data distribution unit 13, a distributed data storage unit 14, a first sketch generation unit 15, a first sketch transmission unit 16, a second sketch generation unit 17, and a second sketch transmission unit 18. The biometric information acquisition unit 11 acquires and stores first biometric information w of a user from a sensor (not shown). The biometric information acquisition unit 11 may extract and store features from the biometric information (digital information) acquired from the sensor (not shown). The first and second biometric information w and w' are acquired and stored by the biometric information acquisition unit 11. The first biometric information w and the second biometric information w' may be vectors of real values ​​or vectors of integer values. The data acquisition unit 12 acquires first data x1 and second data x2. The first data x1 and second data x2 may be the user's personal information or secret information such as a secret key. As described above, the first data x1 and the second data x2 may be scalar values ​​(integer values) or the like, or may be vectors made up of several elements.

[0053] The data distribution unit 13 divides (for example, additively distributes) the first data x1 into a first distribution value x11 and a second distribution value x12. x1 = x11 + x12 …(22)

[0054] Note that the term "shared" is used to refer to the first shared value x11 and the second shared value x12 in connection with, for example, key sharing of a biometric signature key, but it goes without saying that the first shared value x11 and the second shared value x12 may also be referred to as, for example, the first divided value and the second divided value of the first data x1.

[0055] The data distribution unit 13 may divide the second data x2 into a first distribution value x21 and a second distribution value x22 (for example, by additive distribution). x2 = x21 + x22 …(23)

[0056] The distributed data storage unit 14 stores (x11, x12) and (x21, x22) in a storage unit (not shown) (such as a memory, HDD (Hard Disc Drive), or register within the distributed data storage unit 14).

[0057] The first sketch generating unit 15 generates a first sketch s for the first variance value x11 of the first data x1 using the first biometric information w. s = Gen(x11, w) …(24)

[0058] The first sketch transmission unit 16 transmits the first sketch s to the second device 20 via a communication interface and a network (not shown).

[0059] The second sketch generating unit 17 generates a second sketch s' for the second variance value x12 of the second data x2 and the first data x1 using the second biometric information w'. s' = Gen(x2 - x12, w') ...(25)

[0060] The second sketch transmission unit 18 transmits the second sketch s' to the second device 20 via a communication interface and network (not shown).

[0061] The second device 20 includes a first sketch acquisition unit 21, a storage unit 22, a second sketch acquisition unit 23, and a differential data restoration unit 24. The first sketch acquisition unit 21 receives a first sketch s transmitted from the first device 10 and stores it in the storage unit 22. The second sketch acquisition unit 23 receives a second sketch s' transmitted from the first device 10. The differential data restoration unit 24 restores the difference Δ(= x1 - x2) between the first data x1 and the second data x2 using the restoration function Rec(s, s') based on the first sketch s stored in the storage unit 22 and the second sketch s' transmitted from the first device 10.

[0062] An example of the application of the above-described example of the present disclosure to a digital signature will be described below. First, an overview of a digital signature will be provided. A digital signature is a technology that verifies a signature generated for a digitally signed document using a private key (signature key) held only by the signer, thereby confirming the signer of the document and that the document has not been tampered with since the signature was created.

[0063] <Key generation> (sk, vk) ← KeyGen(λ): Generate a pair of private key (signature key) sk and public key vk. λ is a security parameter (key length).

[0064] <signature> σ←Sign(sk, M): Generate a signature σ for the message M using the private key sk.

[0065] <Verification> 0 / 1←Verify(vk, M, σ): Verify the correctness of the pair of message M and signature σ using public key vk (for example, 1 if correct (accepted), 0 if incorrect (not accepted)). In the above verification, - The signature was generated using the public key and the corresponding private key. - Is the signature generated for the message? are verified together.

[0066] Biometric shared signature is a technology that generates digital signatures using a two-party protocol that includes biometric information and key parameters.

[0067] <Key generation> (kp, vk)←KeyGen(w, λ): Generate key parameters kp and verification key vk from the first biometric information w, where λ is a security parameter (key length).

[0068] <signature> σ←Sign(w', kp, M): A signature σ for a message M is generated by communication between two parties having the second biometric information w' and key parameter kp.

[0069] <Verification> 0 / 1←Verify(vk, M, σ): Verify the correctness of the pair of message M and signature σ using verification key vk. In the above verification, - Whether the signature was generated using the same biometric information of the person used to generate the key, - Whether the signature was generated using key parameters corresponding to the verification key - Is the signature generated for the message? are verified together

[0070] Here, as a process related to the restoration of the difference Δ(=x1−x2) between the first data x1 and the second data x2, a biometric shared signature based on a digital signature having key homomorphism will be described.

[0071] Key homomorphic operations (algorithms) generate a signature σ(=Sign(sk, M)) for a message M using a private key (signature key) sk, shifted by Δsk (shift amount) to obtain a signature σ'(=Sign(sk', M)) for a message M using sk' (=sk - Δsk, therefore Δsk=sk - sk'). σ ← KHom(M, σ', Δsk) …(26)

[0072] In some signature algorithms, the key homomorphic operation KHom does not include the message M as an argument. σ ← KHom(σ', Δsk) …(27)

[0073] As explained with reference to Figure 1(B), consider the case where the same person registers a first sketch s = Gen(x1, w) and a second sketch s' = Gen(x2, w') in a registration destination. However, the first data x1 and the second data x2 are the first signature key (private key) and the second signature key (private key) of the same user.

[0074] As shown in FIG. 5, the first device 10 generates a first sketch s (= Gen(x1, w)) and a second sketch s' (= Gen(x2, w')) and registers them in the storage unit 22 of the second device 20 (step S101). At this time, as described above, the second device 20 retrieves the first sketch s and the second sketch s' from the storage unit 22 and executes the restoration algorithm Rec(s, s') (step S102), thereby restoring the difference Δ(= x1 - x2) between the first data x1 and the second data x2.

[0075] When the second device 20 obtains the second signature σ2 (=Sign(x2,M)) for the message M using the second signing key x2 (step S103), it can generate a first signature σ1 (=Sign(x1,M)) for the message M using the first signing key x1 as the signing key by the key homomorphic operation KHom(M, σ2,Δ) from the message M, the second signature σ2, and the differential key Δ (=x1-x2) restored in step S102 (step S104). That is, the second device 20 can create (forge) a first signature σ1 for the message M using the first signing key x1 from the second signature σ2 for the message M using the second signing key x2, without knowing the first signing key x1.

[0076] The above problem is merely an example based on assumptions, but an embodiment of a digital signature system that solves the above problem will be described below.

[0077] 6 is a diagram illustrating an example of a digital signature system according to the present disclosure. Referring to FIG. 6, the digital signature system 100 includes a key generation device 120, a key-based signature generation device 130, a biometrics-based signature generation device 140, and a verification device 150.

[0078] In the key registration phase, the key generation device 120 generates a private key sk and a public key vk from the security parameters κ using a key generation algorithm KeyGen. (sk, vk)←KeyGen(1κ ) …(28)

[0079] This key generation algorithm KeyGen simultaneously returns a pair of a private key sk and a public key vk as return values. Alternatively, KeyGen may receive common parameters generated from security parameters using the setup algorithm and generate a pair of a private key sk and a public key vk. In key generation, the public key vk may be generated from the private key sk using a one-way hash function (cryptographic hash function, linear hash function). Alternatively, the public key vk may be generated by vk=g^φ(sk) using a generator g of a multiplicative group G of a prime order p and a mapping φ (a mapping from the set to which the private key sk belongs to Z (Z is the set of all integers)). Alternatively, a keyed hash function or the like may be used. Hereinafter, this private key sk is referred to as a first signature key x1. The public key vk is referred to as a verification key. The key generation device 120 transmits the verification key vk to the verification device 150. The key generation device 120 and the verification device 150 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN (Local Area Network), a secure wireless LAN, a WAN (Wide Area Network), a mobile communication network, a virtual network, and the like). The verification key vk may not be transmitted to the verification device 150, but may be registered and stored in a key server (public key database) or the like in association with a key ID, etc., and the verification device 150 may obtain the verification key vk from the key server (public key database) or the like as needed.

[0080] The key generation device 120 acquires the first biometric information w. The key generation device 120 divides the first signature key x1 into a first share x11 and a second share x12. x1=x11+x12

[0081] The key generation device 120 applies the encoding function ENC to the first shared value x11 to convert it into an encoding key c←ENC(x11), and then combines the encoding key ENC(x11) and the first biometric information w using an operation such as addition or exclusive OR to generate a first sketch s. s = ENC(x11) + w …(29)

[0082] The key generation device 120 transmits the generated first sketch s to the key-based signature generation device 130. The key-based signature generation device 130 registers the first sketch s transmitted from the key generation device 120 in a storage unit (not shown) (registration phase). The key generation device 120 and the key-based signature generation device 130 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN, a wireless LAN with security measures, a WAN, a mobile communication network, a virtual network, and the like).

[0083] The key generation device 120 transmits the second share x12 to the biometric signature generation device 140. The key generation device 120 and the biometric signature generation device 140 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN, a wireless LAN with security measures, a WAN, a mobile communication network, a virtual network, and the like).

[0084] In Fig. 6 and other figures, the arrows to which the information to be transmitted, such as the first sketch s and the verification key vk, are attached are merely a schematic representation of an example of the transmission of the information (the handshake between the sender and the destination is omitted), and do not, of course, mean that the communication between the sender and the destination is one-way communication. This also applies to the following figures.

[0085] Upon receiving the second share x12 transmitted from the key generation device 120, the biometric signature generation device 140 stores it in a storage unit (not shown). In the stage of actually signing (signature phase), the biometric signature generation device 140 acquires second biometric information w' and a message M for signing. The biometric signature generation device 140 generates a second signature key x2, and generates a second sketch s' by combining an encoding key ENC(x2-x12) obtained by subtracting the second share x12 from the second signature key x2 and applying an encoding function (ENC) to the value x2-x12. s'=ENC(x2 - x12) + w' …(30)

[0086] The biometric signature generation apparatus 140 selects the second signature key x2 uniformly at random from the information source. The second signature key x2 may be called a temporary private key.

[0087] The biometric signature generation device 140 transmits the second sketch s' (=ENC(x2 - x12) + w') and the message M to the key-based signature generation device 130. The generation of the second sketch s' by the biometric signature generation device 140 and the transmission of the second sketch s' to the key-based signature generation device 130 correspond to the restoration phase in FIG. 2. That is, the generation of the first and second sketches s and s' in the registration phase and restoration phase in FIG. 2 are performed by the key generation device 120 and the biometric signature generation device 140, respectively. The key-based signature generation device 130 and the biometric signature generation device 140 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN, a secure wireless LAN, a WAN, a mobile communication network, a virtual network, and the like).

[0088] The biometric signature generation apparatus 140 may divide the second signing key x2 into a first share x21 and a second share x22, corresponding to the registration phase in FIG. 3, and transmit a sketch s″ (=ENC(x21) + w′) for the first share x21 of the second signing key x2 using the second biometric information w′ as a second sketch to the key-based signature generation apparatus 130 for registration.

[0089] The key-based signature generation device 130 receives the second sketch s' and the message M from the biometrics-based signature generation device 140. The key-based signature generation device 130 inputs the difference s - s' between the first sketch s and the second sketch s' into a decryption function (Decode). If the first biometric information w and the second biometric information w' belong to the same person (if the first biometric information w and the second biometric information w' are within the correction range), the decryption function (Decode) generates a difference Δ=x1 - x2 between the first signature key x1 and the second signature key x2. Δ←DEC(s - s') = DEC (ENC(x11) + w - (ENC(x2 - x12) - w')) = DEC(ENC(x11 + x12 - x2) + w-w') = DEC(ENC(x1 - x2)) -DEC(w-w') = x1 - x2 …(31)

[0090] Instead of the decryption function DEC, which takes the difference s - s' between the first sketch s and the second sketch s' as an argument, a key difference recovery function (algorithm) Diff(DiffRec), which takes the first sketch s and the second sketch s' as arguments and recovers the key difference corresponding to s and s', may be used to find the key difference x' between the first signing key x and the difference key Δ (it can also be said that the only difference between Diff and Decode is whether two arguments s and s' are input or a single argument (s - s') is input).

[0091] The key-utilizing signature generation device 130 generates a signature (second signature) σ′ for a message (document) M using the differential key Δ. σ'← Sign(Δ, M) …(32)

[0092] The key-based signature generation apparatus 130 transmits the second signature σ′ to the biometrics-based signature generation apparatus 140 .

[0093] The biometric signature generation device 140 receives the second signature σ′ and generates the first signature σ (=Sign(x,M)) when generated for the message M using the first signature key x1 using the key homomorphic operation Khom(σ′, x2). σ(=Sign(x1,M))← KHom(σ', x2) …(33)

[0094] The biometric signature generation device 140 transmits the first signature σ and the message M to the verification device 150. Note that, although it is implementation-specific, the destination of the first signature σ is not limited to the verification device 150, but may be any device (node) not shown. That is, the destination of the first signature σ is not limited to the verification device 150, but a pair of the signature and the message may be transmitted to and stored in a device other than the verification device 150, and the pair of the signature and the message stored in the other device may be acquired by a verification device (which may be the other device) and used to verify the signature. In this case, there may be a time lag between the generation and verification of the signature, and multiple signatures may be verified together. For example, in a blockchain network, a pair of the signature and the message is transmitted to, for example, the nearest node and temporarily stored, and the signature is verified by the node. If accepted, the signature is propagated to other nodes, and this procedure is repeated.

[0095] The verification device 150 receives and registers the verification key vk from the key generation device 120. The verification device 150 receives the first signature σ and the message M transmitted from the biometric signature generation device 140. The verification device 150 verifies the correctness of the pair of the message M and the first signature σ using the verification key vk. 0 / 1 ←Verify(vk, M, σ) …(34) In the case of accept, it is set to 1, and in the case of reject, it is set to 0. Verification device 150 may transmit the verification result to, for example, biometric signature generation device 140 which is the sender of first signature σ. The biometric signature generation device 140 and verification device 150 may be configured to be communicatively connected via a network (for example, at least one of a wired LAN, a wireless LAN with security measures, a WAN, a mobile communication network, a virtual network, and the like).

[0096] In FIG. 6, the key-based signature generation device 130 may be called the second signature generation device because it generates the second signature σ′ for the message M using the differential key Δ, and the biometrics-based signature generation device 140 may be called the first signature generation device because it generates the first signature σ when signing the message M using the first signature key x1.

[0097] Figure 7 illustrates the calculation process in each device described above with reference to Figure 6. Although it overlaps with the above explanation, the following provides additional information about the calculation. Note that in Figure 7, the numbers in parentheses at the end of the explanation of the process in each device indicate the processing number (step) of that process within that device.

[0098] The key generating device 120 acquires first biometric information w for user registration (1). The first biometric information w may be, for example, an n-dimensional vector.

[0099] The key generating device 120 executes the setup algorithm of the digital signature system, and determines the parameter pp in advance according to the security parameter κ and makes it public to the user (setup) (2). pp ← Setup(1 κ ) …(35)

[0100] The parameters pp consist of information about groups, hash functions, etc., and are common parameters for the system, and are referred to here as public parameters. Setup may be performed, for example, before the system is put into operation, and each of the devices 120, 130, 140, and 150 in the digital signature system 100 can use (share) the public parameters pp.

[0101] The key generating device 120 generates a pair of a signature key (private key) and a verification key (public key) in accordance with the public parameters pp (3). (sk,vk) ← KeyGen(pp) …(36) Let the private key (signature key) sk be the first signature key x1.

[0102] The key generation device 120 divides (additively shares) the first signature key x1 into a first share x11 and a second share x12 (4). x1 = x11 + x12 …(37) The key generation device 120 stores the first share x11 and the second share x12 of the first signature key x1 in a storage unit (not shown).

[0103] The key generating device 120 generates an encoding key ENC(x11) by encoding the first share x11 of the first signature key x1, and generates a first sketch s by combining the encoding key ENC(x11) and the first biometric information w (5). s = ENC(x11) + w …(38)

[0104] The key generation device 120 transmits the verification key vk to the verification device 150 (6). The verification device 150 receives and stores the verification key vk (1).

[0105] The key generation device 120 transmits the first sketch s to the key-based signature generation device 130 (7). The key generation device 120 may transmit the verification key vk before the generation process of the first sketch s (5).

[0106] The key generation device 120 transmits the second share x12 of the first signature key x1 to the biometric signature generation device 140. Upon receiving the second share x12 of the first signature key x1, the biometric signature generation device 140 stores it in a storage unit (not shown).

[0107] The encoding function ENC converts the plaintext m contained in the source space into a code c. The decoding function DEC converts the code c back into the plaintext m. c← ENC(m) …(39) m← DEC(c) …(40)

[0108] Here, for a code c' whose difference from c, which is the code of any plaintext m included in the information source space, is within the correction range, m = DEC(c') …(41) must hold true.

[0109] In the embodiment, a linear code is used. For the coding, for example, an error-correcting code (such as a Hamming code, a BCH (Bose-Chaudhuri-Hocquenghem code), an RS (Reed-Solomon) code, or an LDPC (low-density parity-check code)) may be used. Alternatively, for example, lattice coding may be used. More specifically, methods using integer lattices, methods using triangular lattices, and methods using more complex lattices are known (see, for example, Reference 3).

[0110] The key-using signature generation device 130 receives and stores the first sketch s from the key generation device 120 (1).

[0111] The biometric signature generation device 140 acquires the user's second biometric information w' (2), acquires the message M to be signed (3), and uniformly randomly selects a second signature key x2 from the information source (4). Δ is also called a shift or temporary key. The biometric signature generation device 140 generates a second sketch s' from the second biometric information w' and a coded value obtained by subtracting the second distribution x12 of the first signature key x1 from the second signature key x2 (5). s' = ENC(x2 - x12) + w' …(42)

[0112] The biometrics-based signature generation apparatus 140 transmits the second sketch s' and the message M to the key-based signature generation apparatus 130 (6).

[0113] The key-based signature generating device 130 receives the second sketch s′ and the message M (2), Δ←DEC(s - s') …(43) In equation (43), if the distance between the first biometric information w and the second biometric information w' is equal to or less than a predetermined threshold (within the range of the same person), DEC(s - s') is the value obtained by subtracting x2 - x12, which is the value obtained by subtracting the second share x12 of the first signature key x1 from the second signature key x2, from the first share x11 of the first signature key x1. x11 - (x2 - x12) = x11 + x12 - x2 = x1- x2 In equation (43), Δ is the difference (differential key) x1 - x2 between the first signature key x1 and the second signature key x2.

[0114] The key-based signature generation device 130 generates a second signature σ′ (=Sign(Δ, M)) for the message M using the differential key Δ (4).

[0115] The key-based signature generation apparatus 130 transmits the second signature σ′ to the biometrics-based signature generation apparatus 140 (5).

[0116] The biometric signature generation device 140 receives the second signature σ′ (=Sign(Δ, M)) (7).

[0117] The biometric signature generation device 140 generates a first signature σ (=Sign(x1,M)) equivalent to the signature created for the message M using the first signature key x1 by the key homomorphic operation KHom(σ', x2) to generate the second signature σ' (8).

[0118] σ(=Sign(x1, M))← KHom(σ', x2) …(44)

[0119] The biometric signature generation device 140 transmits the first signature σ and the message M to the verification device 150 (9). The biometric signature generation device 140 obtains the verification key (public key) vk generated by the key generation device 120, and verifies the correctness of the pair of the message and the first signature σ against the first signature σ calculated by the key homomorphic operation KHom(σ', x2) (0 / 1←Verify(vk, M, σ)). If the pair is correct (if accepted), the biometric signature generation device 140 transmits the first signature σ and the message M to the verification device 150 (9). If the pair is incorrect (if not accepted), the biometric signature generation device 140 may not transmit the first signature σ and the message M to the verification device 150. The biometric signature generation device 140 verifies the correctness (acceptance / rejection) of the first signature σ and the message M, which are generated in a distributed manner between the biometric signature generation device 140 and the key-based signature generation device 130. This prevents the leakage of signature key information from the signature σ, for example, when the first signature σ is incomplete, thereby increasing security and making it possible to suppress an increase in network traffic between the biometric signature generation device 140 and the verification device 150, for example.

[0120] The verification device 150 receives the first signature σ and the message M (2), and verifies the first signature σ (3).

[0121] The key homomorphic operation σ ← KHom(σ', x2) in equation (44) is an algorithm that generates a signature σ for a message M using a first signing key x1 from a second signature σ' for the message M using a differential key Δ(=x1-x2) and a second signing key x2.

[0122] Key homomorphic schemes will be explained using Schnorr signatures as an example. The following is an explanation of key homomorphic operations based on the Adapt algorithm in Reference 2. Although the Adapt algorithm in Reference 2 does not match the KHom algorithm in this disclosure, it is useful for intuitively understanding KHom. First, an overview of Schnorr signatures will be provided.

[0123] <Key generation> p and q generate prime numbers (where q|(p - 1) (q is a factor of p-1)). Multiplicative group Zp * Define an element g of order q. That is, g^q ≡ 1 (mod p) …(45) A private key x is chosen uniformly at random. x ← R Zq (Zq = Z / qZ: set of integers from 0 to q) ... (46) Symbol "← R " represents a uniformly random selection from the source (in this case, Zq). Calculate the public key vk. vk = g^x mod p …(47) The public keys may be p, q, g, and vk, where p, q, and g may be shared by each device as common parameters, and the public key may be vk.

[0124] <signature> In Sign(sk, M), r is chosen uniformly at random from Zp (k← R Zp), and outputs the signature σ calculated as follows: c ← H(g r ,M) …(48) y ← r + x·c mod p …(49) Signature:σ ← (c, y) …(50)

[0125] <Verification> In the signature verification, Verify(vk,M,σ), c= H(((g x ) -c g y ), M) …(51) If it is true, it outputs 1, otherwise it outputs 0.

[0126] <Key homomorphism: Schnorr signature> If signature σ (=Sign(x, M)= (c, y)) is a valid signature for message M under verification key v, then a new signature calculated using σ and a shift Δ(x→x+Δ) is: σ' ← (c, y') …(52) y' ← r +(x+Δ)·c mod p …(53) is the verification key v'=g x+Δ …(54) It can be seen that this is a valid signature for message M under H(v' -c g y' , M) = H({g (x+Δ)} -c ·g {r+(x+Δ)c} , M) = H(g -(x+Δ)c ·g r ·g (x+Δ)c , M) = H(g r , M) = c …(55)

[0127] As described above, the algorithm Adapt in Reference 2 converts a signature σ using a signing key x into a signature σ' using a signing key x+Δ. If x in the algorithm Adapt in Reference 2 corresponds to the differential key Δ of the present disclosure and the shift Δ in the algorithm Adapt in Reference 2 corresponds to the second signing key x2 of the present disclosure, then Khom(σ', x2) in the present disclosure converts the second signature σ' for a message M using the differential key Δ into a first signature σ (=Sign(x1, M)) using the first signature x1 (=Δ+x2=(x1 - x2) + x2) shifted by the second signing key x2.

[0128] FIG. 8 is a diagram illustrating an example of a device configuration for realizing the processing operations of FIG. The key generation device 120 includes a biometric information acquisition unit 121 having a sensor (not shown) that acquires first biometric information w of a user (or an interface that receives the first biometric information w acquired by an external sensor via a network such as a communication line), a first signing key / verification key generation unit 122 that generates a first signing key x1 and a verification key vk, a first signing key distribution unit 123 that divides (additively distributes) the first signing key x1 into a first share x11 and a second share x12 and stores the divided shares in a storage unit (not shown), a first sketch generation unit 124 that generates a first sketch s for the first share x11 using the first biometric information w, a verification key transmission unit 125 that transmits the verification key vk to the verification device 150, a first sketch transmission unit 126 that transmits the first sketch s to the key-based signature generation device 130, and a second share transmission unit 127 that transmits the second share x12 to the biometric signature generation device 140. The verification key transmitting unit 125 may transmit the verification key vk to a key server (public key database) or the like.

[0129] The key-based signature generation device 130 includes a first sketch receiving unit 131 that receives a first sketch s transmitted from the key generation device 120, a storage unit 132 that stores the first sketch s received by the first sketch receiving unit 131, and a signature generation unit 134 that transmits and receives information to and from the key-based signature generation device 130 and generates a second signature σ' for a message M. The signature generation unit 134 includes a second sketch / message receiving unit 1341 that receives the second sketch s' and the message M transmitted from the biometric signature generation device 140, a differential key generation unit 1342 that generates a differential key Δ, a second signature generation unit 1343 that generates a second signature σ' for the message M using the differential key Δ, and a second signature transmission unit 1344 that transmits the second signature σ' to the biometric signature generation device 140.

[0130] The biometric signature generation device 140 includes a biometric information acquisition unit 141 equipped with a sensor (not shown) or the like for acquiring the user's second biometric information w′, a second share receiving unit 142 for receiving the second share x12 (the second share of the first signature x1) transmitted from the key generation device 120, a message acquisition unit 143 for acquiring the message M to be signed, a signature generation unit 144 for transmitting and receiving information to and from the key-based signature generation device 130 and generating a first signature σ corresponding to a signature generated for the message M using the first signature key x1, and a transmission unit 145 for transmitting the first signature σ and the message M to the verification device 150.

[0131] The signature generation unit 144 includes a second signature key generation unit 1441 that uniformly randomly selects a second signature key x2 from an information source; a second sketch generation unit 1442 that generates a second sketch s' by using the second biometric information w' for a value x2-x12 obtained by subtracting the second distributed value x12 of the first signature key x1 from the second signature key x2; a second sketch / message sending unit 1443 that sends the second sketch s' and the message M to the signature generation unit 134 of the key-based signature generation device 130; a second signature receiving unit 1444 that receives the second signature σ' generated by the signature generation unit 134 of the key-based signature generation device 130; and a first signature generation unit 1445 that generates a first signature σ equivalent to the signature generated for the message M using the first signature key x1, from the second signature σ' and the second signature key x2 using a key homomorphic operation. The sensor (not shown) in the biometric information acquisition unit 141 is preferably configured in the same manner as the sensor (not shown) in the biometric information acquisition unit 121 of the key generation device 120, and the first biometric information w and the second biometric information w' are biometric information of the same target (area) of the living body.

[0132] The verification device 150 includes a verification key receiving unit 151 that receives a verification key vk generated by the key generation device 120, a storage unit 152 that stores the received verification key vk, a signature / message receiving unit 153 that receives the first signature σ and the message M transmitted from the biometric signature generation device 140, and a signature verification unit 154 that verifies the correctness of the pair of the message M and the first signature σ by using the verification key vk generated by the key generation device 120. The verification key receiving unit 151 may receive the verification key vk from a key server (public key database) (not shown) or the like.

[0133] Fig. 9 is a diagram illustrating an example of processing operations at the key registration stage in the digital signature system 100 shown in Fig. 8. The biometric information acquisition unit 121 of the key generation device 120 acquires first biometric information w for user registration (step A1).

[0134] The first signature key / verification key generation unit 122 of the key generation device 120 generates a pair of a first signature key x1 and a verification key vk corresponding to the first signature key x1 (step A2).

[0135] The first signature key sharing unit 123 of the key generation device 120 divides the first signature key x1 into a first share x11 and a second share x12 (step A3).

[0136] The first sketch generation unit 124 of the key generation device 120 encodes the first shared value x11 of the first signature key x1, and adds the first biometric information w to the encoded encoding key ENC(x11) to generate a first sketch s (step A4). s = ENC(x11) + w …(56) The right side of equation (56) may be a subtraction of ENC(x) from w instead of an addition of ENC(x11) and w, or may be an exclusive OR operation of ENC(x11) and w for each bit.

[0137] In the following, as a non-limiting example of encoding, an example will be described in which encoding using a square lattice, as disclosed in Patent Document 1, etc., is applied to equation (56).

[0138] Here, the first biometric information w and the second biometric information w' are assumed to be n-dimensional real vectors. w= (w1, …, w n ), w'= (w'1,…, w' n ) …(57)

[0139] The distance between the first biometric information w and the second biometric information w' is, for example, L ∞ Distance (L ∞ The norm (maximum norm) is expressed as follows: d (n) ∞ (w, w') = max {|w i - w' i |, i=1,…,n} …(58) Distance d (n) ∞ (w, w') is a given threshold t h Below(d (n) ∞ (w, w')≦t h ) then it is considered a match (same organism).

[0140] The lattice point set L is defined as follows: L={Y=(y1,…,y n )| y i is a non-negative integer, 0≦y i ≦K} …(59) where K is t h Ya|w i | is a predetermined positive integer that is sufficiently larger than

[0141] The function int() that associates one integer z with an N-dimensional integer vector Y∈L is defined as follows: z←int(Y)=Σ[i=1, n]y i (2K) i-1 …(60) Inverse function int -1 () is a function that maps an integer z to an n-dimensional integer vector Y. Y ← int -1 (z) …(61)

[0142] The first shared value x11 (a positive integer) of the first signing key x1 is calculated using the inverse function int -1 When input into (), we get an n-dimensional integer vector A. A=(a1,…, a n )←int -1 (x11) …(62)

[0143] Here, the encoding function ENC() is h *int -1 (), the encoding key c obtained by encoding the first shared value x11 is an n-dimensional vector, and is given by: c=(c1,…,c n )←ENC(x11)=2t h *int -1 (x)=2t h *(a1,…, a n ) …(63)

[0144] Therefore, the first sketch s is represented as follows: s = ENC(x11) + w = ​​2t h *(a1,…, a n )+(w1,…, w n ) =(2t h *a1+w1,…,2t h *a n +w n ) …(64)

[0145] The verification key transmission unit 125 of the key generation device 120 transmits the generated verification key vk to the verification device 150 (step A5). Note that the key generation device 120 may upload the verification key vk to a key server (public key database) (not shown) or the like and make it public on the Internet or the like.

[0146] The first sketch transmission unit 126 of the key generation device 120 transmits the first sketch s to the key-based signature generation device 130 (step A6).

[0147] The verification key receiving unit 151 of the verification device 150 receives the verification key vk (step D1) and stores the verification key vk in the storage unit 152 (step D2). The verification key receiving unit 151 of the verification device 150 may receive and store the verification key vk from a key server (not shown) or the like that registers the verification key.

[0148] The first sketch receiving unit 131 of the key-based signature generating device 130 receives the first sketch s (step B1) and stores it in the storage unit 132 (step B2).

[0149] The second shared value transmitting unit 127 of the key generating apparatus 120 transmits the second shared value x12 to the biometric signature generating apparatus 140 (step A7).

[0150] The second shared value receiving unit 142 of the biometric signature generating apparatus 140 receives the second shared value x12 transmitted from the second shared value transmitting unit 127 of the key generating apparatus 120 (step C1). Note that the order of steps A1 and A2 may be reversed. Also, the order of steps A5, A6, and A7 may be reversed.

[0151] FIG. 10 is a diagram illustrating an example of processing operations at the signature creation stage in the digital signature system 100 shown in FIG.

[0152] The biometric information acquisition unit 141 of the biometric signature generation device 140 acquires the second biometric information w' for the user's signature (step C2).

[0153] The message acquisition unit 143 of the biometric signature generation apparatus 140 acquires the message M (step C3).

[0154] The second signature key generation unit 1441 of the biometric signature generation device 140 selects a random number uniformly at random from an information source, for example, and sets the random number as the second signature key x2 (step C4).

[0155] The second sketch generation unit 1442 of the biometric signature generation device 140 generates a second sketch s' by combining the value ENC(x2-x12), which is obtained by encoding the value x2-x12 obtained by subtracting the second distributed value x12 from the second signature key x2, with the second biometric information w' (step C5). s'=ENC(x2 - x12) + w' …(65)

[0156] As a non-limiting example, if we use a square lattice as the encoding, similar to the first sketch s, c'=(c'1,…,c' n )←Encode(x2-x12)=2t h *int -1 (x2-x12)=2t h *(a'1,…, a' n ) …(66) Therefore, the second sketch s' is an n-dimensional real-valued vector. s' = 2t h *int -1 (x2 - x12) + w' = 2t h *(a'1,…, a' n )+(w'1,…,w' n ) =(2t h *a'1+ w'1,…,2t h *a' n + w' n ) …(67)

[0157] The second sketch / message sending unit 1443 of the biometrics-based signature generation apparatus 140 sends the second sketch s' and the message M to the key-based signature generation apparatus 130 (step C6).

[0158] The second sketch / message receiving unit 1341 of the key-based signature generation apparatus 130 receives the second sketch s' and the message M transmitted from the biometrics-based signature generation apparatus 140 (step B3).

[0159] The differential key generation unit 1342 of the key-utilizing signature generation device 130 inputs the difference s-s' between the first sketch s and the second sketch s' into the decryption function DEC and decrypts the result, obtaining the second signature key x' (step B4). Δ←DEC(s - s') …(68)

[0160] Due to the linearity of the sign function ENC, s-s' is expressed as follows: s-s'= (w1,…, w n ) + ENC(x11) - {(w'1,..., w' n ) + ENC(x2 - x12)} = (w1,…, w n ) - (w'1,…, w' n ) + ENC(x11) - ENC(x2 - x12) = (w1-w'1,…,w n - w' n )+ENC(x11 - (x2 - x12)) = (w1-w'1,…,w n - w' n )+ENC(x1 - x2) …(69)

[0161] The difference between the first biometric information w and the second biometric information w' is w-w'=(w1-w'1..., w n -w' n ) is within the correction range of the linear code, the difference is absorbed by the decoding function DEC, and from equation (69), equation (68) becomes Δ=DEC(s-s') = DEC(ENC(x1 - x2)) = x1 - x2 …(70) This becomes:

[0162] As a non-limiting example, a square lattice is used for encoding, and the encoding function ENC is 2t h *int -1 When () is used, the decoding function DEC is DEC(c) = int(c / 2t h ) …(71) It may also be possible to use the following.

[0163] In this case, DEC(s - s') is obtained by the following formula, since x11 and x2-x12 are integers. int -1 (x11)-int -1 (x2 - x12)=int -1 (x11 - (x2 - x12) ) …(72) holds, TIFF2025131194000002.tif15153 TIFF2025131194000003.tif10150…(73) For the first biometric information w and the second biometric information w′, d (n) ∞ (w, w') = max { |w i - w' i |, i=1,…,n} ≦t h …(74) Then, in equation (73), the n-dimensional vector (w-w') / 2t h Each component of is less than ±1 / 2, and the value Δ of DEC(s - s') is Δ=DEC(s-s') = int{int -1 (x11 - (x2 - x12))+1 / 2t h (w-w')} = x11 - (x2 - x12) = x1 - x2 …(75)

[0164] From the above, the distance d between the first biometric information w and the second biometric information w' is calculated by the decoding function DEC. (n) ∞If (w, w') is within the correction range, it can be confirmed that the difference x1-x2 between the first signing key x1 and the second signing key x2 is correctly restored. That is, the differential key generation unit 1342 of the key-utilizing signature generation device 130 can correctly calculate the differential key Δ between the first signing key x1 and the second signing key x2 by decrypting the value obtained by subtracting the second sketch s' from the first sketch s. The generation of the differential key by the differential key generation unit 1342 of the key-utilizing signature generation device 130 corresponds to step B4 of generating the differential key Δ between the first signing key x1 and the second signing key x2, and step 7 in FIG. 2, where Δ=Rec(s, s') (recovering the difference between the first data x1 and the second data x2 from s and s') is calculated.

[0165] The second signature generation unit 1343 of the key-utilizing signature generation device 130 generates a second signature for the message M using the differential key Δ: σ'←Sign(Δ, M) …(76) (Step B5).

[0166] The second signature transmitting unit 1344 of the key-based signature generating apparatus 130 transmits the second signature σ′ to the biometrics-based signature generating apparatus 140 (step B6).

[0167] The second signature receiving unit 1444 of the biometrics-based signature generation apparatus 140 receives the second signature σ′ transmitted from the key-based signature generation apparatus 130 (step C7).

[0168] The first signature generation unit 1445 of the biometrics-based signature generation device 140 performs key homomorphic operation using the second signature σ′ and the second signature key x2. σ←KHom(σ', x2) …(77) From the second signature σ' for the message M using the differential key Δ (= x1 - x2), a first signature σ for the message M is generated using the first signature key x1 (= Δ + x2) obtained by shifting the differential key Δ by the second signature key x2 (step C8).

[0169] FIG. 11 is a diagram illustrating an example of the operation of the signature verification process in the digital signature system 100 shown in FIG.

[0170] The sending unit 145 of the biometric signature generation device 140 sends the first signature σ and the message M to the verification device 150 (step C9).

[0171] The signature / message receiving unit 153 of the verification device 150 receives the first signature σ and the message M sent from the biometric signature generation device 140 (step D3).

[0172] The signature verification unit 154 verifies the correctness of the set of the message M and the first signature σ using the verification key vk (step D4).

[0173] The verification device 150 may transmit the verification result (acceptance / rejection notification) to the source, the biometric signature generation device 140 (step D5). In this case, the biometric signature generation device 140 receives the acceptance / rejection notification (step C10).

[0174] As mentioned above, the biometrics-based signature generation device 140 may be configured to include a signature verification unit (not shown) that acquires the verification key vk generated by the key generation device 120 and verifies the correctness of the message M and the first signature σ using the verification key vk for the first signature σ generated by transmitting and receiving information between the key-based signature generation device 130. Fig. 12 is a diagram illustrating an example of the processing operations at the signature creation stage and the signature verification processing in the digital signature system. Referring to Fig. 12, steps C11 to C13 are inserted between step C8 and step C9 in the processing flow of the biometrics-based signature generation device 140 in Figs. 10 and 11. The other steps C2 to C10 are the same as those in Figs. 10 and 11, and therefore their description will be omitted.

[0175] In FIG. 12, in step C10, the signature verification unit (not shown) obtains the verification key vk generated by the key generation device 120, and verifies the correctness of the message M and the first signature σ using the verification key vk for the first signature σ (step C11). 0 / 1←Verify(vk, M, σ) The biometric signature generating device 140 may obtain the verification key vk from the key generating device 120, or if the key generating device 120 has registered the verification key vk in a key server (public key database) or the like (not shown), the biometric signature generating device 140 may obtain the verification key vk from the key server (public key database) or the like.

[0176] As a result of the verification of the first signature σ, if the pair of the message M and the first signature σ is correct (if accepted) (Yes branch of step C12), the biometric signature generation device 140 transmits the first signature σ and the message M from the transmission unit 145 to the verification device 150 (step C9). If the verification result shows that the pair of the message M and the first signature σ is incorrect (if not accepted) (No branch of step C12), the biometric signature generation device 140, for example, interrupts the process (step C13). In this case, the first signature σ and the message M are not transmitted to the verification device 150.

[0177] The biometric information may be binary coded into two-valued data. · Number of bits in the codeword: n, The number of allowable error bits is D.

[0178] 8 divides the first signature key x1 into a first share x11 and a second share x12, inputs the first share x11 into an error correction coding algorithm (ENC), and executes it to obtain an n-bit coding key c (=ENC(x11)). Note that, as described above, the first share x11 and the second share x12 may be divided in such a way that their bit-wise exclusive OR operation (xor) results in the first signature key x1. c=[c1,…,c n ] ← ENC(x11) …(78)

[0179] The first sketch generation unit 124 calculates the exclusive OR (xor) of each bit of the first biometric information w (n bits) and the encoding key c, and outputs the result as a first sketch s (n bits). s=ENC(x11) xor w …(79)

[0180] The first sketch s is expressed in bits as s = w xor c = [w1xor c1,…, w n xor c n ] …(80)

[0181] The second sketch generation unit 1442 of the biometric signature generation device 140 generates a second sketch s' from the bitwise exclusive OR of the second biometric information w' (n bits) and the encoded value c' (=ENC(x2 xor x12)) of the bitwise exclusive OR (x2 xor x12) of the second signature key x2 and the second shared value x12, and generates a second sketch s' (step C5 in Figure 10). c'=[c'1,…,c' n ] ← ENC(x2 xor x12) …(81) s'=ENC(x2 xor x12) xor w' …(82)

[0182] The second sketch s' is expressed in bits as s'= w' xor c' = [w'1xor c'1, w'2xor c'2,…, w' n xor c' n ] …(83)

[0183] The second sketch / message sending unit 1443 of the biometrics-based signature generation apparatus 140 sends the second sketch s' and the message M to the key-based signature generation apparatus 130 (step C6 in FIG. 10).

[0184] The differential key generation unit 1342 of the key-utilizing signature generation device 130 performs a bitwise exclusive OR operation between the first sketch s and the second sketch s′: t=s xor s' …(84) The decrypted value is set as the differential key Δ (step B4 in FIG. 10). Δ←DEC(t) …(85)

[0185] t = s x or s' = [w1xor c1, …, w n xor c n ] xor [w'1xor c'1,…, w' n xor c' n ] = [(w1xor c1) xor (w'1xor c'1), …, (w n xor c n ) xor (w' n xor c' n )] = [w1xor w'1, …, w n xor w' n ] xor [c1xor c'1, …, c n xor c' n ] = (w xor w') xor (ENC(x11) xor ENC(x2 xor x12)) = (w xor w') xor ENC(x11 xor (x2 xor x12)) …(86) This becomes: where: ENC(x11 xor (x2 xor x12)) xor t =ENC(x11 xor (x2 xor x12))xor ((w xor w′) xor ENC(x2 xor (x2 xor x12))) =w xor w′ …(87) and the difference between ENC(x11 xor (x2 xor x12)) and t is equal to the difference (Hamming distance) between the first biometric information w and the second biometric information w'. Therefore, by executing the decoding function DEC(t) from t whose difference from the codeword ENC(x11 xor (x2 xor x12)) is less than or equal to D, (x11 xor (x2 xor x12)) is restored. (x11 xor (x2 xor x12))=x1 xor x2=Δ …(88) Therefore, for the differential key Δ, equation (85) holds.

[0186] That is, it can be confirmed that the differential key Δ=x1 xor x2 is correctly calculated from the bitwise exclusive OR operation of the first sketch s and the second sketch s′.

[0187] 2, the first device 10 divides the first data x1 into x11 and x12 and registers s=Gen(x11, w) in the second device 20, but the present disclosure is not limited to such a configuration. For example, as shown as a modified example in FIG. 13, the first device 10′ may divide the first biometric information w into partial biometric information w11 and w12.

[0188] <Registration phase> Step 1: The first device 10' divides the first biometric information w1 into first partial biometric information w11 and second partial biometric information w12. w1 = w11 + w12 …(89) If the first and second biometric information w and w' are n-dimensional vectors as in equation 57, the right-hand side of equation 89 is vector addition. Alternatively, if the first and second biometric information w and w' are binary codes, they may be divided such that the bitwise exclusive OR operation (xor) of the first partial biometric information w11 and the second partial biometric information w12 becomes the first biometric information w1. w1 = w11 xor w12 …(90)

[0189] Step 2: The first device 10′ generates a first sketch s for the first data x1 using the first partial biometric information w11. s = Gen(x1, w11) …(91)

[0190] Step 3: The first device 10 ′ transmits the first sketch s to the second device 20 ′, and the second device 20 ′ registers the first sketch s in the storage unit 22 .

[0191] <Restore phase> Step 4: The first device 10' generates a second sketch s' for the second data x2 by using a value obtained by calculating the second partial biometric information w12 on the second biometric information w'. s' = Gen(x2, w' - w12) ...(92) Step 5: The first device 10' sends the second sketch s' to the second device 20'.

[0192] Step 6: The second device 20′ reads the first sketch s registered in the storage unit 22.

[0193] Step 7: The second device 20' can restore the difference Δ(=x1-x2) between the first data x1 and the second data x2 using the restoration function Rec(s, s') with the first sketch s (=Gen(x1, w11)) and the second sketch s'=Gen(x2, w'-w12) transmitted from the first device 10'. After inputting the second sketch s' received from the first device 10' into the restoration function Rec(s, s') and executing it, the second device 20' clears s' to zero (e.g., resets it to 0) or deletes it (s' is not left in the second device 20').

[0194] For example, in the first device 10′, when a linear encoding function ENC is used as the sketch generation function Gen, and a sketch s is obtained by combining a code word ENC(x) obtained by encoding data x with biometric information w, in the enrollment phase, a first sketch s is generated for the first data x1 using partial biometric information w11, one of the two parts obtained by dividing the first biometric information w. s = ENC(x1) + w11 …(93) The first device 10' generates a first sketch s, transmits it to the second device 20', and registers it in the storage unit 22 of the second device 20'.

[0195] In the restoration phase, the first device 10' generates a second sketch s' for the second data x2 using the second biometric information w' and the other partial biometric information w12 obtained by dividing the first biometric information w into two, and transmits it to the second device 20'. s' = ENC(x2) + w' - w12 …(94)

[0196] In the second device 20′, when the decoding function DEC is used as the restoration function Rec(s, s′) for the second sketch s′ and the first sketch s registered in the storage unit 22, Δ ← DEC(s - s') = DEC(ENC(x1) + w11 - (ENC(x2) + w' - w12)) = DEC(ENC(x1 - x2) + DEC(w11 + w12 - w') = DEC(ENC(x1 - x2) + DEC(w - w') …(95) In equation (95), if the distance |w - w'| between the first biometric information w and the second biometric information w' is within the correction range, DEC(s - s') = x1 - x2 and therefore Δ = x1 - x2.

[0197] When the modification of FIG. 13 is applied to the example of FIG. 3, the first device 10′ divides the second biometric information w′ into first partial biometric information w21 and second partial biometric information w22. w' = w21 + w22 …(96) Then, the first device 10′ may transmit, for example, s″ in the following formula to the second device 20′ as a second sketch and register it in the storage unit 22. s"= Gen(x2, w21) …(97)

[0198] Furthermore, when the modification of FIG. 13 is applied to FIG. 6, the key generation device 120 transmits to the biometric signature generation device 140 the other partial biometric information w12, which is the other of the two pieces of divided first biometric information w, instead of x12. In this case, if it is guaranteed that the first biometric information w cannot be restored from the partial biometric information w12, even if the partial biometric information w12 is transmitted to the biometric signature generation device 140, it is possible to prevent the first biometric information w from being restored and leaked from the partial biometric information w12. For example, for decryption that performs error correction of an integer t or less, by providing randomness in dividing the first biometric information w so that the distance between the first biometric information w and the partial biometric information w12 is a sufficiently large value with respect to t, the first biometric information w will not be restored from the partial biometric information w12 at the destination biometric signature generation device 140. In this way, in FIGS. 6 to 12, the first sketch s and the second sketch s' can be replaced with equations (93) and (94), respectively.

[0199] FIG. 14 is a schematic diagram illustrating an example in which each device (120, 130, 140, 150) of the digital signature system 100 described above is implemented by a computer having a communication function and communicatively connectable to one another via a network. In FIG. 14(A), each device (120, 130, 140, 150) includes a processor 201, a storage device 202, an input / output device 203, and a communication interface 204. The storage device 202 may include semiconductor storage such as RAM (Random Access Memory), ROM (Read Only Memory), or EEPROM (Electrically Erasable and Programmable ROM), an HDD (Hard Disk Drive), CD (Compact Disc), DVD (Digital Versatile Disc), etc. The processor 201 executes a program (not shown) stored in the storage device 202 to realize the processing and functions of each device. The input / output device 203 may include a keyboard and a display. For example, the key-based signature generation device 130 may be configured to display and output the verification result (acceptance / rejection) from the verification device 150 on an output device such as a display. Furthermore, in the key generation device 120 and the biometrics-based signature generation device 140 that acquire biometric information, the input device / output device 203 may be configured to include a sensor for acquiring biometric information. In this case, the sensor may be an image sensor (camera) or the like when the biometric information is a face, iris, or the like. In the case of a fingerprint, the sensor may be, for example, a light-emitting diode (LED) that emits near-infrared light and a near-infrared camera that captures the light transmitted through the finger in the case of a finger vein. The sensor may be a removable sensor such as a universal serial bus (USB) device. The communication interface 204 may include a network interface card, a transceiver, or the like, and may be configured to communicate with each other via a local area network (LAN), a wide area network (WAN) such as the Internet, a secure wireless LAN, a mobile communication network, or the like.Furthermore, the communication interface 204 may be configured to have an interface that is communicatively connected to an external sensor (such as a Bluetooth (registered trademark) connected sensor) in the key generating device 120 or the biometric signature generating device 140 and receives biometric information acquired by the external sensor.

[0200] FIG. 14(B) is a diagram illustrating an example in which the devices (120, 130, 140, 150) of the digital signature system 100 described above are implemented as virtual machines using server virtualization technology. Multiple virtual machines (VM) run on a virtualization platform 302, such as a hypervisor, implemented on a physical machine 301 of a server. One or more of the devices (120, 130, 140, 150) of the digital signature system 100 may be implemented as virtual machines (VM). Although there is one physical server, a virtual server environment in which multiple servers run is provided. Each virtual machine (VM) is preferably configured to operate in an isolated environment in memory space. In this case, a program that realizes the processing of any one of the devices (120, 130, 140, 150) runs on the virtual OS (Operating System) of the virtual machine. A virtual machine VM that virtually realizes one of the devices (120, 130, 140, 150) may be configured to communicate with other virtual machines via a virtual network, or may be configured to communicate with other devices among the devices (120, 130, 140, 150) via a physical interface (communication interface) of the physical machine 301 via a LAN, a WAN such as the Internet, etc.

[0201] Although the examples using a square lattice for encoding in equations (56), (65), etc. have been described as non-limiting examples, it goes without saying that error-correcting codes such as RS codes, BCH codes, etc. may also be used as linear codes. Furthermore, biometric information is not limited to real number vectors, and it goes without saying that integer vectors may also be used.

[0202] In the above embodiment, a system that performs processing based on biometric information has been described as an example, but the present disclosure is not limited to biometric information and can also be realized using fuzzy information other than biometric information. For example, the present disclosure may be applied to a PUF (Physically Unclonable Function: a technology that uses individual differences that occur in the manufacturing process of IC chips, for example, to identify individuals (IC chips) like human fingerprints) that identifies semiconductor devices (IC (Integrated Circuit) chips).

[0203] Some examples and embodiments of the present disclosure described above are given below, for example (but are not limited to):

[0204] (Supplementary Note 1) A means for generating a first sketch using first biometric information for one of the two parts of the first data; means for generating a second sketch using second biometric information for a value obtained by dividing the first data into two and calculating the other of the two; A sketch generation device comprising:

[0205] (Appendix 2) In the sketch generation device of Appendix 1, the difference between one of the two parts obtained by dividing the first data and the value calculated by dividing the first data into two parts on the second data corresponds to the difference between the first data and the second data.

[0206] (Supplementary Note 3) In the sketch generating device of Supplementary Note 1, the first data is obtained by adding one of the two parts of the first data to the other part, The value obtained by dividing the second data and the first data into two is This is a value obtained by subtracting the other half of the first data from the second data.

[0207] (Appendix 4) In any one of the sketch generation devices according to Appendices 1 to 3, The system includes a means for registering the first sketch at a registration destination, generating a sketch using the second biometric information for the other of the two pieces of the first data, and registering the sketch at the registration destination as the second sketch.

[0208] (Appendix 5) A restoration device that is communicatively connected to any one of the sketch generation devices of Appendices 1 to 3, At the time of restoration, the device includes means for acquiring the first sketch registered by the sketch generation device, receiving the second sketch transmitted from the sketch generation device to the restoration device, and restoring the difference between the first data and the second data from the first sketch and the second sketch.

[0209] (Supplementary Note 6) A means for generating a first sketch for the first data by using one of the two parts of the first biometric information, and a means for generating a second sketch for the second data by using a value obtained by calculating the other of the two parts of the first biometric information for the second biometric information; A sketch generation device comprising:

[0210] (Appendix 7) In the sketch generation device of Appendix 6, the difference between one of the two parts of the first biometric information divided into two and the value calculated on the other of the two parts of the first biometric information divided into two on the second biometric information corresponds to the difference between the first biometric information and the second biometric information.

[0211] (Supplementary Note 8) A digital signature system includes a key generation device having at least a processor and a communication interface, and performing a process of generating a first sketch using first biometric information for a first share, which is one of two shares of a first signature key, and transmitting the first sketch to a second signature generation device; a first signature generation device having at least a processor and a communication interface; Equipped with. the first signature generation device, a process of communicating with the key generation device to obtain a second share that is the other share of the first signature key; generating a second sketch using second biometric information from a value obtained by calculating the second share of a second signature key; transmitting the second sketch to the second signature generation device; receiving a second signature from the second signature generation device that generates a second signature for the message to be signed using the first sketch and the second sketch; A process is executed to generate and output a first signature for the message to be signed from the second signature.

[0212] (Appendix 9) In the digital signature system of Appendix 8, the second signature is a signature for the message to be signed using a differential key equivalent to the difference between the first signing key and the second signing key, obtained by the second signature generation device restoring the difference between the first sketch and the second sketch, in the case where the first biometric information and the second biometric information are within the range of the same person, and the first signature generation device obtains the first signature for the message to be signed using the first signing key equivalent to a signing key whose value is obtained by shifting the differential key by the second signing key, by a key homomorphic operation on the second signature for the message to be signed using the differential key.

[0213] (Appendix 10) In the digital signature system of Appendix 8 or 9, the first signature generation device obtains a verification key corresponding to the first signature key; Verifying the authenticity of the message to be signed and the first signature pair using the verification key; If the verification result is correct, the message to be signed and the first signature are sent to a verification device that verifies the signature, and if the result is incorrect, they are not sent.

[0214] (Appendix 11) In any of the digital signature systems of Appendices 8 to 10, The difference between the first share and a value obtained by calculating the second signature key and the second share corresponds to a differential key between the first signature key and the second signature key.

[0215] (Appendix 12) In any of the digital signature systems of Appendices 8 to 10, adding the first share and the second share to obtain the first signature key; The value obtained by calculating the second share from the second signature key is the value obtained by subtracting the second share from the second signature key.

[0216] (Appendix 13) In any of the digital signature systems of Appendices 8 to 12, The second signature generation device generates the second signature for the message to be signed from the first sketch sent from the key generation device and the second sketch sent from the second signature generation device, and transmits the second signature to the first signature generation device.

[0217] (Appendix 14) In the registration phase, a first sketch is generated from one of the two pieces of the first data using the first biometric information, and the first sketch is registered; In the restoration phase, a sketch generation method is used to generate a second sketch using second biometric information based on the value obtained by dividing the first data into two and calculating the other half of the first data, and to send the second sketch to the restoration destination.

[0218] (Appendix 15) In the sketch generation method of Appendix 14, the difference between one of the two parts obtained by dividing the first data and the value obtained by calculating the other of the two parts obtained by dividing the first data on the second data corresponds to the difference between the first data and the second data.

[0219] (Supplementary Note 16) In the sketch generation method of Supplementary Note 14, the first data is obtained by adding one of the two parts obtained by dividing the first data to the other part, The value obtained by calculating the other of the two halves of the first data onto the second data is a value obtained by subtracting the other of the two halves of the first data from the second data.

[0220] (Appendix 17) In any of the sketch generation methods of Appendices 14 to 16, the first sketch is registered to a registration destination, and a sketch is generated using the second biometric information for the other of the two pieces of the first data, and is registered as the second sketch to the registration destination.

[0221] (Supplementary Note 18) In the sketch generation method, in the registration phase, a first sketch for the first data is generated using one of the two pieces of the first biometric information and registered; In the restoration phase, a second sketch for the second data is generated using a value obtained by dividing the first biometric information into two halves and calculating the other halves, and the second sketch is sent to the restoration destination.

[0222] (Appendix 19) In the sketch generation method of Appendix 18, the difference between one of the two parts of the first biometric information divided into two and the value calculated on the other of the two parts of the first biometric information divided into two on the second biometric information corresponds to the difference between the first biometric information and the second biometric information.

[0223] (Appendix 20) A restoration method that acquires the first sketch registered by any one of the sketch generation methods of Appendices 14 to 19, receives the second sketch, and restores the difference between the first data and the second data from the first sketch and the second sketch.

[0224] (Supplementary Note 21) A digital signature method includes a key generation device generating a first sketch using first biometric information for a first share, the first share being one of two shares of a first signature key, and transmitting the first sketch to a second signature generation device; a first signature generation device; communicating with the key generation device to obtain a second share that is the other share of the first signature key; generating a second sketch using second biometric information for a value obtained by calculating the second share of a second signature key; sending the second sketch to the second signature generation device; receiving a second signature from the second signature generation device that generates a second signature for the message to be signed using the first sketch and the second sketch; A first signature for the message to be signed is generated from the second signature and output.

[0225] (Appendix 22) In the digital signature method of Appendix 21, the second signature is a signature for the message to be signed using a differential key equivalent to the difference between the first signature key and the second signature key, obtained by the second signature generation device restoring the difference between the first sketch and the second sketch, in the case where the first biometric information and the second biometric information are within the range of the same person, and the first signature generation device obtains the first signature for the message to be signed using the first signature key equivalent to the signature key whose value is obtained by shifting the differential key by the second signature key, by a key homomorphic operation on the second signature for the message to be signed using the differential key.

[0226] (Appendix 23) In the digital signature method of Appendix 21 or 22, the first signature generation device obtains a verification key corresponding to the first signature key, and uses the verification key to verify the correctness of the pair of the message to be signed and the first signature. If the verification result is correct, the message to be signed and the first signature are transmitted to a verification device that verifies the signature, and if the result is incorrect, they are not transmitted.

[0227] (Appendix 24) In any of the digital signature methods of Appendices 21 to 23, The difference between the first share and the value obtained by calculating the second share from the second signature key corresponds to the differential key between the first signature key and the second signature key.

[0228] (Appendix 25) In any of the digital signature methods of Appendices 21 to 24, adding the first share and the second share to obtain the first signature key; The value obtained by dividing the second data and the first data into two is This is a value obtained by subtracting the other half of the first data from the second data.

[0229] (Appendix 26) In any of the digital signature methods of Appendices 21 to 25, The value obtained by calculating the second share from the second signature key is the value obtained by subtracting the second share from the second signature key. The second signature generation device generates the second signature for the message to be signed from the first sketch sent from the key generation device and the second sketch sent from the second signature generation device, and transmits the second signature to the first signature generation device.

[0230] (Appendix 27) A program that causes a computer to execute a process of generating a first sketch using first biometric information for one of two halves of first data, and a process of generating a second sketch using second biometric information for a value obtained by calculating the other of two halves of the first data on second data.

[0231] (Appendix 28) A program that causes a computer to execute a process of generating a first sketch for first data using one of two parts of first biometric information, and a process of generating a second sketch for second data using a value obtained by calculating the other of two parts of the first biometric information for second biometric information.

[0232] [Reference 1] Yevgeniy Dodis, et al., "Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data", SIAM Journal on Computing, 38(1):97-139, 2008 [Reference 2] David Derler, et al., "Key-Homomorphic Signatures: Definitions and Applications to Multiparty Signatures and Non-Interactive Zero-Knowledge," Designs, Codes and Cryptography 87, 1372-1413, 2019 [Reference 3] JP 2021-087167 A

[0233] The disclosures of Patent Document 1 and References 1-3 are incorporated herein by reference. Modifications, adjustments, and combinations of the embodiments and examples are possible within the scope of the disclosure of this application (including the scope of the claims), and further based on the basic technical ideas thereof. Furthermore, various combinations and selections of the various disclosed elements (including each element of each appendix, each element of each example, each element of each drawing, etc.) are possible within the scope of the claims of the present invention. In other words, this disclosure naturally includes various modifications and alterations that would be possible for a person skilled in the art based on the entire disclosure, including the scope of the claims, and the technical ideas thereof. [Explanation of symbols]

[0234] 10, 10', 10A, 10B First device 11 Biometric information acquisition unit 12 Data Acquisition Section 13 Data Distribution Unit 14 Distributed Data Storage 15 First sketch generation section 16 First sketch transmission section 17 Second sketch generation section 18 Second sketch transmission section 20, 20', 20A, 20B Second device 21 First sketch acquisition section 22 Memory section 23 Second sketch acquisition section 24 Differential data recovery section 100 Digital Signature System 120 Key generation device 121 Biometric information acquisition unit 122 First signing key and verification key generation unit 123 First Signature Key Distribution Part 124 First sketch generation unit 125 Verification key transmission unit 126 First sketch transmission unit 127 Second dispersion value transmitter 130 Key-based signature generation device 131 First sketch receiving unit 132 Storage section 134 Signature generation section 1341 Second Sketch Message Receiving Unit 1342 Differential key generation unit 1343 Second Signature Generation Unit 1344 Second Signature Transmission Unit 1345 Similarity Verification Unit 140 Biometric Signature Generation Device 141 Biometric information acquisition unit 142 second dispersion value receiving unit 143 Message Acquisition Unit 144 Signature generation section 1441 Second Signature Key Generation Unit 1442 Second sketch generation part 1443 Second Sketch Message Sending Unit 1444 Second Signature Receiving Unit 1445 First Signature Generation Unit 145 Transmitter 150 Verification Device 151 Verification key receiving unit 152 Storage section 153 Signature and Message Reception Unit 154 Signature Verification Unit 200 computers 201 processor 202 Storage device 203 Input / Output Devices 204 Communication Interface 300 servers 301 Physical Machine 302 Virtualization Platform 303 Virtual Machines

Claims

1. means for generating a first sketch from one of the two pieces of data obtained by dividing the first data by using the first biometric information; means for generating a second sketch using second biometric information for a value obtained by dividing the first data into two and calculating the other of the two; A sketch generation device comprising:

2. 2. The sketch generating device according to claim 1, wherein the difference between one of the two parts obtained by dividing the first data and the value obtained by calculating the other of the two parts obtained by dividing the first data on the second data corresponds to the difference between the first data and the second data.

3. The first data is divided into two parts, and the first data is obtained by adding the two parts together.

2. The sketch generating device according to claim 1, wherein the value obtained by calculating the other of the two halves of the first data on the second data is a value obtained by subtracting the other of the two halves of the first data from the second data.

4. The sketch generation device according to claim 1, further comprising a means for registering the first sketch in a registration destination, generating a sketch using the second biometric information for the other of the two pieces of the first data, and registering the sketch in the registration destination as the second sketch.

5. A restoration device communicatively connected to the sketch generation device of claim 1, A restoration device having means for, during restoration, acquiring the first sketch registered by the sketch generation device, receiving the second sketch transmitted from the sketch generation device to the restoration device, and restoring the difference between the first data and the second data from the first sketch and the second sketch.

6. means for generating a first sketch for the first data using one of the two parts of the first biometric information; means for generating a second sketch for the second data by using a value obtained by dividing the first biometric information into two and calculating the other of the two; A sketch generation device comprising:

7. 7. The sketch generating device according to claim 6, wherein the difference between one of the two parts of the first biometric information and the value calculated by dividing the other of the two parts of the first biometric information into the second biometric information corresponds to the difference between the first biometric information and the second biometric information.

8. a key generation device including at least a processor and a communication interface, which performs a process of generating a first sketch using first biometric information for a first share, which is one of two shares obtained by dividing a first signature key, and transmitting the first sketch to a second signature generation device; a first signature generation device having at least a processor and a communication interface; Equipped with the first signature generation device, a process of communicating with the key generation device to obtain a second share that is the other share of the first signature key; generating a second sketch using second biometric information from a value obtained by calculating the second share of a second signature key; transmitting the second sketch to the second signature generation device; receiving a second signature from the second signature generation device that generates a second signature for the message to be signed using the first sketch and the second sketch; a digital signature system that executes a process of generating a first signature for the message to be signed from the second signature and outputting the first signature;

9. the second signature is a signature for the message to be signed using a differential key corresponding to the difference between the first signature key and the second signature key, obtained by the second signature generation device restoring the difference between the first sketch and the second sketch; 9. The digital signature system according to claim 8, wherein the first signature generation device uses a key homomorphic operation to generate the first signature for the message to be signed using the first signature key, which corresponds to a signature key whose value is obtained by shifting the differential key by the second signature key.

10. the first signature generation device obtains a verification key corresponding to the first signature key; Verifying the authenticity of the message to be signed and the first signature pair using the verification key; 9. The digital signature system according to claim 8, wherein if the verification result is correct, the message to be signed and the first signature are transmitted to a verification device that verifies the signature, and if the verification result is incorrect, the message and the first signature are not transmitted.

11. 9. The digital signature system according to claim 8, wherein a difference between the first share and a value obtained by calculating the second share on the second signature key corresponds to a differential key between the first signature key and the second signature key.

12. adding the first share and the second share to obtain the first signature key; 9. The digital signature system according to claim 8, wherein the value obtained by calculating the second share value from the second signature key is a value obtained by subtracting the second share value from the second signature key.

13. 9. The digital signature system according to claim 8, wherein the second signature generation device generates the second signature for the message to be signed from the first sketch transmitted from the key generation device and the second sketch transmitted from the second signature generation device, and transmits the second signature to the first signature generation device.

14. In the registration phase, a first sketch is generated from one of the two pieces of the first data using the first biometric information, and the first sketch is registered; In the restoration phase, a second sketch is generated using the second biometric information from a value obtained by dividing the first data into two and calculating the other of the two, and the second sketch is transmitted to a restoration destination. Sketch generation method.

15. 15. The sketch generating method according to claim 14, wherein the difference between one of the two parts obtained by dividing the first data and the value obtained by calculating the other of the two parts obtained by dividing the first data on the second data corresponds to the difference between the first data and the second data.

16. In the registration phase, a first sketch of the first data is generated using one of the two pieces of the first biometric information and registered; In the restoration phase, a second sketch for the second data is generated using a value obtained by dividing the first biometric information into two and calculating the other of the two parts, and the second sketch is transmitted to a restoration destination. Sketch generation method.

17. 17. The sketch generating method according to claim 16, wherein the difference between one of the two parts of the first biometric information and the value obtained by calculating the other of the two parts of the first biometric information on the second biometric information corresponds to the difference between the first biometric information and the second biometric information.

18. A restoration method comprising: acquiring the first sketch registered by the sketch generation method described in claim 14; receiving the second sketch; and restoring the difference between the first data and the second data from the first sketch and the second sketch.

19. a key generation device generates a first sketch using first biometric information for a first share, which is one of two shares obtained by dividing a first signature key, and transmits the first sketch to a second signature generation device; a first signature generation device; communicating with the key generation device to obtain a second share that is the other share of the first signature key; generating a second sketch using second biometric information for a value obtained by calculating the second share of a second signature key; sending the second sketch to the second signature generation device; receiving a second signature from the second signature generation device that generates a second signature for the message to be signed using the first sketch and the second sketch; a digital signature method for generating and outputting a first signature for the message to be signed from the second signature;

20. the second signature is a signature for the message to be signed using a differential key corresponding to the difference between the first signature key and the second signature key, obtained by the second signature generation device restoring the difference between the first sketch and the second sketch; 20. The digital signature method according to claim 19, wherein the first signature generation device uses a key homomorphic operation to generate the second signature for the message to be signed using the differential key, the first signature for the message to be signed using the first signature key corresponding to a signature key whose value is obtained by shifting the differential key by the second signature key.

21. a process of generating a first sketch using the first biometric information for one of the two pieces of data obtained by dividing the first data; A process of generating a second sketch using second biometric information for a value obtained by dividing the first data into two and calculating the other of the two. A program that causes a computer to execute the following.

Images