Secret key restoration device, secret key restoration method and program

Abstract

To reduce a risk of leakage of a secret key when backing up the secret key.SOLUTION: A secret key restoration device comprises secret key restoration means that uses a parameter as data on the sum of an encryption key, obtained by encrypting a secret key by an encryption system having error correcting capability, and first biological information, and second biological information to generate data by decrypting data based upon the encryption key and the difference obtained by subtracting the second biological information from the first biological information, by the encryption system.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to a private key recovery device, a private key recovery method, and a program. [Background technology]

[0002] There are cases where a private key is used for encryption, digital signatures, etc. For example, Patent Document 1 describes that a digital signature is applied to message data using a user's private key only when the feature amount of biometric signature data of a user requesting a digital signature matches the feature amount of pre-registered biometric signature data. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 11-088322 Summary of the Invention [Problem to be solved by the invention]

[0004] When backing up a private key, it is preferable to be able to reduce the risk of the private key being leaked.

[0005] An example of an object of the present disclosure is to provide a private key recovery device, a private key recovery method, and a program that can solve the above-mentioned problems. [Means for solving the problem]

[0006] According to a first aspect of the present disclosure, a private key recovery device includes a private key recovery means that uses a parameter, which is data obtained by adding an encoding key obtained by encoding a private key using an encoding method having error correction capabilities and first biometric information, and second biometric information, to generate data obtained by decrypting data based on the encoding key and the difference obtained by subtracting the second biometric information from the first biometric information using the encoding method.

[0007] According to a second aspect of the present disclosure, a private key recovery method includes a computer generating data by using a parameter, which is data obtained by adding an encoding key obtained by encoding a private key using an encoding method having error correction capabilities and first biometric information, and second biometric information, and decoding the data based on the encoding key and the difference obtained by subtracting the second biometric information from the first biometric information using the encoding method.

[0008] According to a third aspect of the present disclosure, a program causes a computer to execute the following: using a parameter, which is data obtained by adding an encoding key obtained by encoding a private key using an encoding method having error correction capabilities and first biometric information, and second biometric information, to generate data obtained by decoded using the encoding method data based on the encoding key and the difference obtained by subtracting the second biometric information from the first biometric information. [Effects of the Invention]

[0009] According to one aspect of the present disclosure, when backing up a private key, the risk of the private key being leaked can be reduced. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 illustrates an example of the configuration of a private key backup system according to at least one embodiment. [Figure 2] FIG. 1 illustrates an example of a configuration of a key generation device according to at least one embodiment. [Figure 3] FIG. 1 illustrates an example of a configuration of a parameter generating device according to at least one embodiment. [Figure 4] FIG. 2 illustrates an example configuration of a parameter storage device according to at least one embodiment. [Figure 5] FIG. 1 is a diagram illustrating an example of the configuration of a private key recovery device according to at least one embodiment. [Figure 6] FIG. 1 illustrates an example of the configuration of a private key storage device according to at least one embodiment. [Figure 7]FIG. 2 is a diagram showing an example of a processing procedure of the private key backup system 1 when a parameter generation device according to at least one embodiment generates parameters. [Figure 8] FIG. 10 is a diagram showing an example of a processing procedure of the private key backup system 1 when the private key recovery device according to at least one embodiment generates the private key x′. [Figure 9] FIG. 1 illustrates an example of the configuration of a private key backup system according to at least one embodiment. [Figure 10] FIG. 1 is a diagram illustrating an example of the configuration of a private key recovery device according to at least one embodiment. [Figure 11] FIG. 1 is a diagram illustrating an example of the configuration of a private key recovery device according to at least one embodiment. [Figure 12] FIG. 1 is a diagram illustrating an example of a processing procedure in a private key recovery method according to at least one embodiment. [Figure 13] FIG. 1 illustrates an example configuration of a computer according to at least one embodiment. [Figure 14] FIG. 2 illustrates an example of a virtual machine configuration according to at least one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] The following describes embodiments of the present invention, but the following embodiments do not limit the scope of the invention as claimed. Furthermore, not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention.

[0012] First Embodiment Fig. 1 is a diagram showing an example of the configuration of a private key backup system according to at least one embodiment. In the configuration shown in Fig. 1, the private key backup system 1 includes a key generation device 10, a parameter generation device 20, a parameter storage device 30, a private key recovery device 40, and a private key storage device 60. 1 also shows a communication network 90. ​​The communication network 90 may be configured as a part of the private key backup system 1. Alternatively, the communication network 90 may be configured external to the private key backup system 1.

[0013] The communication network 90 communicatively connects the key generation device 10, the parameter generation device 20, the parameter storage device 30, the private key recovery device 40, and the private key storage device 60. The communication network 90 is not limited to a specific type of network. For example, the communication network 90 may be configured using any one of a wired LAN (Local Area Network), a wireless LAN, a WAN (Wide Area Network), a mobile communication network, a virtual network, or a combination of these.

[0014] Furthermore, it is not necessary for all of the key generation device 10, the parameter generation device 20, the parameter storage device 30, the private key recovery device 40, and the private key storage device 60 to be able to communicate with all of the other devices. In particular, it is sufficient for the key generation device 10 to be able to communicate with the parameter generation device 20. It is sufficient for the parameter generation device 20 to be able to communicate with each of the key generation device 10 and the parameter storage device 30. It is sufficient for the parameter storage device 30 to be able to communicate with each of the parameter generation device 20 and the private key recovery device 40. It is sufficient for the private key recovery device 40 to be able to communicate with each of the parameter storage device 30 and the private key storage device 60. It is sufficient for the private key storage device 60 to be able to communicate with the private key recovery device 40.

[0015] The private key backup system 1 backs up private keys. In particular, the private key backup system 1 stores parameters, which are data that combine the private key and biometric information. In this respect, the private key backup system 1 has a lower risk of private key leakage than when the private key is directly stored. The private key is also written as private key x.

[0016] There is no particular limitation to the use of the private key backed up by the private key backup system 1. For example, the private key backup system 1 may back up a private key used for encryption, or a private key used for digital signatures.

[0017] The private key backup system 1 may combine the private key with biometric information of the principal who uses the private key, such as the signer of a digital signature or the sender of a ciphertext. Alternatively, if the right to use the private key is granted to an agent, the private key backup system 1 may combine the private key with biometric information of the agent.

[0018] The key generation device 10 generates a private key. The key generation device 10 is configured using, for example, a computer. The generation of the private key x by the key generation device 10 can be expressed as in equation (1).

[0019]

number

[0020] κ denotes a security parameter. Here, the security parameter is a parameter that specifies the bit length of the key. The security parameter takes a positive integer value.

[0021] KeyGen indicates the algorithm for generating the private key. κ ) indicates that a κ-bit secret key is generated. Equation (1) indicates that a κ-bit secret key x is generated. The algorithm KeyGen used by the key generation device 10 to generate the private key x is not limited to a specific one. For example, the key generation device 10 may generate the private key x using a known key generation algorithm.

[0022] The key generation device 10 may generate the private key x using a key algorithm other than the algorithm that directly receives the security parameters. For example, the key generation device 10 may generate a common parameter from the security parameters using a setup algorithm. Then, the key generation device 10 may input the common parameter into the key generation algorithm to generate the private key x.

[0023] The common parameters are parameters used to generate a private key. The common parameters include, for example, information about the group and information about the hash function. The common parameters are also called public parameters. The process of generating the common parameters is also referred to as setup. The key generation device 10 may generate the common parameters before starting the process of generating the private key x.

[0024] The common parameters may be made public to users. For example, the key generation device 10 may transmit the common parameters to the parameter generation device 20, the parameter storage device 30, the private key recovery device 40, and the private key storage device 60, or some of these devices, so that the common parameters are shared. The key generation device 10 transmits the generated private key x to the parameter generation device 20.

[0025] The parameter generation device 20 generates a parameter s, which is data used to restore the private key x, based on the private key x and the first biometric information w. The parameter generation device 20 is configured using, for example, a computer. The parameter s can also be regarded as a shared private key. The parameter generation device is also called a shared private key generation device.

[0026] The first biometric information w is biometric information that is registered in advance (before the private key x is extracted) so that an unauthorized person who does not have the authority to extract the private key x will fail to extract the private key x. The person of the first biometric information w (the person from whom the first biometric information was obtained) will have the authority to extract the private key x.

[0027] There is no particular limitation to the type of biometric information used by the private key backup system 1. For example, the private key backup system 1 may use, but is not limited to, feature data extracted from a face image, an iris image, a fingerprint image, or voice data, or biometric information that is a combination of these. The parameter generating device 20 transmits the generated parameter s to the parameter storage device 30 .

[0028] The parameter storage device 30 stores the parameter s. Specifically, the parameter storage device 30 stores the parameter s received from the parameter generation device 20. The parameter storage device 30 then transmits the stored parameter s to the private key recovery device 40. For example, the parameter storage device 30 may transmit the parameter s to the private key recovery device 40 in response to a request from the private key recovery device 40. The parameter storage device 30 is configured using, for example, a computer.

[0029] The private key recovery device 40 recovers the private key x from the parameter s. More specifically, the private key recovery device 40 receives the parameter s from the parameter storage device 30. The private key recovery device 40 also acquires the second biometric information w'. The private key recovery device 40 then generates and outputs the private key x' using the parameter s and the second biometric information w'. If the first biometric information w and the second biometric information w' are similar, then x'=x; otherwise, x'≠x. When the first biometric information w and the second biometric information w' are similar to each other, x'=x, and therefore the generation of the private key x' by the private key recovery device 40 corresponds to the recovery of the private key x. The private key recovery device 40 is configured using, for example, a computer.

[0030] The second biometric information w' is used to authenticate the person authorized to extract the private key x based on its relationship with the first biometric information w. In the private key backup system 1, the person authorized to extract the private key x is authenticated by extracting an incorrect private key (data different from the private key x generated by the key generating device 10) when a person without the extraction authority extracts the private key x. Hereinafter, extraction of an incorrect private key will also be referred to as failure to extract private key x. Furthermore, private key x generated by key generation device 10 will also be referred to as original private key x.

[0031] To prevent a person authorized to extract the private key x from failing to extract the private key x, it is preferable that the second biometric information w' be the same type of biometric information as the first biometric information w and be collected in an environment as close as possible to the environment in which the first biometric information w was collected. For example, it is preferable that the second biometric information w' be collected using the same type of sensor as the sensor used to collect the first biometric information w.

[0032] When the second biometric information w' is closer to the first biometric information w than a predetermined condition, the private key x' generated by the private key recovery device 40 will be the same as the original private key x. More specifically, the private key recovery device 40 decodes data based on an encoding key ENC(x) obtained by encoding the private key x and the difference w-w' between the first biometric information w and the second biometric information w' using an encoding method that has linearity and error correction capabilities. The encoding key here refers to data obtained by encoding a key.

[0033] If the difference w-w' between the first biometric information w and the second biometric information w' is within the error correction capability of the encoding method, the difference w-w' between the first biometric information w and the second biometric information w' is canceled by error correction during decoding. As a result, the private key recovery device 40 obtains data based on the private key x and not based on any biometric information.

[0034] In the following, an example will be described in which the private key recovery device 40 directly recovers the private key x when the difference w-w' between the first biometric information w and the second biometric information w' is within the error correction capability of the encoding method. Alternatively, the private key recovery device 40 may first obtain data from which the private key x can be recovered, and then recover the private key from that data.

[0035] On the other hand, if the difference w-w' between the first biometric information w and the second biometric information w' is outside the error correction capability of the encoding method, the difference w-w' between the first biometric information w and the second biometric information w' is not canceled. In this case, the private key recovery device 40 obtains data based on both the private key x and the biometric information. In this case, the private key recovery device 40 fails to recover the private key x. That is, the private key x' recovered by the private key recovery device 40 will be different from the original private key x. The private key recovery device 40 transmits the generated private key x′ to the private key storage device 60 .

[0036] The private key storage device 60 stores the private key x' from the private key recovery device 40. The private key storage device 60 is configured using, for example, a computer. The private key storage device 60 may be configured as a function of a computer owned by a person who has the authority to extract the private key x, such as a personal computer (PC) or smartphone of the person who has the authority to extract the private key x.

[0037] In this way, the private key recovery device 40 recovers the private key x from the parameter s, eliminating the need for the private key backup system 1 to directly store the private key x. In this respect, the private key recovery device 40 can reduce the risk of the private key being leaked when backing up the private key.

[0038] Furthermore, if the difference between the first biometric information and the second biometric information is outside the range of the error correction capability of the encoding method, the private key recovery device 40 outputs data that differs from the original private key x. This prevents anyone without the authority to extract the original private key x from the private key recovery device 40. In this respect, too, the private key recovery device 40 can reduce the risk of the private key being leaked when backing up the private key.

[0039] Furthermore, the person who uses the private key may manage the parameter s. The person who uses the private key may be able to delete the parameters stored in the parameter storage device 30. If the person using the private key wishes to invalidate the private key, such as by revoking the power of attorney of an agent who has been granted the authority to extract the private key, the person can make it impossible to extract the private key from the private key backup system 1 by deleting the parameters stored in the parameter storage device 30.

[0040] 2 is a diagram showing an example of the configuration of the key generation device 10. In the configuration shown in FIG.

[0041] The private key generation unit 11 generates a private key x. The private key generation unit 11 is an example of a key generation means. The private key generation unit 11 may generate the private key x using an algorithm that directly receives a security parameter, as in the above equation (1).

[0042] Alternatively, as described above for the key generation device 10, the private key generation unit 11 may generate a common parameter from a security parameter using a setup algorithm, and then the private key generation unit 11 may input the common parameter into a key generation algorithm to generate the private key x. The secret key generation unit 11 generates common parameters from security parameters using the setup algorithm, which can be expressed as in equation (2).

[0043]

number

[0044] Setup indicates the setup algorithm. pp indicates a common parameter. The private key generation unit 11 inputs common parameters into the key generation algorithm to generate the private key x, which can be expressed as in equation (3).

[0045]

number

[0046] In equation (3), KeyGen represents a key generation algorithm that receives a common parameter pp and generates a private key. This key generation algorithm KeyGen returns a private key x as a return value.

[0047] Fig. 3 is a diagram illustrating an example of the configuration of the parameter generation device 20. In the configuration illustrated in Fig. 3, the parameter generation device 20 includes a private key receiving unit 21, a first biometric information acquiring unit 22, a parameter generating unit 23, and a parameter transmitting unit 24.

[0048] The private key receiving unit 21 receives the private key x from the key generating device 10 . The first biometric information acquisition unit 22 acquires the first biometric information w. For example, the first biometric information acquisition unit 22 may acquire biometric information of a subject who is granted the authority to extract the private key x from a device that stores the biometric information, and use the acquired information as the first biometric information w. Alternatively, the first biometric information acquisition unit 22 may acquire data that is the source of the biometric information, such as an image of a fingerprint captured by a camera, and perform a process to generate biometric information, such as extracting features from the acquired data, and use the acquired biometric information as the first biometric information w. The person who is granted the authority to extract the private key x is also called the extractor.

[0049] The parameter generation unit 23 generates the parameter s based on the private key x and the first biometric information w. For example, the parameter generation unit 23 may encode the private key x to generate an encoding key ENC(x), and then combine the encoding key ENC(x) with the first biometric information w to generate the parameter s. In this case, the generation of the parameter s by the parameter generation unit 23 can be expressed as in equation (4).

[0050]

number

[0051] ENC indicates encoding using a coding method that has linearity and error correction capabilities. The parameter generating unit 23 may perform encoding using an error correcting code such as a Hamming code, a BCH (Bose-Chaudhuri-Hocquenghem) code, an RS (Reed-Solomon) code, or an LDPC (low-density parity-check) code.

[0052] Alternatively, the parameter generating unit 23 may perform encoding using a coding method with error correction capability, such as lattice coding. For example, the parameter generating unit 23 may perform encoding using a method that uses an integer lattice, a method that uses a triangular lattice, or a method that uses a more complex lattice. In the following, an example will be described in which the parameter generating unit 23 performs encoding using an error correction code.

[0053] In equation (4), "+" indicates taking the sum of data. The sum of data here is a combination of data that obtains linearity in the encoding method used by the private key backup system 1. Specifically, the private key backup system 1 uses encoding ENC and decoding DEC that have the properties shown in equation (5).

[0054]

number

[0055] where d1 and d2 represent data. Equation (5) shows that for any data d1 and d2, the data obtained by encoding the data d1 and d2, adding them together, and then decoding them is equal to the data obtained by adding the data d1 and d2 together. The "+" on the left side of equation (5) and the "+" on the right side may be different operations.

[0056] For example, both the encoding key ENC(x) and the first biometric information w may be n-dimensional vectors, and the parameter generating unit 23 may add up the vectors as the sum of the data, where n is an integer greater than or equal to 1.

[0057] Regarding the relationship between encoding ENC and decoding DEC, the process of converting data d into data c by encoding ENC can be expressed as in equation (6).

[0058]

number

[0059] When this data c is converted by the decoding DEC, the original data d is obtained. This can be expressed as in equation (7).

[0060]

number

[0061] Furthermore, even if data c', whose difference from data c is within the error correction capability of the encoding method, is converted by decoding DEC, the same data d as when data c is converted by decoding DEC is obtained. This can be expressed as in equation (8).

[0062]

number

[0063] The parameter transmission unit 24 transmits the parameter s generated by the parameter generation unit 23 to the parameter storage device 30.

[0064] 4 is a diagram showing an example of the configuration of the parameter storage device 30. In the configuration shown in FIG.

[0065] The parameter receiving unit 31 receives the parameter s from the parameter generating device 20 . The parameter storage unit 32 stores the parameter s received by the parameter receiving unit 31. The parameter sending unit 33 sends the parameter s stored in the parameter storage unit 32 to the private key recovery device 40. For example, when the private key recovery device 40 recovers the private key x, it may request the parameter storage device 30 to send the parameter s, and the parameter sending unit 33 may transmit the parameter s in response to the request from the private key recovery device 40.

[0066] Fig. 5 is a diagram showing an example of the configuration of the private key recovery device 40. In the configuration shown in Fig. 5, the private key recovery device 40 includes a parameter receiving unit 41, a second biometric information acquiring unit 42, a private key recovery unit 43, and a private key transmitting unit 44.

[0067] The parameter receiving unit 41 receives the parameter s from the parameter storage device 30. The parameter receiving unit 41 corresponds to an example of a parameter acquiring means. The second biometric information acquisition unit 42 acquires second biometric information w'. The second biometric information w' is biometric information of the person extracting the private key x, and is expected to be the same person as the first biometric information w and the same type of biometric information as the first biometric information w. The second biometric information acquiring unit 42 is an example of a second biometric information acquiring means.

[0068] The private key recovery device 40 may include a device for acquiring data that is the source of biometric information, such as a camera that captures an image of a person's finger. The second biometric information acquisition unit 42 may then acquire the data that is the source of biometric information, such as an image of a fingerprint captured by a camera, when the private key recovery device 40 receives a request to recover the private key. The second biometric information acquisition unit 42 may perform a process for generating biometric information, such as extracting features from the acquired data, and use the acquired biometric information as the second biometric information w'.

[0069] As described above, in order to prevent a person authorized to extract the private key x from failing to extract the private key x, it is preferable that the second biometric information w' be biometric information of the same type as the first biometric information w, collected in an environment as close as possible to the environment in which the first biometric information w was collected. Therefore, it is preferable that the second biometric information acquisition unit 42 collects, as the second biometric information w', biometric information of the same type as the first biometric information w, collected in an environment as close as possible to the environment in which the first biometric information w was collected.

[0070] The private key recovery unit 43 generates a private key x'. As described above, if the second biometric information w' is closer to the first biometric information w than a predetermined condition, the private key x' generated by the private key recovery device 40 will be the same as the original private key x. The private key recovery unit 43 is an example of a private key recovery means. The private key recovery unit 43 recovers the private key x by decrypting the difference obtained by subtracting the second biometric information w' from the parameter s. The parameter s is data obtained by adding the encoding key ENC(x) obtained by encoding the private key x and the first biometric information w.

[0071] Alternatively, the parameter generation unit 23 may generate a parameter s by subtracting the first biometric information w from the encoding key ENC(x). In this case, the private key recovery unit 43 may calculate the sum of the parameter s and the second biometric information w′. When the private key generated by the private key recovery unit 43 is represented by x', the generation of the private key by the private key recovery unit 43 can be expressed as in equation (9).

[0072]

number

[0073] "-" indicates the inverse operation of "+". If the difference w-w' between the first biometric information w and the second biometric information w' is within the error correction capability of the encoding method, the difference w-w' between the first biometric information w and the second biometric information w' is canceled by decoding. In this case, as shown in equation (10), the private key x' generated by the private key recovery unit 43 becomes the same as the original private key x.

[0074]

number

[0075] On the other hand, if the difference w-w' between the first biometric information w and the second biometric information w' is outside the error correction capability of the encoding method, DEC(w-w') remains, which is the decoded difference w-w' between the first biometric information w and the second biometric information w'. In this case, the private key x' generated by the private key recovery unit 43 can be expressed as in equation (11).

[0076]

number

[0077] In this case, the influence of the first biometric information w and the second biometric information w' remains, and the private key x' generated by the private key recovery unit 43 will be different from the original private key x. The private key transmitting unit 44 transmits the private key x′ generated by the private key restoring unit 43 to the private key storage device 60 .

[0078] In this way, as a method of utilizing the error correction capability of error correction codes, for example, a technology called Fuzzy Commitment, which is a data protection scheme that combines error correction codes and encryption technology, can be applied, as described in non-patent document: Juels, A. and Wattenberg, M., A Fuzzy Commitment Scheme, ACM CCS'99, 1999.

[0079] 6 is a diagram showing an example of the configuration of the private key storage device 60. In the configuration shown in FIG. The private key receiving unit 61 receives the private key x′ from the private key recovery device 40 . The private key storage unit 62 stores the private key x' received by the private key receiving unit.

[0080] The private key storage device 60 may perform processing using the private key x' stored in the private key storage unit 62. For example, the private key storage device 60 may have an encryption function and perform encryption using the private key x'. Alternatively, the private key storage device 60 may have a digital signature function and perform a signature using the private key x'. Alternatively, the private key storage device 60 may transmit the private key x' to another device in accordance with a user operation.

[0081] The private key backup system 1 may perform encoding ENC using the encoding function Encode and may perform decoding DEC using the decoding function Decode. For example, the parameter generation unit 23 of the parameter generation device 20 may calculate the parameter s based on equation (12).

[0082]

number

[0083] Alternatively, the private key recovery unit 43 of the private key recovery device 40 may generate the private key x' based on equation (13).

[0084]

number

[0085] Alternatively, the private key backup system 1 may use the parameter s and the second biometric information w' as arguments instead of the decryption function Decode to calculate the private key x' using a key difference recovery function (or key difference recovery algorithm) Diff(DiffRec) that recovers the difference between the key corresponding to the parameter s and the key corresponding to the second biometric information w'. For example, the private key recovery unit 43 of the private key recovery device 40 may generate the private key x' based on equation (14).

[0086]

number

[0087] 7 is a diagram showing an example of the processing procedure of the private key backup system 1 when the parameter generation device 20 generates parameters. The processing phase in which the parameter generation device 20 generates parameters is also referred to as the parameter generation phase. In the process shown in FIG. 7, the private key generation unit 11 of the key generation device 10 generates a private key x (step S101). Next, the private key transmitting unit 12 transmits the private key x generated by the private key generating unit 11 to the parameter generating device 20 (step S102).

[0088] In the parameter generating device 20, the private key receiving unit 21 receives the private key x transmitted by the private key transmitting unit 12 (step S111). Furthermore, the first biometric information acquisition unit 22 acquires the first biometric information w (step S112). Next, the parameter generating unit 23 generates a parameter s based on the private key x and the first biometric information w (step S113). Then, the parameter transmitting unit 24 transmits the parameter s generated by the parameter generating unit 23 to the parameter storage device 30 (step S114).

[0089] In the parameter storage device 30, the parameter receiving unit 31 receives the parameter s transmitted by the parameter transmitting unit 24 (step S121). Then, the parameter storage unit 32 stores the parameters received by the parameter receiving unit 31 (step S122).

[0090] The parameter generating device 20 may perform the process of step S111 and the process of step S112 in any order. For example, the first biometric information acquiring unit 22 may acquire the first biometric information before the private key receiving unit 21 receives the private key x.

[0091] 8 is a diagram showing an example of the processing procedure of the private key backup system 1 when the private key recovery device 40 generates the private key x'. The processing phase in which the private key recovery device 40 generates the private key x' is also referred to as the private key recovery phase. In the process shown in FIG. 8, the parameter transmission unit 33 of the parameter storage device 30 transmits the parameter s stored in the parameter storage unit 32 to the private key recovery device 40 (step S201).

[0092] In the private key recovery device 40, the parameter receiving unit 41 receives the parameter s transmitted by the parameter transmitting unit 33 (step S211). Furthermore, the second biometric information acquisition unit 42 acquires the second biometric information w' (step S212). Next, the private key recovery unit 43 generates a private key x' using the parameter s and the second biometric information w' (step S213).

[0093] Then, the private key transmitting unit 44 transmits the private key x' generated by the private key restoring unit 43 to the private key storage device 60 (step S214). In the private key storage device 60, the private key receiving unit 61 receives the private key transmitted by the private key transmitting unit 44 (step S221). Then, the private key storage unit 62 stores the private key received by the private key receiving unit 61 (step S222).

[0094] Although the above description has been given taking as an example a case where an error correction code having linearity is used as the error correction code, the present invention is not limited to this.

[0095] As described above, the private key recovery unit 43 uses a parameter, which is data obtained by adding an encoding key obtained by encoding a private key using an encoding method with error correction capabilities and the first biometric information, and the second biometric information, to generate data obtained by decoding, using the encoding method, data based on the encoding key and the difference obtained by subtracting the second biometric information from the first biometric information.

[0096] By using the private key recovery device 40 to recover the private key x from the parameter s, the private key backup system 1 does not need to directly store the private key x. In this respect, the private key recovery device 40 can reduce the risk of the private key being leaked when backing up the private key.

[0097] Furthermore, if the difference between the first biometric information and the second biometric information is outside the range of the error correction capability of the encoding method, the private key recovery device 40 outputs data that differs from the original private key x. As a result, the private key recovery device 40 prevents anyone without the authority to extract the original private key x. In this respect, too, the private key recovery device 40 can reduce the risk of the private key being leaked when backing up the private key. In particular, the private key recovery device 40 can reduce the risk of the key being recovered by an unauthorized person.

[0098] If the difference between the first biometric information and the second biometric information is within the error correction capability of the encoding method, the first biometric information and the second biometric information are cancelled by decoding. This allows the private key recovery unit 43 to decode the private key and obtain data that was affected by the biometric information, and it is expected that the private key can be recovered using this data. Since the private key recovery device 40 recovers the private key, there is no need to directly store the private key as a backup of the private key. In this respect, the private key recovery device 40 can reduce the risk of the private key being leaked when backing up the private key. In particular, the private key recovery device 40 prevents unauthorized persons from obtaining the private key even if the backup information (information held by the private key recovery device 40) is leaked.

[0099] Furthermore, if the difference between the first biometric information and the second biometric information is outside the range of the error correction capability of the encoding method, the private key recovery device 40 outputs data that differs from the original private key x. This prevents anyone without the authority to extract the original private key x from the private key recovery device 40. In this respect, too, the private key recovery device 40 can reduce the risk of the private key being leaked when backing up the private key.

[0100] Furthermore, the parameter receiving unit 41 acquires the parameter s. The second biological information acquisition unit 42 acquires the second biological information. The private key recovery unit 43 generates data by decrypting the difference obtained by subtracting the second biometric information from the parameter using an encoding method.

[0101] The private key recovery device 40 can recover the private key through the relatively simple process of finding the difference between the data and decrypting it. In this respect, the private key recovery device 40 is expected to impose a relatively small processing load on the recovery of the private key. Second Embodiment The parameter storage device 30 and the private key recovery device 40 may be configured integrally, and the private key recovery device 40 may store the parameter s. Furthermore, the person who uses the private key may be able to delete the parameter s stored in the private key recovery device 40. This point will be explained in the second embodiment.

[0102] 9 is a diagram showing an example of the configuration of a private key backup system according to at least one embodiment. In the configuration shown in Fig. 9, the private key backup system 2 includes a key generation device 10, a parameter generation device 20, a private key recovery device 140, and a private key storage device 60. Also shown in FIG. 2 is a communications network 90 .

[0103] 9, parts having the same functions as those in FIG. 1 are given the same reference numerals (10, 20, 60, 90), and detailed description thereof will be omitted here. Private key backup system 2 differs from private key backup system 1 in that it does not include a parameter storage device 30. In addition, in private key backup system 2, the configuration of private key recovery device 140 differs from that of private key recovery device 40 in private key backup system 1.

[0104] In other respects, private key backup system 2 is similar to private key backup system 1. In the private key backup system 2, the parameter generation device 20 transmits the generated parameter s to the private key recovery device 140.

[0105] FIG. 10 is a diagram showing an example of the configuration of the private key recovery device 140. As shown in FIG. In the configuration shown in Figure 10, the private key recovery device 140 includes a parameter receiving unit 41, a parameter storage unit 101, a deletion unit 102, a second biometric information acquisition unit 42, a private key recovery unit 43, and a private key transmission unit 44.

[0106] 10, parts having the same functions as those in FIG. 5 are given the same reference numerals (41, 42, 43, 44), and detailed description thereof will be omitted here. The private key recovery device 140 differs from the private key recovery device 40 in that it includes a parameter storage unit 101 and a deletion unit 102. In other respects, the private key recovery device 140 is similar to the private key recovery device 40. In the private key recovery device 140, the private key recovery unit 43 recovers the private key using the parameter s stored in the parameter storage unit 101.

[0107] The parameter storage unit 101 stores the parameter s received by the parameter receiving unit 41. The parameter storage unit 101 corresponds to an example of a parameter storage means. When the deletion unit 102 receives a user operation instructing deletion of the parameter s, the deletion unit 102 deletes the parameter s stored in the parameter storage unit 101. The deletion unit 102 corresponds to an example of a deletion means. If the person using the private key wishes to invalidate the private key, for example, to revoke the power of attorney of an agent who has been granted the authority to extract the private key, the person can have the deletion unit 102 delete the parameter s stored in the parameter storage unit 101. By deleting the parameter stored in the parameter storage device 30, the private key can be made impossible to extract from the private key backup system 1.

[0108] As described above, the parameter storage unit 101 stores the parameters. The deleting unit 102 deletes the parameters stored in the parameter storage means in accordance with a user instruction. The private key recovery unit 43 generates a second private key using the parameters stored in the parameter storage means.

[0109] In the private key recovery device 140, if the person using the private key wishes to invalidate the private key, for example, to revoke the power of attorney of an agent who has been granted the authority to extract the private key, the person can have the deletion unit 102 delete the parameter s stored in the parameter storage unit 101. By deleting the parameter stored in the parameter storage device 30, the private key can be made impossible to extract from the private key backup system 1.

[0110] <Third embodiment> 11 is a diagram showing an example of the configuration of a private key recovery device according to at least one embodiment. In the configuration shown in FIG. With this configuration, the private key recovery unit 611 generates data by decrypting data based on the coding key and the difference obtained by subtracting the second biometric information from the first biometric information, using a parameter that is data obtained by adding an encoding key obtained by encoding the private key using an encoding method with error correction capabilities and the first biometric information, and the second biometric information. The private key recovery unit 611 is an example of a private key recovery means.

[0111] According to the private key recovery device 610, by recovering the private key from the parameters, it is not necessary to directly store the private key x in order to back up the private key. In this respect, according to the private key recovery device 610, it is possible to reduce the risk of the private key being leaked when backing up the private key.

[0112] Furthermore, if the difference between the first biometric information and the second biometric information is outside the range of the error correction capability of the encoding method, the private key recovery device 610 outputs data that differs from the original private key. This prevents anyone without the authority to extract the original private key from the private key recovery device 610. In this respect, too, the private key recovery device 610 can reduce the risk of the private key being leaked when backing up the private key.

[0113] <Fourth embodiment> 12 is a diagram showing an example of a processing procedure in a private key recovery method according to at least one embodiment. The private key recovery method shown in FIG. 12 includes recovering a private key (step S611).

[0114] In restoring the private key (step S611), the computer uses a parameter, which is data obtained by adding an encoding key obtained by encoding the private key using an encoding method with error correction capabilities and the first biometric information, and the second biometric information, to generate data that is obtained by decoded using the encoding method data based on the encoding key and the difference obtained by subtracting the second biometric information from the first biometric information.

[0115] 12, the private key is restored from the parameters, eliminating the need to directly store the private key x for backing up the private key. In this respect, the private key restoration device 610 can reduce the risk of the private key being leaked when backing up the private key.

[0116] Furthermore, according to the private key recovery method shown in Fig. 12, if the difference between the first biometric information and the second biometric information is outside the range of the error correction capability of the encoding method, data different from the original private key is output. As a result, the private key recovery method shown in Fig. 12 prevents anyone without the authority to extract the original private key. In this respect, too, the private key recovery method shown in Fig. 12 can reduce the risk of the private key being leaked when backing up the private key.

[0117] FIG. 13 is a diagram illustrating an example of a computer configuration according to at least one embodiment. In the configuration shown in FIG. 13, a computer 700 includes a CPU 710, a main memory device 720, an auxiliary memory device 730, an interface 740, and a non-volatile recording medium 750.

[0118] One or more of the above-described key generation device 10, parameter generation device 20, parameter storage device 30, private key recovery device 40, private key storage device 60, private key recovery device 140, and private key recovery device 610, or a portion thereof, may be implemented in a computer 700. In this case, the operation of each of the above-described processing units is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main storage device 720, and executes the above-described processing in accordance with the program. The CPU 710 also allocates storage areas in the main storage device 720 corresponding to each of the above-described storage units in accordance with the program. Communication between each device and other devices is performed by an interface 740 having a communication function and performing communication under the control of the CPU 710. The interface 740 also has a port for a nonvolatile storage medium 750, and reads and writes information from and to the nonvolatile storage medium 750.

[0119] When the key generation device 10 is implemented in a computer 700, the operation of the private key generation unit 11 is stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main storage device 720, and executes the above-described processing in accordance with the program.

[0120] Furthermore, the CPU 710 allocates a storage area in the main storage device 720 for the key generation device 10 to perform processing in accordance with the program. Communication between the key generation device 10 and other devices, such as the operation of the private key transmission unit 12, is performed by the interface 740, which has a communication function and operates under the control of the CPU 710. Interaction between the key generation device 10 and a user is performed by the interface 740, which has an input device and an output device, presenting information to the user via the output device under the control of the CPU 710 and accepting user operations via the input device.

[0121] When the parameter generating device 20 is implemented in a computer 700, the operation of the parameter generating unit 23 is stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main storage device 720, and executes the above-described processing in accordance with the program.

[0122] Furthermore, the CPU 710 allocates a storage area in the main storage device 720 for the parameter generation device 20 to perform processing in accordance with the program. Communication between the parameter generation device 20 and other devices, such as the operation of the private key receiving unit 21 and the parameter transmitting unit 24, is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the parameter generation device 20 and a user is performed by the interface 740 having an input device and an output device, presenting information to the user via the output device under the control of the CPU 710, and accepting user operations via the input device. Acquisition of biometric information by the first biometric information acquisition unit 22 is performed by the interface 740 having a sensor and operating under the control of the CPU 710.

[0123] When the parameter storage device 30 is implemented in the computer 700, the operation of the parameter storage device 30 is stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main storage device 720, and executes the above-described processing in accordance with the program.

[0124] Furthermore, the CPU 710 allocates storage areas in the main storage device 720 for the parameter storage unit 32 and other storage areas for the parameter storage device 30 to perform processing in accordance with the program. Communication between the parameter storage device 30 and other devices, such as the operation of the parameter receiving unit 31 and the parameter transmitting unit 33, is performed by the interface 740, which has a communication function and operates under the control of the CPU 710. Interaction between the parameter storage device 30 and a user is performed by the interface 740, which has an input device and an output device, presenting information to the user via the output device under the control of the CPU 710 and accepting user operations via the input device.

[0125] When the private key recovery device 40 is implemented in the computer 700, the operation of the private key recovery unit 43 is stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main storage device 720, and executes the above-mentioned processing in accordance with the program.

[0126] Furthermore, the CPU 710 allocates a storage area in the main storage device 720 for the private key recovery device 40 to perform processing in accordance with the program. Communication between the private key recovery device 40 and other devices, such as the operation of the parameter receiving unit 41 and the private key transmitting unit 44, is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the private key recovery device 40 and a user is performed by the interface 740 having an input device and an output device, presenting information to the user via the output device under the control of the CPU 710, and accepting user operations via the input device. Acquisition of biometric information by the second biometric information acquisition unit 42 may be performed by the interface 740 having a sensor and operating under the control of the CPU 710.

[0127] When the private key storage device 60 is implemented in the computer 700, the operation of the private key storage device 60 is stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main storage device 720, and executes the above-mentioned processing in accordance with the program.

[0128] Furthermore, the CPU 710, in accordance with the program, allocates storage areas in the main storage device 720 for the private key storage unit 62 and other storage areas for the private key storage device 60 to perform processing. Communication between the private key storage device 60 and other devices, such as the operation of the private key receiving unit 61, is performed by the interface 740, which has a communication function and operates under the control of the CPU 710. Interaction between the private key storage device 60 and a user is performed by the interface 740, which has an input device and an output device, presenting information to the user via the output device under the control of the CPU 710 and accepting user operations via the input device.

[0129] When the private key recovery device 140 is implemented in the computer 700, the operations of the deletion unit 102 and the private key recovery unit 43 are stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main storage device 720, and executes the above-mentioned processing in accordance with the program.

[0130] Furthermore, the CPU 710 allocates storage areas, such as the parameter storage unit 101, in the main storage device 720 in accordance with the program for the private key recovery device 140 to perform processing. Communication between the private key recovery device 140 and other devices, such as the operation of the parameter receiving unit 41 and the private key transmitting unit 44, is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the private key recovery device 140 and a user is performed by the interface 740 having an input device and an output device, presenting information to the user via the output device under the control of the CPU 710, and accepting user operations via the input device. Acquisition of biometric information by the second biometric information acquisition unit 42 may be performed by the interface 740 having a sensor and operating under the control of the CPU 710.

[0131] When the private key recovery device 610 is implemented in the computer 700, the operation of the private key recovery unit 611 is stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main storage device 720, and executes the above-mentioned processing in accordance with the program.

[0132] Furthermore, the CPU 710, in accordance with the program, allocates a storage area in the main storage device 720 for the private key recovery device 610 to perform processing. Communication between the private key recovery device 610 and other devices is performed by the interface 740, which has a communication function and operates under the control of the CPU 710. Interaction between the private key recovery device 610 and a user is performed by the interface 740, which has an input device and an output device, presenting information to the user via the output device under the control of the CPU 710 and accepting user operations via the input device.

[0133] One or more of the above-described programs may be recorded on nonvolatile recording medium 750. In this case, interface 740 may read the programs from nonvolatile recording medium 750. CPU 710 may then directly execute the programs read by interface 740, or may temporarily store the programs in main storage device 720 or auxiliary storage device 730 and then execute them.

[0134] The main memory device 720, the auxiliary memory device 730, and the non-volatile recording medium 750 may each include one or more of semiconductor storage such as RAM (Random Access Memory), ROM (Read Only Memory), or EEPROM (Electrically Erasable and Programmable ROM), HDD (Hard Disk Drive), CD (Compact Disc), DVD (Digital Versatile Disc), etc.

[0135] The interface 740 may include an input / output device and a communication interface. The input / output device may include a keyboard and a display. Furthermore, in the parameter generation device 20, the private key recovery device 40, and the private key recovery device 140 that acquire biometric information, the interface 740 may be configured to include a sensor for acquiring the biometric information. In this case, the sensor may be an image sensor (camera) if the biometric information is a face, iris, etc., or a fingerprint sensor if the biometric information is a fingerprint, or a near-infrared camera that captures an image of the light that has passed through the finger if the biometric information is a finger vein, for example.

[0136] The sensor may be a removable sensor such as a USB (Universal Serial Bus) device. The interface 740 may include a network interface card, a transceiver, or the like, and may be configured to communicate with each other via a LAN (Local Area Network), a WAN (Wide Area Network) such as the Internet, a wireless LAN, a mobile communication network, or the like.

[0137] In addition, the interface 740 may be configured to have an interface in the parameter generation device 20, the private key recovery device 40, and the private key recovery device 140 that communicates with an external sensor (e.g., a short-range communication type sensor) and receives biometric information acquired by the external sensor.

[0138] 14 is a diagram illustrating an example of a configuration of a virtual machine according to at least one embodiment. In the example of FIG. 14, in a virtualization server 800, a virtualization platform 820 such as a hypervisor is provided on a physical machine 810, and a virtual machine 830 is provided on the virtualization platform 820. Any one or more of the above-described key generation device 10, parameter generation device 20, parameter storage device 30, private key recovery device 40, private key storage device 60, private key recovery device 140, and private key recovery device 610, or a part thereof, may be implemented in a virtual machine 830. The virtualization server 800 provides a virtual server environment in which multiple servers operate, although it is physically a single server. Each virtual machine 830 is preferably set to operate in an isolated environment in memory space.

[0139] In this case, in the virtual machine 830, a program that realizes the processing of any of the key generation device 10, parameter generation device 20, parameter storage device 30, private key recovery device 40, private key storage device 60, private key recovery device 140, and private key recovery device 610 runs on the virtual OS (Operating System) of the virtual machine. A virtual machine 830 that virtually realizes any of the key generation device 10, parameter generation device 20, parameter storage device 30, private key recovery device 40, private key storage device 60, private key recovery device 140, and private key recovery device 610 may be configured to communicate with other virtual machines via a virtual network, or may be configured to communicate with any other device of the key generation device 10, parameter generation device 20, parameter storage device 30, private key recovery device 40, private key storage device 60, private key recovery device 140, and private key recovery device 610 via a physical interface (communication interface) of the physical machine 810 via a LAN, a WAN such as the Internet, or the like.

[0140] Note that the processing of each unit may be performed by recording a program on a computer-readable recording medium for executing all or part of the processing performed by the key generation device 10, parameter generation device 20, parameter storage device 30, private key recovery device 40, private key storage device 60, private key recovery device 140, and private key recovery device 610. The "computer system" here includes the OS (Operating System) and hardware such as peripheral devices. Furthermore, "computer-readable recording media" refers to portable media such as flexible disks, optical magnetic disks, ROMs (Read Only Memory), and CD-ROMs (Compact Disc Read Only Memory), as well as storage devices such as hard disks built into computer systems. The program may be one that realizes part of the aforementioned functions, or may be one that can realize the aforementioned functions in combination with a program already stored in the computer system.

[0141] As described above, the encoding method used in the present disclosure is not limited to a specific method. For example, encoding using a square lattice, or error correction codes such as RS code and BCH code may be used. Furthermore, the biometric information is not limited to a real number vector, and an integer vector may be used.

[0142] Although the embodiments of the present invention have been described above in detail with reference to the drawings, the specific configuration is not limited to these embodiments and includes designs within the scope of the present invention. Furthermore, the above-described embodiments may be combined with other embodiments as appropriate.

[0143] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes.

[0144] (Appendix 1) a private key recovery means for generating data by using second biometric information and a parameter that is the sum of a coding key obtained by coding a private key using a coding method having error correction capabilities and first biometric information, and by using the second biometric information, the data based on the coding key and a difference obtained by subtracting the second biometric information from the first biometric information, decoded using the coding method; A private key recovery device comprising:

[0145] (Appendix 2) parameter acquisition means for acquiring the parameters; a second biometric information acquisition means for acquiring the second biometric information, the private key recovery means generates data by decrypting the difference obtained by subtracting the second biometric information from the parameter using the encoding method. 2. A private key recovery device according to claim 1.

[0146] (Appendix 3) a parameter storage means for storing the parameters; a deleting means for deleting the parameters stored in the parameter storage means in accordance with a user's instruction; Equipped with the private key recovery means generates the data using the parameters stored in the parameter storage means. 3. A private key recovery device according to claim 2.

[0147] (Appendix 4) The computer Using a parameter that is data obtained by adding a coding key obtained by coding a secret key using a coding method having error correction capabilities and first biometric information, and second biometric information, data based on the coding key and a difference obtained by subtracting the second biometric information from the first biometric information is generated by decrypting the data using the coding method. A method for recovering a private key comprising:

[0148] (Appendix 5) The computer Get the parameters, Acquiring the second biometric information This includes: Restoring the private key includes the computer generating data by decrypting a difference obtained by subtracting the second biometric information from the parameter using the encoding method. A method for recovering a private key as described in Appendix 4.

[0149] (Appendix 6) The computer deleting the stored parameters in accordance with a user instruction; This includes: Restoring the private key includes generating the data by the computer using the parameters stored in the parameter storage means. A method for recovering a private key as described in Appendix 5.

[0150] (Appendix 7) On the computer, generating data by using second biometric information and a parameter that is data obtained by adding a coding key obtained by coding a secret key using a coding method having error correction capabilities and first biometric information, and decoding, using the coding method, data based on the coding key and a difference obtained by subtracting the second biometric information from the first biometric information; A program that executes the following.

[0151] (Appendix 8) The computer, Obtaining the parameters; acquiring the second biometric information; Execute In the step of restoring the private key, the computer is caused to execute a process of subtracting the second biometric information from the parameter and generating data by decoding the result using the encoding method. 1. The program described in Appendix 7.

[0152] (Appendix 9) The computer, deleting the stored parameters in accordance with a user instruction; Execute In the step of restoring the private key, the computer is caused to generate the data using the parameters stored in the parameter storage means. 1. The program described in Appendix 8. [Explanation of symbols]

[0153] 1, 2 Private key backup system 10 Key generator 11 Private key generation section 12 Private key transmission unit 20 Parameter Generation Device 21 Private key receiver 22 First biometric information acquisition unit 23 Parameter Generation Unit 24 Parameter transmission unit 30 Parameter storage device 31 Parameter receiver 32 Parameter storage section 33 Parameter transmission unit 40, 140, 610 Private key recovery device 41 Parameter receiver 42 Second biometric information acquisition unit 43,611 Private key recovery section 44 Private key transmission unit 60 Private key storage device 61 Private key receiver 62 Private key storage 90 Communication Network 101 Parameter storage unit 102 Deleted section

Claims

1. a private key recovery means for generating data by decoding, using second biometric information and a parameter that is the sum of a coding key obtained by coding a private key using a coding method having error correction capabilities and first biometric information, the data being based on the coding key and a difference obtained by subtracting the second biometric information from the first biometric information, using the coding method; A private key recovery device comprising:

2. parameter acquisition means for acquiring the parameters; a second biometric information acquisition unit that acquires the second biometric information, the private key recovery means generates data by decrypting the difference obtained by subtracting the second biometric information from the parameter using the encoding method. The private key recovery device according to claim 1 .

3. a parameter storage means for storing the parameters; a deleting means for deleting the parameters stored in the parameter storage means in accordance with a user's instruction; Equipped with the private key recovery means generates the data using the parameters stored in the parameter storage means. The private key recovery device according to claim 2 .

4. The computer Using a parameter that is data obtained by adding a coding key obtained by coding a secret key using a coding method having error correction capabilities and first biometric information, and second biometric information, data based on the coding key and a difference obtained by subtracting the second biometric information from the first biometric information is generated by decrypting the data using the coding method. A method for recovering a private key comprising:

5. On the computer, generating data by using second biometric information and a parameter that is data obtained by adding a coding key obtained by coding a secret key using a coding method having error correction capabilities and first biometric information, and decoding, using the coding method, data based on the coding key and a difference obtained by subtracting the second biometric information from the first biometric information; A program that executes the following.

Images