Signature systems, methods, and storage media

Abstract

To reduce the burden of identifying users when using the service, and to improve safety and efficiency. [Solution] In the signature system, the first device generates a first sketch using the user's first biometric information and a first signing key, generates first verification information based on the first signing key, and transmits the first sketch and the first verification information to the third device. The second device generates a second sketch using the user's second biometric information and a second signing key, generates second verification information based on the second signing key, and transmits the second sketch and the second verification information to the third device. The third device recovers a differential key from the first sketch and the second sketch for the pair of the first sketch and the first verification information that it received earlier, and identifies the ID corresponding to the pair of the first sketch and the first verification information for which predetermined conditions are met regarding the first verification information, the second verification information and the differential key as the user ID.

Description

[Technical Field]

[0001] This disclosure relates to a signature system, method, and storage medium. [Background technology]

[0002] Digital signatures are a technique that allows verification of the creator of a document and confirms that it has not been tampered with after creation. A typical example of a digital signature algorithm is given by the following key generation, signing, and verification steps.

[0003] Key generation: Generates a pair of signing keys (private keys) sk and verification keys (public keys) vk. (sk, vk)←KeyGen(1 κ ) …(1) κ is a security parameter (key length).

[0004] Signature: A signature σ is generated for the message m to be signed using the signing key (private key) sk. σ←Sign(sk, m) …(2)

[0005] Verification: The validity of the message (document) m and signature σ pair is verified using the verification key vk. 0 / 1←Verify(vk, m, σ) …(3) Here, acceptance is represented as 1, and rejection as 0.

[0006] Biometric signatures, which use biometric information as a key to generate digital signatures, simplify key management for signers, for example, by reducing the need for signature keys (private keys). Fuzzy signatures are known as digital signatures that use biometric information as a signing key (Reference 1).

[0007] Key generation: The KeyGen key generation algorithm generates a verification key vk from the first biometric information (fuzzy data) w. vk←KeyGen(1 κ ,w) …(4)

[0008] Signature: Input the second biometric information (fuzzy data) w' and the message m into the signature algorithm Sign to generate the signature σ. σ ← Sign(w', m) …(5)

[0009] Verification: Input the verification key vk, the message m, and the signature σ into the verification algorithm Verify. When verifying the correctness of the pair of the message m and the signature σ, output the verification result of the signature. 0 / 1 ← Verify(vk, m, σ) = Verify(vk, m, Sign(w', m)) …(6) Here, in the case of acceptance, it is 1, and in the case of rejection, it is 0.

[0010] In fuzzy signature, a distributed signature method in which one of the distributed keys is replaced with biometric information is used (Non-Patent Document 1).

Prior Art Documents

Non-Patent Documents

[0011]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0012] When a user uses a terminal at a store or facility to access services provided by a business, such as electronic payments or point issuance, by simply holding their face or finger / palm over a scanner using fuzzy signatures (biometric signatures), user identification becomes necessary. This is because, for example, if the business stores and manages a verification key for each user to verify the signature, it is necessary to identify the user who generated the signature and verify the signature with the verification key corresponding to that user.

[0013] Regarding user identification processes, it is desirable to realize a system that reduces the burden on both users and service providers, while also improving security and efficiency.

[0014] This disclosure provides a signature system, method, and storage medium that can solve the above-mentioned problems. [Means for solving the problem]

[0015] One form of the signature system disclosed herein includes at least a first device, a second device, and a third device, each having at least a processor and a communication interface. The first device generates a first sketch using the user's first biometric information and a first signing key, generates first verification information based on the first signing key, and transmits the first sketch and the first verification information to the third device. The second device generates a second sketch using the user's second biometric information and a second signing key, generates second verification information based on the second signing key, and transmits the second sketch and the second verification information to the third device. The third device includes a storage unit that stores one or more pairs of the first sketch and the first verification information transmitted from one or more of the first devices. Upon receiving the second sketch and the second verification information, the third device recovers a difference key from the first sketch and the second sketch for the pair of the first sketch and the first verification information stored in the storage unit, and identifies the ID (identification information) corresponding to the pair of the first sketch and the first verification information that satisfies predetermined conditions with respect to the first verification information, the second verification information and the difference key as the user ID.

[0016] One form of the signature method disclosed herein involves a first device transmitting to a third device a first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key. The second device transmits to the third device a second sketch generated using the user's second biometric information and second signing key, and second verification information generated based on the second signing key. The third device, Multiple sets of the first sketch and first verification information transmitted from one or more of the first devices are stored and maintained. Upon receiving the second sketch and the second verification information, the first sketch and the first verification information stored in the storage unit are treated as follows: The difference key is recovered from the first sketch and the second sketch. The ID (identification information) corresponding to the pair of the first sketch and the first verification information, for which predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, is identified as the user ID.

[0017] One form of storage medium disclosed in this disclosure is: A first sketch is generated using the user's first biometric information and first signing key. Based on the first signing key, first verification information is generated, A program that causes the first processing unit to execute a process that transmits the first sketch and the first verification information to the third processing unit, A second sketch is generated using the user's second biometric information and second signing key. Based on the second signing key, a second verification information is generated. A program that causes the second processing unit to execute a process that transmits the second sketch and the second verification information to the third processing unit, A process of storing one or more sets of the first sketch and the first verification information transmitted from one or more of the first devices in a storage unit, Upon receiving the second sketch and the second verification information, the first sketch and the first verification information stored in the storage unit are treated as follows: The difference key is recovered from the first sketch and the second sketch. The system stores a program that causes the third processing unit to execute a process that identifies the ID (identification information) corresponding to the pair of the first sketch and the first verification information, for which predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, as the user ID.

[0018] Another form of user ID identification device disclosed herein receives a first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key from one or more first devices, and registers the pair of the first sketch and the first verification information in a storage unit. Upon receiving a second sketch generated using the user's second biometric information and a second signing key, and second verification information generated based on the second signing key, the system applies the following to the set of the first sketch and the first verification information stored in the memory unit: The difference key is recovered from the first sketch and the second sketch. The ID (identification information) corresponding to the pair of the first sketch and the first verification information, for which predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, is identified as the user ID.

[0019] Another form of authentication device disclosed herein receives a first sketch generated using a user's first biometric information and a first signing key, and first verification information generated based on the first signing key from one or more first devices, and registers the pair of the first sketch and the first verification information as registered information in a storage unit. Upon receiving a second sketch generated using the second biometric information and second signing key of the user to be authenticated, and second verification information generated based on the second signing key, the system applies the first sketch and first verification information set up in the storage unit to the first sketch and first verification information set up in the storage unit. The difference key is recovered from the first sketch and the second sketch. The system verifies whether predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key. If the predetermined conditions are met, the user to be authenticated is authenticated as the user whose first biometric information was used to generate the first sketch. [Effects of the Invention]

[0020] According to this disclosure, the identification of users when using services hands-free, such as through signatures based on biometric information (fuzzy data), reduces the burden on both users and service providers, while also improving security and efficiency. [Brief explanation of the drawing]

[0021] [Figure 1] This diagram schematically illustrates an example of the signature system and processing described herein. [Figure 2] This diagram schematically illustrates an example of the processing of the signature system described herein. [Figure 3] This diagram schematically illustrates an example of the configuration of the signature system described herein. [Figure 4] This diagram illustrates an example of the processing of the signature system in this disclosure. [Figure 5] This diagram illustrates an example of the processing of the signature system in this disclosure. [Figure 6] This diagram illustrates another example of the configuration of the signature system in this disclosure. [Figure 7] This diagram illustrates another example of the processing of the signature system in this disclosure. [Figure 8] This diagram illustrates an example of a use case for the wallet disclosed in this document. [Figure 9] This diagram illustrates an example of a use case for the wallet disclosed in this document. [Figure 10] (A) and (B) are diagrams illustrating examples of computer system implementations. [Modes for carrying out the invention]

[0022] Several embodiments and examples of this disclosure will be described.

[0023] When a user uses a terminal at a store or facility to make electronic payments or other services provided by a service provider using biometric signatures, etc., the following are some examples of methods for identifying the user.

[0024] • When generating a biometric signature, the user enters their User ID (identification information). In this case, the advantage of biometric signatures, which is that users do not need to remember or possess their user IDs, is lost. For example, if the number of users (N) registered with the service provider becomes enormous, a user ID such as a name alone will not be able to uniquely identify N users. Therefore, a unique user ID is required, which necessitates that users remember or possess it.

[0025] • Biometric information is linked to a key ID and registered on the server in advance, and 1:N user authentication (biometric authentication) is performed using the biometric information. In this case, it is necessary for the server (service provider) to register biometric information in advance, which increases the burden on the service provider and raises security concerns such as the risk of biometric information leakage. Biometric information is a part of the body, and once it is leaked, it cannot be changed or destroyed. To avoid the leakage of biometric information, for example, data encryption and a robust system configuration are required, which increases the load on the server (service provider).

[0026] • By performing biometric signatures on all possible combinations, the system searches for registered information with similar biometric data. For example, one could consider a method that involves brute-force verification of biometric signatures until a signature verification is successful, and then using the ID (identification information) corresponding to the verification key for which the signature verification was successful. However, such a method is extremely inefficient. A similar method is known in which a verification node receives a biometric digital signature (biometric signature) generated from biometric information, compares the biometric digital signature with a prior biometric digital signature for the user, and verifies the user if it determines that the biometric digital signature is identical to the prior biometric digital signature for the user (Reference 6). This method is also similarly inefficient as a method for identifying users.

[0027] The above is a list of specific typical examples of anticipated users, and the above issues are merely examples; however, this disclosure discloses a system that solves at least the above issues. Specifically, this disclosure discloses a signature system (method, etc.) that reduces the burden on users and on service providers in stores and facilities, while also enabling improved security and efficiency.

[0028] Figure 1 is a diagram illustrating an example of a system according to an embodiment of the present disclosure. Referring to Figure 1, the biometric key generation device 110 (first device) generates a first sketch s using the user's first biometric information w and a first signing key x. s←Gen(x, w) …(7) Gen is a linear sketch generation algorithm (function).

[0029] The biometric key generation device 110 (first device) generates first verification information vi based on the first signing key x. vi = h(x) …(8) h is a homomorphic (additive homomorphic) one-way function that generates verification information vi from a signing key x, for example.

[0030] The biometric key generation device 110 (first device) transmits the first sketch s and the first verification information vi to the user ID identification device 130 (third device).

[0031] The biometric signature generation device 120 (second device) generates a second sketch s' using the user's second biometric information w' and the second signature key x', for example, when generating a signature. s'←Gen(x', w') …(9)

[0032] The biometric signature generation device 120 (second device) generates second verification information vi' based on the second signature key x'. vi'=h(x') …(10)

[0033] The biometric signature generation device 120 (second device) transmits the second sketch s' and the second verification information vi' to the user ID identification device 130 (third device).

[0034] The user ID identification device 130 (third device) includes a storage unit (database: DB) (not shown) that stores one or more pairs of first sketches s and first verification information vi transmitted from one or more biometric key generation devices 110 (first device).

[0035] When the user ID identification device 130 (third device) receives the second sketch s' and the second verification information vi' from the biometric signature generation device 120 (second device), it recovers the difference key Δ[k] from the first sketch s[k] and the second sketch s' for the k-th (1≦k≦N) pair of the first sketch s[k] and the first verification information vi stored in the storage unit (DB). Δ[k]←Rec(s[k],s') …(11)

[0036] In this specification, the first sketch s and first verification information vi of the k-th pair (row k) of the N pairs (N: positive integer) of the first sketch s and first verification information vi stored in the memory unit (DB) are denoted as s[k] and vi[k], respectively. Furthermore, below, the first signing key x and first biometric information w used to generate the first sketch s[k] of the k-th pair are also denoted as x[k] and w[k].

[0037] The user ID identification device 130 (third device) identifies the ID[k] corresponding to the k-th pair (first sketch s[k] and first verification information vi[k]) stored in the storage unit (DB) as the desired user ID if predetermined conditions are met with respect to the first verification information vi[k], the second verification information vi', and the difference key Δ[k]. The ID[k] (ID[k] may be k) corresponding to the k-th pair that satisfies the predetermined conditions can be associated with the user ID of the second biometric information w' used to generate the second sketch s' which was used to restore the difference key Δ[k] together with the first sketch s[k].

[0038] The biometric key generation device 110 (first device) may generate first verification information vi by applying a homomorphic one-way function h to the first signing key x. The biometric signature generation device 120 (second device) may generate second verification information vi' by applying a homomorphic one-way function h to the second signing key x'.

[0039] The user ID identification device 130 (third device) determines, for the k-th pair of the first sketch s and the first verification information vi stored in the storage unit (DB), that the calculation result of the value h(Δ[k]) obtained by applying the homomorphic one-way function h to the difference key Δ[k] and the second verification information vi'(=h(x')) which is the value obtained by applying the homomorphic one-way function h to the second signing key x' is related to the additive homomorphism relationship between the first verification information vi(=h(x)) which is the value obtained by applying the homomorphic one-way function h to the first signing key x, as a predetermined condition. h(x')*h(Δ[k])=h(x) (h(x')*h(x-x')=h(x)), or, h(x')+h(Δ[k])=h(x) (h(x')+h(x-x')=h(x)) …(12) You may also determine whether or not the condition is met.

[0040] The user ID identification device 130 (third device) may transmit the identified user ID to the biometric signature generation device 120 (second device), and the biometric signature generation device 120 (second device) may generate a signature σ for the message m to be signed using the second biometric information w' and / or the second signing key x'.

[0041] The biometric signature generation device 120 (the second device) transmits the user ID, signature σ, and message m to a verification device (not shown) (140 in Figure 2, the fourth device). The verification device (not shown) (140 in Figure 2, the fourth device) verifies the signature σ for message m using the verification key vk corresponding to the user ID.

[0042] The biometric signature generation device 120 (second device) may, in generating a signature, communicate with the user ID identification device 130 (third device), generate a first distributed signature and a second distributed signature using the second signing key x' and the difference key Δ[k] (=Rec(s[k], s') respectively, and then combine the first and second distributed signatures to generate a signature. The signature generated by combining the first and second distributed signatures is equivalent to the signature generated for message m using the first signing key x[k], and can be verified using the verification key vk corresponding to the user ID.

[0043] Alternatively, as another method of signature generation, the biometric signature generation device 120 (second device) generates a second signing key x' and a second verification key vk', generates a signature σ' for message m using the second signing key x', and transmits the signature σ', the second verification key vk', and the second sketch s' to a verification device (fourth device) not shown. The biometric key generation device 110 (first device) transmits the verification key vk and the first sketch s to the verification device (fourth device). The verification device (fourth device) not shown verifies the signature σ' using the second verification key x', reconstructs the difference key Δ from the first sketch s and the second sketch s', and verifies whether the verification key vk corresponding to the user ID, the second verification key vk', and the difference key Δ have a predetermined relationship (see, for example, reference 5).

[0044] Figure 2 is a diagram illustrating an example of a signature system according to an embodiment of the present disclosure. Figure 2 shows a detailed example of the processing in Figure 1. Referring to Figure 2, the signature system 100 comprises a biometric key generation device 110, a biometric signature generation device 120, a user ID identification device 130, and a verification device 140. In Figure 2, the numbers in parentheses within each device indicate the processing step number in that device. In Figure 2, the transmission and reception of signals (information) are indicated by arrows, but this does not mean one-way transmission; for example, Sending of an information retrieval request from the receiving device to the transmitting device. The transmission of information from the transmitting device to the receiving device, and This may include a series of handshakes, such as the transmission of an acknowledgment from the receiving device to the transmitting device, or A transmission request from the transmitting device to the receiving device. Sending an acknowledgment from the receiving device to the transmitting device. The transmission of information from the transmitting device to the receiving device, and It goes without saying that this may include a series of handshakes, such as the transmission of an acknowledgment from the receiving device to the transmitting device. The same applies to the following drawings.

[0045] The biometric key generation device 110 is equipped with a processor device (not shown) and a communication interface, and performs the following processing.

[0046] (Step 1) Obtain the user's first biometric information w.

[0047] (Step 2) Generate the first signing key x and verification key vk.

[0048] (Step 3) Generate the first sketch s using the first biometric information w and the first signing key x.

[0049] (Step 4) A homomorphic one-way function is applied to the first signing key x to generate the first verification information vi.

[0050] (Step 5) Send the first sketch s to the user ID identification device 130.

[0051] (Step 6) The first verification information vi is transmitted to the user ID identification device 130.

[0052] (Step 7) The verification key vk is sent to the verification device 140.

[0053] The biometric key generation device 110 may transmit the first sketch s and the first verification information vi simultaneously. The biometric key generation device 110 may transmit the first sketch s and the first verification information vi together with the user ID. The biometric key generation device 110 may transmit the verification key vk together with the user ID to the verification device 140. If the biometric key generation device 110 is the user's terminal (mobile terminal), the user ID may be the terminal's address or terminal ID, etc. Steps 1 and 2 may be performed in any order, steps 3 and 4 may also be performed in any order, and steps 5, 6 and 7 do not necessarily have to be performed in this order.

[0054] The biometric signature generation device 120 includes a processor device (not shown) and a communication interface, and performs the following processing.

[0055] (Step 1) Obtain the second biometric information w'.

[0056] (Step 2) Generate a second signing key x'.

[0057] (Step 3) A second sketch s' is generated using the second biometric information w' and the second signing key x'.

[0058] (Step 4) A second verification information vi' is generated from the second signing key x' using a homomorphic one-way function.

[0059] (Step 5) Send the second sketch s'.

[0060] (Step 6) Send the second verification information vi'.

[0061] (Step 7) Obtain the message m to be signed.

[0062] (Step 8) Obtain the user ID from the user ID identification device 130.

[0063] (Step 9) Generate signature σ

[0064] (Step 10) Send the user ID, signature σ, and message m to the verification device 140.

[0065] Note that steps 1 and 2 can be performed in any order, steps 3 and 4 can also be performed in any order, steps 5 and 6 do not necessarily have to be performed in this order, and step 7 can be performed in any order as long as it is before step 9.

[0066] The user ID identification device 130 is equipped with a processor device (not shown) and a communication interface, and performs the following processing.

[0067] (Step 1) The first sketch s and the first verification information vi are received and registered in the storage unit corresponding to the user ID. The user ID identification device 130 may be configured to automatically assign an ID to the set of the user's first sketch s and first verification information vi registered in the storage unit (for example, the record line number).

[0068] (Step 2) The second sketch s' and the second verification information vi' transmitted from the biometric signature generation device 120 are received.

[0069] (Step 3) Obtain the difference key Δ[k] (=Rec(s[k],s') from the first sketch s[k] and the second sketch s' of the k-th pair (1≦k≦N) registered in the memory unit (DB).

[0070] (Step 4) Verify whether the first verification information vi[k] and the second verification information vi' of the k-th (1≦k≦N) pair registered in the memory unit (DB) and the difference key Δ[k] satisfy predetermined conditions (relationships).

[0071] (Step 5) If the verification result of the difference key Δ[k] is successful (OK), the ID corresponding to the k-th set stored in the memory is identified as the user ID of the user of the second biometric information w' corresponding to the second sketch s'. That is, if it is confirmed that the first verification information vi[k] and the second verification information vi' of the k-th (1≦k≦N) set registered in the memory, and the difference key Δ[k] obtained in Step 3 satisfy predetermined conditions (relationships) (the equation Δ[k]=x[k]-x' holds), then the difference (distance) between the second biometric information w' corresponding to the second sketch s' and the first biometric information w[k] corresponding to the first sketch s[k] of the k-th (1≦k≦N) set is within the error correction range, and it is determined that they belong to the same user, and the ID[k] corresponding to the k-th set is identified as the user ID of the user of the second biometric information w. The ID[k] corresponding to the k-th pair may be the row number k (1 ≤ k ≤ N), or it may be the value of ID[k] (a pre-registered user ID) stored in the memory unit as the k-th pair along with the first sketch s[k] and the first verification information vi[k] in the same record.

[0072] (Step 6) The user ID identification device 130 transmits the user ID to the biometric signature generation device 120.

[0073] The verification device 140 is equipped with a processor device (not shown) and a communication interface, and performs the following processing.

[0074] (Step 1) The verification key vk is received and registered in the storage unit in correspondence with the user ID. Multiple verification keys are registered corresponding to multiple users. In the verification device 140, the user ID may be stored in the storage unit of the verification device 140 as the kth set, corresponding to the user's first sketch s[k] and first verification information vi[k] stored as the kth set in the storage unit of the user ID identification device 130. Alternatively, the verification key vk may be stored in the storage unit of the user ID identification device 130 in correspondence with the kth set ID[k] (user ID).

[0075] (Step 2) The user ID, signature σ, and message m sent from the biometric signature generation device 120 are received.

[0076] (Step 3) The verification key vk corresponding to the user ID transmitted from the biometric signature generation device 120 is read from the storage unit, and the signature σ for message m is verified using the verification key vk.

[0077] The verification device 140 transmits the verification result of signature σ to a terminal in the store or facility (which may be the biometric signature generation device 120 in Figure 2, which is the source of the signature σ). If the verification result of signature σ is successful, the terminal in the store or facility may provide a predetermined service, such as electronic payment, to the user who provided the second biometric information w' with the biometric signature generation device 120, thereby realizing hands-free payment.

[0078] Note that in Figure 2, for the sake of drawing convenience, only one configuration each of the biometric key generation device 110 and the biometric signature generation device 120 is shown; however, in the case of a store terminal, multiple biometric signature generation devices 120 may be provided. The biometric key generation device 110 may be a user's terminal or a terminal installed in a store. The user ID identification device 130 may be implemented as a server device and may be configured to communicate with multiple biometric key generation devices 110 and multiple biometric signature generation devices 120 via a communication line.

[0079] Figure 3 is a diagram illustrating an example of the device configuration of the signature system 100, as described with reference to Figure 2.

[0080] The biometric key generation device 110 includes a first biometric information acquisition unit 111, a key pair generation unit 112, a first sketch generation unit 113, a first verification information generation unit 114, a verification key transmission unit 115, a first sketch transmission unit 116, and a first verification information transmission unit 117.

[0081] The first biological information acquisition unit 111 acquires the first biological information w. The first biological information w may be feature information obtained by extracting features from biological information (digital data) acquired by, for example, a camera, a sensor, etc. The first biological information w may be binary data or an n-dimensional real vector.

[0082] The key pair generation unit 112 generates a first signing key x (where sk in equation (1) is x), which is the private key, and a verification key vk, which is the public key, according to the key generation algorithm of equation (1), for example.

[0083] The first sketch generation unit 113 generates a first sketch s by combining, for example, an encoded key Enc(x) obtained by encoding the first signature key x with the encoding function Enc, and the first biometric information w. s := Enc(x) + w …(13)

[0084] In equation (13), the operation + may also be -. Alternatively, depending on the encoding, it may be a bitwise exclusive OR operation, etc. For example, if the first biometric information w is binary data and Enc(x) is binary data, the right-hand side of equation (13) may be the bitwise exclusive OR of the first biometric information w and Enc(xi). If the first biometric information w is an n-dimensional vector, the right-hand side of equation (13) may be the vector addition (or vector subtraction) of the first biometric information w and Enc(x).

[0085] The encoding function Enc converts plaintext m in the source space into a coded c. The decoding function Dec converts the coded c back into plaintext m. c← Enc(m) …(14) m← Dec(c) …(15)

[0086] Here, for a code c' whose difference from the code c of any plaintext m contained in the source space is, for example, within the correction capacity, m = Dec(c') …(16) The following must be true. Linear codes will be used below.

[0087] Linearity: Enc(m1) + Enc(m2) …(17) is the codeword for m1 + m2, m1 + m2 = Dec(Enc(m1) + Enc(m2)) …(18) The following holds true. Note that in equation (18), the "+" on the left and right sides does not have to be the same operation.

[0088] Regarding coding, error correction codes (such as Hamming codes, BCH (Bose-Chaudhuri-Hocquenghem code), RS (Reed-Solomon) codes, and LDPC (low-density parity-check code) codes) may be used. Alternatively, lattice coding may be used. More specifically, methods using integer grids, triangular grids, and more complex grids are known (see Reference 2, etc.).

[0089] The first verification information generation unit 114 applies a one-way function h to the first signing key x to generate the first verification information vi = h(x). The first signing key x is not leaked from the first verification information vi.

[0090] A one-way function h is a function that is easy to compute from one direction to the other, but computationally difficult to compute in the reverse direction. Examples include functions that provide the discrete logarithm problem and cryptographic hash functions.

[0091] For example, let q be a prime number and the multiplicative group Fq of the finite prime field Fq * = <g>(where \(g\) is a generator), \(h(x) = g\) x (when an element \(y\) of the multiplicative group is given, \(y = h(x)=g\) x finding an integer \(x(0 < x < p)\) that satisfies this is difficult (discrete logarithm problem DLP). In this case, the one-way function is \(h(x)=g\) x and is given by, and satisfies the following additive homomorphism property \(h(x') * h(x - x')=h(x)\) …(19)

[0092] Also, for rational points \(Y\) and \(G\) on an elliptic curve \(E(F_q)\) over a finite field \(F_q\), it is difficult to find an integer \(x(0 < x < l\): \(l\) is the order of the base point \(G\)) from \(Y = [x]G\) (scalar multiplication: adding the point \(G\) \(x\) times repeatedly) (elliptic curve DLP: ECDLP). The one-way function \(H\) is given by \(h(x)=[x]G\). Rational points on an elliptic curve form an additive group with the point at infinity \(O\) as the identity element. That is, it satisfies the following relationship of additive homomorphism property [x']G+[x - x']G=[x]G (h(x') + h(x - x')=h(x)) …(20)

[0093] As the one-way function \(h\), a homomorphic ideal lattice hash function or the like may be used

[0094] The verification key transmission unit 115 transmits the verification key \(vk\) to the verification device 140. The verification information \(vk\) may be transmitted together with the user ID

[0095] The first sketch transmission unit 116 transmits the first sketch \(s\) to the user ID identification device 130. The first sketch \(s\) may be transmitted together with the user ID

[0096] The first verification information transmission unit 117 transmits the first verification information \(vi\) to the user ID identification device 130. The first verification information \(vi\) may be transmitted together with the user ID

[0097] The biometric signature generation device 120 includes a second biometric information acquisition unit 121, a key generation unit 122, a second sketch generation unit 123A, a second verification information generation unit 124A, a second sketch transmission unit 123B, a second verification information transmission unit 124B, a message acquisition unit 125, a signature generation unit 126, a user ID receiving unit 127, and a user ID, signature, and message transmission unit 128.

[0098] The second biometric information acquisition unit 121 acquires second biometric information w' for signature generation. The key generation unit 122 generates a second signing key x' (the second signing key x' and the second verification key vk'). The second biometric information w' acquired by the second biometric information acquisition unit 121 from the sensor has the same modality as the first biometric information w acquired by the first biometric information acquisition unit 111 of the biometric key generation device 110. The sensor of the second biometric information acquisition unit 121 and the sensor of the first biometric information acquisition unit 111 of the biometric key generation device 110 are of the same model and performance, and the same software is used for feature extraction.

[0099] The second sketch generation unit 123A generates a second sketch s' by combining the encoded key Enc(x') obtained by encoding the second signature key x' with the second biometric information w'.

[0100] The second verification information generation unit 124A applies a homomorphic one-way function to the second signing key x' to generate the second verification information vi'=h(x'). The second signing key x' is not leaked from the second verification information vi'.

[0101] The second sketch transmission unit 123B transmits the second sketch s' to the user ID identification device 130.

[0102] The second verification information transmission unit 124B transmits the second verification information vi' to the user ID identification device 130.

[0103] The message acquisition unit 125 acquires the message m to be signed. The message m may be an electronic document such as a payment statement at a store or facility.

[0104] The signature generation unit 126 generates a signature σ for message m.

[0105] The user ID receiving unit 127 receives the user ID transmitted from the user ID identification device 130.

[0106] The user ID, signature, and message transmission unit 128 transmits the user ID, signature, and message to the verification device 140.

[0107] The user ID identification device 130 includes a first sketch acquisition unit 131A, a first sketch storage unit 131B, a first verification information acquisition unit 132A, a first verification information storage unit 132B, a second sketch acquisition unit 133, a second verification information acquisition unit 134, a differential key generation unit 135, a differential key verification unit 136, a signature generation unit 137, and a user ID transmission unit 138.

[0108] The first sketch acquisition unit 131A acquires the first sketch transmitted from the biometric key generation device 110 and registers it in the first sketch storage unit 131B in correspondence with the user ID. The first verification information acquisition unit 132A acquires the first verification information transmitted from the biometric key generation device 110 and registers it in the first verification information storage unit 132B in correspondence with the user ID. The first sketch and the first verification information registered in the first sketch storage unit 131B and the first verification information storage unit 132B may also be registered as fields in a record corresponding to the user ID in a database (DB) table. In this case, each record (row) includes the fields (columns) of the user ID, the first sketch, and the first verification information. The user ID may also be the row number.

[0109] The second sketch acquisition unit 133 acquires the second sketch s' transmitted from the biometric signature generation device 120. The second verification information acquisition unit 134 acquires the second verification information vi' transmitted from the biometric signature generation device 120.

[0110] The difference key generation unit 135 reconstructs the difference key Δ[k] from the k-th (k-th row) first sketch s[k] (=Enc(x[k])+w[k]) and the second sketch s' registered in the first sketch storage unit 131B and the first verification information storage unit 132B. If the reconstruction function Rec is constructed using the decoding function Dec corresponding to the encoding function Enc, then the following holds: Δ[k]=Rec(s[k],s')=Dec(s[k]-s')(Enc(x[k])+w[k]-(Enc(x')+w')) =Dec(Enc(x[k]-x')+(w[k]-w')) …(21)

[0111] If the difference (distance) between the first biometric information w[k] and the second biometric information w' used in the first sketch s[k] (=Enc(x[k])+w[k]) of the kth (kth row) is within the correction range (error correction range), Δ[k]=x[k]-x' …(22) This is the result.

[0112] The differential key verification unit 136 calculates h(Δ[k]) and, for the k-th first verification information vi[k], vi'*h(Δ[k] )=vi[k] …(23) Check if the following holds true.

[0113] The differential key verification unit 136 determines that if equation (23) above holds true for the k-th first sketch s[k] and the first verification information vi[k], it sets the ID of the k-th entry as the user ID of the user of the second biometric information w'. The user ID transmission unit 138 transmits the user ID to the biometric signature generation device 120.

[0114] If equation (23) does not hold for any of k=1 to N, the process may be interrupted (an error message may be output) on the grounds that the corresponding user ID could not be found.

[0115] The signature generation unit 137 generates a distributed signature when performing a distributed signature generation process with the signature generation unit 126 of the biometric signature generation device 120. The signature generation unit 137 is not necessary when the signature generation unit 126 of the biometric signature generation device 120 generates a biometric signature on its own.

[0116] The verification device 140 includes a verification key acquisition unit 141A, a verification key storage unit 141B, a user ID, signature, and message acquisition unit 142, and a signature verification unit 143.

[0117] The verification key acquisition unit 141A receives the verification key transmitted from the biometric key generation device 110, associates it with the user ID, and registers it in the verification key storage unit 141B.

[0118] The User ID, Signature, and Message Acquisition Unit 142 receives the User ID, Signature σ, and Message m transmitted from the Biometric Signature Generation Device 120.

[0119] The signature verification unit 143 obtains the verification key vk corresponding to the user ID from the verification key storage unit 141B and uses the verification key vk to verify the validity of the message m and signature σ pair. 1 / 0←Verify (vk, m, σ) …(24)

[0120] Figure 4 is a flowchart illustrating the processing in the user ID identification device 130. In the registration process, the first sketch acquisition unit 131A acquires the first sketch s transmitted from the biometric key generation device 110 and registers it in the first sketch storage unit 131B in association with the user ID (step s101).

[0121] The first verification information acquisition unit 132A acquires the first verification information transmitted from the biometric key generation device 110 and registers it in the first verification information storage unit 132B in correspondence with the user ID (step s102). The first sketch storage unit 131B and the first verification information storage unit 132B may be columns (fields) of a database table. The user ID may be the user ID used when a user logs into the biometric key generation device 110, or the user ID used when logging into an application that accesses the user ID identification device 130 from the biometric key generation device 110. It may also be the address or terminal ID of the biometric key generation device 110. The user ID identification device 130 may receive multiple sets of first sketches s and first verification information vi generated for multiple users by multiple biometric key generation devices 110 and register them in correspondence with each user ID of the multiple users. In this case, the biometric key generation device 110 may be a terminal owned by each user. Alternatively, a single biometric key generation device 110 may generate a first signing key and a verification key, as well as a pair of a first sketch and first verification information, for multiple users. The verification key and user ID, and the pair of the first sketch and first verification information and user ID may be transmitted to the user ID identification device 130.

[0122] In the user ID identification process, the second sketch and second verification information are received from the biometric signature generation device 120 (steps s111, s112).

[0123] The k-th (k-th row) first sketch s[k] and the first verification information vi[k] are read from memory units 131B and 132B (steps s114 and S115). For convenience, the k-th (k-th row) first sketch s and the first verification information vi, which are stored in table format in the memory unit, are represented as s[k] and vi[k].

[0124] Reconstruct the difference key Δ[k] from the k-th first sketch s[k] and the second sketch s' (step s116). Δ[k]=Rec(s[k],s') …(25) If the difference (distance) between the first biometric information w[k] and the second biometric information w' used to generate the k-th first sketch s[k] (=Enc(x[k])+w[k]) is within the correction range (error correction range), then, as mentioned above, Δ[k]=x[k]-x'.

[0125] Apply the homomorphic one-way function h to the difference key Δ[k] to find h(Δ[k]) (step s117).

[0126] vi[k]=h(Δ[k])*vi' …(26) That is, h(x) = h(x-x')*h(x') …(27) Check if the condition is met (step s118).

[0127] If equation (27) is true (Yes branch in step s118), the k-th user ID (ID[k]) is set as the user ID of the user corresponding to the second biometric information w' (step s122), and the user ID is transmitted to the biometric signature generation device 120 (step s123).

[0128] In steps s113 to s120, if the loop variable k is iterated from 1 to N and the result in step s118 is still No (if equation (27) does not hold), an error notification may be issued (step s121) indicating that the user ID corresponding to the second biometric information w' cannot be found, or the process may be interrupted. In this case, an error notification may be issued to re-acquire the user's second biometric information w' and the user ID identification process in steps s113 to s120 may be retried, and the process may be interrupted if the predetermined number of attempts is exceeded.

[0129] In facial recognition and similar applications, feature quantities are represented as vectors in Euclidean space, and determination is made using the Euclidean distance (L2 distance). If the biometric information is an n-dimensional vector (where n is an integer greater than or equal to 2), the Euclidean distance d(w, w') (L2 norm) may be calculated as the distance between the first biometric information w and the second biometric information w'.

[0130] for example, s = Enc(x) + w …(28) s' = Enc(x') + w' …(29) twist, w-w'=s-Enc(x)-(s'-Enc(x')=s-s'-Enc(Δ) …(30) d(w,w')=||w-w'|| …(31)

[0131] If the Euclidean distance d(w, w') exceeds a predetermined threshold, the user of the second biometric information w' is determined not to be the same person as the user of the first biometric information w used to generate the k-th first sketch s[k]. For this reason, processing may be interrupted. By performing a determination using the Euclidean distance, identity can be confirmed with an accuracy comparable to biometric authentication. If the biometric information is binary data, the distance between the first biometric information w and the second biometric information w' may be the Hamming distance or the like.

[0132] Below, we will explain biometric distributed signature generation as a method of signature generation.

[0133] Key generation: The biometric key generation device 110 generates a first sketch s and a verification key vk based on the first biometric information w and security parameter κ. (s, vk)←KeyGen (w, 1 κ ) …(32) As an example, input the security parameter κ to generate the first signing key (private key) x and verification key (public key) vk. (x,vk)←KeyGen(1 κ ) …(33)

[0134] The user's first biometric information w and first signing key x are input into a linear sketch generation algorithm to generate a first sketch s. s←Gen(x, w) …(34) The first sketch, s, is also called the auxiliary key (hk).

[0135] Signature: A signature σ for document M is generated by communication between the signature generation unit of the first device that has acquired the second biometric information w' (signature generation unit 126 of the biometric signature generation device 120) and the signature generation unit of the second device that holds the first sketch s (signature generation unit 137 of the user ID identification device 130). For example, the first device generates a second signature key x', s'←Gen(x',w') …(35) The first device generates a second sketch s'. The first device sends the second sketch s' to the second device, and the second device recovers the difference key Δ between the first signing key x and the second signing key x' from the difference between the first sketch s and the second sketch s'. The signature generation unit of the second device (signature generation unit 137 of the user ID identification device 130) generates a second distributed signature using the difference key Δ. The signature generation unit of the first device (signature generation unit 126 of the biometric signature generation device 120) generates a first distributed signature using the second signing key x'. The signature generation unit of the first device (signature generation unit 126 of the biometric signature generation device 120) may combine the first distributed signature using the second signing key x' and the second distributed signature using the difference key Δ to generate a signature equivalent to the signature generated using the first signing key x for message m. Alternatively, for the second distributed signature σ' using the difference key Δ, the key homomorphism function Khom (Khom corresponds to SignShift in Non-Patent Document 1, or partially corresponds to the Adapt algorithm in Reference 7) can be used. σ←Khom(x', σ') …(36) This may result in Δ+x'=(x-x')+x'=x, that is, generating a signature σ equivalent to the one generated using the first signing key x.

[0136] Verification: The verification device 140 uses the verification key vk to verify whether the message m and signature σ pair is correct. It may return 1 if the verification result is accepted (success: OK) and 0 if it is rejected (failure: NG).

[0137] When this disclosure is applied to this biometric distributed signature, the biometric key generation device 110 generates a verification key vk, a first sketch s, and first verification information vi, transmits the verification key vk to the verification device 140, and transmits the first sketch s and the first verification information vi to the user ID identification device 130. The first verification information vi may be a verification key vk generated using the VKGen() function, which generates the verification key vk from the first signing key x. vk = VKGen(x) …(37)

[0138] In signature generation, the biometric signature generation device 120 acquires the second biometric information w', generates the second signature key x', generates the second sketch s', and generates the second verification information vi', and transmits the second sketch s' and the second verification information vi' to the user ID identification device 130. The second verification information vi' is, vk'=VKGen(x') …(38) The verification key vk' generated by [the relevant method] may also be used.

[0139] The biometric signature generation device 120 generates a first distributed signature for message m using the second signature key x'.

[0140] The user ID identification device 130 generates a difference key Δ[k] from the difference between the N first sketches registered in the storage unit (table) and the second sketch s' in order. vi[k]=h(Δ[k])*vi' …(39) If the above is true, the k-th ID[k] in the table (ID[k] may be k) is used as the user ID.

[0141] The signature generation unit 137 of the user ID identification device 130 generates a second distributed signature for message m using the differential key Δ[k] and transmits it to the biometric signature generation device 120.

[0142] The biometric signature generation device 120 combines the first distributed signature and the second distributed signature to generate a signature equivalent to the one generated using the first signing key x for message m.

[0143] The biometric signature generation device 120 receives the user ID specified by the user ID specifying device 130 and transmits the user ID, signature, and message m to the verification device 140.

[0144] An example of distributed signature generation between the signature generation unit 126 of the biometric signature generation device 120 and the signature generation unit 137 of the user ID specifying device 130 will be described for Schnorr signatures. First, Schnorr signatures will be outlined.

[0145] Key generation: p and q are prime numbers and q|(p - 1) (q is a divisor of p-1), and g is a generator of the multiplicative group Zp * of order q, that is g^q ≡ 1 (mod p) …(40)

[0146] Randomly select the secret key x uniformly. x ← R Zq (Zq = Z / qZ: the set of integers from 0 to less than q) …(41) The symbol "← R " represents randomly selecting uniformly from the information source (in this case, Zq).

[0147] Calculate the public key vk. vk = g^x mod p …(42) Here, ^ is the exponentiation operator. Note that the public key may also be p, q, g, vk. However, p, q, g are shared by each device as common parameters, and the public key may also be vk.

[0148] Signature: k ← R Zq …(43) is randomly selected uniformly. r = g^k mod p …(44) e = H(r, m) …(45) y = k - e*x mod q …(46) Signature = (e, y) The hash function H(r, m) calculates a hash value for the concatenated value of r and m.

[0149] verification: In the signature verification function Verify(vk, σ, m)(vk = g^x mod p: public key), for a signature σ=(e, y) and a message m, r' = (g^y)(vk^e) mod p …(47) Calculate, e = H(r', M)s If the condition is met, it returns 1 (accepted); otherwise, it returns 0 (rejected).

[0150] Figure 5 is a diagram illustrating an example of the computational flow for two-party distributed signature generation (Two-Party Schnorr signature) between the biometric signature generation device 120 and the user ID identification device 130. For more information on two-party distributed Schnorr signatures, please refer to, for example, Reference 3. In the following, the processing numbers (step numbers) within each device in Figure 5 are indicated in parentheses at the end of the explanation for that processing number.

[0151] In the bio-based key generation device 110, (Step 1) The first biological information acquisition unit 111 acquires the first biological information w.

[0152] (Step 2) The key pair generation unit 112 uniformly randomly selects the first signing key x (x ← R F n * The key pair generation unit 112 of the biometric key generation device 110 generates a verification key vk corresponding to the first signing key x (vk = g^x). The pair of the first signing key x and the verification key vk may be generated in a single key generation procedure.

[0153] (Step 3) The first sketch generation unit 113 generates a first sketch s (=Enc(x)+w) using the first signature key x encoded with the encoding function Enc, which gives the encoded key c (=Enc(x)), and the first biometric information w.

[0154] (Step 4) The first verification information generation unit 114 generates the first verification information vi=H(x) from the first signing key x.

[0155] (Step 5) The first verification key transmission unit 115 transmits the verification key vk to the verification device 140. The verification key vk may also be transmitted to the verification device 140 along with the user ID.

[0156] (Step 6) The first sketch transmission unit 116 transmits the first sketch s to the user ID identification device 130, and the first verification information transmission unit 117 transmits the first verification information vi to the user ID identification device 130.

[0157] In the user ID identification device 130, (Step 1) The first sketch acquisition unit 131A receives the first sketch s and stores it in the first sketch storage unit 131B. The first verification information acquisition unit 132A receives the first verification information vi and stores it in the first verification information storage unit 132B. In Figure 5, for the sake of drawing convenience, the reception and registration of the first sketch s and the first verification information vi are described as a single processing step, but of course, the reception step and the registration step may be separate steps. Of course, the first sketch s and the first verification information vi may be stored, for example, as a single record corresponding to a user ID.

[0158] When creating a biometric signature, in the biometric signature generation device 120, (Step 1) The second biological information acquisition unit 121 acquires the second biological information w'.

[0159] (Step 2) The key generation unit 122 uniformly randomly selects a second signing key x' (Δ ← R Z q )(Δ∈[0,q-1]).

[0160] (Step 3) The second sketch generation unit 123A generates a second sketch s' (=Enc(x')+w') using the second signature key x' and the second biometric information w'.

[0161] (Step 4) The second verification information generation unit 124A generates the second verification information vi' (=h(x')) from the second signing key x'.

[0162] (Step 5) The second sketch transmission unit 123B transmits the second sketch s' to the user ID identification device 130. The second verification information transmission unit 124B transmits the second verification information vi' to the user ID identification device 130. Note that in Figure 5, the transmission of the second sketch s' and the second verification information vi' is shown as a single step simply for the sake of drawing, but of course, they could be treated as separate steps.

[0163] In the user ID identification device 130, (Step 2) The second sketch acquisition unit 133 receives the second sketch s' transmitted from the biometric signature generation device 120, and the second verification information acquisition unit 134 receives the second verification information vi' transmitted from the biometric signature generation device 120.

[0164] In the user ID identification device 130, (Step 3) For the second sketch s' and the second verification information vi', the difference key generation unit 135 recovers the difference key from the first sketch s[k] and the second sketch s' for the k-th (1≦k≦N) pair of the first sketch (s[k]) and first verification information (vi[k]) out of the N pairs of first sketches s and first verification information vi stored (registered) in the first sketch storage unit 131B and the first verification information storage unit 132B. Δ[k]=Rec(s[k],s)=Dec(s[k] - s)=x[k]-x' mod p …(48) However, s[k] = Enc(x[k]) + w[k] …(49)

[0165] In the user ID identification device 130, the differential key verification unit 136 is: vi = h(Δ[k]) * vi' …(50) In other words, h(x[k])=h(x[k]-x')*h(x') …(51) The system checks whether the condition is true, and if it is true, the difference (distance) between the first biometric information w used to generate the first sketch s[k] stored in the k-th set and the second biometric information w' used to generate the second sketch s' is within the error correction range, and the ID[k] of the k-th set is identified as the user ID of the user of the second biometric information w'.

[0166] The first verification information vi may be the verification information vk = g^x mod p corresponding to the first signing key x. Similarly, the second verification information vi' may be the verification information vk' = g^x' mod p corresponding to the second signing key x'. The first verification information vi[k] stored as the k-th pair in the first verification information storage unit 132B is, if x[k] represents the corresponding first signing key x, vi[k]=g^x[k] mod p …(52) in this case, h(Δ[k])*vi'=g^(x[k]-x')*g^x' mod p=g^x[k] mod p …(53) And so, vi[k]=h(Δ[k])*vi' …(54) This is true.

[0167] In the biometric signature generation device 120, (Step 7) The signature generation unit 126 performs distributed signature generation. Distributed signature generation consists of the following steps.

[0168] (Step 7A) The signature generation unit 126 uniformly selects a first random number k1 (k1 ← R Zq)(k1∈[0,q-1]).

[0169] (Step 7B) The signature generation unit 126 obtains a value r1 by raising the source g to the power of the first random number k1. r1 = g^k1 mod p …(55) Calculate.

[0170] (Step 7C) The signature generation unit 126 sends messages m and r1 to the signature generation unit 137 of the user ID identification device 130.

[0171] (Step 7D) The signature generation unit 126 receives r2 and y2 transmitted from the signature generation unit 137 of the user ID identification device 130.

[0172] (Step 7E) The signature generation unit 126 obtains a value r by multiplying r2 (= g^k2 mod p) received from the signature generation unit 137 of the user ID identification device 130 by r1 (= g^k1 mod p) calculated by the signature generation unit 126. r = r1*r2 mod p=g^(k1+k2 mod q) mod p …(56)

[0173] (Step 7F) The signature generation unit 126 inputs r and message m into the hash function H, e = H(r, m) …(57) Calculate.

[0174] (Step 7G) ​​Signature generation unit 126 y1 = k1 - e*x' mod q …(58) Calculate.

[0175] (Step 7H) The signature generation unit 126 combines y1 and y2 to calculate y. y=y1+y2=k1 - e*x' mod q +k2 - e*Δ[k] mod q =(k1 + k2)-e*(x'+ Δ[k]) mod q =(k1 + k2)-e*(x'+ x[k]-x') mod q =(k1 + k2)-e*x[k] mod q …(59) x[k] is the first signing key x used in the user ID identification device 130 to generate the k-th set of the first sketch s[k].

[0176] (Step 7I) In the above steps, the signature generation unit 126 of the biometric signature generation device 120 generates (completes) a signature σ=(e, y) for message m using the signature key x'+Δ[k] (=first signature key x[k]).

[0177] (Step 8) The user ID receiving unit 127 receives the user ID identified by the user ID identification device 130.

[0178] (Step 9) The User ID, Signature, and Message Transmission Unit 128 transmits the User ID, Signature σ, and Message m to the Verification Device 140.

[0179] In the user ID identification device 130, (Step 5) The signature generation unit 137 communicates with the signature generation unit 126 of the biometric signature generation device 120 to perform distributed signature generation processing.

[0180] (Step 5A) The signature generation unit 137 receives messages m and r1 from the signature generation unit 126 of the biometric signature generation device 120.

[0181] (Step 5B) The signature generation unit 137 uniformly selects a second random number k2 (k2 ← R Zq(k2∈[0,q-1])).

[0182] (Step 5C) The signature generation unit 137 obtains the value r2 by raising the generator g to the power of the second random number k2. r² = g^k² mod p …(60)

[0183] (Step 5D) The signature generation unit 137 calculates the value r by multiplying r2 by r1 transmitted from the biometric signature generation device 120. r = r1*r2 mod p …(61)

[0184] (Step 5E) The signature generation unit 137 inputs r and message m into the hash function H, e = H(r, m) (∈Z q * :Z q (and the set of integers prime to q) ... (62) Calculate.

[0185] (Step 5F) The signature generation unit 137 uses the product of e and the difference key Δ[k] and the second random number k2, y2 = k2 -e*Δ[k] mod q …(63) Calculate.

[0186] σ²=(e, y²) can also be considered a second distributed signature.

[0187] (Step 5G) The signature generation unit 137 transmits r2 obtained by equation (60) and y2 (the second element of the second distributed signature σ2=(e, y2)) obtained by equation (63) to the biometric signature generation device 120.

[0188] (Step 6) The user ID transmission unit 138 transmits the user ID to the biometric signature generation device 120.

[0189] In the verification device 140, (Step 1) The verification key acquisition unit 141A receives the verification key vk transmitted from the biometric key generation device 110 and stores (registers) it in the verification key storage unit 141B in correspondence with the user ID. The user ID in the verification key storage unit 141B and the user ID in the user ID identification device 130 are the same.

[0190] (Step 2) The User ID, Signature, and Message Acquisition Unit 142 receives the User ID, Signature σ=(e, y), and Message m.

[0191] (Step 3) The signature verification unit 143 reads the verification key vk corresponding to the user ID from the verification key storage unit 141B and uses the verification key vk to verify the validity of the signature σ=(e, y) and message m pair. That is, the signature verification unit 143 obtains a value r' by multiplying the value obtained by raising the generator g to the power of y by the value obtained by raising the public key vk corresponding to the user ID to the power of e. r' = (g^y)*(vk^e) mod p …(64) And the hash value of r' and message m H(r', m) …(65) Calculate, e = H(r', M) …(66) If the condition is met, Verify(v, σ, M) returns 1 (accepted); otherwise, it returns 0 (rejected).

[0192] That is, regarding the right-hand side of equation (64), g^y= g^ {(k1 + k2 - e*(x'+Δ)) mod q} mod p …(67) vk^e = g^{(x*e) mod q} mod p …(68) Therefore, r' in equation (64) is given by the following: r' = g^{(k1+k2 -e*(x'+Δ) +e*x) mod q} mod p …(69)

[0193] Here, x = Δ + x' mod q …(70) If so, the right-hand side of equation (64) is, r' = g^{(k1+k2) mod q} mod p …(71) Thus, r' is the same as r in equation (61). therefore, H(r', m) = H(r, m)=e …(72) The following holds true, and Verify(v, σ, M) returns 1 (accepted).

[0194] on the other hand, x ≠ x' + Δ mod q …(73) Therefore, r'≠r, and thus, H(r', m)≠e …(74) Therefore, Verify(v, σ, M) returns 0 (rejected).

[0195] For the purpose of enhancing security, the biometric signature generator 120 may perform a zero-knowledge proof (Non-Interactive zero-knowledge: NIZK) of knowing the first random number k1 to the user ID identification device 130. In this case, the biometric signature generator 120 and the user ID identification device 130 share a proof generation key and a proof verification key. For example, in Figure 5, the signature generation unit 126 of the biometric signature generator 120, which is the prover, may, for example, calculate r1 using the first random number k1 (step 7B of the biometric signature generator 120 in Figure 5), then generate a proof (NIZK proof) π1 from a specific example of the proposition to be proven (instance: knowing the first random number k1) and evidence (witness) that this proposition is true, and send the instance (r1) and proof π1 to the user ID identification device 130, which is the verifier. The verifier, user ID identification device 130, may, after receiving the instance (r1) and proof π1, perform verification of proof π1 using the proof verification key.

[0196] The user ID identification device 130 may perform a non-interactive zero-knowledge proof that it knows the second random number k2 to the biometric signature generation device 120. For example, in Figure 5, the signature generation unit 137 of the user ID identification device 130, which is the prover, may calculate r2 using the second random number k2 (step 5C of the user ID identification device 130 in Figure 5), and then generate proof π2 from a specific example of the proposition to be proven (instance: knowing the second random number k2) and evidence that this proposition is true, and then send the instance (r2) and proof π2 to the biometric signature generation device 120, which is the verifier. The biometric signature generation device 120, which is the verifier, receives the instance (r2) and proof π2 and then verifies proof π2 using the proof verification key. The biometric signature generation device 120 may decommit to the instance (r2) and the certificate π2, and the user ID identification device 130 may verify the certificate π1 after the commitment has been released (decommitted) (Reference 4).

[0197] Figure 6 illustrates another example of an embodiment of the present disclosure and corresponds to the apparatus configuration in Figure 3. In difference from Figure 3, in Figure 6, the biometric key generation device 110 further comprises a verification key component 118 that constructs the verification key VK=(vk,s) from the verification key vk and the first sketch s.

[0198] The biometric signature generation device 120 includes a key pair generation unit 122A that generates a key pair of the second signature key x' and the second verification key vk', instead of the key generation unit 122 that generates the second signature key x' in Figure 3, and further includes a signature configuration unit 129 that constructs a signature (biometric signature) σ=(σ', vk', s') from the signature σ' generated by the signature generation unit 126, the second verification key vk' generated by the key pair generation unit 122A, and the second sketch s' generated by the second sketch generation unit 123A.

[0199] The user ID identification device 130 has the signature generation unit 137 shown in Figure 3 removed and is equipped with a Euclidean distance verification unit 139.

[0200] The verification device 140 has the configuration shown in Figure 3, plus an additional differential key pair verification unit 144.

[0201] Figure 7 is a diagram illustrating the processing of the signature system 100 in Figure 6.

[0202] In the bio-based key generation device 110, (Step 1) The first biometric information acquisition unit 111 acquires the user's first biometric information w.

[0203] (Step 2) The key pair generation unit 112 generates a first signing key x and a verification key vk.

[0204] (Step 3) The first sketch generation unit 113 generates a first sketch s using the first biometric information w and the first signature key x. s := Enc(x) + w …(75)

[0205] (Step 4) The verification key construction unit 118 generates a verification key VK = (s, vk) using the verification key vk and the first sketch s.

[0206] (Step 5) The first verification information generation unit 114 applies a homomorphic one-way function to the first signature key x to generate the first verification information vi. vi := h(x) …(76)

[0207] (Step 6) The first sketch transmission unit 116 transmits the first sketch s to the user ID identification device 130.

[0208] (Step 7) The first verification information transmission unit 117 transmits the first verification information vi to the user ID identification device 130.

[0209] (Step 8) The verification key transmission unit 115 transmits the verification key VK = (vk, s) to the verification device 140.

[0210] The first sketch s and the first verification information vi may be transmitted simultaneously. The first sketch s and the first verification information vi may be transmitted together with the user ID. The verification key VK may be transmitted together with the user ID. Note that steps 1 and 2 may be swapped, steps 3, 4, and 5 do not necessarily have to be in this order, and steps 6, 7, and 8 do not necessarily have to be in this order either.

[0211] In the biometric signature generation device 120, (Step 1) The second biometric information acquisition unit 121 acquires the second biometric information w'.

[0212] (Step 2) The key pair generation unit 122A generates a pair of the second signature key x' and the second verification key vk'.

[0213] (Step 3) The second sketch generation unit 123A generates a second sketch s' using the second biometric information w' and the second signature key x'.

[0214] (Step 4) The second verification information generation unit 124A applies a homomorphic one-way function to the second signature key x' to generate the second verification information vi'.

[0215] (Step 5) The second sketch transmission unit 123B transmits the second sketch s' to the user ID identification device 130.

[0216] (Step 6) The second verification information transmission unit 124B transmits the second verification information vi' to the user ID identification device 130.

[0217] (Step 7) Obtain the message m.

[0218] (Step 8) The signature generation unit 126 generates a signature σ' for the message m using the second signature key x'. σ'←Sign(x',m) …(77)

[0219] (Step 9) The signature composition unit 129 generates a signature σ = (σ', vk', s') including the signature σ', the second verification key vk', and the second sketch s'.

[0220] (Step 10) The user ID reception unit 127 receives the user ID transmitted from the user ID identification device 130.

[0221] (Step 11) The user ID-signature-message transmission unit 128 transmits the user ID, the signature σ = (σ', vk', s'), and the message m to the verification device 140.

[0222] Note that steps 1 and 2 may be swapped, steps 3 and 4 may be swapped, steps 5 and 6 do not necessarily have to be in this order, step 7 may be in any order as long as it is before step 9. Step 10 may be before step 8.

[0223] In the user ID identification device 130, (Step 1) The first sketch acquisition unit 131A and the first verification information acquisition unit 132A receive the first sketch s and the first verification information vi transmitted from the biometric key generation device 110, and register them in the first sketch storage unit 131B and the first verification information storage unit 132B in correspondence with the user ID. For example, the first sketch storage unit 131B and the first verification information storage unit 132B may be configured as a database (table), and the first sketch s and the first verification information vi fields of the record stored in the database (including the user ID, the first sketch s, and the first verification information vi) may be used as columns.

[0224] (Step 2) The second sketch acquisition unit 133 and the second verification information acquisition unit 134 receive the second sketch s' and the second verification information vi'.

[0225] (Step 3) The difference key generation unit 135 obtains the difference key Δ from the first sketch s[k] and the second sketch s' which are registered in the k-th (k-th row) position in the first sketch storage unit 131B. Δ[k]=Rec(s[k],s')(=Dec(s[k]-s')) …(78)

[0226] (Step 4) The difference key verification unit 136 checks if the difference key Δ[k] is found to be the first verification information vi[k] and the second verification information vi' registered in the kth row (kth position) of the first verification information storage unit 132B. vi = h(Δ[k]) * vi' …(79) If the following relationship is satisfied, the user ID is set to k. Alternatively, the user ID is set to ID[k], which is the k-th user ID stored in the first sketch storage unit 131B.

[0227] (Step 5) For the first sketch s[k] (=Enc(x[k])+w[k]) of the kth (kth row) of the first sketch storage unit 131B corresponding to user ID=k, the second sketch s' (=Enc(x')+w'), and the difference key Δ[k] (=x[k]-x'), the difference between the first biometric information w[k] and the second biometric information w' is given by the following: w[k]-w'=s[k]-Enc(x[k])-(s'-Enc(x')=s[k]-s'-Enc(Δ[k]) …(80)

[0228] Therefore, the first biological information w[k] of the n-dimensional vector is (w1, ..., w n ) and the second biological information w'=(w'1,…,w' n The Euclidean distance d(w[k], w') between ) can be found as follows: d(w[k], w')=||w[k]-w'||=√{(w1-w'1) 2 +…+(w n -w' n ) 2 }=||s[k]-s'-Enc(Δ[k])|| …(81)

[0229] The Euclidean distance verification unit 139 may determine that the first biometric information w and the second biometric information w' are not biometric information of the same person if the Euclidean distance d(w,w') exceeds a predetermined threshold th (d(w,w')>th), and may interrupt the process (it may also return an error message).

[0230] In equation (80), the encoding function Enc may also be a function that generates an n-dimensional (integer) vector from an integer value (signature key). For example, the set of lattice points L is defined as follows (Reference 5). L={Y=(y1,…,y n )| y i y is a non-negative integer, 0 ≤ y i ≤K} …(82) Here, K is t h Ya|w i Let it be a predetermined integer that is sufficiently larger than |.

[0231] The function int() that associates an integer z with an N-dimensional integer vector Y ∈ L may be defined as Enc. z←int(Y)=Σ[i=1, n]y i (2K) i-1 …(83)

[0232] The decoding function Dec is a function that maps an integer z to an n-dimensional integer vector Y, and the inverse function int() of int() may be used. -1 () may be used. Y ← int -1 (z) …(84)

[0233] (6) The user ID transmission unit 138 transmits the user ID to the biometric signature generation device 120.

[0234] In the verification device 140, (Step 1) The verification key acquisition unit 141A receives the verification key VK = (vk, s) and registers it in the verification key storage unit 141B. In this case, the row number in the table of the verification key storage unit 141B where the verification key VK = (vk, s) is registered may be registered to be the same as the row where the corresponding first sketch s and the first verification information vi are registered in the first sketch storage unit 131B and the first verification information storage unit 132B of the user ID identification device 130. Alternatively, the verification key VK = (vk, s) may be registered in the table of the verification key storage unit 141B corresponding to the same user ID as the user ID of the corresponding first sketch s and the first verification information vi.

[0235] (Step 2) The user ID·signature·message acquisition unit 142 receives the user ID, signature σ, and message m transmitted from the biometric signature generation device 120.

[0236] (Step 3) The signature verification unit 143 acquires the verification key VK corresponding to the user ID from the verification key storage unit 141B.

[0237] (Step 4) The signature verification unit 143 verifies the signature σ' for the message m using the second verification key vk' included in the biometric signature σ = (σ', vk', s'). 1 / 0 ← Verify(vk', σ', m) …(85)

[0238] If the verification of the signature σ' fails (is not accepted), the signature verification unit 143, for example, interrupts the process (or returns an error message to the signature transmission source).

[0239] (Step 5) If the verification of the signature σ' is successful (accepted), the difference Δvk between the verification key vk of the verification key VK=(vk, s) and the second verification key vk' is calculated using the function Diff. Δvk = Diff(vk, vk') …(86)

[0240] (Step 6) The signature verification unit 143 reconstructs the difference key Δ from the first sketch s contained in the verification key VK=(vk, s) and the second sketch s' contained in the biometric signature σ=(σ', vk',s') using the reconstruction function Rec. Δ = Rec(s, s') …(87)

[0241] The recovery function Rec(s, s') is composed of, for example, the decoding function Dec(s-s'), Δ=Rec(s, s')=Dec(s-s')=Dec(Enc(x)+w-(Enc(x')+w')) =Dec(Enc(x-x')+(w-w')) …(88) If the difference (distance) between the first biological information w and the second biological information w' is within the correction range, Δ = x - x' …(89) This is the result.

[0242] (Step 7) The differential key pair verification unit 144 verifies whether Δvk = vk - vk' and Δ have a predetermined relationship. In the case of the Schnorr signature described above, Δvk = Diff(vk,vk') = g x / g x’ mod p …(90) So, Δvk=g Δ mod p …(91)

[0243] If the difference key pair verification unit 144 successfully verifies the difference between the verification key and the signing key, it is considered a final success.

[0244] As an example of a use case for the above-described embodiment, we will explain its application to a wallet system. A custodial wallet (management-delegated wallet) entrusts the possession and management of private keys necessary for accessing and managing assets (digital assets), as well as asset transactions, to a service provider. Custodial wallets have advantages such as ease of use and simple setup, but they have problems in terms of data privacy and security, such as the risk of fraud by malicious service providers or the risk of data leakage from service providers. In a non-custodial wallet, the user is responsible for possessing and managing the private key. Therefore, proper management of the private key becomes a burden on the user. Non-custodial wallets often require a smartphone or similar device for storing and managing the private key, making hands-free use difficult. Figure 8 is a schematic diagram showing an example of a wallet system (electronic wallet system) 101 in which the signature system 100 is applied to a hands-free non-custodial wallet, as a modification of the above-described embodiment.

[0245] In Figure 8, terminal 10 is a terminal where user 60 registers sketches, verification information, and user information in advance with user ID identification device 30, etc., and may include the biometric key generation device 110 shown in Figure 2. Depending on the system configuration, the modality of the biometric information used for user ID identification and the biometric information used to sign the certificate selected by the user may be the same or different. For example, facial information may be used as the biometric information for user ID identification, and finger vein information may be used to sign the certificate. In this case, terminal 10 acquires facial information as the first biometric information w, generates a first sketch s (=Enc(w)+x) from the first signing key x and the first biometric information w, generates first verification information vi from the first signing key x, and registers these with user ID identification device 30. Terminal 10 may also generate a sketch using finger vein information as biometric information and register it with certificate management device 50. In the example shown in Figure 8, the terminal 10 transmits the first sketch s and the first verification information vi along with the user ID to the user ID identification device 30, which then stores and manages the first sketch s and the first verification information vi corresponding to the user ID. The user ID identification device 30 may also include the user ID identification device 130 shown in Figure 2.

[0246] Terminal 10 may also send n pairs (s1, vk1) ~ (sn, vkn) (where n is an integer greater than or equal to 1) of the first sketch s generated from the first signing key x and the first biometric information w to the certificate management device 50 for pre-configuration registration.

[0247] When user 60 (the same user 60 who performed the pre-registration work at terminal 10) receives a service at terminal 20 of the facility (such as purchasing boarding passes, accommodation vouchers, tickets, making payments, issuing coupons, or awarding points), terminal 20 uses a camera or sensor (not shown) to acquire second biometric information w' of user 60, such as facial information (or iris, finger / palm vein). Terminal 20 generates a second sketch s' from the second signing key x' and the second biometric information w', generates second verification information vi' from the second signing key x', and transmits the second sketch s' and the second verification information vi' to the user ID identification device 30.

[0248] The user ID identification device 30 receives the second sketch s' and the second verification information vi' transmitted from the terminal 20, and for the N sets of first sketches s and first verification information vi pre-registered in the storage unit (DB), it determines the difference key Δ[k] (=Rec(s[k],s') obtained from the k-th set of first sketches s[k] and second sketches s', and then determines the first verification information vi[k] and second verification information vi' of the k-th set. vi[k]=h(Δ[k])*vi' …(92) If the following relationship is satisfied, the ID[k] of the k-th pair is identified as the user ID of the user of the second biometric information w'.

[0249] The user ID identification device 30 may use the first sketch s[k] (=Enc(x[k])+w[k])(k={1,..,N}), the second sketch s', and the difference key Δ[k] to calculate the Euclidean distance d(w[k], w')(L2 norm) as the distance between the first biometric information w[k] and the second biometric information w' according to equations (80) and (81) above, determine whether the Euclidean distance d(w[k], w')(L2 norm) is less than or equal to a predetermined threshold, and confirm the identity (that the biometric information belongs to the same user) of the first biometric information w[k] and the second biometric information w' used to generate the first sketch s[k].

[0250] In a configuration where terminal 20 includes the biometric signature generation device 120 shown in Figure 2, message m may be a predetermined certificate for a wallet identified by the user ID. In this case, terminal 20 may generate a signature σ for message m and send the signature σ and message m together with the user ID to the verification device 140 shown in Figure 2. Alternatively, although not particularly limited, it may be a challenge (e.g., a random number) sent from the user ID identification device 30 to terminal 20. In this case, terminal 20 may generate a biometric signature for the challenge and send it together with the user ID to the verification device 40, where the verification device 40 verifies the signature, and if the verification is successful (accepted), notify the user ID identification device 30. Alternatively, in a configuration where the first verification information vi stored in the user ID identification device 30 together with the first sketch s is the verification key vk corresponding to the first signing key x, the terminal 20 may generate a biometric signature for the challenge and send it to the user ID identification device 30, and the user ID identification device 30 may verify the signature with the k-th verification key vk[k] that is pre-registered in the storage unit (DB). In this case, if the signature verification is successful (accepted), the user ID identification device 30 may send the user ID to the certificate management device 50. The user ID may be sent from the terminal 10 to the user ID identification device 30 together with the first sketch s and the first verification information vi when the terminal 10 registers the first sketch and the first verification information to the user ID identification device 30, or the user ID used when user 60 logs in to the user ID identification device 30 from the terminal 10 may be used.

[0251] The certificate management device 50 receives the user ID transmitted from the user ID identification device 30 and identifies the user 60's wallet from the user ID. The certificate management device 50 stores the user 60's wallet (an electronic wallet, also called a virtual wallet) in its storage unit, associating it with the user ID. Although not particularly limited, here the user ID is assumed to be common to both the certificate management device 50 and the user ID identification device 30. If the user ID differs between the certificate management device 50 and the user ID identification device 30, the user ID in the user ID identification device 30 may be converted to the user ID in the certificate management device 50 using a conversion table or the like before identifying the user 60's wallet.

[0252] The user's wallet (virtual wallet) stored and managed by the certificate management device 50 can store one or more certificates of user 60. Of course, there may be times when there are no certificates in the wallet. In user 60's wallet, certificates may be stored corresponding to service IDs. User 60's wallet may be associated with a folder (directory) under a user-specific folder (directory) in the storage unit, and the certificates in the wallet may be associated with electronic files in the said wallet folder (directory). In other words, the data structure in the storage unit of the certificate management device 50 may be configured such that one or more certificate entries are placed under the wallet entry corresponding to the user ID.

[0253] The certificate management device 50 selects a certificate from among the one or more certificates stored in the user's wallet that corresponds to the ID (SID) of the service the user wishes to receive. This selection may be performed, for example, by the certificate management device 50 displaying one or more certificates (the services corresponding to one or more certificates) stored in the user's wallet on the screen of the terminal 20, and then sending the ID of the service selected by the user 60 on the screen of the terminal 20 to the certificate management device 50.

[0254] The certificate management device 50 may store one or more sketches (first sketches) s in a storage unit (not shown) corresponding to the IDs (SIDs) of one or more services provided to the user. The certificate management device 50 may also store one or more verification keys vk in a storage unit (not shown) corresponding to the IDs (SIDs) of one or more services provided to the user. That is, the certificate management device 50 may be configured to store s (SID) as a sketch (first sketch) and vk (SID) (SID: 1, ..., n, where n is an integer of 1 or more) as a verification key for each user ID.

[0255] The certificate management device 50 may obtain a first sketch s (SID) corresponding to the service ID (SID) corresponding to the service received by the user, obtain second biometric information w' from the terminal 20, and generate a signature σ for certificate m (SID) from the first sketch s (SID) and the second biometric information w'. σ←Sign(w', s(SID), m(SID)) …(93)

[0256] The above function Sign takes w', s(SID), and m(SID) as inputs (arguments), and performs calculations within the Sign function. Dec(s-w')=Dec(Enc(x)+w-w') …(94) Therefore, if the difference between the first biometric information w and the second biometric information w' is within the correction range, Dec(s-w')=x (the return value of the Sign function is σ, the value of Dec(s-w') is not output from the Sign function, and x is not leaked), and a signature σ equivalent to the signature generated using the first signing key x is generated for message m (SID).

[0257] Alternatively, the certificate management device 50 may reconstruct the differential key Δ from the difference between the first sketch s and the second sketch s', use the differential key Δ to generate a first distributed signature for certificate m(SID), and the terminal 20 may generate a second distributed signature for certificate m(SID) using the second signing key x', and then combine the first and second distributed signatures to generate a signature for certificate m(SID). Alternatively, a list of multiple certificates m and service IDs pre-registered in the wallet may be displayed on the terminal 20, and the user 60 may select the certificate m(SID) corresponding to the service ID (SID) selected on the terminal 20.

[0258] The certificate management device 50 sends the certificate m(SID) (signed certificate) with the signature σ attached, and the verification key vk(SID), which is the public key used to verify the signature σ, to the verification device 40. Alternatively, the signature σ, certificate m(SID), and verification key vk(SID) may be sent separately.

[0259] The verification device 40 uses the verification key vk (SID) to verify whether the certificate m (SID) and signature σ pair is correct. The verification device 40 sends the signature verification result to the terminal 20.

[0260] If the signature verification result is OK, terminal 20 provides user 60 with a service corresponding to the verified certificate. Terminal 20 provides a service corresponding to the verified user's wallet certificate, such as issuing tickets, points, or coupons.

[0261] Figure 9 schematically shows an example of a screen (terminal screen) 20A displayed on terminal 20. The user ID identification device 30 determines the k-th ID[k] as the user ID if the relationship vi[k]=h(Δ[k])*vi' is satisfied for the k-th first sketch s[k] and the first verification information vi[k] that have been registered in advance. The certificate management device 50 automatically selects the certificate for the service ID corresponding to the user ID. In this case, the user does not need to select a certificate on terminal 20. For example, if the user ID of the user is obtained through user authentication using vein authentication, the device may automatically select the certificate corresponding to the user ID and generate a signature for the certificate using the vein information used in biometric authentication. The verification device verifies the signature using the verification key, and if the verification result is successful (accepted), it provides a service (e.g., payment service) on terminal 20.

[0262] (Step 1) Terminal 10 acquires biometric information for biometric authentication (e.g., facial features), generates a signature key and verification key pair, and pre-registers the first sketch and first verification information generated from the biometric information and signature key with the user ID identification device 30. Furthermore, user information may be pre-registered with the user ID identification device 30.

[0263] Terminal 10 acquires biometric information for signature generation (e.g., finger vein), generates multiple pairs of signing and verification keys, and sends n pairs (s1, vk1) ~ (sn, vkn) (where n is an integer greater than or equal to 1) of sketches (generated from the same biometric information and signing key for signature generation) and verification keys corresponding to the signing keys to the certificate management device 50 for pre-configuration. Through the pre-registration process at Terminal 10, User 60 has already configured the correspondence between the user's wallet, services, and auxiliary keys at Terminal 10, and User 60 can enjoy services (such as purchasing tickets, adding purchased tickets to the n wallet) without doing anything other than scanning their biometric information at Terminal 20 (the facility's terminal).

[0264] (Step 2) User 60 obtains a user ID from the user ID identification device 30 by holding their face up to the camera of terminal 20.

[0265] (Step 3) The certificate management device 50 searches its storage device (service database 31) using the user ID output from the user ID identification device 30, and selects the certificate 502 stored in the wallet 501 corresponding to the user ID (the certificate corresponding to the user ID is automatically selected from the user ID). In Figure 9, the certificate 502 retrieved (selected) from the wallet 501 in the certificate management device 50 is schematically shown on the terminal screen 20A.

[0266] (Step 4) The sketch management unit 51 of the certificate management device 50 selects a sketch that corresponds to the service (service ID: SID) provided by the certificate 502 selected in Step 3.

[0267] (Step 5) The certificate management device 50 generates a signature 503 for the certificate using the second biometric information w' (e.g., vein information) for generating the user's signature (distributed signature) obtained from the terminal 20 and the sketch selected in step 4, and attaches it to the certificate 502.

[0268] (Step 6) The certificate management device 50 obtains the verification key 504 (vk[SID]) corresponding to the service ID from the user's verification keys, and sends the certificate 502, signature 503, and verification key 504 to the terminal 20.

[0269] (Step 7) The terminal 20 verifies the signature 503 on the certificate 502 using the verification key 504. If the verification is successful, it provides the user with a service corresponding to the service ID (for example, a procedure to purchase an airline boarding pass, a procedure to purchase a ticket, or a procedure to make a hotel reservation). If the verification fails (rejected), the service is not provided. In Figure 9, the terminal screen 20A shows the purchased ticket 505 being added to the wallet 501.

[0270] (Step 8) As a result of the service provision on terminal 20, tickets are registered, and points and coupons are awarded to the user's wallet 501 on the certificate management device 50. User 60 can use the tickets etc. issued as a result of the service provision on terminal 20 as new certificates to use for other services provided by verifying the tickets. Note that information such as electronic money card information, tickets, and coupons in the user's wallet on the certificate management device 50 may be transferred to the wallet app on the user's smartphone. Alternatively, certificates stored in the wallet app on the user's smartphone may be transferred to the user's wallet on the certificate management device 50.

[0271] The user ID identification device 30 in Figure 8 (including the user ID identification device 130 in Figure 1, etc.) can, of course, be applied to authentication services (authentication systems) in addition to electronic wallet systems. As mentioned above, when the user ID identification device 30 is implemented as an authentication device (authentication server), it receives the second biometric information w' of the user to be authenticated acquired by the terminal 20, the second sketch s' generated using the second signature key x' generated by the terminal 20, and the second verification information vi' generated based on the second signature key x'. For N sets of first sketches s and first verification information vi pre-registered in a storage unit (DB) not shown, the difference key Δ[k] (=Rec(s[k],s') obtained from the k-th set of first sketches s[k] and second sketches s' is used to determine the first verification information vi[k] and second verification information vi' of the k-th set. vi[k]=h(Δ[k])*vi' …(94) If the following relationship is satisfied, it may be determined that the user being authenticated is (or a candidate for) the user of the first biometric information w[k] used to generate the k-th set of first sketches s[k] which are pre-registered in a storage unit (DB) not shown. Furthermore, when determining a candidate, the user ID identification device 30 may use the first sketch s[k] (k={1,..,N}) of the k-th pair, the second sketch s' transmitted from the terminal 20, and the difference key Δ[k] to calculate the Euclidean distance d(w[k], w') (L2 norm) as the distance between the first biometric information w[k] (k={1,..,N}) and the second biometric information w' according to equations (80) and (81) above, and determine whether the Euclidean distance d(w[k], w') (L2 norm) is less than or equal to a predetermined threshold th. If d(w[k], w') is less than or equal to th, it may determine that the user of the first biometric information w[k] used to generate the first sketch s[k] and the user of the second biometric information w' are the same user (authentication) (two-step determination). On the other hand, even if the difference key Δ[k] and the k-th pair of first verification information vi[k] and second verification information vi' satisfy equation (94), if the Euclidean distance d(w[k], w') exceeds the threshold th, the user of the first biometric information w[k] and the user of the second biometric information w' may not be recognized as authentic. Note that depending on the biometric information, the Hamming distance or other distances may be used instead of the Euclidean distance.

[0272] In the authentication device (authentication server) configured with the user ID identification device 30, instead of registering biometric information in the storage unit (DB) in advance, a pair of the first sketch s and the first verification information vi sent from the terminal 10 is registered. Therefore, compared to a normal biometric authentication device that performs a 1:N match with registered biometric information, it is possible to significantly reduce the burden of preventing biometric information leakage, etc., while ensuring security. Of course, when the user ID identification device 30 is implemented as a biometric authentication device, the first verification information vi stored together with the first sketch s may be a verification key vk corresponding to the first signing key x. In this case, as mentioned above, the terminal 20 (for example, the biometric signature generation device 120 in Figure 2) may generate a signature (for example, a biometric signature) for the challenge sent from the biometric authentication device as the message m to be signed and send it to the user ID identification device 30, and the user ID identification device 30 may verify the signature with the k-th verification key vk[k] that is registered in advance in the storage unit (DB).

[0273] Figure 10 is a schematic diagram illustrating an example in which each device of the system 100 described above is implemented using computers equipped with communication functions and capable of communicating with each other via a network. Referring to Figure 10(A), the devices in Figure 2 (110, 120, 130, 140) may be configured to include a processor 201 (multiple processors are possible), a storage device 202, an input / output device 203, and a communication interface 204. The storage device 202 may be configured to include semiconductor storage such as RAM (Random Access Memory), ROM (Read Only Memory), or EEPROM (Electrically Erasable and Programmable ROM), or an HDD (Hard Disk Drive), CD (Compact Disc), DVD (Digital Versatile Disc), etc. The processor 201 realizes the processing and functions of each device by executing a program (not shown) stored in the storage device 202. The input / output device 203 may be configured to include a keyboard and a display. In the biometric key generation device 110 and biometric signature generation device 120 shown in Figure 2, the input / output device 203 may be configured to include a sensor for acquiring biometric information. In this case, the sensor may be an image sensor (camera) if the biometric information is a face, iris, etc., a fingerprint sensor if it is a fingerprint, or, if it is a finger (palm) vein sensor, it may be, for example, an LED (Light Emitting Diode) that emits near-infrared light and a near-infrared camera that captures the light transmitted through the finger (palm). The sensor may also be a removable sensor, such as a USB (Universal Serial Bus) device. The communication interface 204 may be configured to include a network interface card or transceiver, and to communicate with each other via a LAN (Local Area Network), WAN (Wide Area Network) such as the Internet, wireless LAN, mobile communication network, etc. The communication interface 204 may also be configured to communicate with an external sensor (for example, a Bluetooth® connected sensor) and to have an interface for receiving biometric information acquired by the external sensor.

[0274] Figure 10(B) schematically illustrates an example in which one or more of the devices 110, 120, 130, and 140 of the signature system 100 described above (for example, the user ID identification device 130 and the verification device 140) are implemented as virtual machines using server virtualization technology. Multiple virtual machines (VMs) VM303 run on a virtualization infrastructure 302 such as a hypervisor implemented on the physical server machine 301. One or more of the devices (110, 120, 130, and 140) of the signature system 100 may be implemented as virtual machines VM303. Although physically it is a single server, a virtual server environment in which multiple servers are running is provided. Preferably, each virtual machine VM is configured to operate in an isolated environment in memory space. In this case, a program that implements one of the processes of the devices (110, 120, 130, and 140) runs on the virtual operating system (OS) of the virtual machine VM. A virtual machine VM303 that virtually implements one of the devices may be configured to communicate with other virtual machines via a virtual network, or it may be configured to communicate with other devices (110, 120, 130, 140) via a LAN, the Internet, or other WAN through the physical interface (communication interface) of the physical machine 301. In this case, multiple virtual machines VM303 do not need to run on the same physical machine; they may be configured to communicate with virtual machines VM running on other physical machines.

[0275] The above-described embodiment is further noted as follows.

[0276] (Note 1) Each includes at least a first to third device, each equipped with at least a processor and a communication interface. The first apparatus described above, A first sketch is generated using the user's first biometric information and first signing key. Based on the first signing key, first verification information is generated, The first sketch and the first verification information are transmitted to the third device. The second apparatus described above is A second sketch is generated using the user's second biometric information and second signing key. Based on the second signing key, a second verification information is generated. The second sketch and the second verification information are transmitted to the third device. The third device includes a storage unit that stores one or more sets of the first sketch and first verification information transmitted from one or more of the first devices, Upon receiving the second sketch and the second verification information, the first sketch and the first verification information stored in the storage unit are treated as follows: The difference key is recovered from the first sketch and the second sketch. A signature system that identifies an ID (identification information) corresponding to a pair of the first sketch and the first verification information, where predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, as a user ID.

[0277] (Note 2) In the signature system of Note 1, the first device generates the first verification information by applying the homomorphic one-way function to the first signature key, and the second device generates the second verification information by applying the homomorphic one-way function to the second signature key.

[0278] (Note 3) In the signature system of Note 2, the third device and the set of the first sketch and the first verification information stored in the storage unit are subject to the predetermined conditions: It is determined whether an additive homomorphism relationship holds between the result of the operation between the value obtained by applying the homomorphic one-way function to the difference key and the second verification information, which is the value obtained by applying the homomorphic one-way function to the second signing key, and the first verification information, which is the value obtained by applying the homomorphic one-way function to the first signing key.

[0279] (Note 4) In any of the signature systems described in Notes 1 to 3, The third device transmits the identified user ID to the second device. The second device generates a signature for the message to be signed using the second biometric information.

[0280] (Note 5) In any of the signature systems described in Notes 1 to 4, a fourth device is provided that stores and maintains a verification key for each user and performs signature verification. The second device transmits the user ID, the signature, and the message to the fourth device. The fourth device verifies the signature to the message using the verification key corresponding to the user ID.

[0281] (Note 6) In any of the signature systems described in Notes 1 to 5, the second device and the third device communicate with each other according to the signature generation protocol, generate a distributed signature using the second signing key and the difference key, and synthesize the distributed signatures to generate a signature equivalent to the signature generated for the message using the first signing key.

[0282] (Note 7) In any of the signature systems described in Notes 1 to 5, the second device generates the second signing key and the second verification key, generates a signature for the message using the second signing key, and transmits the signature, the second verification key, and the second sketch to the fourth device. The first device transmits the verification key and the first sketch to the third device. The fourth device verifies the signature using the second verification key, generates a differential key from the first sketch and the second sketch, and verifies whether the verification key corresponding to the user ID, the second verification key, and the differential key are in a predetermined relationship.

[0283] (Note 8) In any of the signature systems described in Notes 1 to 7, the third device calculates the distance between the first biometric information and the second biometric information from the difference between the first sketch and the second sketch and the difference key, and verifies whether the distance is within a predetermined threshold.

[0284] (Note 9) In any of the signature systems described in Notes 1 to 7, the third device has the first sketch and the first verification information set up as a single record in the storage unit, and the row number in the storage unit of the record containing the first sketch and the first verification information set up to satisfy the predetermined conditions is set as the user ID, or the value of the user ID field in the record is set as the user ID.

[0285] (Note 10) The first device transmits to the third device a first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key. The second device transmits to the third device a second sketch generated using the user's second biometric information and second signing key, and second verification information generated based on the second signing key. The third device, Multiple sets of the first sketch and first verification information transmitted from one or more of the first devices are stored and maintained. Upon receiving the second sketch and the second verification information, the first sketch and the first verification information stored in the storage unit are treated as follows: The difference key is recovered from the first sketch and the second sketch. A signing method for identifying an ID (identification information) corresponding to a pair of the first sketch and the first verification information, where predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, as a user ID.

[0286] (Note 11) In the signing method of Note 10, the first device generates the first verification information by applying the homomorphic one-way function to the first signing key, and the second device generates the second verification information by applying the homomorphic one-way function to the second signing key.

[0287] (Note 12) In the signing method of Note 11, the third device and the set of the first sketch and the first verification information stored in the storage unit are subject to the predetermined conditions: It is determined whether an additive homomorphism relationship holds between the result of the calculation between the value obtained by applying the homomorphic one-way function to the difference key and the second verification information, which is the value obtained by applying the homomorphic one-way function to the second signing key, and the first verification information, which is the value obtained by applying the homomorphic one-way function to the first signing key.

[0288] (Note 13) In any of the signing methods described in Notes 10 to 12, the third device transmits the identified user ID to the second device. The second device generates a signature for the message to be signed using the second biometric information.

[0289] (Note 14) In any of the signing methods described in Notes 10 to 12, the second device transmits the user ID, the signature, and the message to the fourth device which verifies the signature. The fourth device verifies the signature to the message using the verification key corresponding to the user ID.

[0290] (Note 15) In the method of signing in Note 13, The second device and the third device communicate with each other, generate a distributed signature using the second signing key and the difference key, and synthesize the distributed signature to generate a signature equivalent to the signature generated for the message using the first signing key.

[0291] (Note 16) In the signing method of Note 13, the second device generates the second signing key and the second verification key, generates a signature for the message using the second signing key, and transmits the signature, the second verification key, and the second sketch to the fourth device. The first device transmits the verification key and the first sketch to the third device. The fourth device verifies the signature using the second verification key, generates a differential key from the first sketch and the second sketch, and verifies whether the verification key corresponding to the user ID, the second verification key, and the differential key are in a predetermined relationship.

[0292] (Note 17) In any of the signature methods described in Notes 10 to 14, the third device calculates the distance between the first biometric information and the second biometric information from the difference between the first sketch and the second sketch and the difference key, and verifies whether the distance is within a predetermined threshold.

[0293] (Note 18) In any of the signing methods described in Notes 10 to 12, the third device is configured such that the set of the first sketch and the first verification information is registered as a single record in the storage unit, and the row number in the storage unit of the record containing the set of the first sketch and the first verification information that satisfies the predetermined conditions is used as the user ID, or the value of the user ID field in the record is used as the user ID.

[0294] (Note 19) A first sketch is generated using the user's first biometric information and first signing key. Based on the first signing key, first verification information is generated, The first sketch and the first verification information are transmitted to the third processing unit. A program that causes the first processing unit to execute the process, A second sketch is generated using the user's second biometric information and second signing key. Based on the second signing key, a second verification information is generated. The second sketch and the second verification information are transmitted to the third processing unit. A program that causes a second processing unit to execute the processing, A process of storing one or more sets of the first sketch and the first verification information transmitted from one or more of the first processing units in a storage unit, Upon receiving the second sketch and the second verification information, the first sketch and the first verification information stored in the storage unit are treated as follows: The difference key is recovered from the first sketch and the second sketch. The ID (identification information) corresponding to the pair of the first sketch and the first verification information, for which predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, is identified as the user ID. A program that causes the third processing unit to execute the process, A recording medium that stores data.

[0295] (Note 20) A first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key are received from one or more first devices, and the pair of the first sketch and the first verification information is registered in the storage unit. Upon receiving a second sketch generated using the user's second biometric information and a second signing key, and second verification information generated based on the second signing key, the system applies the following to the set of the first sketch and the first verification information stored in the memory unit: The difference key is recovered from the first sketch and the second sketch. A user ID identification device that identifies an ID (identification information) corresponding to a pair of the first sketch and the first verification information, where predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, as a user ID.

[0296] (Note 21) A process of receiving a first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key, from one or more first devices, and registering the pair of the first sketch and the first verification information in the storage unit, A process for receiving a second sketch generated using the user's second biometric information and second signing key, and second verification information generated based on the second signing key, With respect to the set of the first sketch and the first verification information stored in the memory unit, The difference key is recovered from the first sketch and the second sketch. A process to identify the ID (identification information) corresponding to the pair of the first sketch and the first verification information, where predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, as the user ID. A program that causes a computer to execute something.

[0297] (Note 23) The system receives a first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key, from one or more first devices, and registers the pair of the first sketch and the first verification information as registered information in the storage unit. Upon receiving a second sketch generated using the second biometric information and second signing key of the user to be authenticated, and second verification information generated based on the second signing key, the system applies the first sketch and first verification information set up in the storage unit to the first sketch and first verification information set up in the storage unit. The difference key is recovered from the first sketch and the second sketch. An authentication device that verifies whether predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, and if the predetermined conditions are met, authenticates the user to be authenticated as the user of the first biometric information used to generate the first sketch.

[0298] (Note 24) A process of receiving a first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key, from one or more first devices, and registering the pair of the first sketch and the first verification information as registration information in the storage unit, A process for receiving a second sketch generated using the second biometric information and second signing key of the user to be authenticated, and second verification information generated based on the second signing key, With respect to the set of the first sketch and the first verification information stored in the memory unit, The difference key is recovered from the first sketch and the second sketch. The process involves verifying whether predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, and if the predetermined conditions are met, the user to be authenticated is authenticated as the user whose first biometric information was used to generate the first sketch. A program that causes a computer to execute something.

[0299] [Reference document 1] Patent No. 7215559 [Reference 2] Japanese Patent Publication No. 2021-087167 [Reference 3] Nicolosi, Antonio, et al. "Proactive Two-Party Signatures for User Authentication." NDSS. 2003. [Reference 4] Lindell, Yehuda. "Fast secure two-party ECDSA signing." Advances in Cryptology-CRYPTO 2017: 37th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 20-24, 2017, Proceedings, Part II 37. Springer International Publishing, 2017 [Reference document 5] Patent No. 5707311 [Reference 6] Japanese Patent Publication No. 2022-172069 [Reference 7] Derler, David / Slamanig, Daniel. "Key-homomorphic signatures: definitions and applications to multiparty signatures and non-interactive zero-knowledge." Designs, Codes and Cryptography, Vol. 87.

[0300] Furthermore, the disclosures in the aforementioned patent documents and references are incorporated herein by reference. Within the scope of the disclosure of this application (including the claims), further modifications, adjustments, and combinations of embodiments or examples are possible based on the fundamental technical concept. Also, within the scope of the claims of this invention, various combinations or selections of various disclosed elements (including each element in each appendix, each element in each embodiment, each element in each drawing, etc.) are possible. In other words, this disclosure naturally includes the entire disclosure, including the claims, and various modifications and alterations that a person skilled in the art could make in accordance with the technical concept. [Explanation of Symbols]

[0301] 10 devices 20 devices 20A Terminal screen 30. User ID Identification Device 31 Service Database 40 Verification device 50 Certificate Management Device 51 Sketch Management Department 60 users 100 Signature Systems 101 Wallet System 110. Bio-based key generation device 111 First biological information acquisition unit 112 Key pair generation unit 113 First Sketch Generation Unit 114 First Verification Information Generation Unit 115 Verification Key Transmission Unit 116 First Sketch Transmission Unit 117 First Verification Information Transmission Unit 118 Verification Key Configuration Section 120 Biometric Signature Generation Device 121 Second biological information acquisition unit 122 Key generation section 122A Key pair generation unit 123A Second sketch generation unit 123B Second Sketch Transmission Section 124A Second Verification Information Generation Unit 124B Second Verification Information Transmission Unit 125 Message Acquisition Unit 126 Signature generation section 127 User ID Receiving Unit 128 User ID, Signature, and Message Sending Section 129 Signature component 130 User ID Identification Device 131A First sketch acquisition unit 131B First Sketch Memory Unit 132A First Verification Information Acquisition Unit 132B First Verification Information Storage Unit 133 Second Sketch Acquisition Unit 134 Second Verification Information Acquisition Unit 135 Differential key generation unit 136 Difference Key Verification Unit 137 Signature generation section 138 User ID transmission section 139 Euclidean distance verification section 140 Verification device 141A Verification Key Acquisition Unit 141B Verification Key Storage Unit 142 User ID, Signature, and Message Acquisition Unit 143 Signature Verification Department 144 Difference Key Pair Verification Unit 200 Computers 201 Processor 202 Storage device 203 Input / Output Devices 204 Communication Interface 300 servers 301 Physical Machines 302 Virtualization Infrastructure 303 Virtual Machines 501 Wallet 502 certificate 503 signatures 504 Verification Key 505 tickets< / g>

Claims

1. It includes at least a first device, a second device, and a third device, each of which is equipped with at least a processor and a communication interface, The first apparatus is A first sketch is generated using the user's first biometric information and first signing key. Based on the first signing key, first verification information is generated. The first sketch and the first verification information are transmitted to the third device. The second apparatus described above is A second sketch is generated using the user's second biometric information and second signing key. Based on the second signing key, a second verification information is generated. The second sketch and the second verification information are transmitted to the third device. The third device described above is The system includes a storage unit that stores one or more sets of the first sketch and the first verification information transmitted from one or more of the first devices, Upon receiving the second sketch and the second verification information, the first sketch and the first verification information stored in the storage unit are treated as follows: The difference key is recovered from the first sketch and the second sketch. A signature system that identifies an ID (identification information) corresponding to a pair of the first sketch and the first verification information, where predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, as a user ID.

2. The first device generates the first verification information by applying a homomorphic one-way function to the first signing key. The signature system according to claim 1, wherein the second device generates the second verification information by applying the homomorphic one-way function to the second signing key.

3. The third device applies the following predetermined conditions to the set of the first sketch and the first verification information stored in the storage unit: The signature system according to claim 2, which determines whether an additive homomorphism relationship exists between the result of an operation between the value obtained by applying the homomorphic one-way function to the difference key and the second verification information obtained by applying the homomorphic one-way function to the second signature key and the first verification information obtained by applying the homomorphic one-way function to the first signature key.

4. The third device transmits the identified user ID to the second device. The signature system according to claim 1, wherein the second device generates a signature for the message to be signed using the second biometric information.

5. It includes a fourth device that stores and maintains a verification key for each user and performs signature verification. The second device transmits the user ID, signature, and message to the fourth device. The signature system according to claim 1, wherein the fourth device verifies the signature to the message using the verification key corresponding to the user ID.

6. The signature system according to claim 4, wherein the second device and the third device communicate with each other, generate a distributed signature using the second signing key and the difference key, and synthesize the distributed signature to generate a signature equivalent to the signature generated for the message using the first signing key.

7. The second device generates the second signing key and the second verification key, generates a signature for the message using the second signing key, and transmits the signature, the second verification key, and the second sketch to the fourth device. The first device transmits the verification key and the first sketch to the third device. The signature system according to claim 5, wherein the fourth device verifies the signature using the second verification key, further generates a differential key from the first sketch and the second sketch, and verifies whether the verification key corresponding to the user ID, the second verification key, and the differential key are in a predetermined relationship.

8. The signature system according to claim 1, wherein the third device determines the distance between the first biometric information and the second biometric information from the difference between the first sketch and the second sketch and the difference key, and verifies whether the distance is within a predetermined threshold.

9. The signature system according to claim 2, wherein in the third device, the set of the first sketch and the first verification information is registered as a record in the storage unit, and the line number in the storage unit of the record containing the set of the first sketch and the first verification information that satisfies the predetermined conditions is set as the user ID, or the value of the user ID field in the record is set as the user ID.

10. The first device transmits to the third device a first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key. The second device transmits to the third device a second sketch generated using the user's second biometric information and second signing key, and second verification information generated based on the second signing key. The third device described above is Multiple sets of the first sketch and the first verification information transmitted from one or more of the first devices are stored in the storage unit. Upon receiving the second sketch and the second verification information, the first sketch and the first verification information stored in the memory unit are treated as follows: The difference key is recovered from the first sketch and the second sketch. A signing method for identifying an ID (identification information) corresponding to a pair of the first sketch and the first verification information, where predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, as a user ID.

11. The first device generates the first verification information by applying a homomorphic one-way function to the first signing key. The signature method according to claim 10, wherein the second device generates the second verification information by applying the homomorphic one-way function to the second signing key.

12. The third device described above is The third device applies the following predetermined conditions to the set of the first sketch and the first verification information stored in the storage unit: The signature method according to claim 11, which determines whether an additive homomorphism relationship exists between the result of an operation between the value obtained by applying the homomorphic one-way function to the difference key and the second verification information obtained by applying the homomorphic one-way function to the second signing key and the first verification information obtained by applying the homomorphic one-way function to the first signing key.

13. The third device transmits the identified user ID to the second device. The signature method according to claim 10, wherein the second device generates a signature for the message to be signed using the second biometric information.

14. The second device transmits the user ID, the signature, and the message to the fourth device which verifies the signature. The signature method according to claim 10, wherein the fourth device verifies the signature to the message using a verification key corresponding to the user ID.

15. The signature method according to claim 13, wherein the second device and the third device communicate with each other, generate a distributed signature using the second signing key and the difference key, and synthesize the distributed signature to generate a signature equivalent to the signature generated for the message using the first signing key.

16. The second device generates the second signing key and the second verification key, generates a signature for the message using the second signing key, and transmits the signature, the second verification key, and the second sketch to the fourth device. The first device transmits the verification key and the first sketch to the third device. The signature method according to claim 14, wherein the fourth device verifies the signature using the second verification key, generates a differential key from the first sketch and the second sketch, and verifies whether the verification key corresponding to the user ID, the second verification key, and the differential key are in a predetermined relationship.

17. The signature method according to claim 10, wherein the third device determines the distance between the first biometric information and the second biometric information from the difference between the first sketch and the second sketch and the difference key, and verifies whether the distance is within a predetermined threshold.

18. A first sketch is generated using the user's first biometric information and the first signing key. Based on the first signing key, first verification information is generated. The first sketch and the first verification information are transmitted to the third processing unit. A program that causes the first processing unit to execute the process, A second sketch is generated using the user's second biometric information and second signing key. Based on the second signing key, a second verification information is generated. The second sketch and the second verification information are transmitted to the third processing unit. A program that causes a second processing unit to execute the processing, A process of storing one or more sets of the first sketch and the first verification information transmitted from one or more of the first processing units in a storage unit, Upon receiving the second sketch and the second verification information, the first sketch and the first verification information stored in the storage unit are treated as follows: The difference key is recovered from the first sketch and the second sketch. The ID (identification information) corresponding to the pair of the first sketch and the first verification information, for which predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, is identified as the user ID. A program that causes the third processing unit to execute the process, A recording medium that stores data.

19. The system receives a first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key, and registers the pair of the first sketch and the first verification information in the storage unit. Upon receiving a second sketch generated using the user's second biometric information and a second signing key, and second verification information generated based on the second signing key, the system applies the following to the set of the first sketch and the first verification information stored in the memory unit: The difference key is recovered from the first sketch and the second sketch. A user ID identification device that identifies an ID (identification information) corresponding to a pair of the first sketch and the first verification information, where predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, as a user ID.

20. The system receives a first sketch generated using the user's first biometric information and a first signing key, and first verification information generated based on the first signing key, from one or more first devices, and registers the pair of the first sketch and the first verification information as registered information in the storage unit. Upon receiving a second sketch generated using the second biometric information and second signing key of the user to be authenticated, and second verification information generated based on the second signing key, the system applies the first sketch and first verification information set up in the storage unit to the first sketch and first verification information set up in the storage unit. The difference key is recovered from the first sketch and the second sketch. An authentication device that verifies whether predetermined conditions are met with respect to the first verification information, the second verification information, and the difference key, and if the predetermined conditions are met, authenticates the user to be authenticated as the user of the first biometric information used to generate the first sketch.

Images