A method for verifying partially distributed identification information
By encrypting and masking biometric data scores across multiple devices, the method addresses inefficiencies in traditional verification methods, providing faster and secure verification without requiring multiple databases.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2024-02-16
- Publication Date
- 2026-03-17
AI Technical Summary
Traditional methods for verifying individual registration in a database are inefficient due to excessive execution time, particularly in decentralized systems involving parallel computations across multiple entities.
A method that calculates an encryption of the score representing the distance between personal-related test and reference biometric data using a primary encryption key, followed by a decentralized decryption and masking process across multiple devices, ensuring the score remains encrypted and masked, thus reducing execution time.
The proposed method achieves faster verification results compared to centralized methods by leveraging distributed computing without plaintext calculation, while allowing reference biometric data to be stored in a single database.
Smart Images
Figure 2026509193000001_ABST
Abstract
Description
[Technical Field]
[0001] This disclosure relates to a method for verifying identification information. [Background technology]
[0002] Traditional methods for verifying whether an individual is registered in a database involve the following steps: Test biometric data related to the individual being verified is obtained. Next, a score is calculated representing the distance between the test biometric data and the reference biometric data contained in the database. Then, this score is compared to a threshold. At the end of this comparison, a verification result is obtained indicating whether the test biometric data matches the reference biometric data.
[0003] A document titled "Colmade: Collaborative Masking in Auditable Decryption for BFV-based Homomorphic Encryption" describes a method using this general principle, but with the following characteristics: First, the Colmade method calculates a score and compares that score to a threshold within the cryptographic domain. Second, the Colmade method involves centralized steps and steps distributed across multiple entities, where these entities perform parallel computations that yield partial results, and these partial results must be recombined to arrive at a confirmation.
[0004] However, the execution time of the Colmade method is long. [Overview of the Initiative]
[0005] The objective of this invention is to verify whether an individual is registered in a database in a secure manner without requiring excessive execution time.
[0006] This objective is achieved through the following steps, · A step of calculating an encryption of a score representing the distance between personal-related test biometric data and reference biometric data, the encryption of the score having been previously calculated from the encryption of the test biometric data and the reference biometric data, the encryption of the reference biometric data resulting from an encryption of the reference biometric data using a primary encryption key, the step of calculating; · When i is equal to 1 and 2, the following steps by the device of index i, namely · A step of applying a decryption and masking process to the encryption of the score using the secondary decryption key of index i and the secondary mask of index i, the decryption and masking process resulting in data representing the score in a form decrypted and masked by a primary mask without calculating the score in plaintext, the step of applying; · A step of generating a partial result of index i from the unmasking data of index i related to the data and the secondary mask of index i executing the step of is achieved by a method including · Here · The devices of each index 1 and 2 are different, · The secondary decryption keys of each index 1 and 2 are derived from a primary decryption key related to an encryption key, · The secondary masks of each index 1 and 2 are derived from a primary mask.
[0007] In the proposed method, the step of calculating the encryption of the score constitutes a centralized step that is executed much faster than the centralized step executed by the Colmade method. The present inventors have recognized that using this centralized step combined with processing distributed to at least a pair of participating devices, a confirmation result can be obtained more quickly than the Colmade method with equivalent computing resources. Specifically, since the score in plaintext is not calculated, the masking performed provides security.
[0008] Another advantage of the proposed method is that the method can be implemented within a system where reference biometric data is stored in a single database. This is an advantage over methods that require the joint use of multiple different databases.
[0009] The proposed method may also include the following features, which can be incorporated alone or in combination where possible.
[0010] Preferably, the decoding and masking processes performed by the device of index i are the following steps, namely · The following data, namely · The first part of the score cipher, · The secondary decryption key of index i, · The secondary mask of index i, · A random quantity generated by the device of index i to calculate the intermediate data of index i, and · Receiving the intermediate data of index j transmitted by the device of index j≠i, and · The secondary decryption key of index i <sk> i Decrypted using the following data, namely • Intermediate data for each index 1 and 2, • The second part of the score's code The steps include: calculating data that represents the score in a format masked by a mask; and Includes.
[0011] Preferably, the intermediate data of index i
number
number
number
[0012] Preferably, the secondary decryption key of index i <sk> i The data representing the score in the form decrypted using and masked using a primary mask is calculated as follows:
number
number
number
[0013] Preferably, the verification result is equal to the sum of the partial results for indices 1 and 2.
[0014] Preferably, at least one of the following data is single-use data for test biometric data, and further for score encryption: • Secondary mask of index i, • Unmasked data for index i, • The secondary decryption key for index i.
[0015] Preferably, the calculation of the score's cryptographic value is a linear or polynomial calculation.
[0016] Preferably • Cryptographic calculations are performed by a server different from the devices at index 1 and 2, and / or The output results are calculated from the partial results of indices 1 and 2 by output devices different from those used for indices 1 and 2.
[0017] We also propose a computer program product that includes program code instructions for performing the steps of the proposed method when executed by a device or a set of devices. We also propose a computer-readable memory that stores instructions executable by the device for performing the steps of the proposed method.
[0018] A server configured to compute an encryption of a score representing the distance between test biometric data and reference biometric data related to an individual, wherein the encryption of the score is previously computed from the encryption of the test biometric data and the reference biometric data, and the encryption of the reference biometric data results from the encryption of the reference biometric data using a primary encryption key, and the server and • There are two devices, each with index 1 and index 2, and when i is equal to 1 and 2, the device with index i Applying a decryption and masking process to the cipher of the score using the secondary decryption key and secondary mask of index i, wherein the decryption and masking process yields data representing the score in a form that is decrypted and masked by the primary mask without calculating the score in plaintext. - Generate a partial result of index i from the data and the unmasked data of index i related to the secondary mask of index i. Two devices configured to perform the following: We also proposed a system that includes this, Here The secondary decryption keys for indices 1 and 2 are derived from the primary decryption key associated with the encryption key. The secondary masks for indices 1 and 2 are derived from the primary mask. The partial results for indices 1 and 2 can be used to calculate confirmation results indicating whether the test biometric data matches the reference biometric data.
[0019] Further features, purposes, and advantages of the present invention will become apparent from the following description, which is purely illustrative and non-limiting and should be read with reference to the accompanying drawings. [Brief explanation of the drawing]
[0020] [Figure 1] Various devices forming part of a system according to one embodiment, which can be used to verify personal identification information, are schematically shown. [Figure 2] Various devices forming part of a system according to one embodiment, which can be used to verify personal identification information, are schematically shown. [Figure 3] This is a flowchart of the steps for a method to verify identification information according to one embodiment.
[0021] In all of these drawings, similar elements are specified by the same reference. [Modes for carrying out the invention]
[0022] Detailed description of the invention A system for verifying personal identification information. Referring to Figures 1 and 2, the system includes a control unit 1, a storage server 2, at least one pair of participating devices 3, a trusted server 4, and a registration device 6.
[0023] The control device 1 includes a processor 10, a communication interface 12 for communicating with the storage server 2 and each participating device, a memory 14, and a biometric sensor 16.
[0024] The processor 10 is configured to perform some steps of the method described later. The processor can have any structure. The processor includes one or more cores, each core is configured to execute program code instructions to perform the steps described above.
[0025] The communication interface 12 is, for example, wireless and uses any communication protocol (Wi-Fi, Bluetooth, etc.).
[0026] Memory 14 is designed to store data manipulated or generated by the processor. Memory 14 can be of any type. Conventional memory includes volatile memory for temporarily storing data and non-volatile memory for permanently storing data, i.e., in a way that retains data when non-volatile memory is off.
[0027] The biometric sensor 16 is configured to acquire biometric data related to an individual. For example, the biometric sensor includes a camera configured to acquire an image showing the individual's face and to extract biometric data from that image. Alternatively or additionally, the biometric sensor may include a fingerprint sensor and / or an iris sensor.
[0028] In one embodiment, the control device 1 further includes a gate 18 that can be closed to prevent an individual from accessing a safety area and opened to allow such access. In this case, the processor 10 is configured to control the opening and closing of the gate 18. For example, the control device 1 is located within an airport, the safety area is a boarding area, and in this specific application, the individual wishing to access the boarding area is a passenger on a flight whose identification information needs to be verified before boarding.
[0029] The storage server 2 includes a processor 20, a communication interface 22 for communicating with the control device 1, and memory 24. The information given above regarding the processor 10 and the communication interface 12 can also be applied to the processor 20 and the communication interface 22.
[0030] Memory 24 stores a biometric database containing confidential biometric data. Biometric data relating to previously registered individuals is referenced within the database. The biometric data of registered individuals is not stored in plain text within the database, but is instead protected, i.e., it is encrypted using the encryption method described below.
[0031] Each participating device 3 includes a processor 30, a communication interface 32 for communicating with the control device 1 and / or other participating devices 3, and a memory 34. The information provided above regarding the processor 10 and the communication interface 12 can also be applied to the processor 30 and the communication interface 32. The same or different protocols can be used for communication between interfaces 12 and 22, and between interfaces 12 and 32.
[0032] The participating devices 3 are all different from each other. Below, an embodiment in which the participating devices 3 are separate from the control device 1, storage server 2, registration device 4, and registration device 6 will be described in detail, as shown in Figure 1. However, in other embodiments, it may be assumed that the control device 1, storage server 2, registration device 4, and / or registration device 6 constitute one of the participating devices 3.
[0033] The function of trusted server 4 is to generate encryption keys, some of which are used by other components of the system. Trusted server 4 includes a processor 40, a communication interface 42 for communicating with registration device 6 and each participating device 3, and memory 44. The information provided above regarding processor 10, communication interface 12, and memory 14 can also be applied to processor 40, communication interface 42, and memory 44.
[0034] The registration device 6 includes a processor 60, a communication interface 62 for communicating with the reliable server 4 and the storage server 2, a memory 64, and a biometric sensor 66. The information provided above regarding the processor 10, the communication interface 12, the memory 14, and the biometric sensor 16 can also be applied to the processor 60, the interface 62, the memory 64, and the biometric sensor 66. Hereinafter, a detailed description will be given of an embodiment in which the registration device 6 is different from the control device 1. However, in other embodiments, the control device 1 can be used as the registration device.
[0035] Key generation The following steps are preliminarily executed within the system.
[0036] The processor 40 of the reliable server 4 generates an encryption key pk and a related decryption key sk, and these two keys form a pair of encryption keys, typically a pair of asymmetric keys. These keys are generated randomly, for example.
[0037] The keys pk and sk are stored in the memory 44.
[0038] The reliable server 4 transmits the encryption key pk, which is a public key, to the registration device. In contrast, the decryption key sk is a secret key unique to the reliable server 4 and is therefore not transmitted outside the reliable server 4.
[0039] s Registration Assume that the reference individual to be registered comes near the registration device 6. In practice, the reference individual can be an individual who has obtained the right to access the secure area discussed above. If the control device 1 is installed at an airport, the secure area may provide access to an aircraft, and in that case, the right to access the secure area is granted by the ticket assigned to the reference individual.
[0040] The biometric sensor 66 of the registration device 6 acquires reference biometric data y related to the reference individual u thereof.
[0041] Processor 60 processes biometric data y u The cipher
number
number
[0042] Specifically, this step can use encryption using the Brakerski / Fan-Vercauteren (BFV) method.
[0043] Cryptography
number
[0044] The storage server transmits encrypted data via its communication interface 22.
number
[0045] The above steps are repeated by the registration device 6 for multiple reference individuals to be registered, thereby the database of data contained in memory 24 stores multiple encryption keys related to different reference individuals. Each time, the same encryption key pk is used by the processor 60.
[0046] Verification of identification information Referring to Figure 3, the method performed by this system includes the following steps. When it is mentioned below that control device 1, server 2, participating device 3, or trusted server 4 performs processing, it will be understood that the processing is more specifically performed by the corresponding processors 10, 20, 30, and 40.
[0047] It is assumed that an individual whose identification information needs to be verified will come near control device 1. For example, the individual to be verified wishes to board an aircraft and arrives at the boarding gate of the airport where control device 1 is installed.
[0048] In step 102, the biometric sensor 16 acquires biometric data x related to the individual being identified. Hereafter, to distinguish it from the reference biometric data discussed above, this biometric data x will be referred to as "test biometric data," and its individual encryption codes are stored by the storage server 2.
[0049] In step 104, the control device 1 transmits test biometric data x to the server 2 via the communication interface 12.
[0050] In step 202, server 2 receives test biometric data via communication interface 22.
[0051] In step 204, Server 2 receives test biometric data x and cryptographic data.
number
number
[0052] crypto c s The calculation of is performed within the encrypted area in this step. In other words, this step does not involve calculating the score s of the plaintext. Those skilled in the art can use isomorphic encryption methods known from the prior art.
[0053] The function BFV.dist() is preferably a linear function or a polynomial function.
[0054] For example, the distance represented by the score is calculated using test biometric data x and reference biometric data y. u It is the scalar product between and . Therefore, cryptographic c s This is a scalar product cipher.
[0055] The following is the score encryption c s is data vs
number
[0056] In step 206, the storage server sends encrypted c to device 1 in response to the test biometric data x. s Send.
[0057] In step 106, the control device 1 crypts c s Receive.
[0058] In step 108, the control device 1 sends encrypted data to the trusted server 4. s Send a request related to this.
[0059] In step 110, the control device 1 sends an encrypted message c to each of the participating devices 3. s Send. Steps 108 and 110 can be performed in any order or simultaneously.
[0060] In step 402, trusted server 4 receives the request sent during step 108.
[0061] In step 404, the trusted server 4 receives two secondary decryption keys derived from the decryption key sk. <sk> 1、 <sk>Generate 2.
[0062] Furthermore, in step 406, the trusted server 4 generates a primary mask r. The primary mask r is generated by the function FSS.Setup(). The function FSS.Setup() could be, for example, the function Funshade.Setup() described in the document "Funshade: Functional Secret Sharing for Two-Party Secure Thresholded Distance Evaluation".
[0063] In step 408, the server • Two secondary masks derived from the primary mask r <r> 1、 <r>2, and • Two related unmasked data sets k1 and k2 Generates.
[0064] Steps 404 and 406 can be performed in any order. In particular, step 404 can be performed before, during, or after steps 406 and 408.
[0065] Step 410, which is performed when i is equal to 1 and 2, is performed when the trusted server 4 is connected to the participating device 3 of index i. • Secondary decryption key for index i <sk> i , • Secondary mask of index i <r> i , and • Secondary mask of index i <r> i Unmasked data k of index i related to this i It transmits.
[0066] On the other hand, any data for index 1 generated by the trusted server 4 in steps 402 and 404 is not sent to the participating device 3 of index 2, and vice versa.
[0067] If i is equal to 1 and 2, the participating device 3 of index i performs the following steps.
[0068] In step 302, the participating device 3 of index i is encrypted c s Receive.
[0069] In step 304, the participating device 3 of index i • Secondary decryption key for index i <sk> i , • Secondary mask of index i <r> i , and • Secondary mask of index i <r> i Related to index i, unmasked data k i Receive.
[0070] Steps 302 and 304 can be performed in any order depending on how the control device 1 operates.
[0071] In step 306, the participating device 3 of index i receives the cryptographic score c. s The decryption and masking process ColMaskDecr() is applied to the data. This process decrypts the data using the primary decryption key and then masks it using the mask r, representing the score.
number
number
[0072] Using the primary decryption key sk, encryption c s When the data is decrypted, the score s of the plaintext is obtained. Next, when masking is applied to the score s of the plaintext using a primary mask r, the data
number
[0073] However, the decryption and masking process ColMaskDecr() does not operate in accordance with this sequence of operations. The decryption and masking process ColMaskDecr() does not perform intermediate calculations of the plaintext score s.
number
[0074] Next, an embodiment of the decryption and masking process ColMaskDecr() that obtains this characteristic will be described in detail. In this embodiment, the score is encrypted c s is data vs
number
[0075] Participating device 3 of index i receives the following data, namely: cipher c s part
number
number
[0076] This calculation could be as follows:
number
[0077] Participating device 3 of index i is the intermediate data of index i.
number
number
[0078] Ultimately, two intermediate data
number
[0079] Participating device 3 of index i is intermediate data
number
number
number
number
number
number
number
[0080] In this embodiment, the following holds true:
number
[0081] In this equation, the sign of ≡ represents equality. Therefore, the data
number
[0082] In step 308, the participating device 3 of index i receives the data of index i and the unmasked data k. i Partial result o from index i i Calculate:
number
[0083] In step 310, the participating device 3 of index i is a partial result o i This is transmitted to the control device 1.
[0084] The processing performed by participating device 3 for index i is completed.
[0085] As shown above, the process consisting of steps 302 to 310 is executed twice in total: once by the participating device of index 1 and once by the participating device of index 2. Therefore, two partial results o1 and o2 are generated.
[0086] For the partial results o1 and o2 pairs, test biometric data x is compared with reference biometric data y. u It has properties that can be used to calculate a confirmation result o indicating whether it matches. On the other hand, it is impossible to calculate this confirmation result based on only one of the two partial results o1 and o2.
[0087] In step 112, the control device 1 receives two partial results o1 and o2, which are generated and transmitted by the two participating devices 3, respectively.
[0088] In step 114, the control device 1 calculates a confirmation result o from the two received partial results o1 and o2. As described above, the confirmation result indicates whether the test biometric data matches the reference biometric data.
[0089] In one embodiment, the verification result o is obtained by summing the partial results as follows: o = o1 + o2
[0090] Ultimately, the steps of cryptographic processing performed jointly by the two participating devices 3, and calculating the verification result o, represent a comparison of a threshold with the distance between the test biometric data and the reference biometric data. The threshold is defined within the function FSS.Setup(), which is used to generate the primary mask r, the secondary decryption key, and the unmasked data (the threshold is, so to speak, encoded by this data).
[0091] In reality, the verification result o can be a Boolean value.
[0092] If the result o indicates that the test biometric data matches the reference biometric data, the individual to whom the test biometric data x pertains is considered to have been previously registered with server 2. Under these conditions, processor 10 may open gate 18 in step 116 to allow the individual to access the secure area.
[0093] If the results indicate that the test biometric data does not match the reference biometric data, the individual in question will be subject to the reference biometric data y u They are not considered to be the reference individual involved.
[0094] The aforementioned steps (especially those performed by participating device 3) are stored by storage server 2, and different reference biometric data y1...y u ...y U This can be performed U times for different ciphers related to it. These U executions may be consecutive. Therefore, as a modified form, U processes are started in parallel, each performing steps 202 to 116 above, and the final result is shown in step 308 (therefore o i =Σ u o i,u ) or in step 114 (therefore o=Σ i Σ u o i,u ) can be aggregated.
[0095] The method described above may be subject to other modifications.
[0096] In the embodiment of the method described above, as shown in Figure 3, it should be noted that each time a score cipher is generated when step 204 is performed, a new mask, new unmasked data, and a new secondary decryption key are generated in steps 404 and 408. Thus, when i is equal to 1 and 2, the secondary mask for index i, the associated unmasked data for index i, and the associated secondary decryption key for index i constitute single-use data for a particular cipher that is computed when step 204 is performed. This embodiment is particularly robust against replay attacks.
[0097] In another embodiment, the data generated in steps 404 and 408 is single-use data for the test biometric data x, which implies that this data is reused multiple times for different referencing users referenced in the database of the storage server 2 during the verification of the identification information of the individual to which x relates. In this other embodiment, each time new test biometric data x is acquired, the control device 1 can request the trusted server 4 to generate new single-use data.
[0098] While this offers security advantages, the secondary mask for index i, the associated unmasked data for index i, and the associated secondary decryption key for index i may not be single-use data.
[0099] Furthermore, it has been assumed that the data provided by server 4 (secondary key, mask, and unmasked data) is generated after the biometric data x is received. However, this is not mandatory. In a modified form, this data can be generated during the preliminary stage when keys pk and sk are generated, and can be stored in advance in the individual memories of participating devices 3, and therefore before the biometric data x is acquired. Thus, all or part of steps 404, 406, 408, 410, and 304 can be performed before step 102 (in this case, step 108 is not performed, nor is step 402).
[0100] In one particularly advantageous embodiment, only a pair of participating devices 3 for individual indices 1 and 2 are used. The inventors observed that this embodiment is reasonably fast and safe, while also being easy to implement. However, it is also possible to use multiple pairs of participating devices to perform the method described above.
number
[0101] We have described a specific application of the identification verification method in which the verification result is a condition for accessing a secure area. However, it will be understood that the method described can be used in other applications as well.< / r> < / r> < / sk> < / r> < / r> < / sk> < / r> < / r> < / sk> < / r> < / r> < / sk> < / sk> < / sk> < / r> < / sk> < / sk>
Claims
1. • Test biometric data related to the individual (x) and reference biometric data (y) ｕ The cryptographic score representing the distance between (c ｓ A step (204) of calculating the cipher (c ｓ ) is the encryption of the test biometric data and the reference biometric data. [Math 1] The encryption of the reference biometric data is calculated from the reference biometric data (y) using the primary encryption key (pk). ｕ The computational step (204) resulting from the encryption of ) - If i is equal to 1 and 2, the device at index i performs the following steps, i.e. - Secondary decryption key for index i (<sk>) ｉ ) and the secondary mask of index i (<r> ｉ ) using the cryptographic (c ｓ Step (306) of applying a decoding and masking process to the data, wherein the decoding and masking process is performed by decoding the score without calculating the score in plain text and representing the score in a form masked by a primary mask (r). [Math 2] Step (306) to bring about the application of, - The aforementioned data [Math 3] and the secondary mask of index i (<r> ｉ ), the mask release data of index i related to (k ｉ ), from the partial result of index i (o ｉ ), step (308) of generating The steps to perform, A method including, Here The devices for indices 1 and 2 are different. - The secondary decryption keys (<sk>) for each index 1 and 2 １ , <sk> ２ ) is derived from the primary decryption key (sk) associated with the aforementioned encryption key (pk), - The secondary masks for indices 1 and 2 (<r> １ , <r> ２ ) is derived from the primary mask (r), - The aforementioned partial results for each index 1 and 2 (o １ ,o ２ ) can be used to calculate a confirmation result (o) indicating whether the test biometric data matches the reference biometric data. method.
2. The decoding and masking process performed by the device for index i is as follows: The following data, that is - The encryption of the score (c ｓ ) Part 1 [Math 4] 、 - The secondary decryption key (<sk>) of index i ｉ ), - The secondary mask of index i (<r> ｉ ), and - The random quantity (e) generated by the device at index i ｉ ) Intermediate data from index i [Math 5] The steps to calculate, - Intermediate data of index j transmitted by the device where index j ≠ i [Math 6] The step of receiving, - The secondary decryption key <sk> of index i ｉ Decrypted using the following data, namely - Intermediate data for each index 1 and 2 [Number 7] - The encryption of the score (c ｓ ) Part 2 [Number 8] The data representing the score in a form masked by the mask (r) [Number 9] The steps to calculate and The method according to claim 1, including the method described in claim 1.
3. The aforementioned intermediate data of index i [Number 10] This is calculated as follows: [Math 11] Here ・ [Math 12] The cipher (c) of the score ｓ This is the first part of the above, ・<sk> ｉ is the secondary decryption key for index i, ・<r> ｉ is the secondary mask of index i, e ｉ is the random quantity generated by the device at index i. The method according to claim 1 or 2.
4. The secondary decryption key <sk> of index i ｉ The data representing the score in a form that has been decoded using and masked using the primary mask (r) [Number 13] It is calculated as follows: [Number 14] Here ・ [Number 15] This is the aforementioned intermediate data for index 1, ・ [Number 16] This is the aforementioned intermediate data for index 2, ・c ａ The cipher (c) of the score ｓ This is the second part of the above, t and q are two integers that constitute the parameters of the Brakerski / Fan-Vercauteren encryption scheme. • [. . .] indicates the operator for rounding to the nearest integer. ・[...] ｑ This indicates the modulo q operator, ・[...] ｔ This indicates the modulo t operator. The method according to claim 2 or 3.
5. The aforementioned confirmation result (o) is the partial result (o) of each index 1 and 2. １ ,o ２ The method according to any one of claims 1 to 4, wherein the sum of the above is equal to the sum of the above.
6. The following data, namely: - The secondary mask of index i, - The unmasked data of index i, - The secondary decryption key for index i At least one of the is for the test biometric data (x), and further the cryptographic (c) of the score. ｓ The method according to any one of claims 1 to 5, wherein the data is single-use data for )
7. The encryption of the score (c ｓ The method according to any one of claims 1 to 6, wherein the calculation of ) is a linear calculation or a polynomial calculation.
8. - The aforementioned encryption (c ｓ The calculations of ) are performed by a server different from the devices of index 1 and 2, and / or - The output results are obtained by an output device different from the device for indices 1 and 2, and the partial results for indices 1 and 2 (o １ ,o ２ ) calculated from, The method according to any one of claims 1 to 7.
9. A computer program product comprising program code instructions for performing a step of the method according to any one of claims 1 to 8, when executed by a system including the respective devices of index 1 and 2.
10. A computer-readable memory for storing instructions that can be executed by a device to perform a step of the method according to any one of claims 1 to 8.
11. Test biometric data related to the individual (x) and reference biometric data (y) ｕ The cryptographic score representing the distance between (c ｓ A server (2) configured to calculate the cipher (c) of the score, wherein the cipher (c) ｓ ) is the encryption of the test biometric data and the reference biometric data. [Number 17] The encryption of the reference biometric data is calculated from the reference biometric data (y) using the primary encryption key (pk). ｕ ) resulting from encryption, server (2) and - Two devices (3) for indices 1 and 2, where i is equal to 1 and 2, the device for index i - Secondary decryption key for index i (<sk>) ｉ ) and the secondary mask of index i (<r> ｉ ) using the cryptographic (c ｓ The method involves applying a decoding and masking process to the data, wherein the decoding and masking process involves decoding the score without calculating it in plaintext and representing the score in a form masked by a primary mask (r). [Number 18] To bring about, to apply, - The aforementioned data [Number 19] and the secondary mask of index i (<r> ｉ Unmasked data of index i related to (k ｉ ) From the partial result of index i (o ｉ To generate Two devices (3) and A system including, Here - The secondary decryption keys (<sk>) for each index 1 and 2 １ , <sk> ２ ) is derived from the primary decryption key (sk) associated with the aforementioned encryption key (pk), - The secondary masks for indices 1 and 2 (<r> １ , <r> ２ ) is derived from the primary mask (r), - The aforementioned partial results for each index 1 and 2 (o １ ,o ２ ) can be used to calculate a confirmation result (o) indicating whether the test biometric data matches the reference biometric data. system.