Verification system, verification method, and verification program

Abstract

This comparison system (100) is provided with: a key generation means (125) which uses a common random number to generate a key common to each of multiple items of registration information, and which uses multiple pieces of identification information to generate multiple private keys specific to each of the items of registration information; a concealment means (126) which uses the common key and the private keys to generate multiple pieces of concealed information by concealing the pieces of registration information; a client; and a validation server. The client has a concealment index calculation means (134) which calculates multiple concealment indices representing the degree of approximation between comparison information and each of the items of concealed information; the validation server has a determination means (144) which uses the common key and the private keys to generate multiple indices by decoding the multiple concealment indices, and which authenticates the comparison information on the basis of whether or not any of the multiple indices indicates a value in a prescribed range.

Description

[Technical field]

[0001] The present invention relates to a matching system, a matching method, and a computer-readable medium. [Background technology]

[0002] One example of authentication is biometric authentication. "Biometric authentication" is a personal authentication method that verifies whether the enrollee and the authenticatee match by comparing their biometric information with each other. "Biometric information" is data extracted from certain physical or behavioral characteristics, or data generated by converting the extracted data. This data is sometimes called a feature. Here, data stored in advance for biometric authentication, including data generated from the enrollee's biometric information (hereinafter referred to as registration information), is called a template.

[0003] When performing biometric authentication using a client-server system, there are two types: one in which the template is stored on the client, and one in which the template is stored on the server.

[0004] Patent Documents 1 and 2 disclose an example of an authentication device and authentication method that prevents registration information from being leaked by storing encrypted registration information as a template on a server.

[0005] Moreover, Patent Document 3 describes a matching system that enhances security regarding binary vectors.

[0006] Furthermore, Patent Document 4 describes an example of an authentication device and authentication method in which encrypted registration information is stored as a template on the client to prevent leakage of registration information. By storing encrypted registration information as a template on the client, damage caused by data leakage can be reduced compared to storing the information on the server. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2011-211593 A [Patent Document 2] JP 2009-129292 A [Patent Document 3] International Publication No. 2018 / 110608 [Patent Document 4] International Publication No. 2020 / 121458 Summary of the Invention [Problem to be solved by the invention]

[0008] Biometric authentication has an authentication format (hereinafter referred to as 1:N authentication) in which N templates (N is an integer equal to or greater than 1) are compared with the biometric information of the person to be authenticated to see if there is a match. In 1:N authentication, for example, an authentication format (hereinafter referred to as 1:1 authentication) in which one template is compared with the biometric information of the person to be authenticated and confirmed is repeated N times. However, this method has the problem that the amount of communication, calculation, and data to be stored on the client and server is N times larger than in 1:1 authentication, and the efficiency becomes worse as the value of N becomes larger.

[0009] The present disclosure has been made to solve such problems, and has an object to provide an efficient 1:N authentication matching system, a matching method, and a computer-readable medium. [Means for solving the problem]

[0010] The verification system according to the present disclosure includes a common random number generation means for generating a common random number, an identification information generation means for generating a plurality of identification information unique to each of a plurality of registration information, which is biometric information of a plurality of persons to be registered, a key generation means for generating a common key common to each of the plurality of registration information using the common random number and generating a plurality of unique keys unique to each of the plurality of registration information using the plurality of identification information, anonymization means for generating a plurality of anonymized information by anonymizing each of the plurality of registration information using the common key and the plurality of unique keys, a client, and a verification server, wherein the client has anonymization index calculation means for calculating a plurality of anonymization indexes representing a degree of similarity between verification information, which is the biometric information of a person to be authenticated, and each of the plurality of anonymized information, and the verification server has a determination means for generating a plurality of indexes by decrypting each of the plurality of anonymization indexes using the common key and the plurality of unique keys, and for authenticating the verification information based on whether any of the plurality of indexes indicates a value within a predetermined range.

[0011] The matching method according to the present disclosure includes a common random number generation step of generating a common random number, an identification information generation step of generating a plurality of identification information unique to each of a plurality of registration information, which is biometric information of a plurality of persons to be registered, a key generation step of generating a common key common to each of the plurality of registration information using the common random number and generating a plurality of unique keys unique to each of the plurality of registration information using the plurality of identification information, an anonymization step of generating a plurality of anonymized information by anonymizing each of the plurality of registration information using the common key and the plurality of unique keys, an anonymization index calculation step in a client of calculating a plurality of anonymization indexes representing a degree of similarity between matching information, which is biometric information of a person to be authenticated, and each of the plurality of anonymized information, and a determination step in a verification server of generating a plurality of indexes by decrypting each of the plurality of anonymization indexes using the common key and the plurality of unique keys, and authenticating the matching information based on whether any of the plurality of indexes indicates a value within a predetermined range.

[0012] A non-transitory computer-readable medium according to the present disclosure stores a matching program that causes a computer to execute the following steps: a common random number generation process that generates a common random number; an identification information generation process that generates a plurality of identification information unique to each of a plurality of registration information, which is biometric information of a plurality of persons to be registered; a key generation process that uses the common random number to generate a common key common to each of the plurality of registration information, and generates a plurality of unique keys unique to each of the plurality of registration information, using the plurality of identification information; an anonymization process that uses the common key and the plurality of unique keys to generate a plurality of anonymized information by anonymizing each of the plurality of registration information; an anonymization index calculation process, in a client, that calculates a plurality of anonymization indexes that indicate a degree of similarity between matching information, which is biometric information of a person to be authenticated, and each of the plurality of anonymized information; and a determination process, in a verification server, that generates a plurality of indexes by decrypting each of the plurality of anonymization indexes using the common key and the plurality of unique keys, and authenticates the matching information based on whether any of the plurality of indexes indicates a value within a predetermined range. Effect of the Invention

[0013] The present disclosure provides an efficient 1:N authentication matching system, matching method, and computer-readable medium. [Brief description of the drawings]

[0014] [Figure 1] 1 is a block diagram showing a configuration example of a matching system according to a first embodiment. [Diagram 2] FIG. 11 is a block diagram showing a configuration example of a matching system according to a second embodiment. [Diagram 3] 3 is a flowchart showing a common random number generation operation in the verification system shown in FIG. 2. [Figure 4] 3 is a flow diagram showing the operation of a registration process and an authentication process in the verification system shown in FIG. 2. [Diagram 5] 3 is a block diagram showing a first application example of the verification system shown in FIG. 2. [Figure 6]3 is a block diagram showing a second application example of the verification system shown in FIG. 2. [Figure 7] FIG. 2 is a block diagram showing an outline of a computer that realizes a client and a server to which the matching systems according to the first and second embodiments are applied. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In each drawing, the same or corresponding elements are denoted by the same reference numerals, and duplicated descriptions will be omitted as necessary for clarity of explanation.

[0016] In the following description, the matching system of the present disclosure will be described taking as an example a case where it is applied to biometric authentication, but the present disclosure is not limited to this, and it may be applied to authentication or matching processes other than biometric authentication.

[0017] <Embodiment 1> FIG. 1 is a block diagram showing an overview of a matching system according to the first embodiment. The verification system according to the first embodiment includes a common random number generation unit 111, an ID issuing unit 123, a key generation unit 125, a concealment unit 126, a concealment index calculation unit 134, and a determination unit 144. The concealment index calculation unit 134 is provided in a client. The determination unit 144 is provided in a verification server.

[0018] When a start signal is input, the common random number generation unit 111 generates a common random number CR. The ID issuing unit 123 issues an ID (IDentification) for each piece of biometric information (hereinafter referred to as registration information) X of the person to be registered. The key generation unit 125 generates a unique anonymization key sk_ID for each ID using the input common random number CR. The anonymization unit 126 anonymizes each piece of registration information X using the anonymization key sk_ID. The anonymization unit 126 transmits information obtained by anonymizing multiple pieces of registration information X (hereinafter referred to as anonymized information) to the client as a template.

[0019] In the client, the anonymization index calculation unit 134 calculates data (hereinafter referred to as anonymization index) in which an index is anonymized, which is a value indicating the closeness of each of the multiple pieces of registration information X to the matching information Y, based on multiple templates (i.e., anonymized information obtained by anonymizing the registration information X) and matching information Y (biometric information of the authenticated person used to match the registration information X), and transmits the calculated multiple anonymization indexes to the verification server.

[0020] In the validation server, the determination unit 144 acquires a plurality of anonymization indices transmitted from the client. The determination unit 144 first generates a plurality of indices by decrypting each of the plurality of anonymization indices using the common key CR and a plurality of anonymization keys sk_ID unique to each ID. The determination unit 144 then performs 1:N authentication by determining whether any of the decrypted plurality of indices is within a predetermined acceptance range. Only when there is one indices within the acceptance range, the determination unit 144 transmits the ID and authentication result information indicating that the authentication has been successful (authentication has been accepted) to the client. On the other hand, when there is no indices within the acceptance range or when there are multiple indices within the acceptance range, the determination unit 144 transmits authentication result information indicating that the authentication has failed to the client.

[0021] For example, when the client receives authentication result information from the verification server indicating that the authentication was successful, the client executes post-authentication processing corresponding to the ID. However, the device that executes the post-authentication processing is not limited to the client, and a device other than the client may execute the post-authentication processing corresponding to the ID on the condition that the authentication result information indicating that the authentication was successful is obtained.

[0022] In this way, the matching system according to the first embodiment shares a part of the anonymization key used to generate each template, and therefore, compared to a case where the keys are not shared, it is possible to reduce the number of data held by the client and the number of keys held by the verification server, and to reduce the number of exponentiations and the amount of communication between the client and the verification server. In other words, the matching system according to the first embodiment can perform efficient 1:N authentication.

[0023] In the matching system according to the first embodiment, the encrypted registration information is stored as a template in the client, so that the damage caused by the data leakage is reduced compared to the case where the information is stored in the server. In other words, the matching system according to the first embodiment can perform efficient 1:N authentication while improving security performance.

[0024] <Embodiment 2> 2 is a block diagram showing an example of the configuration of a verification system 100 according to embodiment 2. The verification system 100 shown in FIG. 2 is a block diagram showing the verification system shown in FIG. 1 in more detail.

[0025] As shown in FIG. 2, the verification system 100 includes a common random number generation device 110, a registration information concealment device 120, a concealment index calculation device 130, and a concealment index verification device 140.

[0026] In this embodiment, a case will be described in which the registration information and the matching information are expressed by vectors of a common dimension. In this embodiment, the biometric information may be extracted from the iris, retina, face, blood vessels (veins), palm print, voice print, or a combination of these, in addition to the fingerprint. Alternatively, the biometric information may be extracted from other information that can identify a living body other than the above examples.

[0027] (Configuration of the common random number generator 110) The common random number generation device 110 includes a common random number generation unit 111 and a common random number storage unit 112. The common random number generation device 110 generates a common random number CR. The common random number generation unit 111 generates a common random number CR when a start signal is input. The common random number storage unit 112 stores the common random number CR generated by the common random number generation unit 111. The common random number CR generated by the common random number generation device 110 is used in the registration information concealment device 120.

[0028] (Configuration of the registration information concealment device 120) The registration information concealment device 120 includes a registration information input unit 121 , a common random number input unit 122 , an ID issuing unit 123 , a random number generating unit 124 , a key generating unit 125 , and a concealment unit 126 .

[0029] The registration information input unit 121 accepts input of biometric information (hereinafter referred to as registration information) X of the person to be registered. The registration information input unit 121 may be an input device according to the type of the registration information X. For example, when the registration information X is biometric information extracted from a fingerprint, the registration information input unit 121 may be an input device that reads a fingerprint, extracts a vector that is the biometric information of the person to be registered from the fingerprint, and accepts the vector as the registration information X. The registration information input unit 121 may also be an input device into which the vector that is the biometric information of the person to be registered is directly input as the registration information X.

[0030] The common random number input unit 122 receives a common random number CR from the common random number generation device 110. The common random number input unit 122 outputs the received common random number CR to the key generation unit 125. The ID issuing unit 123 issues an ID every time registration information X is input to the registration information input unit 121. The random number generation unit 124 generates a random number R_ID for each issued ID. The random number R_ID generated by the random number generation unit 124 is input.

[0031] The key generation unit 125 generates an anonymization key by using the common random number CR and the random number R_ID. Here, in this embodiment, a digital signature based on a public key cryptosystem is adopted. Therefore, the key generation unit 125 generates a public key pk and a secret key sk of the digital signature by using the common random number CR. The secret key sk is also used as an anonymization key. In addition, the key generation unit 125 generates a common anonymization key sk_C by using the common random number CR, and generates an anonymization key sk_ID for each piece of registered information X by using the common random number CR and the random number R_ID. The key generation unit 125 outputs the secret key sk, the common anonymization key sk_C, and the anonymization key sk_ID for each piece of registered information X to the anonymization unit 126. In addition, the key generation unit 125 transmits the public key pk, the common anonymization key sk_C, and the anonymization key sk_ID for each piece of registered information X to the anonymization index verification device 140.

[0032] The anonymization unit 126 anonymizes the registration information X input to the registration information input unit 121, using the secret key sk, the common anonymization key sk_C, and the anonymization key sk_ID corresponding to the registration information X. The anonymization unit 126 transmits information obtained by anonymizing the registration information X (hereinafter, referred to as anonymized information) to the anonymization index calculation device 130.

[0033] The common random number input unit 122, the key generation unit 125, and the concealment unit 126 are realized, for example, by a CPU (Central Processing Unit) of a computer that operates according to a program for clients, and a communication interface of the computer. For example, the CPU may read the program for clients from a program recording medium such as a program storage device of the computer, and operate as the common random number input unit 122, the key generation unit 125, and the concealment unit 126 using the communication interface according to the program. Also, the ID issuing unit 123 and the random number generating unit 124 are realized, for example, by a CPU of a computer that operates according to a program for clients. For example, the CPU may read the program for clients from a program recording medium as described above, and operate as the ID issuing unit 123 and the random number generating unit 124 according to the program.

[0034] (Configuration of the Concealment Index Calculation Device 130) The concealment index calculation device 130 includes a concealment information receiving unit 131 , a concealment information storage unit 132 , a matching information input unit 133 , a concealment index calculation unit 134 , and an output unit 135 .

[0035] The anonymization information receiving unit 131 receives the anonymization information transmitted from the registration information anonymization device 120, and stores the anonymization information in the anonymization information storage unit 132. The anonymization information storage unit 132 is a device that stores the anonymization information.

[0036] The matching information input unit 133 accepts input of biometric information Y of the person to be authenticated used for matching with the registered information X (hereinafter, referred to as matching information). The matching information input unit 133 may be an input device according to the type of the matching information Y. Furthermore, the matching information input unit 133 may be an input device into which a vector serving as the biometric information of the person to be authenticated is directly input as the matching information Y.

[0037] In addition, in the verification system 100 of this embodiment, a challenge-response method is introduced to prevent a client from being spoofed by an attacker who eavesdrops on communication between the client and the verification server. Specifically, in the verification system 100, the concealment index verification device 140 transmits a different challenge for each authentication to the concealment index calculation device 130, and the concealment index calculation device 130 calculates a response that corresponds to a different challenge for each authentication and includes the closeness between the registered information and the verification information, so that the response value is changed for each authentication. As a result, even if an attacker eavesdrops on the response value, the eavesdropped value cannot be used in the next authentication, and the attacker cannot generate a response corresponding to a different challenge, so that spoofing of a client is prevented.

[0038] The concealment index calculation unit 134 calculates data (hereinafter, referred to as the concealment index) in which an index is concealed, which is a value indicating the closeness between each of the plurality of pieces of registration information X and the comparison information Y, based on a plurality of templates (i.e., concealment information obtained by concealing the registration information X), the matching information Y, and a challenge received from the concealment index verification device 140. At this time, the concealment index calculation unit 134 calculates the concealment index without removing the concealment of the template. The calculated plurality of concealment indexes are transmitted to the concealment index verification device 140.

[0039] The output unit 135 receives authentication result information indicating a result of biometric authentication transmitted from the concealment index verification device 140. In addition, the output unit 135 outputs the received authentication result information to the outside of the concealment index calculation device 130.

[0040] The anonymized information receiving unit 131, the anonymized information storage unit 132, and the output unit 135 are realized, for example, by a CPU (Central Processing Unit) of a computer that operates according to a program for a client, and a communication interface of the computer. For example, the CPU may read the program for a client from a program recording medium such as a program storage device of the computer, and operate as the anonymized information receiving unit 131, the anonymized information storage unit 132, and the output unit 135 using a communication interface according to the program. Also, the ID issuing unit 123 and the random number generating unit 124 are realized, for example, by a CPU of a computer that operates according to a program for a registration server. For example, the CPU may read the program for a client from a program recording medium as described above, and operate as the ID issuing unit 123 and the random number generating unit 124 according to the program.

[0041] The anonymization information storage unit 132 is realized by, for example, a storage device included in a computer.

[0042] (Configuration of the Concealment Index Verification Device 140) The concealment index verification device 140 includes a key receiving unit 141 , a key storage unit 142 , an acceptance range storage unit 143 , a determination unit 144 , and a challenge generation unit 145 .

[0043] The key receiving unit 141 receives the public key pk, the common anonymization key sk_C, and the anonymization key sk_ID for each piece of registration information X transmitted from the registration information anonymization device 120, and stores them in the key storage unit 142.

[0044] The key storage unit 142 is a storage device that stores the public key pk, the common anonymization key sk_C, and the anonymization key sk_ID for each piece of registration information X.

[0045] The determination unit 144 uses the keys (public key pk, common anonymization key sk_C, and anonymization key sk_ID for each piece of registration information X) stored in the key storage unit 142 to determine whether or not an index can be obtained from each of the multiple anonymization indices calculated by the anonymization index calculation device 130.

[0046] Before receiving each concealment index from the concealment index calculation device 130, the determination unit 144 transmits the challenge generated by the challenge generation unit 145 to the concealment index calculation device 130.

[0047] When an index can be acquired from each of the multiple concealment indexes calculated by the concealment index calculation device 130, the determination unit 144 acquires the index. Next, the determination unit 144 determines whether or not the index acquired from each concealment index is a value within a predetermined acceptance range, thereby determining whether or not the enrollee included in the enrollment information X matches the authenticatee included in the matching information Y. Note that the predetermined acceptance range is stored in the acceptance range storage unit 143.

[0048] For example, if the index acquired from the concealment index is a value within the acceptable range, the determination unit 144 determines that the person to be registered and the person to be authenticated match. The match between the person to be registered and the person to be authenticated corresponds to the registration information X and the matching information Y. Furthermore, if the index acquired from the concealment index is not a value within the acceptable range, the determination unit 144 determines that the person to be registered and the person to be authenticated do not match. Only when there is one determination result in which the person to be registered and the person to be authenticated match, the determination unit 144 transmits the ID and authentication result information indicating that the authentication was successful (authentication was accepted) to the concealment index calculation device 130. When there is no determination result in which the person to be registered and the person to be authenticated match, or when there are multiple determination results in which they match, the determination unit 144 transmits authentication result information indicating that the authentication failed to the concealment index calculation device 130.

[0049] For example, the concealment index calculation device 130 executes post-authentication processing corresponding to the ID when it receives authentication result information indicating successful authentication from the concealment index verification device 140. However, the device that executes the post-authentication processing is not limited to the concealment index calculation device 130, and a device other than the client may execute the post-authentication processing corresponding to the ID on the condition that authentication result information indicating successful authentication is obtained.

[0050] The key receiving unit 141, the challenge generating unit 145, and the determining unit 144 are realized by, for example, a CPU (Central Processing Unit) of a computer that operates according to a server program, and a communication interface of the computer. For example, the CPU may read the server program from a program recording medium such as a program storage device of the computer, and operate as the key receiving unit 141, the challenge generating unit 145, and the determining unit 144 using the communication interface according to the program.

[0051] The key storage unit 142 and the acceptance range storage unit 143 are realized by, for example, a storage device included in the computer.

[0052] (flowchart) Next, the process flow of the collation system 100 will be described. 3 is a flowchart showing the operation of generating a common random number in the verification system 100. Note that detailed explanations of the contents that have already been explained will be omitted.

[0053] First, the common random number generation device 110 generates a common random number CR in the common random number generation unit 111 (step S101). After that, the common random number generation device 110 stores the common random number CR in the common random number storage unit 112 (step S102). After that, the common random number generation device 110 transmits the common random number CR to the common random number input unit 122 of the registration information concealment device 120 (step S103).

[0054] 4 is a flowchart showing the operation of the registration process and authentication process in the verification system 100. Note that detailed explanations of matters that have already been explained will be omitted.

[0055] First, a registration process is performed. Specifically, first, in the enrollment information concealment device 120, the enrollment information X (biometric information of the person to be enrolled) is input to the enrollment information input unit 121 (step S201).

[0056] Next, the common random number input unit 122 receives the common random number CR transmitted from the common random number generation device 110 (step S202).

[0057] Next, the ID issuing unit 123 issues an ID every time the registration information X is input to the registration information input unit 121 (step S203).

[0058] Next, the random number generation unit 124 generates a random number R_ID for each issued ID (step S204).

[0059] Next, the key generation unit 125 generates a private key sk and a public key pk for a digital signature using the common random number CR (step S205). The key generation unit 125 also generates a common anonymization key sk_C using the common random number CR, and generates an anonymization key sk_ID for each piece of registration information X using the common random number CR and the random number R_ID (step S205).

[0060] Next, the anonymization unit 126 anonymizes the registration information X input to the registration information input unit 121 using the private key sk, the common anonymization key sk_C, and the anonymization key sk_ID corresponding to the registration information X, and outputs it as anonymized information (step S206).

[0061] Next, the anonymization unit 126 transmits the anonymization information to the anonymization information receiving unit 131 of the anonymization index calculation device 130 (Step S207).

[0062] Next, the key generation unit 125 transmits the public key pk, the common anonymization key sk_C, and the anonymization key sk_ID for each piece of registration information X to the key reception unit 141 of the anonymization index verification device 140 (step S208).

[0063] Next, in the anonymization index calculation device 130, the anonymization information receiving unit 131 receives the anonymization information (step S209).

[0064] Next, the anonymization information storage unit 132 stores the anonymization information (step S210).

[0065] Next, in the anonymization index verification device 140, the key receiving unit 141 receives the public key pk, the common anonymization key sk_C, and the anonymization key sk_ID for each piece of registration information X transmitted from the registration information anonymization device 120 (step S211).

[0066] Next, the key storage unit 142 stores the public key pk, the common anonymization key sk_C, and the anonymization key sk_ID for each piece of registration information X (step S212).

[0067] FIG. 5 is a block diagram showing a first application example of the verification system 100. As shown in FIG. 5, the registration server includes a common random number generation device 110 and a registration information concealment device 120, the client includes a concealment index calculation device 130, and the verification server includes a concealment index verification device 140. In this case, the registration server continues to hold a common random number CR, a secret key sk, a common concealment key sk_C, and a concealment key sk_ID for each registration information X.

[0068] FIG. 6 is a block diagram showing a second application example of the verification system 100. As shown in FIG. 6, the client includes a common random number generation device 110, a registration information concealment device 120, and a concealment index calculation device 130, and the verification server includes a concealment index verification device 140. In this case, when the registration process is completed, the common random number CR, the secret key sk, the common concealment key sk_C, and the concealment key sk_ID for each registration information X are deleted from the client.

[0069] After the registration process, an authentication process is carried out. Specifically, first, in the concealment index calculation device 130, the matching information Y (biometric information of the person to be authenticated) is input to the matching information input unit 133 (step S213).

[0070] Next, in the concealment index verification device 140, the challenge generation unit 145 generates a challenge (step S214). In addition, the challenge generation unit 145 transmits the challenge to the concealment index calculation unit 134 of the concealment index calculation device 130 (step S215).

[0071] Next, in the concealment index calculation device 130, the concealment index calculation unit 134 receives the challenge (step S216).

[0072] Next, the anonymization index calculation unit 134 calculates multiple anonymization indices based on multiple templates (anonymization information obtained by anonymizing the registration information X), the matching information Y, and the challenge received from the anonymization index verification device 140 (step S217).

[0073] Next, the anonymization index calculation unit 134 transmits the calculated multiple anonymization indexes to the determination unit 144 of the anonymization index verification device 140 (step S218).

[0074] Next, in the anonymization index verification device 140, the determination unit 144 receives the multiple anonymization indexes transmitted from the anonymization index calculation device 130 (step S219).

[0075] Next, the determination unit 144 checks whether the received multiple anonymization indices include an index within a predetermined acceptable range by using the public key pk, the common anonymization key sk_C, the anonymization key sk_ID, and the challenge (step S220). The determination unit 144 also transmits the check result to the output unit 135 of the anonymization index calculation device 130 (step S221).

[0076] Next, in the concealment index calculation device 130, the output unit 135 receives the matching result (step S222). Next, the output unit 135 outputs the matching result (step S223).

[0077] A specific example of the authentication process of this embodiment will be described below. In the following explanation, both the registration information X and the matching information Y are assumed to be n-dimensional vectors. Each element of X is expressed as X=(x_1,...,x_n), and each element of Y is expressed as Y=(y_1,...,y_n). The symbol i represents 1,...,n. For example, {u_i}=u_1,u_2,...,u_n. Furthermore, the number of pieces of registration information X entered at the time of registration is assumed to be N. The symbol j represents 1,...,N.

[0078] (First concrete example) In this specific example, a case is considered in which an index indicating the closeness between the registered information X and the matching information Y is the inner product of the registered information X and the matching information Y.<X,Y> is Σ(x_i·y_i). Below, we show an example of processing when the index is an inner product.

[0079] In this specific example, Schnorr signature is used. In Schnorr signature, a pair of a private key sk and a public key pk=g^sk is generated. Note that sk∈Z_q (Z_q={0,1,···,q-1}, q is a prime number) (Z is a symbol representing the set of all integers). Also, g is a generator of a group G of order q. That is, G={g_0,g_1,···,g_q-1}. Z_q, g, and G are shared between all devices.

[0080] Furthermore, an acceptance range Θ={θ_1, , θ_m} is given to the concealment index verification device 140. The acceptance range storage unit 143 of the concealment index verification device 140 stores Θ'={g^(θ_1), , g^(θ_m)}. Note that Θ' is a set of powers of g with each value of Θ as an exponent.

[0081] A specific registration process when a Schnorr signature is used will be described below.

[0082] First, biometric information (that is, registration information) {X_j} of N persons to be registered is input to the registration information input unit 121. Next, the ID issuing unit 123 issues an ID for each piece of biometric information. Next, the common random number generation unit 111 generates a common random number according to the following formulas (1) and (2).

[0083] R_1 ← ^RZ_q (1) R_3←^RZ_q (2)

[0084] Furthermore, the random number generation unit 124 generates random numbers according to the following formulas (3) and (4).

[0085] (R_2_1,R_2_2,···,R_2_N)←^RZ_q···(3) (r_1_1,r_2_1,···,r_n_1,r_1_2,···,r_n_N)←^RZ_q···(4)

[0086] Next, the key generation unit 125 regards R_3 as a secret key and generates a public key g^(R_3). Also, the key generation unit 125 regards the common random number {r_i_j} and the random numbers R_1 and {R_2_j} as anonymization keys.

[0087] The key generation unit 125 inputs the private key and the anonymization key to the anonymization unit 126. In addition, the key generation unit 125 transmits the ID, the public key g^(R_3), and the anonymization keys R_1, {R_2_j} to the key reception unit 141 of the anonymization index verification device 140.

[0088] Next, the key storage unit 142 stores the received ID, public key, and encryption key.

[0089] Next, the anonymization unit 126 of the registration information anonymization device 120 generates R_1·x_i_j+R_2_j·r_i+R_3 and g^(r_i_j) for i=1,2,...,n and j=1,2,...,N based on the input private key, anonymization key, and N pieces of registration information {X_j}. Hereinafter, the templates are defined as {R_1·x_i_j+R_2_j·r_i_j+R3} and {g^(r_i_j)}.

[0090] The anonymization unit 126 transmits the ID and the template to the anonymization information receiving unit 131 of the anonymization index calculation device 130.

[0091] Next, the anonymization information storage unit 132 stores the ID and the template.

[0092] Next, a specific authentication process when the Schnorr signature is used will be described.

[0093] First, the matching information Y is input to the matching information input unit 133. The anonymization index calculation unit 134 acquires the matching information Y from the matching information input unit 133, and acquires the ID and the template from the anonymization information storage unit.

[0094] Next, the concealment index calculation unit 134 calculates σ_1_j=g^(Σr_i_j·y_i). After that, the concealment index calculation unit 134 transmits the ID and the corresponding {σ_1_j} to the determination unit 144 of the concealment index verification device 140.

[0095] Next, the concealment index verification device 140 that has received the ID and σ_1_j generates M, R ← ^RZ_q in the challenge generation unit 145, and calculates g^(R·R_3) using the public key g^(R_3) stored in the key storage unit 142. Thereafter, it transmits M, g^(R·R_3) as a challenge to the concealment index calculation unit 134 of the concealment index calculation device.

[0096] Next, the concealment index calculation unit 134 calculates S_j=H(M, g^r'_j), where H is a cryptographic hash function. Next, the concealment index calculation unit 134 calculates the following values ​​from equations (5), (6), and (7) based on the inputted matching information Y and template.

[0097] A_j=Σ_i(R_1·x_i_j+R_2_j·r_i_j+R_3)·y_i ···(5) σ2j=r'j-Aj·S (6) σ_3=g^(R·R_3·y_i) ···(7)

[0098] Note that A_j is the inner product of X and Y.<X,Y> is a value obtained by adding R_2_j times Σr_i·y_i and R_3 times Σy_i to a value obtained by multiplying A_j by R_1. After calculating each value, the concealment index calculation unit 134 transmits ({S_j}, {σ_2_j}, σ_3) to the determination unit 144 of the concealment index verification device 140 as a response including the inner product of the registration information X_j and the matching information Y. (S_j, σ_2_j, σ_3) corresponds to a Schnorr signature with A_j as a private key.

[0099] The determination unit 144 receives a response from the anonymization index calculation unit 134. The determination unit 144 verifies N digital signatures {S_j, σ_2_j, σ_3} using the public key g^(R_3) stored together with the ID in the key storage unit 142 and the anonymization keys R_1, {R_2_j}. Specifically, the following formula (8) is calculated.

[0100] v_j=[{g^(σ_2_j)} · {(σ_3)^(S_j · R_3)} · {(σ_1_j)^(S_j · R_2_j)} · (g^(-r'_j))]^(-1 / R_1) · · (8)

[0101] The determination unit 144 checks whether the calculated v_j is included in Θ'. If no value included in Θ' is found, or if multiple values ​​are found, the determination unit 144 generates authentication result information indicating "authentication failure."

[0102] Also, if only one value included in Θ' is found, the determination unit 144 generates authentication result information indicating that "ID_j has been successfully authenticated."

[0103] Next, the determination unit 144 transmits the generated authentication result information to the output unit 135 of the concealment index calculation device 130. Next, the output unit 135 that has received the authentication result information outputs the authentication result information. Note that the authentication result information may be output directly from the concealment index verification device 140.

[0104] Although Schnorr signature is used in this specific example, other cryptographically secure digital signature methods such as DSA signature may be used.

[0105] (Second concrete example) In this specific example, a case is also considered in which an index indicating the closeness between registered information X and matching information Y is the inner product of registered information X and matching information Y. An example of processing in the case in which the index is the inner product is shown below.

[0106] In this specific example, Schnorr signature is used. In Schnorr signature, a pair of a private key sk and a public key pk=g^sk is generated. Note that sk∈Z_q (Z_q={0,1,···,q-1}, q is a prime number) (Z is a symbol representing the set of all integers). Also, g is a generator of a group G of order q. That is, G={g_0,g_1,···,g_q-1}. Z_q, g, and G are shared between all devices.

[0107] Furthermore, an acceptance range Θ={θ_1, , θ_m} is given to the concealment index verification device 140. The acceptance range storage unit 143 of the concealment index verification device 140 stores Θ'={g^(θ_1), , g^(θ_m)}. Note that Θ' is a set of powers of g with each value of Θ as an exponent.

[0108] A specific registration process when a Schnorr signature is used will be described below.

[0109] First, biometric information (that is, registration information) {X_j} of N persons to be registered is input to the registration information input unit 121. Next, the ID issuing unit 123 issues an ID for each piece of biometric information. Next, the common random number generation unit 111 generates common random numbers according to the following equations (9) and (10).

[0110] R_2←^RZ_q (9) R_3←^RZ_q (10)

[0111] Moreover, the random number generation unit 124 generates random numbers according to the following formulas (11) and (12).

[0112] (R_1_1,R_1_2,···,R_1_N)←^RZ_q···(11) (r_1_1,r_2_1,···,r_n_1,r_1_2,···,r_n_N)←^RZ_q···(12)

[0113] Next, the key generation unit 125 regards R_3 as a secret key and generates a public key g^(R_3). Also, the common random number {r_i_j} and the random numbers {R_1_j} and R_2 as anonymization keys.

[0114] The key generation unit 125 inputs the private key and the anonymization key to the anonymization unit 126. In addition, the key generation unit 125 transmits the ID, the public key g^(R_3), and the anonymization keys {R_1_j} and R_2 to the key reception unit 141 of the anonymization index verification device 140.

[0115] Next, the key storage unit 142 stores the received ID, public key, and encryption key.

[0116] Next, the anonymization unit 126 of the registration information anonymization device 120 generates R_1_j·x_i_j+R_2·r_i+R_3 and g^(r_i_j) for i=1,2,...,n and j=1,2,...,N based on the input private key, anonymization key, and N pieces of biometric information {X_j}. Hereinafter, the templates are defined as {R_1_j·x_i_j+R_2·r_i_j+R3} and {g^(r_i_j)}.

[0117] The anonymization unit 126 transmits the ID and the template to the anonymization information receiving unit 131 of the anonymization index calculation device 130.

[0118] Next, the anonymization information storage unit 132 stores the ID and the template.

[0119] Next, a specific authentication process when the Schnorr signature is used will be described.

[0120] First, the matching information Y is input to the matching information input unit 133. The anonymization index calculation unit 134 acquires the matching information Y from the matching information input unit 133, and acquires the ID and the template from the anonymization information storage unit.

[0121] Next, the concealment index calculation unit 134 calculates σ_1_j=g^(Σr_i_j·y_i). After that, the concealment index calculation unit 134 transmits the ID and the corresponding {σ_1_j} to the determination unit 144 of the concealment index verification device 140.

[0122] Next, the concealment index verification device 140 that has received the ID and σ_1_j generates M, R ← ^RZ_q in the challenge generation unit 145, and calculates g^(R·R_3) using the public key g^(R_3) stored in the key storage unit 142. Thereafter, it transmits M, g^(R·R_3) as a challenge to the concealment index calculation unit 134 of the concealment index calculation device.

[0123] Next, the concealment index calculation unit 134 calculates S_j=H(M, g^r'_j), where H is a cryptographic hash function. Next, the concealment index calculation unit 134 calculates the following values ​​from equations (13), (14), and (15) based on the inputted matching information Y and template.

[0124] A_j=Σ_i(R_1_j·x_i_j+R_2·r_i_j+R_3)·y_i ···(13) σ2j=r'j-Aj·S (14) σ_3=g^(R·R_3·y_i) ···(15)

[0125] Note that A_j is the inner product of X and Y.<X,Y> is a value obtained by adding R_2 times Σr_i·y_i and R_3 times Σy_i to a value obtained by multiplying A_j by R_1_j. After calculating each value, the concealment index calculation unit 134 transmits ({S_j}, {σ_2_j}, σ_3) to the determination unit 144 of the concealment index verification device 140 as a response including the inner product of the registration information X_j and the matching information Y. (S_j, σ_2_j, σ_3) corresponds to a Schnorr signature with A_j as a private key.

[0126] The determination unit 144 receives a response from the anonymization index calculation unit 134. The determination unit 144 verifies N digital signatures {S_j, σ_2_j, σ_3} using the public key g^(R_3) stored together with the ID in the key storage unit 142 and the anonymization keys {R_1_j} and R_2. Specifically, the following formula (16) is calculated.

[0127] v_j=[{g^(σ_2_j)} · {(σ_3)^(S_j · R_3)} · {(σ_1_j)^(S_j · R_2)} · (g^(-r'_j))]^(-1 / R_1_j) · · (16)

[0128] The determination unit 144 checks whether the calculated v_j is included in Θ'. If no value included in Θ' is found, or if multiple values ​​are found, the determination unit 144 generates authentication result information indicating "authentication failure."

[0129] Also, if only one value included in Θ' is found, the determination unit 144 generates authentication result information indicating that "ID_j has been successfully authenticated."

[0130] Next, the determination unit 144 transmits the generated authentication result information to the output unit 135 of the concealment index calculation device 130. Next, the output unit 135 that has received the authentication result information outputs the authentication result information. Note that the authentication result information may be output directly from the concealment index verification device 140.

[0131] Although Schnorr signature is used in this specific example, other cryptographically secure digital signature methods such as DSA signature may be used.

[0132] In this way, the verification system 100 according to the second embodiment shares a part of the anonymization key used to generate each template, and therefore, compared to a case where the keys are not shared, it is possible to reduce the number of data held by the client and the number of keys held by the verification server, and to reduce the number of exponentiations and the amount of communication between the client and the verification server. In other words, the verification system 100 according to the second embodiment can perform efficient 1:N authentication.

[0133] In addition, in the verification system 100 according to the second embodiment, the encrypted registration information is stored as a template in the client, so that the damage caused by the occurrence of data leakage is reduced compared to the case where the information is stored in the server. In other words, the verification system 100 according to the second embodiment can perform efficient 1:N authentication while improving security performance.

[0134] The verification system 100 can be appropriately changed to a configuration that executes only the registration process. For example, the verification system 100 may be configured by a common random number generation device 110, a registration information concealment device 120, a concealment index calculation device 130a, and a concealment index verification device 140a. The concealment index calculation device 130a is a device corresponding to the concealment index calculation device 130, and has only the concealment information receiving unit 131 and the concealment information storage unit 132. The concealment index verification device 140a is a device corresponding to the concealment index verification device 140, and has only the key receiving unit 141 and the key storage unit 142.

[0135] Furthermore, the verification system 100 can be appropriately changed to a configuration that executes only the authentication process. For example, the verification system 100 may be configured by a concealment index calculation device 130a and a concealment index verification device 140a. The concealment index calculation device 130a is a device corresponding to the concealment index calculation device 130, and has only the concealment information storage unit 132, the matching information input unit 133, the concealment index calculation unit 134, and the output unit 135. The concealment index verification device 140a is a device corresponding to the concealment index verification device 140, and has only the key storage unit 142, the acceptance range storage unit 143, the determination unit 144, and the challenge generation unit 145.

[0136] Fig. 7 is a block diagram showing an outline of a computer that realizes a client and a server to which the matching systems according to the first and second embodiments are applied. As will be described below with reference to Fig. 7, the computer used as the client and the computer used as the server are separate computers.

[0137] The computer 1000 includes a CPU 1001 , a main memory device 1002 , an auxiliary memory device 1003 , an interface 1004 , and a communication interface 1005 .

[0138] The operation of computer 1000 that realizes the client is stored in the form of a client program in auxiliary storage device 1003. CPU 1001 reads the client program from auxiliary storage device 1003, loads it in main storage device 1002, and executes the client operation described in the above embodiment and specific examples in accordance with the client program.

[0139] The operation of computer 1000 that realizes the server is stored in the form of a server program in auxiliary storage device 1003. CPU 1001 reads the server program from auxiliary storage device 1003, loads it in main storage device 1002, and executes the server operation described in the above embodiment and specific examples in accordance with the server program.

[0140] The auxiliary storage device 1003 is an example of a non-transient tangible medium. Other examples of non-transient tangible media include a magnetic disk, a magneto-optical disk, a CD-ROM (Compact Disk Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), a semiconductor memory, and the like, which are connected via the interface 1004. In addition, when a program is distributed to the computer 1000 via a communication line, the computer 1000 that receives the program may load the program into the main storage device 1002 and operate according to the program.

[0141] Furthermore, some or all of the components of the client may be realized by general-purpose or dedicated circuits, processors, etc., or a combination of these. These may be configured by a single chip, or by multiple chips connected via a bus. Some or all of the components may be realized by a combination of the above-mentioned circuits, etc., and programs. The same applies to the server.

[0142] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes.

[0143] (Appendix 1) A common random number generating means for generating a common random number; an identification information generating means for generating a plurality of identification information unique to each of a plurality of pieces of registration information which are biometric information of a plurality of persons to be registered; a key generating means for generating a common key common to each of the plurality of pieces of registration information by using the common random number, and generating a plurality of unique keys unique to each of the plurality of pieces of registration information by using the plurality of pieces of identification information; an anonymization means for generating a plurality of pieces of anonymized information by anonymizing each of the plurality of pieces of registration information by using the common key and the plurality of unique keys; With clients, A validation server; Equipped with The client: a concealment index calculation means for calculating a plurality of concealment indexes representing degrees of similarity between matching information, which is biometric information of a person to be authenticated, and each of the plurality of concealment information, The verification server includes: a determination means for generating a plurality of indices by decrypting each of the plurality of concealment indices using the common key and the plurality of unique keys, and for authenticating the matching information based on whether any of the plurality of indices indicates a value within a predetermined range. Matching system.

[0144] (Appendix 2) The determination means accepts authentication of the matching information when any one of the plurality of indexes indicates a value within the predetermined range. A matching system as described in Appendix 1.

[0145] (Appendix 3) Each unique key is composed of a private key and a public key, the key generation means transmits a private key of each of the unique keys to the anonymization means, and transmits a public key of each of the unique keys to the verification server; 3. A verification system according to claim 1 or 2.

[0146] (Appendix 4) The verification server includes: a challenge generating means for generating a challenge signal for each of the verification information and transmitting the challenge signal to the client; In the client, the anonymization index calculation means is configured to calculate the plurality of anonymization indexes as response signals corresponding to the challenge signal. 4. A verification system according to any one of claims 1 to 3.

[0147] (Appendix 5) The matching information and the plurality of registered information are both represented by vectors. A verification system according to any one of claims 1 to 4.

[0148] (Appendix 6) In the client, the anonymization index calculation means calculates the plurality of anonymization indexes by inner products of the matching information and each of the plurality of anonymization information. A matching system according to any one of claims 1 to 5.

[0149] (Appendix 7) At least the identification information generating means, the key generating means, and the concealing means are provided in the client. A matching system according to any one of claims 1 to 6.

[0150] (Appendix 8) At least the identification information generating means, the key generating means, and the concealing means are provided in a registration server separate from the client and the verification server. A matching system according to any one of claims 1 to 6.

[0151] (Appendix 9) A common random number generation step for generating a common random number; an identification information generating step of generating a plurality of identification information unique to each of a plurality of pieces of registration information, which are biometric information of a plurality of persons to be registered; a key generation step of generating a common key common to each of the plurality of pieces of registration information using the common random number, and generating a plurality of unique keys unique to each of the plurality of pieces of registration information using the plurality of pieces of identification information; an anonymization step of generating a plurality of pieces of anonymized information by anonymizing each of the plurality of pieces of registration information by using the common key and the plurality of unique keys; a concealment index calculation step of calculating, in the client, a plurality of concealment indexes representing degrees of similarity between matching information, which is biometric information of a person to be authenticated, and each of the plurality of pieces of concealment information; a determination step of generating a plurality of indices by decrypting each of the plurality of concealment indices by using the common key and the plurality of unique keys in a verification server, and authenticating the matching information based on whether any of the plurality of indices indicates a value within a predetermined range; The matching method includes:

[0152] (Appendix 10) A common random number generation process for generating a common random number; an identification information generation process for generating a plurality of identification information unique to each of a plurality of pieces of registration information, which are biometric information of a plurality of persons to be registered; a key generation process for generating a common key common to each of the plurality of pieces of registration information using the common random number, and generating a plurality of unique keys unique to each of the plurality of pieces of registration information using the plurality of pieces of identification information; an anonymization process for generating a plurality of pieces of anonymized information by anonymizing each of the plurality of pieces of registration information by using the common key and the plurality of unique keys; a concealment index calculation process in which a client calculates a plurality of concealment indexes representing degrees of similarity between matching information, which is biometric information of a person to be authenticated, and each of the plurality of pieces of concealment information; a determination process in which, in a verification server, a plurality of indices are generated by decrypting each of the plurality of concealment indices using the common key and the plurality of unique keys, and the verification information is authenticated based on whether any of the plurality of indices indicates a value within a predetermined range; A non-transitory computer-readable medium storing a matching program for causing a computer to execute the above.

[0153] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Explanation of symbols]

[0154] 100 Matching System 110 Common Random Number Generator 111 Common Random Number Generator 112 Common random number memory unit 120 Registration information concealment device 121 Registration information input section 122 Common random number input section 123 ID Issuance Department 124 Random Number Generator 125 Key generation section 126 Concealment Department 130 Concealment index calculation device 131 Confidential information receiving unit 132 Concealment information storage unit 133 Matching information input section 134 Concealment index calculation unit 135 Output section 140 Concealment index verification device 141 Key receiver 142 Key storage unit 143 Acceptance range memory unit 144 Judgment section 145 Challenge Generation Unit 1000 Computers 1002 Main storage 1003 Auxiliary storage device 1004 Interface 1005 Communication Interface

Claims

1. A common random number generating means for generating a common random number; an identification information generating means for generating a plurality of identification information unique to each of a plurality of pieces of registration information which are biometric information of a plurality of persons to be registered; a key generating means for generating a common key common to each of the plurality of pieces of registration information by using the common random number, and generating a plurality of unique keys unique to each of the plurality of pieces of registration information by using the plurality of pieces of identification information; an anonymization unit that performs a predetermined calculation process by combining each of the pieces of registration information, a secret key that is a part of the common key, and a unique key corresponding to the piece of registration information, thereby generating a plurality of pieces of anonymized information by anonymizing each of the pieces of registration information; With the client, A validation server; Equipped with The client: a concealment index calculation means for calculating an inner product of matching information, which is biometric information of a person to be authenticated, and each of the plurality of pieces of concealed information as a plurality of concealment indexes representing a degree of similarity between the matching information, which is biometric information of the person to be authenticated, and each of the plurality of pieces of concealed information, without releasing the concealment of the plurality of pieces of concealed information; The verification server includes: a determination means for performing a predetermined calculation process by combining each of the concealment indices, a public key which is another part of the common key, and a unique key corresponding to the concealment indices, thereby generating a plurality of indices by decrypting the plurality of concealment indices, and for authenticating the matching information based on whether any of the plurality of indices indicates a value within a predetermined range. Matching system.

2. The determination means accepts authentication of the matching information when any one of the plurality of indexes indicates a value within the predetermined range. The verification system according to claim 1 .

3. The verification server includes: a challenge generating means for generating a challenge signal for each of the verification information and transmitting the challenge signal to the client; In the client, the concealment index calculation means is configured to output the plurality of concealment indexes as a response signal corresponding to the challenge signal. The collation system according to claim 1 or 2.

4. The matching information and the plurality of registered information are both represented by vectors. A collation system according to any one of claims 1 to 3.

5. In the client, the anonymization index calculation means calculates the plurality of anonymization indexes by inner products of the matching information and each of the plurality of anonymization information. A collation system according to any one of claims 1 to 4.

6. At least the identification information generating means, the key generating means, and the concealing means are provided in the client. A collation system according to any one of claims 1 to 5.

7. At least the identification information generating means, the key generating means, and the concealing means are provided in a registration server separate from the client and the verification server. A collation system according to any one of claims 1 to 5.

8. The computer Generate a common random number, generating a plurality of pieces of identification information unique to each of a plurality of pieces of registration information, which are biometric information of a plurality of persons to be registered; generating a common key common to each of the plurality of pieces of registration information using the common random number, and generating a plurality of unique keys unique to each of the plurality of pieces of registration information using the plurality of pieces of identification information; performing a predetermined calculation process by combining each of the pieces of registration information, a secret key that is a part of the common key, and a unique key corresponding to the piece of registration information, thereby generating a plurality of pieces of concealed information by concealing each of the plurality of pieces of registration information; a client calculates an inner product of matching information, which is biometric information of the person to be authenticated, and each of the plurality of pieces of concealed information as a plurality of concealment indices representing a degree of similarity between the matching information, which is biometric information of the person to be authenticated, and each of the plurality of pieces of concealed information, without deconcealing the plurality of pieces of concealed information; a verification server performs a predetermined calculation process by combining each of the concealment indices, a public key that is another part of the common key, and a unique key corresponding to the concealment indices, thereby generating a plurality of indices by decrypting each of the plurality of concealment indices, and authenticates the matching information based on whether any of the plurality of indices indicates a value within a predetermined range. Matching method.

9. A common random number generation process for generating a common random number; an identification information generation process for generating a plurality of identification information unique to each of a plurality of pieces of registration information, which are biometric information of a plurality of persons to be registered; a key generation process for generating a common key common to each of the plurality of pieces of registration information using the common random number, and generating a plurality of unique keys unique to each of the plurality of pieces of registration information using the plurality of pieces of identification information; an anonymization process for generating a plurality of anonymized pieces of information by anonymizing each of the plurality of pieces of registration information by performing a predetermined calculation process combining each of the pieces of registration information, a secret key that is a part of the common key, and a unique key corresponding to the registration information; a concealment index calculation process in which, in the client, an inner product of matching information which is biometric information of the person to be authenticated and each of the plurality of pieces of concealed information is calculated as a plurality of concealment indexes which represent a degree of similarity between the matching information which is biometric information of the person to be authenticated and each of the plurality of pieces of concealed information, without releasing the concealment of the plurality of pieces of concealed information; a determination process in which, in the verification server, a predetermined calculation process is performed by combining each of the concealment indices, a public key that is another part of the common key, and a unique key corresponding to the concealment indices to generate a plurality of indices by decrypting each of the plurality of concealment indices, and the verification information is authenticated based on whether any of the plurality of indices indicates a value within a predetermined range; A matching program that causes a computer to execute the above.

Images