Recovery verification system, collation system, recovery verification method and program

Abstract

Provided is a recovery verification system (10) comprising: a template storage unit (151); a random number generation unit (153); a concealed template generation unit (152); and a determination unit (175). The template storage unit (151) stores a template in which registration input information, which is biometric information about a person to be registered, is encrypted with a private key. The random number generation unit (153) generates a random number in response to a request from a client. The concealed template generation unit (152) conceals the template using the random number and transmits the concealed template to the client. The determination unit (175) acquires, from the client, information about a concealed index, which conceals the degree of approximation between registration input information and collation information, which is the biometric information about the person to be authenticated, the concealed index being calculated on the basis of collation information and the concealed template. The determination unit (175) generates an index obtained by decrypting the concealed index using a public key corresponding to the private key and the random number, and performs authentication on the basis of whether the generated index shows a value within a prescribed range.

Description

[Technical field]

[0001] The present disclosure relates to a recovery verification system, a matching system, a recovery verification method, and a non-transitory computer readable medium. [Background technology]

[0002] When a client logs in to a server system, authentication processing is performed to compare pre-registered registration information (secret information) of the client user with information input by the user (see Patent Documents 1, 2, 3 and 4).

[0003] In such a system, when a user loses secret information used for authentication, a process (account recovery) is performed to recover access authority. Non-Patent Document 1 issued by the FIDO (Fast ID entity Online) Alliance recommends registering templates in multiple clients, IC cards, etc. This makes it difficult for users to completely lose secret information used for authentication, and reduces the number of times account recovery is performed.

[0004] Furthermore, Non-Patent Document 1 lists two methods for account recovery when a user loses all of their templates. The first method is to perform identity verification similar to that performed when registering templates, and the second method is to register authentication information for account recovery in advance on a server and use it to perform identity verification. The first method includes, for example, a method of verifying an identification card such as a driver's license. The second method includes a method of sending a recovery code to a previously registered phone number or email address and verifying the recovery code. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2011-211593 A [Patent Document 2] JP 2009-129292 A [Patent Document 3] International Publication No. 2018 / 110608 [Patent Document 4] International Publication No. 2020 / 121461 [Non-patent literature]

[0006] [Non-Patent Document 1] Hidehito Gomi, Bill Leddy, Dean H. Saxe, “Recommended Account Recovery Practices for FIDO Relying Parties”, FIDO Alliance, 2019 Summary of the Invention [Problem to be solved by the invention]

[0007] When it comes to account recovery, verifying your identity with an ID document is generally inconvenient, while verifying your identity with a recovery code is generally insecure.

[0008] To achieve both convenience and security, the use of biometric authentication for account recovery has been proposed. However, when biometric authentication is used for account recovery, biometric features, which are personal information, must be stored as a template on the verification server used for account recovery. Therefore, if the template is leaked due to a cyber attack by malware or other such actions by an administrator, there is a risk that biometric features, which remain unchanged throughout a person's life, will be leaked. Therefore, there is a problem in that the template used for biometric authentication must be strictly protected even during authentication during account recovery.

[0009] The present disclosure has been made to solve such problems, and aims to provide a recovery verification system, a matching system, a recovery verification method, and a non-transitory computer-readable medium that are highly convenient and secure. [Means for solving the problem]

[0010] A recovery verification system according to an aspect of the present disclosure includes a template storage means, a random number generation means, an anonymization template generation means, and a determination means. The template storage means stores a template obtained by encrypting input information for enrollment, which is biometric information of a person to be enrolled, using a private key. The random number generation means generates a random number in response to a request from a client. The anonymization template generation means generates an anonymization template by anonymizing the template using the random number, and transmits the anonymization template to the client. The determination means acquires information on an anonymization index, which is an index that anonymizes a degree of similarity between input information for enrollment and matching information, which is biometric information of a person to be authenticated, from the client, the anonymization index being calculated based on the matching information and the anonymization template. The determination means then generates an index by decrypting the anonymization index using a public key corresponding to the private key and the random number, and performs authentication on the matching information based on whether the generated index indicates a value within a predetermined range.

[0011] A verification system according to one aspect of the present disclosure includes a client, a normal verification system, and a recovery verification system. The normal verification system authenticates normal verification information input for verifying normal registration input information of a person to be enrolled. The recovery verification system is a system for recovering an account related to the normal registration input information of the person to be enrolled. The recovery verification system includes a template storage means, a random number generation means, an anonymization template generation means, and a determination means. The template storage means stores a template obtained by encrypting recovery registration input information, which is biometric information of the person to be enrolled, using a private key. The random number generation means generates a random number in response to a request from a client. The anonymization template generation means generates an anonymization template by anonymizing the template using the random number, and transmits the anonymization template to the client. The determination means acquires from the client information on a concealment index, which is an index for concealing the degree of similarity between the input information for recovery registration and the recovery matching information, which is the biometric information of the person to be authenticated, and is calculated based on the recovery matching information and the concealment template. The determination means then generates an index by decrypting the concealment index using a public key corresponding to the private key and the random number, and authenticates the recovery matching information based on whether the generated index indicates a value within a predetermined range.

[0012] A recovery verification method according to an aspect of the present disclosure includes a random number generation step, an anonymization template generation step, an acquisition step, and an authentication step. The random number generation step is a step of generating a random number in response to a request from a client. The anonymization template generation step is a step of generating an anonymization template by anonymizing a template using the random number, and transmitting the anonymization template to the client. The template is obtained by encrypting input information for enrollment, which is biometric information of a person to be enrolled, using a private key. The acquisition step is a step of acquiring information on an anonymization index from the client. The anonymization index is an index that anonymizes a degree of similarity between input information for enrollment and matching information, which is biometric information of a person to be authenticated, and is calculated based on the matching information and the anonymization template. The authentication step is a step of generating an index by decrypting the anonymization index using a public key corresponding to the private key and the random number, and authenticating the matching information based on whether the generated index indicates a value within a predetermined range.

[0013] A non-transitory computer-readable medium according to an aspect of the present disclosure causes a computer to execute a random number generation process, an anonymization template generation process, an acquisition process, and an authentication process. The random number generation process is a process of generating a random number in response to a request from a client. The anonymization template generation process is a process of generating an anonymization template by anonymizing a template using the random number, and transmitting the anonymization template to the client. The template is obtained by encrypting input information for enrollment, which is biometric information of a person to be enrolled, using a private key. The acquisition process is a process of acquiring information on an anonymization index from the client. The anonymization index is an index that anonymizes a degree of similarity between input information for enrollment and matching information, which is biometric information of a person to be authenticated, and is calculated based on the matching information and the anonymization template. The authentication process is a process of generating an index by decrypting the anonymization index using a public key corresponding to the private key and the random number, and authenticating the matching information based on whether the generated index indicates a value within a predetermined range. Effect of the Invention

[0014] The present disclosure makes it possible to provide a recovery verification system, a matching system, a recovery verification method, and a non-transitory computer-readable medium that are highly convenient and secure because they are based on biometric authentication and perform matching while protecting the template. [Brief description of the drawings]

[0015] [Figure 1] FIG. 2 is a block diagram showing a functional configuration of the recovery verification system according to the first embodiment. [Diagram 2] 1 is a schematic diagram of a verification system to which the recovery verification system can be applied; [Diagram 3] FIG. 11 is a schematic configuration diagram of a normal verification system according to a second embodiment. [Figure 4] FIG. 11 is a schematic configuration diagram of a recovery verification system according to a second embodiment. [Diagram 5] FIG. 11 is a sequence diagram showing the procedure of a registration process in the normal verification system according to the second embodiment. [Figure 6] FIG. 11 is a sequence diagram showing the procedure of authentication processing in the normal verification system according to the second embodiment. [Figure 7] FIG. 11 is a sequence diagram showing a procedure of a recovery registration process of the recovery verification system according to the second embodiment. [Figure 8] FIG. 11 is a sequence diagram showing the procedure of recovery authentication processing of the recovery verification system according to the second embodiment. [Figure 9] FIG. 2 is a schematic block diagram showing an example of the configuration of a computer related to a client or a server in this embodiment or a specific example thereof. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, the present disclosure will be described through embodiments, but the invention according to the claims is not limited to the following embodiments. In addition, all of the configurations described in the embodiments are not necessarily essential as means for solving the problems. For clarity of explanation, the following description and drawings are omitted and simplified as appropriate. In each drawing, the same elements are given the same reference numerals.

[0017] <Issues of the embodiment> Here, the problem that the present embodiment is intended to solve will be explained again. One example of authentication is biometric authentication. "Biometric authentication" is a personal authentication method that verifies whether the enrollee and the authenticatee match by comparing their biometric information with each other. "Biometric information" is data extracted from certain physical or behavioral characteristics, or data generated by converting the extracted data. This data is sometimes called a feature. Here, data stored in advance for biometric authentication, including data generated from the enrollee's biometric information (hereinafter referred to as registration information), is called a template.

[0018] When performing biometric authentication using a client-server system, there are two types: one in which the template is stored on the client, and one in which the template is stored on the server.

[0019] The above-mentioned Patent Documents 1 and 2 disclose an example of an authentication device and authentication method that prevents the leakage of registered information by storing encrypted registered information as a template on a server. Also, the above-mentioned Patent Document 3 discloses a matching system that enhances security regarding binary vectors.

[0020] An example of a mode in which a template is stored in a client is the FIDO (Fast ID entity Online) authentication method. In the FIDO authentication method, a template is stored in advance in a client. Then, when biometric information of a user (person to be authenticated) currently using the client is input to the client, the client judges whether or not the person to be authenticated corresponds to a person to be registered based on the input biometric information and the template. Then, when the client judges that the person to be authenticated corresponds to a person to be registered, the server judges whether or not a signature key held by the client and a verification key (public key) held by the server are a pair of keys based on a digital signature generated by the client using a signature key (private key). That is, in the FIDO authentication method, when the client succeeds in biometric authentication and the server succeeds in verifying the client's signature, it is finally judged that authentication of the user (person to be authenticated) has been successful.

[0021] In addition, in the FIDO authentication method, data including encrypted biometric information of the person to be registered is stored in advance as a template in the client. A key for decrypting the encrypted information is also stored in the client. When the biometric information of the person to be authenticated is input to the client, the client uses the key to decrypt the encrypted text of the biometric information included in the template, and uses the decrypted biometric information and the input biometric information to determine whether the person to be authenticated corresponds to the person to be registered.

[0022] Patent Document 4 discloses a matching system in which a template is stored in a client, the client calculates an anonymization index that conceals an index indicating the similarity between the template and matching information, and the server performs authentication based on the anonymization index.

[0023] In addition, encrypted biometric information may be stored in an IC chip of an IC (Integrated Circuit) card.

[0024] However, in an authentication system, when a user loses secret information used for authentication, account recovery is required to restore access authority. Non-Patent Document 1 issued by the FIDO Alliance lists two methods for account recovery when a user loses all templates. However, as described above, there are problems in terms of convenience and security.

[0025] In order to achieve both convenience and security, it has been proposed to use biometric authentication for account recovery. However, as mentioned above, there is a need to improve security in order to reduce the risk of template leakage.

[0026] As described above, there is a problem in account recovery, namely, the compatibility of convenience and security. The present disclosure has been made to solve such a problem, and embodiments will be described below.

[0027] <Embodiment 1> First, a first embodiment of the present disclosure will be described with reference to Fig. 1. Fig. 1 is a block diagram showing a functional configuration of a recovery verification system 10 according to the first embodiment. The recovery verification system 10 is a computer system that performs authentication for account recovery. The recovery verification system 10 is communicably connected to a client 20. The client 20 is a computer device or computer system that a person to be authenticated uses for authentication.

[0028] The recovery verification system 10 includes a template storage unit 151 , a random number generation unit 153 , a concealment template generation unit 152 , and a determination unit 175 .

[0029] The template storage unit 151 stores templates. A template is information obtained by encrypting registration input information using a private key. The registration input information is biometric information of a person to be registered that is input by the person to be registered for user registration for account recovery.

[0030] The random number generator 153 generates a random number in response to an account recovery request from the client 20 .

[0031] The anonymization template generation unit 152 anonymizes the template stored in the template storage unit 151 by using the random number generated by the random number generation unit 153, and generates an anonymization template as a result. Then, the anonymization template generation unit 152 transmits the generated anonymization template to the client 20.

[0032] The determination unit 175 acquires information on the concealment index from the client 20. The concealment index is an index obtained by concealing the degree of similarity between the input information for registration and the matching information. The matching information is biometric information of the person to be authenticated that is input by the person to be authenticated for user authentication for account recovery. The concealment index is calculated in the client 20 based on the matching information and the concealment template.

[0033] Next, the determination unit 175 generates an index by decrypting the concealed index using a public key corresponding to the private key and the random number generated by the random number generation unit 153. Then, the determination unit 175 authenticates the matching information based on whether or not the generated (decrypted) index indicates a value within a predetermined range. For example, when the generated index indicates a value within the predetermined range, the determination unit 175 accepts the authentication of the matching information.

[0034] Thus, according to the first embodiment, the recovery verification system 10 is based on biometric authentication, and therefore has the same level of convenience as biometric authentication. The recovery verification system 10 performs a matching process while protecting the template. At this time, the recovery verification system 10 provides the client with a template protected by a random number generated in response to a client's request, i.e., a random number that is different for each request, so there is little risk of biometric information leaking and high security. By employing such a convenient and highly secure system for account recovery, the management costs for account recovery can be reduced.

[0035] <Embodiment 2> Next, a second embodiment of the present disclosure will be described with reference to Figures 2 to 8. Figure 2 is a schematic configuration diagram of a verification system 1 to which the recovery verification system can be applied. The verification system 1 includes a server-side system 10a and a client-side system 20a.

[0036] The server-side system 10a is a server-side computer system and includes an authentication information verification device 130, a recovery registration information storage device 150, and a recovery authentication information verification device 170.

[0037] The client-side system 20a is a client-side computer system and corresponds to the client 20 according to embodiment 1. The client-side system 20a includes a registration information generating device 110, an authentication information generating device 120, a recovery registration information generating device 140, and a recovery authentication information generating device 160.

[0038] The registration information generating device 110, the authentication information generating device 120, and the authentication information verifying device 130 are computer devices that constitute a normal verification system 2. The normal verification system 2 is a verification system that performs normal registration processing and normal authentication processing. Each device in the normal verification system 2 is connected to each other so that they can communicate with each other.

[0039] The registration information generating device 110 generates normal registration information of the person to be registered to be used in normal authentication processing, and registers the normal registration information. That is, the registration information generating device 110 executes normal registration processing. Here, the normal registration information is information obtained by encrypting secret information of the person to be registered, that is, a so-called normal template. For example, the secret information may be text data such as a password or biometric information of the person to be registered, but is not limited to these. The person to be registered may also be a user of the client-side system 20a.

[0040] The authentication information generating device 120 generates normal authentication information using the normal registration information of the person to be registered and the normal matching information of the person to be authenticated. Here, the normal matching information is information input by the person to be authenticated for matching with the normal registration information of the person to be registered. The normal authentication information is information that serves as material for determining whether or not to accept normal authentication, and is, for example, information indicating the degree of similarity between the normal registration information and the normal matching information.

[0041] The authentication information verification device 130 verifies the normal authentication information and, as a result, performs authentication on the normal verification information. The authentication information verification device 130 is also called a normal verification system.

[0042] The recovery registration information generating device 140, the recovery registration information storage device 150, the recovery authentication information generating device 160, and the recovery authentication information verifying device 170 are computer devices that constitute the recovery verification system 3. The recovery verification system 3 is a verification system that performs recovery registration processing and recovery authentication processing to recover an account related to the normal registration information of a registered person.

[0043] The recovery registration information generating device 140 uses a private key to generate recovery registration information of the person to be enrolled to be used in the recovery authentication process. The recovery registration information is information obtained by encrypting the recovery registration input information (recovery registration input information), which is the biometric information of the person to be enrolled, with a private key. In other words, the recovery registration information corresponds to the template of the first embodiment. The recovery registration information generating device 140 is communicably connected to the recovery registration information storage device 150 and the recovery authentication information verification device 170. The recovery registration information generating device 140 transmits the recovery registration information to the recovery registration information storage device 150 and the public key corresponding to the private key to the recovery authentication information verification device 170.

[0044] The recovery registration information storage device 150 stores the recovery registration information. The recovery registration information storage device 150 generates random numbers and generates a random number mask in response to a request from the recovery authentication information generation device 160. The recovery registration information storage device 150 generates recovery information using the recovery registration information and the generated random number mask. The recovery information corresponds to the concealment template of the first embodiment. The recovery registration information storage device 150 transmits the recovery information to the recovery authentication information generation device 160.

[0045] The recovery authentication information generation device 160 generates recovery authentication information using the recovery information and recovery verification information, which is the biometric information of the person to be authenticated input by the person to be authenticated. The recovery verification information corresponds to the verification information of the first embodiment. The recovery authentication information also includes information on a concealment index that conceals the degree of similarity between the recovery registration input information and the recovery verification information. The recovery authentication information generation device 160 transmits the recovery authentication information to the recovery authentication information verification device 170.

[0046] The recovery credential verification device 170 verifies the recovery credential using the public key and the random number mask in order to recover the account related to the ordinary registration information of the person to be registered, and as a result, authenticates the recovery verification information.

[0047] Moreover, the recovery registration information storage device 150 and the recovery authentication information verification device 170 correspond to the recovery verification system 10 of the first embodiment.

[0048] The various functions of the authentication information verification device 130, the recovery registration information storage device 150, and the recovery authentication information verification device 170 constituting the server-side system 10a may be implemented in a single device or in multiple devices. The same is true for the various functions of the registration information generation device 110, the authentication information generation device 120, the recovery registration information generation device 140, and the recovery authentication information generation device 160 constituting the client-side system 20a. The registration information generation device 110 may be included in the server-side system 10a instead of the client-side system 20a.

[0049] Next, the normal verification system 2 and the recovery verification system 3 will be described in detail. In the following, when referring to the process performed by the normal verification system 2 and the information used in the process, "normal" may be omitted. In this embodiment 2, a case will be described in which the recovery registration information and the recovery verification information are represented by vectors of a common dimension. In this embodiment 2, the biometric information may be extracted from a fingerprint, an iris, a retina, a face, a blood vessel (vein), a palm print, a voice print, or a combination of these. The biometric information may be extracted from other information capable of identifying a living body other than the above examples.

[0050] 3 is a schematic configuration diagram of the normal verification system 2 according to the embodiment 2. As described above, the normal verification system 2 includes the registration information generating device 110, the authentication information generating device 120, and the authentication information verifying device .

[0051] (Registration information generating device 110) The registration information generating device 110 includes a secret information input unit 111 and a registration information generating unit 112 .

[0052] The secret information input unit 111 accepts input of the secret information of the person to be registered.

[0053] The registration information generation unit 112 generates registration information and verification information from the secret information of the person to be registered input to the secret information input unit 111. For example, the registration information may be information obtained by encrypting the secret information using a secret key, and the verification information may be a public key (verification key) corresponding to a normal secret key. Also, for example, the registration information may be nonce value data of the secret information, and the verification information may be hash value data calculated based on the secret information and the registration information.

[0054] The registration information generating unit 112 then transmits the registration information to a registration information receiving unit 121 of an authentication information generating device 120 (to be described later), and transmits the verification information to a verification information receiving unit 131 of an authentication information verification device 130 (to be described later).

[0055] The secret information input unit 111 and the registration information generation unit 112 are realized by, for example, a CPU of a computer that operates according to a client program or a server program, and a communication interface of the computer. For example, the CPU reads the client program or the server program from a program recording medium such as a program storage device of the computer. Then, the CPU operates as the secret information input unit 111 and the registration information generation unit 112 using the communication interface according to the program.

[0056] (Authentication information generating device 120) The authentication information generation device 120 includes a registration information receiving unit 121 , a registration information storage unit 122 , a matching information input unit 123 , an authentication information generation unit 124 , and an output unit 125 .

[0057] The registration information receiving unit 121 receives the registration information transmitted from the registration information generating device 110 and the ID transmitted from the authentication information verifying device 130 , and stores them in the registration information storing unit 122 .

[0058] The registration information storage unit 122 is a device that stores registration information and an ID in association with each other.

[0059] Verification information input unit 123 accepts input of verification information from the person to be authenticated.

[0060] The authentication information generation unit 124 calculates authentication information to be used for verification from the registration information and the verification information. Note that a challenge-response method is adopted in the normal verification system 2 of the present embodiment 2 so as to prevent an attacker who eavesdrops on communication between the client-side system 20a and the server-side system 10a from masquerading as a client. Therefore, the authentication information generation unit 124 calculates authentication information as a response to a challenge signal. However, the normal verification system 2 does not need to adopt the challenge-response method.

[0061] The output unit 125 receives authentication result information indicating the result of authentication transmitted from the authentication information verification device 130. In addition, the output unit 125 outputs the received authentication result information to the outside of the authentication information generation device 120.

[0062] The registration information receiving unit 121, the matching information input unit 123, the authentication information generating unit 124, and the output unit 125 are realized, for example, by a CPU of a computer that operates according to a program for a client, and a communication interface of the computer. For example, the CPU reads the program for a client from a program recording medium such as a program storage device of the computer. Then, the CPU operates as the registration information receiving unit 121, the matching information input unit 123, the authentication information generating unit 124, and the output unit 125 using the communication interface according to the program.

[0063] The registration information storage unit 122 is realized, for example, by a storage device included in a computer.

[0064] (Authentication information verification device 130) The authentication information verification device 130 includes a verification information receiving unit 131 , an ID issuing unit 132 , a verification information storage unit 133 , a determination unit 134 , and a challenge generating unit 135 .

[0065] The verification information receiving unit 131 receives the verification information generated by the registration information generating device 110 and transmitted from the registration information generating device 110 , and stores the information in the verification information storage unit 133 .

[0066] The ID issuing unit 132 issues an identification number (ID) to each person to be registered, and causes the verification information storage unit 133 to store the ID.

[0067] The verification information storage unit 133 is a device that stores the verification information and the ID in association with each other.

[0068] The determination unit 134 determines whether or not the person to be registered and the person to be authenticated match based on the authentication information received from the authentication information generating device 120 and the verification information stored in the verification information storage unit 133. If the person to be registered and the person to be authenticated match, the determination unit 134 transmits authentication result information of "accepted" to the authentication information generating device 120. If the person to be registered and the person to be authenticated do not match, the determination unit 134 transmits authentication result information of "rejected" to the authentication information generating device 120.

[0069] When the authentication information generating device 120 receives the authentication result information of "accepted", it regards the authentication as successful and executes post-authentication processing corresponding to the ID. However, the device that executes the post-authentication processing is not limited to the authentication information generating device 120, and a device other than the authentication information generating device 120 may execute the post-authentication processing corresponding to the ID on the condition that the authentication result information of "accepted" is obtained.

[0070] The challenge generating unit 135 generates a challenge signal before the determining unit 134 receives the authentication information from the authentication information generating device 120, and transmits the generated challenge signal to the authentication information generating device 120. Note that a challenge-response may not be performed, and in this case, the authentication information verifying device 130 may not be provided with the challenge generating unit 135.

[0071] The verification information receiving unit 131, the ID issuing unit 132, the determining unit 134, and the challenge generating unit 135 are realized, for example, by a CPU (Central Processing Unit) of a computer that operates according to a server program, and a communication interface of the computer. For example, the CPU reads the server program from a program recording medium such as a program storage device of the computer. Then, the CPU operates as the verification information receiving unit 131, the ID issuing unit 132, the determining unit 134, and the challenge generating unit 135 using the communication interface according to the program.

[0072] The verification information storage unit 133 is realized by, for example, a storage device included in the computer.

[0073] 4 is a schematic configuration diagram of the recovery verification system 3 according to embodiment 2. As described above, the recovery verification system 3 includes a recovery registration information generating device 140, a recovery registration information storage device 150, a recovery authentication information generating device 160, and a recovery authentication information verifying device 170.

[0074] (Recovery registration information generating device 140) The recovery registration information generating device 140 includes a recovery information input unit 141 , a recovery ID input unit 142 , a key generating unit 143 , and a concealment unit 144 .

[0075] The recovery information input unit 141 may be an input device corresponding to the recovery registration input information. The recovery information input unit 141 may be an input device that extracts a vector to be the recovery registration input information from the biometric information and receives the vector as an input. The recovery information input unit 141 may also be an input device to which the vector to be the recovery registration input information is directly input. Hereinafter, the vector corresponding to the biometric information of the person to be registered input to the recovery information input unit 141 is denoted as X.

[0076] The recovery ID input unit 142 acquires the recovery ID of the person to be registered.

[0077] The key generation unit 143 generates a private key sk and a public key pk corresponding to the private key sk. The key generation unit 143 transmits the public key pk and the recovery ID to the key reception unit 171 of the recovery authentication information verification device 170.

[0078] The anonymization unit 144 generates recovery registration information using the biometric information X and the secret key sk. That is, the anonymization unit 144 functions as a template generation unit. Then, the anonymization unit 144 transmits the recovery registration information and the recovery ID to the recovery registration information storage unit 151a of the recovery registration information storage device 150.

[0079] The recovery information input unit 141, the recovery ID input unit 142, the key generation unit 143, and the anonymization unit 144 are realized, for example, by a CPU of a computer that operates according to a program for a client, and a communication interface of the computer. For example, the CPU reads the program for a client from a program recording medium such as a program storage device of the computer. Then, the CPU operates as the recovery information input unit 141, the recovery ID input unit 142, the key generation unit 143, and the anonymization unit 144 using the communication interface according to the program.

[0080] (Recovery registration information storage device 150) The recovery registration information storage device 150 includes a recovery registration information storage section 151a, a recovery information generation section 152a, and a mask generation section 153a.

[0081] The recovery registration information storage unit 151a receives the recovery registration information and the recovery ID from the recovery registration information generating device 140 and stores them. That is, the recovery registration information storage unit 151a corresponds to the template storage unit 151 of the first embodiment.

[0082] The recovery information generating unit 152a receives a recovery ID from the recovery authentication information generating device 160, and acquires recovery registration information corresponding to the recovery ID from the recovery registration information storage unit 151a. Then, the recovery information generating unit 152a generates recovery information from the recovery registration information and the random number mask R_M generated by the mask generating unit 153a, and transmits the recovery information to the recovery information receiving unit 163 of the recovery authentication information generating device 160. In other words, the recovery information generating unit 152a corresponds to the concealment template generating unit 152 of the first embodiment.

[0083] The mask generation unit 153a generates a random number mask R_M. The mask generation unit 153a corresponds to the random number generation unit 153 in the first embodiment.

[0084] The recovery registration information storage unit 151a, the recovery information generation unit 152a, and the mask generation unit 153a are realized, for example, by a CPU of a computer that operates according to a server program, and a communication interface of the computer. For example, the CPU reads the server program from a program recording medium such as a program storage device of the computer. Then, the CPU operates as the recovery registration information storage unit 151a, the recovery information generation unit 152a, and the mask generation unit 153a using the communication interface according to the program.

[0085] The recovery registration information storage unit 151a is realized by, for example, a storage device provided in a computer.

[0086] (Recovery authentication information generating device 160) The recovery authentication information generating device 160 includes a recovery verification information input unit 161 , a recovery ID input unit 162 , a recovery information receiving unit 163 , a recovery authentication information generating unit 164 , and an output unit 165 .

[0087] The recovery verification information input unit 161 may be an input device corresponding to the recovery verification information. The recovery verification information input unit 161 may be an input device into which a vector serving as the recovery verification information is directly input. The vector corresponding to the biometric information of the person to be authenticated input to the recovery verification information input unit 161 is denoted as Y.

[0088] The recovery ID input unit 162 acquires a recovery ID, and transmits the recovery ID to the recovery information generation unit 152 a of the recovery registration information storage device 150 .

[0089] The recovery information receiving unit 163 receives the recovery information from the recovery registration information storage device 150 .

[0090] The recovery authentication information generating unit 164 generates data (hereinafter, referred to as recovery authentication information) by concealing an index, which is a value indicating the degree of similarity between the biometric information X and the biometric information Y, from the biometric information Y of the person to be authenticated and the recovery information. The recovery authentication information may be determined based on the inner product of the recovery matching information and the recovery registration information. The recovery information is a value obtained by adding a random number mask R_M to the recovery registration information obtained by concealing the biometric information X of the person to be registered. The recovery authentication information generating unit 164 generates the recovery authentication information without removing the concealment of the recovery information.

[0091] Here, the recovery verification system 3 of the present embodiment 2 employs a challenge-response method to prevent an attacker who eavesdrops on communication between the client system 20a and the server system 10a from masquerading as a client. Specifically, the recovery credential verification device 170 transmits a different challenge signal to the recovery credential generation device 160 for each authentication. The recovery credential generation device 160 then calculates a response that corresponds to the challenge signal and includes the degree of approximation between the recovery information and the recovery verification information, thereby changing the response value for each authentication. As a result, even if an attacker obtains a response value by eavesdropping, the eavesdropped value cannot be used in the next recovery authentication, and the attacker cannot generate a response corresponding to another challenge, thereby preventing masquerading as a client.

[0092] Therefore, the recovery credential generating unit 164 generates recovery credential as a response to the challenge signal based on the challenge signal received from the recovery credential verification device 170 in addition to the biometric information Y and the recovery information.

[0093] The output unit 165 receives authentication result information indicating the result of the biometric authentication transmitted from the recovery authentication information verification device 170. In addition, the output unit 165 outputs the received authentication result information to the outside of the recovery authentication information generation device 160.

[0094] The recovery information receiving unit 163, the recovery authentication information generating unit 164, and the output unit 165 are realized by a CPU of a computer that operates according to a program for a client, and a communication interface of the computer. For example, the CPU reads the program for a client from a program recording medium such as a program storage device of the computer. Then, the CPU operates as the recovery information receiving unit 163, the recovery authentication information generating unit 164, and the output unit 165 using the communication interface according to the program.

[0095] The recovery verification information input unit 161 is realized by a CPU of a computer that operates according to a program for a client, and an interface of the computer. For example, the CPU may read the program for a client from a program recording medium such as a program storage device of the computer, and operate as the recovery verification information input unit 161 using the interface according to the program.

[0096] The recovery ID input unit 162 is realized by a CPU of a computer that operates according to a program for a client, and an interface and a communication interface of the computer. For example, the CPU reads the program for a client from a program recording medium such as a program storage device of the computer. Then, the CPU operates as the recovery ID input unit 162 using the interface and the communication interface according to the program.

[0097] (Recovery authentication information verification device 170) The recovery authentication information verification device 170 includes a key receiving unit 171 , a key storage unit 172 , a recovery key generating unit 173 , an acceptance range storage unit 174 , a judgment unit 175 a , and a challenge generating unit 176 .

[0098] The key receiving unit 171 receives the public key pk and the recovery ID from the recovery registration information generating device 140 .

[0099] The key storage unit 172 stores the public key pk and the recovery ID in association with each other.

[0100] The recovery key generating unit 173 generates a recovery verification key pk′ using the public key pk corresponding to the recovery ID received from the recovery authentication information generating device 160 and the random number mask R_M received from the recovery registration information storage device 150.

[0101] The judgment unit 175a judges whether the recovery authentication information received from the recovery authentication information generating device 160 is within a predetermined acceptance range by using the recovery verification key pk′, thereby judging whether the person to be registered and the person to be authenticated match. The predetermined acceptance range is stored in the acceptance range storage unit 174.

[0102] That is, if the recovery authentication information is a value within the acceptable range, the judgment unit 175a judges that the person to be registered and the person to be authenticated match. A match between the person to be registered and the person to be authenticated corresponds to a correspondence between the recovery verification information and the recovery registration information. Moreover, if the recovery authentication information is not a value within the acceptable range, the judgment unit 175a judges that the person to be registered and the person to be authenticated do not match. That is, the judgment unit 175a corresponds to the judgment unit 175 of the first embodiment.

[0103] If the person to be registered and the person to be authenticated match, the judgment unit 175a sends authentication result information of "accepted" to the recovery authentication information generating device 160. If the person to be registered and the person to be authenticated do not match, the judgment unit 175a sends authentication result information of "rejected" to the recovery authentication information generating device 160. When the recovery authentication information generating device 160 receives the authentication result information of "accepted", it regards the authentication as successful and executes the post-authentication process corresponding to the recovery ID. However, the device that executes the post-authentication process is not limited to the recovery authentication information generating device 160, and a device other than the recovery authentication information generating device 160 may execute the post-authentication process corresponding to the recovery ID on the condition that the authentication result information of "accepted" is obtained.

[0104] The challenge generating unit 176 generates a challenge signal for each authentication, i.e., for each piece of recovery verification information, and transmits the generated challenge signal to the recovery authentication information generating device 160 before the determining unit 175a receives the recovery authentication information from the recovery authentication information generating device 160.

[0105] The key receiving unit 171, the recovery key generating unit 173, the determining unit 175a, and the challenge generating unit 176 are realized by, for example, a CPU of a computer that operates according to a server program, and a communication interface of the computer. For example, the CPU reads the server program from a program recording medium such as a program storage device of the computer. Then, the CPU operates as the key receiving unit 171, the recovery key generating unit 173, the determining unit 175a, and the challenge generating unit 176 using the communication interface according to the program.

[0106] The key storage unit 172 and the acceptance range storage unit 174 are realized, for example, by a storage device provided in the computer.

[0107] Next, the process of the normal verification system 2 will be described with reference to FIGS. 5 is a sequence diagram showing the procedure of the registration process of the normal verification system 2 according to the embodiment 2. Note that detailed explanations of matters that have already been explained will be omitted.

[0108] First, the secret information input unit 111 of the registration information generating device 110 accepts input of secret information by the person to be registered and acquires the secret information (step S10). Next, the registration information generating unit 112 of the registration information generating device 110 generates registration information and verification information from the secret information (step S12). Next, the registration information generating unit 112 of the registration information generating device 110 transmits the verification information to the authentication information verification device 130 (step S13).

[0109] In response to receiving the verification information, the verification information receiving unit 131 of the authentication information verification device 130 stores the verification information in the verification information storage unit 133 (step S14).

[0110] Moreover, the registration information generating unit 112 of the registration information generating device 110 transmits the registration information to the registration information receiving unit 121 of the authentication information generating device 120 (step S16).

[0111] In response to receiving the registration information, the registration information receiving unit 121 of the authentication information generating device 120 stores the registration information in the registration information storage unit 122 (step S16).

[0112] Next, the ID issuing unit 132 of the authentication information verification device 130 issues an ID (step S17). Then, the ID issuing unit 132 transmits the ID to the registration information receiving unit 121 of the authentication information generation device 120 (step S18).

[0113] Next, in response to receiving the ID, the registration information receiving unit 121 of the authentication information generating device 120 stores the ID in the registration information storage unit 122 in association with the registration information (step S19).

[0114] Furthermore, the verification information storage unit 133 of the authentication information verification device 130 stores the ID in association with the registration information (step S20).

[0115] FIG. 6 is a sequence diagram showing a procedure of an authentication process of the normal verification system 2 according to the second embodiment.

[0116] First, the matching information input unit 123 of the authentication information generation device 120 accepts the input of matching information by the person to be authenticated and acquires the matching information (step S30). Next, the authentication information generation device 120 transmits the ID stored in the registration information storage unit 122 to the judgment unit 134 of the authentication information verification device 130 (step S31).

[0117] In response to receiving the ID, the determination unit 134 of the authentication information verification device 130 acquires verification information corresponding to the ID from the verification information storage unit 133 (step S32). Next, the challenge generation unit 135 of the authentication information verification device 130 generates a challenge (step S33). Next, the challenge generation unit 135 transmits the challenge to the authentication information generation device 120 (step S34).

[0118] The authentication information generation unit 124 of the authentication information generation device 120 that has received the challenge acquires registration information from the registration information storage unit 122 (step S35). Next, the authentication information generation unit 124 generates authentication information as a response (step S36). Next, the authentication information generation unit 124 transmits the authentication information to the authentication information verification device 130 (step S37).

[0119] In response to receiving the authentication information, the determination unit 134 of the authentication information verification device 130 performs a comparison between the authentication information and the verification information (step S38). Next, the determination unit 134 transmits authentication result information indicating the comparison result to the authentication information generation device 120 (step S39).

[0120] In response to receiving the authentication result information, the output unit 125 of the authentication information generation device 120 outputs the authentication result (step S40).

[0121] Next, the process of the recovery verification system 3 will be described with reference to FIGS. FIG. 7 is a sequence diagram showing a procedure of the recovery registration process of the recovery verification system 3 according to the second embodiment.

[0122] First, the recovery information input unit 141 of the recovery registration information generating device 140 accepts the input of the biometric information X of the person to be enrolled by the person to be enrolled, and acquires the biometric information X (step S50). Next, the recovery ID input unit 142 of the recovery registration information generating device 140 accepts the input of the recovery ID by the person to be enrolled, and acquires the recovery ID (step S51). The recovery registration information generating device 140 transmits the recovery ID to the recovery registration information storage unit 151a of the recovery registration information storage device 150 and the key receiving unit 171 of the recovery authentication information verification device 170 (step S52).

[0123] In response to receiving the recovery ID, the recovery registration information storage device 150 and the recovery authentication information verification device 170 store the recovery ID in the recovery registration information storage section 151a and the key storage section 172, respectively (step S53).

[0124] Meanwhile, the key generating unit 143 of the recovery registration information generating device 140 generates a random number (step S54). Then, the key generating unit 143 generates a secret key sk and a public key pk based on the random number (step S55). Next, the concealment unit 144 of the recovery registration information generating device 140 generates recovery registration information from the biometric information X and the secret key sk (step S56). The recovery registration information is also called a template. The key generating unit 143 transmits the public key pk to the key receiving unit 171 of the recovery authentication information verifying device 170 (step S57).

[0125] Upon receiving the public key pk, the key receiving unit 171 of the recovery authentication information verification device 170 stores the public key pk in the key storage unit 172 (step S58).

[0126] On the other hand, the concealment unit 144 of the recovery registration information generating device 140 transmits the recovery registration information to the recovery registration information storage device 150 (step S59).

[0127] In response to receiving the recovery registration information, the recovery registration information storage device 150 stores the recovery registration information in the recovery registration information storage section 151a (step S60).

[0128] FIG. 8 is a sequence diagram showing the procedure of the recovery authentication process of the recovery verification system 3 according to the second embodiment.

[0129] First, the recovery ID input unit 162 of the recovery authentication information generating device 160 accepts the input of the recovery ID by the person to be authenticated, and obtains the recovery ID (step S70). Next, the recovery verification information input unit 161 of the recovery authentication information generating device 160 accepts the input of the biometric information Y of the person to be authenticated by the person to be authenticated, and obtains the biometric information Y (step S71). Next, the recovery ID input unit 162 transmits the recovery ID to the recovery registration information storage device 150 (step S72).

[0130] In response to receiving the recovery ID, the recovery information generating unit 152a of the recovery registration information storage device 150 acquires the recovery registration information corresponding to the recovery ID from the recovery registration information storage device 151a (step S73). Next, the mask generating unit 153a of the recovery registration information storage device 150 generates a random number mask (step S74). The mask generating unit 153a transmits the recovery ID and the random number mask to the recovery authentication information verification device 170 (steps S75, 76). As a result, the recovery key generating unit 173 of the recovery authentication information verification device 170 receives the recovery ID and the random number mask.

[0131] Next, the recovery information generating unit 152a of the recovery registration information storage device 150 generates recovery information from the recovery registration information and the random number mask (step S77). The recovery information is also called a concealment template. The recovery information generating unit 152a transmits the recovery information to the recovery authentication information generating device 160 (step S78). As a result, the recovery information receiving unit 163 of the recovery authentication information generating device 160 receives the recovery information.

[0132] Next, the recovery key generation unit 173 of the recovery credential verification device 170 obtains the public key pk corresponding to the recovery ID from the key storage unit 172 (step S79). Next, the recovery key generation unit 173 generates the recovery verification key pk' using the public key pk and the random number mask R_M (step S80). Next, the challenge generation unit 176 of the recovery credential verification device 170 generates a challenge (step S81) and transmits the challenge to the recovery credential generation unit 164 of the recovery credential generation device 160 (step S82).

[0133] In response to receiving the challenge, the recovery credential generating unit 164 of the recovery credential generating device 160 generates recovery credential from the biometric information Y, the recovery information, and the challenge (step S83). Next, the recovery credential generating unit 164 transmits the recovery credential to the determining unit 175a of the recovery credential verifying device 170 (step S84).

[0134] In response to receiving the recovery authentication information, the judgment unit 175a of the recovery authentication information verification device 170 checks whether the recovery authentication information contains an index included in the acceptance range by using the recovery verification key pk′ and the challenge (step S85). The judgment unit 175a also transmits authentication result information indicating the check result to the output unit 165 of the recovery authentication information generation device 160 (step S86).

[0135] Next, the output unit 165 of the recovery authentication information generating device 160 outputs the authentication result in response to receiving the authentication result information (step S87). After that, if the authentication (matching) is successful, a process of recovering the registered information is executed.

[0136] A specific example of the process of the recovery matching system 3 of the second embodiment will be described below. In the following description, both the biometric information X and the biometric information Y are n-dimensional vectors. Each element of X is expressed as X=(x_1, x_2, ..., x_n), and each element of Y is expressed as Y=(y_1, y_2, ..., y_n). The symbol i represents 1, 2, ..., n. For example, {u_i}=u_1, u_2, ..., u_n.

[0137] (Specific examples) In this specific example, a specific recovery registration process and recovery authentication process will be described when a Schnorr signature is used. In this specific example, a case will be considered in which an index showing the closeness between biometric information X and biometric information Y is the inner product of biometric information X and biometric information Y. The inner product of biometric information X and biometric information Y<X,Y> is Σ(x_i·y_i). Below, we show an example of processing when the index is an inner product.

[0138] In this specific example, Schnorr signature is used. In Schnorr signature, a pair of a private key sk and a public key pk=g^sk is generated. Note that sk∈Z_q (Z_q={0,1,...,q-1}, q is a prime number) (Z is a symbol representing the set of all integers). Also, g is a generator of a group G of order q. That is, G={g_0,g_1,...,g_q-1}. Z_q, g, and G are shared among all devices.

[0139] Furthermore, the recovery credential verification device 170 is given an acceptance range Θ={θ_1, ..., θ_m}. The acceptance range storage unit 174 of the recovery credential verification device 170 stores Θ'={g^(θ_1), ..., g^(θ_m)}. Note that Θ' is a set of powers of g with each value of Θ as an exponent.

[0140] In addition, it is assumed that the registration process and authentication process by the normal verification system 2 of this specific example involves general authentication such as ID and password authentication, and therefore a description thereof will be omitted. A specific recovery registration process by the recovery verification system 3 when the Schnorr signature is used will be described below.

[0141] First, the biometric information X of the person to be enrolled is input to the recovery information input unit 141. Next, the recovery ID is input to the recovery ID input unit 142. Next, the key generation unit 143 generates random numbers according to the following formulas (1) to (4).

[0142] R_1 ← ^RZ_q (1) R_2←^RZ_q (2) R_3←^RZ_q (3) (r_1,r_2,…,r_n)←^RZ_q ···(4)

[0143] The key generation unit 143 regards R_3 as a private key and generates a public key g^(R_3) based on the private key. The key generation unit 143 also regards {r_i} and the random numbers R_1 and R_2 as an anonymization key. The anonymization key is a unique key unique to each person to be enrolled, i.e., each piece of biometric information X.

[0144] The key generation unit 143 inputs the private key R_3 and the anonymization keys {r_i}, R_1, and R_2 to the anonymization unit 144. In addition, the key generation unit 143 transmits the recovery ID, the public key g^(R_3), and the anonymization keys R_1 and R_2 to the key reception unit 171 of the recovery authentication information verification device 170.

[0145] Next, the key storage unit 172 stores the received recovery ID, the public key, and the anonymization keys R_1 and R_2 in association with each other.

[0146] Next, the anonymization unit 144 of the recovery registration information generating device 140 generates R_1·x_i+R_2·r_i+R_3 and g^(r_i) for i=1,2,...,n based on the input private key, anonymization key, and biometric information X. Hereinafter, the templates are defined as {R_1·x_i+R_2·r_i+R3} and {g^(r_i)}.

[0147] The concealment unit 144 transmits the recovery ID and the template to the recovery registration information storage unit 151a of the recovery registration information storage device 150. Then, the recovery registration information storage unit 151a stores the recovery ID and the template, and ends the recovery registration process.

[0148] It should be noted that the recovery registration information storage device 150 that holds the templates does not hold the anonymization key and the public key in order to reduce security risks.

[0149] Next, a specific recovery authentication process by the recovery verification system 3 when the Schnorr signature is used will be described.

[0150] First, the recovery authentication information generating device 160 transmits the recovery ID to the recovery registration information storage device 150 .

[0151] Next, the recovery information generating section 152a acquires a template corresponding to the recovery ID from the recovery registration information storage section 151a.

[0152] Here, the recovery information generating unit 152a transmits {g^r_i} to the recovery authentication information verification device 170 in order to conceal {g^r_i}.

[0153] Next, the recovery authentication information verification device 170 generates a random number according to the following formula (5).

[0154] (r'_1,r'_2,···,r'_n)←^RZ_q···(5)

[0155] Next, the recovery authentication information verification device 170 calculates {g^(r_i+r'_i)} and {r'_i·R_2}, and transmits them to the recovery enrollment information storage device 150.

[0156] Next, the recovery information generating unit 152a of the recovery registration information storage device 150 receives {g^(r_i+r'_i)} and {r'_i·R_2}.

[0157] Next, the mask generating unit 153a generates random numbers according to the following equations (6) to (8).

[0158] R'_1←^RZ_q (6) R'_2←^RZ_q (7) R'_3←^RZ_q (8)

[0159] Next, the recovery information generator 152a generates {R'_1·R_1·x_i+R'_1·R_2·(r_i+r'_i)+R'_1·R_3+R'_3} and {g^(r_i+r'_i)·(1 / R'_2)} as the recovery information.

[0160] Next, the mask generation unit 153a transmits the masks R'_1, R'_2, and R'_3 to the recovery key generation unit 173 of the recovery authentication information verification device 170. As a result, the recovery key generation unit 173 receives the masks R'_1, R'_2, and R'_3.

[0161] Next, the recovery information generating unit 152a of the recovery registration information storage device 150 transmits the recovery information to the recovery information receiving unit 163 of the recovery authentication information generating device 160. As a result, the recovery information receiving unit 163 of the recovery authentication information generating device 160 receives the recovery information.

[0162] Next, the biometric information Y of the person to be authenticated is input to the recovery verification information input unit 161. The recovery authentication information generation unit 164 acquires the biometric information Y from the recovery verification information input unit 161.

[0163] Next, the recovery credential generation unit 164 calculates σ_1=g^(Σ(r_i+r'_i)·y_i)·(1 / R'_2). After that, the recovery credential generation unit 164 transmits the recovery ID and σ_1 to the judgment unit 175a of the recovery credential verification device 170.

[0164] Next, the recovery credential verification device 170, which has received the recovery ID and σ_1, generates M, R ← ^RZ_q in the challenge generation unit 176. Then, the recovery credential verification device 170 calculates g^(R·(R'_1·R_3+R'_3)) using the public key g^(R_3) and masks R'_1 and R'_3 stored in the key storage unit 172. After that, it transmits M, g^(R·(R'_1·R_3+R'_3)) to the recovery credential generation unit 164 of the recovery credential generation device 160 as a challenge.

[0165] Next, the recovery authentication information generating unit 164 calculates S=H(M, g^r), where H is a cryptographic hash function. Next, the recovery authentication information generating unit 164 calculates the following values ​​from the input biometric information Y and the template using formulas (9) to (11).

[0166] A=Σ_i(R'_1·R_1·x_i+R'_1·R_2·(r_i+r'_i)+R'_1·R3+R'_3)·y_i ···(9) σ2=rA·S··(10) σ_3=g^(R·(R'_1·R_3+R'_3)·y_i) ···(11)

[0167] After calculating each value, the recovery credential generation unit 164 transmits (S, σ_2, σ_3) to the judgment unit 175a of the recovery credential verification device 170 as a response including the inner product of the biometric information X and the biometric information Y. (S, σ_2, σ_3) corresponds to a Schnorr signature with A as a private key.

[0168] The judgment unit 175a receives a response from the recovery authentication information generation unit 164. The judgment unit 175a verifies the digital signatures S, σ_2, and σ_3 using the public key g^(R_3) stored together with the recovery ID in the key storage unit 172, the anonymization keys R_1 and R_2, and the masks R'_1 and R'_2. Specifically, the following formula (12) is calculated.

[0169] v=[{g^(σ_2)}·{(σ_3)^(S·R)}·{(σ_1)^(S·R'_1·R_2·R'_2)}·(g^(-r))]^(-1 / R_1·R'_1) ···(12)

[0170] The determination unit 175a checks whether the calculated v is included in Θ'. If v is not included in Θ', the determination unit 175a generates authentication result information indicating "authentication failed." On the other hand, if v is included in Θ', the determination unit 175a generates authentication result information indicating "authentication successful."

[0171] Next, the judgment unit 175a transmits the generated authentication result information to the output unit 165 of the recovery authentication information generating device 160. Next, the output unit 165 that has received the authentication result information outputs the authentication result information. If the authentication is successful, the access right to the ID of the person to be authenticated is restored, and the person to be authenticated executes the normal registration process.

[0172] Although Schnorr signature is used in this specific example, other cryptographically secure digital signature methods such as DSA signature may be used.

[0173] In this specific example, the key storage unit 172 of the recovery credential verification device 170 stores a unique anonymization key and a public key for each piece of biometric information X. The mask generation unit 153a of the recovery registration information storage device 150 functions as a first random number generation unit that generates a first random number in response to a request from a client. The recovery credential verification device 170 also functions as a second random number generation unit that generates a second random number in response to a request from a client, and generates a key (anonymized unique key) that further anonymizes the anonymized key using the second random number. The recovery information generation unit 152a of the recovery registration information storage device 150 generates recovery information that anonymizes the template using the first random number and the anonymized unique key. The judgment unit 175a of the recovery credential verification device 170 uses the public key, the first random number, and the unique key as a recovery verification key to decrypt the anonymization index included in the response.

[0174] With this configuration, the storage location of the anonymization key and the storage location of the template can be managed separately, thereby reducing security risks.

[0175] In the second embodiment and its specific example, the verification system 1 uses biometric authentication for account recovery, which allows verification while protecting a template. The biometric authentication according to the second embodiment is more convenient than a method of verifying identity using an ID card, and is more secure than a method of verifying identity using a recovery code. Therefore, the verification system 1 is a system that reduces the management cost of the server-side system 10a and reduces the risk of leakage of biometric information, including during account recovery.

[0176] The verification system 1 may execute only the recovery registration process and the recovery authentication process. For example, the verification system 1 may be configured with a recovery registration information generating device 140, a recovery registration information storage device 150, a recovery authentication information generating device 160, and a recovery authentication information verifying device 170.

[0177] Fig. 9 is a schematic block diagram showing an example of the configuration of a computer related to a client and a server in the above embodiment and its specific example. In the following description, the computer used as a client and the computer used as a server are separate computers.

[0178] The computer 1000 includes a CPU 1001 , a main memory device 1002 , an auxiliary memory device 1003 , an interface 1004 , and a communication interface 1005 .

[0179] The operation of computer 1000 that realizes the client is stored in the form of a client program in auxiliary storage device 1003. CPU 1001 reads the client program from auxiliary storage device 1003, loads it in main storage device 1002, and executes the client operation described in the above embodiment and specific examples in accordance with the client program.

[0180] The operation of computer 1000 that realizes the server is stored in the form of a server program in auxiliary storage device 1003. CPU 1001 reads the server program from auxiliary storage device 1003, loads it in main storage device 1002, and executes the server operation described in the above embodiment and specific examples in accordance with the server program.

[0181] The auxiliary storage device 1003 is an example of a non-transient tangible medium. Other examples of non-transient tangible media include a magnetic disk, a magneto-optical disk, a CD-ROM (Compact Disk Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), and a semiconductor memory connected via the interface 1004. In addition, when a program is distributed to the computer 1000 via a communication line, the computer 1000 that receives the program may load the program into the main storage device 1002 and operate according to the program.

[0182] Furthermore, some or all of the components of the client may be realized by general-purpose or dedicated circuits, processors, etc., or a combination of these. These may be configured by a single chip, or by multiple chips connected via a bus. Some or all of the components may be realized by a combination of the above-mentioned circuits, etc., and programs. The same applies to the server.

[0183] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. (Appendix 1) a template storage means for storing a template obtained by encrypting input information for enrollment, which is biometric information of a person to be enrolled, using a private key; A random number generating means for generating random numbers in response to a request from a client; an anonymization template generating means for generating an anonymization template by anonymizing the template using the random number and transmitting the anonymization template to the client; Judgment means and Equipped with The determination means is acquiring, from the client, information on a concealment index which is an index of concealing a degree of similarity between input information for enrollment and matching information which is biometric information of a person to be authenticated, the concealment index being calculated based on the matching information and the concealment template; A public key corresponding to the private key and the random number are used to generate an index by decrypting the concealed index, and the matching information is authenticated based on whether the generated index indicates a value within a predetermined range. Recovery verification system. (Appendix 2) The determination means accepts authentication of the matching information when the generated index indicates a value within a predetermined range. 2. The recovery verification system of claim 1. (Appendix 3) The apparatus further includes a challenge generating means for generating a challenge signal for each of the verification information and transmitting the challenge signal to the client; The client is configured to calculate the concealment indicator as a response to the challenge signal. 3. A verification system for recovery according to claim 1 or 2. (Appendix 4) The registration input information and the matching information are both represented by vectors. 4. A verification system for recovery according to any one of claims 1 to 3. (Appendix 5) The anonymization index is determined based on an inner product of the matching information and the anonymization template. 5. A recovery verification system according to any one of claims 1 to 4. (Appendix 6) A key storage means for storing a unique key for each piece of registration input information, The random number generation means a first random number generating means for generating a first random number in response to the request from the client; a second random number generating means for generating a second random number in response to the request from the client; having the anonymization template generation means generates the anonymization template by using the first random number and an anonymization unique key obtained by anonymizing the unique key by using the second random number; The determination unit generates an index by decrypting the concealment index using the public key, the first random number, and the unique key. 6. A verification system for recovery according to any one of claims 1 to 5. (Appendix 7) With the client, A normal verification system that authenticates normal verification information input for verifying the normal registration input information of a person to be registrant; a recovery verification system for recovering an account associated with the regular registration input information of the person to be registered; A matching system comprising: The recovery verification system includes: a template storage means for storing a template obtained by encrypting the enrollment input information for recovery, which is the biometric information of the person to be enrolled, using a private key; A random number generating means for generating random numbers in response to a request from the client; an anonymization template generating means for generating an anonymization template by anonymizing the template using the random number and transmitting the anonymization template to the client; Judgment means and Equipped with The determination means is acquiring, from the client, information on a concealment index which is an index of concealment of a degree of similarity between the enrollment input information for recovery and the recovery matching information which is biometric information of the person to be authenticated, the concealment index being calculated based on the recovery matching information and the concealment template; A public key corresponding to the private key and the random number are used to generate an index by decrypting the concealment index, and the recovery verification information is authenticated based on whether the generated index indicates a value within a predetermined range. Matching system. (Appendix 8) The client: a key generating means for generating the private key and the public key; a template generating means for generating the template using the private key; having The key generation means transmits the public key to the recovery verification system. A matching system as described in Appendix 7. (Appendix 9) a random number generation stage for generating random numbers in response to a client request; an anonymization template generation stage in which an anonymization template is generated by anonymizing a template using the random number and transmitting the anonymization template to the client, the template being generated by enrollment input information, which is biometric information of a person to be enrolled, encrypted using a secret key; acquiring, from the client, information on a concealment index, which is an index of concealment of a degree of similarity between input information for enrollment and matching information, which is biometric information of a person to be authenticated, the concealment index being calculated based on the matching information and the concealment template; an authentication step of generating an index by decrypting the concealment index using a public key corresponding to the private key and the random number, and authenticating the matching information based on whether the generated index indicates a value within a predetermined range; Equipped Recovery verification method. (Appendix 10) A random number generation process for generating random numbers in response to a client request; an anonymization template generation process for generating an anonymization template by anonymizing a template using the random number and transmitting the anonymization template to the client, the template being generated by enrollment input information, which is biometric information of a person to be enrolled, encrypted using a secret key; acquiring, from the client, information on a concealment index, which is an index of concealment of a degree of similarity between input information for enrollment and matching information, which is biometric information of a person to be authenticated, the concealment index being calculated based on the matching information and the concealment template; an authentication process of generating an index by decrypting the concealment index using a public key corresponding to the private key and the random number, and authenticating the matching information based on whether the generated index indicates a value within a predetermined range; A non-transitory computer-readable medium on which a program for causing a computer to execute the above is stored.

[0184] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the invention. [Industrial Applicability]

[0185] The present disclosure is suitably applied to a matching system that performs biometric authentication using a client and a server. [Explanation of symbols]

[0186] 1. Matching System 2. Regular Verification System 3. Recovery Matching System 10 Recovery Verification System 10a Server-side system 20 clients 20a Client-side system 110 Registration information generating device 111 Secret information input section 112 Registration information generation unit 120 Authentication information generating device 121 Registration Information Receiving Department 122 Registration information storage unit 123 Matching information input section 124 Authentication information generation unit 125,165 Output section 130 Authentication information verification device 131 Verification information receiving unit 132 ID issuing department 133 Verification information storage unit 134,175,175a Judgment section 135,176 Challenge Generation Unit 174 Acceptance range memory unit 140 Recovery registration information generating device 141 Recovery information input section 142 Recovery ID input section 143 Key generation section 144 Concealment Department 150 Recovery registration information storage device 151 Template memory section 151a Recovery registration information storage unit 153 Random Number Generator 153a Mask generation unit 152 Concealment template generation unit 152a Recovery information generation unit 160 Recovery authentication information generation device 161 Recovery verification information input section 162 Recovery ID input section 163 Recovery Information Receiving Unit 164 Recovery Credentials Generation Unit 170 Recovery authentication information verification device 171 Key receiver 172 Key storage unit 173 Recovery key generation unit 1000 Computers 1001 CPU 1002 Main storage 1003 Auxiliary storage device 1004 Interface 1005 Communication Interface

Claims

1. a template storage means for storing a template obtained by encrypting input information for enrollment, which is biometric information of a person to be enrolled, using a private key; A random number generating means for generating random numbers in response to a request from a client; an anonymization template generating means for generating an anonymization template by anonymizing the template using the random number and transmitting the anonymization template to the client; A determination means; A key storage means for storing a unique key for each piece of registration input information; Equipped with The determination means is acquiring, from the client, information on a concealment index which is an index of concealing a degree of similarity between input information for enrollment and matching information which is biometric information of a person to be authenticated, the concealment index being calculated based on the matching information and the concealment template; generating an index by decrypting the concealment index using a public key corresponding to the private key and the random number, and authenticating the matching information based on whether the generated index indicates a value within a predetermined range; The random number generation means a first random number generating means for generating a first random number in response to the request from the client; a second random number generating means for generating a second random number in response to the request from the client; having the anonymization template generation means generates the anonymization template by using the first random number and an anonymization unique key obtained by anonymizing the unique key by using the second random number; The determination means generates an index by decrypting the concealment index using the public key, the first random number, and the unique key. Recovery verification system.

2. The determination means accepts authentication of the matching information when the generated index indicates a value within a predetermined range.

2. The recovery verification system of claim 1.

3. The apparatus further includes a challenge generating means for generating a challenge signal for each of the verification information and transmitting the challenge signal to the client; The client is configured to calculate the concealment indicator as a response to the challenge signal.

3. A recovery verification system according to claim 1 or 2.

4. The registration input information and the matching information are both represented by vectors. A recovery verification system according to any one of claims 1 to 3.

5. The anonymization index is determined based on an inner product of the matching information and the anonymization template. A recovery verification system according to any one of claims 1 to 4.

6. With the client, A normal verification system that authenticates normal verification information input for verifying the normal registration input information of a person to be registrant; a recovery verification system for recovering an account associated with the regular registration input information of the person to be registered; A matching system comprising: The recovery verification system includes: a template storage means for storing a template obtained by encrypting the enrollment input information for recovery, which is the biometric information of the person to be enrolled, using a private key; A random number generating means for generating random numbers in response to a request from the client; an anonymization template generating means for generating an anonymization template by anonymizing the template using the random number and transmitting the anonymization template to the client; A determination means; A key storage means for storing a unique key for each piece of registration input information; Equipped with The determination means is acquiring, from the client, information on a concealment index which is an index of concealment of a degree of similarity between the enrollment input information for recovery and the recovery matching information which is biometric information of the person to be authenticated, the concealment index being calculated based on the recovery matching information and the concealment template; generating an index by decrypting the concealment index using a public key corresponding to the private key and the random number, and authenticating the recovery verification information based on whether the generated index indicates a value within a predetermined range; The random number generation means a first random number generating means for generating a first random number in response to the request from the client; a second random number generating means for generating a second random number in response to the request from the client; having the anonymization template generation means generates the anonymization template by using the first random number and an anonymization unique key obtained by anonymizing the unique key by using the second random number; The determination means generates an index by decrypting the concealment index using the public key, the first random number, and the unique key. Matching system.

7. The client: a key generating means for generating the private key and the public key; a template generating means for generating the template using the private key; having The key generation means transmits the public key to the recovery verification system. The verification system according to claim 6.

8. a random number generation stage for generating random numbers in response to a client request; an anonymization template generation stage in which an anonymization template is generated by anonymizing a template using the random number and transmitting the anonymization template to the client, the template being generated by enrollment input information, which is biometric information of a person to be enrolled, encrypted using a secret key; an acquisition step of acquiring, from the client, information on a concealment index, which is an index of concealment of a degree of similarity between input information for enrollment and matching information, which is biometric information of a person to be authenticated, the concealment index being calculated based on the matching information and the concealment template; an authentication step of generating an index by decrypting the concealment index using a public key corresponding to the private key and the random number, and authenticating the matching information based on whether the generated index indicates a value within a predetermined range; The random number generating step includes the steps of generating a first random number in response to the request of the client, and generating a second random number in response to the request of the client, the anonymization template generating step includes a step of generating the anonymization template by using the first random number and an anonymization unique key obtained by anonymizing a unique key that is unique to each piece of registration input information by using the second random number, The authentication step includes a step of generating an index by decrypting the concealment index using the public key, the first random number, and the unique key. Recovery verification method.

9. A random number generation process for generating random numbers in response to a client request; an anonymization template generation process for generating an anonymization template by anonymizing a template using the random number and transmitting the anonymization template to the client, the template being generated by enrollment input information, which is biometric information of a person to be enrolled, encrypted using a secret key; an acquisition process of acquiring, from the client, information on a concealment index, which is an index of concealment of a degree of similarity between input information for enrollment and matching information, which is biometric information of a person to be authenticated, the concealment index being calculated based on the matching information and the concealment template; generating an index by decrypting the concealment index using a public key corresponding to the private key and the random number, and authenticating the matching information based on whether the generated index indicates a value within a predetermined range; the random number generation process includes a process of generating a first random number in response to the request from the client, and a process of generating a second random number in response to the request from the client, the anonymization template generation process includes a process of generating the anonymization template by using the first random number and an anonymization unique key obtained by anonymizing a unique key that is unique to each piece of registration input information by using the second random number, The authentication process includes a process of generating an index by decrypting the concealment index using the public key, the first random number, and the unique key. program.

Images