Template management system and template management method

Abstract

To enable only users themselves who have registered templates to download the templates, and to make it difficult for people other than the users themselves to download the templates.SOLUTION: A key recovery terminal transmits a message requesting transmission of a template generated based on a user's biometric information for registration, and the user's collation information for first verification to a first server. The first server holds the user's collation information for first registration and the template, and transmits the template to the key recovery terminal if first verification processing based on the collation information for first verification and the collation information for first registration is successful. The key recovery terminal acquires the user's biometric information for key recovery and restores a private key based on the template and the biometric information for key recovery. If the first server fails in the first verification processing, the first server refuses to transmit the template to the key recovery terminal.SELECTED DRAWING: Figure 1A

Description

[Technical field]

[0001] The present invention relates to a template management system and a template management method. [Background technology]

[0002] Biometric encryption is a known method of recovering a private key using biometric information and performing cryptographic processes such as encryption, decryption, signature generation, and authentication using the recovered private key.

[0003] In a biometric encryption registration process, a registration terminal generates a template and a private key based on a user's biometric information and stores the generated template in a DB (Data Base). In order to perform cryptographic processing using the private key, a key recovery terminal acquires biometric information from the user again, receives the template stored in the DB, and recovers the private key generated in the registration process from the biometric information and the template. JP 2020-67719 A (Patent Document 1) is a background technique related to a system using such a biometric encryption method.

[0004] This publication states that "an attribute information management system having a server device and one or more client devices, wherein any one of the client devices generates a pair of a public key and a private key, generates a public template for a user including the public key and a private key in which inputted biometric information of the user is embedded by one-way conversion, and transmits the generated public template to the server device, the server device retains the public template, and when a user's attribute information is inputted, any one of the client devices attaches the user's digital signature to the attribute information using the private key, transmits the attribute information with the digital signature attached to the server device, and the server device retains the attribute information with the digital signature attached in association with the public template" (see abstract). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2020-67719 A Summary of the Invention [Problem to be solved by the invention]

[0006] Because templates are generated from biometric information, it is desirable, from the standpoint of privacy, for the template to be difficult for anyone other than the user who registered it to download. However, the technology described in Patent Document 1 allows a user to download a template that the user has not registered.

[0007] Therefore, one aspect of the present invention is to make it possible for only the user who registered a template to download the template, and to make it difficult for anyone other than the user to download the template. [Means for solving the problem]

[0008] In order to solve the above problems, one aspect of the present invention employs the following configuration: A template management system includes a key recovery terminal and a first server, the first server holds first registration matching information of a user and a template generated based on the registration biometric information of the user, the key recovery terminal generates first verification matching information of the user and executes a first request process of transmitting a message requesting transmission of the template and the first verification matching information to the first server, the first server executes a first verification process based on the first verification matching information and the first registration matching information, and transmits the template to the key recovery terminal if the first verification process is successful, the key recovery terminal acquires the key recovery biometric information of the user and restores a private key based on the template and the key recovery biometric information, and the first server refuses to transmit the template to the key recovery terminal if the first verification process is unsuccessful. Effect of the Invention

[0009] According to one aspect of the present invention, only the user who registered the template can download the template, making it difficult for anyone other than the user to download the template.

[0010] Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0011] [Figure 1A] 1 is a block diagram showing an example of a functional configuration of a personal data management system according to a first embodiment. [Figure 1B] 1 is a block diagram showing an example of a functional configuration of a personal data management system according to a first embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of the hardware configuration of a computer constituting each device included in the personal data management system 10 in the first embodiment. [Diagram 3] FIG. 11 is a sequence diagram illustrating an example of a first matching information registration process in the first embodiment. [Figure 4] FIG. 11 is a sequence diagram illustrating an example of a template registration process according to the first embodiment. [Diagram 5] FIG. 11 is a sequence diagram illustrating an example of a second matching information registration process according to the first embodiment. [Figure 6] FIG. 11 is a sequence diagram illustrating an example of a personal data registration process according to the first embodiment. [Figure 7A] FIG. 11 is a sequence diagram illustrating an example of a personal data output process in the first embodiment. [Figure 7B] FIG. 11 is a sequence diagram illustrating an example of a personal data output process in the first embodiment. [Figure 8] 13 is an example of a processing result display screen displayed on a display screen in the first embodiment. [Figure 9] 13 is an example of a processing result display screen displayed on a display screen in the first embodiment. [Figure 10A] FIG. 11 is a block diagram showing an example of a functional configuration of a personal data management system according to a second embodiment. [Figure 10B] FIG. 11 is a block diagram showing an example of a functional configuration of a personal data management system according to a second embodiment. [Figure 11] FIG. 11 is a sequence diagram illustrating an example of a personal data registration process according to the second embodiment. [Figure 12A] FIG. 11 is a sequence diagram illustrating an example of a personal data output process in the second embodiment. [Figure 12B] FIG. 11 is a sequence diagram illustrating an example of a personal data output process in the second embodiment. [Figure 13] FIG. 11 is a block diagram showing an example of a functional configuration of a personal data management system according to a third embodiment. [Figure 14] FIG. 13 is a sequence diagram illustrating an example of a personal data output process according to the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention. EXAMPLES

[0013] In the first embodiment, a personal data management system via a network will be described. The personal data management system manages personal data including templates. Personal data is any data related to a user. Data related to certificates such as a driver's license, passport, resident's card, graduation certificate, course completion certificate, vaccination certificate, medical or physical examination result certificate, etc. issued to a user, and data such as documents, drawings, images, or voices owned by the user are all examples of personal data.

[0014] 1A and 1B are block diagrams showing an example of the functional configuration of a personal data management system. The personal data management system 10 includes, for example, a first matching information registration terminal 1100, a template registration terminal 1200, a second matching information registration terminal 1300, a personal data registration terminal 1400, a key recovery terminal 1500, a first server 1600, a second server 1700, a public key DB (DataBase) 91, a first matching information DB 92, a template DB 93, a second matching information DB 94, and a personal data DB 95.

[0015] Due to drawing space limitations, FIG. 1A omits illustration of the functional sections of the public key DB 91, the first matching information DB 92, the template DB 93, the second matching information DB 94, and the personal data DB 95, and FIG. 1B omits illustration of the functional sections of the first matching information registration terminal 1100, the template registration terminal 1200, the second matching information registration terminal 1300, the personal data registration terminal 1400, and the key recovery terminal 1500, but both FIG. 1A and FIG. 1B show the same functional configuration example of the same personal data management system 10.

[0016] The first matching information registration terminal 1100, the template registration terminal 1200, the second matching information registration terminal 1300, the personal data registration terminal 1400, the key recovery terminal 1500, the first server 1600, the second server 1700, and the public key DB 91 are connected to each other via a network 51. The first server 1600, the first matching information DB 92, and the template DB 93 are connected to each other via a network 52. The second server 1700, the second matching information DB 94, and the personal data DB 95 are connected to each other via a network 53.

[0017] The Internet, a local network within an organization, and the like are all examples of the network 51, the network 52, and the network 53. Each of the network 51, the network 52, and the network 53 may be wired or wireless.

[0018] 1A and 1B, the networks connected to the devices in the personal data management system 10 are configured with the network 51, the network 52, and the network 53, but this is not necessarily the case. For example, only one of the network 51, the network 52, and the network 53 may exist, and all the devices included in the personal data management system 10 may be connected to that one network.

[0019] However, in order to prevent unauthorized downloading of templates by anyone other than the user who registered the template, it is desirable to take measures that make it difficult to download templates from template DB 93 without going through first server 1600.

[0020] Specifically, for example, the following measures can be taken. Prior to communication, authentication is performed between the template DB 93 and the first server 1600 to confirm that the destination of the template from the template DB 93 is indeed the first server 1600. Furthermore, for example, the template DB 93 may transmit to the first server 1600 an encrypted template that can only be decrypted by the first server 1600. Furthermore, for example, the system may be configured such that the first server 1600 includes the template DB 93.

[0021] It is also desirable to take measures similar to those described above so that it is difficult to download personal data without going through the second server 1700. In addition, if it is undesirable for the first registration verification information to be leaked outside the first server 1600 (for example, when the first registration verification information is a password), it is also desirable to take similar measures for the first registration verification information. The same applies to the second registration verification information.

[0022] The first matching information registration terminal 1100 includes, for example, a first matching information registration terminal communication unit 101, a first registration matching information generation unit 102, and a first ID generation unit 103, all of which are functional units. The first matching information registration terminal communication unit 101 communicates with a device connected to the first matching information registration terminal 1100. The first registration matching information generation unit 102 generates first registration matching information. The first ID generation unit 103 generates a first ID.

[0023] The template enrollment terminal 1200 includes, for example, a template enrollment terminal communication unit 201, a key pair generation unit 202, a registration biometric information acquisition unit 203, a template generation unit 204, and a first ID acquisition unit 205, all of which are functional units. The template enrollment terminal communication unit 201 communicates with a device connected to the template enrollment terminal 1200. The key pair generation unit 202 generates, for example, a key pair of a private key and a public key. The registration biometric information acquisition unit 203 acquires biometric information for enrollment of a user. The template generation unit 204 generates a template based on the biometric information. The first ID acquisition unit 205 acquires the first ID.

[0024] The second matching information registration terminal 1300 includes, for example, a second matching information registration terminal communication unit 301, a second registration matching information generation unit 302, and a second ID generation unit 303, all of which are functional units. The second matching information registration terminal communication unit 301 communicates with a device connected to the second matching information registration terminal 1300. The second registration matching information generation unit 302 generates second registration matching information. The second ID generation unit 303 generates a second ID.

[0025] The personal data registration terminal 1400 includes, for example, a personal data registration terminal communication unit 401, a first ID acquisition unit 402, a personal data acquisition unit 403, a personal data conversion unit 404, and a second ID acquisition unit 405, which are all functional units. The personal data registration terminal communication unit 401 communicates with a device connected to the personal data registration terminal 1400. The first ID acquisition unit 402 acquires a first ID. The personal data acquisition unit 403 acquires personal data. The personal data conversion unit 404 performs a predetermined conversion on the personal data. The second ID acquisition unit 405 acquires a second ID.

[0026] The key restoration terminal 1500 is a terminal that restores the private key generated by the template enrollment terminal 1200 and then outputs the personal data registered by the personal data enrollment terminal 1400. The key restoration terminal 1500 includes, for example, a key restoration terminal communication unit 501, a first ID acquisition unit 502, a first verification matching information generation unit 503, a key restoration biometric information acquisition unit 504, a private key restoration unit 505, a second ID acquisition unit 506, a second verification matching information generation unit 507, a personal data restoration unit 508, and a result output unit 509, all of which are functional units.

[0027] The key recovery terminal communication unit 501 communicates with a device connected to the key recovery terminal 1500. The first ID acquisition unit 502 acquires the first ID. The first verification matching information generation unit 503 generates first verification matching information. The key recovery biometric information acquisition unit 504 acquires the user's biometric information for recovering the key. The private key recovery unit 505 recovers the private key based on the biometric information. The second ID acquisition unit 506 acquires the second ID. The second verification matching information generation unit 507 generates second verification matching information. The personal data recovery unit 508 recovers the converted personal data. The result output unit 509 outputs the recovery result of the personal data.

[0028] The first server 1600 includes, for example, a first server communication unit 601, a first verification unit 602, and a first transmission permission determination unit 603, which are all functional units. The first server communication unit 601 communicates with a device connected to the first server 1600. The first transmission permission determination unit 603 determines whether or not to transmit a template based on the template DB 93.

[0029] The second server 1700 includes, for example, a second server communication unit 701, a second verification unit 702, and a second transmission permission determination unit 703, which are all functional units. The second server communication unit 701 communicates with a device connected to the first server 1600. The second transmission permission determination unit 703 determines whether or not to transmit the converted personal data by the personal data DB 95.

[0030] The public key DB 91 includes, for example, a public key DB communication unit 911 and a public key storage unit 912, both of which are functional units. The public key DB communication unit 911 communicates with a device connected to the public key DB 91. The public key storage unit 912 stores a public key.

[0031] The first matching information DB 92 includes, for example, a first matching information DB communication unit 921 and a first registration matching information storage unit 922, both of which are functional units. The first matching information DB communication unit 921 communicates with a device connected to the first matching information DB 92. The first registration matching information storage unit 922 stores the first registration matching information.

[0032] The template DB 93 includes, for example, a template DB communication unit 931 and a template DB storage unit 932, both of which are functional units. The template DB communication unit 931 communicates with a device connected to the template DB 93. The template DB storage unit 932 stores templates.

[0033] The second matching information DB 94 includes, for example, a second matching information DB communication unit 941 and a second registration matching information storage unit 942, both of which are functional units. The second matching information DB communication unit 941 communicates with a device connected to the second matching information DB 94. The second registration matching information storage unit 942 stores the second registration matching information.

[0034] The personal data DB 95 includes, for example, a personal data DB communication unit 951 and a converted personal data storage unit 952, both of which are functional units. The personal data DB communication unit 951 communicates with a device connected to the personal data DB 95. The converted personal data storage unit 952 stores the converted personal data.

[0035] 2 is a block diagram showing an example of the hardware configuration of a computer constituting each device included in the personal data management system 10 in Example 1. The computer 70 has, for example, a CPU (Control Processing Unit) 71, a memory 72, an auxiliary storage device 73, an input device 74, an output device 75, a communication device 76, and a reading device 77.

[0036] The CPU 71 includes a processor and executes programs stored in the memory 72. The memory 72 includes a ROM (Read Only Memory), which is a non-volatile storage element, and a RAM (Random Access Memory), which is a volatile storage element. The ROM stores immutable programs (e.g., a Basic Input / Output System (BIOS)). The RAM is a high-speed, volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by the CPU 71 and data used when the programs are executed.

[0037] The auxiliary storage device 73 is a large-capacity non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or a flash memory (SSD (Solid State Drive)), and stores the programs executed by the CPU 71 and data used when the programs are executed. That is, the programs are read from the auxiliary storage device 73, loaded into the memory 72, and executed by the CPU 71.

[0038] The input device 74 is a device such as a keyboard or a mouse that receives input from an operator. The output device 75 is a device such as a display device or a printer that outputs the results of program execution in a format that can be viewed by the operator.

[0039] The communication device 76 is a network interface device that controls communication with other devices according to a predetermined protocol. The communication device 76 may also include a serial interface such as a Universal Serial Bus (USB).

[0040] A part or all of the programs executed by the CPU 71 may be provided to the computer 70 from a removable medium (such as a CD-ROM or a flash memory) which is a non-transitory storage medium, or from an external computer equipped with a non-transitory storage device via a network, and may be stored in a non-volatile auxiliary storage device 73 which is a non-transitory storage medium. The reading device 77 is an interface device which reads data from the removable medium.

[0041] Each device included in the personal data management system 10 is a computer system configured on one physical computer, or on multiple logically or physically configured computers, and may operate in separate threads on the same computer, or may operate on a virtual computer constructed on multiple physical computer resources.

[0042] It is preferable that the computer 70 constituting the template enrollment terminal 1200 and the computer 70 constituting the key recovery terminal 1500 each have a sensor for acquiring biometric information.

[0043] 1A and 1B are stored in a CPU 71 of a computer 70 constituting an apparatus including the functional units. For example, the CPU 71 included in the computer 70 constituting the first matching information registration terminal 1100 functions as a first matching information registration terminal communication unit 101 by operating according to a first matching information registration terminal communication program loaded into a memory 72 included in the computer 70, and functions as a first registration matching information generation unit 102 by operating according to a first registration matching information generation program loaded into the memory 72.

[0044] The same relationship exists between the programs and the functional units of the other functional units included in the CPU 71 of the computer 70 constituting the first matching information registration terminal 1100. The same relationship exists between the programs and the functional units of the functional units included in the CPU 71 of the computer 70 constituting each of the devices other than the first matching information registration terminal 1100 included in the personal data management system 10.

[0045] In addition, some or all of the functions of the functional units of the devices included in the personal data management system 10 may be realized by hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array).

[0046] In addition, some or all of the information stored in the auxiliary storage device 73 of the computer 70 constituting each device included in the personal data management system 10 may be stored in the memory 72 of the computer 70, or may be stored in a database outside the personal data management system 10 connected to the computer 70 as necessary.

[0047] In this embodiment, the information used by the personal data management system 10 does not depend on the data structure and may be expressed in any data structure. In this embodiment, the information is expressed in a table format, but the information can be stored in a data structure appropriately selected from, for example, a list, a database, or a queue.

[0048] An example of processing by the personal data management system 10 in this embodiment will be described below. The personal data management system 10 first executes a first matching information registration process related to a user, a template registration process, and a second matching information registration process.

[0049] Next, the personal data management system 10 executes a personal data registration process to register the personal data owned by the user. Next, the personal data management system 10 executes a personal data output process.

[0050] For example, data on certificates such as driver's licenses, passports, resident cards, graduation certificates, course completion certificates, vaccination certificates, medical or physical examination result certificates, etc. are examples of personal data. When the personal data is any of these data, the user to whom the data is issued is an example of the personal data owner. Information stored by an individual, such as a password, is also an example of personal data. A first ID and a second ID are generated for each user. The first ID and the second ID for a certain user may be related values ​​(for example, the same value, or a value obtained by inputting the first ID into a predetermined injective function), or may be unrelated values.

[0051] 3 is a sequence diagram showing an example of the first matching information registration process. When multiple users use the personal data management system 10, the personal data management system 10 performs the first matching information registration process for each of the multiple users. This also applies to the template registration process, the second matching information registration process, and the personal data registration process described later, in that the process is performed for each of the multiple users.

[0052] In step S11101, the first registration matching information generating unit 102 generates first registration matching information. A specific example of the process in step S11101 will be described later. In step S11102, the first ID generating unit 103 generates a first ID of a user to be processed in the first matching information registration process. The first ID is used to link the template, the first registration matching information, and some or all of the public key.

[0053] The first ID generation unit 103 may, for example, generate the first ID randomly or according to a predetermined rule, or may generate the first ID by the user to be processed inputting the first matching information registration terminal 1100 to obtain the first ID.

[0054] Also, for example, the first server 1600, rather than the first matching information registration terminal 1100, may create the first ID and transmit it to the first matching information registration terminal 1100. If necessary, the terminal that generates the first ID may notify the target user of the first ID by displaying the generated first ID on a display, which is an example of the output device 75 of the key recovery terminal 1500.

[0055] In step S11103, the first matching information registration terminal communication unit 101 transmits to the first server 1600 the first registration matching information generated in step S11101 and the first ID generated in step S11102.

[0056] In step S11601, first server communication unit 601 transmits the first registration matching information and the first ID transmitted in step S11101 to first matching information DB 92. If first matching information registration terminal 1100 and first matching information DB 92 are directly connected via a network, instead of the processes of steps S11103 and S11601, first matching information registration terminal communication unit 101 may directly transmit the first registration matching information and the first ID to first matching information DB 92. Similarly, from this point onwards, in a process in which the terminal transmits data to be stored in a DB via a server, the terminal may transmit the data directly to the DB without going through the server.

[0057] In step S19201, the first registration matching information storage section 922 associates the first registration matching information transmitted in step S11601 with the first ID and stores them in the auxiliary storage device 73 of the computer 70 constituting the first matching information DB 92.

[0058] Fig. 4 is a sequence diagram showing an example of the template registration process. Below, an example will be described in which the first matching information registration process for the template registration process target user is completed before the process of Fig. 4. However, the first matching information registration process and the template registration process may be executed simultaneously (in parallel).

[0059] In step S21201, the key pair generation unit 202 generates a pair of a private key and a public key. The key pair generation unit 202 can generate a key pair using any algorithm according to the cryptographic processing executed by the key recovery terminal 1500, for example.

[0060] The key pair generation unit 202 generates a key pair using a key pair generation algorithm in any encryption method, such as RSA encryption or ElGamal encryption, or a key pair generation algorithm in any signature method, such as RSA signature, RSA-FDH (Full Domain Hash) signature, ElGamal signature, Schnorr signature, or Waters signature.

[0061] Alternatively, the key pair generating unit 202 may generate a key pair (sk1, pk1) consisting of a data encryption public key pk1 and a data decryption private key sk1, and a key pair (sk2, pk2) consisting of a digital signature generation private key sk2 and a digital signature verification public key pk2, and determine the key pair (sk, pk) in step S21201 by sk:=(sk1, sk2) and pk:=(pk1, pk2). As in this example, the key pair generating unit 202 generates the data decryption private key sk1 and the digital signature generation private key sk2 separately, which has the effect of improving the difficulty of inferring one of data related to encryption processing (e.g., encrypted data, a data encryption public key, etc.) and data related to digital signature processing (e.g., data to be signed, a digital signature, a digital signature verification public key, etc.) from the other.

[0062] In addition, the key pair generating unit 202 may generate a private key using the biometric information for registration acquired in step S21202 described later, and then calculate a corresponding public key to generate a key pair. The method by which the key pair generating unit 202 generates a key pair is not limited to the above-mentioned method, and any method may be used.

[0063] Furthermore, when a private key at the time of registration is generated in the template generation process in step S21203 described later, the key pair generating unit 202 may generate a key pair using this private key at the time of registration. Such a method will be described later.

[0064] In step S21202, the registration biometric information acquiring unit 203 acquires registration biometric information from a target user of the template registration process. For example, biometric information acquired from one or more arbitrary parts such as a face, a fingerprint, a palm print, or finger veins is an example of the biometric information to be acquired in step S21202.

[0065] In step S21203, the template generating unit 204 generates a template by performing processing including the registration processing of the biometric encryption method using the registration biometric information acquired in step S21202. A specific example of the template generation processing will be described later.

[0066] In step S21204, the first ID acquisition unit 205 acquires the first ID of the user who is the target of the template registration process. Specifically, for example, the first ID acquisition unit 205 acquires the first ID that the user who is the target of the template registration process inputs to the template registration terminal 1200. Note that if the template registration terminal 1200 has already obtained the first ID of the user who is the target of the template registration process, such as when the first matching information registration terminal 1100 and the template registration terminal 1200 are the same terminal, the first ID acquisition process of step S21204 is omitted.

[0067] In step S21205, the template registration terminal communication unit 201 transmits the template generated in step S21203 and the first ID acquired in step S21204 to the first server 1600. In step S21601, the first server communication unit 601 transmits the first ID and template transmitted in step S21205 to the template DB 93. In step S29301, the template DB storage unit 932 associates the first ID and template transmitted in step S21601 with each other, and stores them in the auxiliary storage device 73 of the computer 70 constituting the template DB 93.

[0068] In step S21206, the template registration terminal communication unit 201 transmits the public key generated in step S21201 and the first ID acquired in step S21204 to the public key DB 91. In step S29101, the public key storage unit 912 associates the public key and the first ID transmitted in step S21206 with each other, and stores them in the auxiliary storage device 73 of the computer 70 constituting the public key DB 91.

[0069] Note that, prior to the template registration process, the template registration terminal 1200 may execute first verification matching information generation process at step S51503 in Fig. 7A described below and first verification matching information transmission process at step S51504 in Fig. 7A described below, and the first server 1600 may execute the first verification process at step S51602 in Fig. 7A described below, and the template registration process may be executed only if the verification result in step S51602 is "successful". By doing this, only the person who registered the first registration verification information can execute the template registration process.

[0070] Note that the personal data management system 10 may register, for each user who is a target of the template registration process, a plurality of templates generated from a plurality of pieces of biometric information acquired from the same body part or different body parts in the template DB 93.

[0071] 5 is a sequence diagram showing an example of the second matching information registration process. In step S31301, the second matching information for registration generating unit 302 generates second matching information for registration. A specific example of the second matching information for registration generating process will be described later.

[0072] In step S31302, the second ID generation unit 303 generates a second ID of the user to be processed in the second matching information registration process. The second ID generation unit 303 can generate the second ID by using, for example, any of the methods described above as examples of the first ID generation method. In addition, the second ID generation unit 303 may determine the second ID of the user to be processed in the second matching information registration process as a value that is the same as or related to the first ID of the user (for example, a value obtained by inputting the first ID into a predetermined injective function), or may determine the second ID as an unrelated value. The second ID generation unit 303 may notify the user to be processed in the second matching information registration process of the second ID as necessary.

[0073] In step S31303, second matching information registration terminal communication unit 301 transmits the second registration matching information generated in step S31301 and the second ID generated in step S31302 to second server 1700. In step S31701, second server communication unit 701 transmits the second registration matching information and the second ID transmitted in step S31303 to second matching information DB 94. In step S39401, second registration matching information storage unit 942 associates the second registration matching information transmitted in step S31701 with the second ID and stores them in auxiliary storage device 73 of computer 70 constituting second matching information DB 94.

[0074] Fig. 6 is a sequence diagram showing an example of a personal data registration process. Hereinafter, a user who operates the personal data registration terminal 1400 is also called a personal data registration terminal operating user. The personal data registration terminal operating user does not necessarily have to be the same as the personal data owner. In addition, the personal data management system 10 can register multiple pieces of personal data owned by a certain user by executing the personal data registration process multiple times.

[0075] In step S41401, the first ID acquisition unit 402 acquires the first ID of the personal data owner. Specifically, for example, the first ID acquisition unit 402 acquires the first ID of the personal data owner inputted to the input device 74 of the personal data registration terminal 1400 by the personal data registration terminal operating user.

[0076] In step S41402, the personal data registration terminal communication unit 401 transmits to the public key DB 91 a message requesting transmission of the public key and the first ID acquired in step S41401.

[0077] In step S49101, the public key DB communication unit 911 obtains the public key corresponding to the first ID transmitted in step S41402 from the auxiliary storage device 73 of the computer 70 that constitutes the public key DB 91, and transmits it to the personal data registration terminal 1400.

[0078] In step S41403, the personal data acquisition unit 403 acquires personal data. Specifically, the personal data acquisition unit 403 may generate the personal data in step S41403, the personal data registration terminal 1400 may generate the personal data before step S41403, or another device may generate the personal data and transmit it to the personal data registration terminal 1400 before step S41403.

[0079] In step S41404, the personal data conversion section 404 converts the personal data acquired in step S41403 to generate converted personal data. A specific example of the personal data conversion process will be described later.

[0080] In step S41405, the second ID acquisition unit 405 acquires the second ID of the personal data owner. Specifically, for example, the second ID acquisition unit 405 acquires the second ID of the personal data owner input by the personal data registration terminal operating user to the input device 74 of the computer 70 constituting the personal data registration terminal 1400. Note that if the personal data registration terminal 1400 has already acquired the second ID, such as when the second matching information registration terminal 1300 and the personal data registration terminal 1400 are the same device, the second ID acquisition process in step S41405 is omitted.

[0081] In step S41406, the personal data registration terminal communication unit 401 transmits the second ID acquired in step S41401 and the converted personal data generated in step S41406 to the second server 1700. In step S41701, the second server communication unit 701 transmits the second ID and the converted personal data transmitted in step S41406 to the personal data DB 95. In step S49501, the converted personal data storage unit 952 associates the second ID and the converted personal data transmitted in step S41701 with each other and stores them in the auxiliary storage device 73 of the computer 70 constituting the personal data DB 95.

[0082] Figures 7A and 7B are sequence diagrams showing an example of a personal data output process. Due to space limitations, the personal data output process is shown separately in Figures 7A and 7B, but the personal data output process is a series of processes in which the process in Figure 7A is executed followed by the process in Figure 7B. Hereinafter, the user who operates the key recovery terminal 1500 is also called the key recovery terminal operating user. The personal data owned by the key recovery terminal operating user is output by the personal data output process.

[0083] In step S51501, the first ID acquisition unit 502 acquires the first ID of the user who operates the key recovery terminal. Specifically, for example, the first ID acquisition unit 502 acquires the first ID that the user who operates the key recovery terminal inputs to the input device 74 of the computer 70 that constitutes the key recovery terminal 1500.

[0084] In step S51502, the key recovery terminal communication unit 501 transmits a message requesting transmission of a template and the first ID acquired in step S51501 to the first server 1600. In step S51601, the first server communication unit 601 transmits a message requesting transmission of first registration matching information and the first ID transmitted in step S51502 to the first matching information DB 92. In step S59201, the first matching information DB communication unit 921 acquires first registration matching information corresponding to the first ID transmitted in step S51601 from the auxiliary storage device 73 of the computer 70 constituting the first matching information DB 92, and transmits it to the first server 1600.

[0085] In step S51503, the first verification matching information generating unit 503 generates first verification matching information. A specific example of the first verification matching information generating process will be described later. In step S51504, the key recovery terminal communication unit 501 transmits the first verification matching information generated in step S51503 to the first server 1600. In step S51602, the first verification unit 602 performs the first verification process using the first registration matching information and the first verification matching information. A specific example of the first verification process will be described later.

[0086] In step S51603, the first transmission permission determining unit 603 determines whether or not to transmit the template. Specifically, for example, the first transmission permission determining unit 603 determines "transmission permission" when it determines that the result of the first verification process in step S51602 is "success", and determines "transmission refusal" when it determines that the result of the first verification process in step S51602 is "failure". When the first transmission permission determining unit 603 determines "transmission refusal", the personal data management system 10 proceeds to the process of step S51605 described later without executing the processes of steps S51604 and S59301.

[0087] In step S51604, the first server communication unit 601 transmits a message requesting transmission of a template and the first ID transmitted in step S51502 to the template DB 93. In step S59301, the template DB communication unit 931 transmits, to the first server 1600, the template corresponding to the first ID transmitted in step S51604.

[0088] In step S51605, the first server communication unit 601 transmits a first response, as defined below, to the key recovery terminal 1500. When the result of step S51603 indicates "transmission permitted", the first response includes the template transmitted in step S59301. When the result of step S51603 indicates "transmission rejected", the first response includes a message indicating that transmission is rejected.

[0089] In addition, when a plurality of templates of the key recovery terminal operating user are registered in the template DB 93, the templates to be transmitted may be a part or all of the plurality of templates. In addition, the first server 1600 or the like may select the template to be transmitted, or the first server 1600 may transmit a list of registered templates to the key recovery terminal 1500, and the key recovery terminal 1500 may output the list of registered templates to the output device 75 of the computer 70 constituting the key recovery terminal 1500, and the key recovery terminal operating user may select a template to be transmitted.

[0090] When a message to the effect that the transmission is rejected is sent in step S51605, the personal data management system 10 does not execute the processes from step S51505 to step S51511, and proceeds to the process of step S51512.

[0091] In step S51505, the key restoration biometric information acquisition unit 504 acquires key restoration biometric information from the user who operates the key restoration terminal. In step S51506, the private key restoration unit 505 restores the private key by performing processing including the private key restoration processing of the biometric encryption method using the template transmitted in step S51605 and the key restoration biometric information acquired in step S51506. A specific example of the private key restoration processing will be described later.

[0092] In step S51507, the second ID acquisition unit 506 acquires the second ID of the user who operates the key recovery terminal. In step S51508, the key recovery terminal communication unit 501 transmits to the second server 1700 a message requesting transmission of the converted personal data and the second ID acquired in step S51507.

[0093] In addition, when a plurality of pieces of personal data whose owner is the key restoration terminal operating user are registered in the personal data DB 95, the key restoration terminal 1500 may allow the key restoration terminal operating user to select one or more pieces of the plurality of personal data and request transmission of the selected converted personal data. For the selection, the personal data DB 95 may hold, for example, a list of registered personal data whose owner is the key restoration terminal operating user, and transmit the list to the key restoration terminal 1500 via the second server 1700 or directly in response to a request from the key restoration terminal 1500.

[0094] Also, the second server 1700 is not necessarily shared by all users. For example, the personal data of each user may be stored in different online storage services. In such a case, the key recovery terminal 1500 needs to identify the location information of the second server 1700, which is the destination.

[0095] For example, if the second server 1700 is a server for an online storage service, the URL (Uniform Resource Locator) of the server is an example of location information of the second server 1700. Also, if the location of the second server 1700 can be specified from the name of the service, the name of the service is also an example of location information of the second server 1700. For this purpose, the key recovery terminal 1500 may have the user operating the key recovery terminal input location information of the second server 1700, for example.

[0096] In step S51701, the second server communication unit 701 transmits to the personal data DB 95 a message requesting transmission of second registration matching information, and the second ID transmitted in step S51508.

[0097] In step S59401, the second matching information DB communication unit 941 transmits the second registration matching information corresponding to the second ID transmitted in step S51701 to the second server 1700. In step S51509, the second verification matching information generation unit 507 generates second verification matching information for the target user. A specific example of the second verification matching information generation process will be described later. In step S51510, the key recovery terminal communication unit 501 transmits the second verification matching information generated in step S51509 to the second server 1700.

[0098] In step S51702, the second verification unit 702 performs a second verification process using the second registration verification information transmitted in step S59401 and the second verification verification information transmitted in step S51510. A specific example of the second verification process will be described later.

[0099] In step S51703, the second transmission permission determining unit 703 determines whether or not to transmit the converted personal data. Specifically, the second transmission permission determining unit 703 determines "transmission permission" when it determines that the result of the second verification process in step S51702 is "success", and determines "transmission refusal" when it determines that the result of the second verification process in step S51702 is "failure". When the second transmission permission determining unit 703 determines "transmission refusal", the personal data management system 10 proceeds to the process of step S51705 without executing the processes of steps S51704 and S59501.

[0100] In step S51704, the second server communication unit 701 transmits to the personal data DB 95 a message requesting the converted personal data and the second ID transmitted in step S51508.

[0101] In step S59501, the personal data DB communication unit 951 obtains the converted personal data corresponding to the second ID transmitted in step S51704 from the auxiliary storage device 73 of the computer 70 that constitutes the personal data DB 95, and transmits it to the second server 1700.

[0102] In step S51705, the second server communication unit 701 transmits a second response, as defined below, to the key recovery terminal 1500. When the result of step S51703 indicates "transmission permitted", the second response includes the converted personal data transmitted in step S59501. When the result of step S51703 indicates "transmission rejected", the second response includes a message indicating that transmission is rejected. Note that when a message indicating transmission rejected is transmitted in step S51705, the key recovery terminal 1500 proceeds to step S51512 without executing the process of step S51511.

[0103] In step S51511, the personal data restoration unit 508 restores the personal data from the converted personal data transmitted in step S51705. A specific example of the personal data restoration process will be described later. In step S51512, the result output unit 509 performs a process of outputting the processing result. A specific example of the result output process will be described later.

[0104] Next, a specific example of each process will be described. A specific example of the template generation process in step S21203 and the private key recovery process in step S51506 is as follows.

[0105] A first specific example of the template generation process in step S21203 and the private key recovery process in step S51506 will be described. This specific example is an example of a method in which, in the template generation process in step S21203, the template generation unit 204 generates an enrollment private key s_E by the enrollment process of the biometric encryption method, and then includes data generated from s_E and the private key sk generated in step S21201 in the template.

[0106] In step S21203, first, the template generating unit 204 extracts a feature for enrollment x_E ("_" indicates a subscript) from the biometric information for enrollment. For example, the template generating unit 204 extracts the feature for enrollment using an arbitrary feature extraction algorithm according to the type of biometric information.

[0107] Next, the template generating unit 204 performs a biometric encryption method registration process using x_E, and generates a registration time private key s_E and auxiliary information c_E. The template generating unit 204 can use any method such as Fuzzy Extractor, Fuzzy Signature, Fuzzy Vault, or Fuzzy Commitment as the biometric encryption method. Depending on the method, the auxiliary information c_E is data that is also called Helper Data, Helper String, Sketch, or the like.

[0108] Then, template generation unit 204 performs encryption processing in an arbitrary common key cryptosystem on private key sk generated in step S21201 using s_E as a key, to obtain encrypted private key Enc(sk). Instead of using the common key cryptosystem, template generation unit 204 may generate a public key corresponding to s_E and then use the public key cryptosystem. Also, when private key sk is divided into a plurality of elements (for example, private key sk1 for data decryption and private key sk2 for digital signature generation), template generation unit 204 may perform encryption by dividing it into each element. Then, template generation unit 204 determines template T as data including c_E and Enc(sk).

[0109] Template generation unit 204 may or may not include data called a pseudo-identifier in the template for verifying whether the private key has been correctly restored during key restoration. A predetermined function value such as a hash value of a private key or a public key corresponding to a private key is an example of a pseudo-identifier. In the following examples as well, the template may or may not include a pseudo-identifier.

[0110] Next, in the private key recovery process in step S51506, first, the private key recovery unit 505 extracts the key recovery feature x_A from the key recovery biometric information, and performs the private key recovery process in the biometric encryption method used in step S21203 using x_A and the auxiliary information c_E included in the template T to recover s_E. When x_E and x_A are sufficiently close, the recovery is successful, and the private key recovery unit 505 can verify whether the recovery is successful using the pseudo identifier. Then, the private key recovery unit 505 uses the recovered s_E to perform the decryption process on the encrypted private key Enc(sk) to recover the private key sk.

[0111] Below, we will use formulas to explain an example of a method for generating the enrollment private key s_E and auxiliary information c_E through enrollment processing in a biometric encryption method, which are used in the template generation processing in step S21203, and a method for restoring the enrollment private key s_E through key recovery processing in a biometric encryption method, which are used in the private key recovery processing in step S51506.

[0112] The feature x_E is an element of a set X, and the enrollment private key s_E is an element of a set S. The set S is a linear space and is a subset of the set X.

[0113] As a method of generating the registration private key s_E, for example, the template generation unit 204 may randomly select an element of the set S as s_E. As another example, the template generation unit 204 may determine s_E as a value obtained by substituting x_E into a predetermined function. Specifically, for example, the template generation unit 204 may select, as s_E, an element of the set S that is closest to x_E.

[0114] Furthermore, template generation unit 204 may express x_E as a linear combination of the bases of set S, and then determine s_E by rounding the coefficients so that x_E becomes an element of set S. Furthermore, key pair generation unit 202 may calculate a function value such as a hash value of x_E, and then convert the obtained function value into an element of S to determine s_E.

[0115] Alternatively, the template generating unit 204 may perform the calculation in the above example and then perform a predetermined process such as multiplying the result by a constant to determine s_E. Note that the present invention is not limited to these examples, and the key pair generating unit 202 may determine s_E by substituting a value into a predetermined function that uses at least one of the enrollment biometric information, a random number, and a preset constant as an argument and returns an element of S.

[0116] The auxiliary information c_E is generated, for example, by the template generating unit 204 performing a concealment process using x_E and s_E. Specifically, for example, the template generating unit 204 determines c_E defined by c_E:=x_E+s_E as the auxiliary information.

[0117] In one example of a method for restoring the enrollment private key s_E in the private key restoration process in step S51506, the private key restoration unit 505 first extracts a key restoration feature x_A from the key restoration biometric information. Then, the private key restoration unit 505 calculates the private key s_A by s_A:=f_1(c_E-x_A). Note that f_1(x) for an element x of X is a value obtained by an error correction process for x (i.e., a process of estimating the element of set S before noise is added, regarding x as a value in which noise has been added to an element of set S). In this case, if x_E-x_A is sufficiently small, s_A=s_E, and s_E can be restored correctly.

[0118] A second specific example of the template generation process in step S21203 and the private key recovery process in step S51506 will be described. This specific example is an example in which, in the template generation process in step S21203, the template generation unit 204 generates auxiliary information c_E using the private key sk generated in step S21201 in the registration process of the biometric encryption method.

[0119] In the template generation process of step S21203, the template generation unit 204 first extracts an enrollment feature x_E from the enrollment biometric information, determines s_E=f_0(sk) using a predetermined mapping f_0 (e.g., an identity mapping) that is injective and easy to calculate the inverse image, and generates c_E corresponding to this s_E through the enrollment process of the biometric encryption method. Some methods among the biometric encryption methods can generate c_E corresponding to s_E specified in the enrollment process, so the template generation unit 204 may use such a method. For example, the method described in the first specific example may be used. Then, the template generation unit 204 determines the template T so as to include this c_E.

[0120] Next, in the private key recovery process in step S51506, the private key recovery unit 505 extracts the key recovery feature x_A from the key recovery biometric information, and performs private key recovery process in the biometric encryption method using x_A and auxiliary information c_E included in the template T to recover s_E. Then, the private key recovery unit 505 recovers sk by sk=f_0^(-1)(s_E), where f_0^(-1) represents the inverse mapping of f_0.

[0121] A third specific example of the template generation process in step S21203 and the private key recovery process in step S51506 will be described. This specific example is an example in which the enrollment private key s_E generated by the enrollment process of the biometric encryption method in the template generation process in step S21203 is used to generate the private key sk in step S21201. Therefore, the specific example will be described including the process of step S21201.

[0122] In the template generation process in step S21203, the template generation unit 204 extracts an enrollment feature x_E from the enrollment biometric information, performs enrollment processing of the biometric encryption method using x_E, and generates an enrollment private key s_E and auxiliary information c_E. The template generation unit 204 defines a template T as data including c_E.

[0123] Next, in the key pair generation process of step S21201, the key pair generation unit 202 generates a private key sk using s_E, and then calculates a public key pk corresponding to sk. Here, an example of a method in which the key pair generation unit 202 generates sk from s_E is to use s_E itself as sk.

[0124] Another example of a method in which the key pair generation unit 202 generates sk from s_E is to generate a data decryption private key sk1 based on a value of a predetermined portion of a pseudorandom number obtained by inputting s_E into a pseudorandom number generator, and generate a digital signature generation private key sk2 based on a value of a predetermined portion that is not necessarily the same as the portion used to generate sk1. In this case, the key pair generation unit 202 can determine pk by calculating a public key pk1 corresponding to sk1 and a public key pk2 corresponding to sk2, and determining pk by pk:=(pk1, pk2).

[0125] In particular, if the location used to generate sk1 is different from the location used to generate sk2, it becomes even more difficult to infer sk1 (or the data generated based on it) and sk2 (or the data generated based on it) from the other, which has the effect of improving security.

[0126] In the private key recovery process in step S51506, the private key recovery unit 505 extracts the key recovery feature x_A from the key recovery biometric information, and recovers the enrollment private key s_E using x_A and c_E included in the template. Then, the private key recovery unit 505 recovers the private key sk using s_E, which performs the same process as in step S21201.

[0127] A fourth specific example of the template generation process in step S21203 and the private key recovery process in step S51506 will be described. Like the third specific example, this specific example is an example in which the enrollment private key s_E generated by the enrollment process of the biometric encryption method in the template generation process in step S21203 is used to generate the private key sk in step S21201. For this reason, the specific example will be described including the process of step S21201. Note that part of the process performed by the template generation unit 204 may be performed by the key pair generation unit 202 instead.

[0128] In the template generation process of step S21203, the template generation unit 204 extracts a feature for enrollment x_E from the biometric information for enrollment, performs a biometric encryption method enrollment process using x_E, and generates a private key for enrollment s_E and auxiliary information c_E. Furthermore, the template generation unit 204 generates a key pair (sk2, pk2) independent of s_E, and generates encrypted data Enc(sk2) using sk1 for sk2 by common key encryption with sk1 as the key or public key encryption with pk1 as the key. Then, the template generation unit 204 determines the template T as data including Enc(sk2) and c_E.

[0129] Next, in the key pair generation process of step S21201, the key pair generation unit 202 generates sk1 using s_E, and generates pk1 from sk1. Then, the key pair generation unit 202 determines the key pair (sk, pk) in step S21201 by sk:=(sk1, sk2) and pk:=(pk1, pk2).

[0130] In the private key recovery process in step S51506, the private key recovery unit 505 extracts the key recovery feature x_A from the key recovery biometric information, and recovers the enrollment private key s_E using x_A and c_E included in the template. Then, the private key recovery unit 505 generates sk1 using s_E, and obtains sk2 by decrypting Enc(sk2) included in the template using s_E. This allows the private key sk=(sk1, sk2) to be recovered.

[0131] Next, in the process of generating first registration matching information in step S11101, the process of generating first verification matching information in step S51503, and the first verification process in step S51602, for example, any authentication method can be used. Specific examples are as follows.

[0132] A first specific example is authentication using a password. For example, the first registration matching information generating unit 102 generates a password by a method such as accepting input of a password desired by a user, and determines the input password or a password that has been anonymized as the first registration matching information. The first verification matching information generating unit 503 accepts a password input from a user, and determines the input password or a password that has been anonymized as the first verification matching information. The first verification unit 602 verifies whether the input password (or the password that has been anonymized) matches, and determines the verification result as "success" if they match, and as "fail" if they do not match.

[0133] The second specific example is an authentication method using a private key stored in a specific device. For example, the first registration verification information generating unit 102 creates a private key, stores the created private key in a device owned by the user (for example, a device such as a personal computer (PC) or a smartphone, or an integrated circuit (IC) card), and determines information for verifying the private key (for example, a public key for the private key) as the first registration verification information. However, the private key and public key in this example are different from the private key and public key generated in step S21201.

[0134] The first verification matching information generating unit 503 accepts presentation of a device in which a private key is stored from a user, and generates first verification matching information based on the private key (for example, a digital signature created using the private key for a random message received from the first server 1600, or a predetermined function value such as a hash value of the private key). This first verification matching information generating process may be generated by a device in which the private key is stored, instead of the key recovery terminal 1500.

[0135] When the first verification information is a digital signature, if the first registration verification information includes a public key corresponding to the private key, the first verification unit 602 can verify the relationship between the public key, the digital signature, and the message to be signed. When the first verification information is a predetermined function value of the private key, if the first registration verification information includes the corresponding function value of the private key, the first verification unit 602 can verify that a device storing a private key has been presented by verifying that the function values ​​match.

[0136] The third specific example is an authentication method using a terminal owned by the user, which is not necessarily the same as the key recovery terminal 1500. For example, authentication using a one-time password or push authentication is one of the specific examples. In this specific example, the first registration verification information is the user's contact information (email address or phone number, etc.) or unique information related to authentication software installed on the terminal owned by the user.

[0137] An example of authentication using a one-time password is as follows: The first verification matching information is a one-time password (such as a random number string or character string) sent to a registered contact address or displayed by authentication software on a terminal owned by the user. The first verification unit 602 judges the reception of a valid one-time password within a predetermined period as a "success," and judges the reception of a "failure" otherwise.

[0138] An example of authentication using push authentication is as follows: The terminal owned by the user accepts the user's access to the URL transmitted from the first server 1600. The terminal owned by the user may also display a screen asking whether authentication is being attempted, and accept a selection of "Yes" or "No" from the user. If the first verification unit 602 can confirm that the URL has been accessed or "Yes" has been selected within a certain period of time, it determines the result as "success", and if not, it determines the result as "failure".

[0139] It should be noted that in such a method using a terminal owned by the user, the terminal owned by the user may transmit the first verification matching information instead of the key recovery terminal 1500.

[0140] A fourth specific example is a method using biometric authentication. Any method may be used as the biometric authentication method. In addition, a method that can protect biometric information from leakage, such as cancelable biometrics, may be used. In addition, a method that combines these methods may be used.

[0141] For example, the first registration matching information generation unit 102 receives input of biometric information for generating first registration matching information from a user, and generates first registration matching information by performing a feature extraction process (and, if necessary, an encoding process such as a concealment process) on the input biometric information for generating first registration matching information.

[0142] Furthermore, the first verification matching information generation unit 503 receives input of biometric information for generating first verification matching information from the user, and generates first verification matching information by performing feature extraction processing (and, if necessary, encoding processing such as concealment processing) on ​​the input biometric information for generating first verification matching information.

[0143] The biometric information for generating the first registration matching information and the biometric information for generating the first verification matching information are assumed to be acquired from the same body part. The first verification unit 602 verifies the first registration matching information and the first verification matching information and determines whether the result is "successful" or "failed." For example, when the first registration matching information is a feature extracted from the biometric information for generating the first registration matching information and the first verification matching information is a feature extracted from the biometric information for generating the first verification matching information, the first verification unit 602 calculates the similarity between the features based on a predetermined method, and determines whether the similarity exceeds a predetermined threshold value as a "success" and whether the result is "failed" if the similarity does not exceed the predetermined threshold value.

[0144] The fifth, sixth, and seventh concrete examples will be described. In these concrete examples, the first registration matching information is a part or all of the template generated in step S21203, and the first verification matching information is generated using the key recovery biometric information. Therefore, the personal data management system 10 does not need to include the first matching information DB 92.

[0145] Moreover, the first matching information registration terminal 1100 may not execute the first registration matching information generation process of step S11101, and may send only the first ID to the first server 1600. Moreover, the personal data management system 10 may not include the first matching information registration terminal 1100, and may not execute the first matching information registration process, and the template registration terminal 1200 may include the first ID generation unit 103 instead of the first ID acquisition unit 205, and may execute the first ID generation process instead of the first ID acquisition process in the template registration process.

[0146] In a fifth specific example, the first verification unit 602 uses the first enrollment matching information included in the template and the first verification matching information to calculate an estimate of the distance between the enrollment feature (feature extracted from the enrollment biometric information) and the key recovery feature (feature extracted from the key recovery biometric information), and if the calculated distance estimate is less than or equal to a predetermined threshold, it determines that it is a “success”, otherwise it determines that it is a “failure”.

[0147] Note that the distance here is not limited to one that satisfies the mathematical axioms of distance, but may be any function whose value is small when the registration feature and the key recovery feature are similar and whose value is large when they are dissimilar.

[0148] A detailed example of the fifth specific example will be described. The template generating unit 204 generates the first registration matching information by c_E:=x_E+s_E in the template generating process of step S21203, using the method described as an example of the registration process of the biometric encryption method. The template generating unit 204 determines the template so as to include c_E. The first verification matching information generating unit 503 extracts the key recovery feature x_A from the key recovery biometric information. It is assumed that x_A is an element of the set X, similar to x_E.

[0149] Next, the first verification matching information generation unit 503 generates a temporary private key x_A, which is an element of the set S, by any method (for example, any of the methods given as examples of the method for generating the registration private key s_E). Then, the first verification matching information generation unit 503 generates first verification matching information by c_A:=x_A+s_A.

[0150] The distance between x_E and x_A is defined as d(x_E-x_A,0) using a function representing distance. The first verification unit 602 defines the estimated value f_2(c_E,c_A) of the distance between x_E and x_A as f_2(c_E,c_A):=d(c_E-c_A-f_1(c_E-c_A),0). When the distance between x_E and x_A is sufficiently small, f_2=d(x_E-x_A,0), so f_2(c_E,c_A) is the estimated value of the distance between x_E and x_A.

[0151] In a sixth specific example, the first verification unit 602 calculates an estimate of the difference between the private key generated in step S21201 and the temporary private key generated in the first verification matching information generation process in step S51503 based on the first registration matching information and the first verification matching information, and judges the difference as "success" if the estimated difference is correct, and as "failure" if the estimated difference is incorrect.

[0152] A detailed example of the sixth specific example will be described. Template generation unit 204 generates c_E in the same manner as the fifth specific example. In addition, let Z be the set of all integers, g be a primitive element of the multiplicative group of a finite field, and f_3 be a linear mapping from S to Z. Let b_E be determined by b_E:=g^(f_3(s_E)), where "^" represents an exponentiation operation.

[0153] Template generation unit 204 defines the template as data including (c_E, b_E). Note that if the value of b_E is included in the public key, template generation unit 204 does not need to include b_E in the template. Next, first verification matching information generation unit 503 generates s_A and c_A in the same manner as in the fifth specific example. Furthermore, b_A is defined by b_A:=g^(f_3(s_A)). Then, first verification matching information generation unit 503 defines the first verification matching information as a set of (c_A, b_A).

[0154] Next, the first verification unit 602 calculates an estimate of the private key difference s_A-s_E by f_4(c_E,c_A):=f_1(c_A-c_E). If g^(f_4(c_E,c_A))*b_E=b_A (where "*" indicates a product) holds, the first verification unit 602 determines the result as "success," and if not, determines the result as "failure."

[0155] A seventh specific example is a method using a fuzzy signature. In this method, the first verification reference information is a signature generated using the key recovery biometric information, and signature verification is performed in the first verification process.

[0156] A detailed example of the seventh specific example will be described. Template generation unit 204 determines s_E, c_E, and b_E in the same manner as in the sixth specific example, and determines the template as data including (c_E, b_E). Note that if the value of b_E is included in the public key, template generation unit 204 does not need to include b_E in the template.

[0157] Next, the first verification-use matching information generating unit 503 determines s_A, c_A, and b_A in the same manner as in the sixth specific example. Furthermore, the first verification-use matching information generating unit 503 generates a signature Sig(m, s_A) for a message m using s_A as a key. Note that the message m is a value generated by the first server 1600 randomly or according to a predetermined rule such as combining date and time information and a random number.

[0158] Before the first verification matching information generation process, the first server 1600 transmits a message m to the key recovery terminal 1500. The message m may also be generated by the key recovery terminal 1500. Then, the first verification matching information generation unit 503 determines the first verification matching information by (c_A, b_A, Sig(m, s_A)).

[0159] Next, the first verification unit 602 calculates an estimate of the private key difference s_A-s_E by f_4(c_E,c_A):=f_1(c_A-c_E). Then, the first verification unit 602 verifies whether g^(f_4(c_E,c_A))*b_E=b_A holds. Furthermore, the first verification unit 602 verifies the relationship between the message m and the signature Sig(m,s_A) by using b_A as the public key for the temporary private key. The first verification unit 602 judges "success" when these two verifications are successful, and judges "failure" otherwise.

[0160] As in the fifth to seventh concrete examples, when a method is used in which the first registration matching information is determined by data included in a template, there is an advantage that it is not necessary to store the first registration matching information. Furthermore, in the sixth and seventh concrete examples, it is understood that c_E and c_A that satisfy the success condition of the first verification process in step S51602 satisfy the success condition of the private key recovery process in step S51506. This has the advantage that for a pair of c_E and c_A for which private key recovery fails, it can be determined as "failed" at the point of S51602.

[0161] Next, a specific example of a combination of the second registration matching information in step S31301, the second verification matching information generation process in step S51509, and the second verification process in step S51702 will be described.

[0162] The first specific example is a method of applying a specific example of the set (called the first process set) of the first registration matching information generation process of step S11101, the first verification matching information generation process of step S51503, and the first verification process of step S51602 to the set (called the second process set) of the second registration matching information of step S31301, the second verification matching information generation process of step S51509, and the second verification process of step S51702.

[0163] The first and second processing sets may include different processes or the same process. When the same process is included, data stored in one DB may be shared by multiple servers instead of storing data including the same data in multiple DBs (e.g., first matching information DB 92 and second matching information DB 94).

[0164] In the second specific example, the second registration matching information is a predetermined function value such as a hash value for the private key generated in step S21201, and the second verification matching information is a function value for the private key restored in step S51506 using the same function as that used for generating the second registration matching information. In the second verification process, if the second registration matching information and the second verification matching information match, it is determined as "success", and if not, it is determined as "failure".

[0165] A third specific example is an example in which the second registration matching information is a public key for the private key generated in step S21201, and the second verification matching information is a signature generated using the private key restored in step S51506 for a specified message (e.g., a random number sent from the second server prior to the second verification matching information generation process).

[0166] In the second verification process, the relationship between the message and the signature is verified using a public key, and if the verification is successful, it is determined as "success", and if not, it is determined as "failure". In this specific example, since the public key is stored in the public key DB 91, the second registration matching information does not need to be stored again. However, information indicating the relationship between the first ID and the second ID, or the relationship between the second ID and the public key, is stored somewhere (e.g., the second server 1700), and the public key corresponding to the second ID can be referenced.

[0167] In the second and third specific examples, when the correct private key is restored, the key restoration terminal 1500 can receive the converted personal data, and when the correct private key is not restored, the key restoration terminal 1500 cannot receive the converted personal data. In other words, the second and third specific examples are examples in which the restored private key is used to access personal data.

[0168] Next, a specific example of the personal data conversion process in step S41404 and the personal data restoration process in step S51511 will be described.

[0169] In the first specific example, in step S41404, the personal data conversion unit 404 generates converted personal data by executing encryption processing based on the public key cryptosystem using the public key transmitted in step S49101. In S51511, the personal data restoration unit 508 performs decryption processing using the private key restored in step S51506, and restores the converted personal data.

[0170] In the second specific example, in step S41404, the personal data conversion unit 404 performs the same process as the private key recovery process in step S51506, and then performs encryption using the recovered private key. However, in order to execute the process of the second specific example, it is necessary that the user operating the terminal for personal data registration is the same person as the user who registered the template, and that the terminal for personal data registration 1400 has received the template before step S49101. When the terminal for personal data registration 1400 receives the template, the first server 1600 transmits the template to the terminal for personal data registration 1400 after template transmission permission decision process is executed as in step S51603.

[0171] A third specific example is identity conversion, in which the personal data conversion unit 404 determines the converted personal data as having the same value as the personal data, and the personal data restoration unit 508 restores the personal data as having the same value as the converted personal data.

[0172] In addition, when a public key is not required in the conversion process in step S41404, like the second and third examples of the conversion method, the public key request process in step S41402 and the public key transmission process in step S49101 are omitted.

[0173] In the first and second specific examples, when the correct private key is restored, the key restoration terminal 1500 can restore the correct personal data, and when the correct private key is not restored, the key restoration terminal 1500 cannot restore the correct personal data. In other words, the first and second specific examples are examples in which the restored private key is used to access the personal data.

[0174] Next, a specific example of the processing result output process of step S51512 will be described. As a first example of the processing result output process, the processing result is displayed on a display screen, which is an example of the output device 75 of the computer 70 constituting the key recovery terminal 1500.

[0175] 8 is an example of a processing result display screen displayed on the display screen in step S51512 when the result of step S51603 is "transmission permitted" and the result of step S51703 is "transmission permitted." The processing result display screen 9100 includes, for example, a block 9110 displaying a message indicating that the processing was successful, and a block 9120 displaying the restored personal data list.

[0176] Block 9120 includes block 9121, block 9122, and block 9123 which display the restored personal data. Note that block 9121, block 9122, and block 9123 respectively display "DATA E", "DATA F", and "DATA G", and the displayed contents are, for example, information such as the name and data size of the personal data.

[0177] Although this example shows a case where three pieces of personal data are restored, any number of pieces of personal data may be restored. When the restored personal data has a folder structure, block 9120 may display a diagram representing the folder structure. When any of blocks 9121, 9122, and 9123 is selected by the user, the contents of the personal data corresponding to the selected block may be displayed.

[0178] 9 is an example of a processing result display screen displayed on the display screen in step S51512 when the result of the template transmission permission determination process in step S51603 is "transmission rejected", or when the result of the converted personal data transmission permission determination process in step S51703 is "transmission rejected". The processing result display screen 9200 includes, for example, a block 9210 displaying a message indicating that the processing has failed, and a block 9220 displaying a message asking whether to perform the processing again.

[0179] The block 9220 includes a block 9221 displayed as "retry" and a block 9222 displayed as "cancel". When the user selects the block 9221 displayed as "retry", the personal data management system 10 executes the process again from the beginning or the middle of the personal data output process (for example, from the beginning of the personal data output process if the result of the template transmission propriety determination process in step S51603 is "reject transmission", or from the beginning of the personal data output process or from step S51507 if the result of the converted personal data transmission propriety determination process in step S51703 is "reject transmission"), and when the user selects the block 9222 displayed as "cancel", the process is cancelled.

[0180] The display content of block 9210 may directly indicate that the processing has failed, such as "Processing has failed," or it may indicate that the matching information is invalid (i.e., the verification process has failed) as in the example of Figure 9, or it may be more specifically an indication of whether the first verification matching information or the second verification matching information is invalid.

[0181] In a second example of the processing result output process, the communication device 76 of the key recovery terminal 1500 transmits the processing result to another device via the network 51 or another network. If the result of step S51603 is "permitted to send" and the result of step S51703 is "permitted to send", for example, a part or all of the restored personal data is transmitted as the processing result.

[0182] If the result of the template transmission permission determination process in step S51603 is “rejected”, or if the result of the converted personal data transmission permission determination process in step S51703 is “rejected”, a message indicating that the output process has failed is sent as the processing result.

[0183] When the communication device 76 of the key recovery terminal 1500 transmits the processing result to another device, the display screen as an example of the output device 75 of the computer 70 constituting the key recovery terminal 1500 may or may not display the processing result display screen 9100 of Fig. 8 or the processing result display screen 9200 of Fig. 9 depending on the processing result. When the processing result display screen 9100 of Fig. 8 or the processing result display screen 9200 of Fig. 9 is displayed, the display contents may or may not include information related to personal data (e.g., block 9120 of Fig. 8).

[0184] Each device included in the personal data management system 10 may be a device owned by a user, or may be a device installed in a public institution such as a government office, police station, hospital, or school, or in a store, station, airport, or workplace, etc., and may be used by one or more users. In addition, any device such as a PC (Personal Computer), a smartphone, or a tablet device can be used as each device included in the personal data management system 10.

[0185] Hereinafter, use cases of the personal data management system 10 of this embodiment will be described. In the first use case, a user executes the first matching information registration process and the template generation process using his / her own device, and then a person in charge at a public institution executes the personal data registration process using a terminal in the public institution as a personal data registration terminal 1400. An example of personal data is a document issued by a public institution, such as a passport. The device owned by the user transmits information required for the process of step S41402 (for example, a set of information on the location of the public key DB91 and the first ID) to the public institution before step S41402. The device owned by the user may also transmit the public key itself to the public institution.

[0186] Furthermore, the device owned by the user transmits information required to execute the converted personal data transmission process of step S41406 (e.g., information on the location of the second server 1700) to the public institution before step S41406. Furthermore, the device owned by the user may transmit the user's contact information (e.g., email address) to the public institution, and a terminal in the public institution executes up to the personal data conversion process of step S41404 and then transmits the converted personal data to the user's contact information, and the device owned by the user may receive the converted personal data and then execute the converted personal data transmission process of step S41406. Furthermore, the device owned by the user may receive the personal data from the public institution and then execute the personal data registration process as the personal data registration terminal 1400.

[0187] In this way, after the personal data registration process is completed, for example, a device owned by the user executes a personal data output process as the key recovery terminal 1500. If the result output process of step S51512 is a process of displaying the personal data on a display, the personal data output process allows the user to visually confirm the contents of his / her own personal data.

[0188] Furthermore, the result output process of step S51512 may include a process of presenting the personal data to a predetermined person or a predetermined organization. Specifically, for example, the result output process of step S51512 may include a process of presenting the personal data to a bank for identity verification to open an account at the bank, etc. In this case, the screen on which the personal data is output may be presented to a clerk at the bank, or the restored personal data may be transmitted to the bank via a communication means such as the Internet.

[0189] The above use cases are merely examples, and other application methods may be used. For example, the processing may be performed on other people or organizations other than public institutions or banks, or a shared terminal may execute some or all of the processing.

[0190] The personal data management system 10 may also be used as a system for realizing SSI (Self-sovereign Identity). In this case, the personal data may be a certificate called VC (Verifiable Credential). The first ID may be a self-sovereign implementable ID called DID (Decentralized Identifier). The public key DB 91 may be implemented using a blockchain or a distributed ledger, and the public key DB 91 may store data in a format called DID Document, and the DID Document may include the public key. The public key may also be stored as a public key certificate issued by a certification authority.

[0191] A second use case of the personal data management system 10 is a login management system for a PC as follows. For example, the key recovery terminal 1500 is a device provided inside the PC, and the second server 1700 is a device that manages login to the PC. The second server 1700 may be provided inside the PC, or may be present in another location via a network.

[0192] Personal data is any data such as documents, drawings, or audio stored in a PC. The processing of step S51703 corresponds to the processing of deciding whether or not to permit login to the PC. When "transmission permitted" is decided in step S51703, i.e., when login is successful, in step S51512, result output unit 509 displays a screen after successful login (e.g., a desktop screen). When "transmission rejected" is decided in step S51703, i.e., when login is unsuccessful, in step S51512, result output unit 509 outputs a message indicating that login has failed.

[0193] In this embodiment, the first ID acquisition process in step S51501 may be omitted, and to do so, the process contents may be changed as follows: The necessary changes will be described below.

[0194] In step S51502, the key recovery terminal communication unit 501 does not include the first ID in the message to be sent. In step S51601, the first server communication unit 601 does not include the first ID in the message to be sent. In step S59201, the first matching information DB communication unit 921 sends pairs of (first ID, first registration matching information) for all registered users to the first server 1600.

[0195] In step S51602, the first verification unit 602 performs a verification process using the first registration matching information transmitted in step S59201, and determines the first ID for key recovery (the first ID transmitted in step S51604) as follows.

[0196] When the verification is successful for one user, the first verification unit 602 determines the verification result as "success" and sets the first ID for key recovery to the first ID corresponding to the successful first registration matching information. When the verification is successful for no user, the first verification unit 602 determines the verification result as "failure."

[0197] When two or more users are successfully verified, the first verification unit 602, for example, determines the verification result as "success", selects one of the first IDs corresponding to the successfully verified first registration matching information by a predetermined method, and determines the first ID for key recovery by the first ID corresponding to the successful first registration matching information. When two or more users are successfully verified, the first verification unit 602 may determine the verification result as "failure".

[0198] For example, in verification using biometric authentication, when two or more users have been successfully verified, the first verification unit 602 may determine the first ID for key recovery to be the first ID corresponding to the first registration matching information that has the greatest similarity, if it is possible to calculate the similarity between the biometric information used to generate the first registration matching information and the biometric information used to generate the first verification matching information.

[0199] In addition, some or all of the DBs included in the personal data management system 10 may be integrated. For example, the first matching information DB 92 and the template DB 93 may be integrated. The integrated DB of the first matching information DB 92 and the template DB 93 may hold the first ID, the first matching information for registration, and the template in association with each other. Similarly, the second matching information DB 94 and the personal data DB 95 may be integrated.

[0200] In addition, if the above-mentioned processes include the same process (for example, a process of acquiring, generating, transmitting, or storing the same data), the results of the process may be shared rather than performing the same process multiple times.

[0201] For example, when the first registration matching information and the template include common data, the process of generating the common data may be executed only once. Furthermore, the common data may be stored in both the first matching information DB 92 and the template DB 93, or may be stored in only one of the DBs. When the other DB needs to use the common data stored in the one DB, the one DB may transmit the common data to the other DB. The same applies to the case where the first registration matching information and the second registration matching information include common data, or the case where the template and the second registration matching information include common data.

[0202] The personal data management system 10 in this embodiment has the following advantages: Only when the result of the first verification process is "success", that is, only when the first verification matching information that results in the first verification process being "success" is generated in the key recovery terminal 1500, the first server 1600 transmits a template to the key recovery terminal 1500.

[0203] If the key recovery terminal 1500 is not operated by the user who registered the template, it is difficult for the key recovery terminal 1500 to accept input of appropriate data (e.g., a correct password or biometric information of the user who registered the template) for generating first verification matching information that results in a "success" in the first verification process. In other words, when the key recovery terminal 1500 is operated by a user other than the user who registered the template, it is difficult to download the template to the key recovery terminal 1500.

[0204] In this embodiment, after executing the private key recovery process, the key recovery terminal 1500 uses the restored private key to decrypt encrypted data and generate a hash value and a signature in the second verification matching information generation process. However, the same effect can be achieved even if the key recovery terminal 1500 performs any cryptographic process using the restored private key, not limited to these processes.

[0205] In particular, when each of a plurality of terminals can be the key recovery terminal 1500 (for example, when the key recovery terminal 1500 is a shared terminal in a public facility or store, or when the key recovery terminal 1500 is a terminal newly acquired by a user), it is not determined in advance which user will use each key recovery terminal 1500, and therefore it is highly likely that information is not available in advance about which key recovery terminal 1500 the first server 1600 should send a template to. In such a situation, the method of the present embodiment described above is particularly effective.

[0206] Furthermore, the method of this embodiment has the following effects: Here, a template can be considered as a type of personal data, and the owner of the template can be considered as the user who registered the template.

[0207] As in this embodiment, access to the template is only possible if the first verification is successful, and further, the key recovery terminal 1500 uses the recovered private key to access the personal data (decrypt the converted personal data and generate second verification matching information for downloading the converted personal data), thereby enabling anyone who owns the personal data to access the personal data (whether the personal data is a template or not) and making access difficult for anyone who is not the owner.

[0208] Furthermore, when the first verification matching information is generated from the biometric information, the user can perform the personal data output process simply by inputting the biometric information, which is highly convenient for the user. Note that the user inputs the location information of the second server 1700 in addition to the first ID and the second ID as necessary, but as described above, the user does not necessarily have to input the first ID, and further, when the method of the third embodiment described later is used, the user does not need to input the second ID and the location information of the second server 1700.

[0209] Furthermore, when the first registration matching information is part or all of a template and the first verification matching information is generated using the restoration biometric information, this has the effect of eliminating the need to store the first registration matching information, which is advantageous in terms of efficiency and resources, and it also has the effect of improving convenience, as the user does not have to input different biometric information for generating the first verification matching information and restoring the private key in the personal data output process.

[0210] Furthermore, when the first verification process is a process of verifying a private key difference or a process of verifying a signature in a Fuzzy Signature, the correct private key can be restored if the verification is successful. This has the effect of eliminating unnecessary cases in which the correct private key is not restored even though the first verification process is successful. When a Fuzzy Signature is used in the first verification process, it also has the effect of preventing a replay attack on the first verification matching information (an attack in which the first verification process is deemed to be a "success" by resending first verification matching information that has already been successfully verified). EXAMPLES

[0211] Hereinafter, differences from the first embodiment will be mainly described, and explanations of similarities to the first embodiment will be omitted as appropriate. In the second embodiment, the first server 1600 also plays the role of the second server 1700 in the first embodiment. In this case, since the first verification process and the second verification process can be performed at the same time, the personal data management system 10 does not need to include the second matching information DB 94.

[0212] 10A and 10B are block diagrams showing an example of a functional configuration of a personal data management system 10 in Example 2. The personal data management system 10 of this example differs from the personal data management system 10 of the example in that it does not include a second matching information registration terminal 1300, a second matching information DB 94, a second server 1700, and a personal data DB 95, and the personal data DB 95 is connected to a network 52 (a network 53 is not necessary).

[0213] The personal data management system 10 of this embodiment differs from the personal data management system 10 of the first embodiment in that it includes a personal data DB 96 instead of the personal data DB 95, and includes a personal data registration terminal 2400 instead of the personal data registration terminal 1400. The personal data DB 95 and the personal data registration terminal 2400 are each configured, for example, by the computer 70 shown in FIG.

[0214] The personal data DB 96 includes a personal data DB communication unit 961 and a converted personal data storage unit 962, both of which are functional units. The functions realized by the personal data DB communication unit 961 and the converted personal data storage unit 962 are similar to the functions realized by the personal data DB communication unit 951 and the converted personal data storage unit 952 of the first embodiment, respectively.

[0215] The personal data registration terminal 2400 includes, for example, a personal data registration terminal communication unit 411, a first ID acquisition unit 412, a personal data acquisition unit 413, and a personal data conversion unit 414. Functions realized by the personal data registration terminal communication unit 411, the first ID acquisition unit 412, the personal data acquisition unit 413, and the personal data conversion unit 414 are similar to the functions realized by the personal data registration terminal communication unit 401, the first ID acquisition unit 402, the personal data acquisition unit 403, and the personal data conversion unit 404 of the first embodiment, respectively.

[0216] The personal data registration terminal 2400 of this embodiment differs from the personal data registration terminal 1400 of the first embodiment in that it does not include the second ID acquisition unit 405. The key recovery terminal 1500 of this embodiment differs from the key recovery terminal 1500 of the first embodiment in that it does not include the second ID acquisition unit 506 and the second verification matching information generation unit 507.

[0217] Due to space limitations, the functional sections of the public key DB 91, the first matching information DB 92, and the template DB 93 are omitted in Figure 10A, and the functional sections of the first matching information registration terminal 1100, the template registration terminal 1200, and the key recovery terminal 1500 are omitted in Figure 10B, but both Figures 10A and 10B show the same functional configuration example of the same personal data management system 10.

[0218] 10A and 10B, the network connected to the devices in the personal data management system 10 is composed of the network 51 and the network 52, but this is not necessarily the case. For example, only one of the network 51 and the network 52 may exist, and all the devices included in the personal data management system 10 may be connected to that one network.

[0219] An example of each process in the second embodiment will be described. In this embodiment, except for the processes described below, the processes by the personal data DB 95, the personal data DB communication unit 951, and the converted personal data storage unit 952 in the first embodiment are respectively executed by the personal data DB 96, the personal data DB communication unit 961, and the converted personal data storage unit 962. In addition, in this embodiment, except for the processes described below, the processes by the personal data registration terminal 1400, the personal data registration terminal communication unit 411, the first ID acquisition unit 412, the personal data acquisition unit 413, and the personal data conversion unit 414 are respectively executed by the personal data registration terminal 2400, the personal data registration terminal communication unit 411, the first ID acquisition unit 412, the personal data acquisition unit 413, and the personal data conversion unit 414.

[0220] First, the first matching information registration process and the template registration process are the same as those in the embodiment 1. Moreover, the second matching information registration process is not necessary.

[0221] Fig. 11 is a sequence diagram showing an example of a personal data registration process. The processes in the steps with the same reference numerals as those in Fig. 6 are the same as those in Fig. 6, and therefore will not be described. Following step S41404, in step S61405, the personal data registration terminal communication unit 411 transmits the first ID acquired in step S41401 and the converted personal data generated in step S41404 to the first server 1600.

[0222] In step S61601, the first server communication unit 601 transmits the first ID and the converted personal data transmitted in step S61405 to the personal data DB 96. In step S69601, the converted personal data storage unit 962 associates the first ID and the converted personal data transmitted in step S61601, and stores them in the auxiliary storage device 73 of the computer 70 constituting the personal data DB 96.

[0223] Figures 12A and 12B are sequence diagrams showing an example of personal data output processing. The processing in the steps with the same reference numerals as in Figures 7A and 7B is the same as in Figures 7A and 7B, and therefore the description is omitted. Due to the limitation of drawing space, the personal data output processing is shown separately in Figures 12A and 12B, but the personal data output processing is a series of processing in which the processing in Figure 12B is executed after the processing in Figure 12A.

[0224] Following step S51501, in step S71502, the key recovery terminal communication unit 501 transmits to the first server 1600 a message indicating that the template and the converted personal data will be transmitted, and the first ID.

[0225] If the result of the template transmission decision in step S51603 is "rejected," the processes from step S51604 to step S59501 are not executed, and the process proceeds to step S71605. Following step S59301, in step S71704, the first server communication unit 601 transmits to the personal data DB 96 a message requesting transmission of the converted personal data and the first ID transmitted in step S71502.

[0226] Following step S59501, in step S71605, the first server communication unit 601 transmits a first response, as defined below, to the key recovery terminal 1500. When the result of step S51603 is "transmission permitted", the first response includes, for example, a set of the template transmitted in step S59301 and the converted personal data transmitted in step S59501. When the result of step S51603 is "transmission rejected", the first response includes, for example, a message indicating that transmission is rejected.

[0227] When a message indicating refusal to send is sent in step S71605, the personal data management system 10 does not execute the processes from step S51505 to step S51511, and proceeds to step S71502.

[0228] Following step S51511, the process of step S71512 is executed, which is similar to the process of step S51512. However, while in the first embodiment the process of step S51512 is executed depending on the process results of steps S51603 and S51703, in this embodiment, the process of step S71212 may be executed depending on the result of step S51603.

[0229] In addition, in the first response processing of step S71605, the first server communication unit 601 may transmit a list of registered converted personal data instead of transmitting the converted personal data, and the key recovery terminal 1500 may accept the user's selection of the converted personal data he or she wishes to receive, transmit to the first server 1600 which converted personal data has been selected, and the first server 1600 may transmit the selected converted personal data to the key recovery terminal 1500.

[0230] According to the method of this embodiment, even when templates and personal data are managed on one server, the same effect as in embodiment 1 can be achieved. That is, the effect is achieved that if you are the owner of the personal data, you can access the personal data (whether the personal data is a template or not), and if you are not the owner, it is difficult to access the personal data. EXAMPLES

[0231] Hereinafter, differences from the first and second embodiments will be mainly described, and descriptions of similarities between the first and second embodiments will be omitted. In this embodiment, a personal data DB is connected to both the first server 1600 and the second server 1700.

[0232] The process executed in the third embodiment is the process in the first embodiment to which the personal data process in the second embodiment is added. For this reason, the personal data in the second embodiment is called "additional personal data", and with regard to the device and processing unit in the second embodiment, "personal data" related to the additional personal data is read as "additional personal data". For example, the "terminal 2400 for registering personal data" in the second embodiment for registering additional personal data is read as "terminal 2400 for registering additional personal data", and the "DB 96 for personal data" in the second embodiment is read as "DB 96 for additional personal data".

[0233] 13 is a block diagram showing an example of a functional configuration of the personal data management system 10 of this embodiment. The personal data management system 10 of this embodiment differs from the personal data management system 10 of the first embodiment in the following points.

[0234] An additional personal data DB 96 is further connected to the network 52, and an additional personal data registration terminal 2400 is further connected to the network 51. The functional units of the additional personal data DB 96 are similar to the functional units of the personal data DB 96 in the second embodiment, and the functional units of the additional personal data registration terminal 2400 are similar to the functional units of the personal data registration terminal 2400 in the second embodiment, so that illustration and description thereof will be omitted.

[0235] Furthermore, the functional units of the first matching information registration terminal 1100, the template registration terminal 1200, the second matching information registration terminal 1300, the personal data registration terminal 1400, the public key DB 91, the first matching information DB 92, the template DB 93, the first server 1600, the second server 1700, and the personal data DB 95 are the same as those in the first embodiment, and therefore will not be illustrated or described.

[0236] Moreover, the key recovery terminal 1500 differs from the key recovery terminal 1500 in the first embodiment in that it further includes an additional personal data recovery unit 510 which is a functional unit. The additional personal data recovery unit 510 realizes the same function as the personal data recovery unit 508 in the second embodiment.

[0237] 13, the networks connected to the devices in the personal data management system 10 are configured with the network 51, the network 52, and the network 53, but this is not necessarily the case. For example, only one of the network 51, the network 52, and the network 53 may exist, and all the devices included in the personal data management system 10 may be connected to that one network.

[0238] The personal data management system 10 shown in FIG. 13 can execute the first matching information registration process, template registration process, second matching information registration process, and personal data registration process similar to those in the first embodiment, and can further execute the additional personal data registration process in a manner similar to that in the second embodiment.

[0239] Fig. 14 is a sequence diagram showing an example of personal data output processing. In step S80001, the key recovery terminal 1500, the first server 1600, the first matching information DB 92, the template DB 93, and the additional personal data DB 96 execute the processing from step S51501 to step S51511 in the additional personal data output processing in Fig. 12 (private key and additional personal data recovery processing). In step S80001, if the recovery of the private key and additional personal data is successful, the process proceeds to step S80002, and if not, the process proceeds to step S51512.

[0240] In step S80002, the key recovery terminal 1500, the second server 1700, the second matching information DB 94, and the personal data DB 95 execute the processes (personal data recovery process) from step S51507 to step S51511 in Fig. 7. The process of step S51512 is the same as in the first embodiment.

[0241] In the third embodiment, the restored additional personal data can be used to access the personal data. Examples of the method are described below. In a first example, the additional personal data is information including location information of the second server 1700, and when requesting the converted personal data in step S51508, the location of the second server 1700 is specified using the location information of the second server 1700 included in the additional personal data.

[0242] Furthermore, if the additional personal data includes the second ID, the second ID acquisition process in step S51507 is completed by referring to the second ID included in the restored additional personal data. In this way, since the additional personal data includes the location information of the second server 1700 and the second ID, the user does not need to input the location information of the second server 1700 and the second ID in the converted personal data request process and the second ID acquisition process, improving user convenience.

[0243] In the second example, the additional personal data is assumed to be second verification information. As a result, the second verification information generation process in step S51509 is completed by referring to the additional personal data. This eliminates the need for the user to input a password, biometric information, or the like in the second verification information generation process, improving user convenience.

[0244] In addition, even when a predetermined function value such as a hash value of the private key restored in step S51506 or a signature generated using the private key is used as the second verification matching information, there is an advantage that the user does not need to input a password, biometric information, etc. In addition, when the additional personal data is the second verification matching information, there is an advantage that the type of the second verification matching information is not limited to a predetermined function value such as a hash value of the private key or a signature, but can be selected more flexibly, including a password, etc.

[0245] According to the method of this embodiment, the owner of the personal data can access the personal data (whether the personal data is a template or not), and access is difficult for non-owners. In addition, the amount of input required by the user for communication with the second server 1700 is reduced, improving user convenience.

[0246] The present invention is not limited to the above-mentioned embodiment, and various modifications are included. For example, the above-mentioned embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all the configurations described. It is also possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0247] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0248] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0249] 10 personal data management system, 91 public key DB, 92 first matching information DB, 93 template DB, 94 second matching information DB, 95 personal data DB, 96 additional personal data DB, 1100 first matching information registration terminal, 1200 template registration terminal, 1300 second matching information registration terminal, 1400 personal data registration terminal, 1500 key recovery terminal, 1600 first server, 1700 second server, 2400 additional personal data registration terminal

Claims

1. 1. A template management system, comprising: A key recovery terminal and a first server, The first server holds first registration matching information of a user and a template generated based on the registration biometric information of the user; The key recovery terminal includes: generating a first verification reference for the user; execute a first request process to transmit a message requesting transmission of the template and the first verification matching information to the first server; The first server executing a first verification process based on the first verification matching information and the first registration matching information; If the first verification process is successful, Sending the template to the key recovery terminal; The key recovery terminal includes: Acquire key recovery biometric information of the user; Recovering a private key based on the template and the key recovery biometric information; If the first verification process fails, the first server refuses to transmit the template to the key recovery terminal; The template management system further includes a second server; The second server holds second registration verification information of the user and converted personal data obtained by performing a first conversion on personal data related to the user, If the first server succeeds in the first verification process, The key recovery terminal includes: generating second verification reference information for the user; execute a second request process to transmit a message requesting transmission of the converted personal data and the second verification matching information to the second server; The second server, executing a second verification process based on the second verification reference information and the second registration reference information; If the second verification process is successful, the converted personal data is transmitted to the key recovery terminal; the key recovery terminal recovers the personal data by a personal data recovery process based on the converted personal data and the first conversion; The second server refuses to transmit the converted personal data to the key recovery terminal if the second verification process fails.

2. The template management system according to claim 1, the converted personal data is data obtained by encrypting the personal data as the first conversion, The key restoration terminal decrypts the converted personal data by using the restored private key in the personal data restoration process.

3. The template management system according to claim 1, The first server retaining converted additional personal data obtained by subjecting the additional personal data relating to the user to a second conversion; If the first verification process is successful, Transmitting the converted additional personal data together with the template to the key recovery terminal; the key recovery terminal recovers the additional personal data by a converted additional personal data recovery process based on the converted additional personal data and the second conversion; and a template management system that executes the second request process based on the restored additional personal data.

4. The template management system according to claim 3, The key recovery terminal, in the second request processing, identifies the location of the second server based on the recovered additional personal data.

5. The template management system according to claim 4, The key recovery terminal generates the second verification matching information based on the additional personal data in the second request processing.

6. A template management system according to claim 1, The key recovery terminal generates the second verification matching information based on the recovered private key in the second request processing.

7. A template management system, comprising: A key recovery terminal and a first server, The first server holds first registration matching information of a user and a template generated based on the registration biometric information of the user; The key recovery terminal includes: generating a first verification reference for the user; execute a first request process to transmit a message requesting transmission of the template and the first verification matching information to the first server; The first server executing a first verification process based on the first verification matching information and the first registration matching information; If the first verification process is successful, Sending the template to the key recovery terminal; The key recovery terminal includes: Acquire key recovery biometric information of the user; Recovering a private key based on the template and the key recovery biometric information; If the first verification process fails, the first server refuses to transmit the template to the key recovery terminal; The first server holds encrypted personal data obtained by encrypting personal data related to the user; If the first verification process is successful, the first server transmits the encrypted personal data together with the template to the key recovery terminal; the key restoration terminal restores the encrypted personal data by using the restored private key.

8. A template management system according to claim 1 or 7, the first enrollment matching information and the first verification matching information are generated based on biometric information of the user.

9. The template management system according to claim 8, The first registration matching information includes a part or the whole of the template, The template management system according to claim 1, wherein the first verification matching information is generated based on the key recovery biometric information.

10. A template management system according to claim 9, the first verification matching information is generated based on a temporary private key and the key recovery biometric information, The first server estimating a difference between the private key and the temporary private key based on the first registration matching information and the first verification matching information; and determining a result of the first verification process based on a verification result of whether the estimated difference is correct.

11. The template management system according to claim 9, the first verification matching information is generated using a signature generation process based on a temporary private key and the key recovery biometric information, the first server determines a result of the first verification process based on a result of a signature verification process using the first registration matching information and the first verification matching information.

12. A template management method by a template management system, comprising: The template management system includes a key recovery terminal and a first server, The first server holds first registration matching information of a user and a template generated based on the registration biometric information of the user; The template management method includes: The key recovery terminal generates first verification matching information for the user; The key recovery terminal executes a first request process for transmitting a message requesting transmission of the template and the first verification matching information to the first server; The first server executes a first verification process based on the first verification matching information and the first registration matching information; If the first server succeeds in the first verification process, The first server transmits the template to the key recovery terminal; The key recovery terminal acquires the user's key recovery biometric information, the key recovery terminal recovers the private key based on the template and the key recovery biometric information; If the first verification process fails, the first server refuses to transmit the template to the key recovery terminal; The template management system further includes a second server; The second server holds second registration verification information of the user and converted personal data obtained by performing a first conversion on personal data related to the user, The template management method includes: If the first server succeeds in the first verification process, The key recovery terminal generates second verification matching information for the user; a second request process is executed by the key recovery terminal to transmit a message requesting transmission of the converted personal data and the second verification matching information to the second server; The second server executes a second verification process based on the second verification reference information and the second registration reference information; If the second server is successful in the second verification process, the second server transmits the converted personal data to the key recovery terminal; the key recovery terminal recovers the personal data by a personal data recovery process based on the converted personal data and the first conversion; the second server rejects transmission of the converted personal data to the key recovery terminal if the second verification process fails.

13. A template management method by a template management system, comprising: The template management system includes a key recovery terminal and a first server, the first server holds first registration matching information of a user, a template generated based on the registration biometric information of the user, and encrypted personal data obtained by encrypting personal data related to the user; The template management method includes: The key recovery terminal generates first verification matching information for the user; The key recovery terminal executes a first request process for transmitting a message requesting transmission of the template and the first verification matching information to the first server; The first server executes a first verification process based on the first verification matching information and the first registration matching information; If the first server succeeds in the first verification process, The first server transmits the template to the key recovery terminal; The key recovery terminal acquires the user's key recovery biometric information, the key recovery terminal recovers the private key based on the template and the key recovery biometric information; If the first verification process fails, the first server refuses to transmit the template to the key recovery terminal; If the first server is successful in the first verification process, the first server transmits the encrypted personal data together with the template to the key recovery terminal; the key recovery terminal uses the recovered private key to decrypt the encrypted personal data, thereby recovering the personal data.

Images