Information processing device, information processing system, and information processing method

Abstract

To provide biometric authentication using a plurality of types of biological information, the biometric authentication efficiently recovering the same secret key in a safe and accurate manner and, therefore, executing online authentication in a safe and accurate manner.SOLUTION: An information processor holds commitments that are created on the basis of registration feature amounts obtained from respective types of biological information, secret data, and predetermined embedding processing and correspond to the respective registration feature amounts; acquires an authentication feature amount obtained from each of the respective types of biological information; and recovers the secret data on the basis of the authentication feature amount and a commitment corresponding to a registration feature amount obtained from biological information having the same type as that of the authentication feature amount.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing system, and an information processing method. [Background technology]

[0002] Biometric authentication technology that uses a user's biometric characteristics (fingerprints, vein patterns, iris patterns, etc.) as authentication information is becoming increasingly popular as a safe and convenient personal authentication technology. It is not limited to use in closed environments such as PC login, bank ATMs (Automated Teller Machines), and entrance and exit, but is increasingly being used for online authentication via the cloud, such as online payments and empty-handed sightseeing. On the other hand, when biometric information (authentication template) is used in the cloud, there is an increased risk of sensitive information such as biometric information being leaked from servers, etc.

[0003] The First Identity Online (FIDO) standard (technology described in Non-Patent Document 1), which separates biometric authentication by terminal authentication devices and network authentication to improve security and interoperability, has been established by industry, and development of a protected biometric authentication technology for authentication templates is also underway. FIDO achieves online authentication by storing a private key required for electronic signatures based on a public key infrastructure (PKI) in a protected area such as a Trusted Execution Environment (TEE), and activating the private key and issuing an electronic signature when identity authentication is successful.

[0004] Public Biometric Infrastructure (PBI), a template protection technology, realizes a mechanism for online identity authentication by extracting a private key from biometric information such as vein patterns and creating an electronic signature through biometric authentication.

[0005] On the other hand, biometric authentication, which is available to everyone for mobile devices and in-store payments, may have some cases where a single piece of biometric information reduces the convenience of the user, such as when the user is wearing glasses or a mask, or when facial recognition cannot be performed due to injury or religious reasons. Therefore, it is necessary to achieve both reduced risk of spoofing and convenience by being able to select an appropriate combination from multiple pieces of biometric information according to the situation, such as fingerprint recognition when wearing a mask, and facial recognition or iris recognition when the skin is rough. In this case, it is desirable to be able to realize electronic signatures using the same private key regardless of which combination of biometric authentication is used.

[0006] JP 2020-57275 A (Patent Document 1) discloses a technology that "includes an image input unit that acquires an image of a biometric subject, a memory unit that stores registration information relating to multiple biometric features obtained from the biometric area of ​​the image of each person, and an authentication processing unit that processes the biometric area of ​​the image acquired by the image input unit and performs biometric authentication based on the registration information, wherein the multiple biometric features obtained from the biometric area of ​​each person are multiple biometric features having low pattern correlation with each other, and the authentication processing unit performs biometric authentication by combining the multiple biometric features having low pattern correlation with each other obtained by processing the image" (see abstract). [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2020-57275 A [Patent Document 2] JP 2014-17746 A [Non-patent literature]

[0008] [Non-Patent Document 1] FIDO ALLIANCE, “FIDO Alliance Specification Overview”, retrieved on July 21, 2021, Internet<https: / / fidoalliance.org / specifications / > Summary of the Invention [Problem to be solved by the invention]

[0009] Patent Document 1 discloses a technology for extracting multiple non-overlapping biometric features and using them for authentication. However, Patent Document 1 does not disclose a mechanism for restoring the same private key for online authentication when different types or combinations of biometric information are used.

[0010] For this reason, in the technology described in Patent Document 1, for example, one key is set for each registered biometric information such as for each finger or face, and key management is required on the user side. If the technology described in Patent Document 1 is used to manage private keys on the authentication system side, it is necessary to protect and hold the same private key for every combination of multiple types of biometric information, which causes the size of the authentication template to grow exponentially with the number of pieces of biometric information, n.

[0011] In addition, in the FIDO standard described in Non-Patent Document 1, a separate private key is managed for each terminal, and specifications for restoring a fixed private key by combining multiple pieces of biometric information are not disclosed.

[0012] Therefore, one aspect of the present invention is to efficiently recover the same private key safely and with a high degree of accuracy in biometric authentication using a plurality of types of biometric information, and thereby to execute online authentication safely and with a high degree of accuracy. [Means for solving the problem]

[0013] In order to solve at least one of the above problems, one aspect of the present invention employs the following configuration: An information processing device having a processor and a memory, the memory holds commitments generated based on enrollment features obtained from each of multiple types of biometric information, secret data, and a predetermined embedding process and corresponding to each of the enrollment features, the processor acquires authentication features obtained from each of the multiple types of biometric information, and restores the secret data based on the authentication features and the commitment corresponding to the enrollment features obtained from the same type of biometric information as the authentication features. Effect of the Invention

[0014] According to one aspect of the present invention, in biometric authentication using multiple types of biometric information, it is possible to efficiently recover the same private key safely and with high accuracy, and therefore to execute online authentication safely and with high accuracy.

[0015] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0016] [Figure 1] 1 is a block diagram showing a configuration example of a biometric authentication system according to a first embodiment. [Diagram 2] 1 is a flowchart illustrating an example of a biometric information registration process according to the first embodiment. [Diagram 3] 11 is a flowchart illustrating an example of an authentication process according to the first embodiment. [Figure 4] 13 is a flowchart illustrating an example of a distributed commitment generation process in the first embodiment. [Diagram 5] 13 is a flowchart illustrating an example of a distributed share restoration process in the first embodiment. [Figure 6] 13 is a flowchart illustrating an example of a registration process according to the second embodiment. [Figure 7] 13 is a flowchart illustrating an example of an authentication process according to the second embodiment. [Figure 8] FIG. 11 is an explanatory diagram illustrating an example of hierarchical division of biometric authentication groups in the hierarchical distributed commitment according to the second embodiment. [Figure 9] FIG. 11 is an explanatory diagram illustrating a configuration example of a hierarchical distributed commitment in a tree structure according to a second embodiment. [Figure 10] 13 is a flowchart illustrating an example of a registration process according to the third embodiment. [Figure 11] 13 is a flowchart illustrating an example of an authentication process according to the third embodiment. [Figure 12] 13 is an example of a guide displayed on the display device in the fourth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The following description and drawings are examples for explaining the present invention, and some omissions and simplifications are made for clarity of explanation. The present invention can be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

[0018] In order to facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in the drawings may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not necessarily limited to the position, size, shape, range, etc. disclosed in the drawings. EXAMPLES

[0019] 1 is a block diagram showing an example of the configuration of a biometric authentication system 10. The biometric authentication system 10 is a system that authenticates biometrics using biometric images of a face, a finger, a palm, or the like. The biometric authentication system 10 includes an information processing device 3, an imaging device 2 provided on or connected to the information processing device 3, and a server 5. The information processing device 3 and the server 5 are capable of communicating with each other via a network 4 such as the Internet.

[0020] The information processing device 3 acquires still or moving images of the biometric information captured by the imaging device 2, and executes a series of processes including moving image processing, biometric information extraction, biometric information encoding, secret data generation, and registration data generation, and the information processing device 3 and the server 5 execute registration processing or authentication processing. When the results of the registration processing or authentication processing or a guide on a method for presenting the biometric information are required, the information processing device 3 displays the processing results or the guide on the display device 36 or the like. Note that the information processing device 3 and the server 5 may be integrated.

[0021] The information processing device 3 is configured by a computer including, for example, a CPU 31, a memory 32, an auxiliary storage device 33, a communication device , an input device 35, and a display device .

[0022] The CPU 31 includes a processor and executes programs stored in the memory 32. The memory 32 includes a ROM (Read Only Memory), which is a non-volatile storage element, and a RAM (Random Access Memory), which is a volatile storage element. The ROM stores immutable programs (e.g., a Basic Input / Output System (BIOS)). The RAM is a high-speed, volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by the CPU 31 and data used when the programs are executed.

[0023] The auxiliary storage device 33 is a large-capacity non-volatile storage device such as a magnetic storage device (HDD (Hard Disk Drive)) or a flash memory (SSD (Solid State Drive)), and stores the programs executed by the CPU 31 and data used when the programs are executed. That is, the programs are read from the auxiliary storage device 33, loaded into the memory 32, and executed by the CPU 31.

[0024] In this embodiment, the information used by the biometric authentication system 10 does not depend on the data structure and may be expressed in any data structure. For example, the information may be stored in a data structure appropriately selected from a table, a list, a database, or a queue.

[0025] The input device 35 is a device that receives input from an operator, such as a keyboard or a mouse. The input device 35 may also include a device for receiving input of an electronic document. The display device 36 is a device that outputs the execution result of a program in a format that can be viewed by an operator, such as a display device or a printer. The information processing device 3 may also have an input interface for receiving input of a moving image from the imaging device 2, or may receive a moving image from the imaging device 2 via the network 4. The communication device 34 is a network interface device that controls communication with other devices according to a predetermined protocol.

[0026] The program executed by the CPU 31 may be provided to the information processing device 3 from another information processing device equipped with a non-transitory storage device via a removable medium (such as a CD-ROM or a flash memory) which is a non-transitory storage medium or via the network 4, and may be stored in a non-volatile auxiliary storage device 33 which is a non-transitory storage medium. For this reason, the information processing device 3 may have an interface for reading data from the removable medium. The same applies to the server 5.

[0027] The information processing device 3 is a computer system configured on one physical computer or on multiple logically or physically configured computers, and may operate in separate threads on the same computer, or may operate on a virtual computer constructed on multiple physical computer resources. The same applies to the server 5.

[0028] The CPU 31 includes a moving image input unit 320 , a moving image processing unit 321 , a biometric information detection unit 322 , a biometric feature extraction unit 323 , a secret data generation unit 324 , a shared commitment generation unit 325 , a signature generation unit 326 , a biometric authentication unit 327 , and an electronic document input unit 328 .

[0029] The moving image input unit 320 receives input of a moving image from the imaging device 2. The moving image input unit 320 may be a function that is originally provided in a mobile terminal or a notebook PC (Personal Computer), both of which are examples of the information processing device 3.

[0030] The video input unit 320 displays a guide on the display device 36 and accepts input of a video captured by the imaging device 2. The video processing unit 321 converts the input video into a plurality of still images. The biometric information detection unit 322 detects and extracts biometric information of the face, fingers, palm, etc. from each still image. The biometric feature extraction unit 323 extracts features from the extracted biometric information. In this embodiment, the features may be a one-dimensional value or a two- or higher-dimensional vector.

[0031] The secret data generation unit 324 generates secret data to be restored when the biometric authentication is successful. The secret data generation unit 324 generates a key pair of a secret key and a public key based on the public key cryptography, for example, and determines the secret key as the secret data.

[0032] The shared commitment generation unit 325 generates a shared commitment from the secret data and the feature amount. The signature generation unit 326 generates a signature using the secret data obtained in the authentication process. The biometric authentication unit 327 executes biometric authentication with the server 5.

[0033] The auxiliary storage device 33 includes a reference matrix storage area 41. The reference matrix storage area 41 stores matrices for converting feature vectors for which Euclidean distance (L2 distance) or Hamming distance (L1 distance) is defined into vectors for which L∞ distance is defined.

[0034] For example, CPU 31 functions as video input unit 320 by operating according to a video input program loaded in memory 32, and functions as video processing unit 321 by operating according to a video processing program loaded in memory 32. The same applies to the relationships between programs and functional units for other functional units included in CPU 31. The same applies to the relationships between programs and functional units for functional units described later included in CPU 51 of server 5.

[0035] Some or all of the functions of the functional units included in the CPU 31 and the CPU 51 may be realized by hardware such as an Application Specific Integrated Circuit (ASIC) or a Field Programmable Gate Array (FPGA).

[0036] The server 5 is configured by a computer including, for example, a CPU 51, a memory 52, an auxiliary storage device 53, a communication device 54, an input device 55, and a display device 56. Descriptions of the hardware of the CPU 51, the memory 52, the auxiliary storage device 53, the communication device 54, the input device 55, and the display device 56 are omitted because they are similar to the descriptions of the hardware of the CPU 31, the memory 32, the auxiliary storage device 33, the communication device 34, the input device 35, and the display device 36.

[0037] The CPU 51 includes a data registration unit 521 and a data acquisition unit 522. The data registration unit 521 registers the distributed commitment in a database 530. In response to a request from the biometric authentication unit 327 of the information processing device 3, the data acquisition unit 522 acquires the distributed commitment stored in the database 530 and transmits it to the information processing device 3.

[0038] In the above example, the CPU 31 of the information processing device 3 has the biometric authentication unit 327, but the CPU 51 of the server 5 may have the biometric authentication unit 327, and the biometric authentication unit 327 of the server 5 may execute the biometric authentication.

[0039] The auxiliary storage device 53 includes a database 530. The database 530 holds the distribution commitment.

[0040] 2 is a flowchart showing an example of a biometric information registration process. In step S201, the video input unit 320 displays a guide on the display device 36 to present one or more types of biometric information to the user, and the user follows this guide to hold one or more types of biometric information, such as a face or a hand, over the imaging device 2. Note that the user may hold one or more types of biometric information over the imaging device 2 without the video input unit 320 displaying the guide.

[0041] When a mobile terminal such as a smartphone or tablet is used as the information processing device 3, the user holds his / her face and hand in the air (toward the lens of the imaging device 2 attached to the information processing device 3) at the same time. At this time, a guide including a message such as "Please remove your face and hand" may be displayed on the display device 36 so that multiple pieces of biometric information are not captured in an overlapping manner. This allows the user to stably acquire multiple pieces of biometric information, improving authentication accuracy.

[0042] In step S202, the moving image input unit 320 accepts input of a moving image from the imaging device 2, the moving image being captured by the imaging device 2 for a certain period of time of the user's hand.

[0043] In step S203, the video processing unit 321 converts the video input in step S202 into a plurality of still images. The video processing unit 321 may convert all frames in the video into still images, or may convert only a portion of the video into still images. The video processing unit 321 may also determine the quality of the still images obtained at this time, delete still images whose image quality is below a predetermined value, and not perform processing on the deleted still images in the subsequent processing.

[0044] In step S204, the biometric information detection unit 322 detects one or more types of biometric information captured in each of the still images generated in step S203. The biometric information detection unit 322 clips out a predetermined image area (e.g., an image area showing the hand of the person to be authenticated; hereinafter, also referred to as a "cut-out image") from the still images generated in step S203, and generates a background-separated image from the cut-out image. For example, the biometric information detection unit 322 generates a cut-out image based on a fixed coordinate position of the image acquired by the imaging device 2, or searches for predetermined biometric information (e.g., a hand or a face) in the captured image and generates a cut-out image based on the circumscribed rectangular coordinates thereof.

[0045] In step S205, the biological information detection unit 322 determines whether or not a predetermined number or more types of biological information have been acquired in step S204. The biological information detection unit 322 repeats the process of step S204 until the predetermined number or more types of biological information have been acquired.

[0046] At this time, the biometric information detection unit 322 may treat all biometric information equally, or may treat the biometric information hierarchically, such as by determining that a face has been acquired if "iris or face" is acquired and that a hand has been acquired if "three or more fingers or one palm" is acquired. The process of treating the biometric information hierarchically will be described in the second embodiment.

[0047] In step S206, the biometric feature extraction unit 323 extracts feature amounts X_i from each piece of acquired biometric information. When there are n types of biometric information to be used, the biometric feature extraction unit 323 extracts at least n pieces of feature amounts X_i, that is, extracts at least one feature amount from each piece of biometric information.

[0048] In step S207, the secret data generation unit 324 creates secret data (Ks) which is data to be restored when the authentication process described later is successful. Specifically, the secret data generation unit 324 randomly generates a pair of a private key and a public key (Kp) by electronic signature technology such as RSA signature, DSA (Digital Signature Algorithm), ElGamal signature, Schnorr signature, elliptic DSA, elliptic ElGamal signature, or elliptic Schnorr signature (the pair of private key and public key does not have to be generated from biometric information), and stores the public key in the auxiliary storage device 33. The secret data is not limited to the private key, and may be any data that the user wants to keep secret, such as a password and personal information.

[0049] In step S208, the shared commitment generating unit 325 divides the secret data Ks into n shares (ds_1, . . . , ds_n) by the (k, n) threshold secret sharing scheme.

[0050] In step S209, the distribution commitment generation unit 325 generates the distribution commitment C_i=Emb(X_i, ds_i) by embedding the distribution share ds_i (i=1, . . . , n) in each feature X_i using a predetermined embedding function Emb. At this time, an embedding function Emb is used that makes it sufficiently difficult to estimate the feature X_i and the distribution share ds_i from the commitment C_i. Specific examples of the embedding function Emb that can be used include those described in Patent Document 2, and those described later in FIG. 4.

[0051] In step S210, the distributed commitment generation unit 325 determines each of the distributed commitments C_i generated in step S209 as registration data, and transmits it together with a registration request to the server 5 via the network 4. In addition, the distributed commitment generation unit 325 discards the secret data Ks, the shared shares ds_i, the shared shares (ds_1, ds_2, . . . , ds_n), and the biometric features (X_1, . . . , X_n), which are sensitive information.

[0052] In step S211, the server 5 receives the registration request and registration data transmitted from the information processing device 3 to the server 5 in step S210, and the data registration unit 521 stores the registration data in the database 50. Since the secret data cannot be restored from the divided shares unless authentication related to one or more types of biometric information is successful, the distributed commitment generation unit 325 may store all the distributed commitments in the auxiliary storage device 33 of the information processing device 3 without transmitting the distributed shares to the server 5.

[0053] 3 is a flowchart showing an example of authentication processing, in which the biometric authentication system 10 performs online personal authentication by using multiple types of biometric information to restore the same private key and perform digital signing.

[0054] In step S301, the video input unit 320 displays a guide on the display device 36 to encourage the user to present one or more types of biometric information, and in response to this, the user holds one or more types of biometric information (the same biometric information as at the time of registration, for example, the face and hand) over the imaging device 2. Note that the user may hold one or more types of biometric information over the imaging device 2 without the video input unit 320 displaying the guide. The processing from step S302 to step S304 is similar to the processing from step S202 to step S204, and therefore the description thereof will be omitted.

[0055] In step S305, the biometric authentication unit 327 transmits a divided commitment acquisition request to the server 5 via the network 4, and the data acquisition unit 522 of the server 5 that has received the template request acquires registration data from the database 50 by specifying the user ID, and transmits the data to the information processing device 3. Note that the process of step S305 may be executed at any time between the processes of steps S301 to S306. For example, step S305 may be executed after the process of step S301, and then the processes of steps S302 to S304 and step S306 may be executed.

[0056] In step S306, the biometric authentication unit 327 restores the shared share ds_i from the acquired biometric feature X'_i and the shared commitment C_i included in the enrollment data. A method for restoring the commitment will be described later with reference to FIG.

[0057] In step S307, the biometric authentication unit 327 determines whether the number of restored shared shares is equal to or greater than a predetermined number k, and if the number of restored shared shares is less than the predetermined number k, restores further shared shares from another biometric feature X'_j and the distributed commitment C_j. That is, the biometric authentication unit 327 repeats the process of step S306 until the number of restored shared shares is equal to or greater than the predetermined number k, and transitions to step S308 when the number of restored shared shares is equal to or greater than the predetermined number k.

[0058] In step S308, the biometric authentication unit 327 reconstructs the secret data Ks from the predetermined number k or more of reconstructed shares based on the (k, n) threshold secret sharing scheme.

[0059] In step S309, if the restored private data is the private key Ks in the electronic signature, the electronic document input unit 328 acquires the electronic document Me (Me may be a random message). The electronic document input unit 328 may receive the electronic document Me via the network 4, for example, or may read the electronic document Me from a recording medium such as a Universal Serial Bus (USB) memory, or may read the electronic document Me created by a signature generation device (not shown) connected to the information processing device 3.

[0060] In step S310, the signature generation unit 326 generates an electronic signature σ=Sign(Me,Ks) using the restored private key (private data Ks) for the electronic document Me, and generates S=(σ,Kp) as signature data by pairing the generated electronic signature σ with a public key that is a pair of the private key. Note that any electronic signature algorithm, such as RSA signature or DSA, may be used as the signature generation function (Sign).

[0061] 4 is a flowchart showing an example of the distribution commitment generation process in step S209. A distribution commitment C_i is generated from the biometric feature X_i and the distribution share ds_i.

[0062] In step S401, the distributed commitment generating unit 325 acquires one biometric feature X_i from among multiple types of biometric information. In step S402, the distributed commitment generating unit 325 acquires ds_i, which is one of the distributed shares generated from the secret data Ks.

[0063] In step S403, the distributed commitment generation unit 325 converts the feature vector X_i, which is generally defined as a Euclidean distance (L2 distance) or a Hamming distance (L1 distance), into a vector Y_i, which is defined as an L∞ distance. Specifically, for example, the distributed commitment generation unit 325 acquires a matrix M from the reference matrix storage area 41, and converts the biometric feature X_i into a feature Y_i by multiplying the matrix M by the biometric feature X_i. The matrix M is composed of m one-dimensional vectors. Here, n is the number of dimensions of the biometric feature X_i. As one example of the configuration of the matrix M, the matrix M may be composed of m one-dimensional reference vectors whose norm coincides with a predetermined constant c. Specifically, for example, the distributed commitment generation unit 325 calculates the feature vector Y_i using the following conversion formula (Formula 1).

[0064]

number

[0065] The vector r is a random number vector generated using a pseudorandom number generator, for example. Note that the process of adding this random number vector does not have to be executed.

[0066] In step S404, the distributed commitment generation unit 325 creates a secret vector and a public vector from the feature vector Y_i calculated in step S403 by calculation based on a predetermined reference threshold integer t. Specifically, for example, the distributed commitment generation unit 325 calculates the secret vector Ys_i using (Equation 2), and calculates the public vector Yp_i using the following (Equation 3).

[0067]

number

[0068]

number

[0069] In step S405, the distributed commitment generation unit 325 calculates the distributed commitment using the distributed share ds_i, the private vector Ys_i, and the public vector Yp_i. Specifically, for example, the distributed commitment generation unit 325 calculates the distributed commitment using the following (Equation 4).

[0070]

number

[0071] As another example of calculating the shared commitment, the shared commitment generation unit 325 may calculate the shared commitment C_i=enc(ds_i,h) for the secret vector calculated by (Equation 2) using a common key encryption with a cryptographic hash function h=hash(Ys_i) as the key.

[0072] It is sufficiently difficult to estimate the feature quantity X_i and the distribution share ds_i from the distribution commitment C_i calculated by the above procedure. Note that, although one distribution commitment is calculated by the processing of steps S401 to 405, in step S307, the processing of steps S401 to 405 is repeated until a predetermined number k or more of distribution commitments are generated.

[0073] 5 is a flowchart showing an example of the distributed share restoration process in step S306. In the distributed share restoration process, the distributed share ds_i is restored from the distributed commitment based on the biometric feature X'_i extracted during the authentication process.

[0074] In step S501, the biometric authentication unit 327 acquires one biometric feature X_i In step S502, the biometric authentication unit 327 acquires one distributed commitment C_i.

[0075] In step S503, the biometric authentication unit 327 converts the feature vector X_i, which is generally defined as a Euclidean distance (L2 distance) or a Hamming distance (L1 distance), into a vector Y_i, which is defined as an L∞ distance. Specifically, for example, the biometric authentication unit 327 obtains a matrix M from the reference matrix storage area 41, and converts the biometric feature X_i into a feature Y_i by multiplying the matrix M by the biometric feature X_i. The matrix M stored in the reference matrix storage area 41 is the same as that described in step S403, and therefore will not be described.

[0076] In step S504, the biometric authentication unit 327 restores the distributed share d_i by the following (Equation 5).

[0077]

number

[0078] In addition, the floor(x) function in (Equation 5) is a function that converts each component of the vector x into the nearest integer. Also, Ext(C_i, Y') in Fig. 5 is a function that represents decoding using C_i and Y', and the above-mentioned (Equation 5) is a specific example of this function.

[0079] As another example of restoring the distributed shares, the biometric authentication unit 327 may calculate ds_i=dec(C_i,h) by common key cryptography using a hash value h calculated by the following (Equation 6) as a key.

[0080]

number

[0081] According to this embodiment, when authentication is successful using one type of biometric information captured by a dedicated device or a general-purpose camera, one distributed share can be restored, and when biometric authentication is successful for k or more types of biometric information out of n types of biometric information captured by a dedicated device or a general-purpose camera, a function can be realized to efficiently restore a fixed private key. EXAMPLES

[0082] In this embodiment, an example of hierarchical AND authentication of biometric information consisting of multiple components and biometric information consisting of one component will be described, as seen in the examples of biometric authentication of the hand (two of four fingers) and iris (one of two).

[0083] 6 is a flowchart showing an example of the registration process. The processes from step S201 to step S207 are the same as those in the first embodiment, and therefore the description thereof will be omitted.

[0084] In step S608, the shared commitment generating unit 325 divides the secret data Ks into biometric authentication groups and performs secret sharing processing. Note that the grouping is assumed to be predetermined.

[0085] Fig. 8 is an explanatory diagram showing an example of hierarchical division of biometric authentication groups in hierarchical distributed commitment. Fig. 9 is an explanatory diagram showing an example of the configuration of hierarchical distributed commitment in the form of a tree structure. As can be seen in Figs. 8 and 9, group 81 is a finger group, and group 82 is a face group. Finger group 81 includes finger vein group 811 and fingerprint group 812, which are at lower levels. Face group 82 includes visible light face group 821 and iris group 822, which are at lower levels.

[0086] That is, in the examples of Figures 8 and 9, k=2 shared commitments (i.e., when the correct shared shares are recovered from both the finger and the face, the secret data Ks is recovered) are generated for each of the features obtained from the finger and the face.

[0087] In addition, for each of the features obtained from the finger vein at the next lower level of the finger and the features obtained from the fingerprint, a shared commitment with k=2 (i.e., the finger features are restored when the correct shared share is restored from both the finger vein and fingerprint) is generated.

[0088] Furthermore, for each feature obtained from the finger vein of each finger, which is one level lower than the finger vein, a distributed commitment of k=a (i.e., the finger vein feature will be restored if the correct distributed share is restored from the finger vein of each of a or more fingers) is generated. Also, for each feature obtained from the fingerprint of each finger, which is one level lower than the finger vein, a distributed commitment of k=b (i.e., the finger vein feature will be restored if the correct distributed share is restored from the finger vein of each of b or more fingers) is generated.

[0089] In addition, for each of the features obtained from the visible light face at the next lower level than the face and the features obtained from the iris, a shared commitment with k=2 (i.e., the face features are restored when the correct shared share is recovered from both the visible light face and the iris) is generated.

[0090] An example of the process of restoring the secret data Ks will be described with reference to the examples of Fig. 8 and Fig. 9. First, if the correct distribution share is restored from the finger vein features of a or more fingers among the finger vein features (C_1, C_2, C_3), the finger vein feature Ds_11 is obtained from the distribution share. If the correct distribution share is restored from the fingerprint features of b or more fingers among the fingerprint features (C_11, C_12, C_13), the fingerprint feature Ds_12 is obtained from the distribution share. Furthermore, if the correct distribution share is restored from each of the obtained finger vein feature Ds_11 and the obtained finger vein feature Ds_12, the finger feature is obtained.

[0091] Similarly, if the correct distribution share is restored from one visible light face feature C_22 and one iris feature C_23, then the face feature DS_2 is obtained. Finally, if the correct distribution share is restored from the obtained finger feature Ds_1 and the obtained face feature Ds_2, then the secret data Ks is restored.

[0092] Returning to the description of Fig. 6, in step S608, the shared commitment generation unit 325 configures the secret data Ks so that it can be restored when k shared shares ds_i are obtained by the (k, n) threshold secret sharing scheme, as described in Fig. 8 and Fig. 9.

[0093] In step S609, the distributed commitment generation unit 325 judges whether the authentication group has a lower authentication group (element). When the distributed commitment generation unit 325 judges that the authentication group has a lower authentication group (element), it regards the distributed share ds_i having the lower authentication group as new secret data, and executes the process of step S608 for the lower authentication group. The distributed commitment generation unit 325 repeats the process of step S608 until there are no lower authentication groups (elements) for which distributed shares have not been generated, and when there are no lower authentication groups (elements) for which distributed shares have not been generated, it transitions to step S610. Hereinafter, the set of distributed shares ds_i' thus constructed is also referred to as a hierarchical distributed share Ts.

[0094] In step S610, the distributed commitment generation unit 325 generates distributed commitments C_i for all distributed shares arranged at leaf nodes for the hierarchical distributed share Ts in the same manner as in step S209. Note that, in order to make it possible to recognize the decoding order of the commitments, the distributed commitment generation unit 325 configures the hierarchical distributed commitment Tc by arranging each of the distributed commitments C_i in the same structure as the hierarchical structure of the hierarchical distributed share.

[0095] In step S611, the distributed commitment generation unit 325 determines the hierarchical distributed commitment Tc as the registration data and transmits it together with the registration request to the server 5 via the network 4. In addition, the distributed commitment generation unit 325 discards the confidential data Ks, the shared shares ds_i, the hierarchical shared shares (ds'_1, ds'_2, . . . , ds'_n), and the biometric features (X_1, . . . , X_n), which are sensitive information, and transitions to step S211.

[0096] The distribution commitment generation unit 325 may store the hierarchical distribution commitment Tc in the auxiliary storage device 33 instead of transmitting it to the server 5 .

[0097] Fig. 7 is a flowchart showing an example of authentication processing. In the authentication processing, the biometric authentication system 10 performs online personal authentication by recovering a private key using multiple types of biometric information and performing an electronic signature. The processing from step S301 to step S304 is the same as that in Fig. 3, and therefore the description will be omitted.

[0098] In step S705, the biometric authentication unit 327 acquires the hierarchical distributed commitment Tc from the auxiliary storage device 33 or the server 5.

[0099] In step S706, the biometric authentication unit 327 restores the shared share ds_i from the biometric feature X'_i extracted in step S304 and the commitment C_i at the leaf node of the hierarchical shared commitment Tc.

[0100] In step S707, the biometric authentication unit 327 restores the distributed share ds_i of each node for any of the intermediate nodes of the hierarchical distributed commitment Tc (for example, the node that is reached first by the depth-first search).

[0101] In step S708, the biometric authentication unit 327 determines whether share restoration (i.e., restoration of secret data Ks) has been completed for the root node of the hierarchical distributed commitment Tc. If the biometric authentication unit 327 determines that share restoration has not been completed for the root node of the hierarchical distributed commitment Tc, then in step S711, the biometric authentication unit 327 searches for the next unrestored intermediate node by depth-first search, and executes the process of step S707. That is, the biometric authentication unit 327 repeats the processes of steps S711 and S707 until share restoration is completed for the root node of the hierarchical distributed commitment Tc, and when share restoration is completed, executes the processes of steps S309 and S310.

[0102] According to this embodiment, it is possible to realize a function for efficiently recovering a fixed secret key by repeating AND / OR authentication of biometric information defined in hierarchical groups. EXAMPLES

[0103] In this embodiment, another implementation method for restoring a private key randomly generated at the time of registration based on AND authentication of multiple types of biometric information captured by a dedicated device or a general-purpose camera will be described.

[0104] 10 is a flow chart showing an example of the registration process. The processes from step S201 to step S207 are the same as those in FIG. 2, and therefore the description thereof will be omitted.

[0105] In step S1008, the private data generation unit 324 randomly generates a temporary encryption key TKs (TKs is also an example of private data). In step S1009, the private data generation unit 324 encrypts the private key (Ks) using the temporary encryption key (TKs) as a common key encryption key to generate an encrypted private key Eks (EKs←Enc(Ks, TKs)). The common key encryption method used for the encryption may be AES (Advanced Encryption Standard) or the like.

[0106] In step S1010, the distributed commitment generation unit 325 embeds a temporary encryption key TKs using a predetermined embedding function Emb for any combination of k types of features that serve as the conditions for AND judgment, out of the n types of features X_i extracted in step S206, and generates a commitment C_a=Emb(X_i||X_j||X_k, TKs) (three types of features X_i, X_j, and X_k are used to calculate this commitment C_a, but the number of types of features used to calculate C_a is any value less than or equal to n).

[0107] At this time, the embedding is performed so that it is sufficiently difficult to estimate the k types of features X_i and the temporary encryption key TKs from the commitment C_a. As an example of the implementation of the commitment C_a, there is an implementation in which one commitment is generated for each combination of k types of biometric features. As a specific example of the embedding function Emb, the method described in Patent Document 2 may be used for the second feature obtained by concatenating the k types of features X_i or the third feature obtained by XORing the k types of features X_i, or Emb described in FIG. 4 may be used.

[0108] In step S1011, the distributed commitment generation unit 325 transmits the set of distributed commitments C_a generated in step S1010, information indicating the type of features used to generate C_a, and the encrypted private key EKs as registration data together with a registration request to the server 5 via the network 4, and the data registration unit 521 registers the registration data in the database 530. In step S1012, the distributed commitment generation unit 325 discards the private data Ks, the temporary encryption key TKs, and the biometric features (X_1, . . . , X_n).

[0109] Fig. 11 is a flowchart showing an example of authentication processing. In the authentication processing, the biometric authentication system 10 performs online personal authentication by recovering a private key using multiple types of biometric information and creating an electronic signature. The processing from step S301 to step S305 is the same as in Fig. 3, so the description will be omitted.

[0110] In step S1106, the biometric authentication unit 327 restores the temporary encryption key TKs from the k types of biometric features X'_i among the features acquired in step S304 and the corresponding commitment C_a. The biometric authentication unit 327 restores the temporary encryption key TKs by using the restoration means described in FIG. 5 for, for example, a second feature obtained by concatenating the k types of features X_i or a third feature obtained by XORing the k types of features X_i.

[0111] In step S1107, the biometric authentication unit 327 restores the private key Ks from the encrypted private key EKs using the temporary encryption key TKs as a key for a common key cryptosystem (for example, AES), and then the processes of steps S309 and S310 are executed.

[0112] According to this embodiment, it is possible to provide a system that efficiently restores a fixed secret key when the authentication of the AND combination of any two or more pieces of biometric information among a plurality of pieces of biometric information captured by a dedicated device or a general-purpose camera is successful. Also, it is possible to suppress the image size of the required authentication template data.

[0113] According to this embodiment, it is possible to provide a system that efficiently recovers a secret key when the authentication of the AND combination of any of multiple types of biometric information projected on a dedicated device or a general-purpose camera is successful, and it is also possible to reduce the size of the required authentication template data. EXAMPLES

[0114] 12 is an example of a guide displayed on the display device 36 in steps S201 and S301 in the first, second, and third embodiments. For example, a face guide area 121 and a finger guide area 122 are displayed on the display device 36. The face guide area 121 guides a recommended position for capturing an image of a face in the imaging area and a recommended size of the face. The finger guide area 122 indicates a recommended position for capturing an image of a finger in the imaging area. The finger guide area 122 displays a finger guide message 123. The finger guide message 123 is a message that recommends including four fingers in the finger guide area 122. The guide in FIG. 12 makes it possible to capture an image that makes it easier to obtain biometric information more accurately.

[0115] The present invention is not limited to the above-mentioned embodiment, and various modifications are included. For example, the above-mentioned embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all the configurations described. It is also possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0116] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0117] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0118] 2 imaging device, 3 information processing device, 5 server, 31 CPU, 32 memory, 33 auxiliary storage device, 34 communication device, 35 input device, 36 display device, 41 reference matrix storage area, 51 CPU 52 memory, 53 auxiliary storage device, 54 communication device, 55 input device, 56 display device, 320 video input unit, 321 video processing unit, 322 biometric information detection unit, 323 biometric feature extraction unit, 324 secret data generation unit, 325 shared commitment generation unit, 326 signature generation unit, 327 biometric authentication unit, 328 electronic document input unit, 521 data registration unit, 522 data acquisition unit, 530 database

Claims

1. An information processing device, A processor and a memory, The memory includes a commitment generated based on a feature for registration obtained from each of a plurality of types of biometric information and a share generated by distributing secret data by a (k, n) threshold secret sharing scheme, the commitment corresponding to each of the feature for registration, and A reference matrix for converting the feature quantity into a feature vector for which a predetermined type of distance is defined; Each of said commitments is: an exclusive OR of a secret vector generated from the registration feature corresponding to the commitment and one of the shares; a public vector generated from the registration feature corresponding to the commitment; and a combination of a private vector and a public vector included in each of the commitments is based on a quotient and a remainder obtained by dividing a feature vector obtained by transforming a registration feature corresponding to the commitment by the reference matrix, by a predetermined reference threshold value; The processor, Acquire authentication feature quantities obtained from each of the plurality of types of biometric information, restoring a predetermined number or more of the shares based on the authentication feature and a commitment corresponding to an enrollment feature obtained from biometric information of the same type as the authentication feature; restoring the secret data based on the restored shares, the number of which is equal to or greater than the predetermined number; In restoring each of the predetermined number or more shares, converting the authentication feature into a feature vector using the reference matrix; An information processing device that restores the share used to calculate the exclusive OR included in the commitment by dividing the difference between the converted feature vector and a public vector included in the commitment corresponding to the enrollment feature obtained from the same type of biometric information as the authentication feature by the specified standard threshold, and calculating an exclusive OR based on the commitment.

2. An information processing device, A processor and a memory, The memory includes a commitment generated based on a feature for registration obtained from each of a plurality of types of biometric information and a share generated by distributing secret data by a (k, n) threshold secret sharing scheme, the commitment corresponding to each of the feature for registration, and A public vector corresponding to each of the registration features; A reference matrix for converting the feature quantity into a feature vector for which a predetermined type of distance is defined; Each of the commitments is generated by a predetermined embedding process in which one of the shares is encrypted with a common key cipher using a hash value obtained from a secret vector generated from the registration feature corresponding to the commitment and a predetermined cryptographic hash function as a key; a combination of a private vector and a public vector included in each of the commitments is based on a quotient and a remainder obtained by dividing a feature vector obtained by transforming a registration feature corresponding to the commitment by the reference matrix, by a predetermined reference threshold value; The processor, Acquire authentication feature quantities obtained from each of the plurality of types of biometric information, restoring a predetermined number or more of the shares based on the authentication feature and a commitment corresponding to an enrollment feature obtained from biometric information of the same type as the authentication feature; restoring the secret data based on the restored shares, the number of which is equal to or greater than the predetermined number; In restoring each of the predetermined number or more shares, converting the authentication feature into a feature vector using the reference matrix; an information processing device that restores the share corresponding to the commitment by decrypting the commitment using a hash value calculated from the predetermined cryptographic hash function and the quotient obtained by dividing the difference between the converted feature vector and a public vector corresponding to the registration feature obtained from biometric information of the same type as the authentication feature, using the predetermined standard threshold, as a decryption key.

3. 3. The information processing device according to claim 1, The relationship between types of biometric information is defined in a tree structure. A root node of the tree structure is the secret data, each of the commitments is generated based on one share generated by distributing the feature for registration of a type corresponding to a parent node of the tree structure by a (k, n) threshold secret sharing scheme, the feature for registration of a type corresponding to one child node of the parent node, and the predetermined embedding process; The processor, an information processing device that restores a predetermined number or more of shares from the authentication features of a type corresponding to a child node of the tree structure and a commitment corresponding to enrollment features obtained from biometric information of the same type as the authentication features, and restores a share corresponding to a parent node of the child node based on the restored shares, thereby repeating the process to restore the secret data that is the root node.

4. An information processing system including a first information processing device and a second information processing device, The first information processing device, A method for converting a feature quantity into a feature vector having a predetermined distance defined therein, comprising: Acquire registration feature quantities obtained from each of the plurality of types of biometric information; generating shares by distributing the secret data using a (k, n) threshold secret sharing scheme; Converting each of the features into a feature vector using the reference matrix; generating a combination of a secret vector and a public vector for each of the features for registration based on a quotient and a remainder obtained by dividing the feature vector into which the feature for registration has been converted by a predetermined reference threshold; For each of the registration features, an exclusive OR of the secret vector generated from the registration feature and one of the shares; a public vector generated from the registration feature quantity; and generating a commitment including the public vector and registering the commitment in the second information processing device; the second information processing device transmits the registered commitment to the first information processing device in response to a request from the first information processing device; The first information processing device, Acquire authentication feature quantities obtained from each of the plurality of types of biometric information, restoring a predetermined number or more of the shares based on the authentication feature and a commitment corresponding to an enrollment feature obtained from biometric information of the same type as the authentication feature; restoring the secret data based on the restored shares, the number of which is equal to or greater than the predetermined number; In restoring each of the predetermined number or more shares, converting the authentication feature into a feature vector using the reference matrix; An information processing system that restores the share used to calculate the exclusive OR included in the commitment by dividing the difference between the converted feature vector and a public vector included in the commitment corresponding to the enrollment feature obtained from the same type of biometric information as the authentication feature by the specified standard threshold, and calculating an exclusive OR based on the commitment.

5. An information processing system including a first information processing device and a second information processing device, The first information processing device, A method for converting a feature quantity into a feature vector having a predetermined distance defined therein, comprising: Acquire registration feature quantities obtained from each of the plurality of types of biometric information; generating shares by distributing the secret data using a (k, n) threshold secret sharing scheme; Converting each of the features into a feature vector using the reference matrix; generating a combination of a secret vector and a public vector for each of the features for registration based on a quotient and a remainder obtained by dividing the feature vector into which the feature for registration has been converted by a predetermined reference threshold; encrypting one of the shares with a common key cipher using a hash value obtained from a secret vector generated from the registration feature and a predetermined cryptographic hash function as a key for each of the registration feature, thereby generating a commitment and registering the commitment in the second information processing device; the second information processing device transmits the registered commitment to the first information processing device in response to a request from the first information processing device; The first information processing device, Acquire authentication feature quantities obtained from each of the plurality of types of biometric information, restoring a predetermined number or more of the shares based on the authentication feature and a commitment corresponding to an enrollment feature obtained from biometric information of the same type as the authentication feature; restoring the secret data based on the restored shares, the number of which is equal to or greater than the predetermined number; In restoring each of the predetermined number or more shares, converting the authentication feature into a feature vector using the reference matrix; an information processing system that restores the share corresponding to the commitment by decrypting the commitment using a hash value calculated from the predetermined cryptographic hash function and the quotient obtained by dividing the difference between the converted feature vector and a public vector corresponding to the registration feature obtained from biometric information of the same type as the authentication feature, using the predetermined standard threshold, as a decryption key.

6. An information processing method by an information processing device, The information processing device includes a processor and a memory, The memory includes a commitment generated based on a feature for registration obtained from each of a plurality of types of biometric information and a share generated by distributing secret data by a (k, n) threshold secret sharing scheme, the commitment corresponding to each of the feature for registration, and A reference matrix for converting the feature quantity into a feature vector for which a predetermined type of distance is defined; Each of said commitments is: an exclusive OR of a secret vector generated from the registration feature corresponding to the commitment and one of the shares; a public vector generated from the registration feature corresponding to the commitment; a combination of a private vector and a public vector included in each of the commitments is based on a quotient and a remainder obtained by dividing a feature vector obtained by transforming a registration feature corresponding to the commitment by the reference matrix, by a predetermined reference threshold value; The information processing method includes: the processor acquires authentication feature amounts obtained from each of a plurality of types of biometric information; the processor restores a predetermined number or more of the shares based on the authentication feature and a commitment corresponding to an enrollment feature obtained from biometric information of the same type as the authentication feature; The processor recovers the secret data based on the recovered shares equal to or greater than the predetermined number; wherein the processor, in restoring each of the predetermined number or more of shares, converting the authentication feature into a feature vector using the reference matrix; An information processing method, comprising: calculating an exclusive OR based on the commitment and a quotient obtained by dividing the difference between the converted feature vector and a public vector included in the commitment corresponding to the enrollment feature obtained from the same type of biometric information as the authentication feature, by the specified standard threshold, thereby restoring the share used to calculate the exclusive OR included in the commitment.

7. An information processing method by an information processing device, The information processing device includes a processor and a memory, The memory includes a commitment generated based on a feature for registration obtained from each of a plurality of types of biometric information and a share generated by distributing secret data by a (k, n) threshold secret sharing scheme, the commitment corresponding to each of the feature for registration, and A public vector corresponding to each of the registration features; A reference matrix for converting the feature quantity into a feature vector for which a predetermined type of distance is defined; Each of the commitments is obtained by encrypting one of the shares with a common key cipher using a hash value obtained from a secret vector generated from the registration feature corresponding to the commitment and a predetermined cryptographic hash function as a key; a combination of a private vector and a public vector included in each of the commitments is based on a quotient and a remainder obtained by dividing a feature vector obtained by transforming a registration feature corresponding to the commitment by the reference matrix, by a predetermined reference threshold value; The information processing method includes: the processor acquires authentication feature amounts obtained from each of a plurality of types of biometric information; the processor restores a predetermined number or more of the shares based on the authentication feature and a commitment corresponding to an enrollment feature obtained from biometric information of the same type as the authentication feature; The processor recovers the secret data based on the recovered shares equal to or greater than the predetermined number; wherein the processor, in restoring each of the predetermined number or more of shares, converting the authentication feature into a feature vector using the reference matrix; An information processing method, comprising: decrypting the commitment using a hash value calculated from the predetermined cryptographic hash function and the quotient obtained by dividing the difference between the converted feature vector and a public vector corresponding to the registration feature obtained from biometric information of the same type as the authentication feature by the predetermined standard threshold, thereby restoring the share corresponding to the commitment, as a decryption key.

Images