AUTHENTICATION SYSTEM, AUTHENTICATED DEVICE, AUTHENTICATOR DEVICE, AUTHENTICATION METHOD, AND AUTHENTICATION PROGRAM

Abstract

This authentication system is for transmitting a cryptogram of authentication information from a to-be-authenticated person device to an authenticating person device by using homographic encryption that uses a public key encryption format. The authenticating person device issues a first random number to the to-be-authenticated person device. The to-be-authenticated person device generates a second random number, and transmits, to the authenticating person device, a first element generated by using a public key that uses the first random number and the second random number and a second element generated by using a public key that uses the second random number. The authenticating person device corrects the second element by using the first random number, and obtains a cryptogram of the authentication information.

Description

[Technical Field]

[0001] The present invention relates to an authentication system, an authenticatee device, an authenticator device, an authentication method, and an authentication program. [Background technology]

[0002] Biometric authentication is an example of personal authentication. "Biometric authentication" is a method of personal authentication in which the biometric information of the person to be authenticated is compared with the biometric information of the person being authenticated to confirm whether the person to be authenticated matches the person to be authenticated. Here, "biometric information" refers to data extracted from some of an individual's physical or behavioral characteristics. For example, "biometric information" includes features extracted from images such as fingerprints and palm prints, and features extracted from audio data such as voiceprints.

[0003] In biometric authentication, the biometric information of the person to be authenticated is registered in advance, and at the time of authentication, it is verified whether the registered biometric information matches the biometric information of the person to be authenticated. At this time, a high level of security management is required for the biometric information, and it is preferable that the verification of whether the registered biometric information matches the biometric information of the person to be authenticated is also performed in an encrypted state.

[0004] Homomorphic encryption is an encryption method that meets these requirements. "Homomorphic encryption" is an encryption method that has homomorphism, and is capable of calculating the ciphertext resulting from an operation between decrypted plaintexts as is. Using homomorphic encryption makes it possible to calculate the similarity between the features of registered biometric information and the features of the biometric information of the person being authenticated as is. The similarity of the features is, for example, the squared Euclidean distance or inner product between the features, and if these values ​​are within a predetermined range, it can be determined that the registered biometric information and the biometric information of the person being authenticated match. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2016-114692 Summary of the Invention [Problem to be solved by the invention]

[0006] The disclosures of the above prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0007] Although authentication methods using homomorphic encryption transmit and receive encrypted biometric information, replay attacks, also known as "spoofing," can be carried out. A replay attack is an attack method in which a malicious attacker intercepts authentication information sent by a legitimate person to an authentication device and retransmits it to the authentication device as is. Although the malicious attacker cannot decrypt the intercepted authentication information, the encrypted authentication information is legitimate, so the authentication is successful.

[0008] One method of countering this type of replay attack is known as the challenge-response authentication method. In challenge-response, the authenticator issues a different challenge for each authentication and requests the authenticatee to provide a response corresponding to this challenge. Since the challenge and response pair is different for each authentication, a malicious attacker cannot succeed in authentication by simply sending a response that he or she has previously intercepted to the authenticator.

[0009] In authentication using homomorphic encryption, a challenge-response is followed by a similarity calculation using homomorphic operations. Therefore, the challenge can be embedded in the response and transmitted so that the authenticator can return the ciphertext that was originally intended to be sent by the person to be authenticated in post-processing. For example, Patent Document 1 describes a challenge-response method in which the received challenge is embedded in plaintext using the homomorphism of homomorphic encryption and this is transmitted as a response. The method described in Patent Document 1 utilizes the fact that only those who know the plaintext can perform pseudo-division using inverse element calculation and homomorphic multiplication in the plaintext space.

[0010] As described above, in the case of challenge-response in authentication using homomorphic encryption, the challenge-response and the homomorphic encryption method are closely related. Therefore, the method described in Patent Document 1 is not necessarily the optimal method for all homomorphic encryption methods. Depending on the homomorphic encryption method, it may be possible to improve the amount of communication and calculation by using a method different from the method described in Patent Document 1. In other words, if the number of types of challenge-response that can be used for authentication using homomorphic encryption increases, it will become possible to select and use the optimal challenge-response to suit the homomorphic encryption.

[0011] In view of the above-mentioned problems, an object of the present invention is to provide an authentication system, an authenticatee device, an authenticator device, an authentication method, and an authentication program that contribute to security against replay attacks. [Means for solving the problem]

[0012] According to a first aspect of the present invention, there is provided an authentication system that transmits a ciphertext of authentication information from an authenticated user device to an authenticator device using homomorphic encryption using a public key cryptosystem, wherein the authenticator device issues a first random number to the authenticated user device, the authenticator device generates a second random number, and transmits to the authenticator device a first element generated using the first random number and a public key using the second random number, and a second element generated using a public key using the second random number, and the authenticator device modifies the second element using the first random number to obtain the ciphertext of the authentication information.

[0013] According to a second aspect of the present invention, there is provided an authenticated user device that transmits an encrypted text of authentication information to an authenticator device using homomorphic encryption with a public key cryptosystem, receiving a first random number from the authenticator device, generating a second random number, and transmitting to the authenticator device a pair of a first element generated using the first random number and a public key using the second random number, and a second element generated using a public key using the second random number, from which the encrypted text of the authentication information can be obtained by modifying the second element using the first random number.

[0014] A third aspect of the present invention provides an authenticator device that receives a ciphertext of authentication information from an authenticated user device using homomorphic encryption using a public key cryptosystem, wherein the authenticator device issues a first random number to the authenticated user device, the authenticated user device generates a second random number, receives from the authenticated user device a first element generated using the first random number and a public key using the second random number, and a second element generated using a public key using the second random number, and modifies the second element using the first random number to obtain the ciphertext of the authentication information.

[0015] A fourth aspect of the present invention provides an authentication method for transmitting a ciphertext of authentication information from an authenticated user device to an authenticator device using homomorphic encryption with a public key cryptosystem, in which the authenticator device issues a first random number to the authenticated user device, the authenticator device generates a second random number, and transmits to the authenticator device a first element generated using the first random number and a public key using the second random number, and a second element generated using a public key using the second random number, and the authenticator device modifies the second element using the first random number to obtain the ciphertext of the authentication information.

[0016] A fifth aspect of the present invention provides an authentication program for transmitting ciphertext of authentication information from an authenticatee device to an authenticator device using homomorphic encryption using a public key cryptosystem, the program causing the authenticator device to issue a first random number to the authenticatee device, generate a second random number, transmit to the authenticator device a first element generated using the first random number and a public key using the second random number, and a second element generated using a public key using the second random number, and modify the second element using the first random number, thereby obtaining the ciphertext of the authentication information. This program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product. [Effects of the Invention]

[0017] According to each aspect of the present invention, it is possible to provide an authentication system, an authenticatee device, an authenticator device, an authentication method, and an authentication program that contribute to security against replay attacks. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 1 is a diagram showing a schematic configuration of an authentication system according to the first embodiment. [Figure 2] FIG. 2 is a system flow diagram showing an outline of the procedure of the authentication method according to the first embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of the hardware configuration of the authenticator device and the authenticatee device. [Figure 4] FIG. 4 is a diagram showing a schematic configuration of an authentication system according to the second embodiment. [Figure 5] FIG. 5 is a diagram showing a schematic configuration of an authentication system according to the third embodiment. [Figure 6] FIG. 6 is a diagram showing a schematic configuration of an authentication system according to the fourth embodiment. [Figure 7] FIG. 7 is a diagram showing a schematic configuration of an authentication system according to the fifth embodiment. [Figure 8] FIG. 8 is a diagram showing a schematic configuration of an embodiment in which the present invention is applied to biometric authentication. DETAILED DESCRIPTION OF THE INVENTION

[0019] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiments described below. In addition, the same or corresponding elements in each drawing are appropriately designated by the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationships and ratios of each element may differ from those in reality. There may also be parts in which the dimensional relationships and ratios differ between the drawings.

[0020] [First embodiment] An authentication system according to a first embodiment will be described below with reference to Fig. 1. The first embodiment is an embodiment that explains a basic concept that is common to the embodiments that will be described later.

[0021] Fig. 1 is a diagram showing a schematic configuration of an authentication system according to the first embodiment. As shown in Fig. 1, authentication system 100 includes authenticator device 110 and authenticated user device 120, and transmits encrypted authentication information from authenticator device 120 to authenticator device 110 using homomorphic encryption using a public key encryption method.

[0022] Authenticator device 110 and authenticated user device 120 are information processing devices (computers) whose hardware configurations will be described later. Authenticator device 110 and authenticated user device 120 may be connected by wired communication or by wireless communication. For example, authentication-subjected user device 120 may be a general-purpose personal computer or a mobile terminal such as a smartphone. Alternatively, authentication-subjected user device 120 may be configured as part of a separate device that requires authentication, such as a cash dispenser.

[0023] Authenticator device 110 generates a first random number and transmits it to authenticatee device 120. The challenge transmitted from authenticator device 110 to authenticatee device 120 includes at least this first random number. In other words, authenticator device 110 generates a new first random number for each challenge-response between authenticator device 110 and authenticatee device 120.

[0024] Authentication-subjected user device 120 receives a first random number from authenticator device 110 and generates a second random number different from the first random number. Authentication-subjected user device 120 then combines the first random number and the second random number to generate a response corresponding to the challenge, and transmits this response to authenticator device 110. This response indirectly includes authentication information, as will be described later.

[0025] Authentication-subjected user device 120 includes authentication information in a pair of a first element and a second element and transmits them from authentication-subjected user device 120 to authenticator device 110. However, the first element is generated using a public key using a first random number and a second random number, and the second element is generated using a public key using the second random number. It should be noted here that if the first element and the second element are encrypted using the same random number, the pair of the first element and the second element is the ciphertext of normal authentication information, but in this case, the first element and the second element are encrypted using different random numbers.

[0026] Meanwhile, the authenticator device 110 receives a pair of a first element and a second element from the authenticatee device 120. However, as described above, this is not directly the ciphertext of the authentication information. If it were a proper ciphertext, it could be used to perform subsequent processing as is using homomorphic operations, but the received response is not a proper ciphertext. Therefore, the authenticator device 110 modifies the second element using the first random number to obtain the ciphertext of the authentication information. Since the first random number itself was generated by the authenticator device 110, the authenticator device 110 also holds the first random number. Therefore, the authenticator device 110 uses the first random number to modify the second element, which was generated using the public key using the second random number, to a value that would have been obtained if it had been generated using the first random number and a public key using the second random number.

[0027] In this way, by modifying the received response, authenticator device 110 can obtain the ciphertext of the authentication information that would have been obtained if it had been generated using a public key that uses the first random number and the second random number. In other words, through a challenge-response exchange, it becomes possible to transmit the ciphertext of the authentication information from authenticatee device 120 to authenticator device 110. Furthermore, since this ciphertext of the authentication information is a natural ciphertext to which homomorphic operations can be applied, it becomes possible to perform subsequent processing as is.

[0028] Note that the response sent from authentication-subjected user device 120 to authenticator device 110 indirectly includes authentication information, but the first element of the response is generated using a public key that uses a first random number and a second random number, and this first random number is a random number that is generated anew for each challenge-response. Therefore, even if the response sent from authentication-subjected user device 120 to authenticator device 110 is intercepted and retransmitted to authenticator device 110 as is, the first random number will not match, and authentication will not be successful. In other words, authentication system 100 according to the first embodiment can contribute to resistance to replay attacks.

[0029] (Verification method) Fig. 2 is a system flow diagram showing an outline of the procedure of the authentication method according to the first embodiment. The system flow shown in Fig. 2 can be realized, for example, by using the authentication system 100 described above.

[0030] As shown in FIG. 2, the authentication method according to the first embodiment is an authentication method performed between authenticator device 110 and authenticatee device 120, in which encrypted authentication information is transmitted from authenticator device 120 to authenticator device 110 using homomorphic encryption using a public key cryptosystem.

[0031] First, authenticator device 110 generates a first random number (step S1) and transmits this to authentication-subjected device 120 (step S2). The challenge transmitted from authenticator device 110 to authentication-subjected device 120 includes at least this first random number.

[0032] Meanwhile, authentication-subjected user device 120 generates a second random number different from the first random number (step S3).

[0033] Then, authentication-subjected user device 120 generates a first element using a public key that uses the first random number and the second random number, and further generates a second element using a public key that uses the second random number (step S4).

[0034] Authentication-subjected user device 120 pairs the first element and second element thus generated, and transmits this as a response from authentication-subjected user device 120 to authenticator device 110 (step S5). However, as described above, if the first element and second element are encrypted using the same random number, the pair of the first element and second element is a ciphertext of normal authentication information, but since the first element and second element are encrypted using different random numbers, the response transmitted from authentication-subjected user device 120 to authenticator device 110 is not directly a ciphertext of authentication information.

[0035] Therefore, the verifier device 110 modifies the second element using the first random number to obtain a ciphertext of the authentication information (step S6). Since the first random number itself was generated by the verifier device 110, the verifier device 110 also holds the first random number. Therefore, the verifier device 110 uses the first random number to modify the second element, which was generated using the public key that uses the second random number, to a value that would have been obtained if the second element had been generated using the first random number and a public key that uses the second random number.

[0036] According to the above procedure, in the authentication method according to the first embodiment, it is also possible to transmit encrypted authentication information from authentication-subjected user device 120 to authenticator device 110 through challenge-response exchange.

[0037] (Example of hardware configuration) FIG. 3 is a diagram illustrating an example of the hardware configuration of the authenticator device and the authenticatee device.

[0038] An information processing device (computer) employing the hardware configuration shown in Fig. 3 executes the above-described authentication method as a program, thereby enabling the realization of each function of authenticator device 110 and authenticatee device 120. However, the hardware configuration example shown in Fig. 3 is merely an example of a hardware configuration that realizes each function of authenticator device 110 and authenticatee device 120, and is not intended to limit the hardware configuration of authenticator device 110 and authenticatee device 120. Authenticator device 110 and authenticatee device 120 may include hardware not shown in Fig. 3.

[0039] As shown in FIG. 3, the hardware configuration 10 that can be adopted by the authenticator device 110 and the authenticatee device 120 includes a CPU (Central Processing Unit) 11, a main memory device 12, an auxiliary memory device 13, and an IF (Interface) unit 14, which are interconnected, for example, by an internal bus.

[0040] CPU 11 executes each command included in the authentication program executed by authenticator device 110 and authenticatee device 120. Main storage device 12 is, for example, a RAM (Random Access Memory), and temporarily stores various programs such as the authentication program executed by authenticator device 110 and authenticatee device 120 for processing by CPU 11.

[0041] Auxiliary storage device 13 is, for example, a hard disk drive (HDD) and is capable of storing various programs, such as an authentication program executed by authenticator device 110 and authenticatee device 120, for the medium to long term. Various programs, such as the authentication program, can be provided as program products recorded on a non-transitory computer-readable storage medium. Auxiliary storage device 13 can be used to store various programs, such as the authentication program, recorded on a non-transitory computer-readable storage medium for the medium to long term. IF unit 14 provides, for example, an interface for input / output between authenticator device 110 and authenticatee device 120.

[0042] An information processing device employing the above hardware configuration 10 implements the functions of authenticator device 110 and authenticatee device 120 by executing the above-mentioned authentication method as a program.

[0043] [Second embodiment] Next, an embodiment of the present invention will be described in conjunction with a specific encryption method. The encryption method used in the following description is an encryption method that utilizes the difficulty of solving a problem called the Ring-LWE (RLWE) problem. Therefore, the Ring-LWE (RLWE) problem will be described first.

[0044] As a preliminary step, let Z[X] be the set of all polynomials with integer coefficients, and let R=Z[X] / (x n +1) to Z[X] to x n + Divided by 1 (x n=-1), where n is a power of 2. Furthermore, R q =R / qLet R be the ring formed by the set of polynomials obtained by dividing each coefficient of the polynomials in R by q, where q=1 mod 2n is a prime number.

[0045] The sampling is defined as follows: a i ← R R q :R q From a i are selected uniformly at random. s ← χ s :R q The distribution χ above s Sample s from e i ← χ s :R q The distribution χ above s From e i Sample the following.

[0046] At this time, (a i , b i =a i s+e i )∈R q ×R q The problem of finding s when given is called the Search RLWE problem.

[0047] Also, (a i , b i )∈R q ×R q Given b i =a i s+e i Is it a i ← R R q The problem of identifying whether a given condition is true or false is called the Decision RLWE problem.

[0048] Both the Search RLWE problem and the Decision RLWE problem are considered difficult to solve, and there are known encryption methods that take advantage of this difficulty. iWe will call this an RLWE instance.

[0049] (BGV cryptosystem) The BGV cryptosystem is one of the cryptosystems that utilizes the hardness of the above Search RLWE problem and Decision RLWE problem.

[0050] The BGV cryptosystem prepares the following parameters. Let n be a power of 2, and for this n, define the ring R = Z[X] / (x n + 1). Then, for a prime number q satisfying q = 1 mod 2n, define the ring R q of the ciphertext space as R / qR. Also, for an integer t < q, define the ring R t of the plaintext space as R / qR. Furthermore, when the standard deviation of the discrete Gaussian distribution for adding noise is σ, let χ = D Z n , σ and let each coefficient be an element of the ring R following the discrete Gaussian distribution with mean 0 and variance σ 2 .

[0051] Key generation is performed as follows. Sample s and e from the distribution χ (s, e ← χ), and generate p1 ∈ R q uniformly at random. Using this, define the public key as pk = (p0, p1) = (-(p1s + te), p1) ∈ (R q ) 2 and define the secret key as sk = s.

[0052] Then, encryption is performed as follows. For the plaintext m ∈ R q and the public key pk = (p0, p1), generate u, f, g ← χ from the distribution χ, and define the ciphertext ct = (c0, c1) = (p0u + tg + m, p1u + tf) ∈ (R q ) 2 .

[0053] For the ciphertext defined in this way, homomorphic addition and homomorphic multiplication are defined.

[0054] Homomorphic addition: For ciphertexts ct and ct', the homomorphic addition ct'' is defined as follows:

number

[0055] Homomorphic multiplication: For ciphertexts ct and ct', homomorphic multiplication ct'' is defined as follows. However, if ct=(c0, c1), ct'=(c0', c1'), then it is (c0c0', c0c1'+c0'c1, c1c1'). Note that performing homomorphic multiplication increases the number of elements in the ciphertext.

number

[0056] On the other hand, when the above ciphertext is to be decrypted, the following process is carried out.

[0057] Decryption: For the ciphertext ct, the decryption of the plaintext m is obtained as follows, where [ ] q is a reduction to [-q / 2, q / 2), if ct=(c0, c1), then ct(s)= c0+c1s, and if ct=(c0, c1, c2), then ct(s)= c0+c1s+c2s 2 is.

number

[0058] Fig. 4 is a diagram showing a schematic configuration of an authentication system according to the second embodiment. Authentication system 200 according to the second embodiment shown in Fig. 4 is an authentication system that uses the BGV encryption method. As shown in Fig. 4, authentication system 200 includes authenticator device 210 and authenticatee device 220, and transmits encrypted authentication information from authenticator device 220 to authenticator device 210 using homomorphic encryption using public key encryption.

[0059] The authenticator device 210 generates a first random number (u c ← χ), and using this, challenge C= u c Then, the authenticator device 210 creates a challenge C=u c to authentication-subjected user device 220.

[0060] Meanwhile, authentication-subjected user device 220 generates a second random number and uses it to create public key pk. Here, public key pk is a public key pk=(p0, p1)=(-(p1s+te), p1)∈(R q ) 2 Then, authenticatee device 220 receives challenge C=u from verifier device 210. c is embedded in the public key pk to create a pseudo public key pk' = (p0C, p1).

[0061] Then, authenticatee device 220 issues challenge C=u c Using the pseudo public key pk'=(p0C, p1) in which t Here, pseudo-encryption is a process where the challenge C=u c The purpose of this method is to perform the same processing as normal BGV encryption using a pseudo public key pk' = (p0C, p1) with m embedded in it. That is, authentication-subjected user device 220 calculates response R = (R0, R1) = Enc(pk', m). Thereafter, authentication-subjected user device 220 transmits this response R = (R0, R1) = Enc(pk', m) to authenticator device 210.

[0062] On the other hand, authenticator device 210 receives response R=(R0, R1)=Enc(pk', m) from authenticatee device 220. However, as described above, this is generated using pseudo public key pk'=(p0C, p1), and therefore, plaintext m∈R t Therefore, the authenticator device 210 modifies the second element R1 of the received response R=(R0, R1) to obtain the plaintext m∈R t The ciphertext of

[0063] Specifically, the authenticator device 210 adds the first random number u to the second element R1 of the received response R=(R0, R1). c Multiply the second element R1 by the first random number u c multiplied by ct = (R0, R1u c ) is obtained by using the public key pk=(p0, p1)=(-(p1s+te), p1) to obtain the plaintext m∈R t This can be confirmed by performing the following calculation:

[0064]

number

[0065] In this way, authenticator device 210 is able to transmit encrypted authentication information from authenticatee device 220 to authenticator device 210 through challenge-response exchange.

[0066] Furthermore, the fact that authentication system 200 according to the second embodiment is secure against replay attacks can be explained as follows.

[0067] To generate a response R' corresponding to a new challenge C' from a challenge C and response R and C' that have been successfully authenticated in the past, the attacker must first obtain one of the responses R that have been successfully authenticated, R0=p0uc u+t(e c p0u included in u+g)+m c Let u be the monomial p0u corresponding to the new challenge C'. c It must be replaced with 'u.

[0068] However, the attacker can solve the challenge C=u c and public keys p0 to p0u c However, since we cannot know u (if we could know u, it would violate the one-way property of BGV), p0u c u cannot be calculated and cannot be removed from R0.

[0069] Also, a new challenge C'=u c If we can obtain ', we can write the response corresponding to the new challenge as R' = (R0, R1 / u c '=((p1u+tf) / u c ') is considered an attack, but R t Since is a ring, division is not defined. However, since it can be calculated in some cases, it is possible to limit the noise generated in the challenge to those that do not have an inverse.

[0070] As a result, the attacker is unable to forge a response R' corresponding to a new challenge C', and it has been demonstrated that the authentication system 200 according to the second embodiment is secure against replay attacks.

[0071] [Third embodiment] Fig. 5 is a diagram showing a schematic configuration of an authentication system according to a third embodiment. Authentication system 300 according to the third embodiment shown in Fig. 5 is an authentication system in which a configuration for concealing first random numbers is added to the second embodiment using the BGV encryption method. As shown in Fig. 5, authentication system 300 includes authenticator device 310 and authenticatee device 320, and transmits encrypted authentication information from authenticatee device 320 to authenticator device 310 using homomorphic encryption using public key encryption.

[0072] The authenticator device 310 generates a first random number and a third random number (u c , e c ← χ), and then use the third random number to conceal the first random number and issue a challenge C=p0u c +te c Then, the authenticator device 210 creates a challenge C=p0u c +te c to authentication-subjected user device 320.

[0073] Meanwhile, authentication-subjected user device 320 generates a second random number and uses it to create public key pk. Here, public key pk is a public key pk=(p0, p1)=(-(p1s+te), p1)∈(R q ) 2 Then, authenticatee device 320 receives challenge C=p0u from verifier device 310. c +te c is embedded in the public key pk to create a pseudo public key pk'=(C, p1).

[0074] Then, authenticatee device 320 issues challenge C=p0u c +e c Using the pseudo public key pk'=(C, p1) with the embedded t Here, pseudo-encryption is performed by encrypting the challenge C=p0u c +te c The purpose of this method is to perform the same processing as normal BGV encryption using a pseudo public key pk' = (C, p1) with m embedded in it. That is, authentication-subjected user device 320 calculates response R = (R0, R1) = Enc(pk', m). Thereafter, authentication-subjected user device 320 transmits this response R = (R0, R1) = Enc(pk', m) to authenticator device 310.

[0075] On the other hand, authenticator device 310 receives response R=(R0, R1)=Enc(pk', m) from authenticatee device 320. However, as described above, this response is generated using pseudo public key pk'=(C, p1), and therefore, plaintext m∈R tTherefore, the authenticator device 310 modifies the second element R1 of the received response R=(R0, R1) to obtain the plaintext m∈R t The ciphertext of

[0076] Specifically, the authenticator device 310 adds the first random number u to the second element R1 of the received response R=(R0, R1). c Multiply the second element R1 by the first random number u c multiplied by ct = (R0, R1u c ) is obtained by using the public key pk=(p0, p1)=(-(p1s+te), p1) to obtain the plaintext m∈R t This can be confirmed by performing the following calculation:

[0077]

number

[0078] In this way, authenticator device 310 is able to transmit encrypted authentication information from authenticatee device 320 to authenticator device 310 through challenge-response exchange.

[0079] Furthermore, in the authentication system 300 according to the third embodiment, the first random number is kept secret, and therefore, as will be described below, it is more secure against replay attacks.

[0080] To generate a response R' corresponding to a new challenge C' from a challenge C and a response R and C' that have been successfully authenticated in the past, the attacker must first obtain one of the responses R that have been successfully authenticated in the past, R0 = p0u c u+t(e c p0u included in u+g)+m c Let u be the p0u corresponding to the new challenge C'. c It must be replaced with 'u.

[0081] However, although the attacker can obtain the challenge C = p0u c + te c since the attacker cannot know u (knowing u would break the one-way property of BGV), the attacker cannot compute p0u c u and thus cannot remove it from R0.

[0082] Ultimately, the attacker cannot forge the response R' corresponding to the new challenge C', indicating that the authentication system 300 according to the third embodiment is secure against replay attacks.

[0083] [Fourth Embodiment] The fourth embodiment is an embodiment using the BFV encryption method, which is another encryption method utilizing the Ring-LWE (RLWE) problem. Since the Ring-LWE (RLWE) problem has been described above, the BFV encryption method will be described below.

[0084] The BFV encryption method prepares the following parameters. Let n be a power of 2, and for this n, define the ring R = Z[X] / (x n + 1). Then, for a prime number q satisfying q = 1 mod 2n, define the ring R q of the ciphertext space as R / qR. Also, for an integer t satisfying t < q, define the ring R t of the plaintext space as R / qR. Further, when the standard deviation of the discrete Gaussian distribution for adding noise is σ, let χ = D Z n , σ such that each coefficient follows a discrete Gaussian distribution of the elements of the ring R with mean 0 and variance σ 2 . Let w = floor(q / t), where floor is the floor function.

[0085] Key generation is performed as follows. Sample s and e from the distribution χ (s, e ← χ), and generate p1 ∈ R q uniformly and randomly, and using this, set the public key as pk = (p0, p1) = (-(p1s + e), p1) ∈ (R q) 2 and define the private key as sk=s.

[0086] Then, encryption is performed as follows: Plaintext m∈R q For the public key pk=(p0, p1), generate u, f, g ← χ from the distribution χ, and obtain the ciphertext ct=(c0, c1)=(p0u+g+wm, p1u+tf)∈(R q ) 2 Let's say.

[0087] Homomorphic addition and homomorphic multiplication are defined for the ciphertext thus determined.

[0088] Homomorphic addition: For ciphertexts ct and ct', the homomorphic addition ct'' is defined as follows:

number

[0089] Homomorphic multiplication: For ciphertexts ct and ct', homomorphic multiplication ct'' is defined as follows. However, if ct=(c0, c1), ct'=(c0', c1'), then it is (c0c0', c0c1'+c0'c1, c1c1'). Note that performing homomorphic multiplication increases the number of elements in the ciphertext.

number

[0090] On the other hand, when the above ciphertext is to be decrypted, the following process is carried out.

[0091] Decryption: For the ciphertext ct, the decryption of the plaintext m is obtained as follows:

number

[0092] Fig. 6 is a diagram showing a schematic configuration of an authentication system according to a fourth embodiment. Authentication system 400 according to the fourth embodiment shown in Fig. 6 is an authentication system using the BFV encryption method. As shown in Fig. 6, authentication system 400 includes authenticator device 410 and authenticatee device 420, and transmits encrypted authentication information from authenticator device 420 to authenticator device 410 using homomorphic encryption using public key encryption.

[0093] The authenticator device 410 generates a first random number (u c ← χ), and using this, challenge C= u c Then, the authenticator device 410 creates a challenge C=u c to authentication-subjected user device 420.

[0094] Meanwhile, authentication-subjected user device 420 generates a second random number and uses it to create public key pk. Here, public key pk is a public key pk=(p0, p1)=(-(p1s+e), p1)∈(R q ) 2 Then, the authenticatee device 420 receives the challenge C=u from the authenticator device 410. c is embedded in the public key pk to create a pseudo public key pk' = (p0C, p1).

[0095] Then, the authenticatee device 420 issues a challenge C=u c Using the pseudo public key pk'=(p0C, p1) in which t Here, pseudo-encryption is a process where the challenge C=u cThe purpose of this method is to perform the same processing as normal BFV encryption using a pseudo public key pk' = (p0C, p1) with m embedded in it. That is, authenticatee device 420 calculates response R = (R0, R1) = Enc(pk', m). Thereafter, authenticatee device 420 transmits this response R = (R0, R1) = Enc(pk', m) to authenticator device 410.

[0096] On the other hand, authenticator device 410 receives response R=(R0, R1)=Enc(pk', m) from authenticatee device 420. However, as described above, this is generated using pseudo public key pk'=(p0C, p1), and therefore, plaintext m∈R t Therefore, the authenticator device 410 modifies the second element R1 of the received response R=(R0, R1) to obtain the plaintext m∈R t The ciphertext of

[0097] Specifically, the authenticator device 410 adds the first random number u to the second element R1 of the received response R=(R0, R1). c Multiply the second element R1 by the first random number u c multiplied by ct = (R0, R1u c ) is obtained by using the public key pk=(p0, p1)=(-(p1s+e), p1) to obtain the plaintext m∈R t This can be confirmed by performing the following calculation:

[0098]

number

[0099] In this way, through the exchange of challenge and response, authenticator device 410 is able to transmit encrypted authentication information from authenticatee device 420 to authenticator device 410. Also, authentication system 400 according to the fourth embodiment is secure against replay attacks, just like the second embodiment using the BGV encryption method.

[0100] [Fifth embodiment] Fig. 7 is a diagram showing a schematic configuration of an authentication system according to a fifth embodiment. Authentication system 500 according to the fifth embodiment shown in Fig. 7 is an authentication system in which a configuration for concealing a first random number is added to the fourth embodiment using the BFV encryption method. As shown in Fig. 7, authentication system 500 includes authenticator device 510 and authenticatee device 520, and transmits an encrypted text of authentication information from authenticatee device 520 to authenticator device 510 using homomorphic encryption using a public key encryption method.

[0101] The authenticator device 510 generates a first random number and a third random number (u c , e c ← χ), and then use the third random number to conceal the first random number and issue a challenge C=p0u c +e c Then, the authenticator device 510 creates a challenge C=p0u c +e c to authentication-subjected user device 520.

[0102] Meanwhile, authentication-subjected user device 520 generates a second random number and uses it to create public key pk. Here, public key pk is a public key pk=(p0, p1)=(-(p1s+e), p1)∈(R q ) 2 Then, authenticatee device 520 receives challenge C=p0u from verifier device 510. c +e c is embedded in the public key pk to create a pseudo public key pk'=(C, p1).

[0103] Then, authenticatee device 520 issues challenge C=p0u c +ec Using the pseudo public key pk'=(C, p1) with the embedded t Here, pseudo-encryption is performed by encrypting the challenge C=p0u c +te c The purpose of this method is to perform the same processing as normal BFV encryption using a pseudo public key pk' = (C, p1) with m embedded therein. That is, authenticatee device 520 calculates response R = (R0, R1) = Enc(pk', m). Thereafter, authenticatee device 520 transmits this response R = (R0, R1) = Enc(pk', m) to authenticator device 510.

[0104] On the other hand, authenticator device 510 receives response R=(R0, R1)=Enc(pk', m) from authenticatee device 520. However, as described above, this is generated using pseudo public key pk'=(C, p1), and therefore, it is not directly transmitted as plaintext m∈R t Therefore, the authenticator device 510 modifies the second element R1 of the received response R=(R0, R1) to obtain the plaintext m∈R t The ciphertext of

[0105] Specifically, the authenticator device 510 adds the first random number u to the second element R1 of the received response R=(R0, R1). c Multiply the second element R1 by the first random number u c multiplied by ct = (R0, R1u c ) is obtained by using the public key pk=(p0, p1)=(-(p1s+e), p1) to obtain the plaintext m∈R t This can be confirmed by performing the following calculation:

[0106]

number

[0107] In this way, through challenge-response exchange, authenticator device 510 is able to transmit encrypted authentication information from authenticatee device 520 to authenticator device 510. Also, authentication system 500 according to the fifth embodiment is secure against replay attacks, just like the third embodiment using the BGV encryption method.

[0108] [Comparison of computational and communication volume] Here, differences between the embodiments of the present invention and the prior art in terms of calculation volume and communication volume will be explained. Note that the technology described in Patent Document 1 mentioned above will be examined as a comparative example of the prior art. Table 1 below compares the calculation volume in the comparative example, the second embodiment, and the third embodiment. Table 2 below compares the communication volume in the comparative example, the second embodiment, and the third embodiment.

[0109] [Table 1]

[0110] [Table 2]

[0111] As can be seen from Tables 1 and 2 above, the embodiment of the present invention reduces both the computational complexity and the communication complexity compared to the comparative examples. This is not due to the computational complexity and communication complexity being lower compared to a specific comparative example, but rather due to the fact that the embodiment of the present invention embeds the challenge in the public key rather than in the plaintext. When the challenge is embedded in the plaintext, a so-called homomorphic operation is performed to manipulate the challenge stored in the ciphertext, but homomorphic operations generally impose a heavy load in terms of computational complexity and communication complexity. On the other hand, the embodiment of the present invention embeds the challenge in the public key, so processing can be performed using operations in a normal ring. In particular, the operation for converting the received response to the original ciphertext is very light in computational complexity, as it simply involves multiplying the first random number by the second element.

[0112] [Application embodiment] Fig. 8 is a diagram showing a schematic configuration of an embodiment in which the present invention is applied to biometric authentication. As shown in Fig. 8, authentication system 600 includes authenticator device 610 and authenticatee device 620, and transmits an encrypted text of biometric information features from authenticator device 620 to authenticator device 610 using homomorphic encryption using a public key cryptosystem.

[0113] Authenticator device 610 comprises challenge generation means 611, response modification means 612, similarity calculation means 613, and registration information DB 614. On the other hand, authenticatee device 620 comprises public key encryption modification means 621, response generation means 622, and feature extraction means 623.

[0114] Assume that authentication-subjected user device 620 transmits biometric information features to authenticator device 610. Typically, biometric information is, for example, a fingerprint or palm print, but a voiceprint or the like may also be used. In this case, since advanced complete management of biometric information features such as fingerprints and palm prints is required, the features are required to be transmitted from authentication-subjected user device 620 to authenticator device 610 in an encrypted state. The features are also encrypted when stored in registration information DB 614 of authenticator device 610. Furthermore, the features are also encrypted when calculating the similarity between the features of the biometric information transmitted from authentication-subjected user device 620 and the features of the biometric information stored in registration information DB 614. Authentication system 600 functions suitably in such applications.

[0115] That is, challenge generation means 611 generates a challenge including a first random number and transmits it to authentication-subjected device 620. Then, public key encryption correction means 621 generates a second random number and modifies the public key using the second random number by embedding the challenge in it. Response generation means 622 encrypts the biometric information feature using the pseudo public key modified by embedding the challenge, and transmits this ciphertext to authenticator device 610. Authenticator device 610 obtains the ciphertext of the biometric information feature by modifying the received response using the first random number.

[0116] By transmitting the feature amount of biometric information from authenticatee device 620 to authenticator device 610 in this way, security against retransmission is increased, and applying the embodiment of the present invention to biometric authentication is a suitable application example.

[0117] The disclosures of the above-cited patent documents and other documents are incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the claims), and further based on the basic technical concepts thereof. Furthermore, various combinations and selections (including partial deletions) of various disclosed elements (including elements of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally embraces various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure and technical concepts, including the claims. In particular, with regard to the numerical ranges set forth herein, any numerical value or subrange within that range should be construed as specifically set forth, even if not otherwise specified. Furthermore, the disclosures of the above-cited documents, when used in part or in whole in combination with the disclosures herein as part of the disclosure of the present invention, in accordance with the spirit of the present invention, are also deemed to be included in the disclosures of this application. [Explanation of symbols]

[0118] 10 Hardware Configuration 11 CPU 12 Main storage 13 Auxiliary storage device 14 IF Section 100,200,300,400,500,600 authentication system 110,210,310,410,510,610 Authenticator device 120,220,320,420,520,620 Authenticated person device 611 Challenge Generation Method 612 Response Modification Measures 613 Similarity calculation means 614 Registration Information DB 621 Public Key Cryptography Modification Method 622 Response Generation Method 623 Feature Extraction Method

Claims

1. An authentication system for transmitting ciphertext of authentication information from an authenticatee device to an authenticator device using homomorphic encryption using a public key cryptosystem, the authenticator device issues a first random number to the authenticatee device; the authenticatee device generates a second random number, and transmits to the verifier device a first element that is one of a pair of ciphertexts of the authentication information generated using the first random number and a public key incorporating the second random number, and a second element that is the other of the pair of ciphertexts of the authentication information generated using a public key incorporating the second random number; the authenticator device modifies the second factor using the first random number to obtain a ciphertext of the authentication information; Authentication system.

2. The authentication system of claim 1 , wherein the authenticator device modifies the second factor by multiplying the second factor by the first random number.

3. 3. The authentication system according to claim 1, wherein the authenticator device conceals the first random number before transmitting it to the authenticatee device.

4. 4. The authentication system according to claim 3, wherein the authenticator device conceals the first random number using a third random number and transmits the concealed first random number to the authenticatee device.

5. 5. The authentication system according to claim 1, wherein the public key cryptosystem is a BGV system.

6. 5. The authentication system according to claim 1, wherein the public key cryptosystem is a BFV system.

7. A user device to be authenticated transmits an encrypted text of authentication information to an authenticator device using homomorphic encryption using a public key encryption method, receiving a first random number from the authenticator device; generating a second random number, and transmitting to the authenticator device a pair of a first element that is one of a pair of ciphertexts of the authentication information generated using the first random number and a public key incorporating the second random number, and a second element that is the other of the pair of ciphertexts of the authentication information generated using the public key incorporating the second random number, the ciphertext of the authentication information being obtained by modifying the second element using the first random number; Authenticate device.

8. An authenticator device that receives ciphertext of authentication information from an authenticatee device using homomorphic encryption using a public key encryption method, issuing a first random number to the authenticatee device; the authentication-subjected device generates a second random number, and receives from the authentication-subjected device a first element that is one of a pair of ciphertexts of the authentication information generated using a public key incorporating the first random number and the second random number, and a second element that is the other of the pair of ciphertexts of the authentication information generated using a public key incorporating the second random number; modifying the second factor using the first random number to obtain a ciphertext of the authentication information; Authenticator device.

9. An authentication method for transmitting ciphertext of authentication information from an authenticatee device to an authenticator device using homomorphic encryption using a public key cryptosystem, the authenticator device issues a first random number to the authenticatee device; the authenticatee device generates a second random number, and transmits to the verifier device a first element that is one of a pair of ciphertexts of the authentication information generated using the first random number and a public key incorporating the second random number, and a second element that is the other of the pair of ciphertexts of the authentication information generated using a public key incorporating the second random number; the authenticator device modifies the second factor using the first random number to obtain a ciphertext of the authentication information; Authentication method.

10. An authentication program for transmitting ciphertext of authentication information from an authenticatee device to an authenticator device using homomorphic encryption using a public key cryptosystem, causing the authenticator device to issue a first random number to the authenticatee device; causing the authenticatee device to generate a second random number, and to transmit to the verifier device a first element that is one of a pair of ciphertexts of the authentication information generated using a public key incorporating the first random number and the second random number, and a second element that is the other of the pair of ciphertexts of the authentication information generated using a public key incorporating the second random number; causing the authenticator device to modify the second factor using the first random number to obtain a ciphertext of the authentication information; Certification program.

Images