Verification system, verification device, verification method, and program

Abstract

Provided are a (secret) collation system, a (secret) collation device, a (secret) collation method, and a program that contribute to shortening the time of being plain text when encrypting the plain text in order to perform a homomorphic operation between the plain text and a plurality of pieces of encrypted text that have been encrypted with different keys. The (secret) collation system comprises: a user-side device having a user key generation unit and a registration unit that registers registration encrypted text to a service-side device; and a service-side device having a service key generation unit, a conversion key generation unit that generates a conversion key for converting first encrypted text, which has been encrypted with a public key for a service, to second encrypted text, which has been encrypted with a public key of the user without decryption processing, and a collation unit, wherein the first encrypted text obtained by encrypting with the public key for a service is temporarily generated, after which the second encrypted text is generated with the conversion key, and a feature amount serving as a collation source is collated with the registration encrypted text.

Description

[Technical Field]

[0001] The present invention relates to a verification system, a verification device, a verification method, and a program. [Background technology]

[0002] One type of cryptographic technology is called homomorphic encryption. Homomorphic encryption is a technique that allows the calculation of the ciphertext Enc(m1○m2) of the binary operation m1○m2 on plaintext m1 and m2, given Enc(m1) and Enc(m2) of plaintext m1 and m2, without decrypting it to plaintext m1 and m2. Here, "○" is a binary operation, such as addition "+" or multiplication "×". Homomorphic encryption for the addition operation "+" is called additive homomorphic encryption. Similarly, homomorphic encryption for the multiplication operation "×" is called multiplicative homomorphic encryption. Homomorphic encryption that is homomorphic for both the addition operation "+" and the multiplication operation "×" is called fully homomorphic encryption.

[0003] Fully homomorphic encryption is known to be homomorphic for both addition and multiplication, allowing any operation to be processed while remaining encrypted. However, fully homomorphic encryption requires a large amount of computation, making it difficult to put into practical use. Therefore, homomorphic encryption with intermediate properties between additive homomorphic encryption and fully homomorphic encryption has also been developed. For example, an encryption scheme called "Somewhat homomorphic encryption" is a homomorphic encryption scheme that is homomorphic for an arbitrary number of additions and a finite number of multiplications (see, for example, Non-Patent Document 1). Also, for example, an encryption scheme called "level 2 homomorphic encryption" is a homomorphic encryption scheme that allows one homomorphic multiplication and an arbitrary number of homomorphic additions. While these Somewhat homomorphic encryption and level 2 homomorphic encryption schemes have limited allowable operations, they require less computational effort than fully homomorphic encryption. Therefore, the computational effort can be reduced by selecting and implementing an appropriate homomorphic encryption scheme according to the application.

[0004] Similarity calculation is one of the cryptographic protocols using such homomorphic encryption. For example, in biometric authentication, authentication is determined to be successful if the similarity between features extracted from a biometric such as a face or fingerprint falls within a predetermined range. Biometric authentication using homomorphic encryption allows similarity calculation to be performed while the features used for authentication remain encrypted, which is suitable for ensuring the security required for biometric authentication. The registered information in biometric authentication is biometric features, and if these biometric features are leaked, there is a possibility that the user may be spoofed not only in the authentication system but also in other biometric authentication systems using the same method. Therefore, in biometric authentication using homomorphic encryption, an encrypted text of the biometric features that can only be decrypted by the user is sent to the service provider, and the user is required to manage the private key and perform the decryption process (e.g., Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Information security, cybersecurity and privacy protection - Biometric information protection (ISO / IEC DIS 24745:2020(E)) [Non-patent document 2] Keita Xagawa, Keisuke Tanaka “Proxy Re-Encryption based on Learning with Errors” (The 2010 Symposium on Cryptography and Information Security Jan. 19-22, 2010) Summary of the Invention [Problem to be solved by the invention]

[0006] The disclosures of the above prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0007] Incidentally, operations between ciphertexts encrypted with homomorphic encryption require that they be encrypted with the same public key. Homomorphic operations cannot be performed correctly on ciphertexts encrypted with different public keys.

[0008] On the other hand, from the viewpoint of security, it is desirable that the private key be different for each user and managed by each individual, and therefore the public key corresponding to the private key will also be different for each user. Therefore, during biometric authentication, it is necessary to encrypt the extracted biometric features with a public key tailored to each individual, and then perform a similarity calculation using homomorphic operations. However, since the individual cannot yet be identified during biometric authentication, there is a problem that the biometric authentication system cannot know which public key to use for encryption.

[0009] One solution to this problem is for the user undergoing biometric authentication to send a public key. However, even if a user sends a public key, it is necessary to associate the person who sent the public key with the user undergoing biometric authentication, which is not necessarily easy when authenticating multiple people at the same time.

[0010] Another solution is to encrypt the data using the public keys of all users in a brute-force manner and then perform homomorphic operations. In other words, if there are N people's worth of data registered as features to be used for biometric authentication, the data is encrypted using the public keys of these N people and similarity calculations are performed N times. If any one of these N similarity calculations is successful and a similarity within a specified range is obtained, authentication is deemed successful.

[0011] However, when encrypting using the public keys of all users in a brute force manner like this, the time that the biometric feature remains in plain text becomes longer, and there is a risk of attacks targeting that time. When encrypting using the public keys of N users, the time that the biometric feature remains in plain text becomes N times longer than when encrypting once, so even if the time required for one encryption is very short, if there are a large number of registered users, the time that the biometric feature remains in plain text can become significant.

[0012] In view of the above-mentioned problems, an object of the present invention is to provide a matching system, a matching device, a matching method, and a program that contribute to shortening the time that plaintext remains in plaintext when encrypting the plaintext to perform homomorphic operations between multiple ciphertexts encrypted with different keys. [Means for solving the problem]

[0013] In a first aspect of the present invention, there is provided a verification system including: a user-side device having a user key generation unit that generates a pair of a user's public key and a user's private key; and a registration unit that registers, in the service-side device, a registration ciphertext obtained by encrypting a plurality of feature quantities to be compared with the corresponding user public key; a service-side device having a service key generation unit that generates a pair of a service's public key and a service's private key; a reconversion key generation unit that uses the user's public key and the service's private key to generate a reconversion key that converts a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without a decryption process; and a verification unit that compares the registered ciphertext with the second ciphertext, wherein the service-side device first generates a first ciphertext by encrypting the feature quantities to be compared with the service's public key, and then generates a second ciphertext using the reconversion key and compares it with the registered ciphertext.

[0014] In a second aspect of the present invention, there is provided a matching device having a service key generation unit that generates a pair of a service public key and a service private key; a reconversion key generation unit that generates a reconversion key using the public keys of multiple users and the service private key to convert a first ciphertext encrypted with the service public key into a second ciphertext encrypted with the user public key without decryption; a registration unit that encrypts multiple features to be matched with corresponding users' public keys to generate registered ciphertext; an encryption unit that accepts the features to be matched and encrypts them with the service public key to generate first ciphertext; a re-encryption unit that converts the first ciphertext into a second ciphertext with the reconversion key; and a matching unit that compares the registered ciphertext with the second ciphertext.

[0015] In a third aspect of the present invention, there is provided a matching method including the steps of generating a pair of a user's public key and a user's private key, generating a pair of a service's public key and a service's private key, generating a conversion key using the user's public key and the service's private key to convert a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without decryption, encrypting a plurality of features to be matched with the corresponding user's public key to generate registered ciphertexts, receiving features to be matched and encrypting them with the service's public key to generate a first ciphertext, converting the first ciphertext into a second ciphertext using the conversion key, and matching the registered ciphertext with the second ciphertext.

[0016] In a fourth aspect of the present invention, there is provided a program for causing a computer to execute the following processes: generating a pair of a user's public key and a user's private key; generating a pair of a service's public key and a service's private key; generating a reconversion key using the user's public key and the service's private key to convert a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without decryption; encrypting multiple feature quantities that are candidates for matching with the corresponding user's public key to generate a registered ciphertext; receiving feature quantities to be matched and encrypting them with the service's public key to generate a first ciphertext; converting the first ciphertext into a second ciphertext with the reconversion key; and comparing the registered ciphertext with the second ciphertext. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product. [Effects of the Invention]

[0017] According to each aspect of the present invention, it is possible to provide a matching system, a matching device, a matching method, and a program that contribute to shortening the time that plaintext remains in plaintext when encrypting it to perform homomorphic operations on multiple ciphertexts encrypted with different keys. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 1 is a block diagram showing a schematic configuration example of a secret matching system according to the first embodiment. [Figure 2] FIG. 2 is a block diagram showing a schematic configuration example of a secret matching system according to the second embodiment. [Figure 3] FIG. 3 is a block diagram showing another example of the schematic configuration of the secret matching system according to the second embodiment. [Figure 4] FIG. 4 is a system flowchart showing the processing of the secret matching system in the second embodiment. [Figure 5] FIG. 5 is a diagram illustrating an example of the hardware configuration of the secret matching system according to the second embodiment. [Figure 6] FIG. 6 is a diagram showing an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0019] Hereinafter, with reference to the drawings, embodiments of a secret matching system, a secret matching device, a secret matching method, and a program that embody the present invention will be described. However, the present invention is not limited to the embodiments described below. In addition, in each drawing, the same or corresponding elements are appropriately designated by the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationships and ratios of each element may differ from the actual ones. Even between drawings, there may be parts in which the dimensional relationships and ratios differ from each other.

[0020] [First embodiment] A secret matching system according to a first embodiment will be described below with reference to Fig. 1. The first embodiment is an embodiment that mainly describes the basic concept of the present invention.

[0021] Fig. 1 is a block diagram showing a schematic configuration example of a secret matching system according to the first embodiment. As shown in Fig. 1, the secret matching system according to the first embodiment includes a user-side device 10 and a service-side device 11. The user-side device 10 has a user key generation unit 12 and a registration unit 13. The service-side device 11 has a service key generation unit 14, a conversion key generation unit 15, and a matching unit 16.

[0022] The user key generation unit 12 generates a pair of a user's public key and a user's private key in the user device 10. The registration unit 13 registers a registration ciphertext in the service side device 11, which is obtained by encrypting multiple features to be compared in the user device 10 with the corresponding user's public key. The service key generation unit 14 generates a pair of a service's public key and a service's private key in the service side device 11. Using the user's public key and the service's private key, the reconversion key generation unit 15 generates a reconversion key in the service side device 11 for converting a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without decryption processing. The comparison unit 16 compares the registration ciphertext with the second ciphertext in the service side device 11.

[0023] One feature of the secret matching system in the first embodiment is that the service side device 11 first generates a first ciphertext by encrypting a feature to be matched with the public key of the service, and then generates a second ciphertext with the reconstitution key and matches it with a registered ciphertext. Specifically, the service side device 11 receives a feature to be matched, first encrypts the feature with the public key of the service generated by the service key generation unit 14 to generate a first ciphertext, then converts the first ciphertext to a second ciphertext with the reconstitution key generated by the reconstitution key generation unit 15 without decryption, and then matches the second ciphertext with the registered ciphertext in the matching unit 16, thereby performing secret matching.

[0024] In the above configuration, when the service-side device 11 receives a feature to be used as a match, it encrypts it with the service's public key first, rather than immediately starting the time-consuming matching process. This makes it possible to prevent the feature received during the matching process from being stored in plain text in the storage area of ​​the service-side device 11 for a long period of time. This makes it possible to prevent the feature data in the storage area from being stolen and leaked due to an external attack.

[0025] Another feature of the secret verification system in the first embodiment is that the reconstituted key generated by the reconstituted key generating unit 15 of the service side device 11 can contribute to high-speed and safe secret verification.

[0026] The conversion key directly converts a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without decryption. This allows for faster key conversion than encrypting plaintext with the user's public key, or decrypting the first ciphertext with the service's private key and then encrypting it with the user's public key, contributing to speeding up the entire process. Furthermore, by decrypting to change the key, it is possible to avoid the risk of attacks caused by temporarily storing plaintext in a memory area, and privacy risks such as the face of a person authenticating using facial recognition being revealed.

[0027] [Proxy Re-encryption] The conversion key uses proxy re-encryption technology. Proxy re-encryption is a technology that can convert a ciphertext using one key into a ciphertext using a second key without obtaining plaintext information. Here, it is used to convert the public key of the service side device 11 to the user's public key without decryption. There are two types of public key cryptography key pairs, as follows: (public key 1, private key 1) = (pk1, sk1) and (public key 2, private key 2) = (pk2, sk2). A conversion key is generated to perform proxy re-encryption. If the conversion key is ReKey, the conversion key generation process rk = ReKeyGen() becomes ReKeyGen(pk2, sk1) = rk1 → 2. Here, pk2 is the public key of the second (destination) ciphertext, and sk1 is the private key of the first (source) ciphertext.

[0028] In addition to the proxy re-encryption technology that allows one-way conversion of the re-encryption key as described above, there is also a method that allows two-way conversion. In this case, private keys for both the source and destination are required, as shown in ReKeyGen(sk1, sk2) = rk1←→2. In the confidential verification system of this embodiment, the user's private key needs to be delivered from the user device 10 to the service device 11, which raises security issues, so it is desirable to adopt the one-way conversion model described above. If the feature of the plaintext before encryption is M, the re-encryption key processing can be expressed as ReEnc(rk1→2,Enc(pk1,M)) = Enc(pk2,M).

[0029] [Effect description] As described above, by generating a service key on the service side at the registration stage and then temporarily encrypting the feature to be compared with the feature in the comparison stage using the service's public key, it is possible to shorten the time that the input feature remains in plain text compared to performing encryption processing for direct comparison. Furthermore, by using a proxy re-encryption technique, it is possible to perform key conversion quickly while the feature remains encrypted. This allows the feature once encrypted with the service's public key in the service-side device 11 to be processed in the encrypted state until the comparison stage, thereby achieving both improved security and ensuring privacy.

[0030] Specific embodiments will be described in more detail below with reference to the drawings. Note that the same components in each embodiment are denoted by the same reference numerals, and the description thereof will be omitted.

[0031] [Second embodiment] In the second embodiment, a secure matching system will be described that, in addition to the above configuration, introduces similarity calculation using homomorphic operations that enable matching processing to be kept secret. FIG. 2 is a block diagram showing an example of a schematic configuration of the secure matching system in the second embodiment. As shown in this diagram, the secure matching system of this embodiment includes a user-side device 10 and a service-side device 11. The user-side device 10 has a user key generation unit 12, a registration unit 13, a decryption unit 19, and a determination unit 20. The service-side device 11 has a service key generation unit 14, a reconversion key generation unit 15, a matching unit 16, a re-encryption unit 17, and an encryption unit 18.

[0032] The user key generation unit 12 generates a pair of a user's public key and a user's private key. Specifically, the pair of public key and private key is generated by an application program on a smartphone or the like owned by the user. Of the generated keys, the public key is sent to the service side device 11. There are no particular limitations on the encryption method, but in the secret matching system of this embodiment, the final determination process of whether to accept the recognition result is performed after decryption processing using the private key of the user side device 10. Therefore, when applied to processing such as identity verification performed in access control, immediate operation is necessary and high-speed processing is required. For this reason, it is desirable to use a method and key length that allow for relatively high-speed decryption processing.

[0033] The registration unit 13 registers in the service side device 11 a registration ciphertext obtained by encrypting a plurality of feature quantities to be matched with the public key of the corresponding user. The "matching destination" is the contact point when matching, and is a feature quantity belonging to a user registered in the entrance / exit management server, which is the service side device. The feature quantities acquired by the registration unit 13 are encrypted with the public key of the corresponding user, and then stored and held as a registration ciphertext in a memory area of ​​the service side device 11. For this reason, the registration unit 13 may belong to the service side device 11.

[0034] The service key generation unit 14 generates a pair of a service public key and a service private key. "Of the service" means of the service side device 11, and the generated service private key is stored in the service side device 11. The service public key is used to temporarily encrypt the feature to be matched in the encryption unit 18, which will be described later.

[0035] The re-encryption key generator 15 uses the user's public key and the service's private key to generate a re-encryption key for converting a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without decryption. The re-encryption key is generated using the proxy re-encryption technique described above and stored in a storage area of ​​the service-side device 11.

[0036] The encryption unit 18 receives the feature to be matched and encrypts it with the public key of the service to generate a first ciphertext. For example, in face authentication, the feature to be matched is a feature extracted from a facial image captured by a camera or the like. The feature is then encrypted by the service-side device 11 with the public key of the service. Normally, the feature should be encrypted with the user's public key, just like the registered ciphertext, to be matched against the registered ciphertext. However, encryption with the public keys of all users is required for matching (described later). Since encryption processing is performed for each registered user, the processing takes time. If this processing time is long, the feature remains in plain text in the memory of the service-side device 11 for a long time. This increases the possibility of the feature being stolen by an external attack. To prevent this from happening, the confidential matching system of this embodiment temporarily encrypts the acquired feature to be matched with the public key of the service, thereby shortening the time the feature remains in plain text.

[0037] The re-encryption unit 17 converts the first ciphertext into a second ciphertext using a conversion key. The conversion is performed using a conversion key generated by the proxy re-encryption method described above. Specifically, the encryption unit 18 converts the user's feature quantity, which has been temporarily encrypted with the service's public key, into a ciphertext encrypted with each user's public key, similar to the registered ciphertext, for verification. The confidential verification system of this embodiment uses the proxy re-encryption method, and is characterized in that it is possible to directly convert the ciphertext key when converting the first ciphertext into the second ciphertext, without performing a process such as decrypting and then re-encrypting the ciphertext.

[0038] The re-encryption unit 17 generates, by conversion using the conversion key, as many ciphertexts as the number of users who have registered registered ciphertexts for each feature belonging to one user who is a matching source. This is because, at the stage when the feature of the matching source is acquired, it is not known which user it belongs to, and therefore it is unclear which public key should be used to generate the second ciphertext encrypted with. This will become clear during later matching.

[0039] The matching unit 16 matches the registered ciphertext with the second ciphertext. Specifically, when N users are registered in this system, N second ciphertexts are generated for each feature that is the source of matching. These are matched with the N registered ciphertexts. Matching is performed using homomorphic similarity calculation while the features remain encrypted.

[0040] [Homomorphic similarity calculation] Matching can be performed by calculating the similarity, which indicates how close the features are to each other. Using homomorphic operations, it is possible to calculate the similarity while the features remain encrypted. Here, if (public key, private key) = (pk, sk), the encryption of the original features can be expressed as Enc(pk, M) and the decryption as Dec(sk, c). The homomorphic similarity operation is EncSim(Enc(pk, x), Enc(pk, y)) = Enc(pk, D(x, y)). Here, D(x, y) is the similarity (distance) between x and y. In identity verification authentication, an acceptance range is set; if D(x, y) falls within the acceptance range, it is accepted (OK); if not, it is rejected (NG). In this way, using homomorphic operations to calculate the similarity, it is possible to calculate the similarity between encrypted features while they remain encrypted.

[0041] As a result, once the feature quantity to be judged reaches the user device 10, it is encrypted with the service's public key, the key is converted, a similarity calculation is performed to execute matching, and the feature quantity remains encrypted and confidential until just before a final acceptance / rejection decision is made. This provides a high level of security against theft by external attacks. Furthermore, since the feature quantity cannot be directly viewed after being encrypted, it is possible to protect the feature quantity from human eyes, enabling a high level of privacy protection.

[0042] Note that homomorphic similarity calculation is only valid between data encrypted with the same key, so ultimately, for one feature to be matched, N similarity calculation results are generated because, among the N×N second ciphertexts generated with one reconstitution key, one of the N ciphertexts generated with the reconstitution key is a ciphertext generated with the same public key. The generated similarity calculation results are sent to the user device 10 in an encrypted state.

[0043] The decryption unit 19 decrypts the encrypted similarity using the user's private key in the user device 10. It receives the result of the similarity calculation sent from the service device 11 and decrypts the similarity using the user's private key that is held. In a system with N registered users, there will also be N decrypted results.

[0044] The determination unit 20 determines whether the similarity decoded by the user device 10 is within the acceptable range. The "acceptance range" refers to a predetermined range where the error is zero or where the error is not zero but is still acceptable. If the acceptance range is wide, slight differences in feature values ​​fall within the acceptance range, reducing the chance of errors during identity verification. However, if the acceptance range is too wide, features of other users may fall within the acceptance range, potentially resulting in the acceptance of a user who should not be accepted. In such a case, for example, if multiple features fall within the acceptance range, a similarity ranking may be assigned among the features within the acceptance range, and the user with the feature with the highest similarity may be accepted. On the other hand, if the acceptance range is too narrow, errors may occur due to slight noise even when the feature is the correct user. This reduces convenience. As such, the parameters defining the acceptance range must be adjusted to ensure proper system operation.

[0045] [Another configuration of embodiment 2] The user device 10 and service device 11 described above can be divided into a registration stage and a verification stage of the system operation. Figure 3 shows another configuration in which the device configuration of embodiment 2 is further divided into a registration stage and a verification stage. That is, the configuration includes a verification user device 21, a verification server device 22, a registration user device 23, and a registration server device 24.

[0046] In the configuration of Figure 3, verification user device 21 has decryption unit 19 and judgment unit 20. Verification server device 22 has encryption unit 18, re-encryption unit 17, and verification unit 16. Registration user device 23 has user key generation unit 12 and registration unit 13. Registration server device 24 has service key generation unit 14 and reconversion key generation unit 15. In particular, by using a separate verification server device on the server device side, for example, by placing it in a different location on the network or by stopping the device's operation in the verification stage after the registration stage, it is possible to prevent the private key from being stolen by an attack, thereby improving security.

[0047] [Explanation of operation] Next, an overview of the operation of the secret matching system of this embodiment will be described. Note that a description of the registration stage processing for registering a registered ciphertext and generating a key will be omitted. FIG. 4 is a flowchart of the matching stage of the secret matching system of the second embodiment. The left chart corresponds to the processing of the service-side device 11, and the right chart corresponds to the processing of the user-side device 10. As shown in the left chart, in the matching stage, first, a feature to be used as a matching source is received (step S41). Next, a first ciphertext is generated using the service's public key (step S42). Next, the first ciphertext is converted into a second ciphertext using a conversion key (step S43). Next, the similarity between the registered ciphertext and the second ciphertext is calculated (step S44). If the number of registered ciphertexts, i.e., the number of registered features to be used as a matching target, is N, the processing of steps S43 and S44 is repeated N times (loop 1). Here, the processing of step S43 may be repeated N times first, and then the processing of step S44 may be repeated N times.

[0048] Next, the process moves to the user device 10 in the chart on the right. The parts connected by dotted lines on the chart correspond to the same time. Before the process on the user device 10 starts, the calculated N encrypted similarities are sent from the service device 11 to the user device 10. The user device 10 decrypts the sent similarities with the user's private key (step S45). Next, it is determined whether the decrypted similarities are within the acceptable range (step S46). The processes of steps S45 and S46 are repeated N times, that is, the number of times equal to the number of N encrypted similarities sent (loop 2). Here too, the process of step S45 may be repeated N times first, and then the process of step S46 may be repeated N times. If the feature is within the acceptable range of any of the registered ciphertexts, an OK notification may be returned to the system. If there are multiple registered ciphertexts within the acceptance range, and the issue is not just whether it is OK or NG, but which registered ciphertext it corresponds to, then the registered ciphertexts that fall within the acceptance range are ranked by similarity, and the registered ciphertext with the highest similarity is accepted (step S47).

[0049] [Hardware configuration] The secret matching system of this embodiment can be configured by information processing devices (computers), each of which has the configuration exemplified in Fig. 5. For example, the user-side device 10 and the service-side device 11 each have a CPU (Central Processing Unit) 51, a memory 52, an input / output interface 53, and a NIC (Network Interface Card) 54 as a communication means, which are interconnected by an internal bus 55.

[0050] However, the configuration shown in Fig. 5 is not intended to limit the hardware configuration of the user-side device 10 and the service-side device 11. The user-side device 10 and the service-side device 11 may include hardware not shown, and may not be equipped with the input / output interface 53 as necessary. Furthermore, the number of CPUs and the like included in the user-side device 10 and the service-side device 11 is not intended to be limited to the example shown in Fig. 5; for example, the user-side device 10 and the service-side device 11 may include multiple CPUs.

[0051] The memory 52 is a RAM (Random Access Memory), a ROM (Read Only Memory), or an auxiliary storage device (such as a hard disk).

[0052] The input / output interface 53 is a means for interfacing with a display device and an input device (not shown). The display device is, for example, a liquid crystal display. The input device is, for example, a device that accepts user operations, such as a keyboard or a mouse.

[0053] The functions of the user device 10 and the service device 11 are realized by a group of programs (processing modules) stored in memory 52, such as a user key generation program, a registration program, a decryption program, a determination program, a service key generation program, a conversion key generation program, an encryption program, a re-encryption program, and a matching program, as well as a group of data, such as various generated key data and feature data of registered ciphertexts stored in memory 52 by the registration program and used by the matching program. The processing modules are realized, for example, by the CPU 51 executing each program stored in memory 52. ​​The programs can be downloaded via a network or updated using a storage medium storing the programs. Furthermore, the processing modules may be realized by semiconductor chips. That is, it is sufficient to have some means for executing the functions performed by the processing modules using hardware and / or software.

[0054] [Hardware operation] [Registration stage] In the registration stage, first, the user key generation program and the service key generation program are called from memory 52 and executed by CPU 51 to generate keys. The generated pairs of private and public keys are stored in memory 52 of each device. Next, the registration program is called from memory 52 and executed by CPU 51. This program controls an input / output interface 53, such as a camera, to acquire feature data to be saved as a registration ciphertext, encrypts it with the user's public key, and stores it in memory 52. ​​This process is repeated N times for the N users to be registered. At the same time, the reconstituted key generation program is called from memory 52 and executed by CPU 51. The reconstituted key is generated using the user's public key data stored in memory 52 of the user device 10 and the service's private key data stored in memory 52 of the service device 11, and stores the reconstituted key in memory 52 of the service device 11. This process is performed N times, the number of times being the feature data of the registration ciphertext, and N reconstituted key data are stored in memory 52 of the service device 11.

[0055] [Matching stage] In the matching stage, the encryption program is called from the memory 52 in the service side device 11 and is put into an execution state in the CPU 51. The program controls the input / output interface 53, such as a camera, to receive features to be matched, encrypts the features using the service's public key stored in the memory 52, and stores the encrypted data in the memory 52 as a first ciphertext. Next, the conversion program is called from the memory 52 and is put into an execution state in the CPU 51. The program sequentially reads N pieces of converted key data, encrypts the first ciphertext data stored in the memory 52, outputs the second ciphertext, and temporarily stores it in the memory 52. ​​Next, the matching program is called from the memory 52 and is put into an execution state in the CPU 51. The program executes a similarity calculation between the first ciphertext data temporarily stored in the memory 52 and the N registered ciphertext data stored in the memory 52. ​​This calculation may be a homomorphic similarity calculation that calculates the distance between the features of both. These processes are repeated N times, which is the number of subkeys. However, since the homomorphic operation for similarity calculation requires the same key, the similarity is actually calculated only once for each subkey when the user's public key matches. This is performed for the N subkeys, and N encrypted similarity data are generated. This data is sent to the user device 10 via the NIC 54.

[0056] The user device 10 also receives the N encrypted similarity data via the NIC 54, and passes the similarity data to a decryption program that has been called from the memory 52 and is running in the CPU 51. The program reads the user's private key data and decrypts the encrypted similarity data. Next, a judgment program is called from the memory 52 and runs in the CPU 51. The program first reads threshold data that defines the acceptance range from the memory 52. ​​The program then reads the decrypted plaintext similarity data and determines whether the similarity exceeds the threshold of the acceptance range. This process is repeated N times, the number of similarity data pieces. If there is similarity data that falls within the acceptance range, the judgment program sends an OK message to the service device 11 via the NIC 54. Conversely, if there is no similarity data that falls within the acceptance range, the judgment program sends an NG message via the NIC 54.

[0057] For example, when performing not only personal authentication but also individual identification, if there is multiple data that falls within the acceptance range, the judgment program sorts the calculated similarity data in descending or ascending order, accepts the registered ciphertext related to the feature with the highest similarity, and transmits the identifier of the accepted registered ciphertext to the service side device 11 via the NIC 54.

[0058] [Effect description] As described above, by performing homomorphic similarity calculations in the matching stage, it is possible to perform similarity calculations between the input encrypted features of the source of matching and the registered ciphertext of the target of matching while keeping the features encrypted.

[0059] [Example] FIG. 6 is a schematic diagram illustrating an overview of the processing of a secret matching system in an embodiment of the present invention. The secret matching system according to the present disclosure can be used for a variety of purposes. In this embodiment, an application example of the invention according to the present disclosure is shown as an entrance / exit management system. As shown in FIG. 6, the entrance / exit system is configured to include a user-side device and a service-side device. The user-side device is, for example, a smartphone carried by a user. The service-side device is configured by an entrance / exit management server, a camera connected to the device, an electric lock for a door controlled by the device, and the like.

[0060] The system generates the keys required for operation. First, each user generates their private key and public key on their smartphone, which is the user device. The generated public key is sent to the access control server, which is the service device, and stored in memory. The access control server, which is the service device, generates a private key and public key for the service. Then, it generates a conversion key using the user's public key sent from the user device and the service's private key. The generated key is stored in memory.

[0061] In addition to generating the key, it is necessary to register the features of the registration ciphertext for verifying the user in advance on the entrance / exit management server. One possible method is to take a picture of the face with a smartphone camera and register it on the server. The registered features are encrypted with the public key generated and stored for each user, and then stored in memory as the registration ciphertext.

[0062] Once the above process is complete, the user will be able to use the system. Looking at the actions involved in entering a room, a camera for entering and exiting the building is installed on the service device. When a user approaches this camera and their face comes into view, the entrance and exit management server captures the video and, if necessary, pre-processes it by cutting out the face for matching purposes, and uses it as the feature to be matched. Once the feature has been acquired, the entrance and exit management server device calls the service's public key and performs encryption. This converts the acquired feature from plain text into encrypted data, making it relatively secure against external attacks.

[0063] Next, the encrypted features are converted into ciphertext using the user's public key using a conversion key that uses a proxy re-encryption method. At this time, the access control server does not know which user's public key corresponds to the original features, so if N users are registered, it generates N pieces of encrypted data using N conversion keys. The generated N pieces of encrypted data are compared with the N registered ciphertexts. At this time, the comparison is only possible if the data were encrypted with the same key, so the actual comparison results are N comparison results where the same public keys were used to compare the data.

[0064] The matching is performed using homomorphic operations while the data is still encrypted, and the calculated similarity is sent to the user device, such as a smartphone, while still encrypted. The encrypted similarity is decrypted using the user's stored private key. The decrypted similarity is then subjected to a judgment process to determine whether it falls within a predetermined acceptance range. If the judgment result shows that at least one similarity falls within the acceptance range, the user device sends an OK message to the entrance / exit management server of the service device. The entrance / exit management server receives the message and controls the unlocking of the electric lock. In this way, the registered user is allowed to enter the facility. If the judgment result shows that no similarity falls within the acceptance range, an NG message is sent to the entrance / exit management server, and in this case, the lock is not unlocked and an error alarm is displayed, for example.

[0065] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes. [Appendix 1] This is the same as the (secrecy) matching system according to the first aspect above. [Appendix 2] an encryption unit that receives a feature to be matched and encrypts it with a public key of the service to generate a first ciphertext; a re-encryption unit that converts the first ciphertext into a second ciphertext using the conversion key; a service side device further comprising: Preferably, the (secrecy) matching system according to appendix 1. [Appendix 3] the reconstitution key generation unit generates a reconstitution key using the user's public key and the service's private key to convert a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without a decryption process; Preferably, the (secret) matching system is as described in Appendix 1 or 2. [Appendix 4] the matching unit of the service side device calculates the similarity between the registered ciphertext and the second ciphertext while keeping the ciphertext encrypted; the user device includes a decryption unit that decrypts the encrypted similarity using a private key of the user; a determination unit that determines whether the decoded similarity is within an acceptable range based on the decoded similarity; further comprising Preferably, the (secrecy) matching system according to any one of appendices 1 to 3. [Appendix 5] At least the second ciphertext is a fully homomorphic encryption in which homomorphic operations are defined for multiple multiplications and additions, and the matching unit calculates a distance between features related to the registered ciphertext and the second ciphertext by the homomorphic operations, and sets the distance as a similarity. Preferably, the (secrecy) matching system is as defined in any one of appendices 1 to 4. [Appendix 6] a registered user device having the user key generation unit and the registration unit; a registration server device having the service key generation unit and the conversion key generation unit; a verification server device having the encryption unit, the re-encryption unit, and the verification unit; a verification user device having the decoding unit and the determination unit; Including, Preferably, the (secrecy) matching system described in Appendix 4. [Appendix 7] This is the same as the (secret) verification device according to the second aspect described above. [Appendix 8] This is the same as the (secrecy) matching method from the third viewpoint described above. [Appendix 9] The step of comparing includes calculating the similarity between the registered ciphertext and the second ciphertext while keeping the ciphertext encrypted; a decryption step of decrypting the encrypted similarity using a user's private key; determining whether the decoded similarity is within an acceptable range based on the decoded similarity; further comprising Preferably, the (secrecy) matching method described in Appendix 8. [Appendix 10] This is as per the program based on the fourth perspective above.

[0066] The disclosures of the above-cited non-patent documents and other documents are incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the claims), and further based on the basic technical concepts thereof. Furthermore, various combinations and selections (including partial deletions) of various disclosed elements (including elements of each claim, elements of each embodiment or example, and elements of each drawing) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally embraces various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure and technical concepts, including the claims. In particular, with regard to the numerical ranges set forth herein, any numerical value or subrange within that range should be construed as specifically set forth, even if not otherwise specified. Furthermore, the disclosures of the above-cited documents, when used in part or in whole in combination with the disclosures herein as part of the disclosure of the present invention, in accordance with the spirit of the present invention, are also deemed to be included in the disclosures of this application. [Explanation of symbols]

[0067] 10 User side device 11 Service side equipment 12 User key generation unit 13 Registration Department 14 Service Key Generation Unit 15 Conversion key generation unit 16. Matching Unit 17 Re-encryption section 18 Encryption section 19 Decoding section 20 Judgment section 21 Verification user device 22. Verification server device 23 Registered User Device 24 Registration server device 51 CPU 52 memory 53 Input / Output Interface 54 NIC 55 Internal Bus

Claims

1. a user key generation unit that generates a pair of a user's public key and a user's private key; a registration unit that registers a registration ciphertext in the service-side device, the registration ciphertext being obtained by encrypting a plurality of feature quantities to be compared with a public key of a corresponding user; a user side device having a service key generation unit that generates a pair of a service public key and a service private key; a re-encryption key generating unit that generates a re-encryption key for converting a first ciphertext encrypted with the public key of the service into a second ciphertext encrypted with the public key of the user without a decryption process; a matching unit that matches the registered ciphertext with the second ciphertext; a service side device having the service-side device encrypts the feature to be compared with the public key of the service to generate a first ciphertext, and then generates a second ciphertext with the conversion key, and compares the second ciphertext with the registered ciphertext; Matching system.

2. an encryption unit that receives a feature to be matched and encrypts it with a public key of the service to generate a first ciphertext; a re-encryption unit that converts the first ciphertext into a second ciphertext using the conversion key; a service side device further comprising: The verification system according to claim 1 .

3. the reconstitution key generation unit generates a reconstitution key using the user's public key and the service's private key to convert a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without a decryption process; The collation system according to claim 1 or 2.

4. the matching unit of the service side device calculates the similarity between the registered ciphertext and the second ciphertext while keeping the ciphertext encrypted; the user device includes a decryption unit that decrypts the encrypted similarity using a private key of the user; a determination unit that determines whether the decoded similarity is within an acceptable range based on the decoded similarity; further comprising The verification system according to claim 2 .

5. At least the second ciphertext is fully homomorphic encrypted in which homomorphic operations are defined for multiple multiplications and additions, and the matching unit calculates a distance between features related to the registered ciphertext and the second ciphertext by the homomorphic operations, and determines the distance as a similarity. The verification system according to claim 4 .

6. a registered user device having the user key generation unit and the registration unit; a registration server device having the service key generation unit and the conversion key generation unit; a verification server device having the encryption unit, the re-encryption unit, and the verification unit; a verification user device having the decoding unit and the determination unit; The verification system of claim 4 , comprising:

7. a service key generation unit that generates a pair of a service public key and a service private key; a re-encryption key generation unit that generates a re-encryption key by using public keys of a plurality of users and a private key of the service to convert a first ciphertext encrypted with the public key of the service into a second ciphertext encrypted with the public key of the user without a decryption process; a registration unit that encrypts a plurality of feature quantities to be matched with a corresponding user's public key to generate a registration ciphertext; an encryption unit that receives a feature to be matched and encrypts it with a public key of the service to generate a first ciphertext; a re-encryption unit that converts the first ciphertext into a second ciphertext using the conversion key; a matching unit that matches the registered ciphertext with the second ciphertext; A matching device having the above configuration.

8. A collation method performed in cooperation between a user-side device operated by a user and a service-side device that provides a service, comprising: The user-side device generates a pair of a user public key and a user private key; said service side device generating a pair of a service public key and a service private key; generating a re-encryption key by the service side device for converting a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without a decryption process; a step in which the user device encrypts a plurality of feature quantities to be compared with the public keys of the corresponding users to generate registration ciphertexts; a step in which the service-side device receives a feature to be used as a comparison source and encrypts the feature with a public key of the service to generate a first ciphertext; the service side device converting the first ciphertext into a second ciphertext using the conversion key; a step in which the service side device compares the registered ciphertext with the second ciphertext; Matching methods, including:

9. the step of comparing includes the step of calculating the similarity between the registered ciphertext and the second ciphertext by the service side device while the ciphertext is still encrypted; the user device decrypting the encrypted similarity using the user's private key; a step in which the user device determines whether the decoded similarity is within an acceptable range based on the decoded similarity; further comprising The matching method according to claim 8.

10. A process of generating a pair of a user's public key and a user's private key; A process of generating a pair of a service public key and a service private key; a process of generating a re-encryption key for converting a first ciphertext encrypted with the service's public key into a second ciphertext encrypted with the user's public key without a decryption process; A process of encrypting multiple feature quantities that are candidates for matching with the public keys of corresponding users to generate registered ciphertexts; receiving a feature to be matched and encrypting it with a public key of the service to generate a first ciphertext; converting the first ciphertext into a second ciphertext using the re-encryption key; a process of matching the registered ciphertext with the second ciphertext; A program that causes a computer to execute the following.

Images