Information processing system and information processing method

Abstract

To generate an electronic signature for an original message from an electronic signature using biometric information for a concealed message.SOLUTION: A second computer generates blind information based on random numbers and a blind message and transmits the blind information to a first computer. The first computer generates a hash on the basis of random numbers, the blind information, and a hash function, and transmits the hash to the second computer. The second computer generates an electronic signature for a blind message on the basis of the hash, the random numbers used for generating the bling information, and a template based on biometric information, and transmits the electronic signature to the first computer. The first computer generates an electronic signature for an original message on the basis of the electronic signature and a verification key based on the biometric information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an information processing system and an information processing method. [Background technology]

[0002] As background technology for this field, there is Japanese Patent Publication No. 2013-123142 (Patent Document 1). This publication states that "at the time of registration, a predetermined private key is embedded in the feature quantity of the user's biometric information, and a biometric certificate is issued in combination with the corresponding public key. At the time of signing, a new pair of temporary private key and temporary public key is generated for the signature feature quantity of the user's biometric information, a signature for the message is created using the temporary private key, a commitment is created by embedding the temporary private key in the signature feature quantity, the set of the temporary public key, the signature and the commitment is used as the biometric signature, and at the time of biometric signature verification, the signature is verified with the temporary public key, and a differential private key and a differential public key are generated from the biometric certificate, commitment and temporary public key to verify the correspondence." (See abstract).

[0003] The technology described in Patent Document 1 affixes an electronic signature to a message using an individual's biometric information. In contrast, there is a signature method called blind signature, in which the signatory electronically signs a message without disclosing the contents of the message to the signatory.

[0004] In blind signatures, an electronic signature is generated for an anonymized message, and a user who receives this electronic signature can then generate an electronic signature for the original message based on that signature for the anonymized message. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2013-123142 [Overview of the project] [Problems that the invention aims to solve]

[0006] In Patent Document 1, when returning to the user an electronic signature using the biometric information of the signer for a concealed message, there is no description of a method for the user to generate an electronic signature for the original message from the electronic signature, and the message cannot have anonymity.

[0007] Therefore, one aspect of the present invention generates an electronic signature for the original message from an electronic signature using biometric information for a concealed message.

Means for Solving the Problems

[0008] To solve the above problems, one aspect of the present invention adopts the following configuration. The information processing system includes a first computer and a second computer. The first computer holds a verification key indicating a first template into which biometric information has been converted. The second computer holds a blind message, which is a message concealed based on a random number, and a second template into which biometric information has been converted. The second computer generates a random number, generates blind information based on the generated random number and the blind message, and transmits it to the first computer. The first computer generates a random number, generates a hash based on the generated random number, the blind information, and a predetermined first hash function, and transmits it to the second computer. The second computer generates a first electronic signature for the blind message based on the hash, the random number used for generating the blind information, and the second template, and transmits it to the first computer. The first computer generates a second electronic signature for the message based on the first electronic signature and the verification key.

Effects of the Invention

[0009] According to one aspect of the present invention, an electronic signature for the original message can be generated from an electronic signature using biometric information for a concealed message.

[0010] Other issues, configurations, and effects not mentioned above will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0011] [Figure 1] This is a block diagram showing an example configuration of the signature generation / verification system in Example 1. [Figure 2] This is a block diagram showing an example of the hardware configuration of a user terminal in Example 1. [Figure 3] This is a sequence diagram showing an example of electronic voting processing in which a blind signature using biometric information is applied, as in Example 1. [Figure 4] This flowchart shows an example of the verification key generation process in Example 1. [Figure 5] This flowchart shows an example of the blinding process in Example 1. [Figure 6] This flowchart shows an example of the blind information generation process in Example 1. [Figure 7] This flowchart shows an example of the hash generation process in Example 1. [Figure 8] This is a flowchart showing an example of the electronic signature generation process in Example 1. [Figure 9] This flowchart shows an example of the blind signature generation process in Example 1. [Figure 10] This flowchart shows an example of the blind signature verification process in Example 1. [Figure 11] This flowchart shows an example of the zero-knowledge proof verification process in Example 1. [Modes for carrying out the invention]

[0012] Embodiments of the present invention will be described below with reference to the accompanying drawings. It should be noted that these embodiments are merely one example of how to realize the present invention and do not limit the technical scope of the present invention.

[0013] This embodiment describes electronic voting using blind signatures based on biometric information. A user terminal used by a voter blinds (conceals) a message indicating the vote and sends it to a signatory terminal used by a vote observer. The signatory terminal generates an electronic signature using the signatory's (vote observer's) biometric information without being able to see the vote, and sends the generated electronic signature to the user terminal.

[0014] The user terminal generates a signature for the message representing the original vote based on the received signature, and sends the generated signature to the verifier terminal used by the vote counter. The verifier terminal verifies the received signature, and if it is confirmed to be correct, it reflects the vote in the voting results. [Examples]

[0015] Figure 1 is a block diagram showing an example configuration of a signature generation / verification system. The signature generation / verification system (an example of an information processing system) performs digital signatures on blinded messages using biometric information as the secret key, generates a hash from a calculation formula using random numbers generated by the signer and the user, and then constructs a blind signature based on that hash and verifies the signature.

[0016] The signature generation / verification system includes, for example, a user terminal 100 (an example of a first computer), a signer terminal 200 (an example of a second computer), and a verifier terminal 300 (an example of a third computer), and these terminals are interconnected by a network 400 such as the Internet.

[0017] The user terminal 100 includes, for example, a blind processing unit 101, a hash generation unit 102, and a blind signature generation unit 103, all of which are functional units. The signer terminal 200 includes, for example, a verification key generation unit 201, a blind information generation unit 202, and an electronic signature generation unit 203, all of which are functional units. The verifier terminal 300 includes, for example, a blind signature verification unit 301, which is a functional unit.

[0018] The blinding processing unit 101 blinds the message. Hereafter, the blinded message will also be simply called a blind message. The hash generation unit 102 generates a hash based on a calculation formula using random numbers.

[0019] The verification key generation unit 201 generates a verification key based on the signer's biometric information. The blind information generation unit 202 generates blind information that is used by the hash generation unit 102 when generating a hash. The electronic signature generation unit 203 generates a signature using the hash generated by the user terminal 100 and the biometric information of the signature document.

[0020] The blind signature generation unit 103 generates a blind signature for the original message (i.e., the message before it was blinded) using the signature generated by the electronic signature generation unit 203. The blind signature verification unit 301 verifies the blind signature generated by the blind signature generation unit 103.

[0021] Figure 2 is a block diagram showing an example of the hardware configuration of the user terminal 100. The user terminal 100 is comprised of a computer that includes, for example, a CPU 100-1, an auxiliary storage device 100-2, a memory 100-3, an input / output interface 100-5, a communication device 100-6, and a biometric information acquisition sensor 100-7, all connected via an internal signal line 100-4.

[0022] The CPU 100-1 includes a processor and executes programs stored in memory 100-3. Memory 100-3 includes ROM, a non-volatile memory element, and RAM, a volatile memory element. ROM stores immutable programs (e.g., BIOS). RAM is a high-speed, volatile memory element such as DRAM (Dynamic Random Access Memory) and temporarily stores programs executed by the CPU 100-1 and data used during program execution.

[0023] The auxiliary storage device 100-2 is a high-capacity, non-volatile storage device such as a magnetic storage device (HDD) or flash memory (SSD), and stores the program executed by the CPU 100-1 and the data used when the program is executed. In other words, the program is read from the auxiliary storage device 100-2, loaded into memory 100-3, and executed by the CPU 100-1.

[0024] The input / output interface 100-5 includes interfaces to which input devices such as keyboards and mice are connected and to which user input is received, and interfaces to which output devices such as display devices and printers are connected and to which the program execution results are output in a format that the user can see.

[0025] The communication device 100-6 is a network interface device that controls communication with other devices according to a predetermined protocol. The communication device 100-6 may also include a serial interface such as USB (Universal Serial Bus).

[0026] The program executed by CPU 100-1 is provided to the user terminal 100 via removable media (CD-ROM, flash memory, etc.) or network 400, and stored in a non-volatile auxiliary storage device 100-2, which is a non-temporary storage medium. For this reason, the user terminal 100 should have an interface for reading data from the removable media.

[0027] The biometric information acquisition sensor 100-7 is a sensor that acquires the user's biometric information, such as fingerprints, wrinkles, and veins on the hand, via a fingerprint sensor, vein sensor, etc. Note that the computer constituting the user terminal 100 does not necessarily have to include the biometric information acquisition sensor 100-7.

[0028] Note that the hardware configuration of the signatory terminal 200 is the same as that of the user terminal 100, and the verifier terminal 300 is the same as that of the user terminal 100, except that it does not need to include the biometric information acquisition sensor 100-7, so the explanation is omitted.

[0029] The functional part of the user terminal 100 described above is included in the CPU 100-1 of the user terminal 100. The CPU 100-1 of the user terminal 100 functions as a blind processing unit 101 by operating according to the blind processing program loaded into the memory 100-3 of the user terminal 100, and functions as a hash generation unit 102 by operating according to the hash generation program loaded into the memory 100-3 of the user terminal 100.

[0030] Furthermore, the relationship between the programs that implement each functional unit and the CPU 100-1 is the same for the other functional units included in the user terminal 100, the functional units included in the signer terminal 200, and the functional units included in the verifier terminal 300, so their explanation will be omitted.

[0031] Furthermore, some or all of the functions provided by other functional units included in the user terminal 100, the functional units included in the signer terminal 200, and the functional units included in the verifier terminal 300 may be implemented by hardware such as ASICs (Application Specific Integrated Circuits) or FPGAs (Field-Programmable Gate Arrays).

[0032] In this embodiment, the information used by the signature generation / verification system is independent of the data structure and can be represented in any data structure. For example, a data structure appropriately selected from a table, list, database, or queue can store the information.

[0033] Furthermore, the user terminal 100 is a computer system consisting of one physical computer or multiple logically or physically configured computers, and may operate in separate threads on the same computer, or on a virtual computer built on multiple physical computer resources. The same applies to the signer terminal 200 and the verifier terminal 300.

[0034] Figure 3 is a sequence diagram showing an example of an electronic voting process to which biometric signatures are applied. In the example in Figure 3, the user terminal 100 is used by the voter, the signatory terminal 200 is used by the election observer (i.e., the election observer is an example of a signatory), and the verifier terminal 300 is used by the vote counter (i.e., an example of a vote counter's verifier).

[0035] The user terminal 100 obtains a message m indicating the voting content and the voter's identification information (S100) according to input to an input device connected to the input / output interface 100-5, and transmits the obtained identification information to the signatory terminal 200.

[0036] The identity verification information includes information indicating that the voter has the right to vote. If the signatory terminal 200 can confirm that the voter has the right to vote based on the identity verification information, it proceeds with the processing described in step S210 and later.

[0037] In addition, the process in step S210 in which the signer terminal 200 generates a verification key VK and sends it to the user terminal 100 may be performed before the process in step S100.

[0038] The user terminal 100 may encrypt the identity information using an algorithm such as public-key cryptography and send it to the signer terminal 200. In this case, the user terminal 100 has an encryption key for encrypting the identity information, and the signer terminal 200 has a decryption key corresponding to that encryption key.

[0039] Furthermore, the user terminal 100 may prove that the voter has legitimate voting rights by performing authentication with the signatory terminal 200 using a predetermined algorithm (e.g., password authentication, biometric authentication, etc.) instead of or in addition to acquiring and transmitting identity information.

[0040] First, the signer terminal 200 executes the verification key generation process (S210). In the verification key generation process, the signer terminal 200 generates a verification key VK, and uses the generated verification key VK, the generator g of the multiplicative group of the finite field F used to generate the verification key VK, and the hash function h z (Details will be described later) and are sent to the user terminal 100. Details of the verification key generation process will be described later using Figure 4.

[0041] The user terminal 100 performs a blinding process (S110). In the blinding process, the user terminal 100 generates a blind message m0 that conceals the voting content based on a message m indicating the voting content and a random number, and sends the generated blind message m0 to the signatory terminal 200. Details of the blinding process will be described later with reference to Figure 5.

[0042] The signer terminal 200 performs a blind information generation process (S220). In the blind information generation process, the signer terminal 200 generates blind information (m0) based on the signing key and a random number. sk’ The system generates ,vk',a0,b0) and sends the generated blind information to the user terminal 100. Details of the blind information generation process will be described later using Figure 6.

[0043] The user terminal 100 performs a hash generation process (S120). In the hash generation process, the user terminal 100 generates a hash c0 based on blind information and random numbers, and transmits the generated hash c0 to the signer terminal 200. Details of the hash generation process will be described later with reference to Figure 7.

[0044] The signatory terminal 200 executes the electronic signature generation process (S230). In the electronic signature generation process, the signatory terminal 200 generates an electronic signature σ (an example of a first electronic signature) for the blind message m0 based on the biometric information of the vote observer (signature document), and transmits the generated electronic signature σ to the user terminal 100. Details of the electronic signature generation process will be described later with reference to Figure 8.

[0045] The user terminal 100 performs a blind signature generation process (S130). In the blind signature generation process, the user terminal 100 generates a blind signature σ for message m, which indicates the unblinded voting content, based on the digital signature σ for the blind message m0 (by removing the random numbers used to generate the blind message m0 from the digital signature σ). * Generate message m and blind signature σ * This is then sent to the verifier terminal 300. Details of the blind signature generation process will be described later using Figure 9.

[0046] The verifier terminal 300 performs the blind signature verification process (S310). In the blind signature verification process, the verifier terminal 300 performs the blind signature σ * The following steps are performed: a signature verification process (described later) that verifies that (an example of a second digital signature) was generated from the biometric information of the vote observer (and the digital signature σ based on it); and a zero-knowledge proof verification process (described later) that verifies that the digital signature σ was generated for the blind message m0 (i.e., generated without using the original message m). Details of the blind signature verification process will be described later using Figure 10.

[0047] If the verifier terminal 300 succeeds in the blind signature verification process, it determines that the vote indicated by message m is valid, adopts the vote, and reflects it in the voting results. If the blind signature verification process fails, it determines that the vote indicated by message m is invalid and discards the vote.

[0048] As described above, in the electronic voting process shown in Figure 3, the signatory terminal 200 obtains the voter's identity information but generates a biometric signature for the blind message m0 without obtaining the original message m.

[0049] This allows poll watchers to verify that voters have legitimate voting rights, and without the poll watchers knowing the contents of the vote, voters can obtain a biometric signature based on the poll watcher's biometric information for the blind message m0.

[0050] Furthermore, as described above, in the electronic voting process shown in Figure 3, the verifier terminal 300 verifies the blind signature without obtaining the voter's identity information.

[0051] This allows the vote counter to verify that a legitimate vote observer has affixed a biometric signature to the vote without knowing the voter's identity information, and that the legitimate vote observer affixed the biometric signature without knowing the original vote content.

[0052] Figure 4 is a flowchart showing an example of the verification key generation process in step S210. The verification key generation unit 201 of the signer terminal 200 sets the signer's biometric information A, a real constant T, and a generator g of the multiplicative group of a finite field F (S211).

[0053] However, biometric information A is, for example, an element of an n-dimensional real vector space. For example, biometric information A is acquired via the biometric information acquisition sensor 100-7 of the signatory terminal 200. Also, for example, the dimension n, the real constant T, the finite field F, and the generator g of the finite field F are predetermined (i.e., information indicating these is pre-stored in the auxiliary storage device 100-2 and / or memory 100-3 of the signatory terminal 200).

[0054] The verification key generation unit 201 executes the signer's key generation process (S212). Specifically, for example, the verification key generation unit 201 generates a random number sk in a finite field F and sets vk := g sk Calculate the function hz Using it, x := h z -1 Calculate (sk), calculate the public template C := x + TA, and generate the verification key VK := (vk, C). However, the function h z is a hash function from an n-dimensional vector space over the finite field F to the finite field F (or from an n-dimensional real vector space to the finite field F) and is predefined.

[0055] The verification key generation unit 201 transmits the verification key VK, the generator g of the finite field F, and the function h z to the user terminal 100 (S213), and ends the verification key generation process.

[0056] Note that since the user terminal 100 uses the generator g of the finite field F in the process of step S121 described later, the verification key generation unit 201 may transmit the generator g of the finite field F to the user terminal 100 before the process of step S121 starts, and does not necessarily have to transmit it in step S213.

[0057] Also, since the user terminal 100 uses the function h z in the process of step S132 described later, the verification key generation unit 201 may transmit the function h z to the user terminal 100 before the process of step S132 starts, and does not necessarily have to transmit it in step S213.

[0058] Note that the verification key generation unit 201 may distribute the same verification key VK to different user terminals 100, or may distribute different verification keys for each user terminal 100 (that is, the verification key generation process of step S210 may be executed for each user terminal 100).

[0059] Figure 5 is a flowchart showing an example of the blinding process in step S110. The blinding processing unit 101 of the user terminal 100 reads the message m indicating the voting content acquired in step S100 (S111). Note that the message m is an element of the finite field F.

[0060] The blind processing unit 101 generates a random number t in a finite field F, where m0 := m t The value is calculated (S112). Note that the finite field F is predetermined. The blind processing unit 101 sends the blind message m0 to the signer terminal 200 (S113) and terminates the blinding process.

[0061] Figure 6 is a flowchart showing an example of the blind information generation process in step S220. The blind information generation unit 202 of the signer terminal 200 executes the signature key generation process (S221).

[0062] Specifically, for example, the blind information generation unit 202 acquires the signer's biometric information A' at the time of signature generation via the biometric information acquisition sensor 100-7 of the signer terminal 200, and reads the blind message m0 transmitted in step S113.

[0063] Furthermore, for the blind signature in this embodiment to be properly applied, biometric information A' and biometric information A must be of the same type (for example, the same type of feature obtained from the same body part) obtained from the same signatory.

[0064] In step S221, the blind information generation unit 202 further generates, for example, a random number sk' in a finite field F, and the signature key vk':=g for signature generation. sk’ And, x':=h z -1 (sk') and the signature generation template C':=x'+TA' are calculated.

[0065] The blind information generation unit 202 performs random number generation processing (S222). Specifically, for example, the blind information generation unit 202 generates a random number s in a finite field F, such that (a0,b0):=(g s ,m0 s ) calculates the blind information (m0 sk’ Generate vk'a0,b0) (S222).

[0066] The blind information generation unit 202 generates blind information (m0sk’ Send vk'a0,b0) to the user terminal 100 (S223) and terminate the blind information generation process.

[0067] Figure 7 is a flowchart showing an example of the hash generation process in step S120. The hash generation unit 102 of the user terminal 100 executes the hash generation process (S121).

[0068] Specifically, for example, the hash generation unit 102 generates random numbers d, u, and v within a finite field F, and the signer terminal 200 generates (a0, b0) and (m0) in the signing key generation process of step S220. sk’ Using vk', a:=(a0·g v ) u ,b:=(b0 1 / t ·m v ) u ,vk * :=vk'·g d ,z:=(m0 sk’ ) 1 / t ,z * :=zg d Calculate c:=Hash(m,a,b,z * Calculate ).

[0069] The hash function is predetermined and takes a vector containing four elements of a finite field F as input and outputs elements of the finite field F. The hash generation unit 102 sends the hash c0:=c / u to the signer terminal 200 (S122) and terminates the hash generation process.

[0070] Figure 8 is a flowchart showing an example of the electronic signature generation process in step S230. The electronic signature generation unit 203 of the signer terminal 200 reads sk', vk', C', and random number s obtained in the blind information generation process in step S220 (S231).

[0071] The electronic signature generation unit 203 calculates r0:=s+c0·sk' and generates σ=(vk',c0,r0,C') (S232). The electronic signature generation unit 203 sends the electronic signature σ for the blind message m0 to the user terminal 100 (S233) and terminates the electronic signature generation process. Through the above process, the signer terminal 200 can generate an electronic signature σ for the blind message m0 based on the signer's biometric information without obtaining the message m.

[0072] Figure 9 is a flowchart showing an example of the blind signature generation process in step S130. The blind signature generation unit 103 of the user terminal 100 generates a random vector B in an n-dimensional real vector space and refers to the digital signature σ to generate C * Calculate :=C'+B and r=(r0+v)u, and further r * Calculate :=r+cd (S131).

[0073] The blind signature generation unit 103 has Δsk := h z (CC * ) calculate y:=vk * ·g Δsk / vk is calculated, and then the zero-knowledge proof π:=(y,Δsk) is calculated (S132). The blind signature generator 103 uses σ as the signature for message m. * :=(VK,z * ,a,b,r * ,C * ,vk * The blind signature generation unit 103 generates a message m and a blind signature σ (S133). * :=(VK,z * ,a,b,r * ,C * ,vk * The ,π) and are sent to the verifier terminal 300 (S134), and the blind signature generation process is terminated.

[0074] As a result of the above process, the user terminal 100 obtains a blind signature σ from which information about the random number t used to generate the blind message m0 has been removed from the digital signature σ of the message m generated by the signer terminal 200. * (i.e., a signature on message m), and based on the signer's biometric information. * It can generate [this].

[0075] Figure 10 is a flowchart showing an example of the blind signature verification process in step S310. The blind signature verification unit 301 of the verifier terminal 300 performs the signature verification process and obtains the signature verification result (S311). Specifically, for example, the blind signature verification unit 301 performs the blind signature σ * VK,z included * Using a and b, a signature verification process (for example, Schnorr signature verification) is performed according to a predetermined algorithm.

[0076] The blind signature verification unit 301 determines whether the signature verification result in step S311 is a success or a failure (S312). If the blind signature verification unit 301 determines that the signature verification result is a failure (S312: failure), it outputs [false] (S316) and terminates the blind signature verification process.

[0077] If the blind signature verification unit 301 determines that the signature verification result is successful (S312: success), it executes a zero-knowledge proof verification process to obtain the zero-knowledge proof verification result (S313). Details of the zero-knowledge proof process in step S313 will be described later with reference to Figure 11.

[0078] The blind signature verification unit 301 determines whether the zero-knowledge proof verification result in step S313 is a success or a failure (S314). If the blind signature verification unit 301 determines that the zero-knowledge proof verification result is a success (S314: success), it outputs [True] (S315) and terminates the blind signature verification process.

[0079] If the blind signature verification unit 301 determines that the zero-knowledge proof verification result is a failure (S314: failure), it outputs [False] (S316) and terminates the blind signature verification process.

[0080] Furthermore, if the blind signature verification unit 301 outputs [True] (i.e., both the signature verification process in step S311 and the zero-knowledge proof verification process in step S313 are successful), it determines that the voting content indicated by message m is valid, adopts that voting content, and reflects it in the voting result.

[0081] Furthermore, if the blind signature verification unit 301 outputs [False], it determines that the voting content indicated by message m is invalid if the blind signature verification process has failed (i.e., if at least one of the signature verification process in step S311 and the zero-knowledge proof verification process in step S313 has failed), and discards the voting content.

[0082] Figure 11 is a flowchart of an example of the zero-knowledge proof verification process in step S313. The blind signature verification unit 301 of the verifier terminal 300 σ * The π=(y,Δsk), vk, and vk included in * Using (vk is σ * (Included in VK within), I=vk * ·g Δsk Calculate / vk (S3131). However, it is assumed that the values ​​of the generators g of the multiplicative group of a finite field F are pre-stored in the auxiliary storage device 100-2 and / or memory 100-3 of the verifier terminal 300.

[0083] The blind signature verification unit 301 determines whether I=y is true (S3132). If the blind signature verification unit 301 determines that I=y is true (S3132: YES), it outputs "Success" as the zero-knowledge proof verification result (S3133) and terminates the zero-knowledge proof verification process.

[0084] If the blind signature verification unit 301 determines that I=y is not true (S3132: NO), it outputs "failure" as the zero-knowledge proof verification result (S3134) and terminates the zero-knowledge proof verification process.

[0085] In the signature generation / verification system of this embodiment, the signer terminal 200 can generate a biometric signature (based on the signer's biometric information) for a blind message without obtaining the original message, and the user terminal 100 can generate a biometric signature (based on the signer's biometric information) for the original message from the electronic signature.

[0086] In this embodiment, we have described a use case in which blind signatures using biometric information are applied to electronic voting processing. However, the blind signatures using biometric information described in this embodiment can be applied to any use case in which conventional blind signatures are applied.

[0087] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. It is also possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add configurations from other embodiments to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0088] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, either partially or entirely, by designing them as integrated circuits, for example. Alternatively, each of the above configurations and functions may be implemented in software by having the processor interpret and execute programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0089] Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected. [Explanation of symbols]

[0090] 100 User terminal, 100-1 CPU, 100-2 Auxiliary storage device, 100-3 Memory, 100-5 Input / Output interface, 100-6 Communication device, 100-7 Biometric information acquisition sensor, 101 Blind processing unit, 102 Hash generation unit, 103 Blind signature generation unit, 200 Signer terminal, 201 Verification key generation unit, 202 Blind information generation unit, 203 Electronic signature generation unit, 300 Verifier terminal verification, 301 Blind signature verification unit

Claims

1. An information processing system, It includes a first computer and a second computer, The first computer holds a verification key that indicates a first template into which biometric information has been transformed. The second computer holds a blind message in which message m is concealed based on a random number, and a second template in which biometric information has been transformed. The second computer generates a random number, generates blind information based on the generated random number and the blind message, and transmits it to the first computer. The first computer generates a random number, generates a hash based on the generated random number, the blind information, and a predetermined first hash function, and transmits it to the second computer. The second computer generates a first digital signature to the blind message based on the hash, the random numbers used to generate the blind information, and the second template, and transmits it to the first computer. The first computer is an information processing system that generates a second digital signature for the message m based on the first digital signature and the verification key.

2. The information processing system according to claim 1, Including the third computer, The first computer is, Generate a random vector, A zero-knowledge proof is generated based on the vector obtained by adding the random vector to the second template represented by the first digital signature, the first template, and the verification key. The zero-knowledge proof generated above is included in the second electronic signature. The second electronic signature is transmitted to the third computer, The third computer is an information processing system that performs verification of the second digital signature and verification of the zero-knowledge proof indicated by the second digital signature.

3. The information processing system according to claim 1, The aforementioned message m is an element of a predetermined finite field F, The aforementioned blind message is m ０ :=m ｔ And, t is a random number in the predetermined finite field F, The second computer is, The generators g of the multiplicative group of the predetermined finite field F are preserved, Generate random numbers s and sk' in the predetermined finite field F, vk':=g ｓｋ’ Calculate, (a ０ , b ０ ): = (g ｓ ,m ０ ｓ ) calculate, As the blind information, (m ０ ｓｋ’ , vk’a ０ , b ０ ) is generated, an information processing system.

4. The information processing system according to claim 3, The first hash function is Hash, The first computer is, The system stores the message m, the generator g of the multiplicative group of the predetermined finite field F, and the random number t used to generate the blind message. The random numbers d, u, and v of the predetermined finite field F are generated, The aforementioned blind information (m ０ ｓｋ’ ,vk'a ０ , b ０ Based on ), a := (a ０ ・g ｖ ) ｕ And, b := (b ０ １／ｔ ・m ｖ ) ｕ And, vk ＊ :=vk'・g ｄ And, z := (m ０ ｓｋ’ ) １／ｔ , z ＊ :=zg ｄ And, calculate, Calculate c := Hash(m, a, b, z*), The aforementioned hash is c ０ An information processing system that calculates := c / u.

5. The information processing system according to claim 4, The biological information A' used to generate the second template is an n-dimensional real vector, The second template is C' := x' + TA', x' := h ｚ －１ (sk') and h ｚ is a predetermined second hash function, The second computer is, Based on the hash, r ０ := s + c ０ Calculate sk', The first digital signature containing the second template C' is σ = (vk', c ０ ,r ０ An information processing system that generates C').

6. The information processing system according to claim 5, The biological information A used to generate the first template is an n-dimensional real vector, The first template is C := x + TA, x : = h ｚ －１ (sk) sk is a random number in the predetermined finite field F, The first computer is, The second hash function h ｚ Hold, A random vector B, which is an n-dimensional real vector, is generated. C ＊ :=C'+B and r=(r ０ +v)u and r ＊ Calculate :=r+cd, Δsk := h ｚ (C-C) ＊ ) and y := vk ＊ ・g Δｓｋ / vk and calculate, We calculate the zero-knowledge proof π := (y, Δsk), The second electronic signature including the aforementioned zero-knowledge proof π is σ ＊ :=(VK, z ＊ , a, b, r ＊ , C ＊ ,vk ＊ An information processing system that generates π).

7. The information processing system according to claim 6, Including the third computer, The first computer is the second digital signature σ ＊ The following is sent to the third computer: The third computer is, A predetermined signature verification algorithm and the second digital signature σ ＊ The signature verification process is performed based on the VK, z*, a, and b indicated by , The second digital signature mentioned above is σ ＊ vk, vk ＊ An information processing system that performs a zero-knowledge proof verification process based on the zero-knowledge proof π.

8. The information processing system according to claim 7, The third computer is, The generators g of the multiplicative group of the predetermined finite field F are preserved, In the aforementioned zero-knowledge proof verification process, I = vk ＊ ・g Δｓｋ Calculate / vk, An information processing system that determines the verification result in the zero-knowledge proof verification process based on whether or not I = y holds true.

9. An information processing method using an information processing system, The aforementioned information processing system includes a first computer and a second computer, The first computer holds a verification key that indicates a first template into which biometric information has been transformed. The second computer holds a blind message in which message m is concealed based on a random number, and a second template in which biometric information has been transformed. The aforementioned information processing method is: The second computer generates a random number, generates blind information based on the generated random number and the blind message, and transmits it to the first computer. The first computer generates a random number, generates a hash based on the generated random number, the blind information, and a predetermined first hash function, and transmits it to the second computer. The second computer generates a first digital signature for the blind message based on the hash, the random number used to generate the blind information, and the second template, and transmits it to the first computer. An information processing method comprising the first computer generating a second digital signature for the message m based on the first digital signature and the verification key.