Signature generation system and method

Abstract

The present disclosure provides a system with which it is possible to confirm, for example, that a document (message) submitted to a service has been submitted by the document sender him / herself while keeping biometric information secret. A system according to the present disclosure is provided with a first signature generation device and a second signature generation device that are communicatively connected to each other and are each provided with at least a processor and a communication interface, wherein: one of the first signature generation device and the second signature generation device acquires and stores registration information generated from first biometric information; the first signature generation device executes processing for acquiring second biometric information and a message to be signed; and the first signature generation device and the second signature generation device communicate with each other to generate, on the basis of at least the message to be signed, the second biometric information, and the first registration information, a signature including information regarding the message to be signed and the degree of similarity between the first biometric information and the second biometric information.

Description

Signature generation system and method

[0001] The present invention relates to a signature generation system, method, and recording medium.

[0002] Biometric authentication is a personal authentication method that uses biometric information. Private biometric authentication is a method of matching biometric information while keeping it secret (encrypted). The requirement is that neither the registered biometric information nor the biometric information entered during authentication is revealed to anyone other than the device that acquires the biometric information. By using private biometric authentication, biometric authentication can be used while preventing the leakage of biometric information.

[0003] Personal authentication, including biometric authentication, is performed to verify that a user is the person in question (e.g., a person who has previously completed registration processing) when using a certain service. In other words, biometric authentication is not performed for its own sake, but for the subsequent use of the service. Examples of service-related processing include updating registration information and submitting documents to a service provider.

[0004] Biometric authentication has a stronger link between authentication information and the individual than other authentication methods (e.g., passwords). In other words, with authentication methods using biometric information, it is less likely that the individual will be unable to authenticate themselves, or that someone else will be able to successfully authenticate them.

[0005] In contrast, authentication methods based on memorization of passwords, for example, are prone to the following: ・The user cannot be authenticated (for example, forgetting the password), and ・Another person can successfully authenticate (for example, guessing the password). Also, authentication methods based on possession of IC (Integrated Circuit) cards, etc. are prone to the following: ・The user cannot be authenticated (for example, losing the IC card), and ・Another person can successfully authenticate (for example, having the IC card stolen).

[0006] A disadvantage of biometric authentication is that biometric information cannot be selected or changed, so once it is leaked, the same biometric information cannot be used for other services. Therefore, in biometric authentication, it is desirable that neither the registered biometric information nor the biometric information entered when performing authentication is revealed to anyone other than the device that acquires the biometric information. By using confidential biometric authentication, which enables authentication while keeping biometric information encrypted, biometric authentication can be used while preventing the leakage of biometric information.

[0007] Furthermore, biometric information varies slightly each time it is acquired due to factors such as shifts in the imaging position and environmental factors. Therefore, when comparing biometric information for authentication (second registration information) with registered biometric information (first registration information), the similarity between the two pieces of biometric information is calculated and compared with a predetermined value (threshold) to determine whether the biometric information belongs to the same person. Examples of similarity indices that are used include: Euclidean distance, Hamming distance, and cosine similarity. The threshold is usually determined for each system and is included in the necessary devices, applications, etc.

[0008] The device that the user directly operates and the application that the device has are called a client.

[0009] A device owned by a service provider, which receives authentication requests from users and communicates with clients, and an application owned by that device are called a server.

[0010] The data generated and saved from the biometric information to be registered is called a template, which is often a ciphertext of the biometric information.

[0011] Patent No. 6421576

[0012] Personal authentication, including biometric authentication, is a process of identifying whether or not a person is authorized to perform a certain service operation before that operation is performed. After the authentication process is completed, the operation related to the service is performed. In other words, personal authentication is rarely performed for its own sake, but rather for the subsequent use of the service. It is desirable to integrate the biometric authentication process with the process related to the submission of information to the service.

[0013] Therefore, one of the objectives of the present disclosure is to provide a system, method, and program recording medium that makes it possible to confirm that a document (message) submitted to a service, for example, has been submitted by a registered individual while keeping biometric information confidential.

[0014] According to one embodiment of the present disclosure, the system includes a first signature generation device and a second signature generation device, each of which includes at least a processor and a communication interface and is communicatively connected to each other. Either the first signature generation device or the second signature generation device executes a process of acquiring and storing registration information generated from first biometric information. The first signature generation device executes a process of acquiring second biometric information and a message to be signed. The first signature generation device and the second signature generation device communicate with each other and execute a process of generating a signature based on at least the message to be signed and the second biometric information, and the registration information, the signature including information regarding the degree of similarity between the first biometric information and the second biometric information and the message to be signed.

[0015] According to one embodiment of the method of the present disclosure, of a first node and a second node that are communicatively connected to each other, either the first node or the second node acquires and stores registration information generated from first biometric information, the first node acquires second biometric information and a message to be signed, the first node communicates with the second node, and a signature is generated based on at least the message to be signed, the second biometric information, and the registration information, the signature including the degree of similarity between the first biometric information and the second biometric information and information regarding the message to be signed.

[0016] According to one aspect of the present disclosure, there is provided a recording medium (a computer-readable non-transitory medium) storing a program that causes a first processing device and a second processing device to respectively execute the following processes: acquiring and storing registration information generated from first biometric information obtained from either a first processing device or second biometric information that communicate with each other; acquiring the second biometric information and a message to be signed by the first processing device; and generating a signature by the first processing device and the second processing device, based on at least the message to be signed, the second biometric information, and the registration information, the signature including information regarding the similarity between the first biometric information and the second biometric information and the message to be signed.

[0017] According to the present disclosure, for example, it is possible to confirm that a document (message) submitted to a service has been submitted by a registered person while keeping biometric information confidential.

[0018] FIG. 1 is a diagram illustrating a comparative example 1 of a 1:1 authentication system. FIG. 2 is a diagram illustrating a comparative example 2 of a 1:N authentication system. FIG. 3 is a diagram illustrating a configuration of comparative example 1. FIG. 4 is a diagram illustrating a configuration of comparative example 2. FIG. 1 is a diagram illustrating an embodiment 1. FIG. 2 is a diagram illustrating an embodiment 2. FIG. 3 is a diagram illustrating an example of a process of comparative example 2. FIG. 4 is a diagram illustrating an example of a process of example 1 (example 1) of embodiment 2. FIG. 5 is a diagram illustrating an example of a process of example 2 (example 2) of embodiment 2. FIG. 6 is a diagram illustrating an example of a process of comparative example 3. FIG. 7 is a diagram illustrating an example of a process of example 1 (example 3) of embodiment 1. FIG. 8 is a diagram illustrating an example of a process of example 2 (example 4) of embodiment 1. FIG. 9 is a diagram illustrating an example of a process of comparative example 4. FIG. 10 is a diagram illustrating an example of a process of example 3 (example 5) of embodiment 2. FIG. 11 is a diagram illustrating an example of a process of example 4 (example 6) of embodiment 2. FIG. 12 is a diagram illustrating an example of an embodiment. FIG. 13 is a diagram illustrating another example of an embodiment.

[0019] As described above, personal authentication is performed for subsequent use of a service. It is desirable to integrate biometric authentication processing with processing related to the submission of information (documents) to a service. The present disclosure, which is based on the above findings, enables confirmation that a document (message) submitted to a service has been submitted by a person (the person himself / herself) who has been registered in advance, while the biometric information is kept secret. That is, the present disclosure calculates a signature, which is a value combining the degree of similarity between first biometric information for registration and second biometric information for authentication, and the message (document) submitted to the service, while keeping the biometric information encrypted. In verifying the signature, it is confirmed that the degree of similarity between the first biometric information for registration and the second biometric information for authentication falls within a predetermined range, and that the message is correct.

[0020] Below, several comparative examples will be described as a premise for the invention proposed in this disclosure. The drawings for explaining comparative examples 1 and 2 have been newly created to explain typical secure biometric authentication matching in order to facilitate understanding of the invention. Note that while biometric information is generally a real number vector, in each comparative example and each embodiment (example), the real number vector is multiplied by a constant and each element of the vector is rounded to the nearest integer using, for example, a ROUND function, to form an integer vector.

[0021] Comparative Example 1 Referring to FIG. 1 , a secret biometric authentication system 2A performing 1:1 authentication includes an enrollment device 220, a first verification device 240, and a second verification device 250. Note that 1:1 authentication is a method of identifying biometric information from registered biometric information using ID (identification information) or the like and then verifying the biometric information to authenticate an individual. The enrollment device 220, which has first biometric information for enrollment, calculates first and second enrollment information and stores them in the first verification device 240 and the second verification device 250, respectively. The first verification device 240, which has second biometric information for authentication and the first enrollment information (template), communicates with the second verification device 250, which stores the second enrollment information. The second verification device 250 outputs a result of verifying the first biometric information for enrollment and the second biometric information for authentication. The enrollment device 220 and the first verification device 240 may be implemented as clients, respectively, and the second verification device 250 may be implemented as a server. The registration device 220 and the first verification device 240 may be implemented as a single client device.

[0022] The registration device 220 (client) generates first registration information (template) from the first biometric information for user registration, and the first verification device 240 (client) stores the first registration information (template). The registration device 220 (client) may, for example, generate a private key for each user and transmit it to the second verification device 250 (server), which then stores the private key for each user. In the 1:1 authentication secret biometric authentication system 2A, during registration, the first registration information (template) and private key calculated by the registration device 220 (client) having the first biometric information are stored in the first verification device 240 (client) and the second verification device 250 (server), respectively. During authentication, a first verification device 240 (client) having second biometric information for authentication and first enrollment information (template) communicates with a second verification device 250 (server) having the user's private key, and the second verification device 250 (server) calculates a result of matching between the first biometric information for enrollment (template) and the second biometric information for authentication. From the registered first enrollment information and private keys, the first enrollment information and private key corresponding to the user are obtained based on, for example, ID (identification information).

[0023] 2, a secret biometric authentication system 2B performing 1:N secret biometric authentication includes a key generation device 210 that generates a secret key and a public key, a registration device 220, a first verification device 240, a second verification device 250, and a final verification device 260. Note that 1:N authentication is an authentication method in which input biometric information is verified against all registered biometric information using only the biometric information to find matching biometric information. The registration device 220 acquires first biometric information for registration, encrypts it with, for example, a public key, and generates registration information (template, also referred to as "second registration information"), and transmits it to the second verification device 250. The second verification device 250 acquires the second registration information and stores it in a memory unit (second registration information memory unit) 252. On the other hand, the first verification device 240 acquires second biometric information for authentication, generates a query by communicating between the first verification process of the first verification device 240 and the second verification process of the second verification device 250, and transmits the generated query to the final verification device 260. The final verification device 260 acquires a private key from the key generation device 210, stores it in a memory unit (key memory unit) 262, and performs final verification on the query from the second verification device 250. The registration device 220 and the first verification device 240 may each be implemented as a client, and the second verification device 250 and the final verification device 260 may each be implemented as a server.

[0024] The second verification device 250 (server) stores enrollment information (template) of the first biometric information for enrollment, and the final verification device 260 (decryption server) stores a secret key common to all users. A query generated as a result of communication between the first verification device 240 (client) having the second biometric information for authentication and the second verification device 250 (server) having the enrollment information (template) of the first biometric information for enrollment is transmitted to the final verification device 260 (decryption server), and the final verification device 260 (decryption server) performs verification on the query using the secret key.

[0025] 3 is a diagram illustrating an example of the configuration of a secret biometric authentication system 2A for 1:1 authentication in Comparative Example 1 of FIG. 1. The enrollment device 220 includes a biometric information acquisition unit 221 that acquires first biometric information for enrollment, an enrollment information generation unit 222 that generates first enrollment information and second enrollment information based on the first biometric information, a first enrollment information output unit 223 that transmits the first enrollment information to a first verification device 240, and a second enrollment information output unit 224 that transmits the second enrollment information to a second verification device 250. The first verification device 240 includes a first enrollment information acquisition unit 241 that acquires the first enrollment information, a first enrollment information storage unit 242 that stores the acquired first enrollment information, a biometric information acquisition unit 244 that acquires second biometric information for authentication, and a first verification unit 245. The second verification device 250 includes a second registration information acquisition unit 251 that acquires second registration information, a second registration information storage unit 252 that stores the second registration information, a second verification unit 255, and a verification result output unit 256 that outputs the verification result.

[0026] 4 is a diagram illustrating an example of the configuration of a 1:N authentication secret biometric authentication system 2B of Comparative Example 2 in FIG. 2. The key generation device 210 includes a key generation unit 211 that generates a private key and a public key, a public key publication unit 212 that publishes the public key, and a private key output unit 213 that transmits the private key to the final verification device 260. The registration device 220 includes a biometric information acquisition unit 221 that acquires first biometric information for registration, a registration information generation unit 222 that generates registration information (second registration information) based on the first biometric information, and a second registration information output unit 224 that transmits the registration information (second registration information) to the second verification device 250. The first verification device 240 includes a biometric information acquisition unit 244 that acquires second biometric information for authentication and a first verification unit 245. The second verification device 250 includes a second registration information acquisition unit 251 that acquires registration information (second registration information) output from the registration device 220, a second registration information storage unit 252 that stores the registration information (second registration information), and a verification result output unit 256 that transmits the verification result to the final verification device 260. The final verification device 260 includes a key acquisition unit 261 that acquires the private key output from the key generation device 210, a key storage unit 262 that stores the private key, a verification result acquisition unit 263 that acquires the verification result output from the second verification device 250, a final verification unit 264, and a final verification result output unit 265 that outputs the final verification result.

[0027] First Embodiment FIG. 5 is a diagram illustrating a first embodiment. In the first embodiment, the matching flow of the secret biometric authentication system 2A of the first comparative example described with reference to FIG. 1 is modified, and instead of the matching process, a signature generation process is performed to generate a signature that does not leak the first and second biometric information from the secret first biometric information (enrollment information), the second biometric information, and a message, and a signature verification process is performed to verify that the generated signature was generated for the message using the biometric information of the same person. Referring to FIG. 5, the signature generation system 1A of the first embodiment includes a registration device 120, a first signature generation device 130, a second signature generation device 140, and a verification device 150. The registration device 120 generates enrollment information (referred to as "first enrollment information") from the first biometric information for enrollment and transmits it to the first signature generation device 130. The registration device 120 generates another enrollment information (referred to as "second enrollment information") and transmits it to the verification device 150. The verification device 150 stores the second registration information in the storage unit 152. The first signature generation device 130 stores the first registration information in the storage unit 132. The first signature generation device 130 acquires second biometric information for a signature and a message. The first signature generation process of the first signature generation device 130 and the second signature generation process of the second signature generation device 140 communicate with each other to generate a signature and transmit the generated signature to the verification device 150. The verification device 150 acquires the message and the signature and uses the second registration information to verify that the signature was generated for the message using the biometric information of the same person. Devices that communicate with each other among the registration device 120, the first signature generation device 130, the second signature generation device 140, and the verification device 150 may be communicatively connected via a network (e.g., at least one of a wired local area network (LAN), a wireless LAN, a wide area network (WAN), a mobile communication network, a virtual network, etc.). Depending on the system configuration, the second signature generation device 140 and the verification device 150 may be arranged as server devices, and the client-side registration device 120 may transmit the second registration information to the front-end second signature generation device 140, corresponding to the above-mentioned FIG. 1, and the second registration information may be transmitted from the second signature generation device 140 to the back-end verification device 150.

[0028] <Embodiment 2> FIG. 6 is a diagram illustrating embodiment 2. In embodiment 2, the matching flow of the secret biometric authentication system 2B of Comparative Example 2 described with reference to FIG. 2 is modified, and instead of the matching process, a signature generation process is performed to generate a signature that does not leak the first and second biometric information from the secret first biometric information (registration information), the second biometric information, and a message, and a signature verification process is performed to verify that the generated signature was generated for the message using the biometric information of the same person. Referring to FIG. 6, the signature generation system 1B of embodiment 2 includes a key generation device 110, a registration device 120, a first signature generation device 130, a second signature generation device 140, and a verification device 150. The registration device 120 generates second registration information from the first biometric information for registration and transmits it to the second signature generation device 140. The second signature generation device 140 stores the second registration information in a storage unit 142. The first signature generation device 130 acquires second biometric information for signature and a message. The first signature generation process of the first signature generation device 130 and the second signature generation process of the second signature generation device 140 communicate to generate a signature and transmit the generated signature to the verification device 150. The verification device 150 acquires a private key from the key generation device 110, acquires a signature generated by communication between the first signature generation device 130 and the second signature generation device 140, and further acquires the message to verify that the signature was generated for the message using the biometric information of the same person. The devices that communicate with each other among the key generation device 110, the registration device 120, the first signature generation device 130, the second signature generation device 140, and the verification device 150 may be connected to each other via a network (e.g., at least one of a wired LAN, a wireless LAN, a WAN, a mobile communication network, a virtual network, etc.). The public key may be registered and stored in a public key database or the like in association with a key ID or the like.

[0029] As an example of the operation of the system of this embodiment, registration is performed once before using the system, signature generation is performed whenever a user wants to add a signature to a document, and verification is performed whenever a user wants to confirm a signature on a document (not limited to when the signature is received).

[0030] Fig. 7 is a diagram showing an example of the system configuration of the first embodiment shown in Fig. 5. Referring to Fig. 7, this system 1A includes a registration device 120, a first signature generation device 130, a second signature generation device 140, and a verification device 150. The registration device 120 includes a biometric information acquisition unit 121 that acquires first biometric information for registration, a registration information generation unit 122 that generates first registration information and second registration information based on the biometric information, a first registration information output unit 123 that transmits the first registration information to the first signature generation device 130, and a second registration information output unit 124 that transmits the second registration information to the second signature generation device 140. The first signature generation device 130 includes a first registration information acquisition unit 131 that acquires first registration information, a first registration information storage unit 132 that stores the first registration information, a message acquisition unit 133 that acquires a message, a biometric information acquisition unit 134 that acquires second biometric information for a signature, a first signature generation unit 135, and a first signature output unit 136. The second signature generation device 140 includes a second signature generation unit 145 and a second signature output unit 146. The verification device 150 includes a second registration information acquisition unit 151 that acquires second registration information, a second registration information storage unit 152 that stores the second registration information, a message acquisition unit 153 that acquires a message, a signature acquisition unit 154 that acquires the first and second signatures, a signature verification unit 155, and a verification result output unit 156. Each device may include a processor (not shown), and the processing of each unit in each device may be realized by the processor executing a program.

[0031] Fig. 8 is a diagram showing an example of the system configuration of the second embodiment shown in Fig. 6. Referring to Fig. 8, this system 1B includes a key generation device 110, a registration device 120, a first signature generation device 130, a second signature generation device 140, and a verification device 150. The key generation device 110 includes a key generation unit 111 that generates a private key and a public key, a public key publication unit 112 that publishes the public key, and a private key output unit 113 that transmits the private key to the final verification device 260. The registration device 120 includes a biometric information acquisition unit 121 that acquires first biometric information for registration, a registration information generation unit 122 that generates second registration information based on the biometric information, and a second registration information output unit 124 that transmits the second registration information to the second signature generation device 140. The first signature generation device 130 includes a message acquisition unit 133 that acquires a message, a biometric information acquisition unit 134 that acquires second biometric information for a signature, a first signature generation unit 135, and a first signature output unit 136. The second signature generation device 140 includes a second registration information acquisition unit 141 that acquires second registration information, a second registration information storage unit 142 that stores the second registration information, a second signature generation unit 145, and a second signature output unit 146. The verification device 150 includes a key acquisition unit 161 that acquires a private key, a key storage unit 162 that stores the private key, a message acquisition unit 153, a signature acquisition unit 154 that acquires the first and second signatures, a signature verification unit 155, and a verification result output unit 156 that outputs a verification result. Each device may include a processor (not shown), and the processing of each unit in each device may be realized by the processor executing a program.

[0032] Below, several specific examples (embodiments) of the embodiment will be described. As a premise for the specific examples, in the 1:N confidential biometric authentication system 2B of Comparative Example 2 in FIG. 4 , the first verification device 240 and the second verification device 250 calculate the similarity between the registered first biometric information and the second biometric information for authentication while keeping the biometric information encrypted, and the final verification device 260 performs authentication by confirming that the similarity is one of predetermined values. This example is configured using Lifted-Elgamal encryption. Here, an outline of Lifted-Elgamal encryption will be described.

[0033] Let G be a cyclic additive group whose order is a prime number p. Let P be its generator. G =

[0034] Key generation Private key s ∈ F ｐ (Finite field F p = Z / pZ={0,1,2,...p-1}) is chosen at random. Let the public key be Q=sP (P,Q: elements of the group G).

[0035] Encryption: For plaintext m, random number (integer) r ← R Select Fp (← R is an operation symbol representing uniform random selection from Fp), and is encrypted with public key Q. Enc(m) = (mP + rQ, rP) (1)

[0036] Decryption Decrypt the ciphertext c = (S,T) using the secret key s. dec(s,c)=S-sT (2) dec(s,Enc(m))=dec((mP +rQ, rP))=mP +rQ-s(rP)=mP (3)

[0037] m can be found by solving the Discrete Logarithm Problem: Dec(c)=m (4) Note that the notation Enc(m;r) is also used for Enc(m).

[0038] The Lifted-Elgamal cipher has additive homomorphism. c1:=(S1,T1):=Enc(m1;r1) c2:=(S2,T2):=Enc(m2;r2) c1+c2:=(S1 +S2, T1 +T2) That is, Enc(m1; r1) + Enc(m2; r2)=(m1P +r1Q, r1P)+(m2P +r2Q, r2P) =Enc((m1+m2)P +(r1+r2)Q, (r1+r2)P) =Enc(m1+m2, r1+r2) (5)

[0039] n×Enc(m; r) =Enc(n×m;r) (n: integer) (6)

[0040] In the following, Enc(x) denotes the ciphertext calculated from the public key and x.

[0041] In the case of a method that uses Euclidean distance as an index of similarity between registered first biometric information x and second biometric information y for authentication, if the first and second biometric information x and y are vectors with dimension n, the Euclidean distance D is given as follows: D((x1,...,x n ), (y1,…,y n ))=Σ i=1 n x i 2 - 2Σ i=1 n x i y i + Σ i=1 n y i 2　　　　　　　　 (7)

[0042] where D1=Σ i=1 n x i 2 (8) D2=- 2Σ i=1 n x i・ y i + Σ i=1 n y i 2 (9) Then, D=D1+D 2　　　　　　 (10) holds.

[0043] In the comparative example 2 of FIG. 9, the final matching device 260 of FIG. 4 performs a process in which the Euclidean distance D, which is the similarity between the first biometric information x and the second biometric information y, is calculated based on a set of predetermined values ​​related to the similarity {A １ , A2,…,A Θ}, the θth element of the set (θ∈{1, 2, ..., Θ}) is accepted as A θ It is expressed as:

[0044] The key generation unit 211 of the key generation device 210 generates a private key s and a public key sQ of the Lifted-Elgamal encryption (1). Note that the numbers in parentheses at the end of the sentence indicate the processing (processing steps) in the corresponding device, corresponding to FIG. 9.

[0045] The public key publishing unit 212 of the key generating device 210 publishes the public key (2). The public key may be sent to the first verification device 240, or may be sent to a key server (public key database) via the Internet or the like and published on the Internet.

[0046] The private key output unit 213 of the key generation device 210 transmits the private key to the final verification device 260 (3).

[0047] The biometric information acquisition unit 221 of the registration device 220 acquires biometric information for registration (first biometric information) x=(x1,...,x n ) and the registration information generation unit 222 generates a random number R (1).

[0048] The registration information generating unit 222 of the registration device 220 generates first biometric information (vector) x=(x1,...,x n ) The sum of squares of each element D1=Σ i=1 n x i 2　 (11) is calculated, and the random number R and R are converted into a vector x = (x1, ..., x n ) multiplied by each element, and the value encrypted with the public key, and the value multiplied by R by D1, are the n+2 element tuple: T = (Enc(R),Enc(Rx1), ..., Enc(Rx n ),RD1) (12) is generated (2). T corresponds to the second registration information in FIG.

[0049] The registration device 220 transmits the second registration information T to the second verification device 250 (3).

[0050] The second registration information acquisition unit 251 of the second verification device 250 receives the second registration information T and stores it in the second registration information storage unit 252 (1).

[0051] The second verification unit 255 of the second verification device 250 selects a random number r (2).

[0052] The second verification unit 255 of the second verification device 250 multiplies each of the n+1 elements (encryptions) of the second registration information T, excluding the element RD1, by r (r is an element of Fp selected uniformly at random) while keeping it encrypted to obtain C = (Enc(rR),Enc(rRx1), ..., Enc(rRx n )) (13) is generated (3).

[0053] The second verification unit 255 of the second verification device 250 transmits C to the first verification device 240 (4).

[0054] The biometric information acquisition unit 244 of the first verification device 240 acquires biometric information for authentication (second biometric information) y=(y1, . . . , y n ) to obtain (1).

[0055] The first collation unit 245 of the first collation device 240 receives C from the second collation device 250 (2).

[0056] The first matching unit 245 of the first matching device 240 generates a random number R for each θ∈{1, 2, ..., Θ} (Θ is a predetermined positive integer). θ and calculates the product Enc(rRx i ) is encrypted, and y i ×Enc(rRx i ) = Enc(rRx i ・y i ) and sum up n of them, Σ i=1 n Enc (rRx i ・y ii ) = Enc (Σ i=1 n rRx i ・y i The first matching unit 245 of the first matching device 240 further calculates the sum of squares of each element of the second biometric information (vector) y, Σ i=1 n y i 2 is calculated, and multiplied by the first element of C, Enc(rR), to obtain Enc(rRΣ i=1 n y i 2 ) is required.

[0057] The first collation unit 245 of the first collation device 240 calculates (-2)×Enc(Σ i=1 n rRx i ・y i ) + Enc(rRΣ i=1 n y i 2 ) to find Enc(rRD2).

[0058] The first matching unit 245 of the first matching device 240 calculates a predetermined value (integer) A θ and the first element of C, Enc(rRA θ ) and Enc(rRA θ ) and then calculate the random number R θ The encrypted value Enc(R θ ) and Enc(R θ )+Enc(rRD2)+(-1)×Enc(rRA θ ) from Enc(R θ + rR(D2 -A θ )) is required.

[0059] The first collation unit 245 of the first collation device 240 further generates a random number R θ The hash value H(R θ ) and AQ θ = (AQ θ, 1 ,AQ θ, 2 ) = (Enc(R θ + rR(D2 -A θ )), H(R θ )) (14) is calculated (3).

[0060] The first collation unit 245 of the first collation device 240 calculates the Θ elements AQ θ Randomly shuffled array S(AQ θ The sequence of indexes θ (1, 2, ..., Θ) is randomly permuted and transmitted to the second collation device 250 (4).

[0061] Here, AQ in equation (14) θ, 1 =Enc(R θ + rR(D2 -A θ The operation of )) will be explained.

[0062] The first matching unit 245 derives −2Σ from a set of n elements (Enc(rRx1), . . . , Enc(rRxn)) of C from the second to (n+1)th elements and the second biometric information y=(y1, . . . , yn). i=1 n y i ・Enc(rRx i )=Enc(-2Σ i=1 n y i ・rRx i )=Enc(rR(- 2Σ i=1 n x i・ y i )) is required.

[0063] The first element of C, Enc(rR), is (Σ i=1 n y i 2 -A θ ) multiplied to get Enc((Σ i=1 n y i 2 -A θ )rR) and Enc(rR(- 2Σ i=1 n x i・ y i )) + Enc((Σ i=1 n y i 2 -A θ )rR) = Enc (rR(-2Σ i=1 n x i y i +Σy i 2 -A θ )) = Enc(rR(D2 - A θ )) is obtained. This Enc(rR(D2 - A θ )) to R θ Enc(R θ ) to get AQ θ, 1 = Enc (R θ +rR(D2 - A θ )) is obtained.

[0064] The first collation unit 245 of the first collation device 240 calculates Enc(R θ + rR(D2 - A θ )) and R θ The hash value H(R θ ) and the pair with AQ as the first and second components: θ =(AQ θ1, AQ θ2 )=(Enc(R θ + rR(D2 - A θ )), H(R θ )) for θ = 1, 2, ..., Θ. The first collation unit 245 of the first collation device 240 generates the generated Θ AQ １ , AQ ２ , …, AQ Θ The shuffled and rearranged set S = (AQ s1, AQ s2 ,…,AQ sΘ ) (15) is generated and sent to the second matching device 250 (4). Here, the permutation: (1, 2, ..., Θ) → (s1, s2, ..., sΘ) is random.

[0065] The second collation unit 255 of the second collation device 250 derives AD=rRD by multiplying the last element RD1 by a random number r from the second registered information T=(Enc(R),Enc(Rx1), ..., Enc(Rxn),RD1) stored in the second registered information storage unit 252. 1　　　　　　 (16) is obtained (5).

[0066] The second collation unit 255 of the second collation device 250 receives S (6), and the collation result output unit 256 transmits S and AD to the final collation device 260 (7).

[0067] In the final verification device 260, the verification result acquisition unit 263 receives S and AD (2).

[0068] The final matching unit 264 of the final matching device 260 calculates AQ θ The first component AQ θ, 1 The value Dec(AQ) is decrypted with the private key. θ, 1 ) plus AD, Dec(AQ θ, 1 ) + Hash value of AD (Dec(AQθ, 1 ) + AD) and the value is AQ θ The second component AQ θ, ２ Check if there is a match with H(Dec(AQ θ, 1 ) + AD) = AQ θ, 2　　　　　　　　　　　　 If there is θε{1, 2, ..., Θ} that satisfies (17), it is accepted, and if not, it is not accepted (3). The final matching result output unit 265 outputs the matching result from the final matching unit 264 (4).

[0069] The encryption (encoding) function Enc and the decryption function Dec satisfy the following: c←Enc(m) m←Dec(c) Dec(Enc(m))=m (18)

[0070] The left side of equation (17) is obtained from equations (14), (16), and (18) as follows: H(Dec(AQ θ, 1 ) + AD) = H(Dec(Enc(R θ + rR(D2 - A θ ))+rRD1)) =H(R θ + rR(D2 - A θ )+rRD1) =H(R θ + rR(D2 + D1- A θ )) = H(R θ + rR(D - A θ )) (19)

[0071] The second biometric information for authentication y=(y1, . . . , y n ) and the first biometric information for enrollment x=(x1,...,x n ) and the Euclidean distance D, D=A θ (θ∈{1,2,…,Θ}), then H(R θ + rR(D - A θ ))=H(R θ ) (20) and the following holds: H(Dec(AQ θ, 1 ) + AD)=H(R θ + rR(D - Aθ ))=H(R θ )= AQ θ,2 (twenty one)

[0072] Therefore, the Θ AQ contained in S θ The first element AQ θ,1 The value Dec(AQ θ, 1 ) and AD is added to the hash value, which is the second element AQ. θ,2 AQ is equal to θ If it exists, the matching result (biometric authentication result) is accepted, and if it does not hold, it is rejected.

[0073] Note that the similarity is determined by the number of predetermined values ​​A θ If (θ=1,2,…,Θ) is, for example, A,A+1,…,A+Θ-1, then D=A θ indicates that the Euclidean distance D matches any value within the range [A, A+Θ-1]. θ =(AQ θ1, AQ θ2 ) (θ = 1, 2, ..., Θ) is randomly shuffled to generate S. θ This is because the value of the Euclidean distance D between the first biometric information x and the second biometric information y is concealed by randomly arranging the sequences of the first biometric information x and the second biometric information y. That is, even if the formula (17) is satisfied, the final matching unit 264 of the final matching device 260 checks whether the Euclidean distance D is within the range [A １ ,A Θ ].

[0074] 10 is a diagram for explaining the processing of an example (Example 1) of the second embodiment described with reference to Fig. 6 and Fig. 8. In Example 1, in Fig. 8, the first signature generation device 130 communicates with the second signature generation device 140 and generates at least a random number R θ and combines the enrollment information T=(Enc(R),Enc(Rx1), ..., Enc(Rxn),RD1) based on the first biometric information x, the second biometric information y, and at least a random number R θ The first value AQ is calculated using θ,1 (=Enc(Rθ + rR(D2 -A θ ))) and calculate the random number R θ and a second value AQ calculated using (the hash value of) the message M to be signed. θ,2 (=H(R θ, H'(M)) to obtain the first value AQ θ,1 and the second value AQ θ,２ Signature AQ containing θ = (AQ θ, 1 ,AQ θ, 2 The verification device 150 generates the signature AQ θ The first value AQ contained in θ,1 The value calculated using (Dec(AQ θ, 1 ) + AD=R θ + rR(D -A θ )) (D is the Euclidean distance between the first biometric information x and the second biometric information y) and a third value (=H((R θ + rR(D -A θ )), H'(M))) has signature AQ θ The second value AQ contained in θ,2 (=H(R θ, H'(M)) (D = A θ If , it is a match) and whether or not the above is successful is confirmed. The processing of the first embodiment will be described in detail below with reference to FIGS.

[0075] 8, the key generation unit 111 of the key generation device 110 generates a public key and a private key for Lifted-Elgamal encryption (1). The public key publication unit 112 publishes the public key (2). The private key output unit 113 transmits the private key to the verification device 150 (3).

[0076] The biometric information acquisition unit 121 of the registration device 120 acquires biometric information for registration (first biometric information) x=(x1,...,x n ) and the registration information generation unit 122 generates a random number R (1).

[0077] The registration information generation unit 122 of the registration device 120 calculates D1=Σ i=1 n x i 2(22) Calculate the random number R and R for x=(x1,…,x n ) multiplied by D1, and the n+2 elements of the value multiplied by R are enciphered. T = (Enc(R),Enc(Rx1), ..., Enc(Rx n ), RD1) (23) The second registration information output unit 124 transmits T to the second signature generation device 140 (3).

[0078] The second registration information acquisition unit 141 of the second signature generation device 140 receives the second registration information T and stores it in the second registration information storage unit 142 (1).

[0079] The second signature generation unit 145 of the second signature generation device 140 generates a random number r (2).

[0080] The second signature generation unit 145 of the second signature generation device 140 multiplies each of the n+1 elements (encryptions) of the second registration information T, excluding the element RD1, by r (r: integer) while keeping the encryption, to generate a set C = (Enc(rR),Enc(rRx1), ...,Enc(rRx n )) (24) is generated (3).

[0081] The second signature generation unit 145 of the second signature generation device 140 transmits C to the first signature generation device 130 (4).

[0082] The biometric information acquisition unit 134 of the first signature generation device 130 acquires second biometric information for authentication (second biometric information) y=(y1, . . . , y n ) to obtain (1).

[0083] The message acquisition unit 133 of the first signature generation device 130 acquires the message M (2).

[0084] The first signature generation unit 135 of the first signature generation device 130 calculates a hash value H'(M) of the message M (3).

[0085] The first signature generation unit 135 of the first signature generation device 130 receives C from the second signature generation device 140 (4).

[0086] The first signature generation unit 135 of the first signature generation device 130 generates a random number R for each θ∈{1, 2, ..., Θ} (Θ is a predetermined positive integer) in the same manner as the first verification unit 245 of the first verification device 240 described above. θ Select Enc(R θ + rR(D2 - A θ )) and then calculate R θ and calculate the hash value of H'(M), and AQ θ = (AQ θ, 1 ,AQ θ, 2 ) = (Enc(R θ + rR(D2 - A θ )), H(R θ , H'(M))) (25) is found (5).

[0087] The first signature generation unit 135 of the first signature generation device 130 generates Θ AQ θ Randomly shuffled S(AQ θ Generate a sequence of indices θ (1, 2, ..., Θ) with random permutations.

[0088] The first signature output unit 136 of the first signature generation device 130 transmits S to the second signature generation device 140 (6).

[0089] The second signature generation unit 145 of the second signature generation device 140 multiplies the n-th element RD1 of the second registration information T by a random number r to obtain AD=rRD1 (26) (5).

[0090] The first signature generation unit 135 of the second signature generation device 140 receives S from the first signature generation device 130 (6), and the second signature output unit 146 transmits S and AD to the verification device 150 (7).

[0091] The key acquisition unit 161 of the verification device 150 acquires a private key and stores it in the key storage unit 262 (1). The signature acquisition unit 154 of the verification device 150 acquires the message M (2). The signature acquisition unit 154 of the verification device 150 calculates the hash value H'(M) of the message M acquired in process (2) (3).

[0092] The signature acquisition unit 154 of the verification device 150 acquires Θ signatures AQ θReceive randomly shuffled S and AD (4).

[0093] The signature verification unit 155 of the verification device 150 receives the Θ AQ θ Regarding the first component AQ θ, 1 The decrypted value Dec(AQ θ, 1 ) plus AD Dec(AQ θ, 1 )+ AD+ H'(M) and the hash value H'(M) of the message M calculated by the signature verification unit 155: H(Dec(AQ θ, 1 )+ AD, H'(M)) is calculated, and this value is the AQ θ The second component AQ θ, 2 (=H(R θ , H'(M))) matches AQ θ Check whether there exists a set of (θ∈{1,2,…,Θ}). That is, for θ∈{1,2,…,Θ}, there exists a set of H(Dec(AQ θ, 1 ) + AD, H'(M))= AQ θ2 =H(R θ , H'(M)) (27) is accepted, otherwise it is rejected (5).

[0094] The left side of equation (27) is H(Dec(AQ θ, 1 ) + AD, H'(M)) = H(Dec(Enc(R θ + rR(D2 - A θ ))+rRD1 , H'(M)) =H(R θ + rR(D2 - A θ ))+rRD 1 , H'(M) ) =H(R θ + rR(D2 + D1- A θ ) , H'(M)) =H(R θ + rR(D - A θ ), H'(M)) (28)

[0095] Second biometric information y=(y1,..., y n ) and the first biometric information x=(x1,...,x n) is a number of predetermined similarity values ​​A θ If it matches any of (θ∈{1,2,…,Θ}), then D=A θ From H(R θ + rR(D - A θ ), H'(M))=H(R θ , H'(M)) (29) which is the AQ θ The second component AQ θ,2 =H(R θ ,H'(M)). Therefore, H(Dec(AQ θ, 1 )+ AD, H'(M) )= AQ θ,2 If the result is true, the verification result is accepted; if not, the result is rejected.

[0096] The verification result output unit 156 of the verification device 150 outputs the verification result of the signature verification unit 155 of the verification device 150 (6). If the verification result of the signature verification unit 155 is acceptable, the verification device 150 may transfer the message M to a server (not shown) that provides a service for the message M. Alternatively, if the verification device 150 is included in the server, the server may provide the service for the message M.

[0097] <Example 2> Fig. 11 is a diagram illustrating the processing of another example (Example 2) of the second embodiment described with reference to Figs. 6 and 8. The first signature generation device 130 generates a message authentication code (MAC) for the message to be signed using a random number used to calculate the similarity between the first biometric information and the second biometric information as a key, and includes the generated MAC in the signature. The verification device 150 calculates the message authentication code (MAC) for the message using a random number derived from the value obtained by decrypting the signature as a key, and checks the similarity between the first biometric information and the second biometric information and verifies the message authentication code (MAC) of the message to be signed, which is included in the signature. The first signature generation device 130 and the second signature generation device 140 communicate with each other and exchange the random number R θand registering the first biometric information x based on the enrollment information T = (Enc(R), Enc(Rx1), ..., Enc(Rxn), RD1), the second biometric information y, and the random number R θ The first value AQ is calculated using θ,1 (=Enc(R θ + rR(D2 -A θ ))) and calculate the random number R θ , and calculate a first message authentication code (MAC) of the message M to be signed to obtain a second value AQ θ,2 (=MAC(R θ , M)) a signature AQ including the first value and the second value θ (=AQ θ,1 , AQ θ,2 The verification device 150 generates the signature AQ θ The first value AQ θ,1 The decryption result (Dec(AQ θ,1 ) + AD) θ + rR(D -A θ )) to the key (D -A θ When , the key is R θ ), and calculate a second message authentication code for the message M obtained by the verification device 150, and the second message authentication code is a signature AQ θ The second value AQ θ,2 The first message authentication code (MAC(R θ , M)) and whether it matches. The processing of the key generation device 110, the registration device 120, and the second signature generation device 140 is the same as that in FIG.

[0098] When the first signature generation unit 135 of the first signature generation device 130 receives C from the second signature generation device 140, it generates a random number R for each θ∈{1, 2, ..., Θ} (Θ is a predetermined positive integer). θ Select R θ is used as the key to generate the MAC (R θ ,M) and calculate the set AQ θ = (AQ θ, 1 ,AQ θ, 2 )=((Enc(R θ + rR(D2 - A θ )), MAC(Rθ ,M)) (30) is obtained.

[0099] The first signature generation unit 135 of the first signature generation device 130 generates Θ AQ θ Randomly shuffled S(AQ θ An index θ (=(1, 2, . . . , Θ)) of S is generated by randomly permuting it, and the first signature output unit 136 transmits S to the second signature generation device 140 (5).

[0100] The second signature generation unit 145 of the second signature generation device 140 obtains a value AD by multiplying the n-th element RD1 of the second registration information T by a random number r (5). AD = rRD 1　　　　　 (31)

[0101] The second signature generation unit 145 of the second signature generation device 140 receives S from the first signature generation device 130 (6).

[0102] The second signature output unit 146 transmits S and AD to the verification device 150 .

[0103] The message acquisition unit 153 of the verification device 150 acquires the message M (2).

[0104] The signature acquisition unit 154 of the verification device 150 acquires S and AD (3).

[0105] The signature verification unit 155 of the verification device 150 calculates MAC(Dec(AQ θ, 1 ) + AD,M)= AQ θ,2　　　　　　　　　　　 If there is a set that satisfies (32), it is accepted, and if not, it is rejected (4). The verification result output unit 156 outputs the verification result from the signature verification unit 155 (5).

[0106] That is, MAC(Dec(AQ θ, 1 ) + AD,M)=MAC(Dec(Enc(R θ + rR(D2 - A θ ))+rRD1,M)) =MAC(R θ + rR(D2 - A θ )+rRD1,M) =MAC(Rθ + rR(D - A θ ), M), the second biometric information for authentication y=(y1,..., y n ) and the first biometric information for enrollment x=(x1,...,x n ) is a number of predetermined similarity values ​​A θ If it matches any of (θ∈{1,2,…,Θ}), then D=A θ From MAC(R θ + rR(D - A θ ),M)=MAC(R θ , M) (33) which is AQ θ The second component: AQ θ,2 (MAC(R θ , M).

[0107] In this case, the generator of this message authentication code (MAC) is a random number R θ Knowing that, random number R θ The first biometric information x = (x1, ..., x n ) and the second biometric information y=(y1,...,y n ) and therefore MAC(Dec(AQ θ, 1 ) + AD,M)= AQ θ,2 If the result is true, the verification result is accepted; if not, the result is rejected.

[0108] The verification result output unit 156 of the verification device 150 outputs the verification result of the signature verification unit 155 of the verification device 150 .

[0109] In the above Comparative Example 1 and Examples 1 and 2, the first biometric information (n-dimensional vector) x=(x1,...,x n ) and the second biometric information (n-dimensional vector) y=(y1,..., y nIn the above, an example has been described in which Euclidean distance is used as an index of similarity indicating the closeness of first biometric information x and second biometric information y, but below, an example will be described in which the index of similarity indicating the closeness of first biometric information x and second biometric information y is the inner product of first biometric information (n-dimensional vector) x and second biometric information (n-dimensional vector) y. The inner product <x, y> of the first biometric information x and second biometric information y is given by <x, y> = Σ i=1 n x i ・yi (34).

[0110] <Comparative Example 3> Fig. 12 shows an example of processing in a comparative example when the index of similarity indicating the closeness between registered biometric information (first biometric information) x and authenticated biometric information (second biometric information) y is an inner product. The processing in Fig. 12 is executed by the comparative example system 2A in Fig. 3. In this example, Schnorr signature is used. Here, an overview of Schnorr signature will be provided.

[0111] Let p and q be prime numbers (q is a divisor of (p-1)), and g be a generator of a multiplicative group G of order p.

[0112] Key generation: Define a private key sk = s∈Zq (Zq = {0, 1, ..., q-1}) and a public key pk = g s mod p, where p, q, g, and G are shared between the client and the server.

[0113] Signature: Sign(sk,m) r← Ｒ Z ｐ c ← H(g ｒ , m) y ← r + s・c mod p Signature σ is σ ← (c, y) (35)

[0114] Verify (pk, m, σ): c = H((g s ) -c g y , m) = H(g^(-s・c+ r +s・c), m) = H(g^r, m) (36) is checked, and if it is true, it outputs 1; if it is not true, it outputs 0.

[0115] The biometric information acquisition unit 221 of the registration device 220 acquires biometric information for registration (first biometric information) x=(x1,...,x n ), and the registration information generation unit 222 generates the following random numbers (1). (r1, r2, ..., r n ) ← R Zq R1, R2 ← R Zq (37) ``← R " represents uniform random selection.

[0116] The enrollment information generating unit 222 of the enrollment device 220 generates the following equation based on the random number and the first biometric information x: i + R2r i} i∈｛1,…,n｝ (38) and {g ｒｉ} i∈｛1,…,n｝ (39) is generated (2).

[0117] The registration information generating unit 222 of the registration device 220 generates the first registration information: T1=({R1x i + R2r i}i∈{1,...,n}, {g ｒｉ} i∈｛1,…,n｝ ) (40) (2). The first registration information output unit 223 of the registration device 220 generates the first registration information T １ to the first verification device (3).

[0118] The registration information generation unit 222 of the registration device 220 generates second registration information T2=(g R1 , R2) (41) is generated (4).

[0119] The second registration information output unit 224 of the registration device 220 outputs the second registration information T2=(g R1 , R2) to the second verification device 250 (5).

[0120] The first registration information acquisition unit 241 of the first verification device 240 receives the first registration information T1 and stores it in the first registration information storage unit 242 (1).

[0121] The first collation unit 245 of the first collation device 240 calculates a random number r (r←R Zq: selected uniformly at random from (0, 1, ... q-1) (2), and ｒ is transmitted to the second verification device 250 (3).

[0122] The second registration information acquisition unit 251 of the second verification device 250 receives the second registration information T2 and stores it in the second registration information storage unit 252 (1).

[0123] The second collation unit 255 of the second collation device 250 ｒ (2)

[0124] The second verification unit 255 of the second verification device 250 selects a random number (challenge) C and transmits it to the first verification device 240 (3).

[0125] The first verification unit 245 of the first verification device 240 receives the random number (challenge) C (4).

[0126] The biometric information acquisition unit 244 of the first verification device 240 acquires second biometric information y=(y1,...,y n ) (5).

[0127] The first verification unit 245 of the first verification device 240 generates a signature S (6).

[0128] S = H(C, g r ) (42) σ1=r - S・A (where, A=Σ i=1 n (R1x i + R2r i )・y i ) (43) σ2=Π i=1 , n (g ri ) yi = g Σｒi・yi　 (44) is calculated (6).

[0129] The first verification unit 245 of the first verification device 240 transmits the signature (S, σ1, σ2) to the second verification device 250 (6). Note that A is the inner product of x and y.<x,y> is multiplied by R1, and Σ ｉ＝1 ｎ r ｉ y ｉThis is the value obtained by adding R2 times the value of

[0130] The second verification unit 255 of the second verification device 250 receives the signature (S, σ1, σ2) (5).

[0131] The second matching unit 255 of the second matching device 250 finds v θ = g σ1 (g R1 ) SAθ (σ2) SR2　　　　　 (45) and calculate S=H(C, v θ ) (46) is accepted if there is a pair that satisfies it, otherwise it is rejected (6).

[0132] Here, g in equation (45) σ1 is given by: g σ =g^(r - S・A)=g^{r-SΣ i=1 n (R1x i + R2r i )・y i}

[0133] Also, (g R1 ) SAθ (σ2) SR2 = g^{(R1)SA θ ×g^{SR2(Σ i=1 n r i ・y i )

[0134] ∴ v θ =g^[r-SR1(Σ i=1 n (x i ・y i ))-A θ )]=g^(r-SR1(<x,y> -A θ )) (47)

[0135] In equation (46), the inner product<x,y> is a predetermined value A θ If it matches, S θ =H(C,v θ )=H(C,g r )=S (48).

[0136] The second matching unit 250 calculates S for each θ∈{1,...,Θ}. θ =H(C,v θ ) is calculated. S = S θ If there is no θ that satisfies the above, the transmitted signature (S, σ1, σ2) does not correspond to the challenge C, or the similarity (inner product) between the registered biometric information x and the second biometric information y included in the signature (S, σ1, σ2) is not within the acceptable range, and the signature is rejected. θ If there exists a θ that satisfies the above, then the signature (S, σ1, σ2) corresponds to the challenge C sent, and the similarity (inner product) of the biometric information x and y contained in the signature (S, σ1, σ2) is considered to be within the acceptance range, and the signature is accepted.

[0137] 13 is a diagram for explaining the processing of an example (Example 3) of the first embodiment described with reference to FIGS. 5 and 7. In Example 3, the first signature generation device 130 and the second signature generation device 140 communicate with each other to generate registration information T1 based on the first biometric information x and second biometric information y (y n+1 =H'(M)) r The verification device 150 generates a signature including the hash value H′(M) of the message M acquired by the verification device 150. θ (=H(C, v θ ), where v θ = g σ1 (g R1 )S(Aθ+H'(M))(σ2) SR2 = g^(r-SR1(<x,y> -A θ ))) is a plurality of predetermined values ​​A that are different from each other and belong to a predetermined range. θ For any one of (θ∈{1, 2, ..., Θ}), the value S(=H(C, g r 13 and 7, the process of the third embodiment will be described in detail below.

[0138] The biometric information acquisition unit 121 of the registration device 120 acquires first biometric information (n-dimensional vector) x=(x1,...,x n ), and the registration information generation unit 122 obtains the n+1-th element x of the first biometric information x. n+1 Add x n+1 = 1, and select n+1 random numbers (r1, r2, ..., r n , r n+1 ) and generate R1 and R2 chosen uniformly at random from the integers (1).

[0139] (r1,r2,…,r n ,r n+1 ) ← R Zq, (49) R1, R2 ← R Z (50)

[0140] The registration information generation unit 122 of the registration device 120 generates a random number and the first biometric information (n+1-dimensional vector) x=(x1,...,x n , x n+1 ) based on {R1x i + R2r i}i∈{1,...,n+1} (51) and {g ｒｉ}i∈{1,…,n+1} (52)

[0141] The registration information generating unit 122 of the registration device 120 generates the first registration information T1=({R1x i + R2r i}i∈{1,…,n+1}, {g ｒｉ}i∈{1,...,n+1}) (53) (2). The first registration information output unit 123 of the registration device 120 transmits the first registration information T1 to the first signature generation device 130 (3).

[0142] The registration information generation unit 122 of the registration device 120 calculates T2=(g R1 , R2) as second registration information (4). The second registration information output unit 124 of the registration device 120 transmits the second registration information T2 to the verification device 150 (5).

[0143] The first registration information acquisition unit 131 of the first signature generation device 130 receives the first registration information T1 and stores it in the first registration information storage unit 132 (1).

[0144] The first signature generation unit 135 of the first signature generation device 130 generates a random number r (r← R Zq: selected uniformly at random from (0, 1, ... q-1) (2), and ｒ to the second signature generating device 140 (3).

[0145] The second signature generation unit 145 of the second signature generation device 140 is g ｒ (1), selects a random number (challenge) C (2), and transmits C to the first signature generation device 130 (3).

[0146] The first signature generation unit 135 of the first signature generation device 130 receives C sent from the first signature generation device 130 (4).

[0147] The biometric information acquisition unit 134 of the first signature generation device 130 acquires the second biometric information (n-dimensional vector) y=(y1,...,y n The message acquisition unit 133 of the first signature generation device 130 acquires the message M, calculates its hash value H'(M), adds the (n+1)th element of the second biometric information y, and obtains y n+1 =H'(M) (5).

[0148] The first signature generation unit 135 of the first signature generation device 130 generates the following signature: S = H(C, g r , H'(M)) (54) σ1=rS・A (55) (where A is Σ i=1 n+1 (R1x i + R2r i )・y i and {R1x i + R2r i}i∈{1,…,n+1} is the first component of T1) σ2=Π i=1 , n+1 (g ri ) yi = g^(Σ i=1 n+1 ri ・y i ) (56)

[0149] Note that x=(x1,…,x n ) and y=(y1,…,y n ) is the inner product (similarity) of <x,y>, then A is <x,y>+y n+1 is multiplied by R1, and then multiplied by R2 by Σ i=1 n+1 r ｉ y ｉ is the added value.

[0150] The first signature output unit 136 of the first signature generation device 130 transmits the signature (S, σ1, σ2) to the verification device 150 (7).

[0151] The second signature output unit 146 of the second signature generating device 140 outputs g r and C are transmitted to the verification device 150 (4).

[0152] The second registration information acquisition unit 151 of the verification device 150 receives the second registration information T2=(g R1 , R2) is acquired (received) (1) and stored in the second registration information storage unit 152.

[0153] The signature acquisition unit 154 of the verification device 150 receives the signature from the second signature generation device 140. r and obtain C (2).

[0154] The signature acquisition unit 154 of the verification device 150 acquires the signature (S, σ1, σ2) from the first signature generation device 130 (3).

[0155] The message acquisition unit 153 of the verification device 150 acquires the message M (4).

[0156] The signature verification unit 155 of the verification device 150 verifies v for θ∈{1,...,Θ}. θ = g σ1 (g R1 )S(Aθ+H'(M))(σ2) SR2 (57) and calculate S=H(C, v θ ) (58) is accepted, otherwise it is rejected (5). R1, a power of σ2 SR2 R2 is the second registered information T2=(g R1 , R2).

[0157] Here, g in equation (57) σ1 is given by: g σ1 =g^(r - S・A)=g^{r-SΣ i=1 n+1 (R1x i + R2r i )・y i} =g^{rS(Σ i=1 n R1x i ・y i + R1H'(M) + Σ i=1 n+1 R2r i ・y i )}

[0158] (g in Eq. (57) R1 )S(Aθ+H(M))(σ2) SR2 is (g R1 )S(Aθ+H'(M))(σ2) SR2 =g^{SR1(A θ +H'(M)) ×g^{SR2(Σ i=1 n+1 r i ・y i )

[0159] Therefore, the right side of equation (57) is expressed as follows: v θ =g^[{r-(SR1Σ i=1 n 1x i ・y i + SR1H'(M) + SR2Σ i=1 n+1 r i ・y i )} + {SR1(A θ +H'(M))+{SR2Σ i=1 n+1 r i ・y i ] = g^(r-SR1(<x,y> -A θ )) (59)

[0160] In equation (59), the inner product<x,y> is a predetermined value A θ If it matches (θ∈{1,2, …, Θ}) (<x,y> =A θ ), v θ =g^r (60) and S θ =H(C, v θ )= H(C, g r ) = S (61).

[0161] That is, the first biometric information (vector) x=(x1,...,x n ) and the second biometric information (vector) y = (y1, ..., y n ) dot product<x,y> are predetermined values ​​A θ If it matches any of the above, θ =H(C, v θ )=H(C, g r ) = S.

[0162] The signature verification unit 155 of the verification device 150 calculates S for each θ∈{1,...,Θ}. θ =H(C, v θ ) is calculated. S=H(C, g r )=S θ If there is no θ that satisfies the above, the transmitted signature (S, σ1, σ2) does not correspond to the challenge C, or the inner product of the similarity between the first biometric information x and the second biometric information y included in the signature is not within the acceptable range, and the verification result is rejected. S = H(C, g r ) = S θ If there exists a θ that satisfies the above, the signature (S, σ1, σ2) corresponds to the transmitted challenge C, and the inner product, which is the similarity between the first biometric information x and the second biometric information y included in the signature (S, σ1, σ2), is deemed to be within the acceptable range, and the verification result is deemed to be accepted. The verification result output unit 156 of the verification device 150 outputs the verification result from the signature verification unit 155 (6).

[0163] <Example 4> Fig. 14 is a diagram for explaining an example of processing in another example (Example 4) of the first embodiment described with reference to Figs. 5 and 7. The processing in Fig. 14 is executed in the system of the embodiment in Fig. 7. In Example 4, the first signature generation device 130 and the second signature generation device 140 communicate with each other to exchange registration information T1 based on the first biometric information x, and a value S(=H(C, g)) calculated using the second biometric information y and a hash value H'(M) of the message M to be signed. r , H'(M)) is generated. The verification device 150 generates a value S obtained by combining the inner product of the first biometric information x (vector) and the second biometric information y (vector) and the hash value H'(M) of the message M. θ (=H(C, v θ , H'(M)), where v θ = g σ1 (g R1 ) SAθ (σ2) SR2 = g^(r-SR1(<x,y> -A θ )) is a plurality of predetermined values ​​A that are different from each other and belong to a predetermined range. θ For any of (θ∈{1, 2, …, Θ}), the value S(=H(C, g r , H'(M)) is confirmed. The processing of the fourth embodiment will be described in detail below with reference to FIGS.

[0164] The biometric information acquisition unit 121 of the registration device 120 acquires first biometric information (n-dimensional vector) x=(x1,...,x n ), and the registration information generation unit 122 obtains random numbers (r1, r2, ..., r n ), R1, R2 are generated (1). (r1,r2,…,r n ) ← R Zq, (62) R1, R2 ← R Z (63)

[0165] The registration information generation unit 122 of the registration device 120 generates the following equation based on the random number and the biometric information x=(x1, . . . , xn): i + R2r i}i∈{1,…,n} (64) and {gｒｉ}i∈{1,...,n} (65) (2).

[0166] The first registration information output unit 123 of the registration device 120 transmits the first registration information T1 to the first signature generation device 130 (3).

[0167] The registration information generation unit 122 of the registration device 120 generates second registration information T2=(g R1 , R2) (66) (4). The second registration information output unit 124 of the registration device 120 transmits the second registration information T2 to the verification device 150.

[0168] The first registration information acquisition unit 131 of the first signature generation device 130 receives the first registration information T1 and stores it in the first registration information storage unit 132 (1).

[0169] The first signature generation unit 135 of the first signature generation device 130 generates a random number r (2) and ｒ to the second signature generating device 140 (3).

[0170] The second signature generation unit 145 of the second signature generation device 140 generates g ｒ (1), selects a random number (challenge) C (2), and transmits C to the first signature generation device 130 (3).

[0171] The first signature generation unit 135 of the first signature generation device 130 receives C sent from the first signature generation device 130 (4).

[0172] The biometric information acquisition unit 134 of the first signature generation device 130 acquires the second biometric information y=(y1, . . . , y n ) to get the

[0173] The message acquisition unit 133 of the first signature generation device 130 acquires the message M and calculates its hash value H'(M) (5).

[0174] The first signature generation unit 135 of the first signature generation device 130 generates a first signature S=H(C, g r , H'(M)) (67) σ1=rS・A (68) (where A is Σi=1 n (R1x i + R2r i )・y i and {R1x i + R2r i}i∈{1,…,n+1} is the first component of T1) σ2=Π i=1 n (g ri ) yi = g^(Σ i=1 n r i ・y i ) (69) is calculated (6).

[0175] The first biometric information x=(x1,...,x n ) and the second biometric information y=(y1,...,y n ) and the dot product<x,y> Then, A is,<x,y> is multiplied by R1, and then multiplied by R2 by Σ i=1 n r ｉ y ｉ is the added value.

[0176] The first signature output unit 136 of the first signature generation device 130 transmits the signature (S, σ1, σ2) to the verification device 150 (7).

[0177] The second signature generating device 140 generates a signature g r and C are transmitted to the verification device 150 (4).

[0178] The second registration information acquisition unit 151 of the verification device 150 receives the second registration information T2=(g R1 , R2) is acquired (received) (1) and stored in the second registration information storage unit 152.

[0179] The signature acquisition unit 154 of the verification device 150 receives the signature from the second signature generation device 140. r and obtain C (2).

[0180] The signature acquisition unit 154 of the verification device 150 acquires (receives) the signature (S, σ1, σ2) from the first signature generation device 130 (3).

[0181] The message acquisition unit 153 of the verification device 150 acquires the message M (4).

[0182] The signature verification unit 155 of the verification device 150 verifies v for θ∈{1,...,Θ}. θ = g σ1 (g R1 ) SAθ (σ2) SR2 (70) and calculate S θ =H(C, v θ , H'(M))=S (71) is accepted, otherwise it is rejected (5). R1 , a power of σ2 SR2 R2 is the g of the second registration information T2 stored in the second registration information storage unit 152. R1 , and R2.

[0183] Here, g in equation (70) σ1 is given by: g σ１ =g^(r - S・A)=g^{r-SΣ i=1 n (R1x i + R2r i )・y i} =g^{rS(Σ i=1 n R1x i ・y i + Σ i=1 n R2r i ・y i )} Also, (g R1 ) SAθ (σ2) SR2 =g^(SR1A θ )×g^{SR2(Σ i=1 n r i ・y i )

[0184] Therefore, v θ = g^[{r - (SR1Σ i=1 n 1x i ・y i + SR2Σ i=1 n r i ・y i)} + SR1A θ + SR2Σ i=1 n r i ・y i ] = g^(r - SR1(<x,y> -A θ )) (72)

[0185] In equation (72), the inner product<x,y> is a predetermined value A θ If it matches (<x,y> =A θ ), S θ =H(C, v θ , H'(M))=H(C, g r , H'(M))=S (73).

[0186] First biometric information (vector) x=(x1,...,x n ) and the second biometric information (vector) y = (y1, ..., y n ) dot product<x,y> is a predetermined value A θ If it matches, S θ =H(C, v θ , H'(M)) = H(C,g r , H'(M)=S. The signature verification unit 155 of the verification device 150 derives S for each θ∈{1,...,Θ}. θ =H(C,v θ ) is calculated. S = S θ If there is no θ that satisfies the above, the transmitted signature (S, σ1, σ2) does not correspond to the challenge C, or the similarity (inner product) of the biometric information x and y contained in the signature is not within the acceptable range, and the verification result is rejected. S = S θ If there exists a θ that satisfies the above, then the signature (S, σ1, σ2) corresponds to the transmitted challenge C, and the similarity (inner product) of the biometric information x and y included in the signature (S, σ1, σ2) is deemed to be within the acceptable range, and the verification result is deemed to be accepted. The verification result output unit 156 of the verification device 150 outputs the verification result from the signature verification unit 155.

[0187] As another example of the first embodiment, an example will be described in which Somewhat homomorphic encryption, which allows an arbitrary number of additions and a fixed number of multiplications while keeping the data encrypted, is used (see Patent Document 1, etc.). Below, an example of Somewhat homomorphic encryption using a scheme in which the plaintext is a polynomial will be described. In encryption key generation, three key generation parameters (N, q, t) are mainly used. N is an integer of a power of 2, q is a prime number, q = 1 mod 2N, and q, N, and the cyclotomic polynomial f(x) = x N +1 defines the ring Rq:=Zq[x] / (f(x)), the set of all remainder polynomials obtained by dividing a univariate integer polynomial Zq[x] with coefficients on Zq={0,1,...,q-1} by f(x). A prime number t, t<q, defines the message space of the homomorphic encryption scheme as the integer polynomial Rt = Zt[x] / (f(x)) modulo f(x) and t.

[0188] The procedure for generating a cryptographic key begins with randomly generating an N-1 degree polynomial sk, whose coefficients are very small, as a secret key. The magnitude of each coefficient is determined by a parameter σ (error parameter: Gaussian distribution (error distribution) χ=D ZＮ,σ Next, an N-1 degree polynomial a1, each coefficient of which is smaller than q, and an N-1 degree polynomial e, each coefficient of which is very small, are randomly generated. Then, the following polynomial a0 is calculated, and the set of polynomials (a0, a1) is defined as the public key pk: a0 = - (a1*s k + t*e) (74)

[0189] However, in the calculation of polynomial a0, for irreducible polynomials of degree N or higher, f(x)=x N The remainder polynomial obtained by dividing by +1 is calculated. Furthermore, the coefficient of each term included in the polynomial is Zq, that is, the remainder when the coefficient is divided by the prime number q. The space in which such polynomial operations are performed is the above-mentioned Rq:=Zq[x] / (x N +1).

[0190] The message space is R tThe message is encrypted into an N-th degree polynomial with coefficients of Zt. For plaintext data m and public key pk, which are expressed as N-1-th degree polynomials with each coefficient smaller than t, three N-1-th degree polynomials u, f, and g with very small coefficients are randomly generated (u←χ, f, g←χ). The encrypted data Enc(m,pk) of plaintext data m is defined by the following equation: Enc(m,pk)=(c0,c1) (75) c0=a0*u+t*g+m (76) c1=a1*u+t*f (77)

[0191] Polynomial operations on the space Rq are used to calculate the polynomials c0 and c1. In this case, the cryptographic addition of the encrypted data Enc(m1,pk)=(c0,c1) and the encrypted data Enc(m2,pk)=(d0,d1) is calculated by the following formula: Enc(m1,pk)+Enc(m2,pk)=(c0+d0,c1+d1) (78)

[0192] Further, the cryptographic multiplication of the encrypted data Enc(m1, pk) and the encrypted data Enc(m2, pk) is calculated by the following formula: Enc(m1, pk)*Enc(m2, pk)=(c0*d0, c0*d1+c1*d0, c1*d1) (79)

[0193] When the cryptographic multiplication of equation (79) is performed, the encrypted data changes from a two-dimensional vector to a three-dimensional vector. When the cryptographic multiplication is repeated multiple times, the number of elements of the encrypted data in the multiplication result further increases.

[0194] Next, the decryption process will be described. For encrypted data c=(c0, c1, c2, ...) whose elements have been increased by multiple cryptographic multiplications and other operations, the encrypted data c is decrypted by calculating the decryption result Dec(c, sk) using the secret key sk. Dec(c, sk) = [c0 + c1*sk + c2*sk 2 + …]q mod t (80)

[0195] In equation (80), [f(x)]q mod t represents a polynomial obtained by replacing each coefficient zi of the polynomial f(x) with [zi]q mod t. The value of [z]q for an integer z is defined by the following equation using the remainder w when z is divided by q.

[0196] [z]q=w (w

[0197] Therefore, the range of [z]q is [-q / 2,q / 2). a mod t represents the remainder when the integer a is divided by t.

[0198] Comparative Example 4 First, an example of processing in the system (comparative example) of FIG. 4 will be described with reference to FIG. 15. First biometric information (vector) for registration is expressed as x=(x1,...,x n ) (83) The second biometric information (vector) for authentication is y = (y1, ..., y n ) (84).

[0199] Convert two vectors into polynomials using ascending and descending transformations.

[0200] [Ascending transformation] pm1(x)=Σ i=1 n x i X i-1 = x1 + x2X + ... + x n X n-1 (85)

[0201] [Descending transformation] pm2(y)=-Σ =1 n y i X N-i+1 = -y1X N -…-y n-1 X N-n+2 -y n X N-n+1　　　　　 (86)

[0202] When the polynomial pm1(x) and the polynomial pm2(y) are encrypted, the encrypted polynomial Enc(pm1(x)) and the encrypted polynomial Enc(pm2(y)) are generated.

[0203] ​Enc(pm1(A))=Enc(pm1(A),pk) (87) Enc(pm2(B))=Enc(pm2(B),pk) (88)

[0204] When the encrypted polynomials Enc(pm1(x)) and Enc(pm2(y)) are multiplied, the multiplication pm1(x)*pm2(y) is performed while the encryption is still in effect. When the multiplication result Enc(pm1(x))*E(pm2(y)) is decrypted using the private key sk, the constant term included in the decrypted polynomial becomes the value shown in the following equation: Dec(pm1(x)*pm2(y), sk)=x １ y １ +...+x n1 y n1 =Σ i=１ n x i y i　　　　　　 (89)

[0205] The above equation (89) represents the dot product of vector x and vector y.

[0206] The key generation unit 211 of the key generation device 210 generates a public key and a private key for ring homomorphic encryption, the public key publication unit 212 publishes the public key, and the private key output unit 213 transmits the private key to the final verification device 260 .

[0207] The biometric information acquisition unit 221 of the registration device 220 acquires the first biometric information x=(x １ ,…,x n ) (1).

[0208] The registration information generating unit 222 of the registration device 220 generates the first biometric information x=(x1,...,x n ) to calculate the first transformation polynomial pm1(x)=Σ i=1 n x i X i-1　　　　　　　 (90)

[0209] The registration information generating unit 222 of the registration device 220 encrypts the first transformation polynomial pm1(x) using a public key. T=Enc(Σ i=1 n x i X i-1 ) (91)

[0210] The second registration information output unit 224 of the registration device 220 transmits the encrypted first transformation polynomial T to the second verification device 250 (3).

[0211] The second registration information acquisition unit 251 of the second verification device 250 receives the encrypted first transformation polynomial T and stores it in the second registration information storage unit 252 (1).

[0212] The second verification unit 255 of the second verification device 250 selects random numbers r and k, and calculates C=Enc(rX k ) and transmits it to the first verification device 240 (2).

[0213] In the first verification device 240, the biometric information acquisition unit 244 acquires the second biometric information (y1, . . . , y n ) (1).

[0214] The first verification unit 245 of the first verification device 240 verifies the second biometric information (y1, . . . , y n ) the second transformation polynomial pm2(y)=-Σ i=1 n y i X N-i+1 Calculate (92).

[0215] The first matching unit 245 of the first matching device 240 performs a matching operation to obtain Enc(rX k ) to obtain the following S (3): S = Enc(rX k )×(-Σ i=1 n y i X N-i+1 ))=Enc(-rX k Σ i=1 n y i X N-i+1 )(93)

[0216] The first collation unit 245 of the first collation device 240 calculates S=Enc(-rX k Σ i=1 n y i X N-i+1 ) is sent to the second verification device 250 (4).

[0217] The second verification unit 255 of the second verification device 250 receives S (3) and converts the encrypted first conversion polynomial T=Enc(Σ i=1 n x i X i-1 ) to S = Enc(-rX k Σ i=1 n y i X N-i+1 ) and multiply it by Enc((Σ i=1 n x i X i-1 ))・(-Enc(rX k Σ i=1 n y i X N-i+1 ))=Enc((Σ i=1 n x i X i-1 )・(-rX k Σ i=1 n y i X N-i+1 )) (94)

[0218] Furthermore, from equation (94), rX k That is, the monomial rX k The reciprocal of r -1 X -k By multiplying equation (94) by S' = Enc((Σ i=1 n x i X i-1 )(-Σ i=1 n y i X N-i+1 )) (95) is found (4).

[0219] The collation result output unit 256 of the second collation device 250 transmits S' to the final collation device 260 (5).

[0220] The collation result acquisition unit 263 of the final collation device 260 calculates S′=Enc((Σ i=1 n xi X i )(-Σ i=1 n y i X N-i+1 )) is acquired (received) (2).

[0221] The final verification unit 264 of the final verification device 260 decrypts S' using the private key. Dec(sk, S') (96)

[0222] The constant term of Dec(sk, S') is the inner product of the first biometric information x and the second biometric information y, Σ i=1 n x i y i　　 (97)

[0223] That is, the first biometric information for registration x=(x1,...,x n ) and second biometric information y = (y1, ..., y n ) dot product<x,y> The inner product, which is the constant term of Dec(sk, S'), is<x,y> are predetermined Θ values ​​A θ If it matches any of (θε{1, 2, ..., Θ}), it is accepted, and if it does not match, it is rejected (3). The final matching result output unit 265 of the final matching device 260 outputs the matching result (4).

[0224] Example 5 An example of yet another embodiment of the second embodiment will be described as Example 5. The first signature generation device 130 and the second signature generation device 140 in Fig. 8 calculate an encrypted value (a constant value of a polynomial) that combines the similarity between the first biometric information and the second biometric information and the message while the first biometric information remains encrypted, and the verification device 150 decrypts the encrypted value with a private key to confirm that the similarity between the first biometric information and the second biometric information is one of predetermined values ​​and that the message is correct. In Example 5, the first signature generation device 130 and the second signature generation device 140 communicate with each other and generate a signature S' by multiplying, while still encrypted, registration information obtained by encrypting a first polynomial obtained by transforming the first biometric information x using one of ascending and descending transformations, and a second polynomial obtained by transforming, using the other of ascending and descending transformations, second biometric information y to which a hash value H(M) of the message to be signed has been added. In the verification device 150, the constant term obtained by decrypting the acquired signature S' (Dec(sk, S')) is determined to be a number of predetermined values ​​A that are different from each other and belong to a predetermined range. θ and the hash value H(M) of the message to be signed. θ +H(M). The process of FIG. 16 is executed by the system of the second embodiment of FIG.

[0225] The key generation unit 111 of the key generation device 110 generates a public key and a private key for ring homomorphic encryption, the public key publication unit 112 publishes the public key, and the private key output unit 113 transmits the private key to the verification device 150 .

[0226] The biometric information acquisition unit 121 of the registration device 120 acquires first biometric information x=(x1, . . . , xn) (1). n+1 =1.

[0227] The registration information generating unit 122 of the registration device 120 generates the first biometric information x=(x1,...,x n , x n+1 ) to calculate the first transformation polynomial pm1(x)=Σ i=1 n+1 x i X i-1　　　　　 (98)

[0228] The registration information generation unit 122 of the registration device 120 encrypts the first transformation polynomial pm1(x) using a public key. T=Enc(Σ i=1 n+1 x i X i ) (99)

[0229] The second registration information output unit 124 of the registration device 120 transmits the encrypted first transformation polynomial T to the second signature generation device 140 (3).

[0230] The second registration information acquisition unit 141 of the second signature generation device 140 receives the encrypted first transformation polynomial T and stores it in the second registration information storage unit 142 (1).

[0231] The second signature generation unit 145 of the second signature generation device 140 selects random numbers r and k, and calculates C=Enc(rX k ) and transmits it to the first signature generation device 130 (3).

[0232] The biometric information acquisition unit 134 of the first signature generation device 130 acquires the second biometric information (y1, . . . , y n ) (1).

[0233] The message acquisition unit 133 of the first signature generation device 130 acquires the message M (2).

[0234] The first signature generation unit 135 of the first signature generation device 130 obtains C (3).

[0235] The first signature generation unit 135 of the first signature generation device 130 calculates a hash value H(M) of the message and obtains y n+1 =H(M) (4).

[0236] The first signature generation unit 135 of the first signature generation device 130 generates the second biometric information y=(y1, . . . , y n ,y n+1 ) the second transformation polynomial pm2(y)=-Σ i=1 n+1 y i X N-i+1　　 Calculate (100).

[0237] The first signature generation unit 135 of the first signature generation device 130 encrypts the second transformation polynomial pm2(y) using the public key. i=1 n+1 y i X N-i+1 ) (101)

[0238] The first signature generation unit 135 of the first signature generation device 130 generates rX for the encrypted second transformation polynomial Enc(pm2(y)). k By multiplication homomorphism, the following holds:

[0239] S = Enc(rX k )×Enc(-Σ i=1 n+1 y i X N-i+1 )=Enc{-rX k (Σ i=1 n+1 y i X N-i+1 )} (102)

[0240] The first signature generation unit 135 of the first signature generation device 130 calculates S=Enc{-rX k (Σ i=1 n+1 y i X N-i+1 )} to the second signature generation device 140.

[0241] The second signature generation unit 145 of the second signature generation device 140 receives the encrypted first transformation polynomial T=Enc(Σ i=1 n+1 x i X i ) to S = Enc{-rX k (Σ i=1 n+1 y i X N-i+1 )}, the following equation is obtained: Enc((Σ i=1 n+1 x i X i-1 ))・(Enc(-rX k Σ i=1 n+1 y i X N-i+1))=Enc((Σ i=1 n+1 x i X i-1 )・(-rX k Σ i=1 n+1 y i X N-i+1 )) (103)

[0242] Furthermore, from equation (92), rX k That is, the second signature generation unit 145 of the second signature generation device 140 removes the monomial rX k The reciprocal of r -1 X -k By multiplying equation (83) by S' = Enc((Σ i=1 n+1 x i X i-1 )・(-Σ i=1 n+1 y i X N-i+1 )) (104) is found (4).

[0243] The second signature output unit 146 of the second signature generation device 140 transmits S′ to the verification device 150 .

[0244] The signature verification unit 155 of the verification device 150 obtains the message M (2) and calculates S'=Enc((Σ i=1 n+1 x i X i )・(Σ i=1 n+1 y i X n+1-i )) is obtained (3).

[0245] The signature verification unit 155 of the verification device 150 decrypts S' using the private key. Dec(sk, S') (105)

[0246] The constant term of Dec(sk, S') is Σ i=1 n+1 x i y i =Σ i=1 n x i y i + x n+1 yn+1 =<x,y> + H(M) (106)

[0247] <x,y> is the inner product of the first biometric information x=(x1, . . . , xn) and the second biometric information y=(y1, . . . , yn).

[0248] inner product<x,y> is a predetermined value A θ If it matches, the constant term of Dec(sk, S') is Σ i=1 n+1 x i y i =<x,y> + H(M) is A θ + H(M) (107).

[0249] Therefore, for the hash value H(M) of message M, the constant term in Dec(sk, S') is A θ + H(M) (108) is a predetermined value A for the similarity θ If (θ∈{1,2, …, Θ}) exists, it is accepted; if it does not exist, it is not accepted.

[0250] Example 6 A sixth example of the second embodiment will be described. The processing of FIG. 17 is executed in the system of the embodiment of FIG. 6. The first signature generation device 130 and the second signature generation device 140 communicate with each other, select a random number K, and generate a signature S' including registration information obtained by encrypting a first polynomial obtained by transforming first biometric information x in one of ascending order and descending order, and a second polynomial obtained by transforming second biometric information y to which the random number K has been added in the other of ascending order and descending order, and calculate a first message authentication code (MAC(K,M)) for the message M to be signed using the random number K as a key, and transmit the first message authentication code to the verification device 150 together with the signature S'. The verification device 150 decrypts (Dec(sk,S')) the signature S' to obtain a constant term, and then decrypts a plurality of predetermined, mutually different values ​​A that fall within a predetermined range. θUsing a value obtained by subtracting one of (θ∈{1, 2, ..., Θ}) as a key, a second message authentication code (MAC) is calculated for the message M acquired by verification device 150, and it is confirmed that the first message authentication code matches the second message authentication code. Processes 1-3 in key generation device 110, registration device 120, and first signature generation device 130, and processes 1 and 2 in second signature generation device 140 are the same as those in FIG. 16, so their explanation will be omitted.

[0251] The first signature generation unit 135 of the first signature generation device 130 selects a random number K and generates the n+1-th element y n+1 Add y n+1 =K (109) (4).

[0252] The first signature generation unit 135 of the first signature generation device 130 calculates the MAC of the message M using the random number K (5): t=MAC(K,M) (110)

[0253] The first signature generation unit 135 of the first signature generation device 130 generates the second biometric information (n+1-dimensional vector) y=(y1,...,y n ,y n+1 ) the second transformation polynomial pm2(y)=-Σ i=1 n+1 y i X N-i+1 Calculate (111).

[0254] The first signature generation unit 135 of the first signature generation device 130 generates Enc(rX k ) by multiplication homomorphism. k (Σ i=1 n+1 y i X N-i+1 )} (112)

[0255] The first signature generation unit 135 of the first signature generation device 130 calculates S=Enc{-rX k (Σ i=1 n+1 y i XN-i+1 )} and the tag t=MAC(K,M) (113) are sent to the second signature generating device 140 (7).

[0256] The second signature generation unit 145 of the second signature generation device 140 receives S and t (3) and converts the encrypted first conversion polynomial T=Enc(Σ i=1 n+1 x i X i ) to S=Enc{rX k (Σ i=1 n+1 y i X n+1-i )}, the following equation is obtained: Enc((Σ i=1 n+1 x i X i-1 ))・(Enc(-rX k Σ i=1 n+1 y i X N-i+1 ))=Enc((Σ i=1 n+1 x i X i-1 )・(-rX k Σ i=1 n+1 y i X N-i+1 )) (114)

[0257] Furthermore, from equation (102), rX k That is, the second signature generation unit 145 of the second signature generation device 140 removes the monomial rX k The reciprocal of r -1 X -k By multiplying equation (83) by S' = Enc((Σ i=1 n+1 x i X i-1 )・(-Σ i=1 n+1 y i X N-i+1 )) (115) is found (4).

[0258] The second signature output unit 146 of the second signature generation device 140 transmits S′ and t to the verification device 150 .

[0259] The signature acquisition unit 154 of the verification device 150 obtains S′=Enc((Σ i=1 n+1 x i X i )・(-Σ i=1 n+1 y i X N-i+1 )) to get the

[0260] The signature verification unit 155 of the verification device 150 decrypts S' using the private key. Dec(sk, S')

[0261] The constant term of Dec(sk, S') is Σ i=1 n+1 x i y i =Σ i=1 n x i y i + x n+1 y n+1 =<x,y> + K (116)

[0262] <x,y> is the inner product of the first biometric information (n-dimensional vector) x = (x1, ..., xn) and the second biometric information (n-dimensional vector) y = (y1, ..., yn).<x,y> is a predetermined value A θ If it matches (θ∈{1,2,…,Θ}) (<x,y> = A θ ), the constant term of Dec(sk, S') Σ i=1 n+1 x i y i is A θ + K (117).

[0263] Therefore, the signature verification unit 155 of the verification device 150 θ = (Constant term of Dec(sk, S')) - A θ (118) is sought, K θ Using MAC(K θ ,M) and calculate this MAC(K θ, M) is a predetermined value A for the similarity that matches t=MAC(K, M) sent together with S′ from the second signature generating device 140. θ If θ∈{1,2, …, Θ} exists, it is accepted; if it does not exist, it is not accepted.

[0264] FIG. 18 is a schematic diagram illustrating an example in which the above-described devices 110, 120, 130, 140, and 150 are implemented by computers equipped with communication functions and connected to each other via a network. Each device includes a processor 501, a storage device 502, an input / output device 503, and a communication interface 504. The storage device 502 may include semiconductor storage such as RAM (Random Access Memory), ROM (Read Only Memory), or EEPROM (Electrically Erasable and Programmable ROM), a hard disk drive (HDD), a compact disc (CD), or a digital versatile disc (DVD). The processor 501 executes a program (not shown) stored in the storage device 502 to realize the processing and functions of the devices 110, 120, 130, 140, and 150. The input / output device 503 may include a keyboard and a display. For example, the verification result (acceptance / rejection) of the verification device 150 may be displayed on an output device such as a display. Furthermore, in the registration device 120 and the first signature generation device 130 that acquire biometric information, the input / output device 503 may be configured to include a sensor for acquiring biometric information. In this case, the sensor may be an image sensor (camera) if the biometric information is a face, iris, or the like; a fingerprint sensor if the biometric information is a fingerprint; a light-emitting diode (LED) that emits near-infrared light and a near-infrared camera that captures the light transmitted through the finger if the biometric information is a finger vein; or a digital recording device if voice authentication (voiceprint authentication) is performed. The sensor may be a removable sensor, such as a universal serial bus (USB) device. The communication interface 504 may include a network interface card, a transceiver, or the like, and may be configured to communicate with each other via a local area network (LAN), a wide area network (WAN) such as the Internet, a wireless LAN, a mobile communication network, or the like.In addition, the communication interface 504 may be configured to be connected to an external sensor (such as a Bluetooth (registered trademark) connected sensor) in the registration device 120 or the first signature generation device 130 and to have an interface for receiving biometric information acquired by the external sensor.

[0265] FIG. 19 is a diagram illustrating an example in which each of the devices 110, 120, 130, 140, and 150 in the above-described system is implemented as a virtual machine using server virtualization technology. Multiple virtual machines VM603 run on a virtualization platform 602, such as a hypervisor, implemented on a server physical machine 601. One or more of the devices 110, 120, 130, 140, and 150 may be implemented as virtual machines VM. Although there is a single physical server, a virtual server environment in which multiple servers run is provided. Each virtual machine VM is preferably configured to operate in an isolated environment in memory space. In this case, a program that realizes the processing of one of the devices 110, 120, 130, 140, and 150 runs on the virtual machine's virtual operating system (OS). A virtual machine VM that virtually realizes any of the devices 110, 120, 130, 140, and 150 may be configured to communicate with other virtual machines via a virtual network, or may be configured to communicate with other devices among the devices 110, 120, 130, 140, and 150 via a physical interface (communication interface) of the physical machine 601 via a LAN, a WAN such as the Internet, or the like.

[0266] The above-described embodiments and examples are supplemented as follows (however, not limited to the following):

[0267] <Supplementary Note 1> A signature generation system comprises a first signature generation device and a second signature generation device, each of which has at least a processor and a communication interface and is communicatively connected to each other, wherein either the first signature generation device or the second signature generation device executes a process of acquiring and storing registration information generated from first biometric information, wherein the first signature generation device executes a process of acquiring second biometric information and a message to be signed, and wherein the first signature generation device and the second signature generation device communicate with each other and execute a process of generating a signature including at least the message to be signed and the second biometric information and information regarding the similarity between the first biometric information and the second biometric information and the message to be signed, based on the message to be signed and the second biometric information and the registration information.

[0268] <Supplementary Note 2> The signature generation system of Supplementary Note 1 comprises: a registration device having at least a processor and a communication interface; and a verification device having at least a processor and a communication interface and verifying the signature, wherein the registration device acquires the first biometric information and generates the registration information and second registration information, transmits the registration information to the first signature generation device, and transmits the second registration information to the verification device, the first signature generation device acquires and stores the registration information, and the verification device acquires the second registration information, the signature, and a message, and verifies whether the similarity included in the signature is within a predetermined range and whether the acquired message is identical to the message to be signed.

[0269] <Supplementary Note 3> The signature generation system of Supplementary Note 1 comprises: a registration device, which has at least a processor and a communication interface, and acquires the first biometric information, generates the registration information, and transmits it to the second signature generation device; and a verification device, which has at least a processor and a communication interface, acquires the signature and a message, and verifies the signature, wherein the second signature generation device acquires and stores the registration information, and the verification device verifies whether the similarity included in the signature is within a predetermined range, and whether the acquired message is identical to the message to be signed.

[0270] <Supplementary Note 4> In the signature generation system of Supplementary Note 3, the first signature generation device and the second signature generation device communicate with each other, select a random number, calculate a first value using the registration information, the second biometric information, and the random number, calculate a second value calculated using the random number and the message to be signed, generate the signature including the first value and the second value, and the verification device confirms whether a value calculated using the first value included in the signature and a third value calculated using the message acquired by the verification device match the second value included in the signature.

[0271] <Supplementary Note 5> In the signature generation system of Supplementary Note 4, the second value included in the signature includes a value calculated using a hash value of the message to be signed and the random number, or a first message authentication code (MAC) calculated for the message to be signed using the random number as a key, and the third value calculated by the verification device includes a value calculated for the hash value of the message obtained by the verification device using a value derived from the first value included in the signature as a key, or a second message authentication code (MAC) calculated for the message obtained by the verification device using a value derived from the first value included in the signature as a key.

[0272] <Supplementary Note 6> In the signature generation system of Supplementary Note 2, the first signature generation device and the second signature generation device communicate with each other to generate the signature including a value calculated using the registration information and the second biometric information to which a hash value of the message to be signed has been added, and the verification device verifies that a value obtained by combining the similarity and the hash value of the message matches the value included in the signature for any of a plurality of predetermined values ​​that are different from each other and belong to a predetermined range.

[0273] <Supplementary Note 7> In the signature generation system of Supplementary Note 2, the first signature generation device and the second signature generation device communicate with each other to generate a signature including a value calculated using the registration information, the second biometric information, and a hash value of the message to be signed, and the verification device verifies that a value obtained by combining the inner product of the first biometric information and the second biometric information and the message hash value matches the value included in the signature for any of a plurality of predetermined, mutually different values ​​that belong to a predetermined range.

[0274] <Supplementary Note 8> In the signature generation system of Supplementary Note 3, the first signature generation device and the second signature generation device communicate with each other, and generate the signature by multiplying the registration information, which is obtained by encrypting a first polynomial obtained by converting the first biometric information in one of ascending order and descending order, with the second biometric information, to which a hash value of the message to be signed is added, in the encrypted form, by a second polynomial obtained by converting the second biometric information in the other of ascending order and descending order, to which a hash value of the message to be signed is added, while the encrypting the second polynomial; and the verification device verifies that a constant term obtained by decrypting the signature matches one of a plurality of mutually different predetermined values ​​belonging to a predetermined range and the sum of the hash value of the message to be signed.

[0275] <Supplementary Note 9> In the signature generation system of Supplementary Note 3, the first signature generation device and the second signature generation device communicate with each other, select a random number, and generate the signature including the registration information obtained by encrypting a first polynomial obtained by transforming the first biometric information in one of ascending order and descending order, and a second polynomial obtained by transforming the second biometric information, to which a random number has been added, in the other of ascending order and descending order, encrypted; calculate a first message authentication code (MAC) for the message to be signed using the random number as a key, and transmit the MAC together with the signature to the verification device; and the verification device calculates a second message authentication code for the message obtained by the verification device using as a key a value obtained by subtracting one of a plurality of predetermined values ​​that are different from each other and belong to a predetermined range from a constant term obtained by decrypting the signature; and confirm that the first message authentication code and the second message authentication code match.

[0276] <Supplementary Note 10> In the signature generation system of Supplementary Note 3, the registration device acquires a random number R, encrypts the random number R with a public key, and multiplies each element xi (i=1,...n) of the first biometric information of an n-dimensional vector x=(x1,...,xn) by the random number R, encrypts the value Rxi with the public key, and further calculates a sum of squares of xi D1=Σ i=1 n xi 2 and R, and transmits to the second signature generation device the registration information T = (Enc(R),Enc(Rx1), ..., Enc(Rxn),RD1), which is a set of n+2 elements, including the value Rxi obtained by multiplying R and D1 with the public key, the encrypted values ​​of each element of x = (x1, ..., xn) multiplied by R, and the value obtained by multiplying D1 by R; and the second signature generation device selects a random number r, and multiplies each of the n+1 elements of the registration information T, excluding element RD1, by r while keeping them encrypted, to generate a set C = (Enc(rR),Enc(rRx1), ..., Enc(rRx n )) and transmits it to the first signature generation device, and the first signature generation device generates second biometric information y=(y1,...,y n ), obtain the message M and C from the second signature generation device, and for each θ∈{1, 2, ..., Θ} (Θ is a predetermined positive integer), generate a random number R θ, calculate the hash value H'(M) of the message M to be signed, and AQ θ = (AQ θ, 1 ,AQ θ, 2 ):=(Enc(R θ + rR(D2 - A θ )), H(R θ , H'(M))) where D2=- 2Σ i=1 n x i・ y i + Σ i=1 n y i 2 Calculate Θ AQ θ The second signature generation device multiplies an element RD1 of the registration information T by a random number r to obtain AD=rRD1, and transmits S and AD from the first signature generation device to the verification device. The verification device obtains a message M, calculates a hash value H'(M), and calculates Θ AQ of S obtained from the second signature generation device. θ Regarding the first component AQ θ, 1 The decrypted value Dec(AQ θ, 1 ) plus AD, Dec(AQ , 1 )+ AD, the hash value of H'(M) is AQ θ The second component AQ θ, 2 (=H(R θ , H'(M))) matches AQ θ Check whether there is a (θ∈{1,2,…,Θ}) and H(Dec(AQ θ, 1 ) + AD, H'(M))= AQ θ2 =H(R θ ,H'(M)) θ If there is, it will be accepted, if not, it will be rejected.

[0277] <Supplementary Note 11> In the signature generation system of Supplementary Note 3, the registration device acquires a random number R, encrypts the random number R with a public key, and multiplies each element xi (i=1,...n) of the first biometric information of an n-dimensional vector x=(x1,...,xn) by the random number R, encrypts the value Rxi with the public key, and further calculates a sum of squares of xi D1=Σ i=1 n xi 2 and R, and transmits to the second signature generation device the value Rxi obtained by multiplying R and R encrypted with the public key, the encrypted values ​​of each element of x = (x1, ..., xn) multiplied by R, and the registration information T = (Enc(R),Enc(Rx1), ..., Enc(Rxn),RD1), which is a vector of n + 2 elements of the value obtained by multiplying D1 by R, and the second signature generation device selects a random number r and multiplies each of the n + 1 elements (encryptions) of the registration information T except for element RD1 by r while keeping them encrypted to generate a vector C = (Enc(rR),Enc(rRx1), ..., Enc(rRx n )) and transmits it to the first signature generation device, and the first signature generation device generates second biometric information y=(y1,...,y n ), obtain the message M and C from the second signature generation device, and for each θ∈{1, 2, ..., Θ} (Θ is a predetermined positive integer), generate a random number R θ Select a random number R θ The first message authentication code MAC (R θ , M), and calculates predetermined different Θ values ​​A θ For (θ∈{1,2,…,Θ}), AQ θ = (AQ θ, 1 ,AQ θ, 2 ):=(Enc(R θ + rR(D2 - A θ )), MAC(R θ ,M)) where D2=- 2Σ i=1 n x i・ y i + Σ i=1 n y i 2 Calculate Θ AQ θ The second signature generation device multiplies the n-th element RD1 of the registration information T by a random number r to obtain AD=rRD1, and transmits S and AD from the first signature generation device to a verification device. The verification device receives the message M and calculates the Θ AQ of S obtained from the second signature generation device. θ Regarding the first component AQθ, 1 The decrypted value Dec(AQ θ, 1 ) plus AD, Dec(AQ θ, 1 ) + a second message authentication code MAC (Dec(AQ)) of message M using AD as the key θ, 1 )+AD,M) and calculate the second message authentication code MAC (Dec(AQ θ, 1 )+ AD,M) is AQ θ The second component AQ θ, 2 a first message authentication code MAC(R θ ,M) and AQ θ Check whether there is a matching AQ (θ∈{1,2,…,Θ}). θ If there is, it will be accepted, if not, it will be rejected.

[0278] <Supplementary Note 12> In the signature generation system of Supplementary Note 2, the registration device acquires the n-dimensional first biometric information x=(x1, ..., xn), and calculates the n+1-th element x of x. n+1 is set to 1, n+1 random numbers (r1, r2, ..., rn+1) are generated from (0, ..., q-1), integer random numbers R1 and R2 are generated, and based on the random numbers and the first biometric information x = (x1, ..., xn, xn+1), (R1x i + R2r i ) i∈{1,…,n+1} and {g ｒｉ}i∈{1,...,n+1} (g is a generator of a group G of prime order p), and the first registration information T1 = ((R1x i + R2r i )i∈{1,…,n+1}, g ｒｉ i∈{1,...,n+1}) to the first signature generating device, and second registration information T2=(g R1 , R2) to the verification device, and the first signature generation device transmits the first registration information T １ is received and stored in the first registration information storage unit, and a random number r is generated and stored in the first registration information storage unit. ｒ to the second signature generation device, select a random number C and transmit it to the first signature generation device, and the first signature generation device generates the n-dimensional second biometric information y=(y1,...,y n ), get message M, and y n+1=H(M), and the signature (S, σ1, σ2) (S=H(C, g r ) σ1=rS・A (where A is Σ i=1 n+1 (R1x i + R2r i )・y i ) σ2=Π i=1 , n+1 (g ri ) yi = g^(Σ i=1 n+1 r i ・y i )), and sends the signature (S, σ1, σ2) to the verification device, and the second signature generation device r and C to the verification device, and the verification device transmits the second registration information T2=(g R1 , R2) and store it, and then combine the signature (S, σ1, σ2) and g r and C, and for θ∈{1,…,Θ} (Θ is a predetermined positive integer), v θ = g σ1 (g R1 )S(Aθ+H(M))(σ2) SR2 ) and calculate Θ S θ =H(C, v θ ) (θ∈{1, ..., Θ}), the inner product of the first biometric information x and the second biometric information y is a predetermined value A θ and the value S = H(C, g r ) matches S θ If there is, it will be accepted, if not, it will be rejected.

[0279] <Supplementary Note 13> In the signature generation system of Supplementary Note 2, the registration device acquires n-dimensional first biometric information x = (x1, ..., xn), generates n random numbers (r1, r2, ..., rn) from (0, ..., q-1), generates integer random numbers R1 and R2, and calculates (R1x i + R2r i ) i∈{1,…,n} and {g ｒｉ}i∈{1,...,n} (g is a generator of a group G of prime order p), and the first registration information T1 = ((R1x i + R2r i ) i∈｛1,…,n｝ , g ｒｉ i∈｛1,…,n｝ ) to the first signature generating device, and the second registration information T2=(g R1 , R2) to the second signature generation device, and the first signature generation device receives the first registration information T1 and stores it in the first registration information storage unit, generates a random number r, and generates g ｒ to the second signature generation device, and the second signature generation device receives g transmitted from the first signature generation device. ｒ , selects a challenge (random number) C, and transmits it to the first signature generation device, and the first signature generation device receives n-dimensional second biometric information y=(y1,...,y n ) and obtain the message M, calculate the hash value H'(M) of the message M, and create the signature (S, σ1, σ2) ( S = H(C, g r , H'(M)) σ1=rS・A (where A is Σ i=1 n+1 (R1x i + R2r i )・y i ) σ2=Π i=1 , n+1 (g ri ) yi = g^(Σ i=1 n+1 r i ・y i )), and sends the signature (S, σ1, σ2) to the verification device, and the second signature generation device r and C to the verification device, and the verification device transmits the second registration information T2=(g R1 , R2) and store it, and then combine the signature (S, σ1, σ2) and g r and C, and for θ∈{1,…,Θ} (Θ is a predetermined positive integer), v θ = g σ1 (g R1 )S(Aθ+H(M))(σ2) SR2Calculate Θ S θ =H(C, v θ , H'(M)) (θ∈{1,...,Θ}), the inner product of the first biometric information x and the second biometric information y is a predetermined value A θ and the value S = H(C, g r , H'(M)) θ If there is, it will be accepted, if not, it will be rejected.

[0280] <Supplementary Note 14> In the signature generation system of Supplementary Note 3, the registration device n ) and obtain x n+1 =1, and the registration device calculates a first transformation polynomial pm1(x)=Σ i=1 n+1 x i X i-1 and encrypting the first transformation polynomial pm1(x) using a public key, T=Enc(Σ i=1 n+1 x i X i ) The encrypted first transformation polynomial T is transmitted to the second signature generation device as the registration information, and the second signature generation device receives and stores the encrypted first transformation polynomial T, selects random numbers r and k, and calculates C=Enc(rX) using the public key. k ) and transmits it to the first signature generation device, and the first signature generation device acquires the second biometric information (y1, ..., yn) and a message M, and further acquires C, calculates a hash value H(M) of the message, and n+1 =H(M), and the second transformation polynomial pm2(y)=-Σ for the second biometric information (y1, ..., yn, yn+1) i=1 n+1 y i X N+1-i and encrypt the second transformation polynomial pm2(y) using the public key, Enc(Σ i=1 n+1 y i X N+1-i ) For the second transformation polynomial Enc(pm2(y)), Enc(rX k) by multiplying S = Enc(rX k )× (-Σ i=1 n+1 y i X N+1-i )=Enc{-rX k (Σ i=1 n+1 y i X N+1-i )}, and transmits it to the second signature generation device, and i=1 n+1 x i X i ) and S = Enc{-rX k (Σ i=1 n+1 y i X N+1-i )} and rX k From this, S'=Enc(-(Σ i=1 n+1 x i X i )・(Σ i=1 n+1 y i X N+1-i )) and transmits S' to the verification device, and the verification device acquires the message M and S', decrypts S' using a private key sk to Dec(sk, S'), and calculates the constant term (=<x,y> + H(M)) (where,<x,y> is the inner product of the first biometric information x and the second biometric information y),<x,y> is a predetermined value A θ and the constant term of Dec(sk, S') is A θ + H(M), A θ If it exists, it is accepted, and if it does not exist, it is not accepted.

[0281] <Supplementary Note 15> In the signature generation system of Supplementary Note 3, the registration device n ) and obtain x n+1 =1, and the registration device calculates a first transformation polynomial pm1(x)=Σ i=1 n+1 x i X i-1and encrypting the first transformation polynomial pm1(x) using a public key, T=Enc(Σ i=1 n+1 x i X i ) The encrypted first transformation polynomial T is transmitted to the second signature generation device as the registration information, and the second signature generation device receives and stores the encrypted first transformation polynomial T, selects random numbers r and k, and calculates C=Enc(rX) using the public key. k ) and transmits it to the first signature generation device, and the first signature generation device generates the second biometric information (y1, ..., y n ), and obtain a message M, and then obtain C, calculate the hash value H(M) of the message, select a random number K, and n+1 =K, and the second transformation polynomial pm2(y)=-Σ for the second biometric information (y1, ..., yn, yn+1) i=1 n+1 y i X N+1-i , and encrypt the second transformation polynomial pm2(y) using the public key, Enc(-Σ i=1 n+1 y i X N+1-i ) For the second transformation polynomial Enc(pm2(y)), Enc(rX k ) by multiplying S = Enc(rX k )×Enc(-Σ i=1 n+1 y i X N+1-i )=Enc{-rX k (Σ i=1 n+1 y i X N+1-i )}, and further calculates a first message authentication code MAC(K,M) using a random number K, and transmits S and the first message authentication code MAC(K,M) to the second signature generation device, and the second signature generation device receives the encrypted first transformation polynomial T=Enc(Σ i=1 n+1 x i X i ) and S = Enc{-rX k (Σi=1 n+1 y i X N+1-i )} and rX k From this, S'=Enc(-(Σ i=1 n+1 x i X i )・(Σ i=1 n+1 y i X N+1-i )) and transmits S' to the verification device, the verification device acquires the message M and S', decrypts S' using a private key sk to Dec(sk, S'), and calculates the constant term (=<x,y> + K) (where<x,y> is the inner product of the first biometric information x = (x1, ..., xn) and the second biometric information y = (y1, ..., yn)), θ = (Constant term of Dec(sk, S')) - A θ Looking for K θ , and then generate a second message authentication code MAC(K θ ,M) and calculate MAC(K θ , M) is a value A that matches the first message authentication code MAC(K, M) sent together with S' from the second signature generating device. θ If it exists, it is accepted, and if it does not exist, it is not accepted.

[0282] <Supplementary Note 16> A signature generation method includes: one of a first node and a second node that are communicatively connected to each other acquires and stores registration information generated from first biometric information; the first node acquires second biometric information and a message to be signed; the first node and the second node communicate with each other; and a signature is generated based on at least the message to be signed, the second biometric information, and the registration information, the signature including the degree of similarity between the first biometric information and the second biometric information and information regarding the message to be signed.

[0283] <Supplementary Note 17> In the signature generation method of Supplementary Note 16, a third node generates the first registration information and the second registration information from the first biometric information, the first node acquires and stores the registration information, and a fourth node acquires the second registration information, the signature, and a message, and verifies the signature by confirming whether the similarity between the first biometric information and the second biometric information is within a predetermined range and whether the acquired message is identical to the message to be signed.

[0284] <Supplementary Note 18> In the signature generation method of Supplementary Note 16, a third node acquires the first biometric information, generates the registration information, and transmits it to the second signature generation device; the second node acquires and stores the registration information; a fourth node acquires the signature and a message; and verifies the signature by confirming whether the similarity included in the signature falls within a predetermined range, and whether the acquired message is identical to the message to be signed.

[0285] <Supplementary Note 19> In the signature generation method of Supplementary Note 18, the first node and the second node communicate with each other, select a random number, calculate a first value using the registration information, the second biometric information, and the random number, calculate a second value using the random number and the message to be signed, generate the signature including the first value and the second value, and the fourth node confirms whether a value calculated using the first value included in the signature and a third value calculated using the message obtained by the fourth node match the second value included in the signature.

[0286] <Supplementary Note 20> In the signature generation method of Supplementary Note 18, the first node and the second node communicate with each other, select a random number, calculate a first value calculated using the registration information and the second biometric information, calculate a first message authentication code (MAC) for the message to be signed using the random number as a key, and generate the signature including the first value and the first message authentication code, and the fourth node calculates a second message authentication code for the message obtained by the fourth node using a value derived from the first value included in the signature as a key, and confirm whether the first message authentication code and the second message authentication code match.

[0287] <Supplementary Note 21> In the signature generation method of Supplementary Note 17, the first node and the second node communicate with each other to generate the signature including a value calculated using the registration information and the second biometric information to which a hash value of the message to be signed has been added, and the fourth node confirms whether a value obtained by combining the similarity and the hash value of the message matches any of a plurality of predetermined, mutually different values ​​that belong to a predetermined range.

[0288] <Supplementary Note 22> In the signature generation method of Supplementary Note 17, the first node and the second node communicate with each other to generate a signature including a value calculated using the registration information, the second biometric information, and a hash value of the message to be signed, and the fourth node confirms whether a value obtained by combining the inner product of the first biometric information and the second biometric information and the message hash value matches the value included in the signature for any of a plurality of predetermined, mutually different values ​​that belong to a predetermined range.

[0289] <Supplementary Note 23> In the signature generation method of Supplementary Note 18, the first node and the second node communicate with each other, and generate the signature by multiplying the registration information obtained by encrypting a first polynomial obtained by converting the first biometric information in one of ascending order and descending order, and the second biometric information, to which a hash value of the message to be signed is added, in the encrypted form by a second polynomial obtained by converting the second biometric information in the other of ascending order and descending order, and the fourth node confirms whether a constant term obtained by decrypting the signature matches any one of a plurality of predetermined values ​​that are different from each other and belong to a predetermined range, and the sum of the hash values ​​of the message to be signed.

[0290] <Supplementary Note 24> In the signature generation method of Supplementary Note 18, the first node and the second node communicate with each other, select a random number, and generate the signature including an operation result of: the registration information obtained by encrypting a first polynomial obtained by transforming the first biometric information using one of ascending order and descending order; and a second polynomial obtained by transforming the second biometric information, to which a random number has been added, using the other of ascending order and descending order; calculate a first message authentication code (MAC) for the message to be signed using the random number as a key, and transmit the MAC together with the signature to the fourth node; and the fourth node calculates a second message authentication code for the message acquired at the fourth node using as a key a value obtained by subtracting one of a plurality of predetermined values ​​that are different from each other and belong to a predetermined range from a constant term obtained by decrypting the signature; and confirm whether the first message authentication code and the second message authentication code match.

[0291] <Supplementary Note 25> The recording medium stores a program that causes the first processing device and the second processing device to respectively execute the following processes: a process by either the first processing device or the second processing device to acquire and store registration information generated from first biometric information; a process by the first processing device to acquire second biometric information and a message to be signed; and a process by the first processing device and the second processing device, which communicate with each other, to generate a signature including information on the similarity between the first biometric information and the second biometric information and the message to be signed, based on at least the message to be signed, the second biometric information, and the registration information.

[0292] <Supplementary Note 26> The recording medium of Supplementary Note 25 records a program that causes the first processing device, the third processing device, and the fourth processing device to respectively execute the following processes: a process by the third processing device to generate the first registration information and the second registration information from the first biometric information; a process by the first processing device to acquire and store registration information; and a process by the fourth processing device to acquire the second registration information, the signature, and a message; and the signature verification by the fourth processing device is performed by confirming whether the similarity between the first biometric information and the second biometric information is within a predetermined range, and whether the acquired message is identical to the message to be signed.

[0293] <Supplementary Note 27> The recording medium of Supplementary Note 25 records a program that causes the second processing device, the third processing device, and the fourth processing device to respectively execute the following processes: a process by the third processing device to generate the registration information from the first biometric information and a public key; a process by the second processing device to acquire and store the registration information; and a process by the fourth processing device to acquire a message and the signature; and the signature verification by the fourth processing device is performed by confirming whether the similarity between the first biometric information and the second biometric information is within a predetermined range, and whether the acquired message is identical to the message to be signed.

[0294] The disclosure of Patent Document 1 is incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure (including the claims) of the present invention, and further based on its basic technical concept. Furthermore, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each example, each element of each drawing, etc.) are possible within the scope of the claims. In other words, the present invention naturally includes various modifications and alterations that would be possible for a person skilled in the art based on the entire disclosure, including the claims, and the technical concept.

[0295] 1A, 1B Signature generation system 2A 1:1 confidential biometric authentication system 2B 1:N confidential biometric authentication system 110, 210 Key generation device 111, 211 Key generation unit 112, 212 Public key publishing unit 113, 213 Private key output unit 120, 220 Registration device 121, 134, 221, 244 Biometric information acquisition unit 122, 222 Registration information generation unit 123, 223 First registration information output unit 124, 224 Second registration information output unit 130 First signature generation device (first node) 131 First registration information acquisition unit 132 First registration information storage unit 133, 153 Message acquisition unit 135 First signature generation unit 136 First signature output unit 140 Second signature generation device (second node) 141 Second registration information acquisition unit 142 Second registration information storage unit 145 Second signature generation unit 146 Second signature output unit 150 Verification device (fourth node) 151, 251 Second registration information acquisition unit 152, 252 Second registration information storage unit 154 Signature acquisition unit 155 Signature verification unit 156 Verification result output unit 161, 261 Key acquisition unit 162, 262 Key storage unit 240 First verification device 241 First registration information acquisition unit 242 First registration information storage unit 245 First verification unit 250 Second verification device 255 Second verification unit 256 Verification result output unit 260 Final verification device 263 Verification result acquisition unit 264 Final verification unit 265 Final verification result output unit 500 Computer 501 Processor 502 Storage device 503 Input device / output device 504 Communication interface 600 Server 601 Physical machine 602 Virtualization platform 603 Virtual machine

Claims

1. a first signature generation device and a second signature generation device, each of which has at least a processor and a communication interface and is communicatively connected to each other; one of the first signature generation device and the second signature generation device executes a process of acquiring and storing registration information generated from the first biometric information; the first signature generation device executes a process of acquiring second biometric information and a message to be signed; a signature generation system in which the first signature generation device and the second signature generation device communicate with each other and execute a process of generating a signature including information on the message to be signed and a degree of similarity between the first biometric information and the second biometric information and information on the message to be signed, based on at least the message to be signed, the second biometric information, and the registration information.

2. a registration device having at least a processor and a communication interface; a verification device that has at least a processor and a communication interface and that verifies the signature; Equipped with the registration device acquires the first biometric information, generates the registration information and second registration information, transmits the registration information to the first signature generation device, and transmits the second registration information to the verification device; the first signature generation device acquires and stores the registration information; The verification device obtaining the second registration information, the signature, and a message; The similarity included in the signature is within a predetermined range; and The acquired message is the same as the message to be signed; The signature generation system according to claim 1 , further comprising: a step of: verifying whether the signature has been successfully generated;

3. an enrollment device including at least a processor and a communication interface, which acquires the first biometric information, generates the enrollment information, and transmits the generated enrollment information to the second signature generation device; a verification device having at least a processor and a communication interface, for receiving the signature and the message and verifying the signature; Equipped with the second signature generation device acquires and stores the registration information; The verification device The similarity included in the signature is within a predetermined range; and The acquired message is the same as the message to be signed; The signature generation system according to claim 1 , further comprising: a step of: verifying whether the signature has been successfully generated;

4. The first signature generation device and the second signature generation device communicate with each other, Select a random number, calculating a first value using the enrollment information, the second biometric information, and the random number; calculating a second value calculated using the random number and the message to be signed; generating the signature including the first value and the second value; In the verification device, a value calculated using the first value included in the signature and a third value calculated using the message acquired by the verification device match the second value included in the signature; The signature generation system according to claim 3, wherein the success or failure of the signature is confirmed.

5. the second value included in the signature, a value calculated using the hash value of the message to be signed and the random number, or a first message authentication code (MAC) calculated for the message to be signed using the random number as a key; The third value calculated in the verification device is a value calculated using a hash value of the message acquired by the verification device as a key derived from the first value included in the signature; or 5. The signature generation system according to claim 4, further comprising a second message authentication code (MAC) calculated for the message acquired by the verification device using a value derived from the first value included in the signature as a key.

6. The first signature generation device and the second signature generation device communicate with each other, generating the signature including a value calculated using the enrollment information and the second biometric information to which a hash value of the message to be signed has been added; In the verification device, a value obtained by combining the similarity and the hash value of the message matches any one of a plurality of predetermined values ​​that are different from each other and belong to a predetermined range, the predetermined value being included in the signature; The signature generation system according to claim 2, further comprising: a step of verifying whether the signature has been successfully generated.

7. The first signature generation device and the second signature generation device communicate with each other, generating a signature including a value calculated using the registration information, the second biometric information, and a hash value of the message to be signed; the verification device confirms that a value obtained by combining the inner product of the first biometric information and the second biometric information and the message hash value matches any one of a plurality of predetermined values ​​that are different from each other and belong to a predetermined range, the value being included in the signature; The signature generation system according to claim 2, further comprising: a step of verifying whether the signature has been successfully generated.

8. The first signature generation device and the second signature generation device communicate with each other, the enrollment information obtained by encrypting a first polynomial obtained by converting the first biometric information in one of ascending order and descending order; generating the signature by multiplying the second biometric information, to which the hash value of the message to be signed has been added, by a second polynomial obtained by converting the second biometric information in either ascending order or descending order while still encrypted; In the verification device, a constant term obtained by decrypting the signature matches one of a plurality of predetermined values ​​that are different from each other and belong to a predetermined range and the sum of the hash value of the message to be signed; The signature generation system according to claim 3, wherein the success or failure of the signature is confirmed.

9. The first signature generation device and the second signature generation device communicate with each other, the enrollment information obtained by encrypting a first polynomial obtained by selecting a random number and converting the first biometric information in one of ascending order and descending order; generating the signature including a result of operation of a value obtained by encrypting a second polynomial obtained by converting the second biometric information to which a random number has been added using either an ascending order conversion or a descending order conversion; calculating a first message authentication code (MAC) for the message to be signed using the random number as a key, and transmitting the MAC together with the signature to the verification device; In the verification device, calculating a second message authentication code for the message obtained by the verification device using a value obtained by subtracting one of a plurality of predetermined values ​​that are different from each other and belong to a predetermined range from a constant term obtained by decrypting the signature as a key; the first message authentication code and the second message authentication code match; The signature generation system according to claim 3, wherein the success or failure of the signature is confirmed.

10. One of the first node and the second node that are communicatively connected to each other acquires and stores registration information generated from the first biometric information; the first node acquires second biometric information and a message to be signed; A signature generation method in which the first node and the second node communicate with each other, and a signature is generated based on at least the message to be signed, the second biometric information, and the registration information, the signature including the degree of similarity between the first biometric information and the second biometric information and information about the message to be signed.