Information processing method and information processing system

Abstract

An information processing method including receiving signature data in response to an authentication request, receiving list information from a server, wherein the list information includes one or more encrypted first values, calculating encrypted personal information based on personal information included in the authentication request, calculating, for each encrypted first value indicated in the received list information, a respective encrypted second value, generating a zero-knowledge proof based on the received signature data, and transmitting the encrypted personal information, each encrypted second value, and the generated zero-knowledge proof to the server, wherein the server verifies whether the encrypted personal information further encrypted using the first random number coincides with an encrypted second value and verifies the zero-knowledge proof generated based on the received signature data.

Description

INFORMATION PROCESSING METHOD AND INFORMATION PROCESSING SYSTEMCROSS REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of Japanese Priority Patent Application JP 2024-151857 filed September 4, 2024, the entire contents of which are incorporated herein by reference.

[0002] The present disclosure relates to an information processing method and an information processing system.

[0003] In recent years, there have been widespread techniques for verifying whether or not information of a user is included in an allow list or a block list (referred to as "list verification" hereunder) and determining whether or not to provide services to the user according to a result of the verification.

[0004] Also, as disclosed in NPL 1, techniques have been developed to protect respective pieces of information of both users and service providers through the list verification.

[0005] K Thomas and 10 others, "Protecting accounts from credential stuffing with password breach alerting," August 14, 2019, [Online], [searched on the Internet at <https: / / www.usenix.org / system / files / sec19-thomas.pdf> on August 27, 2024]Summary

[0006] The techniques disclosed in NPL 1, however, fail to guarantee that the user-related information truly belongs to the user.

[0007] According to an aspect of the present disclosure, there is provided an information processing method including receiving signature data in response to an authentication request, receiving list information from a server, wherein the list information includes one or more encrypted first values, calculating encrypted personal information based on personal information included in the authentication request, calculating, for each encrypted first value indicated in the received list information, a respective encrypted second value, generating a zero-knowledge proof based on the received signature data, and transmitting the encrypted personal information, each encrypted second value, and the generated zero-knowledge proof to the server, wherein the server verifies whether the encrypted personal information further encrypted using the first random number coincides with an encrypted second value and verifies the zero-knowledge proof generated based on the received signature data.

[0008] According to another aspect of the present disclosure, there is provided an information processing method including generating list information, wherein the list information includes one or more encrypted first values, receiving, from a user terminal, encrypted personal information calculated based on personal information included in an authentication request for a signature, a respective second value encrypted using the second random number calculated for each encrypted first value indicated in the received list information, and a zero-knowledge proof generated based on the received signature data, calculating the encrypted personal information further encrypted using the first random number to verify whether the further encrypted personal information coincides with an encrypted second value, and verifying the zero-knowledge proof generated based on the received signature data. In addition, according to another aspect of the present disclosure, there is provided an information processing system including a first information processing apparatus, and a second information processing apparatus, wherein the first information processing apparatus includes circuitry configured to receive signature data in response to an authentication request, receive list information from the second information processing apparatus, wherein the list information includes one or more encrypted first values, calculate encrypted personal information based on personal information included in the authentication request, calculate, for each encrypted first value indicated in the received list information, a respective encrypted second value, generate a zero-knowledge proof based on the received signature data, and transmit the encrypted personal information, each encrypted second value, and the generated zero-knowledge proof to the second information processing apparatus, and wherein the second information processing apparatus includes circuitry configured to generate the list information, receive, from the first information processing apparatus, the encrypted personal information, each respective second value calculated for a corresponding encrypted first value indicated in the received list information, and the zero-knowledge proof generated based on the received signature data, calculate further encrypted personal information to verify whether the further encrypted personal information coincides with an encrypted second value received from the first information processing apparatus, and verify the zero-knowledge proof generated based on the received signature data.

[0009] FIG. 1 is a view explaining an overview of the related art.FIG. 2 is another view explaining the overview of the related art.FIG. 3 is another view explaining the overview of the related art.FIG. 4 is another view explaining the overview of the related art.FIG. 5 is another view explaining the overview of the related art.FIG. 6 is another view explaining the overview of the related art.FIG. 7 is another view explaining the overview of the related art.FIG. 8 is another view explaining the overview of the related art.FIG. 9 is another view explaining the overview of the related art.FIG. 10 is a sequence diagram indicating a flow of processing of the related art.FIG. 11 is a sequence diagram indicating a flow of processing using personal information x with a signature attached.FIG. 12 is an overview diagram explaining <STEP: 7’> according to one embodiment of the present disclosure.FIG. 13 is a sequence diagram indicating an exemplary flow of processing of an embodiment.FIG. 14 is an overview diagram explaining <STEP: 7’’> according to an embodiment.FIG. 15 is a sequence diagram indicating an exemplary flow of processing using a zero-knowledge proof π generated on the basis of a signature σ and digitized personal information according to an embodiment.FIG. 16 is a block diagram depicting a functional configuration of an information processing system according to an embodiment.FIG. 17 is a view indicating an exemplary UI (user interface) according to an embodiment.FIG. 18 is a sequence diagram indicating a flow of other service uses using VC (Verifiable Credentials) according to an embodiment.FIG. 19 is a sequence diagram indicating an exemplary flow of typical SSO (Single Sign On) authentication.FIG. 20 is a sequence diagram indicating an exemplary flow of processing in a case where an information processing method according to an embodiment of the present disclosure is applied to SSO.FIG. 21 is a block diagram depicting an exemplary hardware configuration of an information processing apparatus according to an embodiment.

[0010] An embodiment of the present disclosure is described below in detail with reference to the accompanying drawings. Throughout the ensuing description and the appended drawings, like reference signs designate like or corresponding constituent elements having substantially similar functional configurations, and the explanations of these elements will be omitted where they are redundant.

[0011] Also, in the ensuing description and appended drawings, in a case where multiple configurations of the same type are explained as distinct from each other, each of such configurations may be designated by the same reference sign suffixed with an alphabetical character or the like. In a case where multiple configurations of the same type need not be distinguished from each other, all such configurations of the same type may be given a common explanation without using the alphabetical character suffix or the like.

[0012] The description will be made in the following order: 1. Embodiment 1.1. Background 1.2. Details of processing 1.3. Functional configuration example 1.4. Examples of UI 1.5. Variations 2. Hardware configuration example 3. Conclusion

[0013] <1. Embodiment> <1.1. Background> As described above, techniques have been developed to protect respective pieces of information of both users and service providers through the list verification.

[0014] For example, NPL 1 discloses the techniques for verifying whether or not a user’s password is included in a "weak password list" without the user revealing the password itself to a service provider and without the service provider revealing the "weak password list" itself to the user.

[0015] In order to prove an advantage of the information processing method according to an embodiment of the present disclosure, an overview of the related art disclosed in NPL 1 is explained first.

[0016] FIGS. 1 through 9 are views explaining the overview of the related art.

[0017] Problem settings are first discussed with reference to FIG. 1. FIG. 1 indicates personal information 60 managed by a user 15 and a block list 70 managed by a service provider 25.

[0018] The personal information 60 is an example of protected information related to the present embodiment. For example, the personal information 60 may be information regarding the user’s individual number card, social security number, driver’s license, passport, passwords, or the like. The personal information 60 may also be information regarding the user’s name, birthday, or the like, as indicated in the drawing.

[0019] The block list 70 is an exemplary list according to the present embodiment. In the case of this example, the block list 70 may be a list that includes pieces of personal information of multiple individuals as elements.

[0020] The service provider 25 verifies whether or not the personal information 60 is included in the block list 70. Only in a case where the personal information 60 is not included in the block list 70, the service provider 25 provides services to the user 15.

[0021] For example, the service provider 25 may be a financial institution such as a bank. In this case, the block list 70 may be the AML / CFT (Anti Money Laundering / Countering the Financing of Terrorism) list.

[0022] In a case where the personal information 60 of the user 15 is included in the AML / CFT list, the service provider 25 as a financial institution such as a back will not provide services, thereby preventing money laundering or financing of terrorists, for example.

[0023] Suppose here that the list verification is to be performed without the contents of both the personal information 60 and block list 70 being revealed to the opposite parties.

[0024] In order to implement the case above, the related art involves first digitizing the personal information 60 using a hash function, for example, to obtain digital personal information 62 as depicted in FIG. 2. Also, individual pieces of personal information included in the block list 70 are digitized so as to obtain a digital block list 72 <STEP: 1>.

[0025] VALUE "23" is a digital example of the personal information 60 ("Shiro TANAKA," "1993 / 07 / 20"). VALUE "12" is a digital example of personal information ("Ichiro SATO," "1989 / 05 / 30") included in the block list 70. VALUE "105" is a digital example of personal information ("Jiro SUZUKI," "1963 / 01 / 24") included in the block list 70. Also, VALUE "57" is a digital example of personal information ("Saburo TAKAHASHI," "2002 / 11 / 01") included in the block list 70.

[0026] The above-described digitization is achieved by converting individual pieces of personal information to points (values) on an elliptic curve with the hash function, for example. Incidentally, in practice, the converted values are approximately 2 to the 256th power each. The above examples are adopted for the purpose of easy understanding.

[0027] Next, as depicted in FIG. 3, grouping of the digital block list 72 is carried out according to the related art <STEP: 2>.

[0028] In the example indicated in FIG. 3, each VALUE in the digital block list 72 is grouped according to the value of the remainder of division by 4.

[0029] Incidentally, the grouping may be performed in accordance with the value of the first m bits of the VALUE (hash value), as will be discussed later.

[0030] It is also possible to adjust the trade-off between processing performance and information protection by changing the number by which to divide the VALUE, the above-mentioned value m, or the like.

[0031] Next, as indicated in FIG. 4, group designation on the side of the user 15 is carried out according to the related art <STEP: 3>. In this example, a group is designated by providing the service provider 25 with the remainder "3" from division of the digital personal information 62 by 4.

[0032] The above group designation allows the service provider 25 to know that, if the digital personal information 62 regarding the user 15 is included in the digital block list 72, the information belongs to the group of the remainder "3."

[0033] The larger the number by which to divide the digital personal information, the larger the number of groups becomes and the smaller the number of elements in each group. That means that, the larger the dividing number, the greater the amount of information obtained by the service provider 25. It is thus desired that the number by which to divide the digital personal information satisfy the information protection requirements that may be established.

[0034] Next, as depicted in FIG. 5, each of the elements included in the group of the remainder "3" is encrypted with a random number b (multiplication by b), with the information regarding the encrypted group of the remainder "3" provided to the user 15, according to the related art <STEP: 4>.

[0035] Since the random number b is concealed from the user 15, the user 15 is unable to decrypt the elements included in the group of the remainder "3." Incidentally, the random number b is an example of a second random number related to an embodiment.

[0036] In the digital block list 72, only the information regarding a given group may be encrypted and presented (transmitted). This provides an advantageous effect of improving computation and communication performance.

[0037] Incidentally, as discussed above, the larger the number by which to divide digital personal information, the larger the number of groups becomes and the smaller the number of elements in each group. That means that, the larger the dividing number, the more improved the performance of computation and communication. Conversely, the smaller the number by which to divide digital personal information, the more degraded the performance of computation and communication. It is thus desired that the number by which to divide the digital personal information satisfy the performance requirements that may be established.

[0038] Next, as depicted in FIG. 6, the personal information 62 is encrypted with a random number a (multiplication by a), with the encrypted personal information provided to the service provider 25, according to the related art <STEP: 5>.

[0039] Since the random number a is concealed from the service provider 25, the service provider 25 is unable to decrypt the digital personal information 62. Incidentally, the random number a is an example of a first random number related to the present embodiment.

[0040] Then, as depicted in FIG. 7, the information regarding the group of the remainder "3" encrypted with the random number b is further encrypted with the random number a before being provided to the service provided 25, according to the related art <STEP: 6>.

[0041] Preferably, the provision of the information in <STEP: 5> and the provision of the information in <SEP: 6> may be performed in one round of communication.

[0042] Next, on the side of the service provider 25 as depicted in FIG. 8, the personal information encrypted with the random number a is further encrypted with the random number b, according to the related art <STEP: 7>.

[0043] Thereafter, on the side of the service provider 25 as depicted in FIG. 9, it is verified whether or not the personal information encrypted with the random numbers a and b is included in the group of the remainder "3" encrypted with the random numbers a and b, according to the related art <STEP: 8>.

[0044] The foregoing paragraphs have explained the overview of the related art with reference to FIGS. 1 through 9. What follows is a detailed explanation of the flow of processing according to the related art with reference to FIG. 10.

[0045] In the example indicated in FIG. 10, a user terminal 10 first transmits the first m bits of H’(x) to a service server 20 (S101).

[0046] The symbol x denotes the personal information (e.g., password and the like) regarding the user 15. The symbol H’ represents a hash function that meets {0, 1}*→{0, 1}k. A symbol H, to be discussed later, stands for a hash function that satisfies {0, 1}*→ set G. The set G denotes a group (order p) by which an assumption DDH (Decisional Diffie-Hellman) is possible.

[0047] The user terminal 10 is an information processing apparatus used by the user 15 and is an example of an authentication apparatus according to the present embodiment. The service server 20 is an information processing apparatus operated by the service provider 25 and is an example of a verification apparatus according to the present embodiment.

[0048] The service server 20 samples the random number b and, given a list Y = {y1, ..., yn}, calculates hi= H(yi)bon yisuch that the first m bits of H’(yi) coincide with the first m bits of H’(x) received in step S101 (S102).

[0049] It is to be noted that it is not mandatory to perform the process of transmitting and receiving the first m bits of H’(x) in step S101 or the process of calculating hi= H(yi)b"on yisuch that the first m bits of H’(yi) coincide with the first m bits of H’(x) received in step S101." These processes are processed for improving the performance as described above and are not required to be configured for the list verification. The service server 20 may sample the random number b and may simply proceed to calculate hi= H(yi)b.

[0050] The service server 20 transmits {hi}ito the user terminal 10 according to the result of the calculation in step S102 (S103).

[0051] The user terminal 10 samples the random number a, and calculates the following mathematical formulas (1) and (2) (step S104):

[0052]

[0053] Also, the user terminal 10 shuffles the mathematical formula (3) below and obtains the following mathematical formula (4) (step S105):

[0054]

[0055] The user terminal 10 then transmits the result of the calculation of the above mathematical formula (1) together with the mathematical formula (4) to the service server 20 (S106).

[0056] When the order of the elements included in the list encrypted with the random numbers a and b is shuffled as described above before the transmission, it is possible to prevent estimation of the information based on the initial order, thereby ensuring security.

[0057] The service server 20 calculates h’bfrom the result of the calculation of the above mathematical formula (1) received in step S106, so as to verify whether or not there is a value coinciding with h’bin the mathematical formula (4) received in step S106 (S107).

[0058] The preceding paragraphs have described the flow of the processing according to the related art. The above-described processing flow makes it possible to verify whether or not the personal information 60 is included in the block list 70 while concealing the personal information 60 and the block list 70 from the opposite parties.

[0059] However, the related art has no configuration for verifying whether the password x is truly the personal information of the user 15. Thus, if a malicious user 15 makes illicit use of personal information x’ of another person, there is a possibility that the service server 20 may overlook the fraudulent password use.

[0060] In order to avoid such an eventuality, there may be provided a configuration in which a third party attaches a signature to the personal information x, for example.

[0061] FIG. 11 is a sequence diagram indicating a flow of processing using the personal information x with a signature attached.

[0062] In the example depicted in FIG. 11, the user terminal 10 first transmits an authentication request including the personal information x to an authentication apparatus 30 (S201).

[0063] The authentication apparatus 30 is an information processing apparatus operated by a third party different from the user 15 and from the service provider 25.

[0064] The authentication apparatus 30 performs authentication based on the authentication request received in step S201 and, if the authentication is successful, returns a signature σ regarding the personal information x to the user terminal 10 (S202).

[0065] Meanwhile, the service server 20 samples the random number b, calculates hi= H(yi)b(S203), and transmits {hi}ito the user terminal 10 (S204).

[0066] Next, the user terminal 10 carries out steps S205 and S206. Steps S205 and S206 are equivalent to steps S104 and S105 indicated in FIG. 10.

[0067] The user terminal 10 transmits the result of the calculation of the above mathematical formula (1), the mathematical formula (4) above, and the signature σ to the service server 20 (S207).

[0068] The service server 20 calculates h’bfrom the result of the calculation of the above mathematical formula (1) received in step S207, in order to verify whether or not there is a value coinciding with h’bin the mathematical formula (4) received in step S207 (S208).

[0069] The service server 20 then verifies the authenticity of the signature σ (S209).

[0070] The foregoing paragraphs have described the flow of the processing using the personal information x with the signature σ attached.

[0071] The above-described processing flow guarantees that the personal information x truly belongs to the user 15. However, there is a possibility that the signature σ may let the personal information x leak out, which can be a security concern.

[0072] The technical idea according to one embodiment of the present disclosure is inspired by the above issues and intends to implement more secure list verification.

[0073] It is therefore a feature of the information processing method according to one embodiment of the present disclosure to verify the authenticity of a zero-knowledge proof indicating that a signature is attached to the protected information.

[0074] What follows is a detailed description of the information processing method according to one embodiment of the present disclosure.

[0075] <<1.2. Details of processing>> As mentioned above, the information processing method according to the present embodiment enables the zero-knowledge proof to prove that a signature is attached to the protected information.

[0076] The zero-knowledge proof is a technology for proving the authenticity of a fact of interest without giving any other knowledge to the opposite party.

[0077] The user terminal 10 according to the present embodiment (an exemplary authentication apparatus) may generate a zero-knowledge proof π, using algorithms such as zk-SNARK (Zero-Knowledge Succinct Non-interactive Arguments of Knowledge).

[0078] FIG. 12 is an overview diagram explaining <STEP: 7’> according to the present embodiment. <STEP: 7’> of the present embodiment corresponds to <STEP: 7> according to the related art indicated in FIG. 8.

[0079] In <STEP: 7’> of this example, on the side of the service provider 25, the personal information encrypted with the random number a is further encrypted with the random number b, whereas, on the side of the user 15, the zero-knowledge proof π is generated on the basis of the signature σ, and the generated zero-knowledge proof π is presented to the service provider 25.

[0080] The zero-knowledge proof π generated in <STEP: 7’> may be data indicating that the signature σ is attached to the personal information 60 (an example of the protected information).

[0081] The zero-knowledge proof π generated in <STEP: 7’> is verified by the service provider 25 in <STEP: 8’> that follows.

[0082] It is to be noted that <STEP: 1’> through <STEP: 6’> of the present embodiment may be equivalent to <STEP: 1> through <STEP: 6> of the related art except that the signature σ is attached to the personal information 60. Thus, the detailed description thereof will be omitted.

[0083] Next, an exemplary flow of processing according to the present embodiment is explained in detail with reference to FIG. 13.

[0084] It is to be noted that the processes of steps S301 through S306 in FIG. 13 may be equivalent to the processes of steps S201 through S206 in FIG. 11. Thus, the detailed description thereof will be omitted.

[0085] Subsequent to steps S301 through S306, the user terminal 10 generates the zero-knowledge proof π based on the signature σ (S307).

[0086] The zero-knowledge proof π generated in step S307 is data indicating that the signature σ is attached to the personal information x (an example of the protected information).

[0087] The user terminal 10 transmits the result of the calculation of the above mathematical formula (1), the mathematical formula (4) above, and the zero-knowledge proof π generated in step S307 to the service server 20 (S308).

[0088] The service server 20 calculates h’bon the basis of the result of the calculation of the mathematical formula (1) above received in step S308, so as to verify whether or not there is a value coinciding with h’bin the mathematical formula (4) received in step S308 (S309).

[0089] The service server 20 then verifies the authenticity of the zero-knowledge proof π received in step S308 (S310).

[0090] According to the zero-knowledge proof π based on the signature σ explained above with reference to FIGS. 12 and 13, it is possible to prove that the signature σ is attached to the personal information x while concealing the signature σ itself within the service server 20 so as to exclude the possibility of the personal information x leaking out by way of the signature σ.

[0091] What follows is a description of another example of the zero-knowledge proof π according to the present embodiment.

[0092] FIG. 14 is an overview diagram explaining <STEP: 7’’> according to the present embodiment. <STEP: 7’’> according to the present embodiment corresponds to <STEP: 7> according to the related art in FIG. 8.

[0093] In <STEP: 7’’> of this example, on the side of the service provider 25, the personal information encrypted with the random number a is further encrypted with the random number b, whereas, on the side of the user 15, the zero-knowledge proof π is generated on the basis of the signature σ and of the digital personal information 62, and the generated zero-knowledge proof π is presented to the service provider 25.

[0094] The zero-knowledge proof π generated in <STEP: 7’’> may be data further indicating that the signature σ is attached to the personal information 60 (an example of the protected information) and that the personal information encrypted with the random number a is a value correctly calculated from the personal information 60.

[0095] The zero-knowledge proof π generated in <STEP: 7’’> is verified by the service provider 25 in <STEP: 8’’> that follows.

[0096] It is to be noted that <STEP: 1’’> through <STEP: 6’’> according to the present embodiment may be equivalent to <STEP: 1> through <STEP: 6> of the related art except that the signature σ is attached to the personal information 60. Thus, the detailed description thereof will be omitted.

[0097] Explained next in detail with reference to FIG. 15 is an exemplary flow of processing using the zero-knowledge proof π generated on the basis of the signature σ and of the digital personal information according to the present embodiment.

[0098] It is to be noted that the processes of steps S401 through S406 in FIG. 15 may be equivalent to the process of steps S201 through S206 in FIG. 11. Thus, the detailed description thereof will be omitted.

[0099] Subsequent to steps S401 through S406, the user terminal 10 generates the zero-knowledge proof π (S407).

[0100] The zero-knowledge proof π generated in step S407 is represented as π←Prove((vk, h’), (x, σ, a)), indicating that the signature σ is attached to the personal information x (Verify(vk; x, σ) = accept) and that h’ is correctly calculated from the personal information x (h’ = H(x)a).

[0101] The user terminal 10 transmits the result of the calculation of the above mathematical formula (1), the mathematical formula (4) above, and the zero-knowledge proof π generated in step S407 to the service server 20 (S408).

[0102] The service server 20 calculates h’bfrom the result of the calculation of the above mathematical formula (1) received in step S408, so as to verify whether or not there is a value coinciding with h’bin the mathematical formula (4) received in step S408 (S409).

[0103] The service server 20 also verifies the authenticity of the zero-knowledge proof π received in step S408 (Verify(σ, (vk, h’))(S410).

[0104] The zero-knowledge proof π explained above with reference to FIGS. 14 and 15 makes it possible to detect the user 15 making illicit use of another person’s personal information x’. It is thus possible to implement more secure list verification.

[0105] <<1.3. Functional configuration example>> An exemplary functional configuration of the information processing system 1 implementing the information processing method according to the present embodiment is described next. FIG. 16 is a block diagram depicting a functional configuration of the information processing system 1 according to the present embodiment.

[0106] As depicted in FIG. 16, the information processing system 1 according to the present embodiment includes the user terminal 10, service server 20, and authentication apparatus 30.

[0107] (User terminal 10) The user terminal 10 is an information processing apparatus used by the user 15 and is an example of the authentication apparatus according to the present embodiment.

[0108] As indicated in FIG. 16, the user terminal 10 includes a processing part 110, a display part 120, a communication part 130, and the like.

[0109] (Processing part 110) The processing part 110 performs the list verification in coordination with the service server 20. The processing part 110 is an example of an authentication part according to the present embodiment.

[0110] The processing part 110 transmits an authentication request including protected information to the authentication apparatus 30 and performs control to obtain a signature for the protected information.

[0111] The processing part 110 also controls display of information by the display part 120.

[0112] The functions provided by the processing part 110 are implemented by various processors and memories in coordination.

[0113] (Display part 120) The display part 120 displays various kinds of information under control of the processing part 110. For this purpose, the display part 120 has various display units.

[0114] (Communication part 130) Under control of the processing part 110, the communication part 130 performs information communication with other information processing apparatuses via networks.

[0115] (Service server 20) The service server 20 is an information processing apparatus operated by the service provider 25 and is an example of the verification apparatus according to the present embodiment.

[0116] As depicted in FIG. 16, the service server 20 includes a processing part 210, a service provision part 220, a communication part 230, and the like.

[0117] (Processing part 210) The processing part 210 performs the list verification in coordination with the user terminal 10.

[0118] The processing part 210 is an example of a first verification part that verifies whether or not the value obtained by an operation in which the protected information encrypted with a first random number is further encrypted with a second random number is included in the list encrypted with the first and the second random numbers.

[0119] Also, the processing part 210 is an example of a second verification part that verifies the authenticity of the zero-knowledge proof indicating that a signature is attached to the protected information.

[0120] The processing part 210 receives the protected information encrypted with the first random number, the list encrypted with the first and the second random numbers, and the zero-knowledge proof from the user terminal 10 via the communication part 230.

[0121] Also, the processing part 210 encrypts the list with the second random number, and transmits the list encrypted with the second random number to the user terminal 10 via the communication part 230.

[0122] (Service provision part 220) The service provision part 220 determines whether or not to provide services according to two results such as the result of verifying whether or not the value obtained by an operation in which the protected information encrypted with the first random number is further encrypted with the second random number is included in the list encrypted with the first and the second random numbers (first verification), and the result of verifying the authenticity of the zero-knowledge proof (second verification).

[0123] For example, in a case where it is confirmed that the protected information encrypted with the first and the second random numbers is not included in the block list encrypted with the first and the second random numbers in the first verification and where the authenticity of the zero-knowledge proof is confirmed in the second verification, the service provision part 220 may provide its services.

[0124] (Communication part 230) The communication part 230 performs information communication with other information processing apparatuses via networks under control of the processing part 210.

[0125] (Authentication apparatus 30) The authentication apparatus 30 is an information processing apparatus operated by a third party different from the user 15 and from the service provider 25.

[0126] As depicted in FIG. 16, the authentication apparatus 30 includes an authentication part 310, a communication part 320, and the like.

[0127] (Authentication part 310) The authentication part 310 performs authentication based on the authentication request including the protected information and transmitted from the user terminal 10 and, if the authentication is successful, attaches a signature to the protected information.

[0128] (Communication part 330) The communication part 330 performs information communication with other information processing apparatuses via networks under control of the authentication part 310.

[0129] The foregoing paragraphs have described an exemplary functional configuration of the information processing system 1 of an embodiment. It is to be noted that the functional configuration explained above with reference to FIG. 16 is merely an example and that this example is not limitative of the functional configuration of the information processing system 1 according to the present embodiment.

[0130] For example, the user terminal 10, the service server 20, and the authentication apparatus 30 may each further include an operation reception part that receives operations by an operator, an audio input part that receives input of sound, and an audio output part that outputs sound.

[0131] Also, in another example, the service server 20 and the authentication apparatus 30 may each further include a display part that displays information.

[0132] The functional configuration of the information processing system 1 according to the present embodiment can be modified flexibly depending on specification, operation, and the like.

[0133] <<1.4. Examples of UI>> An example of the UI according to the present embodiment is described next. FIG. 17 is a view indicating an exemplary UI of the present embodiment.

[0134] In a case where the user 15 desires to receive services, the processing part 110 of the user terminal 10 in coordination with the service server 20 causes the display part 120 to display an indication that the protected information (in this example, an image of a driver’s license) is desired to be provided, as depicted in the left part of FIG. 17.

[0135] Here, in a case where the user 15 has taken a photo of the driver’s license, the processing part 110 performs the above-described list verification in coordination with the service server 20. The processing part 110 causes the display part 120 to display status of the list verification ("verification" in FIG. 17) as depicted in the center part of FIG. 17.

[0136] Also, in a case where the list verification is completed, the protected information is not included in the block list (or included in the allow list), and the authenticity of the zero-knowledge proof is confirmed, the processing part 110 causes the display part 120 to display a button or the like for starting the use of services, as depicted in the right part of FIG. 17.

[0137] Thereafter, the processing part 110 in coordination with the service provision part 220 of the service server 20 continues UI control on the services.

[0138] <<1.5. Variations>> Variations of embodiments are described hereunder.

[0139] FIGS. 13 and 15 indicate, as examples, cases in which the service server 20 samples the random number b and calculates hi= H(yi)b. Preferably, as in the example in FIG. 10, the service server 20 may calculate hi= H(yi)bon yisuch that the first m bits of H’(yi) coincide with the first m bits of H’(x) received from the user terminal 10.

[0140] The calculation above makes it possible to adjust the trade-off between information protection and performance.

[0141] For example, in a case where m = 0 is satisfied, the protected information regarding the user 15 does not entirely leak to the service provider 25, but performance may deteriorate. In a case where the value m is set to 1 or higher, the calculation time is approximately 1 / 2m, compared with a case where m = 0 is satisfied.

[0142] With the above taken into account, the service server 20 may perform optimization control by, for example, reducing the value m (e.g., m is less than or equal to 5, or the like) in a case where the sensitivity of the protected information is high while the list size is small, and enlarging the value m (e.g., m is approximately equal to 20, or the like) in a case where the sensitivity of the protected information is low while the list size is large.

[0143] In a case where the above control is carried out, the user terminal 10 generates the zero-knowledge proof π proving that the signature σ is attached to the personal information x, that h’ is correctly calculated from the personal information x, and that H’(x) is calculated correctly from the personal information x.

[0144] Discussed above have been the cases in which the result of the list verification is used only for the services provided by the service server 20. Preferably, the result of the list verification may be used for other services provided by another service server 50 different from the service server 20.

[0145] In this case, the service server 20 may issue VC indicating that the protected information is either included in the list or not included therein.

[0146] FIG. 18 is a sequence diagram indicating a flow of other service uses that utilize the VC according to an embodiment.

[0147] In the example depicted in FIG. 18, the user terminal 10, the service server 20, and the authentication apparatus 30 operate in coordination to perform the list verification indicated in FIG. 13 or in FIG. 15 (S501).

[0148] On the basis of the result of the list verification in step S501, the service server 20 issues to the user terminal 10 the VC indicating that the protected information is included in the allow list or not included in the block list (S502).

[0149] The user terminal 10 presents the VC issued in step S502 to another service server 50 (S503).

[0150] The other service server 50 verifies the VC presented in step S503 (S504).

[0151] In a case where the authenticity of the VC is confirmed in step S504, the other service server 50 provides services to the user terminal 10 (S505).

[0152] The preceding paragraphs have described the flow of the use of other services utilizing the VC according to an embodiment.

[0153] What follows is an explanation of how an embodiment may be applied to SSO of the list verification.

[0154] SSO refers to a technology in which the account of a given service such as that of SNS (Social Networking Service) is used to log in to other services.

[0155] Here, suppose a case where a service in which SSO is incorporated is to be intended to perform not only SSO authentication but also verification of the user 15 by use of the block list held in the service itself.

[0156] Applying the information processing method of an embodiment to the case above makes it possible to verify that the user 15 has passed the SSO authentication and that the user 15 is not included in the block list without receiving the protected information.

[0157] FIG. 19 is a sequence diagram indicating an exemplary flow of typical SSO authentication.

[0158] In the example depicted in FIG. 19, the user terminal 10 first transmits a service use request to the service server 20 (S601).

[0159] Upon receipt of the service use request in step S601, the service server 20 transmits an ID (identifier) token request to an SSO server 55 (S602).

[0160] Upon receipt of the ID token request in step S602, the SSO server 55 transmits a personal information provision request to the user terminal 10 (S603).

[0161] Upon receipt of the personal information provision request in step S603, the user terminal 10 provides personal information to the SSO server 55 (S604).

[0162] Upon receipt of the personal information in step S604, the SSO server 55 performs authentication on the basis of the received personal information and, if the authentication is successful, generates an ID token (S605).

[0163] The SSO server 55 then transmits the ID token generated in step S605 to the service server 20 (S606).

[0164] Upon receipt of the ID token in step S606, the service server 20 verifies the received ID token (S607).

[0165] In a case where the authenticity of the ID token is confirmed in step S607, the service server 20 provides services to the user terminal 10 (S608).

[0166] The preceding paragraphs have described an exemplary flow of typical SSO authentication. What follows is an explanation of the flow of processing in a case where the information processing method of an embodiment is applied to SSO.

[0167] FIG. 20 is a sequence diagram indicating an exemplary flow of processing in a case where the information processing method of an embodiment is applied to SSO.

[0168] In the example depicted in FIG. 20, the user terminal 10 first transmits a service use request to the service server 20 (S701).

[0169] Upon receipt of the service use request in step S701, the service server 20 transmits an ID token request to the SSO server 55 (S702).

[0170] Upon receipt of the ID token request in step S702, the SSO server 55 transmits a personal information provision request to the user terminal 10 (S703).

[0171] Upon receipt of the personal information provision request in step S703, the user terminal 10 provides personal information to the SSO server 55 (S704).

[0172] Upon receipt of the personal information in step S704, the SSO server 55 performs authentication on the basis of the received personal information and, in a case where the authentication is successful, attaches a signature to the personal information (S705). That is, the SSO server 55 performs a process similar to that of the authentication apparatus 30.

[0173] Also, the SSO server 55 performs the list verification indicated in FIG. 13 or in FIG. 15 in coordination with the service server 20 (S706). That is, the SSO server 55 acts as an authentication apparatus in this example.

[0174] In a case where the personal information is not included in the block list and where the authenticity of the zero-knowledge proof is confirmed, the service server 20 provides services to the user terminal 10 (S707).

[0175] The preceding paragraphs have described an exemplary flow of processing in a case where the information processing method of an embodiment is applied to SSO.

[0176] What follows is a description of a case where the information processing method of an embodiment is applied to the provision of services to a creator.

[0177] A creator (an example of the user 15) doing various creative activities may use a pseudonym or the like for his or her activities. Hence, it can be considered that, while there is a case where the creator may wish to conceal his or her personal information including the titles of his or her creations, there is a case where the service provider 25 may desire to confirm whether the scope of the creator’s activities is well-established.

[0178] In the above circumstances, the creator may request his or her publisher, posting site, or the like to prove with a signature the extent of his or her creative activities. The list verification may then be carried out on the basis of the signature. In this manner, the creator can prove the scope of his or her productions without revealing the personal information.

[0179] <2. Hardware configuration example> Explained next is an exemplary hardware configuration common to the user terminal 10, the service server 20, the authentication apparatus 30, the other service server 50, and the SSO server 55 according to an embodiment of the present disclosure. FIG. 21 is a block diagram depicting an exemplary hardware configuration of an information processing apparatus 90 according to an embodiment of the present disclosure. The information processing apparatus 90 may be an apparatus that has a hardware configuration similar to that of the above-mentioned apparatuses.

[0180] As depicted in FIG. 21, the information processing apparatus 90 includes, for example, a processor 871, a ROM 872, a RAM 873, a host bus 874, a bridge 875, an external bus 876, an interface 877, an input apparatus 878, an output apparatus 879, storage 880, a drive 881, a connection port 882, and a communication apparatus 883. It is to be noted that the hardware configuration indicated here is an example, so that some of its constituent elements may be omitted. Moreover, the information processing apparatus 90 may further include constituent elements other than those depicted here.

[0181] (Processor 871) The processor 871 functions as an arithmetic processing apparatus or a control apparatus, for example. The processor 871 controls part or all of the operations of the constituent elements according to various programs recorded in the ROM 872, the RAM 873, the storage 880, or on a removable storage medium 901.

[0182] (ROM 872 and RAM 873) The ROM 872 is a section that stores the programs read by the processor 871 and the data used thereby for calculations. The RAM 873 temporarily or permanently stores the programs read by the processor 871, various parameters that may be varied appropriately upon execution of the programs, and the like, for example.

[0183] (Host bus 874, bridge 875, external bus 876, and interface 877) The processor 871, the ROM 872, and the RAM 873 are interconnected with each other via the host bus 874 permitting high-speed data transmission, for example. Meanwhile, the host bus 874 is connected, for example, to the external bus 876 permitting data transmission at relatively low speeds via the bridge 875. The external bus 876 is connected with various constituent elements via the interface 877.

[0184] (Input apparatus 878) A mouse, a keyboard, a touch panel, buttons, switches, levers, and the like, for example, may be used as the input apparatus 878. A remote controller capable of transmitting control signals using infrared rays or other radio waves may also be used as the input apparatus 878. Also, the input apparatus 878 may include an audio input apparatus such as a microphone.

[0185] (Output apparatus 879) The output apparatus 879 is an apparatus capable of visually or audibly notifying the user of acquired information, such as a display apparatus including a CRT (Cathode Ray Tube), LCD, or organic EL, an audio output apparatus including a speaker or a headphone, a printer, a mobile phone, or a facsimile. The output apparatus 879 according to an embodiment of the present disclosure may also include various types of vibration devices capable of outputting tactile stimulation.

[0186] (Storage 880) The storage 880 is an apparatus for storing various kinds of data. For example, a magnetic storage device such as an HDD (hard disk drive), a semiconductor storage device, an optical storage device, or a magneto-optical storage device is used as the storage 880.

[0187] (Drive 881) The drive 881 is an apparatus that reads information written on the removable storage medium 901 such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, or writes information to the removable storage medium 901.

[0188] (Removable storage medium 901) The removable storage medium 901 is a DVD medium, a Blu-ray (registered trademark) medium, an HD DVD medium, and various semiconductor storage media, for example. Obviously, the removable storage medium 901 may also be an IC card that carries a non-contact IC chip, an electronic device, or the like.

[0189] (Connection port 882) The connection port 882 is a port for connecting with an externally connected device 902, such as a USB (Universal Serial Bus) port, IEEE 1394, SCSI (Small Computer System Interface) port, RS-232C port, an optical audio terminal, or the like.

[0190] (Externally connected device 902) The externally connected device 902 may be a printer, a portable music player, a digital camera, a digital video camera, an IC recorder, or the like, for example.

[0191] (Communication apparatus 883) The communication apparatus 883 is a communication device for connection to networks. For example, the communication apparatus 883 may be a communication card for wired or wireless LAN, Bluetooth (registered trademark), or WUSB (Wireless USB), a router for optical communication, a router for ADSL (Asymmetric Digital Subscriber Line), a modem for various communication uses, or the like.

[0192] <3. Conclusion> As explained above, the information processing method as one embodiment of the present disclosure includes causing a processor to perform a first and a second verification, the first verification verifying whether or not a value obtained by an operation in which protected information encrypted with a first random number is further encrypted with a second random number is included in a list encrypted with the first and the second random numbers, the second verification verifying the authenticity of a zero-knowledge proof indicating that a signature is attached to the protected information.

[0193] The above configuration makes it possible to implement more secure list verification.

[0194] Whereas some embodiments of the present disclosure have been described above in detail with reference to the accompanying drawings, the embodiments are not limitative of the technical scope of the present disclosure. It is obvious that those skilled in the art will easily conceive variations or alternatives of the disclosure within the scope of the technical idea stated in the appended claims. It is to be understood that such variations and alternatives also fall within the technical scope of the present disclosure.

[0195] Also, the steps related to the processes described in the present disclosure need not necessarily be performed chronologically, i.e., in the order in which they are depicted in the accompanying flowcharts or sequence diagrams. Alternatively, the steps related to each of the apparatuses may be carried out parallelly or in sequences different from those described above.

[0196] Moreover, the series of the processes performed by each of the apparatuses described in the present disclosure may be implemented by programs stored on a non-transitory computer-readable storage medium. Each of the programs may be read into RAM upon execution by a computer, for example, and carried out by a processor such as a CPU. The storage medium may be a magnetic disk, an optical disk, a magneto-optical disk, a flash memory, or the like, for example. Preferably, the programs may be distributed via a network, for example, without recourse to the storage medium.

[0197] Further, the advantageous effects stated in this description are only for explanatory or illustrative purposes and are not limitative of the present disclosure. That is, in addition to or in place of the above-described advantageous effects, the technology of the present disclosure may provide other advantageous effects that will be obvious to those skilled in the art in view of the above description.

[0198] It is to be noted that the following configurations also belong to the technical scope of the present technology. (1) An information processing method including: receiving signature data in response to an authentication request, receiving list information from a server, wherein the list information includes one or more encrypted first values, calculating encrypted personal information based on personal information included in the authentication request, calculating, for each encrypted first value indicated in the received list information, a respective encrypted second value, generating a zero-knowledge proof based on the received signature data, and transmitting the encrypted personal information, each encrypted second value, and the generated zero-knowledge proof to the server, wherein the server verifies whether the encrypted personal information further encrypted using the first random number coincides with an encrypted second value and verifies the zero-knowledge proof generated based on the received signature data. (2) The information processing method according to (1), further including transmitting the authentication request including the personal information. (3) The information processing method according to (1) or (2), wherein each encrypted first value is encrypted using a first random number. (4) The information processing method according to any of (1) to (3), wherein each encrypted first value represents an element included in a list. (5) The information processing method according to any of (1) to (4), wherein the encrypted personal information is encrypted using a second random number. (6) The information processing method according to any of (1) to (5), wherein each respective second value is encrypted using the second random number. (7) An information processing method including: generating list information, wherein the list information includes one or more encrypted first values, receiving, from a user terminal, encrypted personal information calculated based on personal information included in an authentication request for a signature, a respective second value encrypted using the second random number calculated for each encrypted first value indicated in the received list information, and a zero-knowledge proof generated based on the received signature data, calculating the encrypted personal information further encrypted using the first random number to verify whether the further encrypted personal information coincides with an encrypted second value, and verifying the zero-knowledge proof generated based on the received signature data. (8) The information processing method according to (7), wherein each encrypted first value is encrypted using a first random number. (9) The information processing method according to (7) or (8), wherein each encrypted first value represents an element included in a list. (10) The information processing method according to any of (7) to (9), wherein the encrypted personal information is encrypted using a second random number. (11) The information processing method according to any of (7) to (10), wherein each respective second value is encrypted using the second random number. (12) An information processing system including: a first information processing apparatus, and a second information processing apparatus, wherein the first information processing apparatus includes circuitry configured to receive signature data in response to an authentication request, receive list information from the second information processing apparatus, wherein the list information includes one or more encrypted first values, calculate encrypted personal information based on personal information included in the authentication request, calculate, for each encrypted first value indicated in the received list information, a respective encrypted second value, generate a zero-knowledge proof based on the received signature data, and transmit the encrypted personal information, each encrypted second value, and the generated zero-knowledge proof to the second information processing apparatus, and wherein the second information processing apparatus includes circuitry configured to generate the list information, receive, from the first information processing apparatus, the encrypted personal information, each respective second value calculated for a corresponding encrypted first value indicated in the received list information, and the zero-knowledge proof generated based on the received signature data, calculate further encrypted personal information to verify whether the further encrypted personal information coincides with an encrypted second value received from the first information processing apparatus, and verify the zero-knowledge proof generated based on the received signature data. (13) The information processing system according to (12), wherein the circuitry of the first information processing apparatus is further configured to transmit the authentication request including the personal information. (14) The information processing system according to (12) or (13), wherein each encrypted first value is encrypted using a first random number. (15) The information processing system according to any of (12) to (14), wherein each encrypted first value represents an element included in a list. (16) The information processing system according to any of (12) to (15), wherein the encrypted personal information is encrypted using a second random number. (17) The information processing system according to any of (12) to (16), wherein each respective second value is encrypted using the second random number. (18) An information processing method including: causing a processor to perform a first verification verifying whether or not a value obtained by an operation in which protected information encrypted with a first random number is further encrypted with a second random number is included in a list encrypted with the first and the second random numbers; and causing the processor to perform a second verification verifying authenticity of a zero-knowledge proof indicating that a signature is attached to the protected information. (19) The information processing method according to (18) above, in which the zero-knowledge proof further indicates that the protected information encrypted with the first random number is a value correctly calculated from the protected information. (20) The Information processing method according to (19) above, in which the first verification and the second verification are performed by a verification apparatus, and the verification apparatus receives from an authentication apparatus the protected information encrypted with the first random number and the zero-knowledge proof. (21) The information processing method according to (20) above, in which the verification apparatus encrypts the list with the second random number, and transmits the list encrypted with the second random number to the authentication apparatus. (22) The information processing method according to (21) above, in which the authentication apparatus further encrypts with the first random number the list encrypted with the second random number, and transmits the list encrypted with the first and the second random numbers to the verification apparatus. (23) The information processing method according to (22) above, in which the authentication apparatus shuffles an order of elements included in the list encrypted with the first and the second random numbers. (24) The information processing method according to any one of (18) to (23) above, further including: determining whether or not to provide a service according to a result of the first verification and a result of the second verification. (25) The information processing method according to any one of (18) to (24) above, in which the list includes a block list. (26) The information processing method according to (25) above, in which the block list includes an AML / CFT list. (27) The information processing method according to any one of (18) to (26) above, in which the protected information includes personal information of a user. (28) The information processing method according to (25) or (26) above, further including: providing a service in a case where it is confirmed that the protected information encrypted with the first and the second random numbers is not included in the list encrypted with the first and the second random numbers in the first verification and the authenticity of the zero-knowledge proof is confirmed in the second verification. (29) The information processing method according to any one of (18) to (28) above, in which the authentication apparatus attaches the signature to the protected information. (30) The information processing method according to any one of (18) to (29) above, further including: issuing a VC indicating whether or not the protected information encrypted with the first and the second random numbers is included in the list encrypted with the first and the second random numbers. (31) The information processing method according to any one of (20) to (23) above, in which the authentication apparatus includes an SSO server. (32) An information processing system including: a first verification part configured to verify whether or not a value obtained by an operation in which protected information encrypted with a first random number is further encrypted with a second random number is included in a list encrypted with the first and the second random numbers; and a second verification part configured to verify authenticity of a zero-knowledge proof indicating that a signature is attached to the protected information. (33) The information processing system according to (32) above, in which the zero-knowledge proof further indicates that the protected information encrypted with the first random number is a value correctly calculated from the protected information. (34) The information processing system according to (33) above, further including: an authentication part configured to generate the zero-knowledge proof by encrypting the protected information with the first random number. (35) The information processing system according to any one of (32) to (34) above, in which the list includes a block list. (36) The information processing system according to (35) above, in which the block list includes an AML / CFT list. (37) The information processing system according to any one of (32) to (36) above, in which the protected information includes personal information of a user.

[0199] 10: User terminal 110: Processing part 20: Service server 210: Processing part 220: Service provision part 30: Authentication apparatus 310: Authentication part 50: Another service server 55: SSO server 60: Personal information 70: Block list

Claims

An information processing method comprising:receiving signature data in response to an authentication request;receiving list information from a server, wherein the list information includes one or more encrypted first values;calculating encrypted personal information based on personal information included in the authentication request;calculating, for each encrypted first value indicated in the received list information, a respective encrypted second value;generating a zero-knowledge proof based on the received signature data; andtransmitting the encrypted personal information, each encrypted second value, and the generated zero-knowledge proof to the server,wherein the server verifies whether the encrypted personal information further encrypted using the first random number coincides with an encrypted second value and verifies the zero-knowledge proof generated based on the received signature data.The information processing method according to claim 1, further comprising:transmitting the authentication request including the personal information.The information processing method according to claim 1,wherein each encrypted first value is encrypted using a first random number.The information processing method according to claim 3,wherein each encrypted first value represents an element included in a list.The information processing method according to claim 3,wherein the encrypted personal information is encrypted using a second random number.The information processing method according to claim 5,wherein each respective second value is encrypted using the second random number.An information processing method comprising:generating list information, wherein the list information includes one or more encrypted first values;receiving, from a user terminal;encrypted personal information calculated based on personal information included in an authentication request for a signature,a respective second value encrypted using the second random number calculated for each encrypted first value indicated in the received list information, anda zero-knowledge proof generated based on the received signature data;calculating the encrypted personal information further encrypted using the first random number to verify whether the further encrypted personal information coincides with an encrypted second value; andverifying the zero-knowledge proof generated based on the received signature data.The information processing method according to claim 7,wherein each encrypted first value is encrypted using a first random number.The information processing method according to claim 8,wherein each encrypted first value represents an element included in a list.The information processing method according to claim 8,wherein the encrypted personal information is encrypted using a second random number.The information processing method according to claim 10,wherein each respective second value is encrypted using the second random number.An information processing system comprising:a first information processing apparatus; anda second information processing apparatus,wherein the first information processing apparatus includes circuitry configured toreceive signature data in response to an authentication request,receive list information from the second information processing apparatus, wherein the list information includes one or more encrypted first values,calculate encrypted personal information based on personal information included in the authentication request,calculate, for each encrypted first value indicated in the received list information, a respective encrypted second value,generate a zero-knowledge proof based on the received signature data, andtransmit the encrypted personal information, each encrypted second value, and the generated zero-knowledge proof to the second information processing apparatus, andwherein the second information processing apparatus includes circuitry configured togenerate the list information,receive, from the first information processing apparatus,the encrypted personal information,each respective second value calculated for a corresponding encrypted first value indicated in the received list information, andthe zero-knowledge proof generated based on the received signature data,calculate further encrypted personal information to verify whether the further encrypted personal information coincides with an encrypted second value received from the first information processing apparatus, andverify the zero-knowledge proof generated based on the received signature data.The information processing system according to claim 12,wherein the circuitry of the first information processing apparatus is further configured to transmit the authentication request including the personal information.The information processing system according to claim 12,wherein each encrypted first value is encrypted using a first random number.The information processing system according to claim 14,wherein each encrypted first value represents an element included in a list.The information processing system according to claim 14,wherein the encrypted personal information is encrypted using a second random number.The information processing system according to claim 16,wherein each respective second value is encrypted using the second random number.

Images