Method carried out by server, server, and storage medium, and method carried out by device, device, and storage medium

Abstract

This device may: homomorphically encrypt data of a user with a secret key for the user to generate a first homomorphic ciphertext; transmit, to a server, an authentication request message including the secret key and the first homomorphic ciphertext; receive, from the server, first information related to the first homomorphic ciphertext; generate second information on the basis of an inner product between the first information and the secret key; and on the basis of transmitting the second information to the server, receive, from the server, an authentication response message including acceptance or rejection of the authentication request message.

Description

A method performed by a server, a server and a storage medium, and a method performed by a device, a device and a storage medium

[0001] This specification relates to a method and apparatus for providing improved security services.

[0002] The challenge lies in finding a method to transmit information between two parties in a communication system while preventing a third party from obtaining it. For instance, in the field of electronic financial transactions, maintaining confidentiality between the two entities during the communication process is critical. To address security issues in communication, many techniques have been developed, such as private key cryptography and public key cryptography.

[0003] Private key cryptography is also known as symmetric key cryptography, symmetric encryption, secret key cryptography, or single key cryptography. In private key cryptography, a single secret key shared between the sending side and the receiving side is used for both encryption and decryption. This secret key is also referred to as a symmetric key or a private key. Although private key cryptography is a simple and easy-to-use encryption method, since the key must be shared between the sending side that sends information and the receiving side that receives the information, there is a risk that the key may be exposed to a third party who does not have the authority to read the information during the process of sharing the key between the sending side and the receiving side.

[0004] Public key cryptography is also known as asymmetric key cryptography or asymmetric encryption. In public key cryptography, a public key, which is made public for anyone to use, and a private key (also called a secret key), which is kept secret by the entity receiving the ciphertext encrypted with the public key, are used. Each entity on the network generates a pair of keys for encryption and decryption. When the sending side encrypts information using the recipient's public key and transmits the resulting ciphertext, the receiving side attempts to decrypt the ciphertext using its own private key. Ciphertext encrypted with a public key can only be decrypted using the private key that is paired with the public key. In public key cryptography, prior distribution of private keys is not required; for secure communication, if the sending side encrypts information using the receiving side's public key and transmits the resulting ciphertext, the receiving side can decrypt the ciphertext using the private key corresponding to the public key. However, in the case of public key cryptography, there is a possibility that a malicious user could impersonate the sending side and communicate with the receiving side. To prevent this, a trusted third party (TTP) (also referred to as a certificate authority, CA) may be utilized. For example, a certificate authority can certify the credentials of an entity identified by a digital certificate by issuing said digital certificate. The receiving party can verify said transmitting party through the digital certificate of said transmitting party, and once the verification of said transmitting party is successfully completed, it can decrypt the ciphertext received from said transmitting party using its own private key.

[0005] This specification provides a method to secure against the disadvantages caused by homomorphic encryption when the homomorphic encryption method is applied to the authentication process.

[0006] The technical problems that this specification aims to solve are not limited to those mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art related to this specification from the detailed description below.

[0007] In one aspect of the present specification, a method performed on a server is provided. In another aspect of the present specification, a server is provided comprising: at least one processor; and at least one computer memory operably connectable to the at least one processor and, when executed, storing instructions that cause the at least one processor to perform operations. In another aspect of the present specification, a computer-readable non-transient storage medium is provided, storing instructions that cause the at least one processor to perform operations when executed. The method, or the operations of the server or storage medium, comprises: receiving an authentication request message from a device comprising a user's secret key and a first homomorphic ciphertext; generating a third homomorphic ciphertext through a homomorphic operation regarding the similarity between the first homomorphic ciphertext and a second homomorphic ciphertext previously stored on the server in relation to the user, wherein the third homomorphic ciphertext comprises a mask a* and a body b*; transmitting first information including the mask a* to the device; and receiving second information d* from the device. It may include determining a similarity value d based on the second information d* and the body b*; and transmitting an authentication response message to the device, including acceptance or rejection of the authentication request message based on the similarity value d.

[0008] In each aspect of the specification, the similarity value d may be determined based on the difference between the body b* and the second information d*.

[0009] In each aspect of the specification, the similarity value d can be obtained by applying rounding to the difference between the body b* and the second information d*.

[0010] In each aspect of this specification, the similarity value d may be a binary sequence. The operation of the method, or the server or storage medium, may further include converting the binary sequence into a plaintext value μ.

[0011] In each aspect of the present specification, the operation of the method or the server or storage medium may further include determining acceptance or rejection of the authentication request message by comparing the plaintext value μ with a predetermined threshold τ.

[0012] In each aspect of the present specification, the third homomorphic ciphertext may be generated in the form of a tuple of the mask a* and the body d*.

[0013] In each aspect of the specification, the similarity value d may be related to the Hamming distance between the first homomorphic ciphertext and the second homomorphic ciphertext.

[0014] In another aspect of the present specification, a method performed in a device is provided. In another aspect of the present specification, a device is provided comprising: at least one processor; and at least one computer memory operably connectable to said at least one processor and, when executed, storing instructions that cause said at least one processor to perform operations. In another aspect of the present specification, a computer-readable non-transient storage medium is provided that stores instructions that cause said at least one processor to perform operations when executed. The operation of said method, or said device or storage medium, comprises: homomorphically encrypting said user data with a secret key for said user to generate a first homomorphic ciphertext;

[0015] In each aspect of the present specification, the operations of the method, or the device or storage medium may include: transmitting an authentication request message comprising the secret key and the first homomorphic ciphertext to a server; and receiving first information related to the first homomorphic ciphertext from the server; generating second information d* based on the inner product between the first information and the secret key; and receiving an authentication response message from the server comprising acceptance or rejection of the authentication request message based on transmitting the second information d* to the server.

[0016] In each aspect of this specification, the second information d* is d* =<a*, sk> It can be obtained based on + e*, where a* is the first information, sk is the secret key, and e* is the Gaussian error, and<a*, sk> is the inner product of a* and sk.

[0017] The above-mentioned problem-solving methods are merely some of the examples of this specification, and various examples reflecting the technical features of this specification can be derived and understood by a person with ordinary knowledge in the relevant technical field based on the detailed description below.

[0018] According to some implementations of this specification, since the (cloud) server is capable only of isomorphic operations, there is no need to transmit or store the private key in the management center.

[0019] According to some implementations of this specification, there is no need for an additional (cloud) server to directly perform decryption on the user's encrypted information.

[0020] According to some implementations of this specification, the result of authentication acceptance or rejection can be trusted because the user holding the private key cannot arbitrarily adjust the Hamming distance result value.

[0021] The effects of this specification are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art related to this specification from the detailed description below.

[0022] The attached drawings, included as part of the detailed description to aid in understanding the implementations of this specification, provide examples of the implementations of this specification and describe the implementations of this specification together with the detailed description:

[0023] FIG. 1 illustrates an example of a communication system 1 to which the implementations of the present specification are applied;

[0024] FIG. 2 is a block diagram illustrating examples of communication devices capable of performing the method according to the present specification;

[0025] FIG. 3 illustrates another example of a wireless device capable of performing implementation(s) of the present specification;

[0026] Figure 4 is an example of a homomorphic encryption model;

[0027] Figure 5 illustrates a general biometric authentication process;

[0028] FIG. 6 illustrates a general biometric authentication process using encrypted data;

[0029] FIG. 7 is illustrated to explain the authentication process according to some implementations of the present specification;

[0030] FIG. 8 illustrates the signal transmission / reception flow in a device according to some implementations of the present specification;

[0031] FIG. 9 illustrates the signal transmission / reception flow in a server according to some implementations of the present specification.

[0032] Implementations according to this specification are described in detail with reference to the accompanying drawings. The detailed description disclosed below, together with the accompanying drawings, is intended to describe exemplary implementations of this specification and is not intended to represent the only form in which this specification may be practiced. The following detailed description includes specific details to provide a complete understanding of this specification. However, those skilled in the art will know that this specification may be practiced without such specific details.

[0033] In some cases, to avoid ambiguity regarding the concepts of this specification, known structures and devices may be omitted or depicted in the form of block diagrams focusing on the core functions of each structure and device. Additionally, the same reference numerals are used to describe identical components throughout this specification.

[0034] The techniques, devices, and systems described below can be applied to various wireless multiple access systems. Examples of multiple access systems include CDMA (code division multiple access) systems, FDMA (frequency division multiple access) systems, TDMA (time division multiple access) systems, OFDMA (orthogonal frequency division multiple access) systems, SC-FDMA (single carrier frequency division multiple access) systems, and MC-FDMA (multi carrier frequency division multiple access) systems. CDMA can be implemented in wireless technologies such as UTRA (Universal Terrestrial Radio Access) or CDMA2000. TDMA can be implemented in wireless technologies such as GSM (Global System for Mobile communication), GPRS (General Packet Radio Service), and EDGE (Enhanced Data Rates for GSM Evolution) (i.e., GERAN). OFDMA can be implemented in wireless technologies such as IEEE (Institute of Electrical and Electronics Engineers) 802.11 (WiFi), IEEE 802.16 (WiMAX), IEEE 802-20, and E-UTRA (evolved-UTRA). UTRA is part of UMTS (Universal Mobile Telecommunication System), and 3GPP (3rd Generation Partnership Project) LTE (Long Term Evolution) is part of E-UMTS that utilizes E-UTRA.3GPP LTE adopts OFDMA for the downlink (DL) and SC-FDMA for the uplink (UL). LTE-A (LTE-advanced) is an evolved form of 3GPP LTE.

[0035] In this specification, a user (also referred to as a client) may refer to the communication device itself, or an entity that sends information or data related to itself to a server through said communication device. In this case, said communication device may be user equipment (UE). In this specification, a UE may be fixed or mobile, and includes various devices that communicate with a base station (BS) to transmit and / or receive user data and / or various control information. A UE may be referred to as Terminal Equipment, Mobile Station (MS), Mobile Terminal (MT), User Terminal (UT), Subscribe Station (SS), wireless device, Personal Digital Assistant (PDA), wireless modem, handheld device, etc. Furthermore, in this specification, a BS generally refers to a fixed station that communicates with a UE and / or other BSs, and exchanges various data and control information by communicating with a UE and other BSs. BS can be referred to by other terms such as ABS (Advanced Base Station), NB (Node-B), eNB (evolved-NodeB), BTS (Base Transceiver System), Access Point, and PS (Processing Server).

[0036] FIG. 1 illustrates an example of a communication system 1 to which the implementations of the present specification apply. Referring to FIG. 1, the communication system (1) to which the present specification applies includes a wireless device, a BS, and a network. Here, a wireless device refers to a device that performs communication using wireless access technology (e.g., 5G NR (New RAT), communication technology after 5G)) and may be referred to as a communication / wireless / 5G / 6G device. Although not limited thereto, a wireless device may include a robot (100a), a vehicle (100b-1, 100b-2), an XR (eXtended Reality) device (100c), a hand-held device (100d), a home appliance (100e), an IoT (Internet of Thing) device (100f), and an AI device / server (400). For example, a vehicle may include a vehicle equipped with wireless communication capabilities, an autonomous vehicle, a vehicle capable of performing inter-vehicle communication, etc. Here, vehicles may include UAVs (Unmanned Aerial Vehicles) (e.g., drones). XR devices include AR (Augmented Reality) / VR (Virtual Reality) / MR (Mixed Reality) devices and may be implemented in the form of HMDs (Head-Mounted Devices), HUDs (Head-Up Displays) equipped in vehicles, televisions, smartphones, computers, wearable devices, home appliances, digital signage, vehicles, robots, etc. Portable devices may include smartphones, smartpads, wearable devices (e.g., smartwatches, smart glasses), computers (e.g., laptops, etc.). Home appliances may include TVs, refrigerators, washing machines, etc. IoT devices may include sensors, smart meters, etc. For example, BS and networks may be implemented as wireless devices, and specific wireless devices may operate as BS / network nodes to other wireless devices.

[0037] Wireless devices (100a to 100f) can be connected to a network (300) via a BS (200). Artificial Intelligence (AI) technology may be applied to the wireless devices (100a to 100f), and the wireless devices (100a to 100f) can be connected to an AI server (400) via the network (300). The network (300) can be configured using a 3G network, a 4G (e.g., LTE) network, or a 5G (e.g., NR) network. The wireless devices (100a to 100f) may communicate with each other via the BS (200) / network (300), but they may also communicate directly (e.g., sidelink communication) without using the BS / network. For example, vehicles (100b-1, 100b-2) can communicate directly (e.g., V2V (Vehicle to Vehicle) / V2X (Vehicle to everything) communication). Also, IoT devices (e.g., sensors) can communicate directly with other IoT devices (e.g., sensors) or other wireless devices (100a to 100f).

[0038] Wireless communication / connection (150a, 150b) may be established between wireless devices (100a~100f) / BS (200) and BS (200) / wireless devices (100a~100f). Here, the wireless communication / connection may be established through uplink / downlink communication (150a) and sidelink communication (150b) (or D2D communication) using various wireless access technologies (e.g., 5G NR). Through the wireless communication / connection (150a, 150b), wireless devices and BS / wireless devices may transmit / receive wireless signals to / from each other. To this end, based on various proposals of the present specification, at least some of the following may be performed: a process for setting various configuration information for transmitting / receiving wireless signals, a process for various signal processing (e.g., channel encoding / decoding, modulation / demodulation, resource mapping / demapping, etc.), and a resource allocation process.

[0039] FIG. 2 is a block diagram illustrating examples of communication devices capable of performing the method according to the present specification. Referring to FIG. 2, a first wireless device (100) and a second wireless device (200) can transmit and / or receive wireless signals through various wireless access technologies (e.g., LTE, NR). Here, {the first wireless device (100), the second wireless device (200)} may correspond to {wireless device (100x), BS (200)} and / or {wireless device (100x), wireless device (100x)} of FIG. 1.

[0040] The first wireless device (100) includes one or more processors (102) and one or more memories (104), and may additionally include one or more transceivers (106) and / or one or more antennas (108). The processor (102) controls the memory (104) and / or transceivers (106) and may be configured to implement the functions, procedures and / or methods described / suggested below. For example, the processor (102) may process information within the memory (104) to generate a first information / signal and then transmit a wireless signal containing the first information / signal through the transceiver (106). Additionally, the processor (102) may receive a wireless signal containing a second information / signal through the transceiver (106) and then store information obtained from the signal processing of the second information / signal in the memory (104). Memory (104) may be connected to the processor (102) and may store various information related to the operation of the processor (102). For example, memory (104) may store software code containing instructions for performing some or all of the processes controlled by the processor (102) or for performing the procedures and / or methods described / suggested below. Here, the processor (102) and memory (104) may be part of a communication modem / circuit / chip designed to implement wireless communication technology (e.g., LTE, NR). A transceiver (106) may be connected to the processor (102) and may transmit and / or receive wireless signals through one or more antennas (108). The transceiver (106) may include a transmitter and / or receiver. The transceiver (106) may be interchangeably used with an RF (Radio Frequency) unit. In this specification, a wireless device may mean a communication modem / circuit / chip.

[0041] The second wireless device (200) includes one or more processors (202) and one or more memories (204), and may additionally include one or more transceivers (206) and / or one or more antennas (208). The processor (202) controls the memory (204) and / or transceivers (206) and may be configured to implement the functions, procedures and / or methods described / suggested below. For example, the processor (202) may process information within the memory (204) to generate a third information / signal and then transmit a wireless signal containing the third information / signal through the transceiver (206). Additionally, the processor (202) may receive a wireless signal containing a fourth information / signal through the transceiver (206) and then store information obtained from the signal processing of the fourth information / signal in the memory (204). Memory (204) may be connected to the processor (202) and may store various information related to the operation of the processor (202). For example, memory (204) may store software code containing instructions for performing some or all of the processes controlled by the processor (202) or for performing the procedures and / or methods described / suggested below. Here, the processor (202) and memory (204) may be part of a communication modem / circuit / chip designed to implement wireless communication technology (e.g., LTE, NR). A transceiver (206) may be connected to the processor (202) and may transmit and / or receive wireless signals through one or more antennas (208). The transceiver (206) may include a transmitter and / or receiver. The transceiver (206) may be interchangeably used with an RF unit. In this specification, a wireless device may mean a communication modem / circuit / chip.

[0042] Hereinafter, hardware elements of the wireless device (100, 200) will be described in more detail. Although not limited thereto, one or more protocol layers may be implemented by one or more processors (102, 202). For example, one or more processors (102, 202) may implement one or more layers (e.g., functional layers such as a physical (PHY) layer, a medium access control (MAC) layer, a radio link control (RLC) layer, a packet data convergence protocol (PDCP) layer, a radio resource control (RRC) layer, and a service data adaptation protocol (SDAP) layer). One or more processors (102, 202) may generate one or more protocol data units (PDU) and / or one or more service data units (SDU) according to the functions, procedures, proposals and / or methods disclosed in this document. One or more processors (102, 202) may generate messages, control information, data, or information according to the functions, procedures, proposals, and / or methods disclosed in this document. One or more processors (102, 202) may generate a signal (e.g., baseband signal) containing a PDU, SDU, message, control information, data, or information according to the functions, procedures, proposals, and / or methods disclosed in this document and provide it to one or more transceivers (106, 206). One or more processors (102, 202) may receive a signal (e.g., baseband signal) from one or more transceivers (106, 206) and may obtain a PDU, SDU, message, control information, data, or information according to the functions, procedures, proposals, and / or methods disclosed in this document.

[0043] One or more processors (102, 202) may be referred to as a controller, microcontroller, microprocessor, or microcomputer. One or more processors (102, 202) may be implemented by hardware, firmware, software, or a combination thereof. For example, one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), one or more Digital Signal Processing Devices (DSPDs), one or more Programmable Logic Devices (PLDs), or one or more Field Programmable Gate Arrays (FPGAs) may be included in one or more processors (102, 202). The functions, procedures, proposals, and / or methods disclosed in this document may be implemented using firmware or software, and the firmware or software may be implemented to include modules, procedures, functions, etc. Firmware or software configured to perform the functions, procedures, proposals, and / or methods disclosed in this document may be included in one or more processors (102, 202) or stored in one or more memories (104, 204) and driven by one or more processors (102, 202). The functions, procedures, proposals, and / or methods disclosed in this document may be implemented using firmware or software in the form of code, instructions, and / or sets of instructions.

[0044] One or more memories (104, 204) may be connected to one or more processors (102, 202) and may store various forms of data, signals, messages, information, programs, codes, instructions, and / or commands. One or more memories (104, 204) may be composed of ROM, RAM, EPROM, flash memory, hard drive, registers, cache memory, computer read storage media, and / or combinations thereof. One or more memories (104, 204) may be located inside and / or outside of one or more processors (102, 202). Additionally, one or more memories (104, 204) may be connected to one or more processors (102, 202) through various technologies such as wired or wireless connections.

[0045] One or more transceivers (106, 206) may transmit user data, control information, wireless signals / channels, etc., as mentioned in the methods and / or operation flowcharts, etc., of this document to one or more other devices. One or more transceivers (106, 206) may receive user data, control information, wireless signals / channels, etc., as mentioned in the functions, procedures, proposals, methods and / or operation flowcharts, etc., disclosed in this document from one or more other devices. For example, one or more transceivers (106, 206) may be connected to one or more processors (102, 202) and may transmit and / or receive wireless signals. For example, one or more processors (102, 202) may control one or more transceivers (106, 206) to transmit user data, control information, or wireless signals to one or more other devices. Additionally, one or more processors (102, 202) may control one or more transceivers (106, 206) to receive user data, control information, or wireless signals from one or more other devices. Additionally, one or more transceivers (106, 206) may be connected to one or more antennas (108, 208), and one or more transceivers (106, 206) may be configured to transmit and / or receive user data, control information, wireless signals / channels, etc., as mentioned in the functions, procedures, proposals, methods, and / or operation flowcharts disclosed in this document through one or more antennas (108, 208). In this document, one or more antennas may be multiple physical antennas or multiple logical antennas (e.g., antenna ports). One or more transceivers (106, 206) can convert the received wireless signal / channel, etc. from an RF band signal to a baseband signal in order to process the received user data, control information, wireless signal / channel, etc. using one or more processors (102, 202).One or more transceivers (106, 206) can convert user data, control information, wireless signals / channels, etc. processed using one or more processors (102, 202) from baseband signals to RF band signals. To this end, one or more transceivers (106, 206) may include (analog) oscillators and / or filters.

[0046] FIG. 3 illustrates another example of a wireless device capable of performing implementation(s) of the present specification. Referring to FIG. 3, the wireless device (100, 200) corresponds to the wireless device (100, 200) of FIG. 2 and may be composed of various elements, components, units / parts, and / or modules. For example, the wireless device (100, 200) may include a communication unit (110), a control unit (120), a memory unit (130), and an additional component (140). The communication unit may include a communication circuit (112) and transceiver(s) (114). For example, the communication circuit (112) may include one or more processors (102, 202) and / or one or more memories (104, 204) of FIG. 2. For example, the transceiver(s) (114) may include one or more transceivers (106, 206) and / or one or more antennas (108, 208) of FIG. 2. The control unit (120) is electrically connected to the communication unit (110), the memory unit (130), and additional components (140) and controls the general operation of the wireless device. For example, the control unit (120) may control the electrical / mechanical operation of the wireless device based on a program / code / command / information stored in the memory unit (130). Additionally, the control unit (120) may transmit information stored in the memory unit (130) to an external (e.g., another communication device) via a wireless / wired interface through the communication unit (110), or store information received from an external (e.g., another communication device) via a wireless / wired interface through the communication unit (110) in the memory unit (130).

[0047] The additional configuration (140) can be configured in various ways depending on the type of wireless device. For example, the additional configuration (140) may include at least one of a power unit / battery, an input / output unit (I / O unit), a driving unit, and a computing unit. Although not limited thereto, the wireless device may be implemented in the form of a robot (Fig. 1, 100a), a vehicle (Fig. 1, 100b-1, 100b-2), an XR device (Fig. 1, 100c), a portable device (Fig. 1, 100d), a home appliance (Fig. 1, 100e), an IoT device (Fig. 1, 100f), a UE for digital broadcasting, a hologram device, a public safety device, an MTC device, a medical device, a fintech device (or financial device), a security device, a climate / environment device, an AI server / device (Fig. 1, 400), a BS (Fig. 1, 200), a network node, etc. Wireless devices can be used in a movable or fixed location depending on the use—e.g., service.

[0048] In FIG. 3, various elements, components, units / parts, and / or modules within the wireless device (100, 200) may be entirely interconnected via a wired interface, or at least a portion may be wirelessly connected via a communication unit (110). For example, within the wireless device (100, 200), the control unit (120) and the communication unit (110) may be wired, and the control unit (120) and the first unit (e.g., 130, 140) may be wirelessly connected via the communication unit (110). Additionally, each element, component, unit / part, and / or module within the wireless device (100, 200) may include one or more additional elements. For example, the control unit (120) may be composed of one or more sets of processors. For example, the control unit (120) may be composed of a set of communication control processors, application processors, ECUs (Electronic Control Units), graphics processing processors, memory control processors, etc. As another example, the memory unit (130) may be composed of RAM (Random Access Memory), DRAM (Dynamic RAM), ROM (Read Only Memory), flash memory, volatile memory, non-volatile memory, and / or a combination thereof.

[0049] In this specification, at least one memory (e.g., 104 or 204) may store instructions or programs, and said instructions or programs may, when executed, cause at least one processor operablely connected to said at least one memory to perform operations according to some embodiments or implementations of this specification.

[0050] In this specification, a computer-readable (non-transient) storage medium may store at least one instruction or computer program, and when executed by at least one processor, said at least one instruction or computer program may cause said at least one processor to perform operations according to some embodiments or implementations of this specification.

[0051] In this specification, a processing device or apparatus may include at least one processor and at least one computer memory connectable to said at least one processor. said at least one computer memory may store instructions or programs, and said instructions or programs, when executed, may cause at least one processor operablely connected to said at least one memory to perform operations according to some embodiments or implementations of this specification.

[0052] In this specification, a computer program may include program code stored on at least one computer-readable (non-transient) storage medium and, when executed, perform operations according to some implementations of this specification or cause at least one processor to perform operations according to some implementations of this specification. The computer program may be provided in the form of a computer program product. The computer program product may include at least one computer-readable (non-transient) storage medium.

[0053] A communication device of this specification comprises at least one processor; and at least one computer memory operably connected to said at least one processor and storing instructions that, when executed, cause said at least one processor to perform operations according to the examples(s) of this specification described below.

[0054] In some implementations of this specification, the user or client may be a communication device described in FIG. 2 or FIG. 3 or an entity that performs transmission / reception through said communication device.

[0055] In some implementations of this specification, the (cloud) server may be a communication device, a processing device, or an object on which such communication / processing device is installed as described in FIG. 2 or FIG. 3, and / or an object connected wirelessly and / or wired to another server or a trusted party.

[0056] Various encryption methods have been proposed to address security issues in communications. However, according to conventional encryption methods, if a receiving end needs to perform verification or operations on user data contained in ciphertext received from a transmitting end, said receiving end can only perform such verification or operations after decrypting the data to obtain the plaintext. However, if the plaintext contains information of critical security importance, such as personal information, there is a problem in that such personal information is exposed to the receiving end. To resolve this issue, the introduction of homomorphic cryptography into communication systems, which allows operations to be performed on encrypted data without decryption, is being discussed. Below, several implementations of this specification regarding methods for transmitting and analyzing user data in an encrypted state between communication devices or between a communication device and a server by adopting homomorphic encryption (HE) techniques are described. The following notations are used in this specification.

[0057] - λ: security parameter

[0058] - m: plaintext message

[0059] - ct: Ciphertext from homomorphic encryption (HE)

[0060] - pk: HE public key

[0061] - sk: HE secret key

[0062] - Enc: Encryption algorithm or encryptor

[0063] - Dec: Decryption algorithm or decryptor

[0064] - Eval: Isomorphic operation (also called evaluation)

[0065] Homomorphic encryption (HE), or homomorphic cryptography, is an encryption technique utilized within a user-server model that enables operations between ciphertexts (without decryption). In the HE realm, a user transmits encrypted data to a server, the server performs operations on the encrypted data while it remains encrypted, and provides the result(s) of the operations to the user. Through this, the user can delegate computations to the server without revealing their data.

[0066] The size of the ciphertext obtained through encryption increases compared to the size of the plaintext. The ciphertext obtained by applying homomorphic encryption to plaintext is significantly larger than the ciphertext obtained by applying conventional symmetric key encryption (i.e., private key or secret key encryption) or conventional asymmetric key encryption (i.e., public key encryption) to the same plaintext. Therefore, compared to other encryption techniques, homomorphic encryption requires significantly more network resources to transmit and / or receive the encryption results. Furthermore, analyzing or processing the ciphertext obtained through homomorphic encryption at the receiving end also requires greater performance and / or capacity compared to other encryption techniques.

[0067] Homomorphic encryption techniques are explained in more detail below.

[0068] Homomorphic Encryption (HE)

[0069] HE is a quantum-resistant cryptography based on the Leaning With Error (LWE) problem. A distinguishing feature of HE compared to conventional cryptography is an additional step involving the operation Eval between ciphertexts.

[0070] In traditional encryption models, data is shared between a user and a server through an end-to-end encryption process in which the data remains secure during transmission. However, HE provides the capability for operations between ciphertexts (e.g., addition and / or multiplication between ciphertexts) through an evaluation phase (i.e., a computational process). Thus, HE brings an innovative twist to the encryption system by incorporating an evaluation phase that operates directly on the encrypted data or ciphertext. Unlike the traditional approach where the server is granted the capability to decrypt the data, HE does not provide the decryption key to the server, thereby preventing the server from accessing the plaintext data. Despite these restrictions, HE enables the server to perform specific computation(s) on the ciphertext. Using this unique feature, computationally intensive operations that might be too burdensome for the user can be offloaded to the server, provided the server possesses sufficient computational resources.

[0071] Homomorphic encryption can follow the basic premises of public-key cryptography or asymmetric-key cryptography. Public-key cryptography utilizes a public key that is made public for anyone to use, and a private key (also called a secret key) that is kept secret by the user who receives the ciphertext encrypted with the public key. Since ciphertext encrypted with a public key can only be decrypted using the private key paired with that public key, public-key cryptography does not require the prior distribution of private keys.

[0072] CKKS("Cheon, JH, Kim, A., Kim, M., & Song, Y. (2017). Homomorphic encryption for arithmetic of approximate numbers. In Advances in Cryptology-ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I23 (pp. 409-437) and TFHE (see "Chillotti, I., Gama, N., Georgieva, M., & Izabachne, M. (2020). TFHE: fast fully homomorphic encryption over the torus. Journal of Cryptology, 33(1), 34-91.").

[0073] - Leveled Homomorphic Encryption vs. Fully Homomorphic Encryption: To address the noise issues inherent in homomorphic encryption, fully homomorphic encryption provides a bootstrapping function to eliminate noise. A key advantage of fully homomorphic encryption is that it allows for additional operations between ciphertexts by reducing noise through bootstrapping. Leveled homomorphic encryption, on the other hand, omits the bootstrapping process and designs the circuit by carefully setting parameters for a fixed circuit size. Generally, it offers faster circuit operation times than fully homomorphic encryption.

[0074] The CKKS technique enables efficient operations in the real number domain, provides approximate results, and supports addition and multiplication operations. There is a parameter called depth that determines the number of possible multiplication operations, and additional multiplications are possible using bootstrapping.

[0075] - The TFHE technique designs these isomorphic gates, which enable the design of arbitrary operations using basic isomorphic gates (e.g., NAND, OR, AND). Since the TFHE technique uses bootstrapping for all gate operations, there is no limit to the number of operations.

[0076] Among various HE-based libraries, the TFHE technique can generally include the following steps and functions:

[0077] - ParaGen(λ): Generates various parameters depending on the security level λ. Examples of parameters may include the variance of noise α, the dimensions of LWE samples, etc.

[0078] - KeyGen(Params): Once the parameters are established, various keys are generated. These keys include a secret key sk and a public key pk. The secret key sk is used for encryption and decryption, while the evaluation key evk, generated using the public key, is used for operations between ciphertexts.

[0079] - Enc(m; sk): Encrypts message m with secret key sk to generate LWE ciphertext ct.

[0080] - Dec(ct; sk): Decrypts ciphertext ct with secret key sk to retrieve message m.

[0081] - Eval(f; pk, ct1, ct2): Performs operation f on ciphertexts ct1 and ct2 using the public key pk. Typically, Eval involves addition and / or multiplication between ciphertexts.

[0082] The encryption and decryption processes of the TFHE technique can be performed, for example, as follows.

[0083] In the encryption process of the TFHE technique, the user uses a plaintext message m and a secret key sk as inputs to generate two elements, a mask a and a body b, to encrypt m.

[0084] a is generated as a random vector, and b is calculated as follows: b=<a,sk> +m+e, where e is a small noise value, and < , > represent the inner product between two elements. A random vector a is usually a discretized torus space T q It can be a vector randomly sampled from.

[0085] Therefore, the LWE ciphertext ct consists of a tuple (a,b).

[0086] A homomorphic operation on the ciphertext ct for message m can be performed on the authentication server, and the result value ct* of the homomorphic operation on the ciphertext ct is returned to the user. Using the returned ct* = (a*,b*) and the secret key sk as input, the decryption process proceeds as follows.

[0087] Encrypted b* is b* =<a*,sk> It can be expressed as +m+e, and the first step of the decryption process calculates the following using the ciphertext ct* and secret key sk: m* = b* -<a*,sk> Here, m* can be expressed as follows: m* = (<a*,sk> +m+e) -<a*,sk> Simplifying this calculation, it can be expressed as m* = m+e.

[0088] The original plaintext message m can be restored by removing error e through rounding.

[0089] In some implementations of this specification, a communication device or a processing device may include a memory that contains / stores instructions for performing operations according to the above functions when executed by at least one processor.

[0090] Figure 4 is an example of a homomorphic encryption model. In particular, Figure 4 illustrates the fast fully homomorphic encryption scheme over the torus (TFHE) model among homomorphic encryption models.

[0091] To explain the concept of HE, an HE model including two entities, a user (i.e., a client) and a server, can be considered. This model focuses on the user's goal of delegating computational tasks to the server. In the example of Figure 4, data can be shared between the user and the server through the following process.

[0092] 1. The user generates parameters Params based on security level λ, along with a secret key sk and a public key pk.

[0093] 2. The user encrypts messages m1 and m2 using the secret key sk to generate ciphertexts ct1 and ct2, and sends them to the server along with the public key pk.

[0094] 3. Using the above public key pk, the server evaluates the ciphertexts ct1 and ct2 (i.e., performs operations on the ciphertexts ct1 and ct2) to generate the ciphertext ct*, which is the encryption of f(m1, m2). Then, the result is transmitted to the user.

[0095] 4. The user decrypts the ciphertext ct* using the secret key sk to obtain the result m*. Therefore, in FIG. 4, decryption occurs only on the user's side.

[0096] According to this framework, data privacy is maintained because decryption never occurs outside the user's domain.

[0097] To aid in understanding some of the implementations of this specification described below, a general biometric authentication process among the various authentication methods currently in use is briefly explained.

[0098] Biometric Authentication

[0099] Biometric authentication is a technology that verifies identity using an individual's biometric information, providing high security by utilizing unique biometric characteristics specific to each person. Major biometric characteristics used in authentication include fingerprints, facial features, iris patterns, voice, and vein patterns.

[0100] Figure 5 illustrates a general biometric authentication process.

[0101] Biometric authentication consists of two main phases, enrollment and authentication, as exemplified in Fig. 5.

[0102] 1. Enrollment

[0103] The registration phase is the process in which a user's biometric information is first entered into and stored in the system. The registration phase may include the following important steps.

[0104] *Data Collection: This is the step in which a device, an authentication system within the device, or an application first acquires the user's biometric information. For example, in the case of iris recognition, an iris image is captured using a scanner equipped with an iris sensor.

[0105] * Preprocessing and Feature Extraction: The device, or the authentication system or application within the device, performs tasks such as noise removal and image correction to analyze the collected biometric data. This step improves data quality, thereby increasing the accuracy of subsequent steps. Subsequently, unique features are extracted from the biometric data. For example, in the case of iris recognition, the device, the authentication system, or the application within the device analyzes the iris pattern to extract features.

[0106] *Data Storage: The extracted feature data is securely stored on the server. This data is later used to verify the user's identity during the authentication phase.

[0107] 2. Authentication

[0108] The authentication phase is the process of verifying that the user is an identity registered in the system, and this phase can also consist of several important procedures or steps.

[0109] *Data Acquisition: The user's biometric information is acquired again for authentication. For example, the user's iris is scanned to allow the user to pass through a door.

[0110] * Preprocessing and Feature Extraction: Similar to the registration phase, the acquired biometric information is preprocessed, and features of the biometric information are extracted. The processing method in this process may be the same as the processing method in the registration phase.

[0111] *Matching: Feature data extracted from the user seeking authentication is compared with data stored on the server during the registration phase. In this process, a matching algorithm is used to calculate the similarity between the two sets of data.

[0112] Decision: The user's identity is verified based on the matching results. If the similarity exceeds a certain threshold, authentication is considered successful; otherwise, it may be deemed a failure.

[0113] Matching algorithm

[0114] Various matching algorithms can be used during the authentication process to verify whether data stored on the server matches the data requiring authentication. A representative matching algorithm is the Hamming distance. Hamming distance is the difference between two binary strings, representing the number of distinct bits at the same position. For example, the Hamming distance between the binary strings "101010" and "100110" is 2 because the third and fifth bits differ. In biometric authentication, Hamming distance is primarily used in the following cases.

[0115] * Comparison of binarized biometric data

[0116] Biometric data (e.g., iris, fingerprint, facial features, etc.) is often converted into binary form and stored. During the authentication phase, newly acquired biometric data is converted into binary form and compared with registered data. At this stage, the difference between the two binary data is measured using the Hamming distance. A smaller Hamming distance indicates greater similarity between the two data, and if the Hamming distance is below a certain threshold, authentication is deemed successful.

[0117] Error detection and correction

[0118] Biometric data can be subject to errors due to various factors. Hamming distance is useful for detecting and correcting these errors. For example, in iris recognition, some bits may be recognized differently depending on the position of the iris or the brightness of the light. Authentication systems can enhance the reliability of authentication by using Hamming distance to allow these small differences and treating differences within a certain range as identical data.

[0119] Similarity measurement

[0120] Similarity measurement is crucial for enhancing accuracy and security in biometric authentication systems. Hamming distance is a tool that can simply and effectively measure the similarity between binarized biometric data. This is particularly useful in biometric authentication systems that require high accuracy.

[0121] Figure 6 illustrates a general biometric authentication process using encrypted data.

[0122] According to current research on biometric authentication, biometric authentication that protects data privacy mostly proceeds through a process similar to the example in Fig. 5. The user encrypts the biometric data extracted through the device and the identifier (identity, ID) together and transmits them to an authentication server. The encrypted user's biometric data template and ID are stored in a database within the authentication server.

[0123] Another user (who may or may not be the actual user) seeking user authentication extracts biometric data through a process similar to the aforementioned registration phase, encrypts the biometric data along with an ID, and transmits it to an authentication server. The authentication server searches for the biometric data of a previously registered user and determines, through a matching algorithm, whether the previously registered user and the user requesting authentication this time are the same. For example, if Hamming distance is used as the matching algorithm, the authentication server determines that authentication is successful (e.g., see "Accept" in FIG. 6) if the Hamming distance between the previously registered biometric template for the ID and the biometric template provided with the authentication request this time for the ID is less than or equal to a certain threshold τ, and determines that authentication is failed (e.g., see "Reject" in FIG. 6) otherwise.

[0124] The biggest difference between biometric authentication without encryption and biometric authentication using encrypted data is that in the latter case, biometric data is encrypted and transmitted to the authentication server. Particularly in the case of homomorphic encryption, since the authentication server proceeds with the matching process in an encrypted state, the authentication server cannot know information regarding the user's biometric data. Therefore, personal privacy can be protected.

[0125] In currently used or previously proposed authentication systems (e.g., biometric authentication systems), since the user generates their own private key and directly registers biometric information with a cloud server (also called an authentication server), the private key remains possessed by the user. When a server transmits a biometric matching result to a user and the user directly decrypts it using their private key and returns it, the server cannot detect whether the result is actually the decryption of the Hamming distance between biometric templates or the decryption of an arbitrarily calculated Hamming distance.

[0126] Furthermore, existing biometric authentication methods utilizing encrypted data employ methods such as maintaining a separate key management center to prevent the leakage of secret keys (sk), generating a master key and then creating a separate secret key (sk) based on it to encrypt the biometric template before sending it to an authentication server, or combining data and the secret key (sk) to generate a unique Message Authentication Code (MAC) and then transmitting it to the authentication server along with the encrypted biometric template. However, these methods increase computational costs due to the need for additional computations, impose a burden on key management due to the risk that the secret key (sk) may be leaked or compromised, and, in the case of a key management center, pose a burden on centralized management and may lead to threats from insiders who can access the center. Additionally, they cause problems such as the risk of exposure to third parties during the transmission of the secret key (sk) and complexity resulting from the use of additional encryption protocols for key exchange.

[0127] Meanwhile, in the case of existing biometric authentication methods utilizing encrypted data, the decision to accept or reject biometric authentication (i.e., determining success or failure) generally rests entirely with the authentication server. However, if the authentication server makes the acceptance or failure decision entirely, it poses a threat to the security of the entire system because an attacker could manipulate the authentication process of the entire system if the server is hacked or compromised. Furthermore, since the operator of the authentication server holds the sole authority to determine the authentication outcome, they can intentionally block or allow access for specific users or groups, potentially significantly undermining the fairness and reliability of the system.

[0128] These problems can occur not only in biometric information but also in other authentication systems that utilize personal information. Several implementations of this specification that can mitigate or prevent these problems are described below. For the sake of convenience of explanation, the implementations of this specification are described using biometric authentication as an example; however, several implementations of this specification can be used in authentication processes for personal information or various types of information requiring security, in addition to biometric authentication.

[0129] Implementations of this specification are described below in which authentication can be performed even if the secret key sk of a user or for said user is owned only by said user and is not provided to a third entity such as a server or a key management center. Some implementations of this specification are described below in which a user performs partial decryption using the secret key sk they possess to decrypt some of the values ​​necessary to determine the success or failure of authentication, and a server performs final decryption to finally perform the calculation to determine the success or failure of authentication.

[0130] FIG. 7 is illustrated to explain the authentication process according to some implementations of the present specification. In FIG. 7, for convenience of explanation, some implementations of the present specification are described using a user's biometric information (hereinafter, biometric template) as an example of user data / information; however, the authentication process according to some implementations of the present specification may be applied not only to biometric information but also to a user's personal information or various data requiring security. In the example of FIG. 7, User X and User Y may or may not be the same, but it is assumed that User X and User Y use the same identification information ID and the same password PW. In the example of FIG. 7, Device A and Device B may or may not be the same.

[0131] The authentication process according to some implementations of this specification is carried out by applying homomorphic encryption techniques (e.g., including the TFHE library) and proceeds through two phases of registration and authentication, similar to general biometric authentication or biometric authentication for encrypted data.

[0132] Referring to FIG. 7(a), during the registration phase, User X sends their data (e.g., biometric template) to the authentication server. To store ), identification information ID and password PW can be entered into the device (S1a). In the device, the password PW can be used to generate a secret key sk and a public key pk (S2a). The device encrypts the biometric template using the secret key sk to obtain an encrypted biometric template Generates the encrypted biometric template (S3a). It is transmitted from device A to the authentication server along with the identification information ID and the public key pk (S4a). The encrypted biometric template of user X is stored in the database of the authentication server. The above identification information ID is stored.

[0133] Referring to FIG. 7(b), in the authentication phase, following the same method as in the registration phase, User Y [obtains] the encrypted biometric template of User X An identification information ID (identical to the identification information registered by User X) and an encrypted biometric template stored in the aforementioned authentication server It may provide (S1b ~ S4b). Subsequently, for the matching operation, the authentication server (to verify that User X and User B are the same person) the encrypted biometric template of User X stored in the registration phase To find (S5b), and The Hamming distance d between them isomorphically calculated using the public key pk, and the encrypted Hamming distance Enc sk(d) can be obtained (S6b). This means the authentication server uses the evaluation key generated using the public key pk to Eval(HD; pk, , It can be understood as performing ), where "HD" may refer to an operation for calculating the Hamming distance. The above encrypted Hamming distance Enc sk (d) consists of a tuple (a*, b*), where a* is Enc sk It is a mask for (d), and b* is Enc sk This is the body for (d). In other words, the above encrypted Hamming distance Enc sk (d) is a tuple (a * , b * It can be generated in the form of ).

[0134] The above authentication server [uses] the encrypted Hamming distance Enc obtained as the result value of the above matching. sk Partial information regarding (d) is transmitted to the user Y (S7b). For example, the authentication server may return a mask a*, which is the result of the encrypted Hamming distance, to the user. Referring to FIG. 7(b), the authentication server [represents] the ciphertext Enc sk When (d) is generated, a randomly generated mask a* can be returned to the user Y.

[0135] In some implementations of this specification, it is assumed that for the same ID, a user has or can obtain a secret key identical to the secret key generated during the registration process. User Y, having secret key sk, can obtain information d* by performing a calculation on the aforementioned partial information (S8b) (hereinafter referred to as the "partial decryption process"). For example, in the partial decryption process, the user samples an error e* for the ciphertext ct* = (a*, b*) and secret key sk, and the value d* =<a*, sk> + e* can be calculated. In this case, the error e* may be a Gaussian error obtained by discretely sampling a Gaussian distribution. Referring to Fig. 7(b), the user Y, based on the mask a* received from the authentication server,<a*, sk> + e* = d* can be obtained. Shopping mall user Y can return the value d* to the authentication server.

[0136] The authentication server may perform a final decoding process based on the value d* returned from the user Y (S9b). In this specification, the final decoding process refers to a process including decoding. The final decoding process may include determining a result value d through Hamming distance calculation and determining authentication acceptance or authentication rejection based on the result value d. Rounding may be applied to the result value d through Hamming distance calculation if necessary, and decoding may be applied to convert the result value d in binary form into another form.

[0137] For example, the authentication server can perform decryption on the result d obtained by calculating d = b* - d*. In reality, considering noise during the encryption and decryption processes, the error e - e* still remains in the result d for final decryption; however, the authentication server can remove the error e - e* by rounding the result d to the nearest message space. Since the magnitudes of error e and error e* are generally much smaller than 1 (for example, in the case of the TFHE technique, the noise corresponding to the error is smaller than 1 / 16), they can be removed through rounding. Assuming that the encryption / decryption process is applied to the binary Hamming distance d, the authentication server can obtain a result d in binary format where each digit is either 0 or 1 by calculating d = b* - d* and rounding. In other words, a result d in the form of a bit sequence where each digit is either 0 or 1 can be obtained. The authentication server can decode the binary-formatted result value d and convert it into a plaintext value μ of Hamming distance d. For example, if the result value d = 111, the result value d = 111 can be converted into a plaintext value μ = 8. The authentication server can determine whether to approve or reject authentication by comparing the plaintext value μ with a reference value τ used to determine whether two users to be authenticated are the same or different (S10b).

[0138] In the example of FIG. 7, if the user Y is the same as the user X and It is similar so authentication will be approved, and if the above user Y is different from the above user X and Authentication will be rejected because they are not similar. The authentication server may return an authentication result of authentication approval or authentication rejection to the user Y.

[0139] Since the Hamming distance can be easily calculated by the XOR operation, which is a bitwise operation, some implementations of this specification are described in the example of FIG. 7 where the Hamming distance is used as a matching algorithm for similarity calculation. However, other similarity functions using LWE-based ciphertexts (e.g., Euclidean distance, Mahalanobis distance, Manhattan distance, etc.) may also be used as matching algorithms in authentication processes or systems according to some implementations of this specification.

[0140] According to some implementations of the aforementioned specification, since the user possesses the secret key sk and does not share it with third entities such as a server or key management center, it can be free from problems arising in existing biometric authentication methods related to the secret key. Furthermore, according to some implementations of the present specification, a third-party trusted or certification authority, which is used in existing public-key cryptography to prevent the possibility of a malicious attacker impersonating the user of data transmission and communicating with the server, does not need to exist. In addition, unlike existing biometric authentication methods utilizing encrypted data where the acceptance and rejection of biometric authentication (i.e., success and failure of biometric authentication) is determined entirely by the authentication server, according to some implementations of the present specification, some of the processes for determining acceptance / rejection of biometric authentication are performed by the user and the rest by the server. Therefore, various problems that may occur in a centralized authentication system where the authentication server entirely determines acceptance / failure of authentication can be prevented.

[0141] FIG. 8 illustrates a signal transmission / reception flow in a device according to some implementations of the present specification. A device acting as a user or a device used by said user may perform operations according to some implementations of the present specification in relation to data transmission. The device may include at least one transceiver; at least one processor; and at least one computer memory operably connected to said at least one processor and storing instructions that, when executed, cause said at least one processor to perform operations according to some implementations of the present specification. A processing device for said device may include at least one processor; and at least one computer memory operably connected to said at least one processor and storing instructions that, when executed, cause said at least one processor to perform operations according to some implementations of the present specification. A computer-readable (non-transient) storage medium may store at least one computer program including instructions that, when executed by said at least one processor, cause said at least one processor to perform operations according to some implementations of the present specification. A computer program or computer program product is written on at least one computer-readable (non-transient) storage medium and may include instructions that, when executed, cause (at least one processor) to perform operations according to some implementations of this specification.

[0142] Referring to FIG. 8, in a method performed by the device, or in the server, the processing device, the computer-readable (non-transient) storage medium, and / or the computer program product, the operations may include: generating a first homomorphic ciphertext by homomorphically encrypting the user's data with a secret key for the user (S801); transmitting an authentication request message to the server containing the secret key and the first homomorphic ciphertext (S802); receiving first information related to the first homomorphic ciphertext from the server (S803); generating second information d* based on the inner product between the first information and the secret key (S804); and receiving an authentication response message from the server containing acceptance or rejection of the authentication request message based on transmitting the second information d* to the server (S805).

[0143] In some implementations of this specification, the second information d* is d* =<a*, sk> It can be obtained based on + e*, where a* is the first information, sk is the secret key, and e* is the Gaussian error, and<a*, sk> is the inner product of a* and sk.

[0144] FIG. 9 illustrates a signal transmission / reception flow in a server according to some implementations of the present specification. The server may perform operations according to some implementations of the present specification in relation to data transmission / reception. The server may include at least one transceiver; at least one processor; and at least one computer memory operably connected to the at least one processor and storing instructions that, when executed, cause the at least one processor to perform operations according to some implementations of the present specification. A processing device for the server may include at least one processor; and at least one computer memory operably connected to the at least one processor and storing instructions that, when executed, cause the at least one processor to perform operations according to some implementations of the present specification. A computer-readable (non-transient) storage medium may store at least one computer program including instructions that, when executed by at least one processor, cause the at least one processor to perform operations according to some implementations of the present specification. A computer program or computer program product is written on at least one computer-readable (non-transient) storage medium and may include instructions that, when executed, cause (at least one processor) to perform operations according to some implementations of this specification.

[0145] Referring to FIG. 9, in a method performed by the server, or in the server, the processing device, the computer-readable (non-transient) storage medium, and / or the computer program product, the operations may include: receiving an authentication request message from a device containing a user's secret key and a first homomorphic ciphertext (S901); generating a third homomorphic ciphertext through a homomorphic operation regarding similarity between the first homomorphic ciphertext and a second homomorphic ciphertext previously stored in the server in relation to the user (S902), wherein the third homomorphic ciphertext includes a mask a* and a body b*; transmitting first information including the mask a* to the device (S903); receiving second information d* from the device (S904); determining a similarity value d based on the second information d* and the body b* (S905); and transmitting an authentication response message to the device including acceptance or rejection of the authentication request message based on the similarity value d (S906).

[0146] In some implementations, the similarity value d can be determined based on the difference between the body b* and the second information d*.

[0147] In some implementations, the similarity value d can be obtained by applying rounding to the difference between the body b* and the second information d*.

[0148] In some implementations, the similarity value d is a binary sequence, and the method or operations may further include converting the binary sequence into a plaintext value μ.

[0149] In some implementations, the method or operations may further include comparing the plaintext value μ with a predetermined threshold τ to determine acceptance or rejection of the authentication request message.

[0150] In some implementations, the third homomorphic ciphertext may be generated in the form of a tuple of the mask a* and the body d*.

[0151] In some implementations, the similarity value d may be related to the Hamming distance between the first homomorphic ciphertext and the second homomorphic ciphertext.

[0152] As described above, the examples of this specification disclosed are provided to enable a person skilled in the art related to this specification to implement and practice this specification. Although the foregoing has been described by reference to the examples of this specification, a person skilled in the art may modify and change the examples of this specification in various ways. Accordingly, this specification is not intended to be limited to the examples described herein, but to be given the broadest possible scope consistent with the principles and novel features disclosed herein.

[0153] Implementations of this specification may be used in authentication systems, user devices or servers, or other equipment.

Claims

1. Receive an authentication request message from a device containing the user's secret key and a first homomorphic ciphertext; A third homomorphic ciphertext is generated through a homomorphic operation regarding the similarity between the first homomorphic ciphertext and a second homomorphic ciphertext previously stored on a server in relation to the user, wherein the third homomorphic ciphertext includes a mask a* and a body b*; Transmitting first information including the above mask a* to the device; Receive second information d* from the above device; Determining a similarity value d based on the second information d* and the body b*; and Includes transmitting an authentication response message to the device, including acceptance or rejection of the authentication request message based on the similarity value d. Method performed on the server.

2. In Paragraph 1, The above similarity value d is determined based on the difference between the body b* and the second information d*, Method performed on the server.

3. In Paragraph 1, The above similarity value d is obtained by applying rounding to the difference between the body b* and the second information d*, Method performed on the server.

4. In Paragraph 1, The above similarity value d is a binary sequence, and Further comprising converting the above binary sequence into a plaintext value μ, Method performed on the server.

5. In Paragraph 4, Further comprising comparing the plaintext value μ with a predetermined threshold τ to determine acceptance or rejection of the authentication request message, Method performed on the server.

6. In Paragraph 1, The above third homomorphic ciphertext is generated in the form of a tuple of the mask a* and the body d*, Method performed on the server.

7. In Paragraph 1, The above similarity value d is related to the Hamming distance between the first homomorphic ciphertext and the second homomorphic ciphertext, Method performed on the server.

8. At least one processor; and It includes at least one computer memory operablely connectable to the at least one processor and, when executed, stores instructions that cause the at least one processor to perform operations, wherein the operations are: Receive an authentication request message from the device containing the user's secret key and a first homomorphic ciphertext; A third homomorphic ciphertext is generated through a homomorphic operation regarding the similarity between the first homomorphic ciphertext and a second homomorphic ciphertext previously stored on a server in relation to the user, wherein the third homomorphic ciphertext includes a mask a* and a body b*; Transmitting first information including the above mask a* to the device; Receive second information d* from the above device; Determining a similarity value d based on the second information d* and the body b*; and Includes transmitting an authentication response message to the device, including acceptance or rejection of the authentication request message based on the similarity value d. Server.

9. A computer-readable, non-transient storage medium storing instructions that, when executed, cause at least one processor to perform operations, wherein the operations are: Receive an authentication request message from the device containing the user's secret key and a first homomorphic ciphertext; A third homomorphic ciphertext is generated through a homomorphic operation regarding the similarity between the first homomorphic ciphertext and a second homomorphic ciphertext previously stored on a server in relation to the user, wherein the third homomorphic ciphertext includes a mask a* and a body b*; Transmitting first information including the above mask a* to the device; Receive second information d* from the above device; Determining a similarity value d based on the second information d* and the body b*; and Includes transmitting an authentication response message to the device, including acceptance or rejection of the authentication request message based on the similarity value d. Storage medium.

10. Generate a first homomorphic ciphertext by homomorphically encrypting the user's data with a secret key for the user; Transmitting an authentication request message to a server that includes the secret key and the first homomorphic ciphertext; and Receiving first information related to the first homomorphic ciphertext from the server; Generate second information d* based on the inner product between the first information and the secret key; and Based on transmitting the second information d* to the server, receiving an authentication response message from the server including acceptance or rejection of the authentication request message, Method performed on the device.

11. In Paragraph 10, The above second information d* is d* =<a*, sk> It is obtained based on + e*, where a* is the first information, sk is the secret key, and e* is the Gaussian error, and<a*, sk> is the internal of a* and sk, Method performed on the device.

12. At least one processor; and It includes at least one computer memory operablely connectable to the at least one processor and, when executed, stores instructions that cause the at least one processor to perform operations, wherein the operations are: Generate a first homomorphic ciphertext by homomorphically encrypting the user's data using a secret key for the user; Transmitting an authentication request message to a server that includes the secret key and the first homomorphic ciphertext; and Receiving first information related to the first homomorphic ciphertext from the server; Generate second information d* based on the inner product between the first information and the secret key; and Based on transmitting the second information d* to the server, receiving an authentication response message from the server including acceptance or rejection of the authentication request message, machinery and tools.

13. A computer-readable, non-transient storage medium storing instructions that, when executed, cause at least one processor to perform operations, wherein the operations are: Generate a first homomorphic ciphertext by homomorphically encrypting the user's data using a secret key for the user; Transmitting an authentication request message to a server that includes the secret key and the first homomorphic ciphertext; and Receiving first information related to the first homomorphic ciphertext from the server; Generate second information d* based on the inner product between the first information and the secret key; and Based on transmitting the second information d* to the server, receiving an authentication response message from the server including acceptance or rejection of the authentication request message, Storage medium.

Images