KR102236242B1 - Method for Generating Public Value Using Fuzzy Extractor and Generating Secret Key Using the same Public Value and Second Input - Google Patents

Abstract

The present invention relates to a method of generating a public value using a fuzzy extractor and a method of generating a secret key by using the same public value and a secondary input value. A method of allowing an electronic computing device to generate a public key by a fuzzy extractor according to an embodiment of the present invention includes: a first step including step 1-1 of randomly selecting component (b) of a 1-bit (∈{0, 1}) secret key when the secret key generation module of the electronic computing device receives an input value, and step 1-2 of determining component (H) of the public value determined according to the component (b) of the selected private key; and a second step of determining a public value component (H) for each secret key component by repeating the first step by a predetermined number of bits (k) of the private key. A plurality of public values and private keys can be generated without lowering security.

Description

Method for Generating Public Value Using Fuzzy Extractor and Generating Secret Key Using the same Public Value and Second Input}

The present invention relates to a method of generating a public value using a fuzzy extractor and a method of generating a secret key by receiving the public value and a secondary input value. It is about a method in which security is not compromised even if a public value is generated and a secret key is generated accordingly.

Data encryption methods are widely used in order to enhance the security of data along with the increase in digital data transmission through online. Methods for data encryption include symmetric key encryption, public key encryption, and the like, but no matter which encryption is used, a secret key is essential.

However, it is difficult to remember the secret key in general, and if it is stored in a predetermined storage, the risk of hacking is very high and it is vulnerable to security.

In order to solve such a problem, Yevgeniy Dodis, etc., is a method that can perform encryption using a secret key even if the secret key is not necessarily stored by generating a secret key based on a random input value that exists in nature, for example, biometric information. It is described in the paper "Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data" (paper 1) published on January 20, 2008.

When a random input value, such as biometric information, is input to the fuzzy extractor, a public value H and a random string r usable as a secret key are generated. The public value (H) is stored as a public value, and the random string (r) is not separately stored.

After that, when the second input value, that is, the same biometric information and the public value H, is input to the fuzzy extractor, the same random string r is generated. That is, even if the secret key is not separately stored, there is an advantage in that it is possible to generate and use the secret key by inputting biometric information of itself if there is only a public value.

However, the user may want to use different secret keys generated from biometric information for a plurality of different organizations (service subjects). In such a case, the public values generated by the fuzzy extractor are different from each other, and accordingly the generated secret keys (random strings) may also be generated in different plurality (reusable fuzzy extractor). However, such a plurality of different public values and private keys When is generated, the method of generating the secret key through the existing fuzzy extractor may cause a security problem.

In the present invention, biometric information having low entropy is generally input to a fuzzy extractor to generate a public value, and a plurality of public values and secret keys are secured even if the secret key is generated by inputting the secondary input value and the public value to the fuzzy extractor. It aims to provide a method that can be produced without deteriorating the properties.

)을 입력받으면 1-비트(∈{0, 1})로 구성된 비밀키의 성분(b)을 랜덤하게 선택하는 제1-1 단계와, 선택된 비밀키의 성분(b)에 따라 결정되는 공개값의 성분(H)을 결정하는 제1-2 단계를 포함하는 제1 단계와; 미리 결정되어 있는 비밀키의 비트(k) 만큼 제1 단계를 반복하여 각 비밀키 성분에 대한 공개값 성분(H)을 결정하는 제2 단계를 포함한다.In the method of generating a public value by an electronic computing device according to the present invention by a fuzzy extractor, the secret key generation module of the electronic computing device is an input value (

) Is input, step 1-1 of randomly selecting the component (b) of the secret key composed of 1-bit (∈{0, 1}), and the public value determined according to the component (b) of the selected secret key. A first step including a 1-2 step of determining the component (H) of; And a second step of determining a public value component (H) for each secret key component by repeating the first step by a predetermined bit k of the secret key.

로 결정하고, b = 1 이면 공개값 성분(H)을

로 결정하는 단계이다.Step 1-2, if b = 0, the public value component (H) is

And if b = 1, the public value component (H) is

It is a step to decide.

와

는 랜덤 이진 벡터이며, I_i는 입력값(ω)으로부터 랜덤하게 선택되는

비트만큼의 원소를 가리키는 랜덤 인덱스 집합이다.

Wow

Is a random binary vector, and I _i is randomly selected from the input value (ω)

It is a set of random indices indicating elements as many as bits.

는 랜덤 인덱스 집합(I_i)을 구성하는

비트의 원소를 입력으로받아 1-비트(∈{0, 1}) 출력값을 출력하는 임의의 술어 함수(Predicate 함수)이다.

Constitutes a set of random indices (I _i)

It is an arbitrary predicate function that receives a bit element as an input and outputs a 1-bit (∈{0, 1}) output value.

로 정의되는 XOR-Maj 함수가 될 수 있다.The predicate function is

It can be an XOR-Maj function defined as.

는 다른 의사 난수 생성기에 의해서 생성될 수 있다.Set of random indices I _i and random binary sequence

Can be generated by other pseudorandom number generators.

)을 입력받아 전자적 연산 장치가 퍼지 추출기를 이용하여 비밀키를 생성하는 방법은,

를 비교값(h')으로 산출하는 제3 단계와; H의 마지막 성분 벡터(

또는

)와 비교값(h')의 해밍 거리를 산출하는 제4 단계와; 제4 단계에서 산출된 해밍거리가 소정의 값보다 작거나 같으면 비밀키의 성분(b)을 "1"로 출력하고, 그렇지 않으면 "0"으로 출력하는 제5 단계와; 미리 결정되어 있는 비밀키의 비트(k) 만큼 제3 단계 내지 제5 단계를 반복하여 비밀키를 생성하는 제6 단계를 포함한다.The public value and the secondary input value generated by the above method (

) And the electronic computing device generates a secret key using a fuzzy extractor,

A third step of calculating as the comparison value h'; The vector of the last component of H (

or

A fourth step of calculating a Hamming distance between) and the comparison value h'; A fifth step of outputting a component (b) of the secret key as "1" if the Hamming distance calculated in the fourth step is less than or equal to a predetermined value, and outputting it as "0"otherwise; And a sixth step of generating a secret key by repeating the third to fifth steps as many as a predetermined bit (k) of the secret key.

이며, p는

와

가 동일일 확률이다.The predetermined value is

And p is

Wow

Is the probability that is equal.

According to the present invention, even when the entropy of the random distribution to which the input value (ω) is sampled is not large, the size of the public value and the time of regeneration of the secret key are expressed as the polynomial time for the error of the input. Compared to the conventional purge extractor, which took time and time, there is an effect of providing very efficient and fast performance.

1 is a block diagram showing the operation of a purge extractor.
2 is a flowchart of a process of generating an open value of a fuzzy extractor according to the present invention.
3 is a flowchart of a process of regenerating a secret key by receiving a second input value and a public value by a fuzzy extractor according to the present invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

Encryption/decryption may be applied to the information (data) transmission/reception process performed in this specification as needed, and expressions describing the information (data) transmission process in this specification and claims are all encrypted/ It should be interpreted as including the case of decryption. In this specification, expressions in the form of "transmitted from A to B (transmitted)" or "received from A by B" include those transmitted (transmitted) or received with another medium in the middle, and directly from A to B It does not just express what is transmitted (delivered) or received. In the description of the present invention, the order of each step is to be understood without limitation, unless the preceding step must be performed logically and temporally prior to the subsequent step. That is, except for the above exceptional cases, even if a process described as a subsequent step is performed prior to a process described as a preceding step, the essence of the invention is not affected, and the scope of rights should be defined regardless of the order of the steps. And in the present specification, "A or B" is defined to mean not only selectively indicating any one of A and B, but also including both A and B. In addition, in the present specification, the term "comprising" has the meaning of encompassing further including other elements in addition to the elements listed as including.

In this specification, the term "module" or "unit" means a logical combination of general-purpose hardware and software that performs the function.

In the present specification, only the minimum components necessary for the description of the present invention are described, and components not related to the essence of the present invention are not mentioned. In addition, it should not be interpreted as an exclusive meaning including only the mentioned components, but should be interpreted as a non-exclusive meaning that may include other components not mentioned.

The present invention is performed by an electronic computing device such as a computer capable of electronic calculation, a server computer, and a mobile device such as a smartphone, and the mathematical calculation and calculation of each step of the present invention described below are known to perform the corresponding calculation or calculation. It can be implemented as a computer operation by a coding method and/or a coding designed suitable for the present invention.

In the present specification, the term "value" is defined in a broad sense including not only scalar values, but also vectors, matrices, and polynomials.

In the present specification, the meaning of obtaining a predetermined value by performing an operation such as encryption or hashing on a specific value means not only the specific value, but also the modified value of the specific value (for example, a predetermined value is additionally calculated or It is defined as including an operation such as encryption or hash for another value calculated through a process such as changing a corresponding specific value according to a predetermined rule.

The exemplary embodiments described herein provide a general understanding of the principles of the structure, function, fabrication, and use and method of the device disclosed herein. One or more such embodiments are shown in the accompanying drawings. Those skilled in the art will understand that the apparatus and methods specifically described herein and shown in the accompanying drawings are non-limiting and exemplary embodiments, and that the scope of the present invention is defined by the claims. Features shown and described in connection with one exemplary embodiment may be combined with features of other embodiments. Such modifications or variations are intended to be included within the scope of the present invention.

Each component of the device shown in the accompanying drawings of the present specification may be applied in any form, size, or dimension capable of performing the functions intended by the present invention, as well as the shape, size, and dimensions explicitly shown in the drawings. I can.

In FIG. 1, a fuzzy extractor receives an input value (ω) to generate a public value (H), and a secondary input value (ω') and the public value (H) are received and a secret key (b). A block diagram for explaining the process of generating') is shown.

When generating the public value H, the user inputs the input value ω, for example, biometric information, such as fingerprint information or iris information, into the generation module 10 (Fig. 1(A)). The generation module 10 is a component of the purge extractor. The generation module 10 generates the public value H and the private key b through a predetermined operation based on the input value ω, and stores the public value H in a predetermined storage.

After storing the public value H in this way, in order to generate the secret key through the fuzzy extractor in the future, as shown in Fig. 1(B), the secondary input value ω'and the public value that has already been disclosed (H) is input into the regeneration module 20. Then, the secret key (b') is generated. According to the fuzzy extractor theory, the secret key (b') generated by the regeneration module 20 is secondary to the input value (ω) input at the time of generating the public value (H). If the input value ω'has a difference within a predetermined range, it may be generated in the same manner as the secret key b generated when the public value is generated.

According to the characteristics of the fuzzy extractor including a randomness operation, the initially generated public value may be generated differently each time an input value is input, even if the biometric information of the same person is input. The public values thus generated differently may be registered for use in regenerating different private keys individually for a plurality of organizations (service providers). According to the method for generating a public value and a method for regenerating a private key according to the present invention, security is not reduced even if a plurality of public values are registered and used.

2 is a flowchart illustrating a process of generating an open value of the fuzzy extractor according to the present invention.

First, an input value ω is input to the generation module 10 (step 200). The input value ω may be the user's biometric information. The biometric information may include fingerprint information, vein information, iris information, and the like. The input value is enough information that can be expressed in an arbitrary random distribution, and does not necessarily have to be biometric information. For example, information such as handwritten signature, voice, and human memory (password) can also be input values.

The input value ω is an n-bit vector and can be expressed as follows.

)을 입력받으면 1 비트인 비밀키 성분(b)를 랜덤하게 선택한다(단계 220). 즉 비밀키 성분(b)은 "0" 또는 "1" 중에서 어느 하나로 랜덤하게 선택된다.n-bit input value (

When) is inputted, a 1-bit secret key component (b) is randomly selected (step 220). That is, the secret key component (b) is randomly selected from either "0" or "1".

"m" is the number of bits of the output value output by the pseudo-random number generation function described later.

When the secret key component (b) is determined, the public value (H) is determined according to the determined secret key (step 230). This process will be described in more detail.

를 선택한다. 본 명세서에서 화살표 상측의 "$" 표시는 랜덤하게 선택하는 것을 의미한다.Random binary vector if secret key component (b) is "0"

Choose In the present specification, the "$" mark on the upper side of the arrow means selecting at random.

Prior to the description of the next step, a pseudorandom number generator used in the method according to the present invention will be described.

비트의 입력을 받아서 1 비트의 출력값을 출력하는 임의의 술어 함수(P: Predicate function)을 다음과 같이 정한다.first

An arbitrary predicate function (P) that receives a bit input and outputs an output value of 1 bit is determined as follows.

(

)

(

)

)의 각 성분함수 G_i는 다음과 같이 정할 수 있다.Using the predicate function above, a pseudorandom number generation function (

Each component function G _i of) can be determined as follows.

의 원소 중에서

비트 만큼의 부분집합을 골라서 그 부분집합에 대한 술어 함수(Predicate function)의 출력을 의사난수발생함수의 각 성분(G_i)으로 출력하는 것을 의미한다.Equation 1 is the input value

Among the elements of

It means to select a subset of bits and output the output of the predicate function for the subset as each component (G _i ) of the pseudorandom number generation function.

The predicate function can be, for example, the following XOR-Maj function.

비트의 입력값의 (랜덤) 인덱스 집합을

라고 한다.The input value of the predicate function used when calculating _{each component (G i} ) of the pseudorandom number generation function

A set of (random) indices of the bit's input

It is called.

를 선택한다.If the secret key component (b) is "0", returning to the process of calculating the public value component (H), a random binary vector

Choose

Thereafter, when the secret key component (b) is "0", the public value component (H) is determined as follows.

And when the secret key component (b) is "1", the public value component ((H) is determined as follows.

In order to share the 1-bit secret key component (b), the public value component (H) consisting of m sets according to Equation 2 or Equation 3 is output.

If the secret key component is k bits, the above process is repeated k times to output the public value component.

는 다른 의사 난수 생성기에 의해서 생성될 수 있다. 예를 들어 특정 시드값(seed)을 공개하고 다른 의사난수 생성기(G')으로 I_i 및

를 생성한다. 그러한 실시예의 경우에는, 다른 의사 난수 생성기(G')를 수행하는 시간이 더 소요될 수 있지만 공개 정보의 크기를 대폭 압축할 수 있다.Set of random indices I _i and random binary sequence

Can be generated by other pseudorandom number generators. For example, revealing a specific seed value and using another pseudorandom number generator (G') I _i and

Create In the case of such an embodiment, it may take more time to perform another pseudo-random number generator G', but the size of public information may be significantly compressed.

The above-described public value (H) determination process can be performed in the same way even when a user performs an additional public value determination process in order to use a secret key by a fuzzy extraction method in another institution, and the procedure is calculated even if the sequence of the process is the same. Other disclosure values may be determined due to the randomness involved along the way.

After the public value is determined and disclosed, a process of regenerating a secret key by a user subsequently inputting a secondary input value (ω'), for example, fingerprint information, is illustrated in FIG. 3.

When the user inputs the secondary input value ω'to the regeneration module 20, the public value is also input to the regeneration module 20 of the fuzzy extractor (step 300).

The process of calculating the secret key component (b') to be regenerated begins.

First, in step 320, a comparison value h'is calculated. The comparison value h'is calculated as follows.

Next, a Hamming distance of h'and the last component vector of H, which has been previously generated and published, is calculated (step 330). If the calculated Hamming distance is less than or equal to a predetermined value, b'is output as "1" (step 350), otherwise b'is output as "0" (step 360).

The predetermined value is determined by the following equation.

와

가 동일할 확률이다.Where m is the number of bits of the output value of the pseudo-random number generation function, and p is

Wow

Is the probability that is equal.

The secret key component (b') generated in this way is the same as the secret key component (b) generated through the process of FIG. 2. If the number of secret key bits is k, the regeneration process is repeated k times.

According to the present invention, even when the entropy of the random distribution to which the input value (ω) is sampled is not large, the size of the public value and the time of regeneration of the secret key are expressed as the polynomial time for the error of the input. Compared to the conventional purge extractor, which took time and time, there is an effect of providing very efficient and fast performance.

Although the present invention has been described with reference to the accompanying drawings, the scope of the present invention is determined by the claims to be described later and should not be construed as being limited to the above-described embodiments and/or drawings. And it should be clearly understood that the improvements, changes and modifications of the invention described in the claims, which are obvious to those skilled in the art, are included in the scope of the present invention.

10: generation module
20: regeneration module

Claims (4)

In the method of generating a public value by an electronic computing device by a fuzzy extractor (Fuzzy Extractor),
The secret key generation module of the electronic computing device is the input value (

) Is input, step 1-1 of randomly selecting the component (b) of the secret key composed of 1-bit (∈{0, 1}), and the public value determined according to the component (b) of the selected secret key. A first step including a 1-2 step of determining the component (H) of,
And a second step of determining a public value component (H) for each secret key component by repeating the first step by a predetermined bit (k) of the secret key,
Step 1-2,
If b = 0, then the public value component (H) is

And decided to
If b = 1, then the public value component (H) is

It is a step to determine as,

Wow

Is a random binary vector,
I _i is randomly selected from the input value (ω)

It is a set of random indices pointing to an element as many as bits,

Constitutes a set of random indices (I _i)

An arbitrary predicate function (Predicate function) that receives a bit element as an input and outputs a 1-bit (∈{0, 1}) output value,
A method of generating public values using a fuzzy extractor.
The method according to claim 1,
The predicate function is

XOR-Maj function defined as,
A method of generating public values using a fuzzy extractor.
The method according to claim 1 or 2,
Set of random indices I _i and random binary sequence

Is generated by another pseudorandom number generator,
A method of generating public values using a fuzzy extractor.
The public value and the secondary input value generated by the method of claim 1 or 2 (

In the method for generating a secret key using a fuzzy extractor by an electronic computing device receiving ),

A third step of calculating as the comparison value h',
The vector of the last component of H (

or

A fourth step of calculating the Hamming distance of) and the comparison value h',
A fifth step of outputting a component (b') of the secret key as "1" if the hamming distance calculated in the fourth step is less than or equal to a predetermined value, otherwise outputting it as "0";
And a sixth step of generating a secret key by repeating the third to fifth steps as many as a predetermined bit (k) of the secret key,
The predetermined value is

Is,
p is

Wow

Is the probability that is equal,
Secret key generation method using fuzzy extractor.

Images