WO2024057538A1

WO2024057538A1 - Server, authentication system, authentication method and program

Info

Publication number: WO2024057538A1
Application number: PCT/JP2022/034780
Authority: WO
Inventors: 寿幸一色; 春菜福田; 健吾森
Original assignee: 日本電気株式会社
Priority date: 2022-09-16
Filing date: 2022-09-16
Publication date: 2024-03-21

Abstract

This invention provides a server, an authentication system, an authentication method and a program that contribute to the attainment of high-speed processing, high security and privacy in authentication services. The server comprises: a storage unit that stores a first encrypted feature value; an acquisition unit that acquires a second encrypted feature value accepted by a terminal; a calculation unit that calculates a similarity degree on the basis of the first feature value and the second feature value; and a conversion/transmission unit that converts the similarity degree in a format allowing another server to perform a decryption and that transmits the similarity degree as converted to the other server.

Description

Server, authentication system, authentication method and program

The present invention relates to a server, an authentication system, an authentication method, and a program.

SaaS (Software as a Service) can be provided on an account-by-account basis as long as a terminal device and an Internet environment are available, and if multiple accounts are provided, services can be provided to multiple users. Due to such ease and centralization, various services have been provided.

By the way, as mentioned above, SaaS allows multiple people to receive services using application software by creating accounts and accessing a server via the Internet. When it comes to large-scale SaaS, users exist across organizations such as companies and departments. In this case, ensuring security between each account becomes a problem. In particular, in order to prevent unauthorized access to confidential information, etc., it is necessary to strictly manage passwords and IDs during account authentication.

In recent years, there has been an increase in the use of biometric authentication instead of IDs and passwords to prevent unauthorized access. However, once biometric features are leaked, other services that use the leaked biometrics can be accessed, so the so-called template used for biometric authentication and the biometrics obtained during authentication Care must be taken when handling the feature values, etc. Furthermore, if authentication is performed using SaaS, the data such as the biometric template and the features obtained during authentication will be handed over to the service provider when registering an account, which poses security issues. will occur. Additionally, if the feature values are not encrypted, it will be possible for the service operator to identify who has authenticated to which service, which creates a need to consider privacy issues.

Japanese Patent Application Publication No. 2008-021295

Furthermore, the disclosures of the above-mentioned prior art documents are incorporated into this document by reference. The following analysis was performed by the inventors.

In the invention disclosed in Patent Document 1, in a member matching service between groups, matching processing can be performed while the user's identification number is encrypted, and the matching results cannot be disclosed to a third party such as a service provider. A service provider-side program is disclosed that allows a service provider to execute matching processing without any trouble.

However, in the invention of Patent Document 1, the identification IDs of users in the list included in the matching query information are encrypted using a common key encryption method, and the list in which the identification IDs are arranged according to priority is sent to the service provider's server. It is encrypted in two steps: using the public key of Then, the matching results are processed using the processing information included in the query and then sent to the relay computer, so if it is introduced into an authentication service, the processing speed will be an issue. .

Additionally, since the relay computer generates the encryption key using a common key encryption method, it is necessary to deliver the private key to use it on the user's terminal, which poses a security risk. In particular, once a private key is illegally acquired, the impact is likely to be severe in situations where a large number of terminals use the private key, such as in an authentication service.

Therefore, an object of the present invention is to provide a server, an authentication system, an authentication method, and a program that contribute to ensuring high-speed processing, high security, and privacy in authentication services.

According to the first aspect of the present invention or disclosure, a storage section that stores an encrypted first feature amount, an acquisition section that is accepted by a terminal and obtains an encrypted second feature amount; a calculation unit that calculates a degree of similarity based on the first feature amount and the second feature amount; and a calculation unit that converts the degree of similarity into a format that can be decoded by another server and transmits it to the other server. A server having a conversion transmitter is provided.

According to a second aspect of the present invention or disclosure, a storage unit that stores an encrypted first feature quantity; an acquisition unit that is accepted by a terminal and obtains an encrypted second feature quantity; a calculation unit that calculates a degree of similarity based on the first feature amount and the second feature amount; and a calculation unit that converts the degree of similarity into a format that can be decoded by another server and transmits it to the other server. a conversion transmitter, the acquisition unit acquires a user ID that identifies a user in association with a first feature, and the calculation unit acquires a user ID that identifies a user in association with a first feature; The conversion and transmission unit calculates the degree of similarity in an encrypted state based on the above, and the conversion and transmission unit associates the degree of similarity with the user ID and transmits the degree of similarity to another server. and the other server that decrypts the information and obtains one user ID based on the similarity and a predetermined criterion.

According to a third aspect of the present invention or disclosure, the computer stores the encrypted first feature amount, and the computer obtains the encrypted second feature amount accepted by the terminal. a step in which the computer calculates a degree of similarity based on the first feature amount and the second feature amount; and a step in which the computer converts the degree of similarity into a format that can be decoded by another server. and transmitting the information to the other server.

According to the fourth aspect of the present invention or disclosure, the process of storing the encrypted first feature quantity, the process of acquiring the encrypted second feature quantity accepted by the terminal, and the process of storing the encrypted first feature quantity; a process of calculating a degree of similarity based on the first feature amount and the second feature amount; a process of converting the degree of similarity into a format that can be decoded by another server and transmitting it to the other server; A program for causing a computer to execute is provided.

According to each aspect of the present invention or disclosure, the present invention provides a server, an authentication system, an authentication method, and a program that contribute to ensuring high-speed processing, high security, and privacy in authentication services. .

FIG. 1 is a block diagram showing an example of the configuration of a server according to an embodiment. FIG. 2 is a schematic diagram showing an overview of server processing according to the first embodiment. FIG. 2 is a block diagram showing an example of the configuration of a server according to the first embodiment. FIG. 2 is a flowchart showing the operation of the server (key generation and storage of registered feature amounts) according to the first embodiment. FIG. 2 is a flowchart showing the operation (verification process) of the server according to the first embodiment. FIG. 2 is a schematic diagram showing the hardware configuration of a server according to the first embodiment. FIG. 2 is a block diagram illustrating an example of the configuration of a server according to a second embodiment. FIG. 7 is a sequence diagram illustrating an example of the operation (key generation) of the server according to the second embodiment. FIG. 7 is a sequence diagram illustrating an example of the operation (registration of feature amounts) of the server according to the second embodiment. FIG. 7 is a sequence diagram illustrating an example of the operation (verification) of the server according to the second embodiment. FIG. 7 is a sequence diagram showing an example of another operation (key generation) of the server according to the second embodiment. FIG. 7 is a sequence diagram showing an example of another operation (verification) of the server according to the second embodiment.

[Outline of processing of one embodiment]
First, an overview of the processing of one embodiment will be explained. Note that the drawing reference numerals added to this summary are added to each element for convenience as an example to aid understanding, and the description of this summary is not intended to be limiting in any way. Furthermore, connection lines between blocks in each figure include both bidirectional and unidirectional connections. The unidirectional arrows schematically indicate the main signal (data) flow, and do not exclude bidirectionality. Furthermore, in the circuit diagrams, block diagrams, internal configuration diagrams, connection diagrams, etc. shown in the present disclosure, although not explicitly stated, an input port and an output port are present at the input end and output end of each connection line, respectively. The same applies to the input/output interface.

[Configuration of one embodiment]
Next, the configuration of a server according to an embodiment will be explained using a diagram. FIG. 1 is a block diagram showing an example of the configuration of a server according to an embodiment. As shown in this figure, the server 10 according to one embodiment includes a storage section 11, an acquisition section 12, a calculation section 13, and a conversion transmission section 14.

The storage unit 11 stores the encrypted first feature amount. The acquisition unit 12 acquires the encrypted second feature amount accepted by the terminal. The calculation unit 13 calculates the degree of similarity based on the first feature amount and the second feature amount. The conversion transmitting unit 14 converts the similarity into a format that can be decoded by another server and transmits it to the other server.

According to the server of one embodiment, in biometric authentication, the degree of similarity is calculated between a first feature amount, which is a so-called template, and a second feature amount, which is acquired from a terminal and is authentication query information for attempting authentication. However, it is possible to convert the similarity into a format that can be decoded by other servers. In other words, it is possible to convert the calculated similarity using a key that can be decrypted by another server. For example, new encryption can be performed by converting the calculated similarity into a feature encrypted with a key that can be decrypted with a private key that exists on another server that provides the service. Therefore, it is possible to perform the authentication process while keeping the first and second feature amounts secret.

Specific embodiments will be described in more detail below with reference to the drawings. In addition, in each embodiment, the same components are given the same reference numerals, and the explanation thereof will be omitted.

[First embodiment]
FIG. 2 is a schematic diagram showing an overview of server processing according to the first embodiment. As shown in this figure, there is a server 10 that performs authentication processing, a server 21 that provides service A, and a server 22 that provides service B. The server 10 provides authentication services as SaaS. The server 10 stores encrypted feature amounts for authentication that are registered in advance. Note that although FIG. 2 is an example in which two services A and B exist for one authentication SaaS, the number of services is not limited to two.

A user 23 who intends to use service A inputs biometric information at the terminal 24. For example, with facial recognition, the person faces the camera and inputs the image into the device. Features of the input video are extracted and encrypted at the terminal. The encrypted feature quantity is sent to the server 10, which is an authentication server, together with the service ID "A" as an authentication query.

The server 10 calculates the degree of similarity with the registered feature amounts. Calculation is performed between the registered feature amount and the feature amount of the authentication query, but both are homomorphically encrypted, so calculation can be performed with them encrypted. The encryption similarity _D1 , which is the calculation result, is encrypted with the key of the authentication service. Here, the authentication service key is converted to the service A key using the proxy re-encryption method. The converted Enc(D ₁ ) is sent to the server 21 of service A and decoded on the server 21.

It is determined on the server 21 whether the decrypted _D1 is within a predetermined value range, that is, an acceptance range. If it is within the acceptance range, an OK message is sent to the terminal 24 and service A is permitted. If it is outside the acceptance range, an NG message is sent and the series of authentication processes ends.

The user 25 who is attempting to use service B also performs similar processing. The difference is that the service ID “B” is sent to the server 10 as an authentication query, and the encryption similarity Enc (D ₂ ) converted from the authentication service key to the service B key by the server 10 is sent to the server 22. This is the point where it is sent.

In this way, by calculating the similarity between the registered feature amount and the feature amount of the authentication query while encrypted, it is possible to perform the authentication process in a confidential state within the server 10, which is the service provider. be. In addition, by directly converting the calculated encryption similarity key into the key of each service, there is no need to decrypt once and then encrypt it again with the key of each service, resulting in faster processing. It is possible to do so.

[Configuration of first embodiment]
Next, the configuration of the server 10 of Embodiment 1 will be explained using figures. FIG. 3 is a block diagram showing an example of the configuration of the server 10 according to this embodiment. As shown in this figure, the server 10 according to the first embodiment includes a storage section 11, an acquisition section 12, a calculation section 13, a conversion transmission section 14, a key generation section 15, and a conversion key acquisition section 16. and has.

The storage unit 11 stores the encrypted first feature amount. Various methods can be used for "encryption". Although the server of this embodiment uses a public key cryptosystem, a common key cryptosystem may also be used. However, it is necessary to distribute the private key, which poses a security problem, so it is desirable to use public key cryptography. The "first feature quantity" is a so-called template for reference of biometric information, and exists at least as many as the number of users registered in advance.

Note that the storage unit 11 may hold a user ID (of each service) that identifies the user in association with the encrypted first feature amount.

The acquisition unit 12 acquires the second feature quantity that is received and encrypted by the terminal. The second feature amount is included in an authentication query that attempts authentication. The encryption must be performed using at least the same key as the first feature amount. Biometric information is acquired at the terminal, and feature amounts are extracted based on the biometric information. The extracted feature amount is encrypted and sent to the server 10. The feature amount is received by the server 10 and sent to the calculation unit 13 while being encrypted.

The calculation unit 13 calculates the degree of similarity based on the first feature amount and the second feature amount. Generally, the distance between the first feature vector and the second feature vector is used as the similarity. For example, various similarity measures such as Euclidean distance, Hamming distance, cos similarity, and the square of Euclidean distance can be employed.

In the present embodiment, homomorphic encryption, homomorphic operation, and the like are used, as examples, in order to match the feature amounts while they are encrypted. For example, an encryption method called Somewhat homomorphic encryption has homomorphism regarding an arbitrary number of additions and a finite number of multiplications (given the ciphertexts Enc(m ₁ ) and Enc(m ₂ ) of _the plaintexts m ₁ and m 2 Sometimes it refers to the property that the ciphertext Enc (m ₁ ○m ₂ ) of the binary operation m ₁ _○ m ₂ of the plaintexts m 1 and m ₂ can be calculated without decrypting it to the plaintexts m ₁ and m _2. Here, "○" is a binary operation, such as addition "+" or multiplication "x".) Since it is a homomorphic encryption having a binary operation, it can be applied to similarity calculation, etc., which is a matching means in the calculation unit 13.

The conversion transmission unit 14 converts the similarity into a format that can be decoded by another server and transmits it to the other server. In the above, the first feature amount and the second feature amount are encrypted using a key generated by the server 10, which is an authentication server. This is converted into a decryptable key by the server providing each service, and sent to the server of each service.

The server of this embodiment performs key conversion using proxy re-encryption technology, for example. Proxy re-encryption is a technology that can convert the ciphertext of the first key into the ciphertext of the second key without obtaining plaintext information. Here, it is used to convert the public key of the server 10 into a public key generated by the server providing each service without decrypting it. Here, there are two types of key pairs for public key cryptography as follows: (public key 1, private key 1) = (pk ₁ , sk ₁ ), (public key 2, private key 2) = (pk ₂ , sk ₂ ). To perform proxy re-encryption, a conversion key is generated. When the conversion key is ReKey, the conversion key generation process rk=ReKeyGen() becomes ReKeyGen(pk ₂ , sk ₁ )=rk _1→2 . Here, _pk2 is the public key of the ciphertext to be converted, and _sk1 is the private key of the ciphertext to be converted.

The key generation unit 15 generates a pair of private key and public key. The generated public key is distributed to each terminal receiving the service. The first feature amount is encrypted at the time of template registration, and the second feature amount is encrypted using the public key generated at the time of authentication.

The conversion key acquisition unit 16 acquires a conversion key from the secret key generated by the key generation unit and the key acquired from another server. For example, a conversion key is generated using a private key generated by the server 10 and a public key of each service that is another server. To generate this conversion key, for example, if the private key of the server 10 is sk ₁ and the public key of each service is pk ₂ , ReKeyGen(pk ₂ , sk ₁ )=rk _1→2 as described above. The generated conversion key rk _1→2 is sent to the conversion transmitter 14.

Proxy re-encryption technology includes a method in which the conversion key can be converted in one direction as described above, as well as a method in which the conversion key can be converted in both directions. In that case, as ReKeyGen(sk ₁ , sk ₂ )=rk _1←→2, the secret keys of both the conversion destination and the conversion source are required. In the server of this embodiment, it is necessary to deliver the user's private key from another server to the server 10, which poses a security problem, so it is desirable to adopt the one-way conversion model described above. . When the feature amount of the plaintext before being encrypted is M, the conversion key processing is expressed as ReEnc(rk _1→2 , Enc(pk ₁ , M))=Enc(pk ₂ , M).

Note that the server 10 may have the acquisition unit 12 acquire a user ID that identifies the user, such as a user ID of a service currently provided by another server, in association with the second feature amount. The conversion transmitting unit 14 may also associate the calculated degree of similarity with the user ID and transmit it to another server.

[Explanation of operation]
4 and 5 are flowcharts for explaining an example of the operation of the server 10 of this embodiment. The authentication service is mainly divided into three processing flows: key generation, storage of registered feature values, and verification. FIG. 4 is an explanation of an example of the operation of generating a key and storing a registered feature amount, and FIG. 5 is an explanation of an example of the operation at the time of verification.

Referring to FIG. 4, first, a pair of private key and public key is generated in the server 10 (step S101). Among the generated keys, the public key is distributed to each terminal (step S102). After that, the server 10 acquires the private key and the public key (or private key) generated by another server serving as a server for each service, and generates and acquires a conversion key (step S103). Next, each terminal acquires and encrypts the first feature amount (step S104). The acquired first feature quantity is stored in the storage area of the server 10 (step S105).

Referring to FIG. 5, first, the server 10 acquires the second feature amount from the terminal (step S201). Next, a degree of similarity is calculated based on the first feature amount and the second feature amount (step S202). Next, the similarity is converted into a format that can be decoded by other servers. When the conversion is completed, the encrypted similarity is transmitted to other servers serving as servers for each service (S204).

[Hardware configuration]
The server 10 of this embodiment can be executed by an information processing device (computer) and has a configuration illustrated in FIG. 6 . The server 10 includes a CPU (Central Processing Unit) 301, a memory 302, an input/output interface 303, a NIC (Network Interface Card) 304 serving as a communication means, etc., which are interconnected by an internal bus 305.

However, the configuration shown in FIG. 6 is not intended to limit the hardware configuration of the server. The server 10 may include hardware that is not shown, and may not include the input/output interface 303 if necessary. Furthermore, the number of CPUs included in these devices is not limited to the example shown in FIG. 6; for example, a plurality of CPUs may be included in the server 10.

The memory 302 is a RAM (Random Access Memory), a ROM (Read Only Memory), or an auxiliary storage device (hard disk, etc.).

The input/output interface 303 is a means that serves as an interface for a display device or an input device (not shown). The display device is, for example, a liquid crystal display. The input device is, for example, a camera or sensor that receives biometric information, or a device that receives user operations such as a keyboard or mouse.

The functions of the server 10 include a group of programs (processing modules) such as a storage program, an acquisition program, a calculation program, a conversion transmission program, a key generation program, a conversion key acquisition program, etc. stored in the memory 302, and the programs used by each program. This is realized by a data group such as parameters. The processing module is realized, for example, by the CPU 301 executing each program stored in the memory 302. Further, the program can be updated via a network or by using a storage medium storing the program. Furthermore, the processing module may be realized by a semiconductor chip. That is, any means for executing the functions performed by the processing module using some hardware and/or software is sufficient.

[Hardware operation: During key generation]
In the server 10, the key generation program is called from the memory 302, and the CPU 301 enters the execution state. The program generates a set of public key and private key of the server 10 that provides authentication SaaS, and stores it in the memory 302. Furthermore, on the server 10, a conversion key acquisition program is called from the memory 302 and is put into execution by the CPU 301. The program receives the public key (or private key) of the server from another server that provides each service via the NIC 304, and uses it together with the private key of the server 10 to generate a conversion key. The generated conversion key is temporarily stored in memory 302.

[When registering the first feature amount]
In the server 10, a stored program is called from the memory 302, and the CPU 301 enters an execution state. The program receives the encrypted first feature amount, which is the feature amount of the authentication query, from the user terminal via the NIC 304 and stores it in the memory 302.

[When checking]
When the key generation and the registration of the encrypted first feature amount are completed, the acquisition program is called from the memory 302 in the server 10 and is put into execution state in the CPU 301. The program receives the second feature amount of the biometric information acquired by the user terminal via the NIC 304 in an encrypted state. Next, in the server 10, the calculation program is called from the memory 302, and the CPU 301 enters the execution state. The program calculates the degree of similarity between the first feature stored in the memory 302 and the obtained second feature without decoding the two features while they are encrypted.

Next, the conversion and transmission program is called from the memory 302 and put into execution by the CPU 301. The program reads the conversion key temporarily stored in the memory 302 and the calculated similarity, and converts the public key of the server 10 that encrypts the calculated similarity into the public key generated by the server of each service. Convert to key. The converted encryption similarity is sent via the NIC 304 to other servers serving as servers for each service by the same program.

The transmitted encrypted similarity after conversion is decrypted on another server using its own private key, and the other server executes a process to determine whether it is within the acceptance range.

[Explanation of effects]
According to the server 10 of this embodiment, when the authentication service based on biometric information is SaaS, the authentication process can be executed while keeping it secret from the SaaS provider, and high security and privacy protection can be achieved. Furthermore, by converting the key that encrypts the encryption similarity using the conversion key, it is possible to realize high-speed authentication processing.

[Second embodiment]
The authentication system of this embodiment is based on the authentication server of the first embodiment, and further decrypts the similarity encrypted by another server and determines whether it is within the acceptance range. This is an authentication system that can authenticate services provided by .

[Configuration of second embodiment]
FIG. 7 is a block diagram showing the configuration of an authentication system according to the second embodiment. As shown in this figure, the server of this embodiment includes another server group 20 and a server 10. In this configuration, there are multiple other servers 20, and one server 10 is responsible for authentication of multiple services. The configuration of the server 10 is the same as described above, and includes a storage section 11, an acquisition section 12, a calculation section 13, a conversion transmission section 14, a key generation section 15, and a conversion key acquisition section 16. The plurality of other server groups 20 are configured such that at least one server is assigned to each service (services A to X).

The configuration of the server 10 has already been explained above, so a description thereof will be omitted. The other server group 20 obtains the encrypted similarity from the server 10 and decrypts it. As a result of decoding, if the degree of similarity is within a predetermined acceptance range, a message indicating that authentication is OK is notified to the terminal. On the other hand, if the degree of similarity is a value outside the predetermined acceptance range, an authentication NG message is notified to the terminal.

Further, if the server 10 holds the user ID of the service user in association with the first feature amount in the storage unit, the other server group 20 may identify the user based on the degree of similarity and predetermined criteria. You may also obtain an ID. For example, a process may be performed to obtain the user ID associated with the feature with the highest degree of similarity. The user ID obtained here may be used as a login ID for a service being executed on another server 20.

Furthermore, the other server group 20 may be configured to acquire payment information including the user ID based on the authentication result, transmit the payment information to the payment server, and receive payment result information from the payment server.

[System operation]
8 to 10 are sequence diagrams showing an example of the operation of the server according to the second embodiment. FIG. 8 shows an example of the operation when generating a key, and FIG. 9 shows an example of the operation when registering the first feature amount. FIG. 10 shows an example of the operation when comparing the second feature amount and the first feature amount.

[System operation: During key generation]
Referring to FIG. 8, at the start of system operation, the server 10 and other servers 20 corresponding to service A share public key and private key pairs (pk _A , sk _A ) and (pk _S , sk _S ). are generated respectively (steps S401 and S402). Next, the public key pk _A (or sk _A ) is sent from the other server 20 to the server 10 . In the server 10, a conversion key rk _S→A is generated using the private key sk _S and the received public key pk _A (step S403). The generated public key _{pk_S} of the server 10 is sent to the user terminal 1. Note that if no more services are added, that is, the number of other servers 20 does not increase, the private key _skS may be deleted (step S404).

[When registering template]
Referring to FIG. 9, the public key of the server 10 is sent to the user terminal 1 of service A (reprinted). The user terminal 1 of the service A acquires the biometric feature x ₁ of the user 1. The obtained _x1 is encrypted using the sent public key of the server 10 (step S405). The encrypted data is sent to the server 10 as a first feature amount. At this time, the user ID of user 1 may be associated and sent. This operation is repeated as many times as there are users.

[When checking]
Referring to FIG. 10, first, the service ID "SID(A)" is sent from another server 20. The user terminal 1 acquires the biometric feature amount _y1 of the user 1 who is about to be authenticated. Next, _y1 is encrypted using the public key _pkS sent from the server 10 (step S406). The encrypted feature quantity _y1 is sent to the server 10 as a second feature quantity together with the service ID: SID(A). The server 10 calculates the degree of similarity between the first feature amount and the second feature amount (step S407). Since the calculated Enc(pk _S , D(x ₁ , y ₁ )) is encrypted with the public key pk _S of the server 10, the other server 20 can decrypt it with its own private key sk _S. Key conversion is performed using conversion key rk _S→A (step S408). Next, the encrypted similarity Enc (pk _A , D (x ₁ , y ₁ )) is sent from the server 10 to the other server 20, and decryption processing is performed (step S409). It is determined whether the decoded D has a value within a predetermined range (step S410). Depending on the result, the other server 20 notifies the user terminal of an OK or NG message.

[Other system behavior]
Figures 11 and 12 illustrate the operation of the system when using endpoints. An "endpoint" refers to a device that can receive authentication services, such as a terminal installed at a convenience store.

[Another system behavior: During key generation]
Referring to FIG. 11, the endpoint of service A generates the key instead of the user's terminal. A public key/private key pair (pk _α , sk _α ) of endpoint α is generated (step S501). Further, a set of public key and private key is generated for both the other servers 20 and 10 (steps S502 and S503). Similarly to the above, a conversion key rk _S→A is generated on the server 10 (step S504). The endpoint α receives the public key pk _S (or sk _S ) from the server 10 and generates a conversion key rk _α→S (step S505). Note that the secret key sk _α may be deleted after the conversion key is generated (step S506).

[When registering template]
When registering a template, the user's terminal can be used to transmit encrypted biometric information of the user as the first feature amount to the server 10 and store it. In this case, the operation is the same as that in FIG. 9, so the explanation will be omitted.

[When checking]
Referring to FIG. 12, the endpoint α acquires the biometric information of the user performing authentication, extracts the feature quantity _y1 , and encrypts it with its own public key _pkα (step S507). The encrypted authentication query data is sent to the server 10 along with the service ID: SID (A) and the endpoint ID: EID (α). On the server 10, first, the encrypted second feature Enc (pk _α , y ₁ ) is converted to Enc (pk _S , y _{1 )} for comparison with the first feature using the conversion key rk _α→S . ) (step S508). Then, the degree of similarity with the registered first feature amount is calculated (step S509). After that, the key is again converted from _pks to pk _A so that it can be decrypted with the key of another server 20 (step S510). Thereafter, similar to FIG. 10, the similarity is decoded in another server 20 (step S511), and a determination is made as to whether it is within the acceptance range (step S512). The result of the determination is notified to the endpoint α.

[Explanation of effects]
In the authentication system of this embodiment, the first feature amount is encrypted and registered in the server 10 by the user terminal. The second feature amount, which is the authentication query, is similarly encrypted, and the server 10 calculates the degree of similarity while it remains encrypted. By converting the encrypted similarity key that is the result, it is possible to decrypt it using the key of another server 20. Therefore, it is possible to achieve high security and privacy as well as high-speed processing as an authentication service.

Part or all of the above-described embodiments can also be described as in the following additional notes. However, the following additional notes are merely illustrative of the present invention, and the present invention is not limited to such cases.
[Additional note 1]
This is the same as the server according to the first viewpoint described above.
[Additional note 2]
Preferably, the calculation unit is the server according to Supplementary note 1, which calculates the degree of similarity based on the first feature amount and the second feature amount, each of which is encrypted.
[Additional note 3]
A key generation unit that generates a set of a private key and a public key, and a conversion key acquisition unit that acquires a conversion key from the private key generated by the key generation unit and the key acquired from another server. Preferably, the server further comprises a server according to Supplementary Note 1 or 2.
[Additional note 4]
The storage unit stores a user ID that identifies the user in association with the first feature amount, and the conversion transmission unit associates the degree of similarity with the user ID and transmits it to another server, preferably according to appendices 1 to 3. One of the servers.
[Additional note 5]
This is the same as the authentication system according to the second viewpoint described above.
[Additional note 6]
Preferably, the other server decodes the similarity and obtains the user ID associated with the highest similarity.
[Additional note 7]
The server includes a key generation unit that generates a pair of private key and public key, and a conversion key acquisition unit that acquires a conversion key from the private key generated by the key generation unit and a key acquired from another server. Preferably, the authentication system according to appendix 5 or 6 further comprises.
[Additional note 8]
Preferably, the authentication system according to any one of appendixes 5 to 7, wherein the other server transmits payment information including the one user ID to the payment server and receives payment result information from the payment server.
[Additional note 9]
This is the same as the authentication method according to the third viewpoint described above.
[Additional note 10]
This is the same as the program related to the fourth perspective mentioned above.

Furthermore, the disclosures of the above cited patent documents, etc. are incorporated into this book by reference. Within the scope of the entire disclosure of the present invention (including the claims), changes and adjustments to the embodiments can be made based on the basic technical idea thereof. Furthermore, various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment or embodiment, each element of each drawing, etc.) within the framework of the entire disclosure of the present invention (including partial deletion) is possible. That is, it goes without saying that the present invention includes the entire disclosure including the claims and various modifications and modifications that a person skilled in the art would be able to make in accordance with the technical idea. In particular, numerical ranges stated herein should be construed as specifically stating any numerical value or subrange within the range, even if not otherwise stated.

10: Server 11: Storage unit 12: Acquisition unit 13: Calculation unit 14: Conversion transmission unit 15: Key generation unit 16: Conversion

key acquisition unit

20, 21, 22: Server (group)
23, 25: Users 24, 26: Terminal 301: CPU
302: Memory 303: Input/output interface 304: NIC
305: Internal bus

Claims

a storage unit that stores the encrypted first feature amount;
an acquisition unit that acquires the encrypted second feature quantity accepted by the terminal;
a calculation unit that calculates a degree of similarity based on the first feature amount and the second feature amount;
a conversion transmitter that converts the similarity into a format that can be decoded by another server and transmits it to the other server;
A server with
The calculation unit calculates the degree of similarity based on the first feature amount and the second feature amount, each of which is encrypted.
The server according to claim 1.
a key generation unit that generates a set of private key and public key;
a conversion key acquisition unit that acquires a conversion key from the private key generated by the key generation unit and a key acquired from another server;
The server according to claim 1 or 2, further comprising:
The storage unit stores a user ID that identifies a user in association with a first feature amount,
The conversion transmitter associates the degree of similarity with the user ID and transmits it to another server.
The server according to any one of claims 1 to 3.
a storage unit that stores the encrypted first feature amount;
an acquisition unit that acquires the encrypted second feature quantity accepted by the terminal;
a calculation unit that calculates a degree of similarity based on the first feature amount and the second feature amount;
a conversion transmitting unit that converts the similarity into a format that can be decoded by another server and transmits it to the other server,
The storage unit stores a user ID that identifies a user in association with a first feature amount,
The calculation unit calculates the degree of similarity based on the first feature amount and the second feature amount, each of which is encrypted,
The conversion transmitter associates the degree of similarity with the user ID and transmits it to another server.
server and
the other server that decodes the similarity and obtains one user ID based on the similarity and a predetermined criterion;
Authentication system including.
The other server decodes the degree of similarity and obtains a user ID associated with the highest degree of similarity;
The authentication system according to claim 5.
The server is
a key generation unit that generates a set of private key and public key;
further comprising a conversion key acquisition unit that acquires a conversion key from the private key generated by the key generation unit and the key acquired from another server;
The authentication system according to claim 5 or 6.
The other server transmits payment information including the one user ID to the payment server,
receiving payment result information from the payment server;
The authentication system according to any one of claims 5 to 7.
a step in which the computer stores the encrypted first feature;
a step in which the computer acquires a second feature quantity accepted and encrypted by the terminal;
the computer calculating a degree of similarity based on the first feature amount and the second feature amount;
An authentication method comprising the step of the computer converting the degree of similarity into a format that can be decoded by another server and transmitting it to the other server.
a process of storing the encrypted first feature;
a process of acquiring a second feature quantity accepted and encrypted by the terminal;
a process of calculating a degree of similarity based on the first feature amount and the second feature amount;
a process of converting the similarity into a format that can be decoded by another server and transmitting it to the other server;
A program that causes a computer to execute