JP2012119922A - Information processor, pseudo random number generation device, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To restore input data from output data which is generated with respect to the input data and is used for authentication, etc.SOLUTION: An information processor includes a first calculation unit, a second calculation unit, and a third calculation unit. The first calculation unit calculates first output data, based on first input data, and first auxiliary data for calculating the first output data from second input data whose difference from the first input data is included in a first range, and then, calculates second auxiliary data for calculating the first input data from the first output data, based on at least one between the first output data and the first auxiliary data, and the first input data. The second calculation unit calculates the first output data, based on the second input data and the first auxiliary data. The third calculation unit calculates the first input data, based on the first output data and the second auxiliary data.

Description

  Embodiments described herein relate generally to an information processing device, a pseudorandom number generation device, and a program.

  In an authentication system in which input data may include an error, if the input data is within a predetermined error range, it is required to calculate error-free data (authentication data) for use in authentication. .

  As a technique for realizing such a calculation, a pseudo-random number generator called a fuzzy extractor is known.

  In the authentication system in which the input data described above may include an error, the pseudo-random number output from the fuzzy extractor with the data received at the time of system registration as the input is used as the authentication data. Then, the authentication data is stored together with auxiliary data that the fuzzy extractor outputs together with the pseudo random number. When authenticating, input data that may contain errors and auxiliary data are input to the fuzzy extractor to calculate the output data. If the stored authentication data matches the output data, an authentication request is issued. If it does not match, it is rejected.

Y. Dodis et al., Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data. SIAM Journal on Computing Volume 38, Number 1, 97-139, 2008.

  However, when a fuzzy extractor is used in an authentication system in which input data may contain an error, there is a problem that input data cannot be restored from output data and auxiliary data stored in the authentication system. is there.

  The information processing apparatus according to the embodiment includes a first calculation unit, a second calculation unit, and a third calculation unit. A first calculator configured to calculate first output data from second input data in which an error between the first output data and the first input data is included in a first range based on the first input data; Second auxiliary data for calculating first input data from the first output data based on at least one of the first output data and the first auxiliary data and the first input data. calculate. The second calculation unit calculates first output data based on the second input data and the first auxiliary data. The third calculator calculates first input data based on the first output data and the second auxiliary data.

1 is a block diagram of an information processing apparatus according to a first embodiment. The flowchart of the pseudorandom number generation process in 1st Embodiment. The flowchart of the pseudorandom number reproduction process in 1st Embodiment. The flowchart of the reverse image calculation process in 1st Embodiment. The flowchart of the pseudorandom number generation process in 1st Embodiment. The flowchart of the reverse image calculation process in 1st Embodiment. The block diagram of the information processing apparatus concerning 2nd Embodiment. The flowchart of the pseudorandom number generation process in 2nd Embodiment. The flowchart of the reverse image calculation process in 2nd Embodiment. The block diagram of the information processing apparatus in 3rd Embodiment. The flowchart of the registration process in 3rd Embodiment. The flowchart of the authentication process in 3rd Embodiment. The flowchart of the audio | voice data restoration process in 3rd Embodiment. The hardware block diagram of the information processing apparatus concerning 1st to 3rd embodiment.

  Exemplary embodiments of an information processing apparatus according to the present invention will be described below in detail with reference to the accompanying drawings.

  First, the configuration of the fuzzy extractor of Non-Patent Document 1 will be described. The fuzzy extractor includes two functions: a generation function (“Gen” in Non-Patent Document 1) and a reproduction function (“Rep” in Non-Patent Document 1). The generation function is a function that receives first input data and calculates output data and auxiliary data. The reproduction function is a function that receives the second input data and the auxiliary data and reproduces the output data when the error between the first input data and the second input data is within a predetermined range.

(First embodiment)
In the first embodiment, generation of a pseudorandom number (generation unit), reproduction of a pseudorandom number (reproduction unit), and restoration of input data (inverse image calculation unit) are performed using the generation function Gen and the reproduction function Rep. An example configuration is shown. Even if the present embodiment is configured using a function different from the generation function and the reproduction function disclosed in Non-Patent Document 1, as long as the function has a function equivalent to the generation function and the reproduction function of Non-Patent Document 1. good.

  FIG. 1 is a block diagram illustrating an example of the configuration of the information processing apparatus 100 according to the first embodiment. As illustrated in FIG. 1, the information processing apparatus 100 includes a generation unit 110, a reproduction unit 120, and an inverse image calculation unit 130. The generation unit 110, the reproduction unit 120, and the inverse image calculation unit 130 may be configured as separate devices and connected via a network, or one or more devices may be configured as the same device. . For example, the generation unit 110 may be configured as one pseudo random number generation device.

  The generation unit 110 includes an input / output unit 113 and a first calculation unit 111. The input / output unit 113 functions as a receiving unit that receives first input data, and further outputs first output data, first auxiliary data, and second auxiliary data.

  The first calculation unit 111 includes a Gen calculation unit 111a that calculates a fuzzy extractor generation function Gen and a second auxiliary data calculation unit 111b. The Gen calculation unit 111a calculates first output data and first auxiliary data from the first input data. The second auxiliary data calculation unit 111b calculates second auxiliary data from at least one of the first output data and the first auxiliary data and the first input data. The second auxiliary data calculation unit 111b has a function of calculating the encryption function Enc. The encryption function Enc (k, m) is a function that encrypts plaintext m using k as an encryption key. As the encryption function Enc, for example, RSA encryption or elliptic curve encryption may be used in addition to common key encryption such as AES (Advanced Encryption Standard) and Hiercrypt.

  The reproduction unit 120 includes an input / output unit 122 and a second calculation unit 121. The input / output unit 122 receives the second input data and the first auxiliary data, and outputs the second output data. The second calculation unit 121 includes a function of calculating a reproduction function Rep of the fuzzy extractor, and calculates second output data from the second input data and the first auxiliary data.

  The inverse image calculation unit 130 includes an input / output unit 132 and a third calculation unit 131. The input / output unit 132 receives the first output data or the second output data and the second auxiliary data, and outputs the third output data. The third calculator 131 calculates third output data from the first output data or the second output data and the second auxiliary data. The third calculator 131 has a function of calculating a decryption function Dec corresponding to the encryption function Enc held by the second auxiliary data calculator 111b of the generator 110.

  Next, a pseudo random number generation process performed by the information processing apparatus 100 according to the first embodiment configured as described above will be described with reference to FIG. FIG. 2 is a flowchart showing the overall flow of the pseudorandom number generation process in the first embodiment.

Output unit 113 of the generator 110, first receives the input data _{x 1} (step S101). Next, Gen calculation unit 111a of the generator 110, as shown in the following equation (1), the first input data _{x 1} input to generation function Gen, first output data _{y 1} and the first auxiliary data w ₁ is calculated (step S102).
(Y ₁ , w ₁ ) = Gen (x ₁ ) (1)

Second auxiliary data calculating unit 111b of the generator 110, a first input data _{x 1, (y} 1, _{w 1)} with the components necessary for the calculation of, following procedure second auxiliary data _{w 2} Calculate

Second auxiliary data calculating unit 111b _calculates an encryption key _{k e} from at least one of _(y 1, _{w 1)} (step S103). For example, the second auxiliary data calculating unit 111b, the first output data y ₁ or the first auxiliary data w ₁ bit sequence is itself, the first output data y ₁ and the first auxiliary data w ₁ and the bit string obtained by connecting, or A bit string obtained by arithmetically adding the first output data y ₁ and the first auxiliary data w ₁ is obtained. When the bit length determined than the key length required by the encryption function is long, the subsequence of the bit string obtained the encryption key k _e. Bit length of the bit sequence required when less than the key length to generate an encryption key k _e required key length, such as by imparting 0.

Second auxiliary data calculating unit 111b includes a first input data _{x 1} and encryption key _{k e} performs encryption processing by entering the encryption function Enc, second auxiliary data _{w 2 = Enc (k e,} x 1 ) Is calculated (step S104). The input / output unit 113 outputs (y ₁ , w ₁ , w ₂ ) (step S105).

In the case where the inverse image calculation unit 130 to be described later to hold the key k _3, the second auxiliary data calculating unit 111b may be configured to hold the key k ₂ corresponding to key k _3. At this time, the second auxiliary data calculating unit 111b may use a key _{k 2} as the encryption key _{k e.} At this time, when the encryption function Enc is a function of the common key cryptosystem, k ₂ = k ₃ , and when it is a function of the public key cryptosystem, k ₂ ≠ k ₃ . The second auxiliary data calculating unit 111b, the key _{k 2} and _{(y 1, w} 1) from a portion of the may be obtained encryption key _{k e.} If that does not require the first one or both of the output data y ₁ and the first auxiliary data w ₁ for the calculation of the encryption key k _e is the second auxiliary data calculating unit 111b required for encryption key k _e Only information needs to be input.

Also, selected according to at least the method of calculating from one encryption key k _e, of the method of calculating the encryption key k _e from the key k _2, designated by the user in (y _{1, w 1)} any of the methods may be configured to calculate the encryption key k _e with.

  Next, pseudo random number reproduction processing by the information processing apparatus 100 according to the first embodiment will be described with reference to FIG. FIG. 3 is a flowchart showing the overall flow of the pseudorandom number reproduction process in the first embodiment.

Output unit 122 of the reproduction unit 120 receives a second input data _{x 2} a first auxiliary data _{w 1} (step S201). Next, the second calculation unit 121 of the reproduction unit 120 inputs the second input data x ₂ and the first auxiliary data w ₁ to the reproduction function Rep, and outputs the second output data y ₂ = Rep (x ₂ , w ₁ ) Is calculated (step S202). Finally output unit 122 of the reproduction unit 120 outputs the second output data _{y 2} (step S203).

Here, the nature of the generating function Gen and repeatability function Rep Non-Patent Document 1, the first input data x ₁ second input data x ₂ errors when within a predetermined range (first range) (predetermined constant The second output data y ₂ is equal to the first output data y ₁ , for example, different bits between the first input data x ₁ and the second input data x ₂ are at most d bits with respect to d).

  Next, an inverse image calculation process by the information processing apparatus 100 according to the first embodiment will be described with reference to FIG. FIG. 4 is a flowchart showing the overall flow of the inverse image calculation process in the first embodiment.

Output unit 132 of the inverse image calculation unit 130 receives the first output data _{y 1} and the first auxiliary data _{w 1} and the second auxiliary data _{w 2} (step S301). The third calculation unit 131 of the inverse image calculation unit 130 calculates the third output data y ₃ from (y ₁ , w ₁ , w ₂ ) in the following procedure.

The third calculator 131 calculates a decryption key k _d from (y ₁ , w ₁ , w ₂ ) (step S302). As described above, when the inverse image calculation unit 130 holds the key k ₃ , the third calculation unit 131 may calculate the decryption key k _d from the key k ₃ . Calculation decryption key k _d, the second auxiliary data calculating unit 111b of the generator 110 is the same as the calculation method for obtaining the encryption key k _e. Next, the third calculation unit 131 of the inverse image calculation unit 130 calculates the third output data y ₃ = Dec (k _d , w ₂ ) (step S303). Output unit 132 of the inverse image calculation unit 130 outputs the third output data _{y 3} (step S304).

Here, if (y ₁ , w ₁ , w ₂ ) is data calculated from the first input data x ₁ by the generation unit 110, the third output data y ₃ matches the first input data x ₁ . .

(Modification 1)
The information processing apparatus 100 according to Modification 1 includes a generation unit 110, a reproduction unit 120, and an inverse image calculation unit 130 as in the first embodiment described above, but differs from the first embodiment only in the following points. .

  In the first embodiment, the second auxiliary data calculation unit 111b of the generation unit 110 has a function of calculating the encryption function Enc, and the third calculation unit 131 of the inverse image calculation unit 130 has a function of calculating the decryption function Dec. I was prepared.

  In the first modification, the second auxiliary data calculation unit 111b of the generation unit 110 and the third calculation unit 131 of the inverse image calculation unit 130 hold a hash function (hash function family).

  Next, a pseudo random number generation process performed by the information processing apparatus 100 according to the first modification of the first embodiment configured as described above will be described with reference to FIG. FIG. 5 is a flowchart showing an overall flow of the pseudo-random number generation process in the first embodiment.

  Steps S401 to S402 are the same as steps S101 to S102 in FIG.

Second auxiliary data calculating unit 111b of the generator 110, a first input data _{x 1, (y} 1, _{w 1)} with the components necessary for the calculation of, following procedure second auxiliary data _{w 2} Calculate

The second auxiliary data calculation unit 111b calculates a hash key k _h from at least one of (y ₁ , w ₁ ) (step S403). If the configuration for holding the key k ₂ corresponding to the key k ₃ as described above, from the key k ₂ may be calculated hash key k _h. Second auxiliary data calculating unit 111b, among the plurality of hash functions in the hash function family, selecting a hash function H that corresponds to the calculated hash key k _h (step S404).

  The hash key calculation method is the same as the encryption key calculation method of the generation unit 110 in the first embodiment. As will be described later, when the second auxiliary data calculation unit 111b and the third calculation unit 131 of the inverse image calculation unit 130 hold the same hash function H in advance, steps S403 and S404 are omitted. Also good.

The second auxiliary data calculation unit 111b inputs at least one of (y ₁ , w ₁ ) to the hash function H (•) and calculates the first hash data h ₁ (step S405). As described later, when the inverse image calculation unit 130 holds the key k ₅ may calculate the corresponding key k ₄ from the first hash data h _1. Next, the second auxiliary data calculation unit 111b calculates the second auxiliary data w ₂ = h ₁ (*) x ₁ from the first input data x ₁ and the first hash data h ₁ (step S406). Here, (*) is a predetermined binary operation, and uses an exclusive OR, or a cryptographic operation for encrypting the first input data x ₁ using the first hash data h ₁ as an encryption key.

The input / output unit 113 outputs (y ₁ , w ₁ , w ₂ ) (step S407).

  Next, an inverse image calculation process performed by the information processing apparatus 100 according to the first modification of the first embodiment configured as described above will be described with reference to FIG. FIG. 6 is a flowchart showing the overall flow of the inverse image calculation process in the first embodiment.

Step S501 is the same as step S301 in FIG. The third calculation unit 131 of the inverse image calculation unit 130 calculates the third output data y ₃ from (y ₁ , w ₁ , w ₂ ) in the following procedure.

The third calculator 131 calculates the hash key k _h from (y ₁ , w ₁ ) (step S502). When inverse image calculation portion 130 is configured to hold the key k ₃ from the key k ₃ may calculate the hash key k _h. The third calculation unit 131 selects the hash function H on the basis of the hash key _{k h} (step S503). Selection method of calculation method and a hash function H of the hash key k _h is the same as the method of selecting a computation method and a hash function H of the hash key k _h by the second auxiliary data calculating unit 111b of the generator 110.

  As described above, when the inverse image calculation unit 130 holds the hash function H in advance, steps S502 and S503 are omitted.

Next, the third calculation unit 131 of the inverse image calculation unit 130 inputs at least one of (y ₁ , w ₁ ) to the hash function H (•) and calculates the second hash data h ₂ (Step S504). ). When the inverse image calculation unit 130 holds the key k ₅ and the generation unit 110 calculates the first hash data h ₁ using the key k ₄ as described above, the inverse image calculation unit 130 stores the key k ₅ the second hash data key h ₂ may be calculated using the. Next, the third calculator 131 calculates the third output data y ₃ = h ₂ (@) w ₂ from the second auxiliary data w ₂ and the second hash data h ₂ (step S505).

  Here, (@) is a binary operation corresponding to the above (*). Note that (@) may be any calculation as long as it calculates the input of (*) from the output of (*). For example, when (*) is an exclusive OR operation, (@) is also an exclusive OR operation, and when (*) is an encryption operation, (@) is a decryption operation.

Output portion 132 of the third calculation portion 131 outputs the third output data _{y 3} (step S506).

Here, if (y ₁ , w ₁ , w ₂ ) is data calculated from the first input data x ₁ by the generation unit 110, the third output data y ₃ matches the first input data x ₁ . .

  As described above, the information processing apparatus according to the first embodiment generates auxiliary data (second auxiliary data) used for restoring input data when generating pseudo-random numbers (first output data). The inverse image calculation unit can accept the first output data and the second auxiliary data as inputs and restore the first input data.

Furthermore, in the information processing apparatus according to the first embodiment, (y _{1, w 1)} to depend encryption key k _e and first hash data h ₁ is calculated, a different value for each input x _1. Therefore, the encryption key k _e and even when the first information hash data h ₁ is leaked, and the first hash data h _{1 which 'encryption} key k _e' corresponding to the different input x ₁ corresponding to a certain input x ₁ '' S information will not be leaked and safety will be maintained. In general, a different encryption key is prepared and stored for each input. The information processing apparatus according to the first embodiment, needs to be prepared separately encryption key by calculating the (y _{1, w 1)} to depend encryption key k _e and first hash data h ₁ In addition, the storage area can be reduced.

(Second Embodiment)
In the configuration shown in the first embodiment, if the second input data input to the reproduction unit 120 is within a predetermined error range from the first input data, the reproduction unit 120 outputs the first data output from the generation unit 110. One output data can be reproduced. On the other hand, the first output data is input to the input / output unit 132 of the inverse image calculation unit 130.

  In the second embodiment, if the input given to the input / output unit of the inverse image calculation unit is within a predetermined error range (second range) from the first output data output by the generation unit, the input of the generation unit It is possible to restore.

  FIG. 7 is a block diagram illustrating an example of the configuration of the information processing apparatus 200 according to the second embodiment. As illustrated in FIG. 7, the information processing apparatus 200 includes a generation unit 210, a reproduction unit 120, and an inverse image calculation unit 230. Components having the same functions as those in the first embodiment are denoted by the same reference numerals, and description thereof is omitted here.

  As in the first embodiment, the generation unit 210, the reproduction unit 120, and the inverse image calculation unit 230 may be configured as separate devices and connected via a network, or one or more devices. May be configured as the same device.

  The generation unit 210 includes an input / output unit 213 and a first calculation unit 211. The input / output unit 213 receives first input data and outputs first output data, first auxiliary data, second auxiliary data, and third auxiliary data.

  The first calculation unit 211 includes a Gen calculation unit 211a that calculates a fuzzy extractor generation function Gen and a second auxiliary data calculation unit 211b. The Gen calculation unit 211a calculates first output data and first auxiliary data from the first input data. Furthermore, the Gen calculation unit 211a calculates intermediate data (hereinafter referred to as third intermediate data for convenience of explanation) and third auxiliary data from at least one of the first output data and the first auxiliary data.

  The Gen calculation unit 211a may hold two types of different generation functions Gen and calculate the above-described two types of calculations with different Gens. Hereinafter, a configuration example in which calculation is performed using the same generation function Gen will be described.

  The second auxiliary data calculation unit 211b has a function of calculating the encryption function Enc as in the first embodiment, and calculates the second auxiliary data from the first input data and the third intermediate data.

  The inverse image calculation unit 230 includes an input / output unit 232 and a third calculation unit 231. The input / output unit 232 receives the first output data or the second output data, the second auxiliary data, and the third auxiliary data, and outputs the third output data.

  The third calculation unit 231 includes a Rep calculation unit 231a. The Rep calculation unit 231a includes a function for calculating a reproduction function Rep corresponding to the generation function Gen similar to the Gen calculation unit 211a of the generation unit 210. The third calculator 231 calculates third output data from the first output data or second output data, second auxiliary data, and third auxiliary data. The third calculation unit 231 holds a decryption function Dec corresponding to the encryption function Enc held by the second auxiliary data calculation unit 211b of the generation unit 210 described above.

  Next, pseudo random number generation processing by the information processing apparatus 200 according to the second embodiment configured as described above will be described with reference to FIG. FIG. 8 is a flowchart showing an overall flow of the pseudo-random number generation process in the second embodiment.

  Steps S601 to S602 are the same as steps S101 to S102 in the information processing apparatus 100 according to the first embodiment, and a description thereof will be omitted.

Gen calculation unit 211a of the generator 210, as shown in the following equation (3), the first output data _{y 1} input to generation function Gen, calculated to the third intermediate data _{z 3} a third auxiliary data _{w 3} (Step S603).
(Z ₃ , w ₃ ) = Gen (y ₁ ) (3)

Second auxiliary data calculating unit 211b inputs the component comprising at least a third intermediate data _{z 3} and third auxiliary data _{w 3} of the first input data _{x 1} and _{(z 3,} w 1, _{w 3),} calculating a second auxiliary data w ₂ by the following procedure.

The second auxiliary data calculation unit 211b encrypts the component including at least the third intermediate data z ₃ and the third auxiliary data w ₃ in (z ₃ , w ₁ , w ₃ ) as in the first embodiment. to calculate the key _{k e} (step S604). In the case of configuration that holds the key k ₂ may be calculated encryption key k _e from the key k _2.

Second auxiliary data calculating unit 211b includes a first input data _{x 1} and encryption key _{k e} performs encryption processing by entering the encryption function Enc, second auxiliary data _{w 2 = Enc (k e,} x 1 ) Is calculated (step S605). The input / output unit 213 outputs (y ₁ , w ₁ , w ₂ , w ₃ ) (step S606).

  Since the processing procedure of the reproduction unit 120 is the same as that in FIG. 3 of the first embodiment, description thereof is omitted.

  Next, an inverse image calculation process performed by the information processing apparatus 200 according to the second embodiment configured as described above will be described with reference to FIG. FIG. 9 is a flowchart showing the overall flow of the inverse image calculation process in the second embodiment.

Output of the inverse image calculation portion 230 232, the third input data x ₃ and the first auxiliary data w ₁ of the first output data y ₁ and a predetermined range of error to be (second range) within the expected When receiving the second auxiliary data _{w 2} and a third auxiliary data _{w 3} (step S701). The third calculation unit 231 of the inverse image calculation unit 230 calculates the third output data y ₃ from (x ₃ , w ₁ , w ₂ , w ₃ ) in the following procedure.

The Rep calculation unit 231a of the third calculation unit 231 calculates the fourth intermediate data z ₄ = Rep (x ₃ , w ₃ ) by inputting (x ₃ , w ₃ ) to the reproduction function Rep (step S702). Third input data x _3, if within a predetermined error between the first output data y _1, the fourth intermediate data z ₄ corresponds to the third intermediate data z _3.

Similar to the first embodiment, the third calculator 231 performs the first implementation from components including at least the fourth intermediate data z ₄ and the third auxiliary data w ₃ in (z ₄ , w ₁ , w ₃ ). Morphology and calculating a decryption key _{k d} in the same manner (step S703). Incidentally, the inverse image calculation unit 230 may calculate the decryption key k _d from the key k ₃ in the case of a configuration that holds the key k _3.

Next, the third calculator 231 calculates third output data y ₃ = Dec (k _d , w ₂ ) (step S704). Output unit 232 outputs the third output data _{y 3} (step S705).

Here, (y ₁ , w ₁ , w ₂ , w ₃ ) is data calculated from the first input data x ₁ by the generation unit 210, and the third input data x ₃ is predetermined with the first output data y _1. The third output data y ₃ coincides with the first input data x ₁ .

(Modification 2)
Similar to the first modification in the first embodiment, the following second modification can be configured. The second auxiliary data calculation unit 211b of the generation unit 210 and the third calculation unit 231 of the inverse image calculation unit 230 in the second embodiment hold a hash function (family) instead of the encryption function and the decryption function, and The second auxiliary data and the third output data are calculated by the same processing as in Example 1.

  As described above, in the information processing apparatus according to the second embodiment, when the input is restored, the input given to the input / output unit of the inverse image calculation unit is the same as the output data output when generating the pseudo-random number and the predetermined value. If it is within the error range, the input of the generation unit can be restored.

(Third embodiment)
In the third embodiment, a configuration example of a voice authentication system is shown as an application example of the configuration shown in the first embodiment. The voice authentication system can be configured in the same manner using the first modification, the second embodiment, and the second modification.

  FIG. 10 is a block diagram illustrating an example of the configuration of the information processing apparatus 300 that implements the voice authentication system according to the third embodiment. As illustrated in FIG. 10, the information processing apparatus 300 includes a registration processing unit 310, an authentication processing unit 320, an audio restoration unit 330, an input / output unit 301, and a storage unit 340. Each of these may be configured by individual devices, or one or more may be configured by the same device. Note that components having the same functions as those in the first embodiment are denoted by the same reference numerals, and description thereof is omitted here.

  The input / output unit 301 receives registration voice data, authentication voice data, a registration request, an authentication request, and a voice restoration request, and outputs a registration result, an authentication result, and a registered voice.

  The registration processing unit 310 internally holds the generation unit 110 shown in the first embodiment, receives registration audio data, and outputs first output data, first auxiliary data, and second auxiliary data.

  The authentication processing unit 320 internally retains the reproduction unit 120 shown in the first embodiment, receives authentication voice data, first output data, and first auxiliary data as inputs, and outputs an authentication result.

  The sound restoration unit 330 holds the inverse image calculation unit 130 shown in the first embodiment, and outputs the third output data with the first output data, the first auxiliary data, and the second auxiliary data as inputs. In the case of normal operation, the third output data matches the corresponding registration voice data.

  The storage unit 340 holds the first output data, the first auxiliary data, and the second auxiliary data. Such information may be held together with user identification information.

  Next, registration processing by the information processing apparatus 300 according to the third embodiment configured as described above will be described with reference to FIG. The registration process is a process for generating a pseudo random number from the registration voice data and registering it in the storage unit 340 functioning as an authentication database. FIG. 11 is a flowchart showing an overall flow of registration processing in the third embodiment.

The input / output unit 301 of the information processing apparatus 300 receives a registration request and registration voice data (first input data x ₁ ) (step S801). The registration processing unit 310 inputs the registration audio data to the generation unit 110 and calculates the first output data y ₁ , the first auxiliary data w ₁ and the second auxiliary data w ₂ (step S802). The process of step S802 can be realized by the same process as in FIG.

The registration processing unit 310 stores the first output data y ₁ , the first auxiliary data w ₁ and the second auxiliary data w ₂ in the storage unit 340 (step S803). If the identity of a user is input in step S801 may be to save the identification information in step S803 to the first output data y ₁ such along with storage unit 340. The input / output unit 301 outputs a registration completion notification (step S804).

Next, an authentication process performed by the information processing apparatus 300 according to the third embodiment configured as described above will be described with reference to FIG. In the authentication process, the output data calculated from the authentication voice data and the auxiliary data is compared with the output data (first output data y ₁ ) stored in the storage unit 340 by the registration process, thereby obtaining the authentication voice data. It is a process to authenticate. FIG. 12 is a flowchart showing the overall flow of the authentication process in the third embodiment.

The input / output unit 301 of the information processing apparatus 300 receives the authentication request and the authentication voice data (first input data x ₂ ) (step S901). The authentication processing unit 320 reads the first output data y ₁ and the first auxiliary data w ₁ from the storage unit 340 (step S902). Next, the authentication processing unit 320 inputs the authentication voice data and the first auxiliary data _{w 1} to reproducing unit 120 and calculates the second output data _{y 2} (step S903). Authentication processing unit 320, first output data _{y 1} and the second output data _{y 2} checks whether match (step S904).

  If the inspection results match (step S904: Yes), the input / output unit 301 outputs information indicating that the authentication has passed (step S905). If the inspection results do not match (step S904: No), the input / output unit 301 outputs information indicating that the authentication has not passed (step S906).

  Next, audio data restoration processing by the information processing apparatus 300 according to the third embodiment configured as described above will be described with reference to FIG. The voice data restoration process is a process for restoring the registration voice data from the data (first output data or the like) output in the registration process. FIG. 13 is a flowchart showing the overall flow of the audio data restoration processing in the third embodiment.

The input / output unit 301 of the information processing apparatus 300 accepts a voice restoration request (step S1001). The voice restoration unit 330 reads the first output data y ₁ , the first auxiliary data w ₁ and the second auxiliary data w ₂ from the storage unit 340 (step S1002). Next, the sound restoration unit 330 inputs the first output data y ₁ , the first auxiliary data w ₁ and the second auxiliary data w ₂ to the inverse image calculation unit 130, and calculates the third output data y ₃ (step) S1003). Output unit 301 outputs the third output data _{y 3} (step S1004).

  The data held in the authentication database (storage unit 340) is first output data, first auxiliary data, and second auxiliary data. The voice restoration unit 330 can restore the registration voice data from these data. However, a device that does not include the voice restoration unit 330 cannot restore the registration voice data from these data. Therefore, even if the data stored in the storage unit 340 is leaked when the manager of the storage unit 340 is careless or when the unauthorized access to the storage unit 340 is attempted, the registration audio data is protected. Therefore, key phrase and voiceprint information related to the registration audio data is protected.

  Thus, in the third embodiment, a voice authentication system to which the configuration shown in the above embodiment is applied can be realized.

  As described above, according to the first to third embodiments, when generating pseudo-random numbers, data (second auxiliary data) for calculating (restoring) input data from output data is calculated, 2 Input data can be calculated from auxiliary data and output data. Thereby, it is possible to restore the input data when the pseudo random number is generated. For example, if the information processing apparatus of each of the above embodiments is applied to an authentication system using a fuzzy extractor, the biological information can be restored from data unique to the biological information stored in the authentication system. .

An example of a scene to which the inventions according to the first to third embodiments are applied will be described. As described above, the authentication system using biometric information reads biometric information, calculates data characteristic of the biometric information, and performs authentication processing. At this time, the following two points are required.
(1) For example, when an utterance is used as biometric information, the read biometric information includes an error due to the fact that the utterance speed, the magnitude of the voice, and the like are not constant and ambient noise. Therefore, in an authentication system using biometric information, if the input biometric information is within a predetermined error range, it is required to output data unique to the biometric information.
(2) In addition to utterances, human-specific information such as fingerprints and irises is used as biometric information. However, the biometric information includes many points similar to the biometric information of others. On the other hand, data characteristic of biometric information used for authentication is desirably determined uniformly for biometric information in order to reduce false authentication. Ideally, it is desirable to use different data for each piece of biological information as data characteristic of the biological information.
When a fuzzy extractor is used in an authentication system using biometric information, the biometric information cannot be restored from data unique to the biometric information stored in the authentication system and auxiliary data. For example, in the authentication system using utterances, when the user forgets the utterance contents and how to speak, they cannot be restored from the information stored in the authentication system. However, according to the methods of the first to third embodiments, the biometric information can be restored from the data unique to the biometric information stored in the authentication system. Therefore, for example, in the authentication system using utterances, when the user forgets the utterance contents and how to speak, they can be restored from the information stored in the authentication system, so re-registration to the authentication system and deletion of past registration status Etc. become unnecessary.

  Next, the hardware configuration of the information processing apparatus according to the first to third embodiments will be described with reference to FIG. FIG. 14 is an explanatory diagram illustrating a hardware configuration of the information processing apparatus according to the first to third embodiments.

  An information processing apparatus according to the first to third embodiments includes a control device such as a CPU (Central Processing Unit) 51, a storage device such as a ROM (Read Only Memory) 52 and a RAM (Random Access Memory) 53, and a network. A communication I / F 54 that communicates by connecting to each other and a bus 61 that connects each unit are provided.

  A program executed by the information processing apparatus according to the first to third embodiments is provided by being incorporated in advance in the ROM 52 or the like.

  A program executed by the information processing apparatus according to the first to third embodiments is a file in an installable format or an executable format, and is a CD-ROM (Compact Disk Read Only Memory), a flexible disk (FD), a CD. The recording medium may be recorded on a computer-readable recording medium such as -R (Compact Disk Recordable) or DVD (Digital Versatile Disk) and provided as a computer program product.

  Further, the program executed by the information processing apparatus according to the first to third embodiments is stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. Also good. The program executed by the information processing apparatus according to the first to third embodiments may be provided or distributed via a network such as the Internet.

  A program executed by the information processing apparatus according to the first to third embodiments can cause a computer to function as each unit (generation unit or the like) of the information processing apparatus described above. In this computer, the CPU 51 can read a program from a computer-readable storage medium onto a main storage device and execute the program.

  Note that the present embodiment is not limited to the above-described embodiment as it is, and can be embodied by modifying the components without departing from the scope of the invention in the implementation stage. Moreover, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, you may delete a some component from all the components shown by embodiment. Furthermore, the constituent elements over different embodiments may be appropriately combined.

100, 200, 300 Information processing device 110, 210 Generation unit 111, 211 First calculation unit 111a, 211a Gen calculation unit 111b, 211b Second auxiliary data calculation unit 113, 213 Input / output unit 120 Reproduction unit 121 Second calculation unit 122 Input / output unit 130, 230 Inverse image calculation unit 131, 231 Third calculation unit 132, 232 Input / output unit 231a Rep calculation unit 301 Input / output unit 310 Registration processing unit 320 Authentication processing unit 330 Voice restoration unit 340 Storage unit

Claims (6)

A receiving unit for receiving the first input data;
Based on the first input data, a first output data for calculating the first output data from second input data in which an error between the first output data and the first input data is included in a predetermined first range. Calculating one auxiliary data, and calculating the first input data from the first output data based on at least one of the first output data and the first auxiliary data and the first input data A first calculation unit for calculating the second auxiliary data of
A second calculator for calculating the first output data based on the second input data and the first auxiliary data;
A third calculator for calculating the first input data based on the first output data and the second auxiliary data;
An information processing apparatus comprising: The first calculation unit calculates an encryption key for encrypting the first input data based on at least one of the first output data and the first auxiliary data, and uses the encryption key to Calculating the second auxiliary data obtained by encrypting the first input data;
The third calculation unit calculates a decryption key for decrypting the second auxiliary data based on at least one of the first output data and the first auxiliary data, and uses the decryption key to calculate the second key. Calculating the first input data obtained by decoding auxiliary data;
The information processing apparatus according to claim 1. The first calculator selects the hash function determined according to at least one of the first output data and the first auxiliary data among a plurality of hash functions, and the selected hash function and the Calculating the second auxiliary data based on the first input data;
The third calculator selects the hash function determined according to at least one of the first output data and the first auxiliary data among the plurality of hash functions, and the selected hash function and the Calculating the first input data based on second auxiliary data;
The information processing apparatus according to claim 1. The first calculation unit further calculates third auxiliary data for calculating the first input data from third input data within a second range in which an error from the first output data is predetermined, Calculating the second auxiliary data based on at least one of the first output data and the third auxiliary data and the first input data;
The third calculation unit calculates the first output data from the third input data and the third auxiliary data, and based on the calculated first output data and the second auxiliary data, Calculating input data,
The information processing apparatus according to claim 2. A pseudo-random number generator connected to an external device,
A receiving unit for receiving the first input data;
Based on the first input data, a first output data for calculating the first output data from second input data in which an error between the first output data and the first input data is included in a predetermined first range. Calculating one auxiliary data, and calculating the first input data from the first output data based on at least one of the first output data and the first auxiliary data and the first input data A first calculation unit for calculating the second auxiliary data of
With
The external device is
A second calculator for calculating the first output data based on the second input data and the first auxiliary data;
A third calculator that calculates the first input data based on the first output data and the second auxiliary data;
A pseudo-random number generator characterized by the above. A computer connected to an external device
A receiving unit for receiving the first input data;
Based on the first input data, a first output data for calculating the first output data from second input data in which an error between the first output data and the first input data is included in a predetermined first range. Calculating one auxiliary data, and calculating the first input data from the first output data based on at least one of the first output data and the first auxiliary data and the first input data A program for functioning as a first calculation unit for calculating the second auxiliary data of
The external device is
A second calculator for calculating the first output data based on the second input data and the first auxiliary data;
A third calculator that calculates the first input data based on the first output data and the second auxiliary data;
A program characterized by

Images