JP2016111594A - Encrypted text collation system, method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent information about data from leaking out even if information about distance is outputted between data used during registration and data used during collation.SOLUTION: An encrypted text collation system includes: a registration data generation part for encrypting input data to be a secret object by using an encryption key, and outputting registration data; a storage device for storing the registration data in an encrypted text storage part and an identifier for uniquely specifying the registration data in an identifier storage part so as to clarify respective correspondences; a data collation request generation part for encrypting input data of a collation object by using the encryption key, and outputting collation data; a distance calculation part for outputting encrypted distance data from the registration data and the collation data by using the encryption key; a decryption part for decrypting the encrypted distance data by using a decryption key, and generating distance data; a score calculation part for generating a score from the distance data by using a random number; and a determination part of outputting a collation result from the score.SELECTED DRAWING: Figure 7

Description

  The present invention relates to a ciphertext collation system, method, and program that allow ambiguity of encrypted data, and in particular, input data to be concealed (collation source data) is also input data to be collated (collation target data). The present invention also relates to a ciphertext collation system, method, and program in the case where both are encrypted and the ambiguity index is the Euclidean distance in plaintext.

  In recent years, with the spread of the cloud, user data is placed on computing resources connected to a network, and services based on the data are rapidly spreading. In such services, opportunities for handling sensitive data of users are increasing. For this reason, it has become important for users to ensure that their data is managed safely.

  Under such circumstances, research and development of techniques for managing data while encrypting it in an open network environment and performing search, statistical processing, etc. without decrypting the data are being actively conducted.

  In recent years, crimes with the vulnerability of personal authentication using conventional passwords and magnetic cards have frequently occurred. For this reason, biometric authentication technology based on biometric features such as fingerprints and veins with higher safety has attracted attention.

  In biometric authentication, it is necessary to store a template related to biometric information in a database in order to verify authentication information. Biometric information such as fingerprints and veins is basically life-long data. If biological information is leaked, the damage will be enormous. For this reason, the biometric information is information that requires the most confidentiality. Therefore, it is necessary to prevent “spoofing” from being performed even if the template is leaked.

  For example, Patent Literature 1 realizes biometric authentication while keeping the feature vector secret by calculating the Euclidean distance of the feature vector obtained from the biometric data while being encrypted using homomorphic encryption.

  The method disclosed in Patent Document 1 includes a decryption server that holds a decryption key for homomorphic encryption and performs decryption in response to a request from the server, in addition to a client that requests biometric authentication and an authentication server that performs authentication. . In the biometric authentication disclosed in Patent Document 1, authentication is performed using a feature vector obtained from biometric information.

  Non-Patent Document 1, Non-Patent Document 2, Non-Patent Document 3, and Non-Patent Document 4 propose an attack method using a decryption server with respect to the method of Patent Document 1, and describe a method for preventing each attack. ing.

  On the other hand, Patent Document 2 discloses a ciphertext collation system that can avoid leakage of the original plaintext and ensure security in ciphertext collation. In the ciphertext collation system disclosed in Patent Document 2, input data to be collated is encrypted, and registration data for performing collation of the input is encrypted. Patent Document 2 also discloses an embodiment in which only input data is input to the system, an identifier of encrypted data to be verified with the input data is output, and one-to-many verification is realized.

  Patent Document 3 discloses a method for performing biometric authentication while encrypting biometric information. Patent Document 3 discloses a biometric authentication device having a certification device, an authentication device, and a decryption device. The proving device measures biometric information from the user, and performs a secret certification process using the measured biometric information. The authentication device stores the user's biometric information encrypted, and performs authentication using the stored biometric information. The decryption device decrypts the encrypted data.

  The encryption unit of the proving device encrypts the feature vector using the public key and a random number. The encryption similarity generation unit of the authentication device generates encryption similarity information using the public key and a random number from the registered encryption feature vector and authentication feature vector. The decryption unit of the decryption device performs a decryption process using the secret key for the encryption similarity information, and derives the plaintext similarity. The communication unit of the decryption device transmits the plaintext similarity to the authentication device. The determination unit of the authentication device determines whether or not the plaintext similarity is equal to or greater than a predetermined threshold value. If the similarity is equal to or greater than the threshold value, the authenticity is determined. It is determined that it is not.

  In Patent Document 3, the Hamming distance or Euclidean square distance between two feature vectors is used as an index of similarity.

  Furthermore, Patent Document 4 discloses a technique for performing image processing such as image evaluation without decrypting encrypted image data. In the image search disclosed in Patent Document 4, feature amounts are extracted from each of a search destination image and a query image, and these are secret-distributed and encrypted, and a distance between feature amounts is calculated in an encryption area. In the image search disclosed in Patent Document 4, the distance between feature quantity vectors is calculated in the encryption area, and the decrypted value is used as the similarity.

Japanese Patent No. 5496410 International Publication No. 2014/010725 International Publication No. 2011/052056 JP 2013-097351 A

Security of cancelable biometric authentication method (Part 2), Tetsuya Izu, Yumi Sakami, Masahiko Takenaka, Naoya Torii, IEICE IEICE Technical Committee, 2013. Security of the cancelable biometric authentication method (Part 3), Tetsuya Izu, Yumi Sakami, Masahiko Takenaka, Naoya Torii, 2014 Symposium on Cryptography and Information Security, 2014. Security against confidential biometric authentication using homomorphic encryption (Part 1), Yumi Sakami, Masahiko Takenaka, Naoya Torii, Masaya Yasuda, IEICE IEICE Technical Committee, 2014. Security against confidential biometric authentication using homomorphic encryption (Part 2), Yumi Sakami, Masahiko Takenaka, Naoya Torii, Masaya Yasuda, IEICE IEICE Technical Committee, 2014.

  However, in any of the methods disclosed in Patent Document 1 and Non-Patent Documents 1 to 4, the response from the decryption server is OK or NG, and distance information (similarity) indicating how close is transmitted to the authentication server. It is not done.

  When 1: N authentication is performed as disclosed in Patent Document 2, distance information (similarity) cannot be transmitted to the authentication server. Here, “1: N authentication” is authentication for determining whether one piece of authentication data is included in N pieces of registration data. When distance information (similarity) is not transmitted to the authentication server as in the above method, the authentication server cannot make the determination.

  On the other hand, the response from the decryption server is not OK or NG. For example, as in Patent Document 3, the decryption result, that is, distance information (similarity) representing the distance between feature vectors (features) Z and Z ′ ) Can be easily solved. However, it is known that a hill climbing attack (to be described later) using the distance is possible by returning the distance information (similarity) itself to the authentication server. Therefore, it is not preferable for safety to output the distance information (similarity) itself from the decryption server.

  Further, as a verification method with encryption, a method using a searchable encryption using a definite common key encryption or public key encryption is known. However, these methods generally require that a keyword used for search is uniquely determined. When collation is performed using biometric information as described above, it is known that the same biometric information is not always obtained due to noise included when biometric information is acquired. For this reason, it is difficult to apply searchable encryption.

  Note that Patent Document 4 merely discloses an image search technique in which the distance between feature quantity vectors is calculated in an encryption area, and the decrypted value is used as the similarity.

  The problem with the above-mentioned prior art is that the feature vector (feature amount) Z used for registration and the feature vector (feature amount) Z ′ used for authentication are only near or far from the response from the decryption server. . Alternatively, by outputting the distance information (similarity) itself, the feature vector (feature amount) Z or Z ′ is restored from the registration data or the authentication data.

  An object of the present invention is to provide a ciphertext collation system, method, and program in which information about data does not leak even if information about the distance between data Z used during registration and data Z ′ used during collation is output. There is to do.

  The ciphertext matching system of the present invention encrypts input data to be concealed using an encryption key, outputs a registration data, a registration data generation unit that outputs registration data, and stores the registration data in a ciphertext storage unit. A storage device that stores an identifier for uniquely identifying the identifier storage unit so that the correspondence can be recognized, and a data verification request generation that encrypts input data to be verified using an encryption key and outputs verification data Unit, a distance calculation unit that outputs encrypted distance data using an encryption key from registration data and verification data, and a decryption unit that decrypts encrypted distance data using a decryption key and generates distance data A score calculation unit that generates a score using random numbers from the distance data, and a determination unit that outputs a matching result from the score.

  In the ciphertext matching method of the present invention, the first client generates registration data by encrypting the input data to be concealed using the encryption key, and the authentication server converts the registration data to the registration data. A data registration step of storing in the storage unit together with an identifier for uniquely identifying the data, and the second client generates verification data by encrypting the input data to be verified using an encryption key, From the registration data and verification data stored in the storage unit, the encryption distance data is generated using the encryption key, and the decryption server generates the distance data by decrypting the encryption distance data using the decryption key. A ciphertext matching step in which a score is generated from the distance data using a random number, and the authentication server generates a matching result from the score.

  Furthermore, the ciphertext collation program of the present invention encrypts input data to be concealed using an encryption key to generate registration data, and uniquely identifies the registration data. A process of storing in the storage unit together with an identifier for performing, a data collation request generating process for generating collation data by encrypting input data to be collated using an encryption key, and registration data stored in the storage unit, A distance calculation process for generating encrypted distance data from the verification data using the encryption key, a decryption process for generating the distance data by decrypting the encrypted distance data using the decryption key, and a random number from the distance data The computer is caused to execute a score calculation process for calculating a score using and a determination process for generating a matching result from the score.

  According to the present invention, there is an effect that even if information on the distance between the data used at the time of registration and the data used at the time of collation is output, the information on the data is not leaked.

It is a block diagram which shows the structure of the ciphertext collation system by the 1st related technique. It is a block diagram which shows the structure of the ciphertext collation system by a 2nd related technique. 1 is a block diagram showing a schematic configuration of a ciphertext matching system according to the present invention. It is a block diagram showing an example of composition of a ciphertext collation system concerning a 1st embodiment of the present invention. It is a block diagram which shows the structural example of the registration data production | generation apparatus and memory | storage device which are used for the ciphertext collation system shown in FIG. It is a block diagram which shows the structural example of the data collation request | requirement apparatus and data collation determination apparatus which are used for the ciphertext collation system shown in FIG. FIG. 4 is a block diagram illustrating a configuration example of a verification assisting device used in the ciphertext verification system. It is a flowchart which shows the operation example of a setup phase of the ciphertext collation system shown in FIG. It is a flowchart which shows the operation example of the data registration phase of the ciphertext collation system shown in FIG. It is a flowchart which shows the operation example of the ciphertext collation phase of the ciphertext collation system shown in FIG. It is a block diagram which shows the structural example of the ciphertext collation system which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structural example of the registration data production | generation apparatus used for the ciphertext collation system shown in FIG. It is a block diagram which shows the structural example of the data collation request | requirement apparatus used for the ciphertext collation system shown in FIG. It is a block diagram which shows the structural example of the data collation determination apparatus used for the ciphertext collation system shown in FIG. It is a flowchart which shows the operation example of a setup phase of the ciphertext collation system shown in FIG. It is a flowchart which shows the operation example of the data registration phase of the ciphertext collation system shown in FIG. It is a flowchart which shows the operation example of the first half of the ciphertext collation phase of the ciphertext collation system shown in FIG. It is a flowchart which shows the operation example of a setup phase of the ciphertext collation system by the 1st Example of this invention. It is a flowchart which shows the operation example of the data registration phase of the ciphertext collation system by 1st Example of this invention. It is a flowchart which shows the operation example of the ciphertext collation phase of the ciphertext collation system by 1st Example of this invention. It is a flowchart which shows the operation example of a setup phase of the ciphertext collation system by the 2nd Example of this invention. It is a flowchart which shows the operation example of the data registration phase of the ciphertext collation system by the 2nd Example of this invention. It is a flowchart which shows the operation example of the ciphertext collation phase of the ciphertext collation system by the 2nd Example of this invention.

[Related technologies]
As described above, in Patent Document 1, biometric authentication is performed with the feature vector kept secret by calculating the Euclidean distance of the feature vector obtained from the biometric data while encrypting it using homomorphic encryption. doing.

  As shown in FIG. 1, the ciphertext matching system according to the first related technique disclosed in Patent Document 1 includes a client 10 that requests biometric authentication, an authentication server 20 that performs authentication, and decryption of homomorphic encryption. A decryption server 30 that holds a key and decrypts it in response to a request from the authentication server 20. In biometric authentication (ciphertext collation system) disclosed in Patent Document 1, authentication is performed as follows using a feature vector Z obtained from biometric information.

  First, in the ciphertext matching system according to the first related technique, registration is performed as follows.

  The client 10 encrypts the feature vector Z obtained from its own biometric data using a homomorphic encryption encryption key.

  (A1) The decryption server 30 generates a key, and generates a public key pk and a secret key sk of homomorphic encryption. The decryption server 30 sends the public key to the client 10.

  (A2) The client 10 encrypts the feature vector Z using the public key pk, and generates registration data ENC (pk, Z). The client 10 sends registration data ENC (pk, Z) to the authentication server 20.

  (A3) The authentication server 20 stores registration data ENC (pk, Z).

  Next, in the ciphertext matching system according to the first related technique, authentication is performed as follows.

  Here, it is assumed that the client 10 holds the feature vector Z ′. For the same person, the distance between the two feature vectors Z and Z 'is close, and the distance between the feature vectors Z and Z' of different persons is long.

  (B1) The client 10 encrypts the feature vector Z ′ using the public key pk, and generates verification data ENC (pk, Z ′). The client 10 sends the verification data ENC (pk, Z ′) to the authentication server 20.

  (B2) The authentication server 20 uses the homomorphism to calculate the encrypted distance data ENC (pk, d (Z, Z ′)) while being encrypted. Here, d (a, b) means the distance between a and b. The authentication server 20 sends the encrypted distance data ENC (pk, d (Z, Z ′)) to the decryption server 30.

  (B3) The decryption server 30 decrypts the encrypted distance data ENC (pk, d (Z, Z ′)) using the secret key sk, and obtains a decryption result d (Z, Z ′). This decoding result indicates distance information.

  (B4) The decryption server 30 confirms whether or not the decryption result d (Z, Z ′) is equal to or less than a predetermined threshold value t. The decryption server 30 sends OK to the authentication server 20 if the decryption result d (Z, Z ′) is less than or equal to the threshold t, and sends NG to the authentication server 20 if the decryption result d (Z, Z ′) is greater than the threshold t.

  (B5) The authentication server 20 outputs an acceptance to the client 10 if the reply from the decryption server 30 is OK, and an unacceptance to the client 10 if the response is NG.

  Moreover, in the said nonpatent literature 1, the nonpatent literature 2, the nonpatent literature 3, and the nonpatent literature 4, the attack method using a decoding server is proposed with respect to the system of the said patent document 1, and the method of preventing an attack, respectively. Says.

  However, in any of the methods, the response from the decryption server 30 is OK or NG, and distance information (similarity) indicating how close it is is not transmitted to the authentication server 20.

  In general, in biometric authentication, FAR (False Acceptance Rate) is not small. In other words, the probability of accepting another person as the principal cannot be ignored. Therefore, as in Patent Document 2, when performing 1: N authentication, it may be a problem that the distance information (similarity) cannot be transmitted to the authentication server 20. Here, “1: N authentication” is authentication for determining whether one piece of authentication data is included in N pieces of registration data.

  More specifically, the registered ciphertext is assumed to be ENC (pk, Z [1]), ..., ENC (pk, Z [N]). At this time, the authentication server 20 determines whether there is Z [1],..., Z [N] close to the feature vector Z ′. At this time, since FAR cannot be ignored in biometric authentication, when N is large, there are a plurality of Z [i] close to the feature vector Z ′. At this time, in biometric authentication that is not template protection, the authentication server 20 may determine Z [j] that is significantly close to the feature vector Z (obviously close to other Z [i]) as the principal. However, when distance information (similarity) is not transmitted to the authentication server 20 as in the above method, the authentication server 20 cannot make the determination.

  On the other hand, as in the ciphertext matching system according to the second related technique shown in FIG. 2, the reply from the decryption server 30A is not OK or NG, but the decryption result, that is, the feature vector Z If the distance information (similarity) representing the distance between the feature vector Z ′ and the feature vector Z ′ is returned, the above problem can be solved easily.

  However, it is known that a hill climbing attack using distance can be performed by returning distance information (similarity) itself to the authentication server 20A. Here, “hill climbing attack” refers to the following attack.

  Obtain a first distance d (Z, Z ′) for the authentication data generated using a feature vector Z ′, and then modify a part of the feature vector Z ′ (for example, 1 bit inverted) Z ″ A second distance d (Z, Z ″) for the used authentication data is obtained. If the second distance d (Z, Z ″) is smaller than the first distance d (Z, Z ′), it means that the feature vector Z has been approached by modification, and if it has become larger Means away from the feature vector Z by modification.

  It is known that by repeating such an action, it is possible to restore the feature vector Z from the registered data (or the feature vector Z ′ from the authentication data) with a relatively small amount of calculation. Therefore, it is not preferable in terms of safety to output the distance information (similarity) itself from the decryption server 30A.

  Further, as a verification method with encryption, a method using a searchable encryption using a definite common key encryption or public key encryption is known. However, these methods generally require that a keyword used for search is uniquely determined. When collation is performed using biometric information as described above, it is known that the same biometric information is not always obtained due to noise included when biometric information is acquired. For this reason, it is difficult to apply the searchable encryption to the biometric information matching method.

  The problem with the above-described prior art (related technique) is that the feature vector (feature amount) Z used for registration and the feature vector (feature amount) Z ′ used for authentication are close or far from the response from the decryption server 30. It is only that. Alternatively, the distance information (similarity) itself is output from the decryption server 30A, whereby the feature vector (feature amount) Z or Z ′ is restored from the registration data or the authentication data.

[Summary of Invention]
Therefore, in the present invention, even if the information (distance information) about the distance between the data Z used at the time of registration and the data Z ′ used at the time of collation is output, the information about the data is not leaked. The purpose is to realize a ciphertext verification system that allows some errors.

  FIG. 3 is a block diagram showing a schematic configuration of the ciphertext matching system according to the present invention. The illustrated ciphertext verification system includes a client 10 that requests biometric authentication, an authentication server 20B that performs authentication, a decryption server 30B that holds a decryption key for homomorphic encryption, and performs decryption in response to a request from the authentication server 20B. .

  In the ciphertext matching system according to the present invention, a score is generated by replacing the distance information calculated by the decryption server 30B at the time of matching with a random value selected according to an appropriate distribution. By selecting random numbers according to an appropriate distribution, for example, the authentication server 20B can determine whether or not the first place and the second place are significantly different. In addition, by changing the random number used at the time of each check, it is impossible to determine whether it is closer or farther than the previous time, and a hill climbing attack is impossible.

  In the ciphertext matching system according to the present invention, the output from the decryption server 30B becomes a score, so that the information necessary for the authentication server 20B to determine the authentication result (matching result) can be obtained. The reason is to use random numbers according to an appropriate distribution for score generation after decryption.

(First embodiment)
Next, the ciphertext matching system according to the first embodiment of the present invention will be described in detail with reference to the drawings.

  Referring to FIG. 4, the ciphertext verification system according to the first embodiment of the present invention includes a registered data generation device 100, a storage device 200, a data verification request device 300, a data verification determination device 400, and a verification auxiliary device. 500.

  An entity that uses the registered data generation apparatus 100 and the data verification request apparatus 300 corresponds to the client 10 in FIG. An entity having the storage device 200 and using the data collation determination device 400 corresponds to the authentication server 20B in FIG. An entity that uses the verification assisting device 500 corresponds to the decryption server 30B in FIG.

  In other words, the registered data generation device 100 is realized as a first client, and the data matching request device 300 is realized as a second client. The combination of the storage device 200 and the data collation determination device 400 operates as the authentication server 20B. The verification assisting device 500 operates as the decryption server 30B. The first client and the second client may be separate clients or the same one client.

[Description of configuration]
Referring to FIG. 5, the registration data generation device 100 includes a registration data generation unit 101. The registration data generation unit 101 receives input data to be concealed and an encryption key generated by a key generation unit 501 of the verification auxiliary device 500 described later, and outputs registration data.

  As illustrated in FIG. 5, the storage device 200 includes an identifier management unit 201, a ciphertext storage unit 202, and an identifier storage unit 203.

  The identifier management unit 201 receives the registration data generated by the registration data generation unit 101 of the registration data generation device 100 as an input, and generates a different identifier for each registration data. The identifier management unit 201 stores the registration data in the ciphertext storage unit 202 and the corresponding identifier in the identifier storage unit 203 so that the correspondence can be understood.

  Referring to FIG. 6, the data verification request device 300 includes a data verification request generation unit 301 and an identifier storage unit 302.

  The data verification request generation unit 301 receives as input the encryption key generated by the key generation unit 501 of the verification auxiliary device 500 described later, the identifier stored in the identifier storage unit 302, and the input data to be verified. Is output.

  As shown in FIG. 6, the data matching determination apparatus 400 includes a data acquisition unit 401, a distance calculation unit 402, an auxiliary request unit 403, and a determination unit 404.

  The data acquisition unit 401 acquires registration data corresponding to the identifier included in the collation data from the ciphertext storage unit 202 and the identifier storage unit 203 of the storage device 200.

  The distance calculation unit 402 receives the obtained registration data, verification data, and encryption key, and outputs encrypted distance data.

  The auxiliary request unit 403 receives the encrypted distance data and outputs auxiliary request data to the verification auxiliary device 500.

  The determination unit 404 receives the score received from the verification assistant device 500 and outputs a verification result.

  Referring to FIG. 7, the verification assisting device 500 includes a key generation unit 501, a decryption unit 502, a score calculation unit 503, and a key storage unit 504.

  The key generation unit 501 receives a security parameter and outputs an encryption key and a decryption key.

  The decryption unit 502 receives the auxiliary request data received from the data collation determination device 400 and the decryption key, and generates distance data.

  The score calculation unit 503 receives the distance data and outputs a score using a random number.

[Description of operation]
Next, the operation of the ciphertext matching system according to the first embodiment of the present invention will be described in detail.

  The operation of the ciphertext matching system according to the first embodiment of the present invention is roughly divided into three phases: a setup phase, a data registration phase, and a ciphertext verification phase.

  Here, the data registration phase is a phase in which input data is input to the registration data generation device 100, the input data is encrypted, and is registered in the storage device 200. In the ciphertext verification phase, the input data input to the data verification request device 300 is encrypted, and the verification request generated at that time is close to the encrypted data (registered data) in the storage device 200 by the data verification determination device 400. This is a phase for determining whether the text is plain text (with a small Euclidean distance).

  Hereinafter, the operation in each phase will be described in detail.

  Referring to FIG. 8, in the setup phase, first, security parameters are input to the key generation unit 501 of the verification assistant device 500, and an encryption key and a decryption key are generated (step A1).

  Next, the key generation unit 501 sends the generated encryption key to the registered data generation device 100, the verification requesting device 300, and the data verification determination device 400, and stores the decryption key in the key storage unit 503 (step). A2).

  Referring to FIG. 9, in the data registration phase, first, an encryption key and input data to be concealed are input to the registration data generation unit 101 of the registration data generation device 100 (step B1).

  Next, the registration data generation unit 101 generates registration data from the input data and the encryption key, sends the registration data to the storage device 200, and sends the fact that the input data has been registered to the data verification requesting device 300 (step). B2).

  Next, the identifier management unit 201 of the storage device 200 that has received the registration data receives the registration data, generates a different identifier for each data, stores the registration data in the ciphertext storage unit 202, and stores the identifier in the identifier storage unit 203. Each is stored (step B3).

  At this time, it is assumed that the registration data and the identifier issued for the registration data are stored so as to be understood as a pair. Moreover, although the ciphertext storage unit and the identifier storage unit are described as separate units, they may be stored in the same storage device (for example, a database).

  Further, the identifier management unit 201 sends the identifier to the data matching request device 300 (step B4). The data verification requesting apparatus 300 stores the received identifier and input data in the identifier storage unit 302 (step B5).

  Referring to FIG. 10, in the ciphertext verification phase, input data to be verified is input to the data verification request generation unit 301 of the data verification requesting device 300 (step C1).

  Next, the data verification request generation unit 301 reads an identifier corresponding to the input data from the identifier storage unit 302 (step C2).

  Next, the data verification request generation unit 301 receives the input data, the identifier, and the encryption key as input, generates verification data, and sends it to the data verification determination device 400 (step C3).

  Next, the data acquisition unit 401 of the data collation determination device 400 receives the collation data as input, and receives registration data corresponding to the identifier included in the collation data from the ciphertext storage unit 202 of the storage device 200 (step C4). .

  Next, the distance calculation unit 402 receives the collation data, the registration data, and the encryption key, and generates encrypted distance data (step C5).

  Next, the auxiliary request unit 403 receives the encrypted distance data as an input, generates a verification auxiliary request, and sends it to the verification auxiliary device 500 (step C6).

  Next, the decryption unit 502 of the collation assisting device 500 receives the collation assist request and the decryption key stored in the key storage unit 504, and generates distance data (step C7).

  Next, the score calculation unit 503 receives the distance data, generates a score using a random number, and sends the score to the data verification determination device 400 (step C8).

  Next, the determination unit 404 of the data matching determination device 400 receives the score and generates a matching result (step C9).

  As described above, in the first embodiment, the output from the verification assistant device 500 that functions as the decryption server 30B becomes a score, which is necessary for the data verification determination device 400 that functions as the authentication server 20B to determine the authentication result. Information can be obtained. This is because, after decryption, random numbers according to an appropriate distribution are used for score generation. In addition, by changing the random number used at the time of each check, it is impossible to determine whether it is closer or farther than the previous time, and a hill climbing attack is impossible.

(Second Embodiment)
Next, a second embodiment of the present invention will be described in detail with reference to the drawings.

  The difference between the ciphertext matching system described in the first embodiment of the present invention and the ciphertext matching system described in the second embodiment of the present invention is as follows. That is, in the first embodiment of the present invention, an identifier is specified at the time of a collation request, and collation with registered data corresponding to the identifier is performed, so-called 1: 1 collation. On the other hand, in the second embodiment of the present invention, an identifier is not specified at the time of collation, and 1: N collation is performed to check whether there is matching data in registered registration data.

  Referring to FIG. 11, the ciphertext verification system according to the second embodiment of the present invention includes a registered data generation device 600, a storage device 200, a data verification request device 700, a data verification determination device 400A, and a verification auxiliary device. 500.

  An entity that uses the registered data generation apparatus 600 and the data verification request apparatus 300 corresponds to the client 10 in FIG. An entity that has the storage device 200 and uses the data collation determination device 700 corresponds to the authentication server 20B in FIG. An entity that uses the verification assisting device 500 corresponds to the decryption server 30B in FIG.

  In other words, the registered data generation device 600 is realized as a first client, and the data matching request device 700 is realized as a second client. The combination of the storage device 200 and the data collation determination device 400 operates as the authentication server 20B. The verification assisting device 500 operates as the decryption server 30B. The first client and the second client may be separate clients or the same one client.

[Description of configuration]
Referring to FIG. 12, the registration data generation device 600 includes a registration data generation unit 601. The registration data generation unit 601 receives the input data to be concealed and the encryption key generated by the key generation unit 501 of the verification assistant device 500, and outputs registration data.

  Since the storage device 200 is the same as the storage device 200 of the first embodiment of the present invention described above, the description thereof is omitted.

  Referring to FIG. 13, the data verification request device 700 includes a data verification request generation unit 701. The data verification request generation unit 700 receives the encryption key generated by the key generation unit 501 of the verification auxiliary device 500 and the input data to be verified, and outputs the verification data.

  Referring to FIG. 14, the data matching determination apparatus 400A includes a data acquisition unit 401A, a distance calculation unit 402, an auxiliary request unit 403, and a determination unit 404.

  The data acquisition unit 401A acquires all the registration data stored in the ciphertext storage unit 202 of the storage device 200.

  The distance calculation unit 402 receives the obtained registration data, verification data, and encryption key, and outputs encrypted distance data.

  The auxiliary request unit 403 receives the encrypted distance data and outputs auxiliary request data to the verification auxiliary device 500.

  The determination unit 404 receives the score received from the verification assistant device 500 and outputs a verification result.

  Since the collation assisting device 500 is the same as the collation assisting device 500 of the first embodiment of the present invention described above, description thereof is omitted.

[Description of operation]
Next, the operation of the ciphertext matching system according to the second embodiment of the present invention will be described in detail.

  The operation of the ciphertext verification system according to the second embodiment of the present invention is roughly divided into three phases: a setup phase, a data registration phase, and a ciphertext verification phase.

  Here, the data registration phase is a phase in which input data is input to the registration data generating device 600, the input data is encrypted, and registered in the storage device 200. In the ciphertext verification phase, the input data input to the data verification requesting device 700 is encrypted, and the verification request generated at that time is close to the encrypted data in the storage device by the data verification determination device 400A (the Euclidean distance is small). ) This is a phase for determining whether the text is plaintext. Hereinafter, the operation in each phase will be described in detail.

  Referring to FIG. 15, in the setup phase, first, security parameters are input to the key generation unit 501 of the verification assistant device 500, and an encryption key and a decryption key are generated (step D1).

  Next, the key generation unit 501 sends the generated encryption key to the registered data generation device 600, the verification requesting device 700, and the data verification determination device 400A, and stores the decryption key in the key storage unit 503 (step). D2).

  Referring to FIG. 16, in the data registration phase, first, an encryption key and input data to be concealed are input to the registration data generation unit 601 of the registration data generation device 600 (step E1).

  Next, the registration data generation unit 601 generates registration data from the input data and the encryption key and sends it to the storage device 200 (step E2).

  Next, the identifier management unit 201 of the storage device 200 that has received the registration data receives the registration data, generates a different identifier for each data, stores the registration data in the ciphertext storage unit 202, and stores the identifier in the identifier storage unit 203. Each is stored (step E3).

  At this time, it is assumed that the registration data and the identifier issued for the registration data are stored so as to be understood as a pair. Moreover, although the ciphertext storage unit and the identifier storage unit are described as separate units, they may be stored in the same storage device (for example, a database).

  Referring to FIG. 17, in the ciphertext verification phase, input data to be verified is input to the data verification requesting device 700 (step F1).

  Next, the data verification request generation unit 701 receives the input data and the encryption key as input, generates verification data, and sends it to the data verification determination device 400A (step F2).

  Next, the data acquisition unit 401A of the data verification determination device 400A receives all the registration data from the ciphertext storage unit 202 of the storage device 200 (step F3).

  Next, the distance calculation unit 402 receives the collation data, the registration data, and the encryption key, and generates encrypted distance data (step F4).

  Next, the auxiliary request unit 403 receives the encrypted distance data, generates a verification auxiliary request, and sends it to the verification auxiliary device 500 (step F5).

  Next, the decryption unit 502 of the collation assisting device 500 receives the collation assist request and the decryption key stored in the key storage unit 504, and generates distance data (step F6).

  Next, the score calculation unit 503 receives the distance data, generates a score using a random number, and sends the score to the data matching determination apparatus 400A (step F7).

  Next, the determination unit 404 of the data verification determination device 400A receives the score and generates a verification result (step F8).

  As described above, in the second embodiment, the output from the verification assistant device 500 serving as the decryption server 30B becomes a score, which is necessary for the data verification determination device 400A serving as the authentication server 20B to determine the authentication result. Information can be obtained. This is because, after decryption, random numbers according to an appropriate distribution are used for score generation. In addition, by changing the random number used at the time of each check, it is impossible to determine whether it is closer or farther than the previous time, and a hill climbing attack is impossible.

  Next, the first embodiment of the present invention will be described in detail. The first example is an example of the first embodiment of the present invention.

  For explanation, first, “public key encryption” used in the first embodiment will be described. In the first embodiment, Boneh-Goh-Nissim encryption (BGN encryption) is used as public key encryption. BGN cipher is somewhat homomorphic cipher. In other words, it is a public key cryptography that can calculate one multiplication and multiple additions while encrypted.

  Public key cryptography (BGN cipher) is composed of three algorithms (key generation, encryption, and decryption). Each will be described below.

  The key generation algorithm Gen (k) selects k / 2-bit random primes q and r with the security parameter k as an input. n = qr. Next, the key generation algorithm Gen (k) prepares a supersinglar elliptic curve E / F_p having a point P of order n, and G is a group generated by P. The key generation algorithm Gen (k) randomly selects Q ′ from the group obtained by removing the infinity point from the group G, and sets Q = [r] Q ′. (At this time, Q is the order q.) The key generation algorithm Gen (k) uses e: G × G → μ as a pairing function. The key generation algorithm Gen (k) outputs the public key pk = (E, e, n, P, Q) and the secret key sk = q.

  The encryption algorithm ENC (pk, M) randomly selects t from [1, n] and calculates C = [m] P + [t] Q. The encryption algorithm ENC (pk, M) outputs ciphertext C.

  The decryption algorithm DEC (sk, D) calculates P ′ = [q] P and C ′ = [q] C. The decryption algorithm DEC (sk, D) calculates M ′ = log_ {P ′} C ′. The decryption algorithm DEC (sk, D) outputs plaintext M ′.

  Note that the addition ADD (pk, C1, C2) calculates C ′ = C1 + C2 and outputs the ciphertext C ′.

  Multiplication MULT (pk, C1, C2) calculates D = e (C1, C2) and outputs ciphertext D.

  Decoding after multiplication DEC '(sk, D) is g = e (P, P), g' = g ^ {q} and D '= D ^ {q} are calculated, and M' = log_ {g Calculate '} D' and output plaintext M '.

  Addition after multiplication ADD ′ (pk, D1, D2) calculates D ′ = D1 · D2 and outputs ciphertext D ′.

  The BGN cipher is a method that can be mathematically proved to satisfy the indistinguishability of attackers who perform selective plaintext attacks. In the first embodiment, the BGN cipher will be described as an example, but other somewhat homomorphic cipher may be used. Further, in the first embodiment, a method of performing collation while keeping both the registration data and the collation request data secret is described. However, only one of them can be easily converted into a concealed form. In that case, general homomorphic encryption, such as Paillier cipher or Elgamal cipher, can be applied instead of somewhat homomorphic cipher.

  The operation of the ciphertext verification system according to the first embodiment of the present invention is roughly divided into three phases: a setup phase, a data registration phase, and a ciphertext verification phase.

  Referring to FIG. 18, in the setup phase, first, security parameter k is input to key generation unit 501 of verification assisting apparatus 500, and key generation unit 501 executes key generation algorithm GEN (k) for encryption. A key (public key) pk and a decryption key (secret key) sk are generated (step A1).

  Next, the key generation unit 501 sends the generated encryption key pk to the registered data generation device 100, the verification request device 300, and the data verification determination device 400, and stores the decryption key sk in the key storage unit 503. (Step A2).

  Referring to FIG. 19, in the data registration phase, first, the encryption data pk and the input data Z to be concealed are input to the registration data generation unit 101 of the registration data generation device 100 (step B1).

  Next, the registration data generation unit 101 performs the encryption algorithm ENC (pk, Z) from the input data Z and the encryption key pk, generates registration data PT, sends it to the storage device 200, and inputs the input data Z Is registered to the data verification requesting device 300 (step B2).

  Next, the identifier management unit 201 of the storage device 200 that has received the registration data PT receives the registration data PT, generates a different identifier ID for each data, and stores the registration data PT in the ciphertext storage unit 202. Each is stored in the identifier storage unit 203 (step B3).

  At this time, it is assumed that the registration data PT and the identifier ID issued for the registration data are stored so as to be understood as a pair. Moreover, although the ciphertext storage unit and the identifier storage unit are described as separate units, they may be stored in the same storage device (for example, a database).

  Further, the identifier management unit 201 sends the identifier to the data matching request device 300 (step B4).

  The data verification requesting apparatus 300 stores the received identifier and input data in the identifier storage unit 302 (step B5).

  Referring to FIG. 20, in the ciphertext verification phase, verification target input data Z 'is input to data verification requesting apparatus 300 (step C1).

  Next, the data matching request generation unit 301 reads the identifier ID ′ corresponding to the input data Z ′ from the identifier storage unit 302 (step C2).

  Next, the data verification request generation unit 301 receives the input data Z ′, the identifier ID ′, and the encryption key pk, performs the encryption algorithm ENC (pk, Z ′), and generates a ciphertext C ′. . Then, the data verification request generator 301 generates verification data (ID ', C') and sends it to the data verification determination device 400 (step C3).

  Next, the data acquisition unit 401 of the data collation determination device 400 receives the collation data (ID ′, C ′) as input, and registers the registration data PT ′ corresponding to the identifier ID ′ included in the collation data into the encryption of the storage device 200. Received from the sentence storage unit 202 (step C4).

  Next, the distance calculation unit 402 receives the verification data (ID ′, C ′), the registration data PT ′, and the encryption key pk, and first adds ADD (pk, C, C ′ ^ {− 1}). To generate ciphertext CC ′. Here, C ′ ^ {-1} means an inverse element of C ′. Next, the distance calculation unit 402 calculates MULT (pk, C-C ′, C-C ′), and generates a ciphertext D. Then, the distance calculation unit 402 sets the ciphertext D as encrypted distance data (step C5).

  Next, the auxiliary request unit 403 receives the encrypted distance data D, generates a verification auxiliary request (D), and sends it to the verification auxiliary device 500 (step C6).

  Next, the decryption unit 502 of the collation assisting device 500 receives the collation assist request (D) and the decryption key sk stored in the key storage unit 504, performs a decryption algorithm DEC ′ (sk, D), and decrypts the decryption key sk ′. Obtain the result d. The decoding unit 502 sets the decoding result d as distance data (step C7).

  Next, the score calculation unit 503 receives the distance data d and, if the distance data d is smaller than a predetermined value t, selects a random number r, generates a score sc = d + r, and performs data collation determination Send to device 400. On the other hand, if the distance data d is larger than the predetermined value t, the score calculation unit 503 sends the score sc = 0 to the data collation determination device 400 (step C8).

  Next, the determination unit 404 of the data collation determination apparatus 400 receives the score sc, accepts if sc ≠ 0, otherwise accepts the unacceptable result, and generates a collation result (step C9).

  As described above, in the first embodiment, when the output from the verification assisting device 500 serving as the decryption server 30B becomes the score sc, the data verification determination device 400 serving as the authentication server 20B determines the authentication result (matching result). You can get the information you need. This is because, after decryption, random numbers according to an appropriate distribution are used for score generation. In addition, by changing the random number used at the time of each check, it is impossible to determine whether it is closer or farther than the previous time, and a hill climbing attack is impossible.

  Next, a second embodiment of the present invention will be described in detail. The second example is an example of the second embodiment of the present invention.

  The operation of the third ciphertext matching system of the present invention is roughly divided into three phases: a setup phase, a data registration phase, and a ciphertext matching phase.

  Here, the data registration phase is a phase in which input data is input to the registration data generating device 600, the input data is encrypted, and registered in the storage device 200. In the ciphertext verification phase, the input data input to the data verification request device 700 is encrypted, and the verification request generated at that time is close to the encrypted data (registered data) in the storage device by the data verification determination device 400A ( This is a phase in which it is determined whether the text becomes plaintext (with a small Euclidean distance). Hereinafter, the operation in each phase will be described in detail.

  Referring to FIG. 21, in the setup phase, first, security parameter k is input to key generation unit 501 of verification assistant device 500, and key generation unit 501 performs key generation algorithm Gen (k) to generate an encryption key. pk and decryption key sk are generated (step D1).

  Next, the key generation unit 501 sends the generated encryption key pk to the registered data generation device 600, the data verification request device 700, and the data verification determination device 400A, and stores the decryption key sk in the key storage unit 503. (Step D2).

  Referring to FIG. 22, in the data registration phase, first, the encryption key pk and the input data Z to be concealed are input to the registration data generation unit 601 of the registration data generation device 600 (step E1).

  Next, the registration data generation unit 601 generates the ciphertext C by performing the encryption algorithm ENC (pk, Z) from the input data Z and the encryption key pk. The registration data generation unit 601 sets the registration data PT = C and sends it to the storage device 200 (step E2).

  Next, the identifier management unit 201 of the storage device 200 that has received the registration data PT receives the registration data PT, generates a different identifier ID for each data, and stores the registration data PT in the ciphertext storage unit 202. Each is stored in the identifier storage unit 203 (step E3).

  At this time, it is assumed that the registration data PT and the identifier ID issued to the registration data PT are stored so as to be understood as a pair. Moreover, although the ciphertext storage unit and the identifier storage unit are described as separate units, they may be stored in the same storage device (for example, a database).

  Referring to FIG. 23, in the ciphertext verification phase, input data Z ′ to be verified is input to data verification requesting apparatus 700 (step F1).

  Next, the data verification request generation unit 701 receives the input data Z ′ and the encryption key pk, executes the encryption algorithm ENC (pk, Z ′), and generates a ciphertext C ′. The registered data generation unit 601 sets the collation data QD = C ′ and sends it to the data collation determination device 400A (step F2).

  Next, the data acquisition unit 401A of the data verification determination device 400A receives all the registration data {PT} from the ciphertext storage unit 202 of the storage device 200 (step F3).

  Next, for all PTs included in {PT}, the distance calculation unit 402 receives the collation data QD, the registration data PT, and the encryption key pk, and first adds ADD (pk, PT, QD ^ {-1}) = ENC (pk, Z-Z ′) = C ″. Next, the distance calculation unit 402 multiplies MULT (pk, C ″, C ″) = ENC (pk, (Z -Z ') ^ 2) = D The distance calculation unit 402 sets {D} as the set of Ds for all PTs and {D} as the encrypted distance data (step F4).

  Next, the auxiliary request unit 403 receives the encrypted distance data {D}, generates a verification auxiliary request {D}, and sends it to the verification auxiliary device 500 (step F5).

  Next, the decryption unit 502 of the collation assisting device 500 receives the collation assist request {D} and the decryption key sk stored in the key storage unit 504, and for all D included in {D}, Distance data d is generated (step F6).

  Next, the score calculation unit 503 receives all the distance data {d} as input, and generates a list {d1,..., Dm} of d smaller than a predetermined threshold value t. Here, for simplicity, d1,..., Dm are in ascending order, that is, d1 ≦ d2 ≦. Next, the score calculation unit 503 randomly selects r1,. r1,..., rm are in ascending order, that is, r1≤r2≤ ... ≤rm. However, when some di = dj, ri = rj is selected. Then, the score calculation unit 503 sets the scores to {r1,. . . , Rm} and sent to the data matching determination apparatus 400 (step F7).

  Next, the determination unit 404 of the data matching determination apparatus 400A inputs the scores {r1,. . . , Rm} and a collation result is generated (step F8). As the collation result, for example, ID1 corresponding to r1 having the smallest score is received from the identifier storage unit 203, and ID1 is accepted. Alternatively, all IDs that fall below the threshold may be accepted. In addition, there are a plurality of acceptance determination methods depending on the application, but any of the determination methods can be applied.

  In the second embodiment, the scores are randomly selected so as to maintain the order of distances. However, for example, depending on the application, it may be possible to store the difference in distances. For example, whether the difference between the first place and the second place is significantly different (larger than the second place and the third place, the third place and the fourth place, etc.) can be a method for judging the collation result. In this case, instead of the above method, m-1 random numbers can be assigned to d2-d1, d3-d2,..., Dm-dm-1.

  As described above, in the second embodiment, the distance calculated by the decryption server 30A (the verification auxiliary device 500) at the time of verification is replaced with a random value selected according to an appropriate distribution, and a score is generated, for example. The authentication server 20B (data verification determination device 400A) can determine whether the first place and the second place are significantly different. In addition, by changing the random number used at the time of each check, it is impossible to determine whether it is closer or farther than the previous time, and a hill climbing attack is impossible.

  The method described in the present invention is a program that can be executed by a computer, such as a flexible disk, a magnetic disk such as a hard disk, a CD-ROM (compact disc read only memory), an optical disk such as a DVD (digital versatile disc), It can also be stored and distributed in a storage medium such as a magneto-optical disc (MO) or semiconductor memory.

  In addition, as long as the storage medium can store a program and can be read by a computer, the storage format may be any form.

  Further, an operating system running on the computer, middleware such as database management software, network software, or the like may execute a part of each process based on an instruction of a program installed in the computer from the storage medium.

  Furthermore, the storage medium in the present invention is not limited to a medium independent of a computer, but also includes a storage medium in which a program transmitted via a LAN, the Internet, or the like is downloaded and stored or temporarily stored.

  Further, the number of storage media is not limited to one, and the case where the processing in the above embodiment is executed from a plurality of media is also included in the storage media in the present invention, and the media configuration may be any configuration.

  The computer according to the present invention executes each process based on a program stored in a storage medium, and may have any configuration such as a device including a personal computer or a system in which a plurality of devices are connected to a network. .

  The computer in the present invention is not limited to a personal computer, but includes an arithmetic processing unit included in an information processing device, and is a device or device capable of realizing the functions of the present invention by a program.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Various inventions can be formed by appropriately combining a plurality of components. For example, some components may be deleted from all the components shown in the embodiment. Moreover, you may combine a component suitably.

  A part or all of the above-described embodiment can be described as in the following supplementary notes, but is not limited thereto.

(Appendix 1)
A registration data generating unit that encrypts input data to be concealed using an encryption key and outputs registration data;
A storage device for storing the registration data in the ciphertext storage unit, and an identifier for uniquely identifying the registration data in the identifier storage unit so that the correspondence can be understood;
A data collation request generator that encrypts input data to be collated using the encryption key and outputs collation data;
A distance calculation unit that outputs encrypted distance data using the encryption key from the registration data and the verification data;
Decrypting the encrypted distance data using a decryption key to generate distance data;
A score calculation unit that generates a score using random numbers from the distance data;
A determination unit that outputs a matching result from the score;
Ciphertext matching system including

(Appendix 2)
The score calculation unit
Means for comparing the distance data with a predetermined value;
If the distance data is smaller than the predetermined value, the random number is selected, and a value obtained by adding the distance data and the random number is generated as the score;
Means for generating zero as the score if the distance data is greater than the predetermined value;
The ciphertext verification system according to supplementary note 1, comprising:

(Appendix 3)
The ciphertext verification system according to appendix 1 or 2, further including a key generation unit that generates the encryption key and the decryption key from security parameters.

(Appendix 4)
The ciphertext verification system according to appendix 3, wherein the key generation unit generates a public key and a secret key of homomorphic encryption or Somewhat homomorphic encryption, respectively, as the encryption key and the decryption key.

(Appendix 5)
The ciphertext matching system according to any one of appendices 1 to 4, wherein the input data to be concealed and the input data to be collated are biometric information, and the input data to be concealed and the collation target A biometric authentication system for performing biometric authentication by determining whether or not the input data is similar to each other.

(Appendix 6)
The first client encrypts input data to be concealed using an encryption key to generate registration data, and the authentication server stores the registration data together with an identifier for uniquely identifying the registration data A data registration step to be stored in the unit;
A second client encrypts input data to be verified using the encryption key to generate verification data, and the authentication server uses the registration data and the verification data stored in the storage unit, Generate encrypted distance data using the encryption key, and a decryption server decrypts the encrypted distance data using the decryption key to generate distance data, and generates a score from the distance data using a random number A ciphertext matching step in which the authentication server generates a matching result from the score;
Ciphertext matching method including

(Appendix 7)
A registration data generation step in which a first client encrypts input data to be concealed using an encryption key and generates registration data;
An authentication server storing the registration data in a storage unit together with an identifier for uniquely identifying the registration data;
A data collation request generating step in which a second client encrypts input data to be collated using the encryption key and generates collation data;
A distance calculating step in which the authentication server generates encrypted distance data using the encryption key from the registration data and the verification data stored in the storage unit;
A decryption step in which a decryption server decrypts the encrypted distance data using a decryption key to generate distance data;
A score calculating step in which the decryption server calculates a score from the distance data using a random number;
A determination step in which the authentication server generates a matching result from the score;
Ciphertext matching method including

(Appendix 8)
A registration data generation process for generating registration data by encrypting input data to be concealed using an encryption key;
Storing the registration data in a storage unit together with an identifier for uniquely identifying the registration data;
A data verification request generation process for generating verification data by encrypting input data to be verified using the encryption key;
A distance calculation process for generating encrypted distance data using the encryption key from the registration data and the verification data stored in the storage unit;
Decrypting the encrypted distance data using a decryption key to generate distance data;
A score calculation process for calculating a score from the distance data using a random number;
A determination process for generating a matching result from the score;
A ciphertext verification program that causes a computer to execute.

(Appendix 9)
A key generation unit that generates an encryption key and a decryption key from security parameters;
Decrypting encrypted distance data using the decryption key to generate distance data; and
A score calculator that calculates a score using random numbers from the distance data;
A collation assisting device.

(Appendix 10)
A registration data generation device having a registration data generation unit that generates registration data by encrypting input data to be concealed using the encryption key generated by the verification assisting device according to attachment 9.

(Appendix 11)
An identifier management unit that manages an identifier that uniquely identifies the registration data, using the registration data generated by the registration data generation device according to attachment 10 as an input;
A ciphertext storage unit for storing the registration data;
An identifier storage unit for storing the identifier;
A storage device.

(Appendix 12)
An identifier storage unit that stores the identifier stored in the storage device according to attachment 11,
The identifier corresponding to the input data to be verified is read from the identifier storage unit, the input data to be verified is encrypted using the encryption key generated by the verification auxiliary device according to appendix 9, and the identifier is A data collation request generator for generating collation data including,
A data verification requesting device.

(Appendix 13)
A data acquisition unit that acquires, from the ciphertext storage unit of the storage device according to appendix 11, registration data corresponding to the identifier included in the collation data received from the data collation requesting device according to appendix 12.
A distance calculation unit that calculates encrypted distance data from the registration data and the verification data using an encryption key generated by the verification auxiliary device according to appendix 9.
An auxiliary request unit that transmits the encrypted distance data as auxiliary request data to the verification auxiliary device according to attachment 9,
A determination unit that outputs a matching result from the score received from the matching assisting device according to attachment 9,
A data collation determination device.

(Appendix 14)
A data collation request device having a data collation request generation unit that generates collation data by encrypting input data to be collated using the encryption key generated by the collation auxiliary device according to attachment 9.

(Appendix 15)
A data acquisition unit that acquires all of the registration data stored in the ciphertext storage unit of the storage device according to attachment 11,
A distance calculation unit that calculates encrypted distance data from the registration data and the verification data using an encryption key generated by the verification auxiliary device according to appendix 9.
An auxiliary request unit that transmits the encrypted distance data as auxiliary request data to the verification auxiliary device according to attachment 9,
A determination unit that outputs a matching result from the score received from the matching assisting device according to attachment 9,
A data collation determination device.

(Appendix 16)
A ciphertext verification system comprising a registered data generation device, a storage device, a data verification request device, a data verification determination device, and a verification auxiliary device,
The registration data generation device includes a registration data generation unit that encrypts input data to be concealed using an encryption key and outputs registration data,
The storage device receives the registration data generated by the registration data generation unit as an input, generates a different identifier for each data, and corresponds the registration data to the ciphertext storage unit and the corresponding identifier to the identifier storage unit. Including an identifier management unit for storing so that
The data verification request device includes a data verification request generation unit that receives the encryption key, an identifier stored in an identifier storage unit, and input data to be verified, and outputs verification data.
The data collation determination device
A data acquisition unit that acquires registration data corresponding to the identifier included in the verification data from the ciphertext storage unit of the storage device;
A distance calculation unit that inputs the acquired registration data, the verification data, and the encryption key and outputs encrypted distance data;
An auxiliary request unit that receives the encrypted distance data and outputs auxiliary request data to the verification auxiliary device;
A score received from the verification assisting device as an input, and a determination unit that outputs a verification result,
The verification assisting device is:
A key generation unit that receives a security parameter and outputs the encryption key and the decryption key;
The auxiliary request data received from the data matching determination device and the decryption key as inputs, a decryption unit that generates distance data,
A ciphertext matching system, comprising: a score calculation unit that receives the distance data and outputs the score using a random number.

(Appendix 17)
The ciphertext matching system according to appendix 16, wherein
The key generation unit of the verification assisting device generates an encryption key and a decryption key of homomorphic encryption or Somewhat homomorphic encryption,
The registration data generation unit of the registration data generation device generates the registration data using the encryption key,
The data verification request generating unit of the data verification requesting device generates the verification data using the encryption key,
The ciphertext verification system, wherein the decryption unit of the verification assisting device generates the distance data using the decryption key.

(Appendix 18)
A ciphertext verification system comprising a registered data generation device, a storage device, a data verification request device, a data verification determination device, and a verification auxiliary device,
The registration data generation apparatus includes a registration data generation unit that inputs input data to be concealed and an encryption key, and outputs registration data.
The storage device receives the registration data generated by the registration data generation unit as an input, generates a different identifier for each data, and corresponds the registration data to the ciphertext storage unit and the corresponding identifier to the identifier storage unit. Including an identifier management unit for storing so that
The data verification requesting apparatus includes a data verification request generation unit that receives the encryption key and verification target data and outputs verification data.
The data collation determination device
A data acquisition unit that acquires all registration data stored in the ciphertext storage unit of the storage device;
A distance calculation unit that inputs the acquired registration data, the verification data, and the encryption key and outputs encrypted distance data;
An auxiliary request unit that receives the encrypted distance data and outputs auxiliary request data to the verification auxiliary device;
A score received from the verification assisting device as an input, and a determination unit that outputs a verification result,
The verification assisting device is:
A key generation unit that receives a security parameter and outputs the encryption key and the decryption key;
The auxiliary request data received from the data matching determination device and the decryption key as inputs, a decryption unit that generates distance data,
A ciphertext matching system comprising: a score calculation unit that receives the distance data and outputs the score using a random number.

(Appendix 19)
The ciphertext matching system according to appendix 18, wherein
The key generation unit of the verification assisting device generates an encryption key and a decryption key of homomorphic encryption or Somewhat homomorphic encryption,
The registration data generation unit of the registration data generation device generates the registration data using the encryption key,
The data verification request generating unit of the data verification requesting device generates the verification data using the encryption key,
The ciphertext verification system, wherein the decryption unit of the verification assisting device generates the distance data using the decryption key.

  As an application example of the present invention, there is authentication that protects biometric information. The input data in the data registration phase and the input data in the ciphertext verification phase are biometric information acquired from a fingerprint or a vein. As a result, even if the score related to the distance between the data Z used during registration and the data Z ′ used during verification is output, information about the data will not be leaked. Allowed authentication can be performed. Biometric information is not always able to stably acquire the same data, but it can be assumed that data acquired from the same person is similar (data with a small Euclidean distance can be acquired). Utilization for certification is considered industrially useful.

DESCRIPTION OF SYMBOLS 10 Client 20B Authentication server 30B Decryption server 100 Registration data generation apparatus 101 Registration data generation part 200 Storage apparatus 201 Identifier management part 202 Ciphertext storage part 203 Identifier storage part 301 Data collation request generation part 302 Identifier storage part 400 Data collation determination apparatus 400A Data verification determination device 401 Data acquisition unit 401A Data acquisition unit 402 Distance calculation unit 403 Auxiliary request unit 404 Determination unit 500 Verification auxiliary device 501 Key generation unit 502 Decryption unit 503 Score calculation unit 504 Key storage unit 600 Registered data generation device 601 Registration data Generation unit 700 Data verification request device 701 Data verification request generation unit

Claims (10)

A registration data generating unit that encrypts input data to be concealed using an encryption key and outputs registration data;
A storage device for storing the registration data in the ciphertext storage unit, and an identifier for uniquely identifying the registration data in the identifier storage unit so that the correspondence can be understood;
A data collation request generator that encrypts input data to be collated using the encryption key and outputs collation data;
A distance calculation unit that outputs encrypted distance data using the encryption key from the registration data and the verification data;
Decrypting the encrypted distance data using a decryption key to generate distance data;
A score calculation unit that generates a score using random numbers from the distance data;
A determination unit that outputs a matching result from the score;
Ciphertext matching system including The score calculation unit
Means for comparing the distance data with a predetermined value;
If the distance data is smaller than the predetermined value, the random number is selected, and a value obtained by adding the distance data and the random number is generated as the score;
Means for generating zero as the score if the distance data is greater than the predetermined value;
The ciphertext verification system according to claim 1, comprising:   The ciphertext verification system according to claim 1, further comprising a key generation unit that generates the encryption key and the decryption key from security parameters.   The ciphertext matching system according to claim 3, wherein the key generation unit generates a public key and a secret key of homomorphic encryption or Somewhat homomorphic encryption, respectively, as the encryption key and the decryption key.   5. The ciphertext matching system according to claim 1, wherein the input data to be concealed and the input data to be collated are biometric information, and the input data to be concealed and the collation A biometric authentication system that performs biometric authentication by determining whether or not target input data is similar. The first client encrypts input data to be concealed using an encryption key to generate registration data, and the authentication server stores the registration data together with an identifier for uniquely identifying the registration data A data registration step to be stored in the unit;
A second client encrypts input data to be verified using the encryption key to generate verification data, and the authentication server uses the registration data and the verification data stored in the storage unit, Generate encrypted distance data using the encryption key, and a decryption server decrypts the encrypted distance data using the decryption key to generate distance data, and generates a score from the distance data using a random number A ciphertext matching step in which the authentication server generates a matching result from the score;
Ciphertext matching method including A registration data generation step in which a first client encrypts input data to be concealed using an encryption key and generates registration data;
An authentication server storing the registration data in a storage unit together with an identifier for uniquely identifying the registration data;
A data collation request generating step in which a second client encrypts input data to be collated using the encryption key and generates collation data;
A distance calculating step in which the authentication server generates encrypted distance data using the encryption key from the registration data and the verification data stored in the storage unit;
A decryption step in which a decryption server decrypts the encrypted distance data using a decryption key to generate distance data;
A score calculating step in which the decryption server calculates a score from the distance data using a random number;
A determination step in which the authentication server generates a matching result from the score;
Ciphertext matching method including A registration data generation process for generating registration data by encrypting input data to be concealed using an encryption key;
Storing the registration data in a storage unit together with an identifier for uniquely identifying the registration data;
A data verification request generation process for generating verification data by encrypting input data to be verified using the encryption key;
A distance calculation process for generating encrypted distance data using the encryption key from the registration data and the verification data stored in the storage unit;
Decrypting the encrypted distance data using a decryption key to generate distance data;
A score calculation process for calculating a score from the distance data using a random number;
A determination process for generating a matching result from the score;
A ciphertext verification program that causes a computer to execute. A ciphertext verification system comprising a registered data generation device, a storage device, a data verification request device, a data verification determination device, and a verification auxiliary device,
The registration data generation device includes a registration data generation unit that encrypts input data to be concealed using an encryption key and outputs registration data,
The storage device receives the registration data generated by the registration data generation unit as an input, generates a different identifier for each data, and corresponds the registration data to the ciphertext storage unit and the corresponding identifier to the identifier storage unit. Including an identifier management unit for storing so that
The data verification request device includes a data verification request generation unit that receives the encryption key, an identifier stored in an identifier storage unit, and input data to be verified, and outputs verification data.
The data collation determination device
A data acquisition unit that acquires registration data corresponding to the identifier included in the verification data from the ciphertext storage unit of the storage device;
A distance calculation unit that inputs the acquired registration data, the verification data, and the encryption key and outputs encrypted distance data;
An auxiliary request unit that receives the encrypted distance data and outputs auxiliary request data to the verification auxiliary device;
A score received from the verification assisting device as an input, and a determination unit that outputs a verification result,
The verification assisting device is:
A key generation unit that receives a security parameter and outputs the encryption key and the decryption key;
The auxiliary request data received from the data matching determination device and the decryption key as inputs, a decryption unit that generates distance data,
A ciphertext matching system, comprising: a score calculation unit that receives the distance data and outputs the score using a random number. A ciphertext verification system comprising a registered data generation device, a storage device, a data verification request device, a data verification determination device, and a verification auxiliary device,
The registration data generation apparatus includes a registration data generation unit that inputs input data to be concealed and an encryption key, and outputs registration data.
The storage device receives the registration data generated by the registration data generation unit as an input, generates a different identifier for each data, and corresponds the registration data to the ciphertext storage unit and the corresponding identifier to the identifier storage unit. Including an identifier management unit for storing so that
The data verification requesting apparatus includes a data verification request generation unit that receives the encryption key and verification target data and outputs verification data.
The data collation determination device
A data acquisition unit that acquires all registration data stored in the ciphertext storage unit of the storage device;
A distance calculation unit that inputs the acquired registration data, the verification data, and the encryption key and outputs encrypted distance data;
An auxiliary request unit that receives the encrypted distance data and outputs auxiliary request data to the verification auxiliary device;
A score received from the verification assisting device as an input, and a determination unit that outputs a verification result,
The verification assisting device is:
A key generation unit that receives a security parameter and outputs the encryption key and the decryption key;
The auxiliary request data received from the data matching determination device and the decryption key as inputs, a decryption unit that generates distance data,
A ciphertext matching system comprising: a score calculation unit that receives the distance data and outputs the score using a random number.

Images