JP5573293B2 - Authentication device, encryption device, token device, authentication method, and authentication program - Google Patents

Description

  The present invention relates to an authentication device, an encryption device, a token device, an authentication method, and an authentication program for authenticating information.

  In recent years, when various systems are used in society, there are many situations where it is necessary to authenticate that a user is an authorized user. When performing authentication, a method using biometric authentication, which is unique information for each individual, has become widespread. Biometric authentication targets include fingerprints, veins, irises, faces, and voices. Moreover, since biometric information is confidential information regarding an individual, it is preferable to encrypt it. At this time, there is disclosed a technique for performing biometric information matching determination in an encrypted state using homomorphic encryption (for example, see Patent Document 1 below).

  Patent Document 1 relates to a method and system for calculating an index of similarity between at least two data in an encrypted state. As a confirmation method, the authentication apparatus uses a bit sequence X = (x1,..., Xn) indicating biometric information and a bit sequence Y = (y1,..., Yn) indicating biometric information when performing authentication. On the other hand, data Epk (X) and Epk (Y) encrypted with a common public key pk are prepared. At this time, E uses a Palier cipher or an El Gamal cipher that satisfies the following homomorphism.

  E (x + y) = E (x) E (y)

  Subsequently, the authentication device modifies the equation based on the homomorphic property of Epk (dH (X, Y)) whether the Hamming distance dH (X, Y) is equal to or less than a certain value T, and Judgment is made in a state where the biometric information is encrypted by secure calculation according to 1.

Special table 2008-521005 gazette

B. Schonmarkers, P.M. Tuyls, “Practical two-particulate calculation based on the conditional gate”, ASIACRYPT 2004, LNCS, Springer-Verlag, 2004.

  However, in the prior art described above, in the authentication system of Patent Document 1, the secret key sk is managed by the system designer and the operator. Therefore, the authentication system of Patent Document 1 has a problem that the secret key sk may be leaked without the user's involvement.

  Further, when the encrypted biometric information is leaked, a third party can use the information to impersonate a legitimate user. Therefore, it is necessary to invalidate the leaked biometric information by re-registering the biometric information. However, the Hamming distance dH (X, X ′) based on the leaked biological information X and the re-registered biological information X ′ is smaller than the threshold T. Therefore, even if the biometric information is re-registered, the authentication is successful with the leaked biometric information X. For this reason, even if encrypted biometric information is once leaked, there is a problem that it is difficult to prevent spoofing thereafter.

  In order to solve the above-described problems caused by the prior art, the present invention provides an encryption device, a token device, an authentication system, an encryption method, which does not leak a secret key and biometric information even if encrypted biometric information leaks. And to provide an encryption program.

  In order to solve the above-described problems and achieve the object, the disclosed authentication device receives authentication information by homomorphic encryption from the encryption device, and performs authentication, from the encryption device to the user. The biometric information encrypted by homomorphic encryption using the public key, the user identification information, and the user public key are received, and the user identification information and the user public key are used. Based on the identification information received by the receiving means from the database that stores the biometric information of the user encrypted by the homomorphic encryption and the public key of the user for each user, the information is stored in the database. The public key and the encrypted biometric information are searched, and the user is authenticated based on the searched public key and the encrypted biometric information, and the received public key and the encrypted biometric information. It is a requirement to do.

  According to the authentication device, encryption device, token device, authentication method, and authentication program, even if the encrypted biometric information leaks, the biometric information encrypted with a different public key can be registered. There is an effect that biological information can not be leaked.

It is a block diagram which shows the authentication system 100 concerning this Embodiment. 3 is a block diagram illustrating a hardware configuration of an encryption device 103. FIG. 2 is a block diagram showing a functional configuration of the authentication system 100. FIG. 3 is an explanatory diagram showing the location of a public key and a secret key in the authentication system 100. FIG. It is explanatory drawing which shows the outline | summary of the authentication process of the encrypted biometric information. It is explanatory drawing which shows an example of the memory content of the encryption biometric information table. It is a flowchart of a key generation process. It is a flowchart of a biometric information registration process. It is a flowchart of a biometric information authentication process. It is a flowchart which shows a process in case the biometric information encrypted by the biometric information authentication process has randomness.

  Exemplary embodiments of an authentication device, an encryption device, a token device, an authentication method, and an authentication program according to the present invention will be described below in detail with reference to the accompanying drawings.

  FIG. 1 is a block diagram showing an authentication system 100 according to the present embodiment. The authentication system 100 includes an authentication device 101, an encryption device 103, and a token device 104. The service 102 accesses the encryption device 103 when the authentication system 100 succeeds in authentication. The authentication device 101, the service 102, and the encryption device 103 are connected via a network 105, respectively. The encryption apparatus 103 is connected to a biometric information reading device 106 and a token reading device 107. Inside the authentication apparatus 101, there is an encrypted biometric information table 108.

  The authentication system 100 manages an authentication process when the user uses the service 102. It is confirmed whether the accessing user is a legitimate user, and if it is a legitimate user, authentication is performed and the encryption apparatus 103 is permitted to connect to the service 102.

  The authentication device 101 performs an authentication process when the user uses the service 102. Specifically, for example, the authentication apparatus 101 confirms whether the biometric information encrypted by the homomorphic encryption at the time of registration matches the biometric information of the user who performed the access.

  The service 102 provides software functions via the network 105. Specifically, for example, when the authentication system 100 is an authentication system for a service provided by a bank, the encryption device 103 connects to a server group of the bank constructing the service 102 after successful authentication. The server group provides the user with functions for deposit / withdrawal management, transfer, and the like via the network 105.

  The encryption device 103 acquires the user's biometric information and information from the token device 104, encrypts the biometric information, and transmits it to the authentication device 101. Further, after successful authentication, the software provided from the service 102 is operated. A specific example of the encryption device 103 is, for example, an ATM (Automated Teller Machine) at a bank.

  The token device 104 is a physical device that helps the authentication process. Specifically, it is a smart card or the like incorporating an integrated circuit for storing and calculating information. The token device 104 can be implemented in various forms depending on the encryption method. For example, as one implementation, the token device 104 may record the user identification number and output the user identification number during authentication.

  The network 105 is a communication network such as a LAN (Local Area Network), a WAN (Wide Area Network), and the Internet. Alternatively, the network 105 may be a dedicated line for security enhancement.

  The biometric information reading device 106 is a device for capturing the biometric information of the user as digital information. The token reading device 107 is a device for reading the token device 104. For example, if the token device 104 is a smart card, it becomes a card reader.

(Hardware configuration of encryption apparatus 103)
FIG. 2 is a block diagram illustrating a hardware configuration of the encryption apparatus 103. 2, the encryption apparatus 103 includes a CPU (Central Processing Unit) 201, a ROM (Read-Only Memory) 202, and a RAM (Random Access Memory) 203. The encryption device 103 as a storage device includes a magnetic disk drive 204, a magnetic disk 205, an optical disk drive 206, and an optical disk 207. The encryption device 103 as an input / output device for a user or other device includes a display 208, an interface (I / F) 209, a keyboard 210, a mouse 211, a scanner 212, and a card reader 213. I have. Each component is connected by a bus 200.

  Here, the CPU 201 controls the entire encryption apparatus. The ROM 202 stores a program such as a boot program. The RAM 203 is used as a work area for the CPU 201. The magnetic disk drive 204 controls reading / writing of data with respect to the magnetic disk 205 according to the control of the CPU 201. The magnetic disk 205 stores data written under the control of the magnetic disk drive 204.

  The optical disk drive 206 controls reading / writing of data with respect to the optical disk 207 according to the control of the CPU 201. The optical disk 207 stores data written under the control of the optical disk drive 206, or causes the computer to read data stored on the optical disk 207.

  The display 208 displays data such as a document, an image, and function information as well as a cursor, an icon, or a tool box. As the display 208, for example, a CRT, a TFT liquid crystal display, a plasma display, or the like can be adopted.

  The I / F 209 is connected to another device such as the authentication device 101 via the network 105. The I / F 209 manages an internal interface with the network 105 and controls input / output of data from an external device. For example, a modem or a LAN adapter may be employed as the I / F 209.

  The keyboard 210 includes keys for inputting characters, numbers, various instructions, and the like, and inputs data. The keyboard 210 may be a touch panel type input pad or a numeric keypad. The mouse 211 performs cursor movement, range selection, window movement, size change, and the like. The mouse 211 may be a trackball or a joystick as long as it has the same function as a pointing device.

  The scanner 212 is an example of the biometric information reading device 106, reads biometric information by an optical method, voltage, or the like, and captures, for example, image data into the encryption apparatus 103. The biometric information to be captured includes fingerprints and veins. In addition, when the iris and face are used as biometric information, a camera may be employed as the biometric information reading device 106 and captured as image data. When voice is used as biometric information, a microphone may be employed as the biometric information reading device 106 and may be captured as voice data.

  The card reader 213 is an example of the token reading device 107, and is a device when it is assumed that the token device 104 is a smart card. The card reader 213 reads the token device 104 and takes in user identifier information and the like into the encryption device 103.

(Functional configuration of authentication system 100)
Next, a functional configuration of the authentication system 100 will be described. FIG. 3 is a block diagram showing a functional configuration of the authentication system 100. The encryption device 103 includes an acquisition unit 301, an encryption unit 302, a transmission unit 303, a reception unit 307, a generation instruction unit 308, a decryption instruction unit 312, a determination unit 315, and a signature generation instruction unit 316. And a signature verification unit 318. The token device 104 includes a generation unit 309, a transmission unit 310, an acquisition unit 313, a decryption unit 314, a signature generation unit 317, a storage unit 319, and a determination unit 320. The authentication apparatus 101 includes a reception unit 304, a search unit 305, an execution unit 306, and an update unit 311.

  Specifically, the functions (acquisition unit 301 to signature verification unit 318) serving as a control unit in the encryption device 103 are realized by the CPU 201 executing a program stored in the storage device, for example. . The storage device is the ROM 202, RAM 203, magnetic disk 205, optical disk 207, etc. shown in FIG. Alternatively, the function may be realized by another CPU executing via the I / F 209.

  Similarly, the functions (the generation unit 309 to the signature generation unit 317 and the determination unit 320) that serve as the control unit in the token device 104 are also, for example, the program stored in the storage device, for example, by the CPU of the token device 104. The function is realized by executing. The storage device is a ROM, RAM, flash ROM, or the like built in the token device 104. Alternatively, the token device 104 may be in a state in which the execution result is stored after the external device executes the function of the control unit.

  Similarly, the functions (reception unit 304 to execution unit 306, update unit 311) serving as a control unit in the authentication apparatus 101 are specifically executed by, for example, the CPU of the authentication apparatus 101 executing a program stored in the storage device. By doing so, the function is realized. The storage device is a ROM, RAM, magnetic disk, optical disk, or the like built in the authentication device 101. Alternatively, the function may be realized by being executed by another CPU via the network 105.

  In addition, the processing order indicated by solid arrows as the types of line segments that connect the functions indicates the processing order of authentication processing in the authentication system 100. Specifically, a series of processing from the acquisition unit 301, the encryption unit 302, the transmission unit 303, the reception unit 304, the search unit 305, the execution unit 306, the reception unit 307, and the determination unit 315 is the processing order of the authentication processing. Become. In addition, the authentication apparatus 101 accesses the encrypted biometric information table 108 by the search unit 305. Further, the authentication system 100 executes the functions of the storage unit 319 and the determination unit 320 by the token device 104 when the processing of the acquisition unit 301 is executed.

  Similarly, the processing order indicated by the dotted arrows indicates a part of the processing order of the biometric information re-registration processing in the authentication system 100. Specifically, a series of processes from the generation instruction unit 308 to the transmission unit 310 indicated by the dotted arrows, the acquisition unit 301 to the search unit 305 and the update unit 311 indicated by the solid arrows are bio-information re-registration processing. The processing order is as follows. Further, the authentication apparatus 101 accesses the encrypted biometric information table 108 using the update unit 311.

  Similarly, the processing indicated by the one-dot chain line arrow indicates the processing order when the encrypted biometric information in the authentication system 100 has randomness. Specifically, a series of processes from an acquisition unit 301 to a reception unit 307 indicated by solid arrows, a decryption instruction unit 312 to a transmission unit 310, an acquisition unit 301, and a determination unit 315 indicated by dashed-dotted arrows are encrypted. This is the processing order when the converted biological information has randomness.

  Similarly, the processing order indicated by the dashed arrows indicates a part of the processing order of the verification processing of the token device 104 in the authentication system 100. Specifically, a series of processing from the signature generation instruction unit 316 to the transmission unit 310, the acquisition unit 301, and the signature verification unit 318 indicated by the dashed arrows is the processing order of the verification processing of the token device 104.

  The acquisition unit 301 has a function of acquiring identification information and a public key from the token device 104 that stores user identification information and a combination of a public key and a secret key. The acquisition unit 301 may acquire the identification information and the generated public key when the generation instruction unit 308 instructs generation of the public key and the secret key. The acquisition unit 301 may acquire the decrypted authentication result when the decryption instruction unit 312 instructs the decryption of the authentication result. The acquisition unit 301 may acquire the generated electronic signature when the signature generation instruction unit 316 instructs generation of the electronic signature. A user is a user who uses the authentication system 100.

  Specifically, for example, the encryption device 103 acquires the user identifier Ui of the user Ui and the public key pki as user identification information. The acquired data is stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207.

  The encryption unit 302 has a function of encrypting the user's biometric information with homomorphic encryption using the public key acquired by the acquisition unit 301. Further, the encryption unit 302 may encrypt the biometric information of the user so as to have randomness by using homomorphic encryption. Specific examples of the homomorphic encryption are, for example, the Palier encryption and the El Gamal encryption. In addition, encryption with randomness is encryption that outputs different ciphertexts for plaintext with the same input by giving randomness to the encryption algorithm itself. Specific examples of the encryption algorithm having randomness include RSA-OAEP (RSA Optimal Asymmetry Encryption Padding) cipher and RSAES-PKCS1-v1_5 cipher.

  Specifically, for example, the encryption device 103 encrypts the biometric information Mi read by the scanner 212 with the public key pki using the homomorphic encryption E to obtain Epki (Mi). Note that the encrypted data is stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207.

  The transmission unit 303 has a function of transmitting the identification information, the public key, and the biometric information encrypted by the encryption unit 302 to the authentication device 101. Specifically, for example, the encryption device 103 transmits the user identifier Ui, the public key pki, and the biometric information Epki (Mi) encrypted by the homomorphic encryption to the authentication device 101. The transmitted data may be stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207.

  The receiving unit 304 has a function of receiving the biometric information encrypted by the homomorphic encryption with the identification information and the public key transmitted from the encryption device 103. Specifically, for example, the authentication apparatus 101 receives a user identifier Ui, a public key pki, and biometric information Epki (Mi) encrypted by homomorphic encryption. The received data is stored in a storage area such as a RAM, a magnetic disk, or an optical disk in the authentication apparatus 101.

  The search unit 305 has a function of searching the public key and encrypted biometric information stored in the database based on the identification information received by the receiving unit 304 from the database. The database is an encrypted biometric information table 108 that stores, for each user identification information, the biometric information of the user encrypted by homomorphic encryption and the public key obtained by encrypting the biometric information of the user.

  Specifically, for example, when the received identification information is the user identifier Ui from the encrypted biometric information table 108, the authentication device 101, the biometric information encrypted by the homomorphic encryption of the user Ui, and the biometric Search for a public key with encrypted information. The searched and found data is stored in a storage area such as a RAM, a magnetic disk, or an optical disk in the authentication apparatus 101.

  When the search unit 305 searches the public key related to the identification information received in the database and the encrypted biometric information, the execution unit 306 searches the biometric information received by the reception unit 304 and the biometric information searched. Has a function of executing a function for determining whether or not the two match. The function is an encrypted biometric algorithm F that determines the match of biometric information encrypted by homomorphic encryption, corresponding to the biometric authentication algorithm f that determines the match of unencrypted biometric information.

  As a specific example of the biometric authentication algorithm f, for example, an algorithm for determining whether the Hamming distance is equal to or less than a certain value. As another specific example, it may be determined by the Levenshtein distance in addition to the determination by the Hamming distance. In addition, if the homomorphic encryption E is a completely homomorphic encryption capable of both addition and multiplication operations, the biometric authentication algorithm f can use any algorithm.

Completely homomorphic encryption is encryption that satisfies homomorphism for operations by all logic circuits (see Reference 1 below).
(Reference 1: Craig Gentry “Fully homotypic usage using ideals”, Proceedings of the 41st Annual ACM Symposium on Theory of 9 Computation, 9-1

  Here, the plaintext M1 with the key pair: (pk, sk) and the plaintext M encrypted with the public key pk: C = Epk (M), the decryption of the ciphertext C with the private key sk: M = Dsk (C) ,..., A function having Mn as an input is defined as f (M1,..., Mn). Fully homomorphic encryption guarantees the existence of a function F that satisfies the following and its efficient execution.

Dsk (F (pk, Epk (M1), ..., Epk (Mn)))
= F (M1, ..., Mn)

  As a specific example of the biometric authentication algorithm f, if the biometric information is fingerprint information, a minutia method, a pattern matching method, a frequency analysis method, or the like may be applied as an algorithm for comparing fingerprint matches. Even when the biometric information is biometric information other than fingerprints, an algorithm suitable for the characteristics of each biometric information may be used.

  As a specific example of the execution unit 306, for example, the authentication device 101 receives the biometric information Epki (M′i) and the public key pki encrypted by the reception unit 304, and the search unit 305 receives the registration point It is assumed that the encrypted biometric information Epki (Mi) is retrieved. At this time, the authentication apparatus 101 executes F (pki, Epki (Mi), Epki (M′i)) by the execution unit 306.

  The authentication result, which is the execution result, is an OK value indicating successful authentication or an encrypted value of NG indicating an authentication failure, Epki (OK) and Epki (NG). The authentication apparatus 101 compares the authentication result with Epki (OK), and if it matches, transmits it to the encryption apparatus 103 as OK. In addition, when the encryption unit 302 encrypts the biometric information so as to have randomness, since it is not known whether the authentication is successful, the encrypted authentication result is transmitted to the encryption device 103. The authentication result that is the output value of the encrypted biometric authentication algorithm F is transmitted to the encryption device 103. The authentication result may be stored in a storage area such as a RAM, a magnetic disk, or an optical disk in the authentication apparatus 101.

  The receiving unit 307 has a function of receiving the authentication result executed by the execution unit 306. Specifically, for example, the encryption device 103 receives OK, NG, and the like. After reception, the encryption apparatus 103 transmits the received result to the determination unit 315. When the encryption unit 302 encrypts the biometric information so as to have randomness, the encryption device 103 transmits the encrypted authentication result to the decryption instruction unit 312. The received data may be stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207.

  The generation instruction unit 308 has a function of instructing the token device 104 to generate a combination of a public key and a secret key that is different from the currently used combination of the public key and the secret key. Specifically, for example, when the token device 104 includes a public key pki and a secret key ski as a combination of a public key and a secret key, the encryption device 103 performs a new disclosure different from the key combination described above. Instructs to generate a key and secret key. Also, the telegram data serving as the instruction content may be stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207.

  The generation unit 309 has a function of generating a combination of a public key and a secret key. Specifically, for example, the token device 104 generates a public key pki and a secret key ski. When the public key pki and the private key ski are generated and then generated again, the token device 104 generates the public key pki 'and the private key ski'. The generated public key and private key are stored in a non-volatile storage area such as a flash ROM in the token device 104.

  When the determination unit 320 determines that encryption by homomorphic encryption is requested, the transmission unit 310 transmits the identification information stored in the storage unit 319 and the public key generated by the generation unit 309 to the request source. It has a function. Further, when receiving a decoding instruction, the transmission unit 310 may transmit the decoding result to the instruction source. Specifically, for example, when the encryption device 103 as the request source requests encryption by homomorphic encryption, the token device 104 transmits the user identifier Ui and the public key pki to the encryption device 103. The transmitted data may be stored in a storage area such as a RAM or a flash ROM in the token device 104.

  When the search unit 305 searches for the public key related to the identification information received in the database and the encrypted biometric information, the update unit 311 searches the public key received by the reception unit 304 and the encrypted biometric information. It has a function to update the database with information. Moreover, the update part 311 may update a database, when the update information of biometric information, the identification information of a user, and the update instruction | indication are received from an encryption apparatus.

  Specifically, for example, the authentication device 101 receives the biometric information Epki (Mi ′) and the public key pki ′ encrypted by the receiving unit 304, and is encrypted by the search unit 305 at the time of registration. It is assumed that the biometric information Epki (Mi) and the public key pki are searched. At this time, the authentication apparatus 101 updates the encrypted biometric information table 108 with Epki (Mi ′) and pki ′. Note that the authentication apparatus 101 can delete old data by overwriting Epki (Mi ′) and pki ′ that are new data over Epki (Mi) and public key pki that are old data at the time of update. Good.

  The decryption instruction unit 312 has a function of instructing the token device 104 to decrypt the authentication result encrypted with the secret key. Specifically, for example, the encryption apparatus 103 acquires Epki (authentication result) from the receiving unit 307 and instructs the token device 104 to decrypt the Epki (authentication result). Note that the message data serving as the instruction content may be stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207.

  The acquisition unit 313 has a function of acquiring data to be decoded when a decoding instruction is given by the decoding instruction unit 312. Further, the acquisition unit 313 may acquire a value that is a target of the electronic signature when the signature generation instruction unit 316 is instructed to generate a signature. Specifically, for example, when the token device 104 receives an instruction from the encryption device 103 to decrypt Epki (authentication result), the token device 104 acquires Epki (authentication result). The acquired data is stored in a storage area such as a RAM or a flash ROM in the token device 104.

  The decryption unit 314 has a function of decrypting data instructed to be decrypted by the decryption instruction unit 312. Specifically, for example, the token device 104 decrypts Epki (authentication result) that has been instructed to decrypt using the secret key. The decrypted data is stored in a storage area such as a RAM or a flash ROM in the token device 104.

  The determination unit 315 has a function of acquiring the authentication result decrypted by the acquisition unit 301 and determining whether the authentication is successful based on the decrypted authentication result. Further, even when the reception unit 307 acquires an authentication result that is not encrypted, the determination unit 315 may determine whether the authentication is successful based on the authentication result.

  The signature generation instruction unit 316 has a function of instructing the token device 104 to generate an electronic signature for an arbitrary value using a secret key. Specifically, for example, the encryption device 103 generates an arbitrary value and transmits the generated value to the token device 104. The transmitted data is stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207.

  The signature generation unit 317 has a function of generating an electronic signature for an arbitrary value. Specifically, for example, the token device 104 generates an electronic signature for an arbitrary value acquired by the acquisition unit 313 using a secret key stored in the token device 104. Further, the key pair used for the electronic signature may be a key pair different from the key pair used for encrypting the biometric information. The generated electronic signature is transmitted to the encryption device 103 by the transmission unit 310. The transmitted data may be stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207.

  The signature verification unit 318 has a function of acquiring an electronic signature for an arbitrary value generated by the acquisition unit 301 and verifying the validity of the electronic signature for the arbitrary value using a public key. Specifically, for example, the encryption device 103 verifies the validity of the electronic signature by matching the value generated by the signature generation instruction unit 316 with the value obtained by decrypting the electronic signature with the public key. The verification result is stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207.

  The storage unit 319 has a function of storing user identification information. Specifically, for example, the token device 104 stores the user identifier Ui. The user identifier Ui is stored in a nonvolatile storage area such as a ROM or a flash ROM in the token device 104.

  The determination unit 320 has a function of determining whether encryption by homomorphic encryption is requested. Specifically, for example, when the acquisition unit 301 of the encryption device 103 receives the acquisition request for the identification information and the public key, the token device 104 reads the message data that is the acquisition request. Subsequently, the token device 104 determines that it is a homomorphic encryption when the value of the homomorphic encryption is set in the message data according to the format of the message data. Further, when the authentication system 100 always performs only encryption using homomorphic encryption, the token device 104 may always determine that encryption is performed using homomorphic encryption. Note that the determination result is stored in a storage area such as a ROM, a RAM, or a flash ROM in the token device 104.

  FIG. 4 is an explanatory diagram showing the location of the public key and the secret key in the authentication system 100. The token device 104 generates a public key 401 and a secret key 402, and outputs only the public key 401 to the outside when receiving a request for encryption by homomorphic encryption. The encryption device 103 that acquired the public key 401 encrypts the biometric information with the public key 401 and obtains the biometric information 403 encrypted with the public key 401. The biometric information is, for example, an image obtained by reading a fingerprint as shown in FIG.

  After the encryption, the encryption device 103 transmits the public key 401 and the biometric information 403 encrypted with the public key 401 to the authentication device 101 via the network 105. The authentication apparatus 101 receives two pieces of information and executes an algorithm that compares the information with biometric information that has been registered and encrypted by homomorphic encryption. Thus, since the secret key 402 exists only in the token device 104, there is no fear that the secret key 402 leaks to the outside.

  FIG. 5 is an explanatory diagram showing an outline of an authentication process for encrypted biometric information. A block diagram denoted by reference numeral 501 shows an outline of authentication processing when the encrypted biometric information is not given randomness. When the authentication process of the user Ui is performed, the encryption apparatus 103 obtains Epki (M′i) as encrypted biometric information of the user Ui when performing encryption with the public key 401. After encryption, the encryption device 103 transmits the encrypted biometric information to the authentication device 101. The authentication apparatus 101 receives Epki (M′i) and compares it with biometric information at the time of registration stored in the encrypted biometric information table 108. As a comparison method, comparison is performed by executing the biometric authentication algorithm f, and it is determined whether or not the output values match.

  As the biometric authentication algorithm f, any algorithm can be used when using a completely homomorphic encryption. A specific example of the biometric authentication algorithm f is, for example, an algorithm that succeeds in authentication when the Hamming distance is equal to or less than a predetermined threshold. The algorithm F is an encrypted biometric algorithm corresponding to the biometric algorithm f in the homomorphic encryption E.

  As another example of the biometric authentication algorithm f, in the case of complete homomorphic encryption, when biometric information is image data such as a fingerprint, when two images to be compared are input, Among them, a minutiae method for extracting and collating feature points may be used. Further, the biometric algorithm f may be a pattern matching method, a frequency analysis method, or the like other than the above-described method. Even in the case of biometric information other than fingerprints, an algorithm suitable for the characteristics of each biometric information may be used. The authentication apparatus 101 executes the following expression (1) by the execution unit 306.

  F (pki, Epki (Mi), Epki (M'i)) (1)

  Due to the completely homomorphic nature, the formula (1) is transformed into the following formula (2).

  Epki (f (Mi, M'i)) (2)

  The authentication result 502 that is an output value of the biometric authentication algorithm f outputs either “OK” if the Hamming distance is equal to or less than a predetermined threshold value, or “NG” if it is different. Since the output value of the biometric authentication algorithm f is fixed, the authentication apparatus 101 calculates a value Epki (OK) obtained by encrypting “OK” with the public key pki, and the output value of Expression (2) and Epki (OK) Are compared, and if they match, the authentication is successful.

  In this way, in the authentication process when the encrypted biometric information is not given randomness, authentication can be performed without using the secret key 402. Therefore, the authentication system 100 is a system in which the biometric information Mi of the user Ui does not leak where the user Ui is not involved. In the authentication system 100, when the user Ui correctly manages the secret key 402, a third party cannot decrypt Epki (Mi), and the biometric information Mi of the user Ui is not leaked.

  Further, it is assumed that the encrypted biometric information Epki (Mi) leaks. In this case, the authentication system 100 performs biometric information re-registration processing. The token device 104 generates a new key pair (pki ′, ski ′). The encryption device 103 reads the biometric information Mi ′ at the time of new registration of the user Ui, and uses the new public key pki ′ and the encrypted biometric information Epki ′ (Mi ′) based on the public key pki ′ as the entry of the user Ui. Transmit to the authentication device 101. The authentication device 101 updates the encrypted biometric information table 108 with the received public key pki 'and encrypted biometric information Epki' (Mi ').

  Epki (Mi) that has already been registered may be deleted. Thus, the authentication system 100 can cancel the biometric information that has been registered once. A system that can cancel biometric information is called cancelable biometric authentication. Once canceled and re-registered, even if a third party uses the leaked old encrypted biometric information Epki (Mi) to impersonate the user Ui, the authentication device 101 can use the public key pki and pki ′. Are different, the authentication result is NG.

  Further, in the authentication process when the encrypted biometric information has randomness, the ciphertext can be changed with respect to the plaintext Mi in addition to the cancelable biometric authentication. Thereby, even when the same plaintext is input, the fact that the same plaintext is input is not leaked to a third party because the ciphertext is different every time.

  Further, in the authentication process when the encrypted biometric information has randomness, the authentication result encrypted by the decryption unit 314 of the token device 104 is decrypted, but the secret key 402 is transmitted to the encryption device 103. The decryption may be performed by the encryption device 103. In the process of decrypting by the token device 104, when an impersonated token device 104 incorporating a process of returning an appropriate value, for example, “OK” is prepared for Epki (authentication result) by a third party. Is also authenticated. However, decryption can be prevented from being performed by the token device 104 by performing decryption by the encryption device 103.

  In addition, when the decryption unit 314 of the token device 104 decrypts, the authentication system 100 causes the token device 104 to generate an electronic signature either before or after decryption, and verifies the signature using the encryption device 103. Verification processing may be performed.

  Specifically, the encryption device 103 generates an arbitrary value and transmits it to the token device 104. The token device 104 generates a signature key pair that is different from the public key 401 and the private key 402 used in the biometric authentication process and performs signature. The token device 104 generates an electronic signature for an arbitrary value using a signature private key and transmits the digital signature to the encryption device 103. Finally, the encryption apparatus 103 verifies the generated electronic signature with the signature public key, and can confirm that the token device 104 is not impersonated. Any value can be operated more safely by using a different value for each generation. The above verification process will be described in detail with reference to FIG.

  FIG. 6 is an explanatory diagram showing an example of the stored contents of the encrypted biometric information table 108. The encrypted biometric information table 108 includes three fields: a user identifier, a public key, and encrypted biometric information. The user identifier field is identification information for identifying a user, and stores a value that uniquely determines a record in the encrypted biometric information table 108. The public key field stores the public key transmitted from the token device 104. The encrypted biometric information field stores a value obtained by encrypting the biometric information of the user stored in the user identifier using the public key set in the public key field.

  FIG. 7 is a flowchart of the key generation process. The key generation process is executed by the token device 104. Also, an external device may perform key generation processing and store a public key and a secret key in the token device 104. The token device 104 generates a key pair (pki, ski) (step S701). The key pair is a public key pki and a secret key ski. Subsequently, the token device 104 stores the designated user identifier Ui and the key pair (pki, ski) in the storage area (step S702).

  FIG. 8 is a flowchart of the biometric information registration process. The biometric information registration process is executed by the encryption device 103 and the authentication device 101. Also, the broken-line arrows in FIGS. 8 to 10 indicate message exchange between a plurality of devices. The encryption device 103 establishes a registration session with the authentication device 101 (step S801). Specifically, the encryption device 103 transmits a registration session connection request to the authentication device 101 and waits for a response from the authentication device 101. Upon receiving the registration session connection request, the authentication device 101 establishes a registration session with the encryption device 103 (step S802).

  After the registration session is established, the encryption apparatus 103 acquires the biometric information Mi from the token reading device 107, the user identifier Ui, and the public key pki from the token device 104 (step S803). At this time, the token device 104 determines to perform encryption by homomorphic encryption from the message data that is an acquisition request from the encryption device 103, and transmits the public key pki. After the acquisition, the encryption device 103 calculates encryption information Epki (Mi) by homomorphic encryption using the public key (step S804). After the calculation, the encryption device 103 transmits Ui, pki, Epki (Mi) to the authentication device 101 (step S805). After the transmission, the encryption device 103 waits for a response from the authentication device 101.

  Next, the authentication apparatus 101 receives the identifier Ui, the public key pki, and the encryption information Epki (Mi) from the encryption apparatus 103 (step S806). Using the received identifier Ui, the authentication apparatus 101 searches for a record having a user identifier field Ui in the encrypted biometric information table 108 (step S807). When the retrieved record exists (step S807: Yes), the authentication apparatus 101 transmits an inquiry as to whether overwriting is possible or not to the encryption apparatus 103 (step S808). The encryption device 103 confirms whether or not an overwritable inquiry has been accepted (step S809).

  When receiving an overwritable inquiry (step S809: Yes), the encryption apparatus 103 transmits an instruction as to whether or not overwriting is possible to the authentication apparatus 101 after receiving a user instruction (step S810). As an actual process, when an overwritable inquiry is received, the encryption apparatus 103 displays the content indicating the overwritable inquiry on the display 208 and asks the user whether to permit overwriting. After transmitting an instruction as to whether or not overwriting is possible to the encryption apparatus 103 or when an overwrite inquiry has not been received (step S809: No), the encryption apparatus 103 waits for a response from the authentication apparatus 101.

  After the process of step S808, the authentication apparatus 101 confirms whether or not an overwritable instruction has been received (step S811). The overwritable instruction becomes an update instruction. Further, the encryption apparatus 103 may transmit the update instruction in the process of step S805. When the update instruction is included in the transmission content, the authentication device 101 may perform the process of step S813 without executing steps S807 to S812.

  When an overwritable instruction is received (step S811: Yes), the authentication apparatus 101 registers the received pki and Epki (Mi) in the record whose user identifier field is Ui in the encrypted biometric information table 108 (step S813). ). After completion of registration or when an overwritable instruction has not been received (step S811: No), the authentication apparatus 101 ends the registration session with the encryption apparatus 103 (step S814). The encryption device 103 also receives the end of the registration session from the authentication device 101, and ends the registration session with the authentication device 101 (step S815).

  If there is no record whose user identifier field is Ui in the process of step S807 (step S807: No), the authentication apparatus 101 adds a record whose user identifier field is Ui to the encrypted biometric information table 108. (Step S812). After the addition, the authentication apparatus 101 proceeds to the process of step S813.

  Further, when the overwritable instruction is not received in the process of step S811 (step S811: No), the authentication apparatus 101 proceeds to the process of step S814. In addition, as a case where an overwritable instruction has not been accepted, it is an instruction that does not permit overwriting, or when no response is returned from the encryption device 103 for a certain period of time, but no overwritable instruction is accepted. Applicable.

  FIG. 9 is a flowchart of the biometric information authentication process. Similarly to the biometric information registration process, the biometric information authentication process is executed by the encryption device 103 and the authentication device 101. The encryption device 103 establishes an authentication session with the authentication device 101 (step S901). Specifically, the encryption apparatus 103 transmits an authentication session connection request to the authentication apparatus 101 and waits for a response from the authentication apparatus 101. Upon receiving the authentication session connection request, the authentication device 101 establishes an authentication session with the encryption device 103 (step S902).

  After the authentication session is established, the encryption apparatus 103 acquires the biometric information M′i from the token reading device 107, the user identifier Ui, and the public key pki from the token device 104 (step S903). At this time, the token device 104 determines to perform encryption by homomorphic encryption from the message data that is an acquisition request from the encryption device 103, and transmits the public key pki. After the acquisition, the encryption device 103 uses the public key to calculate encryption information Epki (M′i) based on homomorphic encryption (step S904). After the calculation, the encryption device 103 transmits Ui, pki, Epki (M′i) to the authentication device 101 (step S905). After the transmission, the encryption device 103 waits for a response from the authentication device 101.

  Next, the authentication apparatus 101 receives the identifier Ui, the public key pki, and the encryption information Epki (M′i) from the encryption apparatus 103 (step S906). Using the received identifier Ui, the authentication apparatus 101 searches for a record having a user identifier field Ui in the encrypted biometric information table 108 (step S907). When the retrieved record exists (step S907: Yes), the authentication apparatus 101 selects the existing record (step S908). If it does not exist (step S907: No), the authentication apparatus 101 transmits “NG” to the encryption apparatus 103 (step S913).

  After selecting the record, the authentication apparatus 101 confirms whether the received pki matches the pki of the selected record (step S909). If they do not match (step S909: No), the authentication apparatus 101 proceeds to the process of step S913. If they match (step S909: Yes), the authentication apparatus 101 calculates F (pki, Epki (Mi), Epki (M'i)) (step S910). After the calculation, the authentication apparatus 101 confirms whether the calculation result matches Epki (OK) (step S911). If they do not match (step S911: No), the authentication apparatus 101 proceeds to the process of step S913. If they match (step S911: Yes), the authentication apparatus 101 transmits “OK” to the encryption apparatus 103 (step S912).

  The encryption apparatus 103 that has received “OK” or “NG” confirms whether or not the received content is “OK” (step S914). When the received content is “OK” (step S914: Yes), the encryption apparatus 103 permits the user Ui to access the service 102 (step S915). When the access is permitted or the received content is not “OK” (step S914: No), the encryption device 103 ends the authentication session with the authentication device 101 (step S916). The authentication apparatus 101 also accepts the end of the authentication session from the encryption apparatus 103, and ends the authentication session with the encryption apparatus 103 (step S917).

  FIG. 10 is a flowchart showing a process when the biometric information encrypted by the biometric authentication process has randomness. As a previous step of the flowchart illustrated in FIG. 10, when the biometric information encrypted by the biometric authentication process has randomness, the encryption apparatus 103 performs biometric information M ′ that becomes plaintext in the process of step S <b> 904. i is encrypted with randomness. Subsequently, in step S911, the encrypted authentication result that is the calculation result is transmitted to the encryption apparatus 103 without confirming whether the calculation result matches Epki (OK).

  In the flowchart illustrated in FIG. 10, the token device 104 is verified. The processing shown in steps S1001 to S1008 is verification processing of the token device 104, and the processing shown in steps S1009 to S1015 is decryption processing of the encrypted authentication result. Further, the flowchart shown in FIG. 10 is executed in place of steps S914 and S915.

  After receiving the encrypted authentication result, the encryption apparatus 103 generates an arbitrary value, sets it as a signature target (step S1001), and transmits the signature target to the token device 104 (step S1002). The token device 104 generates a key pair (pki ″, ski ″) that is different from the key pair (pki, ski) used in the biometric authentication process, and performs a signature. The token device 104 receives the signature target (step S1003), and generates an electronic signature with the secret key ski '' (step S1004). After the generation, the token device 104 transmits the generated electronic signature to the encryption device 103 (step S1005). After the transmission, the token device 104 waits until there is a response from the encryption device 103.

  The encryption apparatus 103 receives the electronic signature (step S1006), and verifies the received electronic signature with the public key pki '' (step S1007). The encryption device 103 confirms whether the validity of the electronic signature has been verified (step S1008). When the validity can be verified (step S1008: Yes), the encryption apparatus 103 transmits the encrypted authentication result to the token device 104 (step S1009). When the validity cannot be verified (step S1008: No), the encryption apparatus 103 does not allow the user Ui to access the service 102, and proceeds to the process of step S916.

  Next, the token device 104 receives the encrypted authentication result transmitted from the encryption device 103 (step S1010). After reception, the token device 104 decrypts the received authentication result with the secret key ski (step S1011). After the decryption, the token device 104 transmits the decrypted authentication result to the encryption device 103 (step S1012).

  The encryption device 103 receives the decrypted authentication result (step S1013), and determines whether the authentication is successful based on the authentication result (step S1014). If it is determined that the authentication is successful (step S1014: Yes), the encryption apparatus 103 permits the user Ui to access the service 102 (step S1015), and the process proceeds to step S916.

  If it is determined that the authentication has failed (step S1014: No), the encryption apparatus 103 does not allow the user Ui to access the service 102 and proceeds to the process of step S916. Even when there is no response from the token device 104 and a time-out occurs and the authentication result cannot be determined, the encryption apparatus 103 proceeds to step S1014: No.

  In the flowchart illustrated in FIG. 10, steps S914 and S915 are executed in substitution. However, for example, the encryption apparatus 103 performs the verification process shown in steps S1001 to S1008 before the process of step S903. If the verification process fails, the encryption apparatus 103 may end without executing the process of step S903. Good. Further, the encryption apparatus 103 may perform the verification process shown in steps S1001 to S1008 after step S1014: Yes.

  As described above, the authentication device, the authentication method, and the authentication program receive the user's public key, identification information, and biometric information encrypted by homomorphic encryption, and store them in the database from the received identification information. Retrieve the public key and the encrypted biometric information. After the search, the authentication device performs authentication using the searched biometric information, the received public key, and the encrypted biometric information. As a result, the authentication apparatus can authenticate the encrypted information using the homomorphic encryption, and the secret key does not have to be taken out. Accordingly, it is possible to prevent the secret key from being leaked and thus the user's biometric information from being leaked.

  Further, when receiving the user update instruction, the authentication device may update the encrypted biometric information and the public key corresponding to the user identification information stored in the database. Thereby, even when the encrypted biometric information is leaked, the old encrypted biometric information is canceled and the new encrypted biometric information is registered, thereby preventing the spoofed by the leaked encrypted biometric information.

  The public key stored in the authentication device may be a public key acquired by the encryption device from a token device that stores the user identification information and a combination of the public key and the private key. As a result, since the public key stored in the authentication device is a public key paired with a secret key that does not leak, the encrypted biometric information is not decrypted and the user's biometric information leaks out. Can be eliminated.

  Also, the encryption device acquires the identification information and the public key, encrypts the biometric information with the homomorphic encryption using the public key, and transmits it to the authentication device. As a result, the authentication apparatus can authenticate the encrypted information using the homomorphic encryption, and the secret key does not have to be taken out. Accordingly, it is possible to prevent the secret key from being leaked and thus the user's biometric information from being leaked.

  In addition, the encryption apparatus may newly generate a public key and a secret key in the token device, and may encrypt the biometric information using the generated public key. Thereby, even if the encrypted biometric information is leaked and leaked, it is possible to prevent spoofing by the leaked encrypted biometric information by re-registering the biometric information encrypted with the new public key. .

  In addition, the encryption device may perform encryption using homomorphic encryption with randomness when encrypting biometric information. As a result, the biometric information of the user can be prevented from leaking, and even when the biometric information is the same at the time of authentication, a different ciphertext is always output, so that the plaintext that is biometric information is identified. Can be reduced. Further, the electronic signature may be generated for the token device, and the encryption apparatus may verify the electronic signature. This prevents spoofing of the token device.

  Further, according to the token device described above, the identification information is stored, the combination of the public key and the private key is generated, and it is determined that the encryption by the homomorphic encryption is requested, the identification information and the public key Send. As a result, if encryption is performed using homomorphic encryption, the secret key is not required to be released to the outside, the secret key is not leaked, and the user's biometric information is not leaked.

  In the present embodiment, the encryption device and the token device are separate devices. However, the encryption device and the token device may be integrated. Specifically, for example, in a personal computer equipped with a fingerprint reader, a key pair may be generated and a public / private key pair may be stored on a hard disk.

  Note that the encryption method described in this embodiment can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. The encryption program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, and a DVD, and is executed by being read from the recording medium by the computer. The encryption program may be distributed via a network such as the Internet.

  The following additional notes are disclosed with respect to the embodiment described above.

(Supplementary Note 1) An authentication device that receives and authenticates encryption information by homomorphic encryption from an encryption device,
Receiving means for receiving biometric information encrypted by homomorphic encryption using a user's public key, the user's identification information, and the user's public key from the encryption device;
The arbitrary user identification information, the arbitrary user's biometric information encrypted by homomorphic encryption using the arbitrary user's public key, and the arbitrary user's public key Search means for searching the public key and encrypted biometric information stored in the database based on the identification information received by the receiving means from the database stored in association with each user
An execution unit that authenticates the user based on the searched public key and encrypted biometric information, and the received public key and encrypted biometric information;
An authentication device comprising:

(Supplementary Note 2) Update information of the user's biometric information encrypted by homomorphic encryption using the public key of the user and the public key, the identification information of the user, and an update instruction from the encryption device The authentication according to claim 1, further comprising update means for updating the encrypted biometric information corresponding to the identification information of the user stored in the database and the public key when receiving apparatus.

(Supplementary Note 3) The public key of the user is a public key acquired by the encryption apparatus from a token device that stores the identification information of the user and a combination of a public key and a private key. The authentication device according to appendix 1 or 2.

(Appendix 4) An encryption device that can communicate with an authentication device that can authenticate encrypted information by homomorphic encryption and update the encrypted information,
Obtaining means for obtaining the identification information and the public key from a token device that stores the identification information of the user and a combination of a public key and a secret key;
An encryption means for encrypting the biometric information of the user by the homomorphic encryption with the public key acquired by the acquisition means;
Transmitting means for transmitting the identification information, the public key, and the biometric information encrypted by the encryption means to the authentication device;
An encryption device comprising:

(Additional remark 5) It is further provided with the production | generation instruction | indication means which instruct | indicates the production | generation of the combination of the public key and secret key different from the combination of the said public key and the said secret key to the said token device,
The acquisition means includes
The encryption apparatus according to appendix 4, wherein the identification information and the public key generated by the generation instruction unit are acquired from the token device.

(Additional remark 6) Based on an authentication result, the judgment means which judges whether authentication was successful,
Receiving means for receiving an authentication result encrypted by the homomorphic encryption from the authentication device;
Decryption instruction means for instructing the token device to decrypt the authentication result encrypted with the secret key,
The encryption means includes
With the public key read by the acquisition means, the biometric information of the user is encrypted with a homomorphic encryption having randomness among the homomorphic encryption,
The acquisition means includes
Obtaining an authentication result decrypted by the decryption instruction means from the token device;
The determination means includes
The encryption apparatus according to appendix 4 or 5, wherein the authentication result decrypted by the obtaining unit is obtained, and whether or not the authentication is successful is determined based on the decrypted authentication result.

(Appendix 7) Signature verification means for verifying the validity of an electronic signature;
The token device has a signature private key and a signature public key that are different from a combination of a secret key and a public key obtained by encrypting the biometric information by the encryption unit. Signature generation instruction means for instructing generation of an electronic signature for the value,
The acquisition means includes
Obtaining an electronic signature for the arbitrary value generated by the signature generation instruction means from the token device;
The signature verification means includes
The electronic signature for an arbitrary value generated by the acquisition unit is acquired, and the electronic signature for the arbitrary value is verified with the public key for the signature. The encryption device described.

(Supplementary Note 8) Storage means for storing user identification information;
Generating means for generating a combination of a public key and a private key;
A determination means for determining whether or not encryption by homomorphic encryption is requested;
A transmission means for transmitting the identification information stored by the storage means and the public key generated by the generation means to the request source when it is determined by the determination means that encryption by homomorphic encryption is requested;
A token device comprising:

(Supplementary Note 9) An authentication method executed by the authentication device by receiving the encryption information by the homomorphic encryption from the encryption device,
Receiving from the encryption device biometric information encrypted by homomorphic encryption using a user's public key, the user's identification information, and the user's public key;
The arbitrary user identification information, the arbitrary user's biometric information encrypted by homomorphic encryption using the arbitrary user's public key, and the arbitrary user's public key Searching a public key stored in the database and encrypted biometric information based on the received identification information from a database stored in association with each user of
Authenticating the user based on the retrieved public key and encrypted biometric information, and the received public key and encrypted biometric information;
The authentication method executes the authentication.

(Supplementary Note 10) A computer functioning as an authentication apparatus that receives encrypted information by homomorphic encryption from an encryption apparatus and performs authentication,
Receiving from the encryption device biometric information encrypted by homomorphic encryption using a user's public key, the user's identification information, and the user's public key;
The arbitrary user identification information, the arbitrary user's biometric information encrypted by homomorphic encryption using the arbitrary user's public key, and the arbitrary user's public key Searching a public key stored in the database and encrypted biometric information based on the received identification information from a database stored in association with each user of
Authenticating the user based on the retrieved public key and encrypted biometric information, and the received public key and encrypted biometric information;
An authentication program characterized by causing

DESCRIPTION OF SYMBOLS 100 Authentication system 101 Authentication apparatus 103 Encryption apparatus 104 Token device 108 Encrypted biometric information table 301 Acquisition part 302 Encryption part 303 Transmission part 304 Reception part 305 Search part 306 Execution part 307 Reception part 308 Generation instruction part 309 Generation part 310 Transmission Unit 311 update unit 312 decryption instruction unit 313 acquisition unit 314 decryption unit 315 determination unit 316 signature generation instruction unit 317 signature generation unit 318 signature verification unit 319 storage unit 320 determination unit

Claims (8)

An authentication device for receiving and authenticating encryption information by homomorphic encryption from an encryption device,
Receiving means for receiving biometric information encrypted by homomorphic encryption using a user's public key, the user's identification information, and the user's public key from the encryption device;
Wherein the identification information of a plurality of users, and the encrypted plurality of user biometric information by the plurality of users homomorphic encryption using the public key of a public key of said plurality of users plurality from a database that stores the user's respective association with the user, based on the received identification information by said receiving means, retrieves the public key and the encrypted biometric information stored in the database Search means;
When a public key and two pieces of biometric information encrypted with the public key are input, a value indicating success or failure of authentication is output to a function that outputs a value encrypted using the public key. And a value obtained by inputting the encrypted biometric information received from the encryption device and the encrypted biometric information stored in the database, and a value indicating the success or failure of the authentication An execution unit for authenticating the user based on a comparison result with a value encrypted using the public key of the user;
An authentication device comprising:   When receiving the update information of the user's biometric information, the user's identification information, and the update instruction encrypted by homomorphic encryption using the user's public key and the public key from the encryption device, The authentication apparatus according to claim 1, further comprising updating means for updating encrypted biometric information and public key corresponding to the user identification information stored in the database.   The public key of the user is a public key acquired by the encryption device from a token device that stores the identification information of the user and a combination of a public key and a secret key. 2. The authentication device according to 2. The first encryption information to be authenticated encrypted by the homomorphic encryption using the public key and the public key, and the second encrypted by the homomorphic encryption stored in the database using the public key When the encryption information is input, the output result of the function that outputs the value indicating the success or failure of the authentication using the public key, and the value indicating the success or failure of the authentication uses the public key. An encryption device capable of communicating with an authentication device capable of authenticating based on a comparison result with the encrypted value and updating the second encrypted information,
From the token device that stores the identification information of the user and the combination of public and private keys of the user of said user, an acquisition unit for acquiring the public key of the user identification information of the user,
Encrypting means for encrypting the biometric information of the user by the homomorphic encryption with the public key of the user acquired by the acquiring means;
Transmitting means for transmitting the identification information of the user, the public key of the user, and biometric information encrypted by the encryption means to the authentication device;
An encryption device comprising: Signature verification means for verifying the validity of the electronic signature;
Either the secret key for signature or the public key for signature, which is different from the combination of the secret key and the public key obtained by encrypting the biometric information by the encryption unit, is selected according to the secret key for signature . a signature generation instruction means for instructing the generation of the digital signature for the value,
Further comprising a,
The acquisition means includes
Obtaining an electronic signature for any of the values generated by the signature generation instruction means from the token device;
The signature verification means includes
Obtains the electronic signature for one of the values generated by the acquisition unit, the encryption according to the electronic signature for said one of the values to claim 4, characterized in that the verification by the public key for the signature apparatus. The first encryption information to be authenticated encrypted by the homomorphic encryption using the public key and the public key, and the second encrypted by the homomorphic encryption stored in the database using the public key When the encryption information is input, the output result of the function that outputs the value indicating the success or failure of the authentication using the public key, and the value indicating the success or failure of the authentication uses the public key. A token device that can communicate with an encryption device that can communicate with an authentication device that authenticates based on a comparison result with an encrypted value,
Storage means for storing user identification information;
Generating means for generating a combination of the user 's public key and the user's private key;
Determining means for determining whether or not encryption by the homomorphic encryption is requested from the encryption device ;
When it is determined by the determination means that encryption by homomorphic encryption is requested, the identification information stored by the storage means and the user's public key generated by the generation means are transmitted to the encryption device . A transmission means;
A token device comprising: An authentication method for receiving encrypted information by homomorphic encryption from an encryption device and executed by the authentication device,
Receiving from the encryption device biometric information encrypted by homomorphic encryption using a user's public key, the user's identification information, and the user's public key;
Wherein the identification information of a plurality of users, and the encrypted plurality of user biometric information by the plurality of users homomorphic encryption using the public key of a public key of said plurality of users plurality Searching a public key stored in the database and encrypted biometric information based on the received identification information from a database stored in association with each of the users of
When a public key and two pieces of biometric information encrypted with the public key are input, a value indicating success or failure of authentication is output to a function that outputs a value encrypted using the public key. And a value obtained by inputting the encrypted biometric information received from the encryption device and the encrypted biometric information stored in the database, and a value indicating the success or failure of the authentication Authenticating the user based on a comparison result with a value encrypted using the user's public key ;
The authentication method executes the authentication. The computer functioning as an authentication device that receives encrypted information by homomorphic encryption from the encryption device and performs authentication,
Receiving from the encryption device biometric information encrypted by homomorphic encryption using a user's public key, the user's identification information, and the user's public key;
Wherein the identification information of a plurality of users, and the encrypted plurality of user biometric information by the plurality of users homomorphic encryption using the public key of a public key of said plurality of users plurality Searching a public key stored in the database and encrypted biometric information based on the received identification information from a database stored in association with each of the users of
When a public key and two pieces of biometric information encrypted with the public key are input, a value indicating success or failure of authentication is output to a function that outputs a value encrypted using the public key. And a value obtained by inputting the encrypted biometric information received from the encryption device and the encrypted biometric information stored in the database, and a value indicating the success or failure of the authentication Authenticating the user based on a comparison result with a value encrypted using the user's public key ;
An authentication program characterized by causing

Images