JP5813282B2 - Information collation apparatus, information collation method and program - Google Patents

Description

  The present invention relates to an information collation apparatus, an information collation method, and a program that collate a plurality of input information.

  In recent years, biometric authentication for authenticating a person by using the characteristics of a person's body such as the shape of a face, fingerprint, voiceprint, iris, and vein has become widespread. In biometric authentication, it is necessary to store in advance biometric information, which is information indicating the characteristics of a human body as described above, in an authentication device that performs authentication.

  If the biometric information stored in the authentication device or the like is leaked even once, it cannot be changed like a password even if the fact is discovered. In this case, not only a security problem such as an increased risk of impersonation occurs, but also a privacy problem occurs.

  In recent years, attention has been focused on a method of performing data mining by mutually disclosing customer information held by each of a plurality of companies. Data mining is a method of analyzing a large amount of information using various statistical analysis methods to find out the meaning of information and the relationship between information.

  When performing data mining, if customer information of each of a plurality of companies is disclosed as it is, there is a possibility that the customer information of the company will be leaked to the outside. If your company's customer information is leaked outside, your company's social credibility will be lost.

  Therefore, a technique for performing calculation to obtain a processing result such as a biometric authentication result or a data mining result while concealing information such as biometric information and customer information is required. It is disclosed in Non-Patent Documents 1-5.

  Non-Patent Documents 2 to 5 propose a method in which a certain numerical value is encrypted and an arbitrary or specific calculation can be executed without revealing the numerical value. Hereinafter, computing the information in such a concealed state in the concealed state is referred to as concealment calculation. As biometric authentication using this method, a method is known in which biometric authentication is performed by encrypting stored biometric information or biometric information input when collating, and executing a secret calculation without decrypting the biometric information. ing.

  Further, the technique disclosed in Non-Patent Document 1 generates ID (Identification) that makes it difficult to restore the biological information from the biological information by a statistical AD (Analog Digital) conversion approach. Then, biometric authentication is performed based on whether or not the ID of the stored biometric information corresponds to the ID of the biometric information input when collating.

Shibata et al. Consideration on improvement of statistical AD conversion using Fuzzy Commitment (Part 2), SCIS2006. R. Agrawal, A. Ev_mievski, and R. Srikant, Information sharing across private databases, ACM SIGMOD 2003, pp.86-97, 2003. R. Nojima and Y. Kadobayashi, On the construction of the set-intersection protocol from blind signatures, IEICE Technical Report, ISEC2008-9 (2008-5), pp. 57-60, 2008. M. J. Freedman, K. Nissim, and B. Pinkas, Efficient private matching and set intersection, EUROCRYPT 2004, LNCS 3027, pp. 1-19, Springer-Verlag, 2004. B. Schoenmakers and P. Tuyls, "Practical two-party computation based on the conditional gate," ASIACRYPT 2004, LNCS3329, pp. 119-136, Springer-Verlag, 2004.

  Here, consider the case of performing biometric authentication based on the shape of a face for the purpose of managing entry into an office. In this case, if the company has a large number of employees, a lot of face shape information is stored in the authentication device or the like. If it is not known in advance which of the stored face shape information the feature points of the face shape information input at the time of collation correspond to each of the stored face shape information, It is necessary to collate with the face shape information.

  Also, in data mining, it is necessary to collate a large amount of information in order to find out the meaning of information and the relationship between information.

  The secret calculation disclosed in Non-Patent Documents 2 to 5 requires a large amount of calculation compared to normal calculation. Therefore, there is a problem that it takes a very long time to collate a lot of information.

  In addition, verification of biometric information using an ID generated by a statistical AD conversion approach disclosed in Non-Patent Document 1 is inferior in accuracy of verification compared to verification of normal biometric information that does not use an ID. There is a point.

  An object of the present invention is to provide an information collation apparatus, an information collation method, and a program capable of collating information efficiently and with high accuracy while keeping information secret.

In order to achieve the above object, the information collating apparatus of the present invention
Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information A device,
Generating verification target identification information for identifying the received verification target information, generating a plurality of comparison target identification information for identifying each of the received plurality of comparison target information, and comparing the verification target identification information with a plurality of comparisons While the target identification information is kept secret, comparison target identification information that matches the verification target identification information is extracted from the plurality of comparison target identification information, and is identified by the extracted comparison target identification information The comparison target information and the verification target information are verified while the comparison target information and the received verification target information are kept secret.

In order to achieve the above object, the information collation method of the present invention includes:
Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information An information verification method in a device,
A process of generating verification target identification information for identifying the received verification target information and generating a plurality of comparison target identification information for identifying each of the received plurality of comparison target information;
The comparison target identification information that matches the comparison target identification information is extracted from the plurality of comparison target identification information while the comparison target identification information and the plurality of comparison target identification information are kept secret, and the extracted The comparison target information identified by the comparison target identification information and the collation processing for collating the comparison target information and the verification target information while keeping the received verification target information in a concealed state.

In order to achieve the above object, the program of the present invention
Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information To the device,
A function of generating the comparison target identification information for identifying the received verification target information and generating a plurality of comparison target identification information for identifying each of the received plurality of comparison target information;
The comparison target identification information that matches the comparison target identification information is extracted from the plurality of comparison target identification information while the comparison target identification information and the plurality of comparison target identification information are kept secret, and the extracted A comparison function for comparing the comparison target information with the comparison target information while realizing the comparison target information identified by the comparison target identification information and the received verification target information in a secret state is realized.

  According to the present invention, the information collation apparatus receives input of collation target information that is a collation target and a plurality of pieces of comparison target information that is a collation target information. Then, the information matching device generates matching target identification information for identifying the received matching target information, and also generates a plurality of comparison target identification information for identifying each of the received plurality of comparison target information. Then, the comparison target identification information that matches the verification target identification information is extracted from the plurality of comparison target identification information while keeping the verification target identification information and the plurality of comparison target identification information in a concealed state, and the extracted comparison target While comparing the comparison target information identified by the identification information with the received verification target information, the comparison target information and the verification target information are verified.

  In this way, by using the verification target identification information and the comparison target identification information, the number of comparison target information to be verified with the verification target information is narrowed down. This eliminates the need to collate collation target information with all comparison target information. In addition, since the narrowed comparison target information and the verification target information are collated, it is possible to sufficiently ensure the accuracy of the collation.

  Therefore, it is possible to collate information efficiently and with high accuracy while keeping the information secret.

It is a block diagram which shows the structure of 1st Embodiment of the information collation apparatus of this invention. It is a flowchart for demonstrating the operation | movement which collates information in the information collation apparatus shown in FIG. It is a block diagram which shows the structure of 2nd Embodiment of the information collation apparatus of this invention. It is a flowchart for demonstrating the operation | movement which collates information in the information collation apparatus shown in FIG. It is a block diagram which shows an example of a structure of the biometric information collation apparatus to which the information collation apparatus of this invention is applied. It is a flowchart for demonstrating an example of operation | movement of the biometric information collation apparatus shown in FIG. 5, (a) is a flowchart for demonstrating the operation | movement in a registration phase, (b) is for demonstrating the operation | movement in a collation phase. It is a flowchart. 6 is a flowchart for explaining another example of the operation of the biometric information collating apparatus shown in FIG. 5, (a) is a flowchart for explaining the operation in the registration phase, and (b) is for explaining the operation in the collation phase. It is a flowchart for.

  Embodiments of the present invention will be described below with reference to the drawings.

(First embodiment)
FIG. 1 is a block diagram showing the configuration of the first embodiment of the information collating apparatus of the present invention.

As shown in FIG. 1, the information matching apparatus 10 according to the present embodiment includes a computing device 11-1 that receives input of matching target information VI that is a target of matching, and a plurality of comparisons that are targets to be matched with the matching target information VI. And a calculation device 11-2 that receives input of the target information BI _i .

  First, an overview of the functions of the computing devices 11-1 and 11-2 shown in FIG. 1 will be described.

The calculation devices 11-1 and 11-2 have a function of calculating functions f, g1, and g2 such that f (VI, BI _i ) = 1 with high probability if g1 (VI) = g2 (BI _i ). Have. Specifically, the calculation device 11-1 has a “g1 calculation function” for calculating g1, and the calculation device 11-2 has a “g2 calculation function” for calculating g2. Note that f (VI, BI _i ) = 1 means that collation between the collation target information VI and the comparison target information BI _i succeeds (that is, coincides). Here, g1 (VI) is collation target identification information that is information for identifying the collation target information VI, and g2 (BI _i ) is comparison target identification that is information for identifying each of the plurality of comparison target information BI _i. Information. Further, the computing devices 11-1 and 11-2 do not disclose the verification target identification information g1 (VI) and the plurality of comparison target identification information g2 (BI _i ) to each other, that is, the verification target identification information g1 (VI ), “Equal sign determination function” which is a function for obtaining _j satisfying g1 (VI) = g2 (BI _j ) while keeping a plurality of comparison target identification information g2 (BI _i ) in a concealed state. Further, the computing devices 11-1 and 11-2 have a “determination function” for determining whether or not f (VI, BI _i ) = 1.

  Next, the operation of the calculation devices 11-1 and 11-2 will be described.

  The calculation device 11-1 receives input of the verification target information VI, and generates verification target identification information g1 (VI) for identifying the received verification target information VI by the above-described g1 calculation function.

The calculation device 11-2 receives a plurality of pieces of comparison target information BI _i , and generates a plurality of pieces of comparison target identification information g2 (BI _i ) that respectively identify the plurality of pieces of comparison target information BI _i received by the above-described g2 calculation function. To do.

The calculation devices 11-1 and 11-2 perform the calculation by the above-described equal sign determination function while keeping the generated verification target identification information g1 (VI) and the plurality of comparison target identification information g2 (BI _i ) in a concealed state. Of the plurality of comparison target identification information g2 (BI _i ) generated by the device 11-2, the comparison target identification information g2 (matching with the verification target identification information g1 (VI) generated by the calculation device 11-1) BI _j ) is extracted. The computing device 11-1 and 11-2, by the above-mentioned determination function, the compared information BI _j identified by the extracted compared identification information g2 (BI _j), the computing device 11 has received verification The target information VI is collated. At this time, the computing devices 11-1 and 11-2 collate the comparison target information BI _j and the verification target information VI while keeping them secret.

  Below, the operation | movement which collates information in the information collation apparatus 10 comprised as mentioned above is demonstrated.

  FIG. 2 is a flowchart for explaining the operation of collating information in the information collating apparatus 10 shown in FIG.

First, the calculation device 11-1 receives input of the verification target information VI, and the calculation device 11-2 receives input of a plurality of comparison target information BI _i (step S1).

Next, the calculation device 11-1 generates collation target identification information g1 (VI) for identifying the received collation target information VI by the g1 calculation function described above, and the calculation device 11-2 includes the g2 calculation function described above. Thus, a plurality of pieces of comparison target identification information g2 (BI _i ) for identifying each of the received plurality of pieces of comparison target information BI _i is generated (step S2).

Next, the computing devices 11-1 and 11-2 have the equality determination function described above while keeping the generated verification target identification information g1 (VI) and the plurality of comparison target identification information g2 (BI _i ) in a concealed state. Thus, the comparison target identification that matches the verification target identification information g1 (VI) generated by the calculation device 11-1 among the plurality of comparison target identification information g2 (BI _i ) generated by the calculation device 11-2. Information g2 (BI _j ) is extracted (step S3).

The computing device 11-1 and 11-2, by the above-mentioned determination function, the compared information BI _j identified by the extracted compared identification information g2 (BI _j), the computing device 11 has received verification The target information VI is collated while the comparison target information BI _j and the collation target information VI are kept secret (step S4).

As described above, in the present embodiment, the information matching apparatus 10 receives input of the matching target information VI that is the target of matching and the plurality of comparison target information BI _i that is the target of matching with the matching target information VI. Then, the information matching apparatus 10 generates matching target identification information g1 (VI) for identifying the received matching target information VI, and a plurality of comparison target identification information for identifying each of the received plurality of comparison target information BI _i. g2 (BI _i ) is generated. Then, with the verification target identification information g1 (VI) and the plurality of comparison target identification information g2 (BI _i ) kept secret, the verification target identification information g1 (of the plurality of comparison target identification information g2 (BI _i )) extract the comparison identification information coincides with VI) g2 (BI _j), the compared information BI _j identified by the extracted compared identification information g2 (BI _j), and a collation target information VI accepted The comparison target information BI _j and the verification target information VI are verified in the confidential state.

  In this way, by using the verification target identification information and the comparison target identification information, the number of comparison target information to be verified with the verification target information is narrowed down. This eliminates the need to collate collation target information with all comparison target information. In addition, since the narrowed comparison target information and the verification target information are collated, it is possible to sufficiently ensure the accuracy of the collation.

  Therefore, it is possible to collate information efficiently and with high accuracy while keeping the information secret.

Here, when the information collation apparatus 10 of this embodiment is used for biometric authentication, for example, the biometric information of a plurality of persons registered in advance is set as BI _i (i = 1, 2,..., N), The biometric information of the person to be authenticated read at the time of authentication is VI. Then, it is checked whether or not BI _i matches with VI among a plurality of BI _i while keeping VI and BI _i in a concealed state.

When the information matching apparatus 10 of this embodiment is used for biometric authentication, the function f performs, for example, a distance calculation between VI and BI _i and returns 1 if the distance calculation result is less than or equal to a threshold value. A function that returns 0. The determination function is realized by using a method disclosed in Non-Patent Document 5, for example. Further, the g1 calculation function and the g2 calculation function are realized by using, for example, a statistical AD conversion approach disclosed in Non-Patent Document 1. Further, the equal sign determination function determines, for example, whether or not H (g1 (VI)) = H (g2 (BI _j )) using the hash function H.

  Here, the hash function is a function for summarizing a character string such as a document or a number into data of a certain length. A value output through this hash function is a hash value. Since the hash function is a one-way function, it is difficult to specify the original document or a character string such as a number from the hash value.

  In addition, the case where the information collation apparatus 10 of this embodiment is used for biometric authentication will be described in detail in third and fourth embodiments described later.

Further, when the information collating apparatus 10 of this embodiment is used for data mining, for example, VI and BI _i (i = 1, 2,..., N) are set as customer information.

When the information collating apparatus 10 of this embodiment is used for data mining, the function f performs, for example, a distance calculation between VI and BI _i and returns 1 if the result of the distance calculation is less than or equal to a threshold value. A function that returns 0. Then, while the VI and BI _i the secret state, extracts the BI _i where the distance between the VI is equal to or less than the threshold. The determination function is realized by using a method disclosed in Non-Patent Document 5, for example. In addition, the g1 calculation function and the g2 calculation function are realized by performing an operation for roughening customer information, for example. Specifically, for example, the operation is such that similar values are regarded as matching values by replacing the age of the customer with the age. Further, the equal sign determination function determines, for example, whether or not H (g1 (VI)) = H (g2 (BI _j )) using the hash function H.

Incidentally, in the equality determining function, g1 (VI) and g2 hash value _{(BI i) H (g1 (} VI)), the use of _{H (g2 (BI j))} , g1 (VI) and g2 (BI _i ) Can be estimated with a certain probability, or when the number of candidates is small, there is a risk that g1 (VI) and g2 (BI _i ) will be specified by dictionary attack or exhaustive search. For example, non-patent documents 2 to 4 disclose cryptographic application techniques for avoiding this, and by using these techniques, it is possible to avoid specifying g1 (VI) and g2 (BI _j ). That's fine.

(Second Embodiment)
In the present embodiment, as a more specific example of the first embodiment described above, a case will be described in which information is collated while information is kept secret by executing secret calculation using a multi-party protocol. .

  FIG. 3 is a block diagram showing the configuration of the second embodiment of the information collating apparatus of the present invention.

  As shown in FIG. 2, the information matching apparatus 50 according to the present embodiment includes calculation devices 51-1 and 51-2 that execute a secret calculation, and a secret processing device 52.

  Here, the secret calculation executed by the calculation devices 51-1 and 51-2 will be described.

  When executing a secret calculation, a multi-party protocol is usually used. Multi-party protocol, when given information in a certain secret state, by the cooperation of a plurality of computing devices of a certain number or more, the information in the secret state remains in the secret state, the calculation for the information Enable. For example, when the computing device A has a value x and the computing device B has a value y, the value y is concealed from the computing device A and the value x is concealed from the computing device B. The calculation device A and the calculation device B can cooperate to calculate the predetermined function f (x, y).

Referring to FIG. 3 again, the concealment processing device 52 receives input of the verification target information VI and a plurality of comparison target information BI _i . Then, the confidential verification target information E (VI) and the plurality of confidential comparison target information E (BI _i ) in which the received verification target information VI and the plurality of comparison target information BI _i are concealed in a format that can execute the confidential calculation. Is generated. Also, security processing unit 52 includes a check target information matching identifying the VI target identification information g1 accepted (VI), a plurality of comparison target identification information for identifying each of the plurality of comparison target information BI _i g2 (BI _i) And generate Furthermore, the confidential processing device 52 is configured to conceal each of the generated verification target identification information g1 (VI) and the plurality of comparison target identification information g2 (BI _i ) in a confidential state in a format that can execute a confidential calculation. Identification information E (g1 (VI)) and a plurality of secret comparison target identification information E (g2 (BI _i )) are generated. Then, the confidential processing device 52 associates the confidential verification target identification information E (g1 (VI)) with the confidential verification target information E (VI) and outputs the same to the calculation devices 51-1 and 51-2. In addition, the concealment processing device 52 associates each of the plurality of concealment comparison target identification information E (g2 (BI _i )) with each of the plurality of concealment comparison target information E (BI _i ). Output to 51-1 and 51-2.

The calculation devices 51-1 and 51-2 include the confidential verification target identification information E (g1 (VI)) and the confidential verification target information E (VI) output from the confidential processing device 52, and a plurality of confidential comparison target identification information E. (G2 (BI _i )) and a plurality of secret comparison target information E (BI _i ) are received. Then, the computing devices 51-1 and 51-2 execute the confidential calculation using the multi-party protocol, and thereby the confidential verification target information E (VI) from the received confidential verification target identification information E (g 1 (VI)). ) Is generated in correspondence with the first matching information. Further, the computing devices 51-1 and 51-2 execute a secret calculation using a multi-party protocol, thereby obtaining a plurality of secret comparisons from a plurality of accepted secret comparison target identification information E (g2 (BI _i )). A plurality of pieces of second matching information associated with each of the target information E (BI _i ) are generated. Then, the computing devices 51-1 and 51-2 extract second verification information that matches the generated first verification information from among the generated second verification information. That is, the calculation devices 51-1 and 51-2 extract second verification information that satisfies g 1 (VI) = g 2 (BI _i ). Then, the computing devices 51-1 and 51-2 convert the confidential comparison target information E (BI _j ) corresponding to the extracted second verification information and the received confidential verification target information E (VI) into a multi-party. Verify by performing a secret calculation using the protocol.

  Below, the operation | movement which collates information in the information collation apparatus 50 comprised as mentioned above is demonstrated.

  FIG. 4 is a flowchart for explaining the operation of collating information in the information collating apparatus 50 shown in FIG.

First, the concealment processing device 52 receives input of the verification target information VI and a plurality of comparison target information BI _i (step S11).

Next, the concealment processing device 52 conceals the received collation target information VI and the plurality of comparison target information BI _i in a concealed state in a form that can be performed by the concealment calculation. Object information E (BI _i ) is generated (step S12).

Next, the encryption processing unit 52 includes a check target identification information g1 identifying the check target information VI accepted (VI), a plurality of comparison target identification information for identifying each of the plurality of comparison target information BI _i g2 (BI _i ) Is generated (step S13).

Next, the concealment processing device 52 performs the concealment calculation on the generated collation target identification information g1 (VI) and the plurality of comparison target identification information g2 (BI _i ), and the cipher collation target identification information E in a concealed state. (G1 (VI)) and a plurality of secret comparison target identification information E (g2 (BI _i )) are generated (step S14).

Then, the confidential processing device 52 associates the generated confidential verification target identification information E (g1 (VI)) with the confidential verification target information E (VI), and outputs them to the calculation devices 51-1 and 51-2. At the same time, the concealment processing device 52 associates each of the plurality of concealment comparison target identification information E (g2 (BI _i )) with each of the plurality of concealment comparison target information E (BI _i ). 1 and 51-2.

The calculation devices 51-1 and 51-2 include the confidential verification target identification information E (g1 (VI)) and the confidential verification target information E (VI) output from the confidential processing device 52, and a plurality of confidential comparison target identification information E. (G2 (BI _i )) and a plurality of secret comparison target information E (BI _i ) are received.

  Next, the calculation devices 51-1 and 51-2 execute the secret calculation using the multi-party protocol, thereby from the received secret verification target identification information E (g 1 (VI)) to the secret verification target information E ( VI) associated with (VI) is generated (step S15).

Further, the calculation devices 51-1 and 51-2 execute a secret calculation using a multi-party protocol, and thereby, from each of a plurality of received secret comparison target identification information E (g2 (BI _i )), a plurality of A plurality of pieces of second verification information associated with each of the confidential comparison target information E (BI _i ) are generated (step S16).

  Next, the computing devices 51-1 and 51-2 extract second verification information that matches the generated first verification information from among the generated second verification information ( Step S17).

Then, the computing devices 51-1 and 51-2 multiply the confidential comparison target information E (BI _j ) corresponding to the extracted second verification information and the received confidential verification target identification information E (VI). Verification is performed by executing a secret calculation using a party protocol (step S18).

In the present embodiment, the confidential processing device 52 performs the confidential verification in which each of the verification target identification information g1 (VI) and the plurality of comparison target identification information g2 (BI _i ) is in a confidential state in a format that can execute the confidential calculation. Object identification information E (g1 (VI)) and a plurality of secret comparison object identification information E (g2 (BI _i )) were generated. Then, by executing the secret calculation from the secret verification target identification information E (g1 (VI)) and the plurality of secret comparison target identification information E (g2 (BI _i )), the first verification information and the plurality of second verification information 2 verification information was generated.

As described above, the first verification information and the second verification information are not generated from the confidential verification target identification information E (g1 (VI)) and the plurality of confidential comparison target identification information E (g2 (BI _i )). Alternatively, the first verification information and the plurality of second verification information may be generated from the verification target identification information g1 (VI) and the plurality of comparison target identification information g2 (BI _i ). However, in this case, there is a risk of the collation object identification information g1 (VI) and a plurality of comparison target identification information g2 (BI _i) will be identified.

Therefore, in this embodiment, the first verification information and the second verification information are obtained from the confidential verification target identification information E (g1 (VI)) and the plurality of confidential comparison target identification information E (g2 (BI _i )). Is generated.

In addition, when secret comparison object identification information E (g1 (VI)) and a plurality of secret comparison object identification information E (g2 (BI _i )) are generated, the equality determination function is disclosed in Non-Patent Documents 2 to 4, for example. What is necessary is just to implement | achieve by the method currently performed.

  In addition, in the present embodiment, the determination function may be realized by the method disclosed in Non-Patent Document 5, for example, if the determination function is kept secret by the method disclosed in Non-Patent Document 5.

(Third embodiment)
In the present embodiment, as a specific example of the information collating apparatus in the first and second embodiments described above, a biometric information collating apparatus that collates biometric information while keeping the biometric information secret will be described.

  FIG. 5 is a block diagram showing an example of the configuration of a biometric information matching apparatus to which the information matching apparatus of the present invention is applied.

  As shown in FIG. 5, the biometric information matching apparatus 100 of this embodiment includes calculation apparatuses 101-1 and 101-2, a biometric information reading apparatus 102 that is a confidential processing apparatus, and a database 103.

  The biometric information reader 102 accepts input of biometric information and puts the accepted biometric information in a concealed state. And ID which identifies the received biometric information is produced | generated.

  The database 103 stores n pieces of biometric information that is kept secret by the biometric information reader 102.

  The computing devices 101-1 and 101-2 execute a secret calculation.

  Below, operation | movement of the biometric information collation apparatus 100 comprised as mentioned above is demonstrated. Note that the operations performed by the biometric information collating apparatus 100 include a registration phase for storing biometric information, a biometric information for which input has been received, and a collation phase for collating stored biometric information.

  FIG. 6 is a flowchart for explaining an example of the operation of the biometric information collating apparatus 100 shown in FIG. 5, (a) is a flowchart for explaining the operation in the registration phase, and (b) is an operation in the collation phase. It is a flowchart for demonstrating.

  First, the operation in the registration phase will be described with reference to FIG.

The biometric information reading apparatus 102 accepts input of biometric information (step S21). The biometric information received here corresponds to the comparison target information BI _i in the first and second embodiments described above.

The biometric information reading apparatus 102 that has received the input of biometric information generates secret biometric information in which the received biometric information is concealed in a format that can be executed for secret computation (step S22). Hereinafter, the secret biometric information which is the biometric information made secret in the registration phase is referred to as RDi. Here, i is a serial number of a user where i = 1, 2,..., N. The secret biometric information RDi corresponds to the secret comparison target information E (BI _i ) in the second embodiment described above.

  Next, the biometric information reader 102 stores the secret biometric information RDi in the database 103 (step S23). That is, the biometric information of n users is stored in the database 103 in a secret state.

Next, the biometric information reading apparatus 102 generates IDi that is an ID for identifying the biometric information received in step S21. This IDi is generated by, for example, a statistical AD conversion approach disclosed in Non-Patent Document 1. IDi corresponds to the comparison target identification information g2 (BI _i ) in the first and second embodiments described above.

  Next, the biometric information reader 102 generates a hash value of IDi as a label of the secret biometric information RDi (step S24). Hereinafter, the hash value of IDi is expressed as Hash (IDi). Hash () indicates that processing is performed using a hash function. In this embodiment, Hash (IDi) corresponds to the second verification information in the second embodiment described above.

  Then, the biometric information reading apparatus 102 stores Hash (IDi) in the database 103 as the label of the secret biometric information RDi stored in the database 103 in step S23 (step S25).

  Here, the reason why IDi is processed by the hash function is to improve the level of concealing the received biometric information. If IDi is stored in the database 103 together with the secret biometric information RDi as a label of the secret biometric information RDi, the IDi can be acquired if there is an authority to access the database 103. On the other hand, by using Hash (IDi) as the label of the confidential biometric information RDi, it is difficult to specify IDi even if Hash (IDi) can be acquired.

  The above is the operation in the registration phase.

  Next, the operation in the collation phase will be described with reference to FIG.

  The biometric information reading apparatus 102 receives biometric information (step S31). The biometric information received here corresponds to the verification target information VI in the first and second embodiments described above.

  The biometric information reading apparatus 102 that has received the input of biometric information generates secret biometric information in which the received biometric information is kept in a concealed state in a format that can execute a secret calculation (step S32). Hereinafter, the secret biometric information which is the biometric information made secret in the verification phase is denoted as MDi. The secret biometric information MDi corresponds to the secret verification target information E (VI) in the second embodiment described above.

  Next, the biometric information reading apparatus 102 generates ID ′ that is an ID for identifying the biometric information received in step S31. Note that ID ′ corresponds to the verification target identification information g1 (VI) in the first and second embodiments described above. Furthermore, the biometric information reading apparatus 102 generates a hash value of the generated ID ′ (Step S33). Hereinafter, the hash value of ID ′ is expressed as Hash (ID ′). In this embodiment, Hash (ID ′) corresponds to the first verification information in the second embodiment described above.

  Then, the biometric information reading apparatus 102 outputs the secret biometric information MDi and Hash (ID ′) to the calculation apparatuses 101-1 and 101-2.

  The computing devices 101-1 and 101-2 that have received the confidential biometric information MDi and Hash (ID ′) output from the biometric information reader 102 have the same value as the received Hash (ID ′) as a label. Information RDi is searched from the database 103 (step S34).

  Then, the computing devices 101-1 and 101-2 execute the secret calculation using the multi-party protocol, thereby collating the searched secret biometric information RDi with the accepted secret biometric information MDi (step S35). . Then, the final authentication result is obtained.

  As a method for generating the ID, it is desirable to select a method in which IDi and ID ′ of the same user match with a sufficiently high probability. Conversely, IDi and ID ′ of different users may match with a probability that cannot be ignored. This is a requirement that should be rejected in biometric authentication, but in the present invention, IDi and ID ′ are not used for verification, but are used for searching information stored in the database 103. Because there is no problem.

  Note that the probability that IDi and ID ′ of the same user match and the probability that IDi and ID ′ of different users do not match generally have a trade-off relationship, but the former may be given priority in the present invention. .

  Further, there is no problem even if a plurality of Hash (IDi) that satisfy (Hash (IDi) = Hash (ID ′)) are searched. In that case, the secret calculation may be executed on the secret biometric information RDi having each of the searched Hash (IDi) as a label. That is, the present invention is sufficiently effective if the number of Hash (IDi) satisfying (Hash (IDi) = Hash (ID ′)) is sufficiently smaller than the number n of the secret biometric information RDi stored in the database 103. It is thought that.

  As described above, in the biometric information matching apparatus 100 according to the present embodiment, the biometric information reading apparatus 102 receives the biometric information and generates the secret biometric information in which the received biometric information is in a secret state in a format capable of performing the secret calculation. At the same time, an ID for identifying the received biological information is generated. Then, in the storage phase of storing the received biometric information, the biometric information reading apparatus 102 stores the generated hash value of the ID in the database 103 together with the generated secret biometric information as a label of the generated secret biometric information. Further, in the collation phase in which the received biometric information and the stored biometric information are collated, the calculation devices 101-1 and 101-2 use the secret biometric information with the same value as the hash value of the generated ID as the database 103. And the searched secret biometric information and the generated secret biometric information are collated by executing a secret calculation using a multi-party protocol.

  Therefore, biometric information can be collated efficiently and with high accuracy while keeping biometric information secret.

(Fourth embodiment)
In the third embodiment described above, a hash function is used to conceal IDi. However, as described above, when IDi can be estimated with a certain degree of probability, or when the number of candidates is small, there is a risk that IDi is specified by dictionary attack or exhaustive search. Therefore, in this embodiment, a case where such an attack is prevented will be described.

  In the present embodiment, the biometric information reading apparatus 102 sets the ID for identifying the received biometric information in a concealed state in a format that can execute concealment calculation. In addition, the computing devices 101-1 and 101-2 generate a hash value by executing a secret calculation using a multi-party protocol from the ID that is set in a secret state. This hash value becomes the label of the secret biometric information.

  Below, operation | movement of the biometric information collation apparatus 100 comprised as mentioned above is demonstrated. Here, as in the third embodiment described above, the registration phase and the verification phase will be described separately.

  FIG. 7 is a flowchart for explaining another example of the operation of the biometric information matching apparatus 100 shown in FIG. 5, (a) is a flowchart for explaining the operation in the registration phase, and (b) is the matching phase. It is a flowchart for demonstrating operation | movement in FIG.

  First, the operation in the registration phase will be described with reference to FIG.

  The biometric information reading apparatus 102 accepts input of biometric information (step S51).

  The biometric information reading apparatus 102 that has received the input of biometric information generates secret biometric information in which the received biometric information is kept in a concealed state in a format that can execute a secret calculation (step S52). Hereinafter, similarly to the above-described third embodiment, confidential biometric information that is biometric information concealed in the registration phase is denoted as RDi.

Next, the biological information reading apparatus 102 stores the confidential biological information RDi in the database 103 (step S53).
Next, the biometric information reading apparatus 102 generates IDi, which is an ID for identifying the biometric information received in step S51, and further generates a secret IDi obtained by concealing the generated IDi in a format that can execute a secret calculation. Generate (step S54). Then, the biological information reading apparatus 102 outputs the secret IDi to the calculation apparatuses 101-1 and 101-2. The secret IDi corresponds to the secret comparison target identification information E (g2 (BI _i )) in the second embodiment described above.

  The calculation devices 101-1 and 101-2 receive the confidential IDi output from the biological information reading device 102.

  Next, the computing devices 101-1 and 101-2 generate a hash value from the accepted secret IDi and the random numbers a and b by executing the secret calculation using the multi-party protocol (step S55). Hereinafter, the hash value generated from the secret IDi and the random numbers a and b is represented as Hash (IDi || a || b). The random number a is generated by the calculation device 101-1, and the random number b is generated by the calculation device 101-2. The symbol (x || y) represents the connection of data x and y. In this embodiment, Hash (IDi || a || b) corresponds to the second verification information in the second embodiment.

  Then, the computing devices 101-1 and 101-2 store the generated Hash (IDi || a || b) in the database 103 as the label of the confidential biometric information RDi stored in the database 103 in step S53. (Step S56).

  The above is the operation in the registration phase.

  Next, the operation in the collation phase will be described with reference to FIG.

  The biological information reading apparatus 102 receives input of biological information (step S61).

  The biometric information reading apparatus 102 that has received the input of biometric information generates secret biometric information in which the received biometric information is concealed in a format that can execute secret computation (step S62). Hereinafter, similarly to the third embodiment described above, the confidential biometric information that is the biometric information concealed in the verification phase is denoted as MDi.

  Next, the biometric information reading apparatus 102 generates ID ′, which is an ID for identifying the biometric information received in step S61, and concealed ID ′ in which the generated ID ′ is concealed in a format capable of performing concealment calculation. Is generated (step S63). The secret ID ′ corresponds to the secret verification target identification information E (g1 (VI)) in the second embodiment described above.

  Then, the biometric information reading device 102 outputs the secret ID ′ and the secret biometric information MDi to the calculation devices 101-1 and 101-2.

  The calculation devices 101-1 and 101-2 receive the secret ID ′ and the secret biometric information MDi output from the biometric information reading device 102.

  Next, the computing devices 101-1 and 101-2 generate a hash value from the received secret ID ′ and the random numbers a and b by executing the secret calculation using the multi-party protocol (step S64). Hereinafter, the hash value generated from the secret ID ′ and the random numbers a and b is expressed as Hash (ID ′ || a || b). In this embodiment, Hash (ID ′ || a || b) corresponds to the first verification information in the second embodiment described above.

  Then, the computing devices 101-1 and 101-2 retrieve the secret biometric information RDi having the same value as the generated Hash (ID ′ || a || b) from the database 103 (step S65).

  Then, the computing devices 101-1 and 101-2 execute the secret calculation using the multi-party protocol, thereby collating the searched secret biometric information RDi with the accepted secret biometric information MDi (step S66). . Then, the final authentication result is obtained.

  As described above, this embodiment is different from the third embodiment described above in that the label of the confidential biometric information RDi is changed from Hash (IDi) to Hash (IDi || a || b) and the change. It is that the secret calculation is executed so as to be possible. Even if IDi can be estimated by this change, it is difficult to identify IDi unless random numbers a and b are known.

  As described above, in this embodiment, even if the IDi of the secret biological information RDi can be estimated, it is difficult to specify the IDi unless the random numbers a and b are known. Therefore, it is possible to collate the biological information efficiently and with high accuracy while concealing the biological information more firmly.

  In the above-described first to fourth embodiments, the case where there are two computing devices has been described as an example. However, the number of computing devices is not limited to two, and the information kept in a secret state is not limited. The number of computing devices may be three or more according to the type of method for performing computation in the concealed state.

  In the present invention, the processing in the information collating apparatus records a program for realizing its function on a recording medium readable by the information collating apparatus, in addition to the process realized by the dedicated hardware described above. The program recorded on the recording medium may be read by the information collating device and executed. The recording medium readable by the information collating device refers to an HDD or the like built in the information collating device in addition to a transferable recording medium such as a flexible disk, a magneto-optical disk, a DVD, or a CD.

DESCRIPTION OF SYMBOLS 10,50 Information collation apparatus 11-1, 11-2, 51-1, 51-2, 101-1, 101-2 Calculation apparatus 52 Confidential processing apparatus 100 Biometric information collation apparatus 102 Biometric information reader 103 Database

Claims (9)

Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information A device,
A secret processing device that generates verification target identification information that identifies the received verification target information and generates a plurality of comparison target identification information that identifies each of the received plurality of comparison target information;
Computation means for performing a concealment calculation for calculating information in a concealed state in a concealed state, wherein the plurality of comparison targets are kept concealed with the collation target identification information and the plurality of comparison target identification information Among the identification information, the comparison target identification information that matches the verification target identification information is extracted, and the comparison target information identified by the extracted comparison target identification information and the received verification target information are kept secret. The calculation means for matching the comparison target information and the verification target information by calculation using a multi-party protocol,
An information collation apparatus having Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information A device,
A calculation means for executing a secret calculation for calculating information in a secret state in a secret state;
Secret collation target information that accepts input of the collation target information and the plurality of comparison target information, and that each of the received collation target information and the plurality of comparison target information is in a concealed state in a format capable of executing the cipher calculation; A confidential processing device that generates a plurality of pieces of confidential comparison target information and generates a plurality of pieces of comparison target identification information that identifies each of the received pieces of comparison target information and a plurality of pieces of comparison target identification information that identify the received pieces of comparison target information. And having
The cipher processing device generates first collation information associated with the cipher collation target information from the collation target identification information, and uses the plurality of cipher comparisons from each of the plurality of comparison target identification information. Generating a plurality of pieces of second matching information associated with each of the target information;
The calculation means includes second verification information that matches the first verification information generated by the confidential processing device among the plurality of second verification information generated by the confidential processing device. Extract and
An information matching device that collates the secret comparison target information associated with the extracted second matching information with the secret matching target information generated by the secret processing device by executing the secret calculation . Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information A device,
A calculation means for executing a secret calculation for calculating information in a secret state in a secret state;
Secret collation target information that accepts input of the collation target information and the plurality of comparison target information, and that each of the received collation target information and the plurality of comparison target information is in a concealed state in a format capable of executing the cipher calculation; A confidential processing device that generates a plurality of pieces of confidential comparison target information and generates a plurality of pieces of comparison target identification information that identifies each of the received pieces of comparison target information and a plurality of pieces of comparison target identification information that identify the received pieces of comparison target information. And having
The cipher processing device generates secret collation target identification information and plural secret comparison target identification information in which the collation target identification information and the plurality of comparison target identification information are concealed in a format capable of executing the cipher calculation. And
The calculation means generates a random number for generating verification information, and executes the secret calculation, so that each of the plurality of secret comparison target identification information generated by the secret processing device and the random number , After generating a plurality of second verification information associated with each of the plurality of secret comparison target information generated by the secret processing device, the secret verification target identification information generated by the secret processing device and The first verification information associated with the confidential comparison target information generated by the confidential processing device is generated from the random number , and the first verification information among the plurality of second verification information Second verification information that matches the information is extracted, the confidential comparison target information associated with the extracted second verification information, and the confidential verification target information generated by the confidential processing device; The secret calculation Information collating apparatus for collating by executing. Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information An information verification method in a device,
A process for generating a plurality of comparison target identification information for identifying each of the received plurality of comparison target information, while the confidential processing device generates the verification target identification information for identifying the received verification target information;
The plurality of comparison target identification information, wherein the calculation means for performing the secret calculation for calculating the confidential information in the secret state keeps the comparison target identification information and the plurality of comparison target identification information in a secret state. The comparison target identification information that matches the verification target identification information is extracted, and the comparison target information identified by the extracted comparison target identification information and the received verification target information are kept secret An information collation method comprising: collation processing for collating the comparison target information and the collation target information by calculation using a multi-party protocol. Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information An information verification method in a device,
A process for generating a plurality of comparison target identification information for identifying each of the received plurality of comparison target information, while the confidential processing device generates the verification target identification information for identifying the received verification target information;
A secret verification in which the confidential processing device is in a confidential state in a format capable of executing a confidential calculation for calculating the confidential information in the confidential state for each of the received verification target information and the plurality of comparison target information. Processing to generate target information and a plurality of confidential comparison target information;
The cipher processing device generates first collation information associated with the cipher collation target information from the collation target identification information, and the plurality of cipher comparisons from each of the plurality of comparison target identification information Processing for generating a plurality of pieces of second matching information associated with each of the target information;
A calculation means for executing a secret calculation for calculating information in a concealed state in a concealed state is a second collation that matches the first collation information among the plurality of second collation information. By extracting the information and executing the cipher calculation on the cipher comparison target information associated with the extracted second collation information and the cipher collation target information generated by the cipher processing device A matching process to match,
A method for collating information. Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information An information verification method in a device,
A process for generating a plurality of comparison target identification information for identifying each of the received plurality of comparison target information, while the confidential processing device generates the verification target identification information for identifying the received verification target information;
A secret verification in which the confidential processing device is in a confidential state in a format capable of executing a confidential calculation for calculating the confidential information in the confidential state for each of the received verification target information and the plurality of comparison target information. Processing to generate target information and a plurality of confidential comparison target information;
The cipher processing device generates secret collation target identification information and a plurality of secret comparison target identification information in which the collation target identification information and the plurality of comparison target identification information are concealed in a format capable of executing the cipher calculation. Processing to
The calculation means for executing the secret calculation for calculating the information in the secret state in the secret state generates a random number for generating the verification information, and executes the secret calculation with the secret processing device. Then, after generating a plurality of second verification information associated with each of the plurality of secret comparison target information from each of the plurality of secret comparison target identification information and the random number , the secret verification target identification A process of generating first verification information associated with the confidential comparison target information from the information and the random number ;
The calculation means extracts second collation information that matches the first collation information from the plurality of second collation information, and associates it with the extracted second collation information. Collation processing for collating the secret comparison target information and the secret collation target information by executing the cipher calculation;
A method for collating information. Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information The computers that make up the device,
A secret processing device that generates verification target identification information that identifies the received verification target information and generates a plurality of comparison target identification information that identifies each of the received plurality of comparison target information,
Computation means for performing a concealment calculation for calculating information in a concealed state in a concealed state, wherein the plurality of comparison targets are kept concealed with the collation target identification information and the plurality of comparison target identification information Among the identification information, the comparison target identification information that matches the verification target identification information is extracted, and the comparison target information identified by the extracted comparison target identification information and the received verification target information are kept secret. The calculation means for collating the comparison object information and the collation object information by calculation using a multi-party protocol,
Program to function as. Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information The computers that make up the device,
Concealment calculation for accepting input of the collation target information and the plurality of comparison target information, and calculating each of the accepted collation target information and the plurality of comparison target information while keeping the concealed information in a concealed state A secret collation target information and a plurality of secret comparison target information that are in a concealed form in an executable form are generated, and each of the collation target identification information for identifying the received collation target information and the received plurality of comparison target information A plurality of comparison target identification information to be identified is generated, and first verification information associated with the confidential verification target information is generated from the verification target identification information, and from each of the plurality of comparison target identification information A concealment processing device that generates a plurality of pieces of second verification information associated with each of the plurality of concealment comparison target information items,
Computation means for executing the concealment calculation, wherein the second collation information that matches the first collation information is extracted from the plurality of second collation information, and the extracted second Calculating means for comparing the secret comparison target information associated with the verification information and the secret verification target information by executing the secret calculation;
Program to function as. Information collation that accepts input of collation target information to be collated and a plurality of comparison target information to be collated with the collation target information, and collates the received collation target information with a plurality of comparison target information The computers that make up the device,
Concealment calculation for accepting input of the collation target information and the plurality of comparison target information, and calculating each of the accepted collation target information and the plurality of comparison target information while keeping the concealed information in a concealed state A secret collation target information and a plurality of secret comparison target information that are in a concealed form in an executable form are generated, and each of the collation target identification information for identifying the received collation target information and the received plurality of comparison target information A plurality of comparison target identification information to be identified is generated, and each of the comparison target identification information and the plurality of comparison target identification information is concealed in a form in which the secret calculation can be performed. A confidential processing device that generates comparison target identification information,
A calculation means for performing the concealment calculation generates a random number for generating collation information by executing a secret computation between said security processing unit, the plurality of concealing compared identification information from each and the random number, after generating a plurality of second collation information associated with each of the plurality of confidential comparison information from the confidential verification subject identification information and the random number, the secret verification subject information First matching information associated with the first matching information is extracted, and the second matching information that matches the first matching information is extracted from the plurality of second matching information, and is extracted. Calculation means for comparing the confidential comparison target information associated with the second verification information with the confidential verification target information generated by the confidential processing device by executing the confidential calculation,
Program to function as.

Images