KR100864330B1 - Data communication method and system, and computer readable recording medium - Google Patents

Abstract

The biometric data obtained by quantifying the biometric information of the user is transmitted from the terminal to the server, and the server authenticates the user using the biometric data. The user transmits the registration data of his own user and the similarity information of the communication partner to the terminal, and the terminal generates a secret key common with the communication partner from the user's own similarity information calculated from the registration data and the similarity information of the communication partner. Then, cryptographic communication is performed using the secret key.

Network, I / O Interface, Memory Control Interface

Description

DATA COMMUNICATION METHOD AND SYSTEM, AND COMPUTER READABLE RECORDING MEDIUM

The present invention relates to a communication method and system using a public key cryptography.

At present, as the processing capacity of information processing apparatuses such as personal computers is greatly improved, and the maintenance of communication infrastructures has progressed, opportunities for transmitting and receiving personal information, corporate information, and the like using networks such as the Internet are increasing. For this reason, security technologies that conceal these information and prevent leakage to third parties have become increasingly important.

As a general method for concealing transmission / reception data, a common key cryptography method for encrypting and decrypting the data using a common key between terminal devices transmitting and receiving data is well known. In recent years, public key infrastructure (PKI) has attracted attention with the expansion of electronic commerce such as B to B (Business to Business) and B to C (Business to Consumer) (for example, Japanese Patent Laid-Open No. 2001-216270). See publication number).

Public key cryptography, known as a basic technology of PKI, is a method of encrypting transmission data using a public key and decrypting received data using a non-public secret key paired with the public key. Since this public key cryptosystem uses different keys on the transmitting side and the receiving side, the security level is improved compared with the above-described common key cryptography system. However, since the public key cryptography method requires a relatively long time for data encryption and decryption processing, a common key cryptography method is generally suitable for data communication with a specific counterpart.

Moreover, in order to improve the confidentiality of the said public key or a secret key (PKI key), the technique which reads a user's fingerprint and encrypts the PKI key itself using the random number obtained from it, for example, Unexamined-Japanese-Patent No. 2001-357371. It is described in the publication.

In the common key cipher system described above, it is necessary to have a common key in both the terminal device on the sending side that encrypts the data and the terminal device on the receiving side that decrypts the data, so that a user who transmits data through the network is common in some way. The key needs to be distributed to the other party.

In recent data communication systems, the public key cryptography method is used as a means for more securely delivering a common key.

However, in the method of transmitting the common key by the public key cryptography method, even if encrypted, the common key itself flows on the network, so that the common key may be stolen by a malicious third party.

In addition, even when transmitting and receiving data using only the public key cryptography method, since the secret key must be distributed to the communication partner, the secret key may be stolen by a malicious third party when the secret key is distributed through the network. There is.

In other words, in the conventional data communication system, there is a problem that the risk of waterproofing the common key and the secret key must always be considered.

<Start of invention>

It is therefore an object of the present invention to provide a data communication method and system using a public key cryptography method that can improve the level of security by increasing the confidentiality of data transmitted and received using a network.

In order to achieve the above object, in the present invention, the user terminal device used by the user based on the biometric data is authenticated while authenticating the user who transmits and receives data using the biometric data obtained by quantifying the biometric information of the user. Generate the same secret key (common secret key).

Therefore, in the data communication method and system using the public key cryptography method of the present invention, it is not necessary to flow a common secret key on the network, thereby reducing the risk of secret key waterproofing on the network. In particular, since the biometric data has a different bit arrangement for each collection, the common secret key generated on the basis of the biometric data is also different every time, and has only the effect as a one-time key. The security level of the communication by the key encryption system is improved.

1 is a block diagram showing a configuration of a first embodiment of a data communication system of the present invention.

FIG. 2 is a block diagram showing an example of the configuration of the PKI server device shown in FIG. 1; FIG.

FIG. 3 is a block diagram showing another configuration example of the first user terminal device shown in FIG. 1; FIG.

Fig. 4 is a flowchart showing the processing procedure of the first embodiment of the data communication method of the present invention.

Fig. 5 is a flowchart showing the processing procedure of the second embodiment of the data communication method of the present invention.

Fig. 6 is a flowchart showing the processing procedure of the third embodiment of the data communication method of the present invention.

Fig. 7 is a flowchart showing the processing procedure of the fourth embodiment of the data communication method of the present invention.

<Best Mode for Carrying Out the Invention>

Next, the present invention will be described with reference to the drawings.

(First embodiment)

The data communication system of the first embodiment authenticates a user who transmits and receives data using biometric data obtained by quantifying biometric information of the user, such as a fingerprint, an iris, a vein, a handwriting, a signature, a shape of a hand or a face, Based on the biometric data, the user terminal devices used by the user generate the same secret key (common secret key), respectively, thereby realizing the public key cryptography method by the PKI without flowing the secret key on the network.

In general, the biometric data is not obtained exactly the same bit array for each collection, and whether or not the user is the user is the collected biometric data (hereinafter referred to as inquiry data) and previously registered biometric data (hereinafter referred to as registration). And data). Therefore, when the inquiry data of the bit array that is exactly the same as the inquiry data used in the past is used again, a malicious third party is likely to impersonate the user.

In this embodiment, by using the biometric data having such a property, each user terminal device generates a common secret key which becomes a one-time key for each communication with a specific counterpart, thereby improving the concealment of the data to be transmitted and received.

1 is a block diagram showing the configuration of a first embodiment of a data communication system of the present invention, and FIG. 2 is a block diagram showing an example of the configuration of the PKI server device shown in FIG.

As shown in Fig. 1, the data communication system of the first embodiment includes a biometrics acquisition device for acquiring biometric data of the user, which is used by a user, for performing transmission and reception of data with each other. the user terminal device ₍₁₁₎ and second user terminal device _(12), a first user terminal device ₍₁₁₎ and the second biometrics registration data transmitted from the user terminal device _(12), biometric data, PKI server apparatus for transmitting and receiving encrypted data to and from each user terminal device using authentication of each user, validation of registration data or inquiry data used for authentication, and public key cryptography by PKI. ) Is a configuration having. The first user terminal device _(11), the second user terminal device ₍₁₂₎ and PKI server device 4 via the network 5 such as the Internet are connected to each other to enable communication. In addition, although FIG. 1 has shown the structure which one PKI server apparatus 4 is connected to the network 5, the PM server apparatus 4 implements the various functions mentioned later by a some server apparatus. It may be.

The PKI server device 4 is an information processing device such as a workstation server computer having a communication function for connecting to the network 5, for example, a service provider that manages the data communication system of the present invention, or It is managed by a third party, etc. who are entrusted with the operation of the company. In addition, the first user terminal device ₍₁₁₎ and second user terminal device _(12), the network 5, a personal computer, (Personal Digital (Data) Assistants) PDA with a communication function for connecting to, or An information processing device such as a mobile phone. The first user terminal device (1 ₁₎ is connected to a biometric data acquisition device ₍₂₁₎ for collecting the biometric data of the user, the second user terminal device ₍₁₂₎ is acquired biometric data devices ₍₂₂ ) Is connected.

As shown in FIG. 2, the PKI server device 4 includes a processing device 10 that executes processing according to a program, and an input device 20 for inputting commands, data, and the like to the processing device 10. And an output device 30 for monitoring the processing result of the processing device 10.

The processing device 10 includes a CPU 11, a main memory device 12 that temporarily holds data necessary for processing by the CPU 11, and a data storage device in which biometric data, PKI keys, etc. of each user are stored. (14), a recording medium 13 having a control program for causing the CPU 11 to execute the process of the present invention, a CPU 11, a main memory device 12, a recording medium 13, and a data storage device. A memory control interface 15 for controlling data transfer with the 14, an I / O interface 16 that is an interface device with the input device 20 and the output device 30, and for controlling communication via a network It is provided with the communication control apparatus 17 which is an interface, and these are the structures connected via the bus 18. As shown in FIG.

The processing apparatus 10 executes the process of the present invention described later in accordance with a control program recorded on the recording medium 13. The recording medium 13 may be a magnetic disk, a semiconductor memory, an optical disk, or other recording medium.

The first user terminal apparatus 1 ₁ and the second user terminal apparatus 1 ₂ are basically a PKI server apparatus except that the biometric data acquisition device is provided and the information stored in the data storage apparatus is different from each other. It is the same structure as (4). Therefore, detailed description of the configuration is omitted.

As it is shown in Figure 1, PKI server device 4, first user terminal device ₍₁₁₎ and the second user terminal device _(12), an authentication unit for performing user authentication processing using the received data from the (6) and a PKI processing unit (7) for transmitting and receiving data encrypted with each user terminal device using a public key cryptography method using a PKI, wherein the authentication unit (6) and the PKI processing unit (7) A function is realized by the processing apparatus 10. The data storage device 14 of the PKI server device 4 includes a biometrics database 6 _{1 in} which the biometric data of each user is registered and the unusable biometric whose validity is lost. A repository 7 ¹ in which a biometric data invalidation list 6 _{2 in} which matrix data is registered and a PKI public key used for data transmission and reception with each user terminal device used by the PKI processing unit 7 are stored. And a PKI secret key storage section 7 _{2 in} which the PKI secret key is stored.

As described above, the first user terminal device ₍₁₁₎ and second user terminal device _(12), the biometric data acquisition device (2 _1, 2 ₂₎ is connected for collecting the biometric data of the user For example, in the storage devices 3 ₁ and 3 _{2 in the} biometric data acquisition device, inquiry data, registration data, a PKI key used for data transmission and reception with a PKI server device, and data from a user terminal device as a communication partner. The common secret key etc. used at the time of reception are stored. In addition, the inquiry data, registration data, PKI keys and common secret key, the first user may be stored in the terminal device (1 ₁₎ and second user terminal device the data storage device ₍₁₂₎ has.

In addition, or may be built in 3, the biometric data acquisition device (2 _1, 2 _2), the first user terminal device ₍₁₁₎ and second user terminal device _(12). In that case, the inquiry data, the registration data, the PKI key and the common secret key may be stored in the storage device in the biometric data acquisition devices 2 ₁ and 2 ₂ (see FIG. 3A), and the first user terminal. may be stored in a device ₍₁₁₎ and second user terminal device _(12), the data storage device (8) having (see (b) in Fig. 3). Further, in Fig. 3 shows only modification of the first user terminal device _(11).

The inquiry data, registration data, PKI key, and common secret key may be, for example, an IC card, a hard disk device, a floppy disk, a CD (Compact Disk), a magneto-optical disk, a DVD (Digital Video Disk), or a USB (Universal Serial). Bus) memory, an SD memory card, a memory stick or the like may be stored in another external storage medium that can be connected to each user terminal device.

Here, the second user terminal device to the public key used when transmitting data to the first user terminal device ₍₁₁₎ for the user A to use from PKI server device 4 to the PKI public key A, and used by a user B The public key used for transmitting data to the (1 ₂ ) is the PKI public key B, and data is transmitted from the first user terminal device 1 ₁ and the second user terminal device 1 ₂ to the PKI server device 4. The public key used when transmitting is referred to as PKI public key S. Also, the secret key used at the time of decoding of the transmitted data to a first user terminal device ₍₁₁₎ for the user A to use from PKI server device 4 to the PKI secret key A and the user from PKI server device 4 a second user terminal device ₍₁₂₎ a secret key used at the time of decoding of the transmitted data in which B is used as the PKI secret key B, and first user terminal device ₍₁₁₎ and second user terminal device ₍₁₂ PKI secret key S is used as the secret key used for decoding the data transmitted to the PKI server apparatus 4).

Further, from the second user terminal device _(12), first user terminal device ₍₁₁₎ decrypts the secret key for use in a common secret key KA upon, and first user terminal device ₍₁₁₎ of the transmitted data in from the The secret key used at the time of decoding the data transmitted to the 2nd user terminal apparatus ₁₂ is set as common secret key KB.

Next, the processing procedure of the data communication method of the first embodiment shown in FIG. 1 will be described with reference to FIG.

4, the first embodiment, user A and user B before with the data transceiver, for example the second to the user B owns from the first user terminal device ₍₁₁₎ as a result of user A It transmits a creation request of the common secret key to the user terminal device ₍₁₂₎ (step A01). The second user terminal device _(12), the first user upon receipt of the write request of the terminal device, common secret key from (1 _{1), the} repair request to the first user terminal device ₍₁₁₎ as a result of user B Is conveyed (step A02).

Next, the first user terminal device _(11), using the biometric data acquisition device (21) as a result of user A, and harvesting the biometrics data of user A, the biometrics data (inquiry data) Ma Is stored in the predetermined storage device, and information of the user A and the communication partner (user B) is added to the PKI server device 4 (step A03). At this time, the 1st user terminal device ₁₁ may encrypt the data transmitted in order to conceal the inquiry data Ma of user A using PKI public key S. FIG.

Similarly, the second user terminal device ₍₁₂₎ the service the write request of the common secret key, using the biometric data acquisition device ₍₂₂₎ as a result of user B, and harvesting the biometrics data of user B, The biometric data (query data) Mb is stored in a predetermined storage device, and the information of the user B and the communication partner (user A) is added to the PKI server device 4 (step A04). At this time, the second user terminal device ₁₂ may encrypt the data transmitted to conceal the inquiry data Mb of the user B using the PKI public key S. FIG.

Judges whether or not the PKI server device 4, upon receiving the biometrics data of user A from first user terminal device (1 ₁₎ (step A05), the received data is first encrypted. If the received data is encrypted, the PKI server device 4 decrypts the received data using the PKI secret key S.

When the PKI server device 4 acquires the inquiry data Ma of the user A by decoding, the PKI server device 4 reads the registration data Ra of the user A registered in the biometrics database 6 _{1 in} advance, and compares it with the received inquiry data Ma. (Step A06), it is determined whether or not all bit arrays are the same (step A07).

If the registration data Ra and inquiry data Ma all of the same bit array, from a third party of the first data, that is, other than the user A is stolen on the past inquiry data Ma sent from the user terminal device ₍₁₁₎ as described above The access data is determined to be stored in the biometric data invalidation list 6 ₂ (Step A08). When the registration data Ra and the inquiry data Ma are different bit arrays, the inquiry data Ma is collated with the registration data Ra (step A09).

PKI server device 4, a query about the data Mb of user B received from the second user terminal device _(12), and decoding, if necessary using a PKI private key S. Then, by comparing the inquiry data Mb with the registration data Rb, it is determined whether or not these bit arrays are all the same. If the same is the case, the registration data Rb of the user B is stored in the biometric data invalidation list 6 ₂ and the processing ends. do. When the registration data Rb and the inquiry data Mb have different bit arrays, the received inquiry data Mb is collated with the registration data Rb.

The PKI server device 4 determines that the matching result of the user A is successful, that is, when the inquiry data Ma is recognized as the user A (step A10), the similarity information indicating the similarity from the registration data Ra and the inquiry data Ma of the user A. SA1 is calculated (step A11). If the matching result fails, the process ends. For the calculation of the similarity information, for example, "" Automatic Fingerprint Matching-Control Assumption with Minusian Network Features ", Journal of the Institute of Information and Communication Sciences, vol.J72-DH, No. 5, pages 733-740, May 1989 What is necessary is just to use the value (henceforth a score information) which integrated the "large intensity" for every predetermined characteristic point described in "".

Specifically, score information of user A's registration data Ra is set to SA1rr, score information of user A's inquiry data Ma is set to SA1mm, and user A's registration data Ra and score information of inquiry data Ma are set to SA1rm. In this case, the similarity information SA1 of the user A is calculated by using SA1 = F1 (SA1rr, SA1mm, SA1rm) using a predetermined function F1.

In addition, the calculation method of the similarity information SA1 is not limited to the said method, You may obtain | require by another well-known method using the registration data Ra and inquiry data Ma of user A, and the calculated value is also different using a predetermined function. It may be converted to a value and used.

Similarly, when the PKI server apparatus 4 recognizes that the matching result of the user B is successful, that is, that the inquiry data Rb is that of the user B, the PKI server device 4 calculates the similarity information SB1 from the registration data Rb of the user B and the inquiry data Mb. If the matching result fails, the process ends.

Similarity information SB1 of user B is similar to the calculation method of similarity information SA1 of user A, for example, sets score information of registration data Rb of user B as SB1rr, and scores information of inquiry data Mb of user B, for example. When SB1mm is set and score information of user B's registration data Rb and inquiry data Mb is SB1rm, it is calculated by SB1 = F1 (SB1rr, SB1mm, SB1rm) using a predetermined function F1.

Similarity information SA1, PKI server device 4 is calculated a SB1 is, the registration data Ra and similarity information SB1 of user B of the user A in the encrypted using a PKI public key A, and the first user terminal device (1 ₁₎ It transmits (step A12). In addition, the degree of similarity information SA1 of user A and the registration data Rb of user B and the encrypted using a PKI public key B, and transmits it to the second user terminal device _(12).

The acquired first user terminal device (1 _1), the data received from PKI server device 4, the decryption using a PKI private key A, and the registration data Ra and similarity information SB1 of user B of the user A, respectively ( Step A13). Similarity information SA2 is calculated using registration data Ra of user A and inquiry data Ma of user A stored in the predetermined storage device (step A14).

Similarly to the PKI server apparatus 4, the similarity information SA2 sets SA1rr score information between user A's registered data Ra, and sets SA1mm score information of user A's inquiry data Ma to SA1mm. When score information of registration data Ra and inquiry data Ma is SA1rm, it calculates by SA2 = F1 (SA1rr, SA1mm, SA1rm) using predetermined | prescribed function F1. Based on this similarity information SA2 and similarity information SB1 of user B received from PKI server device 4, first generates a common secret key KA for use in data transmission and reception with the second user terminal device ₍₁₂₎ (step A15). The common secret key KA is generated by predetermined functions F2 (SA2, SB1) using similarity information SA2, SB1.

Similarly, the second user terminal device ₍₁₂₎ is, the data received from PKI server device 4, the decryption using the PKI secret key B and obtains each of the similarity information SA1 of the registration data Rb and a user A of the user B (Step A16). The similarity information SB2 is calculated using the registration data Rb of the user B and the inquiry data Mb of the user B stored in the predetermined storage device (step A17).

Similarly to the PKI server apparatus 4, the similarity information SB2 sets score information of registration data Rb of user B to SB1rr, and sets score information of inquiry data Mb of user B to SB1mm, When score information of registered data Rb and inquiry data Mb is SB1rm, it calculates by SB2 = F1 (SB1rr, SB1mm, SB1rm) using predetermined | prescribed function F1. Based on this similarity information SB2 and similarity information SA1 of user A received from PKI server device 4, first generates a common secret key KB to be used in transmitting and receiving data with the first user terminal device (1 ₁₎ (step A18). The common secret key KB is generated by the predetermined function F2 (SB2, SA1) using the similarity information SB2, SA1.

Here, each mobile terminal device (1 _1, 1 ₂₎ and using the same function F1 and function F2 in, and if there is no alteration to the data sent and received in each user terminal device _{(11, 12),} common secret key KA and The common secret key KB will be the same. Thus, the first user terminal device ₍₁₁₎ and the common secret keys that are available only from the second user terminal device ₍₁₂₎ is generated.

Thereafter, the first user terminal device ₍₁₁₎ transmits the data encrypted by using a PKI public key B to the second user terminal device _(12), and a second user terminal device ₍₁₂₎ is the received data Decrypt using the common secret key KB. Similarly, second user terminal device ₍₁₂₎ transmits the data encrypted by using a PKI public key A to the first user terminal device _(11), and first user terminal device ₍₁₁₎ is common to the received data Decrypt using the secret key KA. As a result, the first user terminal device 1 ₁ and the second user terminal device 1 ₂ can transmit and receive data by the public key cryptography method using the hidden common secret key.

According to the data communication method and system of the present embodiment, since the user terminal apparatuses that transmit and receive data each generate the same common secret key using respective similarity information obtained from each other's biometric data, There is no need to shed a common secret key. Therefore, the risk of key waterproofing on the network 5 is reduced.

In addition, since the biometric data has a different bit arrangement for each collection, the common secret key generated on the basis of the biometric data is also different every time, and has only the effect as a one-time key. The security level of the communication by the key encryption system is improved.

(2nd Example)

Next, a second embodiment of a data communication method and system of the present invention will be described with reference to the drawings.

The second embodiment has a configuration in which biometric data (registration data) is registered not only in a PKI server device but also in each user terminal device 1 ₁ , 1 ₂ or biometric data acquisition device 2 ₁ , 2 _{2 in} advance. to be. Therefore, the second embodiment differs from the first embodiment in that registration data is not transmitted from the PKI server device 4 to the respective user terminal devices 1 ₁ and 1 ₂ . Since the configuration of the data communication system is similar to that of the first embodiment, the description thereof is omitted.

Fig. 5 is a flowchart showing the processing procedure of the second embodiment of the data communication method of the present invention.

5, the second embodiment, the user A and the user B before with the data transceiver, for example the second to the user B owns from the first user terminal device ₍₁₁₎ as a result of user A It transmits a creation request of the common secret key to the user terminal device ₍₁₂₎ (step BO1). The second user terminal device _(12), the first user upon receipt of the write request of the terminal device, common secret key from (1 _{1), the} repair request to the first user terminal device ₍₁₁₎ as a result of user B Is conveyed (step B02).

Next, the first user terminal device _(11), using the biometric data acquisition device (21) as a result of user A, and harvesting the biometrics data of user A, the biometrics data (inquiry data) Ma Is stored in the predetermined storage device, and the information of the user A and the communication partner (user B) is added to the PKI server device 4 (step B03). At this time, the 1st user terminal device ₁₁ may encrypt the data to transmit in order to conceal the inquiry data Ma of user A with PKI public key S. FIG.

Similarly, the second user terminal device ₍₁₂₎ the service the write request of the common secret key, using the biometric data acquisition device ₍₂₂₎ as a result of user B, and harvesting the biometrics data of user B, The biometric data (query data) Mb is stored in a predetermined storage device, and information of the user B and the communication partner (user A) is added to the PKI server device 4 (step BO4). At this time, the second user terminal device ₁₂ may encrypt the data transmitted to conceal the inquiry data Mb of the user B using the PKI public key S. FIG.

Judges whether or not the PKI server device 4, upon receiving the biometrics data of user A from first user terminal device ₍₁₁₎ (step BO5), the received data is first encrypted. If the received data is encrypted, the PKI server device 4 decrypts the received data using the PKI secret key S.

When the PKI server device 4 acquires the inquiry data Ma of the user A by decoding, the PKI server device 4 reads the registration data Ra of the user A registered in the biometrics database 6 _{1 in} advance, and compares it with the received inquiry data Ma. (Step B06) It is determined whether or not all bit arrays are the same (step B07).

Here, the registered data when Ra and inquiry data Ma are all of the same bit array, the first user the inquiry data transmitted from the terminal apparatus ₍₁₁₎ as described above Ma is stolen data in the past, that is, a third party other than the user A The access data is determined to be from the user A, and the registration data Ra of the user A is stored in the biometric data invalidation list 6 ₂ (step B08), and the processing ends. When the registration data Ra and the inquiry data Ma are different bit arrays, the inquiry data Ma is collated with the registration data Ra (step B09).

PM server device 4, a query about the data Mb of user B received from the second user terminal device _(12), and decrypted using PKI secret key S as necessary. Then, by comparing the inquiry data Mb with the registration data Rb, it is determined whether or not these bit arrays are all the same. If the same is the case, the registration data Rb of the user B is stored in the biometric data invalidation list 6 ₂ and the processing ends. do. If it is not the same, the received inquiry data Mb is checked against the registration data Rb.

The PKI server device 4 calculates the similarity information SA1 from the registration data Ra and the inquiry data Ma of the user A when the matching result of the user A is successful, that is, when the inquiry data Ra is recognized as the user A (step B10). (Step B11). At this time, similarity information SA1 of user A is calculated using predetermined functions F1 (SA1rr, SA1mm, SA1rm) similarly to the first embodiment (step B09). If the matching result fails, the process ends.

Similarly, when the PKI server apparatus 4 recognizes that the matching result of the user B is successful, that is, that the inquiry data Rb is that of the user B, the PKI server device 4 calculates the similarity information SB1 from the registration data Rb of the user B and the inquiry data Mb. At this time, similarity information SB1 of user B is calculated using, for example, predetermined functions F1 (SB1rr, SB1mm, SB1rm) as in the first embodiment. If the matching result fails, the process ends.

Similarity information SA1, PKI server device 4 is calculated a SB1, the encrypt similarity information SB1 of user B by using a PKI public key A, and first transmits to the first user terminal device (1 ₁₎ (step B12). In addition, the degree of similarity information SA1 of user A, and encrypted by using a PKI public key B, and transmits it to the second user terminal device _(12).

The first user terminal device _(11), the data received from PKI server device 4, the decryption using a PKI private key A, and obtains the degree of similarity information SB1 of user B (step B13). Similarity information SA2 is calculated using registration data Ra of user A and inquiry data Ma of user A previously stored in the predetermined storage device (step B14).

Similarity information SA2 is calculated using the predetermined functions F1 (SA1rr, SA1mm, SA1rm) similarly to the first embodiment. Based on this similarity information SA2 and similarity information SB1 of user B received from the PKI server device, comprising to generate a common secret key KA for use in data transmission and reception with the second user terminal device ₍₁₂₎ (step B15). The common secret key KA is generated by the predetermined functions F2 (SA2, SB1) using the similarity information SA2, SB1 as in the first embodiment.

Similarly, the second user terminal device _(12), the data received from PKI server device 4, the decryption using the PKI secret key B and obtains the degree of similarity information SA1 of user A (Step B16). Similarity information SB2 is calculated using registration data Rb of user B and inquiry data Mb of user B previously stored in the predetermined storage device (step B17).

Similarity information SB2 is calculated using predetermined functions F1 (SB1rr, SB1mm, SB1rm) similarly to the first embodiment. Based on this similarity information SB2 and similarity information SA1 of user A received from PKI server device 4, first generates a common secret key KB to be used in transmitting and receiving data with the first user terminal device (1 ₁₎ (step B18). The common secret key KB is generated by the predetermined function F2 (SB2, SA1) using the similarity information SB2, SA1 as in the first embodiment.

Here, each mobile terminal device (1 _1, 1 ₂₎ and using the same function F1 and function F2 in, and if there is no alteration to the data sent and received in each user terminal device _{(11, 12),} common secret key KA and The common secret key KB will be the same. Thus, the first as in the embodiment, the first user terminal device ₍₁₁₎ and the second user terminal a common secret key that can only use the device ₍₁₂₎ is generated.

Thereafter, the first user terminal device ₍₁₁₎ transmits the data encrypted by using a PKI public key B to the second user terminal device _(12), and a second user terminal device ₍₁₂₎ is the received data Decrypt using the common secret key KB. Similarly, second user terminal device ₍₁₂₎ transmits the data encrypted by the PKI public key A to the first user terminal device _(11), and the first user terminal device ₍₁₁₎ is a common secret key, the received data Decode using KA. As a result, the first user terminal device 1 ₁ and the second user terminal device 1 ₂ can transmit and receive data by the public key cryptography method using the hidden common secret key.

According to the data communication method and system of the present embodiment, since the biometric data (registration data) of the user is registered in the user terminal device or the biometric data acquisition device in advance, the registration data does not need to flow on the network. In addition to the same effects as those in the first embodiment, the risk of registration data being waterproofed to a third party is reduced.

(Third Embodiment)

Next, a third embodiment of a data communication method and system of the present invention will be described with reference to the drawings.

The third embodiment, the first user terminal device ₍₁₁₎ and second user terminal device ₍₁₂₎ (or a biometric data acquisition device _(21, biometrics data (registration data for the user to ₂₂₎₎ is Each user terminal device ₁₁ , 1 ₂ is registered in advance, and the inquiry data is collated with the registration data, and when the matching is successful, the registration data and the inquiry data are transmitted to the PKI server device 4. Then, the PKI server The apparatus 4 authenticates the user who transmitted these data from the bit array of the inquiry data and the registration data transmitted from the user terminal apparatuses 1 ₁ and 1 _2. The configuration of the data communication system is the first embodiment. Since it is the same as that, the description is omitted.

Fig. 6 is a flowchart showing the processing procedure of the third embodiment of the data communication method of the present invention.

6, the third embodiment, the user A and the user B before the data transmission, for example the second to the user B owns from the first user terminal device ₍₁₁₎ as a result of user A It transmits a creation request of the common secret key to the user terminal device ₍₁₂₎ (step C01). The second user terminal device _(12), the first user upon receipt of the write request of the terminal device, common secret key from (1 _{1), the} repair request to the first user terminal device ₍₁₁₎ as a result of user B Is conveyed (step C02).

Next, the first user terminal device _(11), using the biometric data acquisition device ₍₂₁₎ as a result of user A sampled biometric data of the user A (Step C03), the biometrics data (Inquiry data) Ma is stored in a predetermined storage device and is collated with registration data Ra stored in the storage device in advance (step C04). The first user terminal device _(11), the verification result is successful, that is granted by the inquiry data Ma that person of the user A (Step C08), the registration data Ra, inquiry data Ma, the user A and the communication partner (user B) Is sent to the PKI server apparatus 4 (step C09). At this time, the 1st user terminal device ₁₁ may encrypt the data to transmit in order to conceal information about these users A using PKI public key S. FIG. If the matching result fails, the process ends.

Similarly, the second user terminal device ₍₁₂₎ the service the write request of the common secret key, using the biometric data acquisition device ₍₂₁₎ as a result of user B, and harvesting the biometrics data of user B ( Step C06), the biometric data (query data) Mb is stored in a predetermined storage device and collated with registration data Rb previously stored in the storage device (step C07). The second user terminal device _(12), the verification result is successful, that is granted by the inquiry data Mb that the user B I (step C10), the registration data Rb, inquiry data Mb, the user B and the communication partner (user A) Is sent to the PKI server apparatus 4 (step C11). At this time, the second user terminal device ₁₂ may encrypt the data transmitted using the PKI public key S to conceal information about these users B. FIG. If the matching result fails, the process ends.

Whether the PKI server device 4, first upon receipt of the first information including registration data Ra and inquiry data Ma of user A from the user terminal device ₍₁₁₎ (step C12), first the received data is encrypted, Determine. If the received data is encrypted, the PKI server device 4 decrypts the received data using the PKI secret key S.

When the PKI server device 4 acquires the registration data Ra and the inquiry data Ma of the user A by decoding, first, the PKI server device 4 searches in the biometric data invalidation list 6 ₂ (step C13) and receives the received inquiry data Ma. It is determined whether or not data having the same bit array are all present (step C14). Biometrics data invalid list ₍₆₂₎ if the inquiry data Ma, and all data of the same bit array is present in, PKI server device 4 first user terminal device ₍₁₁₎ received from the inquiry data Ma are corrupt It judges that it is data, and complete | finishes a process. If there is no data in the same bit array as the inquiry data Ma, then the inquiry data Ma is registered in the biometric data invalidation list 62 in order to prevent access (user pose) using this inquiry data Ma. (Step C15).

Subsequently, the PKI server device 4 searches in the biometrics database 6 ₁ (step C16), and determines whether or not there is data of the same bit array as the received registration data Ra (step C17). ). If there is no data of the same bit array as the registration data Ra in the biometrics database 6 ₁ , the PKI server device 4 indicates that the access from the first user terminal device 1 ₁ is not that of the user A. (Authentication of self-authentication) It determines and complete | finishes a process.

When the data of the same bit array as the registration data Ra exists in the biometrics database 6 ₁ , it is determined that the received registration data Ra and the inquiry data Ma are the data of the user A (person authentication successful), and the first implementation is performed. Similarly to the example, the similarity information SA1 of the user A is calculated (step C18).

PKI server device 4, first user terminal device ₍₁₂₎ about the data received from subjected to the above (step C12 ~ step C18) and similar processing, the received registration data Rb and inquiry data Mb that user B It is determined whether or not the data is &quot;,&quot; and when the personal authentication is successful, similarity information SB1 of the user B is calculated as in the first embodiment.

Similarity information SA1, PKI server device 4 is calculated a SB1 transmits the similarity information SB1 of the calculated user B for encryption using PKI public key A, and the first user terminal device ₍₁₁₎ (step C19 ). In addition, by encrypting the similarity information SA1 of user A by using a PKI public key B, and transmits it to the second user terminal device _(12).

The first user terminal device _(11), the data received from PKI server device 4, the decryption using a PKI private key A, and obtains the degree of similarity information SB1 of user B (Step C20). Similarity information SA2 is calculated using registration data Ra of user A and inquiry data Ma of user A previously stored in the predetermined storage device (step C21).

Similarity information SA2 is calculated using the predetermined functions F1 (SA1rr, SA1mm, SA1rm) similarly to the first embodiment. Based on this similarity information SA2 and similarity information SB1 of user B received from the PKI server device, comprising to generate a common secret key KA for use in the first user terminal device ₍₁₁₎ (step C22). The common secret key KA is generated by a predetermined function F2 (SA2, SB1) using similarity information SA2, SB1, similarly to the first embodiment.

Similarly, the second user terminal device ₍₁₂₎ is, the data received from PKI server device 4, the decryption using the PKI secret key B, and obtaining the degree of similarity information SA1 of user A is (step C23). The similarity information SB2 is calculated using the registration data Rb of the user B previously stored in the predetermined storage device and the inquiry data Mb of the user B (step C24).

Similarity information SB2 is calculated using predetermined functions F1 (SB1rr, SB1mm, SB1rm) similarly to the first embodiment. Based on the similarity information SA1 of user A received from the similarity information SB2 and PKI server device 4, and generates the common secret key KB used in the second user terminal device ₍₁₂₎ (step C25). The common secret key KB is generated by the predetermined function F2 (SB2, SA1) using the similarity information SB2, SA1 as in the first embodiment.

Here, each mobile terminal device (1 _1, 1 ₂₎ and using the same function F1 and function F2 in, and if there is no alteration to the data sent and received in each user terminal device _{(11, 12),} common secret key KA and The common secret key KB will be the same. Thus, the first as in the embodiment, the first user terminal device ₍₁₁₎ and the second user terminal a common secret key that can only use the device ₍₁₂₎ is generated.

Thereafter, the first user terminal device ₍₁₁₎ transmits the data encrypted by using a PKI public key B to the second user terminal device _(12), and a second user terminal device ₍₁₂₎ is the received data Decrypt using the common secret key KB. Similarly, second user terminal device ₍₁₂₎ transmits the data encrypted by using a PKI public key A to the first user terminal device _(11), and first user terminal device ₍₁₁₎ is common to the received data Decrypt using the secret key KA. As a result, the first user terminal device 1 ₁ and the second user terminal device 1 ₂ can transmit and receive data by the public key cryptography method using the hidden common secret key.

According to the data communication method and system of the third embodiment, in addition to the same effects as those of the first embodiment, the bits of registration data and inquiry data transmitted from the respective user terminal devices 1 ₁ and 1 ₂ in the PKI server device 4 are provided. By authenticating whether or not the user is based on the arrangement, the user's authentication accuracy is improved, and the user's posture by a malicious third party can be more reliably prevented.

(Example 4)

Next, a fourth embodiment of a data communication method and system of the present invention will be described with reference to the drawings.

In the fourth embodiment, similar to the third embodiment, the bio of the user is stored in the first user terminal device 1 ₁ and the second user terminal device 1 ₂ (or the biometric data acquisition devices 2 ₁ , 2 ₂ ). The matrix data (registration data) is registered in advance, and the inquiry data is matched with the registration data in each of the user terminal devices 1 ₁ and 1 ₂ , and when the matching is successful, the registration data and the inquiry data are sent to the PKI server device 4. The PKI server apparatus 4 authenticates the user who transmitted these data from the bit array of the inquiry data and the registration data transmitted from the respective user terminal apparatuses 1 ₁ and 1 ₂ .

In the fourth embodiment, even when the registration data registered in each of the user terminal apparatuses 1 ₁ and 1 ₂ is poor quality data that cannot be used for matching, the same operation as in the third embodiment is enabled. Further, whether or not the quality defect data is, for example, it determines the registration of biometric data for the first user terminal device ₍₁₁₎ and second user terminal device _(12), and determined to be of poor quality data By adding the quality defect flag to the registration data, it is possible to reduce the determination processing of whether or not the quality data is defective for each reading of the registration data. Since the configuration of the data communication system is similar to that of the first embodiment, the description thereof is omitted.

Fig. 7 is a flowchart showing the processing procedure of the fourth embodiment of the data communication method of the present invention. In addition, Figure 7, the first user terminal device ₍₁₁₎ and, but shows only the processing of PKI server device 4, first user terminal device ₍₁₂₎ has, for the first time the first user terminal device (1 ₁₎ except for the process to respond to the requirements in the common secret key from, and executes the first user terminal device (1 ₁₎ and the same processing.

7, the fourth embodiment, the user A and the user B before the data transmission, for example the second to the user B owns from the first user terminal device ₍₁₁₎ as a result of user A A request for creating a common secret key is sent to the user terminal device (step D01). The second user terminal device _(12), the first user upon receipt of the write request of the terminal device, common secret key from (1 _{1), the} repair request to the first user terminal device ₍₁₁₎ as a result of user B (Not shown).

Next, the first user terminal device _(11), using the biometric data acquisition device ₍₂₁₎ as a result of user A sampled biometric data of the user A (Step D02), the biometrics data (Inquiry data) Ma is stored in a predetermined storage device, and the quality of the registration data Ra stored in advance in the storage device is checked (step D04). When registration data Ra has a quality that can be used for verification, the inquiry data Ma collected by the biometric data acquisition device 2 ₁ is collated with the registration data Ra (step D05). The first user terminal device _(11), the verification result is successful, that is granted by the inquiry data Ma that person of the user A (Step D06), the registration data Ra, inquiry data Ma, the user A and the communication partner (user B) Is sent to the PKI server device 4 (step D07). In addition, in this embodiment, even when the registration data Ra is poor quality data which does not have the quality which can be used for collation, the 1st user terminal apparatus moves to the process of step D07, and registration data Ra, inquiry data Ma, Information of the user A and the communication partner (user B) and the like are transmitted to the PKI server device 4. At this time, the 1st user terminal device ₁₁ may encrypt the data to transmit in order to conceal information about these users A using PKI public key S. FIG.

Similarly, the second user terminal device ₍₁₂₎ the service the write request of the common secret key, using the biometric data acquisition device ₍₂₁₎ as a result of user B, and harvesting the biometrics data of user B, The biometric data (query data) Mb is stored in a predetermined storage device, and the quality of the registration data Rb stored in advance in the storage device is confirmed. When the registration data Rb has a quality that can be used for verification, the inquiry data Mb collected by the biometric data acquisition device is collated with the registration data Rb. The second user terminal device ₁₂ receives the registration data Rb, the inquiry data Mb, the information of the user B and the communication partner (user A) and the like when the matching result is successful, that is, when the inquiry data Mb is recognized as that of the user B. It transmits to the PKI server apparatus 4. In addition, the second user terminal device ₍₁₂₎ is registered, even if the data Rb is a quality defect data which does not have the quality that can be used for control, registration data Rb, inquiry data Mb, the user B and the communication partner (user A) Information is sent to the PKI server device 4. At this time, the second user terminal device ₁₂ may encrypt the data transmitted using the PKI public key S to conceal information about these users B. FIG.

Since the subsequent processing is the same as the processing of steps C12 to C25 of the third embodiment shown in FIG. 6, the description thereof is omitted.

According to the data communication method and system of the fourth embodiment, similarly to the third embodiment, the PKI server device 4 is based on the bit arrangement of registration data and inquiry data transmitted from each user terminal device 1 ₁ , 1 ₂ . By authenticating whether the user is the user, the user's authentication accuracy is improved, and the user's posture by a malicious third party can be prevented more reliably. In addition, even when the matching using the registration data is impossible in each of the user terminal apparatuses 1 ₁ and 1 ₂ , the same operations as in the third embodiment can be performed.

In the first to fourth embodiments, the PKI server device 4, the first user terminal device 1 ₁ , and the second user terminal device 1 ₂ both perform processing according to a program. Despite shown an exemplary configuration for implementing by a processing apparatus including a CPU, PKI server device 4, first user terminal device _(11), and second user terminal device ₍₁₂₎ it is not limited to such a construction Instead, for example, a configuration in which the same function as described above may be realized by a plurality of LSIs including a logic circuit and a memory.

Claims (37)

A public key cryptography data communication method for authenticating a user transmitting and receiving data through a network and encrypting and transmitting the data. Biometric data of the user is collected using a biometrics acquisition device for collecting biometric data obtained by quantifying the biometric information of the user, The collected biometric data is transmitted from the user terminal device used by the user to the server device as inquiry data for authenticating the user. On the basis of the registration data which is the biometric data of the user registered in advance in the database by the server device and the inquiry data received from the user terminal device, the inquiry data between the inquiry data and the registration data using a predetermined function. Calculating similarity information indicating similarity for each user; To each user terminal device, the registration data of the user using the user terminal device and the similarity information of the user of the communication partner are respectively transmitted, On the basis of the registration data received by the user terminal device and the inquiry data collected by using the biometrics acquisition device, a similarity between the registration data and the inquiry data is expressed using the same function as the server device. Calculating the similarity information of the user himself, The user terminal device decrypts the encrypted data transmitted from the user terminal device of the communication partner based on the calculated similarity information of the user himself and the similarity information of the user of the communication partner received from the server device. A data communication method for generating a common secret key for use by using a common function for each of the user terminal devices. The method of claim 1, Determining, by the server apparatus, whether the bit arrangement of the inquiry data and the registration data is the same, When the bit array of the registration data and the inquiry data is different, the inquiry data is collated with the registration data, And when the matching is successful, authenticating the user of the user terminal device that has sent the inquiry data as the user. The method of claim 2, When the server apparatus determines that the bit arrays of the registration data and the inquiry data are all the same, registration data of a user using the user terminal apparatus that has transmitted the inquiry data includes biometric data that cannot be used. Data communication method to save in the invalid list. The method of claim 1, The biometric data of the user who uses the user terminal device is stored as registration data in advance in the storage device included in the user terminal device, Similarity information indicating the similarity between the inquiry data and the registration data pre-stored in the storage device by using a predetermined function is obtained by the server apparatus based on the received inquiry data and the registration data previously stored in the storage device. It calculates for each said user, and transmits similarity information of the user of the communication partner to each user terminal apparatus, respectively, The registration data stored in the storage device in advance using the same function as the server device based on the registration data stored in the storage device in advance and the inquiry data collected by the biometrics acquisition device by the user terminal device. And the user's own similarity information indicating the similarity between and the inquiry data, A common secret key for decrypting the encrypted data transmitted from the user terminal device of the communication partner, based on the calculated similarity information of the user himself and the similarity information of the user of the communication partner received from the server apparatus; And a data communication method generated by using a common function for each of the user terminal devices. A public key cryptography data communication method for authenticating a user transmitting and receiving data through a network and encrypting and transmitting the data. In the storage device provided by the user terminal device used by the user, biometric data obtained by quantifying the biometric information of the user is stored in advance as registration data, Biometrics data of the user is collected using a biometrics acquisition device, Transmitting the registration data and inquiry data for authenticating the user, which is the collected biometric data, from the user terminal device used by the user to a server device via a network; The server apparatus judges whether or not there is data in the same bit array as the inquiry data received from the user terminal apparatus in the invalid list in which the biometric data that is not available is registered, When there is no data of the same bit array as all of the inquiry data in the invalid list, it is determined whether or not there is data in the same bit array as the received registration data in the database in which biometric data for each user is registered in advance, And a data communication method for authenticating that the user of the user terminal apparatus that has transmitted the registration data and the inquiry data is the user when there is data in the same bit array as the registration data in the database. The method of claim 5, And the server apparatus stores the inquiry data in the invalid list when there is no data in the same bit array as the inquiry data received from the user terminal device in the invalid list. The method of claim 5, The inquiry data collected by the user terminal device using the biometrics acquisition device is collated with registration data stored in the storage device in advance; And the registration data and the inquiry data are transmitted to the server apparatus when the user of the user terminal apparatus authenticates the user as a result of the verification. The method of claim 5, The user terminal device determines whether or not the registration data stored in the storage device in advance is poor quality data that cannot be used for matching, When the registration data is not the poor quality data, the inquiry data collected by using the biometrics acquisition device is collated with the registration data stored in the storage device in advance, and the user of the user terminal device is determined by the verification. When authenticating as an identity, the registration data and the inquiry data are sent to the server apparatus, And transmitting the registration data and the inquiry data to the server device when the registration data is the poor quality data. The method of claim 5, Based on the received inquiry data and the registration data, the server apparatus calculates similarity information for each of the users, indicating similarity between the inquiry data and the registration data, using a predetermined function, and for each user terminal. Send similarity information of the user of the communication counterpart to the apparatus, The registration data stored in the storage device in advance using the same function as the server device based on the registration data stored in the storage device in advance and the inquiry data collected by the biometrics acquisition device by the user terminal device. And the user's own similarity information indicating the similarity between and the inquiry data, A common secret key for decrypting the encrypted data transmitted from the user terminal device of the communication partner, based on the calculated similarity information of the user himself and the similarity information of the user of the communication partner received from the server apparatus; And a data communication method generated by using a common function for each of the user terminal devices. A public key cryptography data communication system for authenticating a user who transmits and receives data through a network, and encrypts and transmits the data. And a biometrics acquisition device for collecting biometric data obtained by quantifying the biometric information of the user. The biometric data of the user is collected using the biometrics acquisition device, and the collected biometric data is used for the user. A user terminal device to be used by the user, which is transmitted as inquiry data for authentication, And a database in which registration data which is biometric data of the user is registered in advance, and upon receiving the inquiry data from the user terminal device, based on the inquiry data and the registration data, the inquiry data using a predetermined function. And a PKI server for calculating the similarity information indicating the similarity between the data and the registration data for each of the users, and transmitting the registration data of the user using the user terminal device and the similarity information of the user of the communication party to each user terminal device, respectively. Device Including; The user terminal device, A similarity between the inquiry data and the registration data, using the same function as the PKI server device, based on the registration data received from the PKI server device and the inquiry data collected using the biometrics acquisition device. The user's own similarity information is calculated, and based on the calculated similarity information of the user himself and the similarity information of the user of the communication party received from the PKI server device, the encrypted information transmitted from the user terminal device of the communication party is encrypted. A data communication system for generating a common secret key for decoding data using a function common to each of said user terminal devices. The method of claim 10, The PKI server device, It is determined whether the bit arrangement of the registration data and the inquiry data is the same, and when the registration of the bits of the registration data and the inquiry data is different, the inquiry data is collated with the registration data, and the collation is successful. And a data communication system for authenticating the user of the user terminal apparatus that has sent the inquiry data as the user. The method of claim 11, The PKI server device, An invalid list in which unusable biometric data is registered, And when the bit array of the registration data and the inquiry data is determined to be the same, registration data of a user using the user terminal apparatus which has transmitted the inquiry data is registered in the invalid list. The method of claim 10, The PKI server device, Based on the inquiry data received from the user terminal device and the registration data, similarity information indicating the degree of similarity between the inquiry data and the registration data is calculated for each of the users using a predetermined function, respectively. To each of the similarity information of the user of the communication partner, The user terminal device, A storage device for storing biometric data of a user who uses the user terminal device as registration data in advance, The similarity degree between the registration data previously stored in the storage device and the inquiry data, using the same function as the PKI server device, based on the registration data previously stored in the storage device and the inquiry data collected by using the biometrics acquisition device. Calculate similarity information of the user himself / herself, and transmit from the user terminal device of the communication partner based on the similarity information of the user himself / herself and the similarity information of the user of the communication partner received from the PKI server device. And a common secret key for decrypting the encrypted data to be generated using a common function for each of the user terminal devices. A public key cryptography data communication system for authenticating a user who transmits and receives data through a network, and encrypts and transmits the data. A biometrics acquisition device for acquiring biometric data obtained by quantifying the biometric information of the user, and a storage device for storing biometrics data of the user as registration data in advance, and using the biometrics acquisition device A user terminal apparatus used by the user, which collects the biometric data of the user and transmits the collected biometric data as inquiry data for authenticating the user together with the registration data; The database includes a database in which biometric data for each user is registered in advance, and an invalid list in which unusable biometric data is registered. When the inquiry data and registration data are received from the user terminal device, the user is added to the invalid list. It is determined whether there is data of the same bit array as all of the inquiry data received from the terminal device, and when there is no data of the same bit array as all of the inquiry data in the invalid list, it is received from the user terminal device in the database. It is determined whether there is data in the same bit array as the registration data, and when there is data in the same bit array as the registration data in the database, the user of the user terminal apparatus which has transmitted the registration data and the inquiry data The user A PKI server device to authenticate as Data communication system having a. The method of claim 14, The PKI server device, And storing the inquiry data in the invalid list when there is no data in the same bit array as the inquiry data received from the user terminal device in the invalid list. The method of claim 14, The user terminal device, The inquiry data collected using the biometrics acquisition device is collated with registration data stored in the storage device in advance, And the registration data and the inquiry data are transmitted to the PKI server apparatus when the user of the user terminal apparatus authenticates the user as a result of the verification. The method of claim 14, The user terminal device, It is determined in advance whether or not the registration data stored in the storage device is poor quality data that cannot be used for verification, and when the registration data is not the poor quality data, the inquiry data collected by using the biometrics acquisition device is checked. The registration data and the inquiry data are transmitted to the server device when matching with registration data stored in the storage device in advance and authenticating that the user of the user terminal device is the user by the matching. And transmitting the registration data and the inquiry data to the server device when the registration data is the poor quality data. The method of claim 14, The PKI server device, Based on the inquiry data received from the user terminal device and the registration data, similarity information indicating the degree of similarity between the inquiry data and the registration data is calculated for each of the users using a predetermined function, respectively. To each of the similarity information of the user of the communication partner, The user terminal device, The similarity degree between the registration data previously stored in the storage device and the inquiry data, using the same function as the PKI server device, based on the registration data previously stored in the storage device and the inquiry data collected by using the biometrics acquisition device. Calculating similarity information of the user himself, Based on the calculated similarity information of the user himself and similarity information of the user of the communication party received from the PKI server device, a common secret key for decrypting the encrypted data transmitted from the user terminal device of the communication party is determined. And generating using a common function for each of the user terminal devices. A server device for realizing a public key cryptographic data communication for authenticating a user who transmits and receives data through a network, and encrypts and transmits the data. A data storage device having a database in which registration data which is biometric data obtained by quantifying the biometric information of the user is registered in advance; On receiving the inquiry data which is biometric data for authenticating the user from the user terminal device used by the user, based on the inquiry data and the registration data, the inquiry data and the registration data are established using a predetermined function. Similarity information indicative of similarity is calculated for each of the users, and a processing apparatus for transmitting registration data of the user who uses the user terminal device and similarity information of the user of the communication counterpart to each user terminal device, respectively. The server device having. The method of claim 19, The processing device, It is determined whether the bit arrangement of the registration data and the inquiry data is the same, and when the registration of the bits of the registration data and the inquiry data is different, the inquiry data is collated with the registration data, and the collation is successful. At this time, the server apparatus for authenticating the user of the user terminal apparatus which has sent the inquiry data as the user. The method of claim 20, The data storage device, Further comprising an invalid list in which unusable biometric data is registered, The processing device, And when it is determined that the bit array of the registration data and the inquiry data is the same, the server device for storing the registration data of the user who uses the user terminal apparatus which has transmitted the inquiry data in the invalid list. The method of claim 19, The processing device, Based on the inquiry data received from the user terminal device and the registration data, similarity information indicating the degree of similarity between the inquiry data and the registration data is calculated for each of the users using a predetermined function, respectively. The server apparatus which transmits the similarity information of the user of the communication partner, respectively. A server device for realizing a public key cryptographic data communication for authenticating a user who transmits and receives data through a network, and encrypts and transmits the data. A data storage device having a database in which registration data which is biometric data obtained by quantifying the biometric information of the user is pre-registered, and an invalid list in which unusable biometric data is registered; When the inquiry data which is biometric data for authenticating the user and the registration data which is biometric data registered in advance in the user terminal device are received from the user terminal device used by the user, the user terminal device receives the inquiry data from the user terminal device in the invalid list. It is determined whether there is data in the same bit array as the inquiry data, and when there is no data in the same bit array as the inquiry data in the invalid list, all of the registration data received from the user terminal device in the database is the same. It is determined whether there is data of a bit array, and when there is data in the same bit array as the registration data registered in advance in the user terminal device in the database, the registration data and the inquiry data registered in advance in the user terminal device. Send The user of the user terminal device authentication processing apparatus that the user I The server device having. The method of claim 23, wherein The processing device, The server apparatus stores the inquiry data in the invalid list when the invalid list does not contain data having the same bit array as all of the inquiry data received from the user terminal device. The method of claim 23, wherein The processing device, Based on the inquiry data received from the user terminal device and the registration data registered in advance in the user terminal device, a similarity between the inquiry data and the registration data registered in advance in the user terminal device is indicated by using a predetermined function. Similarity information is calculated for each of said users, and each server terminal device transmits similarity information of the user of the communication counterpart, respectively. A computer-readable recording medium having recorded thereon a program for realizing a public key cryptographic data communication by a computer that authenticates a user transmitting and receiving data through a network and encrypts and transmits the data. When the computer receives, from the user terminal device used by the user, inquiry data which is biometric data obtained by quantifying the biometric information of the user for authenticating the user, A process of calculating, for each of the users, similarity information indicating similarity between the inquiry data and the registration data using a predetermined function, based on the registration data which is biometric data of the user registered in the database in advance and the inquiry data. Wow, Processing for transmitting registration data of the user using the user terminal device and the similarity information of the user of the communication partner to each user terminal device, respectively. A computer readable recording medium for causing a computer to run. The method of claim 26, The program, A process of determining whether or not the bit arrays of the inquiry data and the registration data are the same; Processing for matching the inquiry data with the registration data when the bit arrangement of the registration data and the inquiry data is different; A process for authenticating the user of the user terminal device that has sent the inquiry data as the user when the matching is successful; A computer readable recording medium for causing the computer to execute more. The method of claim 27, The program, When it is determined that both the registration data and the bit arrangement of the inquiry data are the same, a process of storing the registration data of the user using the user terminal apparatus which has transmitted the inquiry data in an invalid list in which unusable biometric data is registered. A computer readable recording medium for causing the computer to execute more. The method of claim 26, The program, A process of calculating, for each of the users, similarity information indicating similarity between the inquiry data and the registration data using a predetermined function based on the inquiry data and the registration data received from the user terminal device; A process of transmitting the similarity information of the user of the communication counterpart to each user terminal device, respectively. A computer readable recording medium for causing the computer to execute more. A computer-readable recording medium having recorded thereon a program for realizing a public key cryptographic data communication by a computer, which authenticates a user who transmits and receives data via a network, and encrypts and transmits the data. When the computer receives, from the user terminal device used by the user, inquiry data which is biometric data of the user and registration data which is biometric data registered in advance in the user terminal device, A process of determining whether or not there is data in the same bit array as all of the inquiry data received from the user terminal device in the invalid list in which the biometric data which cannot be used is stored; A process of determining whether or not there is data in the same bit array as the registration data received from the user terminal device in the database when the invalid list contains no data in the same bit array as the inquiry data; A process of authenticating that the user of the user terminal device that has transmitted the registration data and the inquiry data is the user when there is data in the same bit array as the registration data in the database; A computer readable recording medium for causing a computer to run. The method of claim 30, The program, A process for storing the inquiry data in the invalid list when the invalid list contains data of the same bit array as all of the inquiry data received from the user terminal device; A computer readable recording medium for causing the computer to execute more. The method of claim 30, The program, Based on the inquiry data received from the user terminal device and the registration data, similarity information for each of the users indicating similarity between the inquiry data received from the user terminal device and the registration data using a predetermined function, respectively. Processing to calculate, A process of transmitting the similarity information of the user of the communication counterpart to each user terminal device, respectively. A computer readable recording medium for causing the computer to execute more. delete A terminal device for use by a user for transmitting and receiving data encrypted by a public key cryptography method via a network, A biometrics acquisition device for collecting biometric data obtained by quantifying the biometric information of the user; A processing apparatus which collects biometric data of the user by using the biometrics acquisition device, and transmits the collected biometric data to the server apparatus as inquiry data for authenticating the user Including, The processing device, Based on the registration data which is the biometric data of the user registered in advance in the said server apparatus, and the inquiry data collected using the said biometrics acquisition device, received from the said server apparatus, it uses the predetermined function to the said server apparatus. The user's own similarity information indicating the similarity between the registration data registered in advance and the inquiry data is calculated, The common secret key for decoding the encrypted data transmitted from the terminal device of the communication partner is based on the calculated similarity information of the user itself and the similarity information of the user of the communication partner received from the server apparatus. A terminal device generated using a common function for each terminal device. A terminal device for use by a user for transmitting and receiving data encrypted by a public key cryptography method via a network, A biometrics acquisition device for collecting biometric data obtained by quantifying the biometric information of the user; A processing apparatus which collects biometric data of the user by using the biometrics acquisition device, and transmits the collected biometric data to the server apparatus as inquiry data for authenticating the user Including, It further has a memory | storage device for previously storing biometrics data of the user who uses the said terminal device as registration data, The user representing the similarity degree between the registration data prestored in the storage device and the inquiry data, using a predetermined function, based on the registration data stored in advance in the storage device and the inquiry data collected using the biometrics acquisition device. Similarity information of the user is calculated, and based on the calculated similarity information of the user himself and the similarity information of the user of the communication partner received from the server device, the encrypted data transmitted from the communication partner terminal device is decoded. A terminal device for generating a common secret key for each terminal device using a common function. 36. The method of claim 35 wherein The processing device, It is determined in advance whether or not the registration data stored in the storage device is poor quality data that cannot be used for verification, When the registration data is not the poor quality data, the inquiry data collected by using the biometrics acquisition device is collated with the registration data stored in the storage device in advance, And a terminal device for transmitting the registration data and the inquiry data to the server device when the user of the terminal device is authenticated as the user by the verification. The method of claim 36, The processing device, And the registration data and the inquiry data to the server device when the registration data is the poor quality data.

Images