Method and apparatus for cryptographic processing

A cryptographic processing apparatus that holds a first key, and receives authentication object data upon authentication includes a communication unit and a computing unit. The communication unit communicates with a calculation apparatus and a determination apparatus. In the calculation apparatus, encrypted registration data obtained by encrypting registration data twice, once with the first key and once with a second key, is registered. The registration data is data against which the authentication object data is verified. The determination apparatus uses the second key upon the authentication. When registering the encrypted registration data in the calculation apparatus, the computing unit generates a key different from the first key, generates encrypted data by encrypting the registration data twice, once with the first key and once with the different key, transmits the different key to the determination apparatus, and the encrypted data to the calculation apparatus, through the communication unit.

CROSS-REFERENCE TO RELATED APPLICATION

This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2014-070845, filed on Mar. 31, 2014, the entire contents of which are incorporated herein by reference.

FIELD

The embodiments discussed herein are related to a method and an apparatus for cryptographic processing.

BACKGROUND

Systems in financial institutions and systems for electronic commerce and the like need a high level of security. Therefore, these systems use advanced authentication techniques. Recently, techniques such as biometric authentication or the like based on biological information of the user have been used, in addition to password authentication based on a password specified by the user.

A system that uses biometric authentication reads biological information from the user at the time of authentication. Then, the system compares the read biological information with template data, which is biological information registered in advance, so as to determine the degree of similarity therebetween. That is, the biological information read by the system is used as information to be authenticated (hereinafter “authentication object information”), and the template data is used as authentication information. If the authentication object information and the authentication information match within an acceptable tolerance, the authentication is determined to have succeeded. If not, the authentication is determined to have failed.

Examples of biological information include patterns of fingerprints, veins, iris, and the like. These types of biological information are unique to each individual and are unchangeable. Therefore, template data is managed with great care. For example, template data is encrypted and registered in an authentication server. However, if a mechanism is employed that decrypts the encrypted template data into the original template data at the time of authentication and compares biological information obtained from a user with the original template data, there is a risk of the decrypted template data and the obtained biological information being stolen by a malicious third party.

There has been proposed a method that, in order to reduce the above risk, compares encrypted data of biological information read from the user with encrypted template data without decrypting either the biological information or the template data, and calculates a Hamming distance between the biological information and the template data. This technique uses an exclusive-OR operation (hereinafter represented also by the symbol “^”) when encrypting data.

For example, a function that calculates an exclusive OR of an encryption key K and input information X, and a function in CTR (Counter) mode of Advanced Encryption Standard (AES) encryption may be used as a function EK(X) that encrypts data X with the encryption key K. Note that in place of the encryption key K serving as key information, random numbers generated by the encryption key K may be used for encryption. In the following description, such a function will be given by EK(X)=K^X, using the symbol “^”.

An expression EK(X1)^EK(X2)=(X1^K)^(X2^K)=X1^X2≡HV holds, where X1is biological information read from the user, X2is template data, K is an encryption key, and HV is a Hamming vector representing the difference between the biological information X1and the template data X2. Accordingly, if the above operation is used, it is possible to evaluate the degree of match between the biological information and the template data while maintaining an encrypted state thereof, based on the length (Hamming distance) of the Hamming vector HV, and thus to reduce the risk of the biological information being leaked.

The proposed technique described above is designed for application to an authentication system that performs authentication between two parties, that is, between a terminal apparatus to which the user inputs biological information and an authentication server. Thus, the above-described technique is not designed for an authentication system that performs authentication between a terminal apparatus to which the user inputs biological information, a server (hereinafter, “calculation apparatus”) which stores encrypted template data, and a server (hereinafter, “determination apparatus”) that determines whether authentication is successful.

For example, consider a mechanism in which a terminal apparatus transmits encrypted biological information to a calculation apparatus and then the calculation apparatus generates distance information representing the difference between the biological information and template data while maintaining an encrypted state thereof. Note that, a determination apparatus determines whether authentication is successful based on distance information generated by the calculation apparatus. Further, in order to improve the security, the template data is encrypted twice with two encryption keys and stored in the calculation apparatus. One of the keys is stored in the terminal apparatus, while the other one of the keys is stored in the determination apparatus.

In the above case, registering template data in the calculation apparatus involves a process of encrypting the template data with the encryption key stored in the terminal apparatus, encrypting again the template data with the encryption key stored in the determination apparatus, and registering the template data in the calculation apparatus. That is, the determination apparatus registers data in the calculation apparatus in the end. Thus, there is a risk of data being fraudulently registered by the determination apparatus without being noticed by the terminal apparatus. For example, if data that makes a Hamming vector obtained by an exclusive-OR operation with the arbitrary biological information encrypted by the terminal apparatus sufficiently small is fraudulently registered, there arises a risk of authentication succeeding regardless of biological information input in the terminal apparatus.

SUMMARY

According to one aspect of the disclosure, there is provided a non-transitory computer-readable storage medium storing a computer program that causes a computer, which holds a first key, and receives authentication object data upon authentication, to perform a process including: generating a key different from the first key and transmitting the different key to a determination apparatus, when registering encrypted registration data in a calculation apparatus by communicating with the calculation apparatus and the determination apparatus that uses a second key upon the authentication, the encrypted registration data being obtained by encrypting registration data twice, once with the first key and once with the second key, the registration data being data against which the authentication object data is verified; and generating encrypted data by encrypting the registration data twice, once with the first key and once with the different key, and transmitting the encrypted data to the calculation apparatus.

DESCRIPTION OF EMBODIMENTS

Hereinafter, embodiments will be described with reference to the accompanying drawings. Like reference numerals refer to like elements throughout, and a description of like elements will not be repeated.

(1) First Embodiment

A first embodiment will be described with reference toFIG. 1.FIG. 1illustrates an example of a cryptographic processing apparatus according to a first embodiment. A cryptographic processing apparatus10is an example of the cryptographic processing apparatus according to the first embodiment. In the drawings and the following discretion, an exclusive-OR operation and a function in CTR mode for AES encryption may be represented by the symbol “^” for convenience of display. Note that in place of an encryption key K, random numbers generated by the encryption key K may be used for encryption.

As illustrated inFIG. 1, the cryptographic processing apparatus10includes a communication unit11and a computing unit12. Note that the cryptographic processing apparatus10may further include a volatile storage device (not illustrated) such as a random access memory (RAM) and the like, and a non-volatile storage device (not illustrated) such as a hard disk drive (HDD), a flash memory, and the like. The cryptographic processing apparatus10is capable of communicating with a calculation apparatus20and a determination apparatus30. It is desirable to apply an encrypted communication technique such as, for example, the Secure Socket Layer (SSL) and the like to the communication line used for communication with each apparatus.

The communication unit11is a communication circuit, a network interface, or the like for communicating with the calculation apparatus20and the determination apparatus30via a wired or wireless communication line. The computing unit12is a processor such as a central processing unit (CPU), a digital signal processor (DSP), and the like. Alternatively, the computing unit12may be an electronic circuit such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), and the like. The computing unit12executes programs stored in a memory such as a non-volatile storage device and other portable storage media, for example.

The cryptographic processing apparatus10holds a first key KA1, and receives authentication object data upon authentication. In the calculation apparatus20, encrypted registration data C2obtained by encrypting registration data mAtwice, once with the first key KA1and once with a second key KA2, is registered. The registration data mAis data against which the authentication object data is verified. The determination apparatus30uses the second key KA2upon the authentication.

The registration data mAis an example of authentication information. The authentication object data is an example of authentication object information. The registration data mAand the authentication object data may be, for example, biological information of the user, or a physical unclonable function (PUF) of an electronic circuit managed by the cryptographic processing apparatus10or the user.

When registering the encrypted registration data C2in the calculation apparatus20, the computing unit12generates a key K different from the first key KA1. Further, the computing unit12generates encrypted data C1by encrypting the registration data mAtwice, once with the first key KA1and once with the different key K. Further, the computing unit12transmits the different key K to the determination apparatus30through the communication unit11.

For example, the computing unit12calculates an exclusive OR of the first key KA1, the different key K, and the registration data mA(mA^KA1^K=EK(EKA1(mA)), and transmits the calculation result as encrypted data C1to the calculation apparatus20. In this step, the computing unit12transmits, to the calculation apparatus20, ID (A) of a user A for whom the registration data mAis registered. Further, the computing unit12transmits the encrypted data C1to the calculation apparatus20through the communication unit11.

For example, if the different key K is the second key KA2, the encrypted data C1is identical to the encrypted registration data C2. Accordingly, the calculation apparatus20performs registration of the encrypted registration data C2, using the encrypted data C1. Further, the determination apparatus30holds the different key K received from the cryptographic processing apparatus10as the second key KA2.

As another example, assume that the different key K is a temporary key that is newly generated each time the encrypted registration data C2is registered in the calculation apparatus20. In this case, the determination apparatus30generates encrypted key data by encrypting the second key KA2that is held therein in advance, using the different key K (temporary key) received from the cryptographic processing apparatus10. Then, the determination apparatus30transmits the encrypted key data to the calculation apparatus20. For example, the determination apparatus30calculates an exclusive OR of the different key K and the second key KA2(KA2^K=EK(KA2)), and transmits the calculation result as encrypted key data to the calculation apparatus20.

Having received the encrypted key data, the calculation apparatus20generates encrypted registration data C2, using the encrypted data C1and the encrypted key data. For example, the calculation apparatus20calculates an exclusive OR of the encrypted data C1and the encrypted key data (EK(EKA1(mA))^EK(KA2)=EKA2(EKA1(mA))), and obtains the calculation result as encrypted registration data C2. Then, the calculation apparatus20performs registration of the encrypted registration data C2.

In both cases, the encrypted data C1obtained by encrypting the registration data mAis directly transmitted from the cryptographic processing apparatus10to the calculation apparatus20. Thus, upon registration of the encrypted registration data C2, it is possible to reduce the risk of fraudulent data being registered in the calculation apparatus20by the determination apparatus30without being noticed by the cryptographic processing apparatus10.

The above is a description of the first embodiment.

(2) Second Embodiment

The following describes a second embodiment. The second embodiment relates to an authentication system using a scheme (hereinafter referred to as a “redundant Vernam cipher scheme”) that encrypts each of authentication object information and authentication information twice by an encryption process based on an exclusive-OR operation. Note that in the drawings and the following discretion, an exclusive-OR operation and a function in CTR mode for AES encryption may be represented by the symbol “^” for convenience of display. Further, data obtained by encrypting data X with an encryption key K may be represented as “EK(X)”. Note that in place of the encryption key K, random numbers generated by the encryption key K may be used for encryption.

The following describes the characteristics of the exclusive-OR operation.

According to the exclusive-OR operation, (X1^X2)^X2=X1holds, where X1and X2are arbitrary bit strings. That is, two identical bit strings X2cancel each other out in the exclusive-OR operation. Further, X1^X2=X2^X1holds. Accordingly, EK1(EX(X1))^EK2(EX(X2))=(X1^K^K1)^(X2^K^K2)=(X1^X2)^K1^K2=EX1(EX2)(HV)) holds, where HV≡X1^X2.

The authentication system of the second embodiment uses the above-described characteristics of the exclusive-OR operation. Note that the authentication system of the second embodiment may be constructed using another encryption function having these characteristics, in place of the exclusive-OR operation. It is obvious that such a modification also falls within the technical scope of the second embodiment.

(2-1) Authentication System

An authentication system according to the second embodiment will be described with reference toFIG. 2.FIG. 2illustrates an example of an authentication system according to the second embodiment.

As illustrated inFIG. 2, the authentication system of the second embodiment includes a terminal apparatus100, a calculation apparatus200, and a determination apparatus300.

The terminal apparatus100, the calculation apparatus200, and the determination apparatus300are connected to each other via a communication line. The communication line may be, for example, a dedicated line that safely connects between the terminal apparatus100and the calculation apparatus200, between the terminal apparatus100and the determination apparatus300, and between the calculation apparatus200and the determination apparatus300. Further, it is preferable to use a public communication network as a communication line, and employ a method that ensures security using a technique such as SSL, virtual private network (VPN), and the like.

In the case where the authentication system is applied to systems in financial institutions, for example, an automated teller machine (ATM) terminal having a function of reading the vein pattern of the palm, finger, or the like is an example of the terminal apparatus100. Further, in the case where the authentication system is applied to systems for electronic commerce and electronic payment, a user's computer connected to a device for reading fingerprint, iris pattern, and the like is an example of the terminal apparatus100. Other than these examples, the authentication system of the second embodiment may be applied to arbitrary systems that provide an authentication service.

Verification data MA, verification data MB, and so on are input to the terminal apparatus100. The verification data MA, verification data MB, and so on are examples of authentication object information. Further, the verification data MA, verification data MB, and so on are respectively verified against registration data mA, registration data mB, and so on, which are authentication information. The terminal apparatus100holds first encryption keys KA1, KB1, and so on. The first encryption keys KA1, KB1, and so on are used for encryption of the verification data MA, verification data MB, and so on, respectively. The calculation apparatus200holds encrypted registration data EKA2(EKA1(mA)), encrypted registration data EKB2(EKB1(mB)), and so on. The determination apparatus300holds second keys KA2, KB2, and so on.

The encrypted registration data EKA2(EKA1(mA)) is data obtained by encrypting the registration data mAwith the first encryption key KA1and the second encryption key KA2. That is, the encrypted registration data EKA2(EKA1(mA)) is given by equation (1) below. Further, the encrypted registration data EKB2(EKB1(mB)) is data obtained by encrypting the registration data mBwith the first encryption key KB1and the second encryption key KB2. That is, the encrypted registration data EKB2(EKB1(mB)) is given by equation (2) below.
EKA2(EKA1(mB))=mA^KA1^KA2   (1)
EKB2(EKB1(mB))=mB^KB1^KB2   (2)

In the following description, for ease of explanation, the authentication system illustrated inFIG. 2is assumed. Further, the following description focuses on a process of verifying the verification data MAagainst the registration data mA, and a process of registering the encrypted registration data EKA2(EKA1(mA)).

The following describes an example of a verification process in the authentication system with reference toFIG. 3. Note thatFIG. 3illustrates an example of a verification process in the authentication system.

As illustrated inFIG. 3, having received an input of the verification data MA, the terminal apparatus100transmits a determination request of the verification data MAof the user A to the determination apparatus300(S11). Then, the terminal apparatus100calculates encrypted data EKA1(MA), using the first encryption key KA1, as indicated in equation (3) below (S12). Then, the terminal apparatus100transmits, to the calculation apparatus200, the encrypted data EKA1(MA) together with the ID of the user A who entered the verification data MA(S13).
EKA1(MA)=MA^KA1   (3)

Having received the ID of the user A and the encrypted data EKA1(MA), the calculation apparatus200extracts encrypted registration data EKA2(EKA1(mA)) corresponding to the received ID. Then, the calculation apparatus200calculates encrypted distance data EKA2(HV) given by equation (4) below, using the encrypted registration data EKA2(EKA1(mA)) and the encrypted data EKA1(MA) (S14). Then, the calculation apparatus200transmits the encrypted distance data EKA2(HV) to the determination apparatus300(S15).
EKA2(HV)=EKA1(MA)^EKA2(EKA1(mA))   (4)

Having received the encrypted distance data EKA2(HV), the determination apparatus300calculates a Hamming vector MV, using the second encryption key KA2, as indicated in equation (5) below (S16). Then, the determination apparatus300compares a length Len(HV) of the Hamming vector HV with a predetermined threshold Th so as to determine whether Len(HV)>Th holds (S17).

For example, the length Len(HV) of the Hamming vector HV is the number of bits whose bit value in the HV is “1”. If the HV is “00000101”, Len(HV) is 2.

If Len(HV)>Th is determined to hold in step S17, the determination apparatus300transmits a determination result indicating a failure of authentication (failed authentication) to the terminal apparatus100(S18). On the other hand, if Len(HV)>Th is determined not to hold in step S17, the determination apparatus300transmits a determination result indicating a success of authentication (successful authentication) to the terminal apparatus100(S18). When the processing of step S18is completed, the verification process ofFIG. 3ends.
HV=EKA2(HV)^KA2   (5)

(Example of Registration Process)

The following describes an example of a registration process in the authentication system with reference toFIG. 4. Note thatFIG. 4illustrates an example of a registration process in the authentication system.

As illustrated inFIG. 4, the terminal apparatus100having started a registration process calculates encrypted data EKA1(mA) given by equation (6) below, using the first encryption key KA1and the registration data mA(S21). Then, the terminal apparatus100transmits, to the determination apparatus300, the ID of the user A and the encrypted data EKA1(mA) together with a registration request (S22).
EKA1(mA)=mA^KA1   (6)

Having received the registration request, the ID, and the encrypted data EKA1(mA), the determination apparatus300calculates encrypted registration data EKA1(EKA2(mA)) given by equation (7) below, using the second key KA2and the encrypted data EKA1(mA) (S23). Then, the determination apparatus300transmits the encrypted registration data EKA1(EKA2(mA)) calculated in step S23to the calculation apparatus200(S24).
EKA1(EKA2(mA))=EKA1(mA)^KA2   (7)

Having received the encrypted registration data EKA1(EKA2(mA)), the calculation apparatus200registers the encrypted registration data EKA1(EKA2(mA)) (S25). When the processing of step S25is completed, the registration process ofFIG. 4ends.

(Unauthorized Registration by Determination Apparatus)

According to the authentication system ofFIG. 2, it is possible to execute the registration process ofFIG. 4. However, in the case where the mechanism of the registration process ofFIG. 4is applied, there might be a risk of unauthorized registration by the determination apparatus300illustrated inFIG. 5.FIG. 5illustrates an example of unauthorized registration by the determination apparatus300included in the authentication system.

The processing of steps S21and S22ofFIG. 5is the same as the processing of steps S21and S22ofFIG. 4. However, in the example ofFIG. 5, as illustrated in the box denoted by a reference symbol Q, the determination apparatus300generates fraudulent data YY (S31), and transmits the fraudulent data YY to the calculation apparatus200(S32). The fraudulent data YY may be KA2, for example. In this case, the calculation apparatus200registers the above fraudulent data YY (S33).

In the case where the fraudulent data YY (YY=KA2) is registered in the calculation apparatus200, the following unauthorized processing might be performed in the verification process.

For example, in the verification process illustrated inFIG. 3, when a malicious terminal apparatus100transmits binary data “00 . . . 0” whose bit values are all “0” as authentication object information in the processing of step S13, the calculation apparatus200performs an operation represented by equation (8) below. In this case, HV is binary data whose bit values are all “0”. That is, Len(HV)=0. Accordingly, Len(HV)≦Th, so that the authentication succeeds.
(00 . . . 0)^YY=EKA2(00 . . . 0)   (8)

In the case where the mechanism of the registration process ofFIG. 4is applied, there might be a risk of unauthorized registration by the determination apparatus300illustrated inFIG. 5. There might also be a risk of attack by a third party. That is, instead of the determination apparatus300registering data, a third party might register the fraudulent data YY in the calculation apparatus200, by interrupting the communication between the determination apparatus300and the calculation apparatus200and impersonating the determination apparatus300. Accordingly, the second embodiment proposes a method that provides the authentication system with a mechanism of allowing the terminal apparatus100to directly register data in the calculation apparatus200.

(Direct Registration by Terminal Apparatus)

The following describes a method of allowing the terminal apparatus100to directly register the encrypted registration data EKA2(EKA1(mA)) in the calculation apparatus200with reference toFIG. 6.FIG. 6illustrates an example of direct registration by the terminal apparatus100according to the second embodiment.

As illustrated inFIG. 6, the terminal apparatus100having started a registration process generates a first encryption key KA1and a second encryption key KA2(S101). Then, the terminal apparatus100calculates encrypted registration data EKA2(EKA1(mA)) given by equation (9) below, using the registration data mA, the first encryption key KA1, and the second encryption key KA2(S102). Then, the terminal apparatus100transmits, to the calculation apparatus200, the ID of the user A and the encrypted registration data EKA2(EKA1(mA)) calculated in step S102, together with a registration request (S103).
EKA2(EKA1(mA))=mA^KA1^KA2   (9)

Having received the encrypted registration data EKA2(EKA1(mA)), the calculation apparatus200performs registration of the encrypted registration data EKA2(EKA1(mA)) (S104). Further, the terminal apparatus100transmits the second encryption key KA2generated in step S101to the determination apparatus300(S105). Having received the second encryption key KA2, the determination apparatus300holds the received second encryption key KA2(S106). When the processing of step S106is completed, a series of processing steps illustrated inFIG. 6ends. Note that the processing of steps S105and S106may be performed before step S102.

According to the above method, since the encrypted registration data EKA2(EKA1(mA)) is directly transmitted from the terminal apparatus100to the calculation apparatus200, the risk of unauthorized registration by the determination apparatus300is avoided. Further, since the second encryption key KA2used for calculation of the encrypted registration data EKA2(EKA1(mA)) is transmitted to the determination apparatus300, it is possible to execute a verification process by the authentication system illustrated inFIG. 3.

The above is a description of the authentication system of the second embodiment. The following further describes each apparatus of the authentication system of the second embodiment.

The hardware capable of realizing the functions of the terminal apparatus100will be described with reference toFIG. 7.FIG. 7illustrates an example of the hardware capable of realizing the functions of a cryptographic processing apparatus according to the second embodiment.

The functions of the terminal apparatus100may be realized using the hardware resources of an information processing apparatus illustrated inFIG. 7, for example. That is, the functions of the terminal apparatus100are realized by controlling the hardware illustrated inFIG. 7, using a computer program.

As illustrated inFIG. 7, the hardware mainly includes a CPU902, a read only memory (ROM)904, a RAM906, a host bus908, and a bridge910. The hardware further includes an external bus912, an interface914, an input unit916, an output unit918, a storage unit920, a drive922, a connection port924, and a communication unit926.

The CPU902functions as, for example, an arithmetic processing unit or a control device, and controls all or part of the operations of the components in accordance with various programs recorded in the ROM904, the RAM906, the storage unit920, or a removable storage medium928. The ROM904is an example of a storage device that stores programs to be read by the CPU902, data used for computation, and the like. The RAM906temporarily or permanently stores, for example, a program to be read by the CPU902, various parameters that change when the program is executed, and the like.

These components are connected to each other via the host bus908capable of high speed data transmission. The host bus908is connected to the external bus912having a relatively low data transmission speed via, for example, the bridge910. The input unit916may be, for example, a mouse, a keyboard, a touch panel, a button, a switch, a lever, or the like. Further, the input unit916may be a remote controller capable of transmitting a control signal using infrared rays or other electronic waves.

The output unit918may be, for example, a display device such as a cathode ray tube (CRT), a liquid crystal display (LCD), a plasma display panel (PDP), an electro-luminescence display (ELD), and the like. Further, the output unit918may be an audio output device such as a speaker, a headphone, and the like, or may be a printer. That is, the output unit918is a device capable of visually or audibly outputting information.

The storage unit920is a device for storing various types of data. The storage unit920may be, for example, a magnetic storage device such as a hard disk drive (HDD) and the like. Further, the storage unit920may be a semiconductor storage device (such as a solid state drive (SSD), a RAM disk, and the like), an optical storage device, a magneto-optical storage device, or the like.

The drive922is a device that reads information recorded in the removable storage medium928as a detachable storage medium, or writes information to the removable storage medium928. The removable storage medium928may be, for example, a magnetic disk, an optical disc, a magneto-optical disk, a semiconductor memory, or the like.

The connection port924is a port for connecting an externally connected device930, such as a universal serial bus (USB) port, an IEEE1394 port, a small computer system interface (SCSI), an RS-232C port, an optical audio terminal, and the like. The externally connected device930may be a printer or the like, for example.

The communication unit926is a communication device for connection to a network932. The communication unit926may be, for example, a communication circuit for a wired or wireless local area network (LAN), a communication circuit for a wireless USE (WUSB), a communication circuit and a router for optical communication, a communication circuit and a router for asymmetric digital subscriber line (ADSL), a communication circuit for a cellular phone network, or the like. The network932connected to the communication unit926is a network connected with a wire or wirelessly, and includes, for example, the Internet, a LAN, a broadcasting network, a satellite communication network, or the like.

The above is a description of the hardware capable of realizing the functions of the terminal apparatus100. Note that it is possible to realize the functions of the calculation apparatus200and the determination apparatus300using the hardware illustrated inFIG. 6. Accordingly, a detailed description of the hardware capable of realizing the functions of the calculation apparatus200and the determination apparatus300is omitted.

(2-3) Functions of Apparatus

The following describes the functions of each apparatus included in the authentication system of the second embodiment.

The following describes the functions of the terminal apparatus100with reference toFIG. 8.FIG. 8is a block diagram illustrating an example of functions of the terminal apparatus100according to the second embodiment.

As illustrated inFIG. 8, the terminal apparatus100includes a storage unit101, a key generation unit102, a logical operation unit103, and a communication unit104.

Note that the functions of the storage unit101may be realized using the RAM906, the storage unit920, and so on described above. Further, the functions of the key generation unit102and the logical operation unit103may be realized using the CPU902and so on described above. Further, the functions of the communication unit104may be realized using the connection port924, the communication unit926, and so on described above.

The storage unit101stores a first encryption key101aand registration data101b. Note that the above-described first encryption keys KA1, KB1, and so on are examples of the first encryption key101a. Further, the registration data mA, the registration data mB, and so on are examples of the registration data101b. For purposes of simplicity, the following description focuses on the first encryption key KA1and the registration data mA.

When performing registration of the registration data mA, the key generation unit102generates the first encryption key KA1and the second encryption key KA2. The first encryption key KA1and the second encryption key KA2generated by the key generation unit102are input to the logical operation unit103. Further, the first encryption key KA1is stored in the storage unit101, and the second encryption key KA2is input to the communication unit104.

Having received the input of the first encryption key KA1and the second encryption key KA2, the logical operation unit103reads the registration data mAfrom the storage unit101. Further, the logical operation unit103performs an exclusive-OR operation of the registration data mA, the first encryption key KA1and the second encryption key KA2so as to generate encrypted registration data EKA2(EKA1(mA)), as indicated in equation (10) below. The encrypted registration data EKA2(EKA1(mA)) generated by the logical operation unit103is input to the communication unit104.
EKA2(EKA1(mA))=mA^KA1^KA2   (10)

The communication unit104transmits the second encryption key KA2generated by the key generation unit102to the determination apparatus300. Further, the communication unit104transmits the encrypted registration data EKA2(EKA1(mA)) generated by the logical operation unit103to the calculation apparatus200. While registration of the registration data mAhas been described, registration of other registration data me and so on is performed in the same manner. Further, the storage unit101, the logical operation unit103, and the communication unit104are used also in the verification process.

The following describes the functions of the calculation apparatus200with reference toFIGS. 9 and 10.FIG. 9is a block diagram illustrating an example of functions of the calculation apparatus200according to the second embodiment.FIG. 10illustrates an example of encrypted registration data according to the second embodiment.

As illustrated inFIG. 9, the calculation apparatus200includes a storage unit201, a communication unit202, and a logical operation unit203.

Note that the functions of the storage unit201may be realized using the RAM906, the storage unit920, and so on described above. Further, the functions of the communication unit202may be realized using the connection port924, the communication unit926, and so on described above. Further, the functions of the logical operation unit203may be realized using the CPU902and so on described above.

The storage unit201stores encrypted registration data201a. For example, as illustrated inFIG. 10, the encrypted registration data201ais managed by a database in which the ID of the user and the encrypted registration data201aare associated with each other. In the example ofFIG. 10, the ID of the user A and the encrypted registration data EKA2(EKA1(mA)) are associated with each other, and the ID of the user B and the encrypted registration data EKA2(EKB1(mB)) are associated with each other.

For example, the communication unit202receives the ID of the user A and the encrypted registration data EKA2(EKA1(mA)) from the terminal apparatus100. Then, the communication unit202stores the ID of the user A and the encrypted registration data EKA2(EKA1(mA)) in association with each other in the storage unit201. Thus, the processing by the calculation apparatus200for registration of the registration data mAis completed. While registration of the encrypted registration data EKA2(EKA1(mA)) has been described, registration of other encrypted registration data EKB2(EKB1(mB)) and so on is performed in the same manner.

Note that the logical operation unit203is used in the verification process. For example, when the communication unit202receives the encrypted data EKA1(MA) from the terminal apparatus100, the logical operation unit203performs an exclusive-OR operation (see the above equation (4)) of the encrypted registration data EKA2(EKA1(mA)) registered in the storage unit201and the encrypted data EKA1(MA) so as to calculate the encrypted distance data EKA2(HV). Then, the logical operation unit203transmits encrypted distance data EKA2(HV) to the determination apparatus300through the communication unit202.

The following describes the functions of the determination apparatus300with reference toFIG. 11.FIG. 11is a block diagram illustrating an example of functions of the determination apparatus300according to the second embodiment.

As illustrated inFIG. 11, the determination apparatus300includes a storage unit301, a communication unit302, a logical operation unit303, and a determination unit304.

Note that the functions of the storage unit301may be realized using the RAM906, the storage unit920, and so on described above. The functions of the communication unit302may be realized using the connection port924, the communication unit926, and so on described above. The functions of the logical operation unit303and the determination unit304may be realized using the CPU902and so on described above.

The storage unit301stores a second encryption key301a. Note that the above-described second encryption keys KA2, KB2, and so on are examples of the second encryption key301a.

When performing registration of the registration data mA, the communication unit302receives the second encryption key KA2from the terminal apparatus100. Then, the communication unit302stores the second encryption key KA2in the storage unit301. Thus, the processing by the determination apparatus300for registration of the registration data mAis completed. While registration of the registration data mAhas been described, registration of other registration data me and so on is performed in the same manner.

Note that the logical operation unit303and the determination unit304are used in the verification process. For example, when the communication unit302receives a determination request of the verification data MAto be verified against the registration data mA, the communication unit302inputs the ID of the user A to the logical operation unit303. After that, when the communication unit302receives the encrypted distance data EKA2(HV) from the calculation apparatus200, the logical operation unit303performs an exclusive-OR operation (see the above equation (5)) of the encrypted distance data EKA2(HV) and the second encryption key KA2so as to calculate the Hamming vector HV (HV=mA^MA).

The Hamming vector HV calculated by the logical operation unit303is input to the determination unit304. Having received the input of the Hamming vector HV, the determination unit304calculates a Len(HV) of the Hamming vector HV, and compares the Len(HV) with the predetermined threshold Th. If Len(HV)>Th holds, the determination unit304transmits a determination result indicating a failure of authentication (failed authentication) to the terminal apparatus100through the communication unit302. If Len(HV)>Th does not hold, the determination unit304transmits a determination result indicating a success of authentication (successful authentication) to the terminal apparatus100through the communication unit302.

The above is a description of the functions of each apparatus included in the authentication system of the second embodiment.

As described above, in the authentication system of the second embodiment, the terminal apparatus100directly registers the encrypted registration data EKA2(EKA1(mA)) in the calculation apparatus200. Therefore, upon registration, it is possible to reduce the risk of fraudulent data being registered in the calculation apparatus200by the determination apparatus300without being noticed by the terminal apparatus100.

(2-4) Use of Key Generation Function

The following describes use of a key generation function with reference toFIG. 12.FIG. 12illustrates use of a key generation function according to the second embodiment.

In the above, a mechanism has been described in which the terminal apparatus100generates the first encryption key KA1and the second encryption key KA2and the terminal apparatus100directly registers the encrypted registration data EKA2(EKA1(mA)) in the calculation apparatus200.

In the case where the above mechanism is applied, if the first encryption key KA1and the second encryption key KA2are leaked from the terminal apparatus100, there arises a risk of the registration data mAbeing leaked from the encrypted registration data EKA2(EKA1(mA)) held by the calculation apparatus200. Accordingly, a mechanism for the terminal apparatus100to safely manage the first encryption key KA1and the second encryption key KA2is provided.

One example of such a mechanism may be a method that, after registration, stores the first encryption key KA1in an integrated circuit (IC) card with tamper resistance, and deletes the first encryption key KA1and the second encryption key KA2from the terminal apparatus100. Thus, each time a verification process is executed, the first encryption key KA1is read from the IC card. Another example may be a method that generates a pair of the first encryption key KA1and the second generation key KA2from a password, using a key generation function and an encryption function, as illustrated inFIG. 12.

The key generation function may be, for example, a password-based key derivation function (PBKDF) defined by the Public Key Cryptography Standards (PKCS) #5 or the like. When a password, a random number, a salt, parameters (iteration count and the bit length of the encryption key) and the like are input to the PBKDF, an encryption key is output. In the example ofFIG. 12, an intermediate key Km is output from a key generation function.

The intermediate key Km output from the key generation function is input to two encryption functions. The encryption functions may be, for example, a hash function, other one-way functions, or the like. A fixed value MU1is input to one of the encryption functions, and a fixed value MU2(MU1≠MU2) is input to the other one of the encryption functions. The two fixed values MU1and MU2are set for each user.

The terminal apparatus100(key generation unit102) uses an output of one of the encryption functions as the first encryption key KA1, and an output of the other one of the encryption functions as the second encryption key KA2. Thus, using a key generation function reduces the risk of the first encryption key KA1and the second encryption key KA2from being leaked from the terminal apparatus100. Further, the cost is reduced compared to the case where an IC card is used.

The above is a description of use of a key generation function.

(2-5) Operations of Apparatus

The following describes the operations of each apparatus included in the authentication system of the second embodiment. Note that the following describes operations for registration of the registration data mA.

First, the operations of the terminal apparatus100will be described with reference toFIG. 13.FIG. 13is a flowchart illustrating exemplary operations of the terminal apparatus100according to the second embodiment.

As illustrated inFIG. 13, the terminal apparatus100having started a registration process of the registration data mAof the user A causes the key generation unit102to generate a first encryption key KA1and a second encryption key KA2(S111). Then, the terminal apparatus100causes the communication unit104to transmit the second encryption key KA2generated in step S111to the determination apparatus300(S112). Note that the processing of step S112may be executed after the processing of step S113or S114described below.

Then, the terminal apparatus100causes the logical operation unit103to perform an exclusive-OR operation (see the above equation (9)) of the registration data mA, the first encryption key KA1, and the second encryption key KA2so as to calculate encrypted registration data EKA2(EKA1(mA)) (S113). Then, the terminal apparatus100causes the communication unit104to transmit, to the calculation apparatus200, the encrypted registration data EKA2(EKA1(mA)) calculated in step S113, together with the ID of the user A (S114). When the processing of step S114is completed, a series of processing steps illustrated inFIG. 13ends.

Next, the operations of the determination apparatus300will be described with reference toFIG. 14.FIG. 14is a flowchart illustrating exemplary operations of the determination apparatus300according to the second embodiment.

As illustrated inFIG. 14, the determination apparatus300receives the second encryption key KA2from the terminal apparatus100through the communication unit302(S121). Then, the determination apparatus300causes the communication unit302to store the second encryption key KA2received in step S121in the storage unit301(S122). When the processing of step S122is completed, a series of processing steps illustrated inFIG. 14ends.

Next, the operations of the calculation apparatus200will be described with reference toFIG. 15.FIG. 15is a flowchart illustrating exemplary operations of the calculation apparatus200according to the second embodiment.

As illustrated inFIG. 15, the calculation apparatus200receives the encrypted registration data EKA2(EKA1(mA)) from the terminal apparatus100through the communication unit202(S131). Then, the calculation apparatus200stores the encrypted registration data EKA2(EKA1(mA)) received in step S131in the storage unit201(S132). When the processing of step S132is completed, a series of processing steps illustrated inFIG. 15ends.

The above is a description of the operations of each apparatus included in the authentication system of the second embodiment.

As described above, the terminal apparatus100directly registers the encrypted registration data EKA2(EKA1(mA)) in the calculation apparatus200. Thus, it is possible to reduce the risk of fraudulent data being registered in the calculation apparatus200by the determination apparatus300.

The above is a description of the second embodiment.

The following describes a modification (hereinafter referred to as the “present modification”) of the second embodiment. The present modification relates to a method that allows the terminal apparatus100to directly register encrypted data of the registration data mAin the calculation apparatus200in a situation where the determination apparatus300holds the second encryption key KA2in advance and the terminal apparatus100does not hold the second encryption key KA2.

(Method Using Temporary Key for Preventing Unauthorized Registration)

The above method according to the present modification will be described with reference toFIG. 16.FIG. 16illustrates an example of direct registration by the terminal apparatus100according to the present modification of the second embodiment. This method uses a temporary key Kt that is updated each time registration is performed.

As illustrated inFIG. 16, the terminal apparatus100having started a registration process of the registration data mAgenerates a first encryption key KA1and a temporary key Kt (S201). Then, the terminal apparatus100performs an exclusive-OR operation of the registration data mA, the first encryption key KA1, and the temporary key Kt so as to calculate encrypted data EKt(EKA1(mA)) given by equation (11) below (S202).
EKt(EKA1(mA))=mA^KA1^Kt(11)

Then, the terminal apparatus100transmits, to the determination apparatus300, the temporary key Kt together with the ID of the user A (S203). Further, the terminal apparatus100transmits, to the calculation apparatus200, the ID of the user A and the encrypted data EKt(EKA1(mA)) calculated in step S202, together with a registration request (S204). Note that steps S203and S204may be performed in reverse order.

Having received the ID and the temporary key Kt, the determination apparatus300performs an exclusive-OR operation of the temporary key Kt and the second encryption key KA2so as to calculate encrypted key data EKt(KA2), as indicated in equation (12) below (S205). Then, the determination apparatus300transmits the encrypted key data EKt(KA2) calculated in step S205to the calculation apparatus200(S206).
EKt(KA2)=Kt^KA2   (12)

Having received the registration request, the ID, the encrypted data EKt(EKA1(mA)), and the encrypted key data EKt(KA2), the calculation apparatus200performs an exclusive-OR operation represented by equation (13) below so as to calculate encrypted registration data EKA2(EKA1(mA)) (S207). That is, in the processing of step S207, the calculation apparatus200performs an exclusive-OR operation of the encrypted data EKt(EKA1(mA)) and the encrypted key data EKt(KA2).
EKA2(EKA1(mA))=EKt(EKA1(mA))^EKt(KA2)   (13)

Then, the calculation apparatus200stores the encrypted registration data EKA2(EKA1(mA)) in the storage unit101, and registers the encrypted registration data EKA2(EKA1(mA)) (S208). When the processing of step S208is completed, a series of processing steps illustrated inFIG. 16ends.

As described above, using the temporary key Kt allows the terminal apparatus100to directly transmit the encrypted data of the registration data mAto the calculation apparatus200even if the determination apparatus300holds the second encryption key KA2in advance. As a result, it is possible to reduce the risk of fraudulent data being registered in the calculation apparatus200by the determination apparatus300.

(3-1) Functions of Apparatus

The following describes the functions of the terminal apparatus100, the calculation apparatus200, and the determination apparatus300according to the present modification. Note that the following describes functions modified from those ofFIGS. 8, 9, and 11, and a detailed description of the common functions will be omitted.

As for the terminal apparatus100, modifications are made mainly to the functions of the key generation unit102and the logical operation unit103. The key generation unit102of the present modification generates a first encryption key KA1and a temporary key Kt. Further, the logical operation unit103of the present embodiment calculates encrypted data EKt(EKA1(mA)) in accordance with the above equation (11). Then, the communication unit104transmits the temporary key Kt to the determination apparatus300instead of the second encryption key KA2, and transmits the encrypted data EKt(EKA1(mA)) to the calculation apparatus200instead of the encrypted registration data EKA2(EKA1(mA)).

As for the calculation apparatus200, modifications are made mainly to the functions of the logical operation unit203. The logical operation unit203according to the present modification calculates encrypted registration data EKA2(EKA1(mA)) in accordance with the above equation (13), based on the encrypted data EKt(EKA1(mA)) received from the terminal apparatus100and the encrypted key data EKt(KA2) received from the determination apparatus300.

As for the determination apparatus300, modifications are made mainly to the functions of the logical operation unit303. Further, the second encryption key KA2is stored in advance in the storage unit301. The logical operation unit303according to the present modification calculates encrypted key data EKt(KA2) in accordance with the above equation (12), based on the temporary key Kt received from the terminal apparatus100. Then, the communication unit302transmits the encrypted key data EKt(KA2) to the calculation apparatus200.

The above is a description of the functions of the terminal apparatus100, the calculation apparatus200, and the determination apparatus300according to the present modification. As described above, the first encryption key KA1is managed by the terminal apparatus100and the second encryption key KA2is managed by the determination apparatus300. This reduces the risk of both the first encryption key KA1and the second encryption key KA2being leaked and the registration data mAbeing stolen.

(3-2) Operations of Apparatus

The following describes the operations of each apparatus included in the authentication system according to the present modification. Note that the following describes the operations for registration of the registration data mA.

First, the operations of the terminal apparatus100according to the present modification will be described with reference toFIG. 17.FIG. 17is a flowchart illustrating exemplary operations of the terminal apparatus100according to the modification of the second embodiment.

As illustrated inFIG. 17, the terminal apparatus100causes the key generation unit102to generate a first encryption key KA1and a temporary key Kt (S211). Note that the first encryption key KA1and the temporary key Kt may be generated using the key generation functions illustrated inFIG. 12. Then, the terminal apparatus100causes the communication unit104to transmit the temporary key Kt generated in step S211to the determination apparatus300(S212).

Then, the terminal apparatus100causes the logical operation unit103to perform an exclusive-OR operation (see the above equation (11)) of the registration data mA, the first encryption key KA1, and the temporary key Kt so as to calculate encrypted data EKt(EKA1(mA)) (S213). Then, the terminal apparatus100causes the communication unit104to transmit, to the calculation apparatus200, the encrypted data EKt(EKA1(mA)) calculated in step S213, together with the ID of the user A (S214). When the processing of step S214is completed, a series of processing steps illustrated inFIG. 17ends.

The following describes the operations of the determination apparatus300according to the present modification with reference toFIG. 18.FIG. 18is a flowchart illustrating exemplary operations of the determination apparatus300according to the modification of the second embodiment.

As illustrated inFIG. 18, the determination apparatus300receives the temporary key Kt from the terminal apparatus100through the communication unit302(S221). Then, the determination apparatus300causes the logical operation unit303to perform an exclusive-OR operation (see the above equation (12)) of the temporary key Kt and the second encryption key KA2so as to calculate encrypted key data EKt(KA2) (S222).

Then, the determination apparatus300causes the communication unit302to transmit the encrypted key data EKt(KA2) calculated in step S222to the calculation apparatus200(S223). When the processing of step S223is completed, a series of processing steps illustrated inFIG. 18ends.

The following describes the operations of the calculation apparatus200according to the present modification with reference toFIG. 19.FIG. 19is a flowchart illustrating exemplary operations of the calculation apparatus200according to the modification of the second embodiment.

As illustrated inFIG. 19, the calculation apparatus200receives the encrypted data EKt(EKA1(mA)) from the terminal apparatus100through the communication unit202(S231). Then, the calculation apparatus200receives the encrypted key data EKt(KA2) from the determination apparatus300through the communication unit202(S232).

Then, the calculation apparatus200causes the logical operation unit203to calculate encrypted registration data EKA2(EKA1(mA)), using the encrypted data EKt(EKA1(mA)) received in step S231and the encrypted key data EKA2(KA2) received in step S232(S234). In the processing of step S234, the encrypted registration data EKA2(EKA1(mA)) is calculated in accordance with, for example, the above equation (13).

Then, the calculation apparatus200causes the logical operation unit203to store the encrypted registration data EKA2(EKA1(mA)) in the storage unit201(S235). When the processing of step S235is completed, a series of processing steps illustrated inFIG. 19ends.

The above is a description of the operations of each apparatus included in the authentication system of the present modification.

As described above, the terminal apparatus100directly transmits the encrypted data EKt(EKA1(mA)) related to the encrypted registration data EKA2(EKA1(mA)) to the calculation apparatus200. Thus, it is possible to reduce the risk of fraudulent data being registered in the calculation apparatus200by the determination apparatus300. Further, the first encryption key KA1is managed by the terminal apparatus100and the second encryption key KA2is managed by the determination apparatus300. This reduces the risk of both the first encryption key KA1and the second encryption key KA2being leaked and the registration data mAbeing stolen.

The above is a description of a modification of the second embodiment.

According to the present invention, it is possible to prevent unauthorized registration by a determination apparatus.