Patent Grant
11329808
The present invention relates to a secure computation technique and especially relates to a secure computation authentication technique for performing authentication processing with secure computation.
Use of a secure computation technique (see Non-patent Literature 1, for example) enables authentication processing to be performed while keeping authentication information (for example, a password) secret. A simple method is a method for computing a concealed verification value [w−ω]i corresponding to w−ω with secure computation by using concealed authentication information [w] of registered authentication information w and concealed authentication information [ω] of inputted authentication information ω. w=ω (successful authentication) is established when w−ω=0 and w≠ω (failed authentication) is established when w−ω≠0. Thus, the concealed verification value [w−ω] represents a concealed value of an authentication result.
However, the above-described method has a problem of low level of security against spoofing. In other words, in the case where an unauthorized concealed verification value, with which 0 is reconstructed even when w−ω≠0, is computed, authentication is determined to be successful even though w−ω≠0. Further, authentication information w and ω are kept secret, so that detecting such an unauthorized concealed verification value is difficult.
An object of the present invention is to provide a technique for performing authentication processing with high level of security against spoofing while keeping authentication information secret.
A secure computation device stores concealed authentication information [w]i∈[F]L which is a secret sharing value of authentication information w; receives input of concealed authentication information [ω]i∈[F]L which is a secret sharing value of authentication information ω; obtains a first concealed verification value [z]i=[w−ω]i with secure computation by using the concealed authentication information [w]i and the concealed authentication information [ω]i; obtains a concealed extension field random number [rm]i∈[Fε] which is a secret sharing value of an extension field random number rm; obtains a second concealed verification value [ym]i in which ym is concealed with secure computation by using the first concealed verification value [z]i; and obtains a third concealed verification value [rmym]i with secure computation by using the concealed extension field random number [rm]i and the second concealed verification value [ym]i and outputs the third concealed verification value [rmym]i. Here, L is an integer which is 1 or greater, ε is an integer which is 2 or greater, F is a finite field, Fε is an extension field of the finite field F, an extension degree of the extension field Fε is ε, ceil(x) is a minimum integer which is equal to or greater than a real number x, M=ceil(L/ε) holds, j=0, . . . , L−1 holds, m=0, . . . , M−1 holds, z=(z0, . . . , zL−1)=w−ω holds, zj∈F holds, ym=(zεm, . . . , zε(m+1)−1) holds for m=0, . . . , M−1, and zq by which q>L−1 is established among q=ε(M−1), . . . , εM−1 is 0.
Authentication processing with high level of security against spoofing can be performed while keeping authentication information secret.
Embodiments of the present invention are described below with reference to the accompanying drawings.
[General Outline]
A secure computation authentication system according to the embodiments includes N pieces of (a plurality of pieces of) secure computation devices P1, . . . , PN and a verification device. The verification device may be a device external to the N pieces of secure computation devices P1, . . . , PN or may be a device incorporated in any secure computation device Pi. Each secure computation device Pi stores concealed authentication information [w]i∈[F]L which is a secret sharing value of authentication information w in a storage. Here, i=1, . . . , N holds and N is an integer which is 2 or greater. “β1∈β2” represents that β1 belongs to β2. F denotes a finite field and L denotes an integer which is 1 or greater. The finite field F may be a prime field or may be an extension field. For example, L is an integer which is 2 or greater. [F] denotes a secret sharing value of an element of the finite field F and [F]L denotes a set composed of L pieces of [F]. [α]i denotes a secret sharing value of α assigned to the secure computation device Pi. Authentication information w is preliminarily registered for a qualified user. Authentication information w is not limited and may be any information such as a password, biometric authentication information, voice authentication information, and pattern authentication information. Each secure computation device Pi may store concealed authentication information [w]i respectively corresponding to a plurality of pieces of authentication information w or may store only concealed authentication information [w]i corresponding to a single piece of authentication information w. A secret sharing scheme for obtaining a secret sharing value is not limited and a well-known (K, N) secret sharing scheme (also referred to as a “K-out-of-N threshold secret sharing scheme”) such as a replicated secret sharing scheme (see Reference Literature 1, for example) and Shamir's secret sharing scheme (see Reference Literature 2, for example) may be employed. Here, K is an integer which is 2 or greater and satisfies K≥N. For example, K=2 holds. In the (K, N) secret sharing scheme, concealed secret information can be reconstructed if arbitrary K pieces of secret sharing values which are different from each other are provided, but any information of secret information cannot be obtained even if arbitrary K−1 pieces of secret sharing values are provided. Shamir's secret sharing scheme which is the (K, N) secret sharing scheme is referred to as a “(K, N) Shamir's secret sharing scheme” below.
Concealed authentication information [ω]i∈[F]L which is a secret sharing value of authentication information ω is inputted into an input unit of each secure computation device Pi. An arithmetic unit of each secure computation device Pi obtains a first concealed verification value [z]i=[w−ω]i with secure computation by using the concealed authentication information [w]i and the concealed authentication information [ω]i and outputs the first concealed verification value [z]i. [w−ω]i denotes a secret sharing value of w−ω. A secure computation method is not limited and a well-known secure computation method described in Non-patent Literature 1 and Reference Literature 3, for example, may be employed. The same goes for the following secure computation
A random number generation unit of each secure computation device Pi obtains and outputs a concealed extension field random number [rm]i∈[Fε] which is a secret sharing value of an extension field random number rm∈Fε. Here, ε denotes an integer which is 2 or greater, Fε denotes an extension field of the finite field F, and an extension degree of the extension field Fε is ε. ceil denotes a ceiling function and ceil(x) denotes the minimum integer which is equal to or greater than a real number x. m=0, . . . , M−1 holds and M=ceil(L/ε) is satisfied. M denotes an integer which is 1 or greater. For example, M is an integer which is 2 or greater. The concealed extension field random number [rm]i has to be generated in a state that the extension field random number rm is concealed from any secure computation device Pi. Such a method is well known and any method may be employed. For example, the secure computation devices P1, . . . , PN can generate the concealed extension field random number [rm]i in a coordinated manner. For instance, each secure computation device Pi′ computes a secret sharing value [rm,i′]i∈[Fε ] of an extension field random number rm,i′ and sends the secret sharing value [rm,i′]i to the secure computation device Pi (where i=1, . . . , N, i′=1, . . . , N, and i′≠i), and each secure computation device Pi obtains [rm]i=[rm,1+ . . . +rm,N]i with secure computation using secret sharing values [rm,1]i, . . . , [rm,N]i.
The arithmetic unit of each secure computation device Pi obtains a second concealed verification value [ym]i in which ym is concealed with secure computation using the first concealed verification value [z]i and outputs the second concealed verification value [ym]i. Here, z=(z0, . . . , zL−1)=w−ω, zj∈F, and j=0, . . . , L−1 hold, ym=(zεm, . . . , zε(m+1)−1) holds for m=0, . . . , M−1, and zq with which q>L−1 is established in q=ε(M−1), . . . , εM−1 is 0. zq with which q>L−1 is established may be expressed as zq=0 (that is, zq may be padded with 0) or information representing that zq with which q>L−1 is established is 0 may be added. The arithmetic unit of each secure computation device Pi may obtain each second concealed verification value [ym]i by dividing a sequence representing the first concealed verification value [z]i. If there is no zq with which q>L−1 is established, for example, the arithmetic unit of each secure computation device Pi may divide the first concealed verification value [z]i=[y0]i| . . . |[yM−1]i into M pieces so as to obtain [y0]i, . . . , [yM−1]i. Here, α1|α2 represents concatenation between α1 and α2. If there is zq with which q>L−1 is established, the arithmetic unit of each secure computation device Pi may divide the first concealed verification value [z]i=[y0]i| . . . |[yM−2]i|[y′M−1]i into [y0]i, . . . , [yM−2]i, [y′M−1]i and obtain a secret sharing value [0, . . . , 0]i of zq=0 for q>L−1 or a secret sharing value [0, . . . , 0]i of information representing that zq with which q>L−1 is established is 0 so as to establish [yM−1]i=[y′M−1]i|[0, . . . , 0]i.
The second concealed verification value [ym]i can be handled as a secret sharing value conforming to the (K, N) Shamir's secret sharing scheme on the extension field Fε of the order ε. The case of K=2 is explained. It is assumed that ym=(zεm, . . . , zε(m+1)−1) is obtained by expressing an element of the extension field of the order ε by a vector. That is, it is dealt as ym=(zεm, . . . , zε(m+1)−1)∈Fε. The secret sharing value [ym]i obtained by performing secret sharing of ym=(zεm, . . . , zε(m+1)−1)∈Fε in accordance with the (2, N) Shamir's secret sharing scheme on the extension field Fε of the order ε is expressed as follows.
This is because a polynomial for obtaining a secret sharing value in accordance with the (2, N) Shamir's secret sharing scheme on the extension field Fε of the order ε can be assumed to be g(χ)=y0+ysm·χ∈Fε. Here, ysm,0, . . . , ysm,ε−1 are respective members on a vector expression ysm=(ysm,0, . . . , ysm,ε−1)∈Fε of an extension field random number ysm∈Fε, and a vector expression of a coordinate axis I∈Fε corresponding to i is I=(i, 0, . . . , 0)∈Fε. Coordinate axis χ=(η, 0, . . . , 0)∈Fε holds and η denotes an integer variable. g(I) obtained when χ=I=(i, 0, . . . , 0) is [ym]i and g(0) obtained when χ=0=(0, 0, . . . , 0) is ym. As expressed in formula (1), this secret sharing value [ym]i is an element of the extension field Fε of the order ε. Here, when ym∈Fε, ysm∈Fε, and I∈Fε are expressed in a polynomial, the following is obtained.
ym=zεm+zεm+1·X+ . . . +zε(m+1)−1·Xε−1
ysm=sm,0+sm,1·X+ . . . +ysm,ε−1·Xε−1
I=i+0·X+ . . . +0·Xε−1
Accordingly, when ym+ysm·I∈Fε is expressed in a polynomial, the following is obtained.
Here, X satisfies ρ(X)=0 for an irreducible polynomial ρ(X) on the finite field F. Vectors whose members are respective coefficients of formula (2) are (zεm+ysm,0·i, . . . , zε(m+1)−1+ysm,ε−1·i). This shows that formula (1) is obtained when ym+ysm·I∈Fε is expressed in a vector.
A simple example is described in which L=2, ε=2, K=2, and N=3 hold and the finite field F is a prime field GF(5) of an order 5. When secret sharing of z0=0 and z1=0 is performed by a (2, 3) Shamir's secret sharing scheme on the prime field GF(5), examples of a z0 secret sharing value and a z1 secret sharing value corresponding to the secure computation device Pi are respectively f0(i)=z0+2i mod 5 and f1(i)=z1+i mod 5. Here, M=ceil(2/2)=1 holds and the second concealed verification value [y0]i=[(z0, z1)]i is expressed as [y0]i=[(z0+2i mod 5, z1+i mod 5)]i. That is, [y0]1=[(2, 1)]1, [y0]2=[(4, 2)]2, and [y0]3=[(1, 3)]3 are established. Here, the second concealed verification value [y0]i may be handled as a secret sharing value conforming to Shamir's secret sharing scheme on a quadratic extension field of GF(5): Fε=GF(52). This is because a polynomial for obtaining a secret sharing value in accordance with the (2, N) Shamir's secret sharing scheme can be assumed to be g(χ)=y0+ysm·χ∈GF(52). Here, it is assumed that secret information y0=(z0, z1), a random number ysm=(2, 1), and the coordinate axis χ=(η, 0) hold. η denotes an integer variable, g(I) obtained when χ=I=(i, 0) is [y0]i, and g(0) obtained when χ=(0, 0)=0 is y0. Thus, the second concealed verification value [ym]i can be handled as a secret sharing value conforming to the (K, N) Shamir's secret sharing scheme on the extension field Fε of the order ε.
The arithmetic unit of each secure computation device Pi obtains a third concealed verification value [rmym]i with secure computation by using the concealed extension field random number [rm]i and the second concealed verification value [ym]i and outputs the third concealed verification value [rmym]i. As described above, when the concealed authentication information [w]i is a secret sharing value conforming to the (K, N) Shamir's secret sharing scheme, the concealed authentication information [ω]i is a secret sharing value conforming to the (K, N) Shamir's secret sharing scheme, each second concealed verification value [ym]i is obtained by joining members of a sequence representing the first concealed verification value [z]i, and the concealed extension field random number [rm]i is a secret sharing value conforming to the (K, N) Shamir's secret sharing scheme, the arithmetic unit of each secure computation device Pi can obtain the third concealed verification value [rmym]i by using the second concealed verification value [ym]i as a secret sharing value conforming to the (K, N) Shamir's secret sharing scheme. The arithmetic unit of each secure computation device Pi performs computation (multiplication on the extension field Fε) of [rmym]i=[rm]i[ym]i, for example. Two multiplication results of secret sharing values conforming to the (K, N) Shamir's secret sharing scheme are secret sharing values conforming to a (2K−1, N) Shamir's secret sharing scheme. Accordingly, the third concealed verification value [rmym]i obtained as the above is a secret sharing value conforming to the (2K−1, N) Shamir's secret sharing scheme. When K=2, for example, the third concealed verification value [rmym]i is a secret sharing value conforming to a (3, N) Shamir's secret sharing scheme. That is, a secret sharing value [rm]i obtained by performing secret sharing of rm∈Fε in accordance with the (2, N) Shamir's secret sharing scheme on the extension field Fε of the order ε is expressed as the following, as is the case with formula (1).
[rm]i=rm+rsm·I (3)
Here, rsm∈Fε represents an extension field random number. Formula (2) and formula (3) show that the following can be satisfied.
This shows that [rmym]i is a secret sharing value of rmym conforming to the (3, N) Shamir's secret sharing scheme. This is because a polynomial for obtaining a secret sharing value in accordance with the (3, N) Shamir's secret sharing scheme on the extension field Fε of the order ε can be assumed to be g′(χ)=rm·ym+(rm·ys+rs·ym)·×χ+rs·ys·χ2∈Fε, and accordingly, g′(I) obtained when χ=I=(i, 0, . . . , 0) is [rmym]i and g′(0) obtained when χ=0=(0, 0, . . . , 0) is rm·ym.
Here, third concealed verification values [r0y0]i, . . . , [rM−1yM−1]i may be outputted as concealed values of authentication results (scheme 1). However, if each secure computation device Pi further performs the following processing, security can be further enhanced (scheme 2). In the scheme 2, the random number generation unit of each secure computation device Pi further obtains a second concealed extension field random number [Rm]i=Rm+Rsm·I∈Fε which is a secret sharing value of a second extension field random number Rm∈Fε in accordance with the (2, N) Shamir's secret sharing scheme on the extension field Fε of the order ε and outputs the second concealed extension field random number [Rm]i. As is the case with the above-described generation of the concealed extension field random number [rm]i, the second concealed extension field random number [Rm]i has to be generated in a state that the second extension field random number Rm is concealed from any secure computation device Pi. Such a method is well-known and any method may be employed. The arithmetic unit of each secure computation device Pi subsequently obtains an extension field multiplication value [Rm]i·I=Rm·I+Rsm·I2∈Fε by using the second concealed extension field random number [Rm]i and I and outputs the extension field multiplication value [Rm]i·I. The arithmetic unit of each secure computation device Pi further obtains a fourth concealed verification value [rmym]i+[Rm]i·I=rm·ym+(rm·ysm+rsm·ym+Rm)·I+(rsm·ysm+Rsm)·I2∈Fε by using the third concealed verification value [rmym]i and the extension field random number [Rm]i·I and outputs the fourth concealed verification value [rmym]i+[Rm]i·I. Here, [rmym]i+[Rm]i·I is a secret sharing value of rm·ym conforming to the (3, N) Shamir's secret sharing scheme on the extension field Fε of the order ε. This is because a polynomial for obtaining a secret sharing value in accordance with the (3, N) Shamir's secret sharing scheme on the extension field Fε of the order ε can be assumed to be g″(χ)=rm·ym+(rm·ysm+rsm·ym+Rm)·χ+(rsm·ysm+Rsm)·χ2∈Fε, and accordingly, g′(I) obtained when χ=I=(i, 0, . . . , 0) is [rmym]i and g′(0) obtained when χ=0=(0, 0, . . . , 0) is rm·ym.
The verification device determines that authentication is successful when rmym=0 is satisfied for all of m=0, . . . , M−1. On the other hand, the verification device determines that authentication is failed when rmym=0 is not satisfied for any of m=0, . . . , M−1. Processing of the verification device for the schemes 1 and 2 are described below.
In the scheme 1, when the third concealed verification value [rmym]i is a secret sharing value conforming to a (κ, N) Shamir's secret sharing scheme, at least κ pieces of third concealed verification values [rmym]φ(1), . . . , [rmym]φ(κ) which are mutually different are inputted into a reconstruction unit of the verification device and the reconstruction unit of the verification device reconstructs a verification value rmym by using the third concealed verification values [rmym]φ(1), . . . , [rmym]φ(κ) and outputs the verification value rmym. Here, κ is a positive integer which is from 1 to N inclusive and {φ(1), . . . , φ(κ)}⊆{1, . . . , N} holds. For example, when the third concealed verification value [rmym]i is a secret sharing value conforming to the (2K−1, N) Shamir's secret sharing scheme, the reconstruction unit of the verification device reconstructs a verification value rmym by using third concealed verification values [rmym]φ(1), . . . , [rmym]φ(2K−1) which are outputted from at least 2K−1 pieces of secure computation devices and outputs the verification value rmym. A determination unit of the verification device determines that authentication is successful when rmym=0 is satisfied in any authentication information w for all of in =0, . . . , M−1. On the other hand, when rmym=0 is not satisfied in all pieces of authentication information w for any m, authentication is determined to be failed. Alternatively, in the scheme 1, the verification device may perform an operation including secure computation using at least part of [r0y0]i, . . . , [rM−1yM−1]i and reconstruction and determine whether or not rmym=0 is satisfied for all of m=0, . . . , M−1 by using reconstructed values obtained through the operation. For example, the verification device may obtain secret sharing values [r0y0+ . . . +rM−1yM−1]μ with secure computation using [r0y0]μ, . . . , [rM−1yM−1]μ, and determine that rmym=0 is satisfied for all of m=0, . . . , M−1 when r0y0+ . . . +rM−1yM−1 reconstructed from these secret sharing values [r0y0+ . . . +rM−1yM−1]μ is 0 or determine that rmym=0 is not satisfied for any of m=0, . . . , M−1 when r0y0+ . . . +rM−1yM−1 is not 0. Here, μ=φ(1), . . . , φ(κ) holds.
In the scheme 2, the verification device performs an operation with respect to [rmym]φ(1)+[Rm]φ(1)·I, [rmym]φ(2)+[Rm]φ(2)·I, and [rmym]φ(3)+[Rm]φ(3)·I by using [rmym]φ(1)+[Rm]φ(1)·I, [rmym]φ(2)+[Rm]φ(2)·I, and [rmym]φ(3)+[Rm]φ(3)·I among the above-described fourth concealed verification values [rmym]i+[Rm]i·I in accordance with the (3, N) Shamir's secret sharing scheme on the extension field Fε of the order ε, and determines that authentication is successful when rmym=0 is satisfied for all of m=0, . . . , M−1. For example, [rmym]φ(1)+[Rm]φ(1)·I, [rmym]φ(2)+[Rm]φ(2)·I, and [rmym]φ(3)+[Rm]φ(3)·I are inputted into the reconstruction unit of the verification device and the reconstruction unit of the verification device reconstructs a verification value rmym by using these and outputs the verification value rmym. The determination unit of the verification device determines that authentication is successful when rmym=0 is satisfied in any authentication information w for all of m=0, . . . , M−1. On the other hand, when rmym=0 is not satisfied in all pieces of authentication information w for any m, authentication is determined to be failed. Alternatively, in the scheme 2, the verification device may perform an operation including secure computation using at least part of [r0y0]i″+[R0]i″·I″, . . . , [rM−1yM−1]i″+[RM−1]i″·I″ and reconstruction and determine whether or not rmym=0 is satisfied for all of m=0, . . . , M−1 by using reconstructed values obtained through the operation. Here, i″=φ(1), φ(2), φ(3) and I″=(i″, 0, . . . , 0)∈Fε hold. For example, the verification device may obtain a secret sharing value [r0y0+ . . . +rM−1yM−1]i″ with secure computation using [r0y0]i″+[R0]i″·I″, . . . , [rM−1yM−1]i″+[RM−1]i″·I″, and determine that rmym=0 is satisfied for all of m=0, . . . , M−1 when r0y0+ . . . +rM−1yM−1 obtained by reconstructing the secret sharing value [r0y0+ . . . +rM−1yM−1]i″ is 0 or determine that rmym=0 is not satisfied for any of m=0, . . . , M−1 when r0y0+ . . . +rM−1yM−1 is not 0.
In the above-described method, the use of the concealed extension field random number [rm]i can prevent generation of unauthorized concealed verification values, with which rmym=0 is reconstructed even when w−ω≠0, and resulting determination of successful authentication. Further, rmym=0 is established irrespective of a value of an extension field random number rm when w−ω=0, so that authentication is not determined to be failed even when w−ω=0. Further, since each processing is performed with secure computation, authentication processing can be performed while keeping authentication information secret. Thus, authentication processing with high level of security against spoofing can be performed while keeping authentication information secret.
A first embodiment according to the present invention is now described with reference to the accompanying drawings. The first embodiment is an example of the scheme 1.
<Configuration>
As illustrated in
As illustrated in
<Preprocessing>
A single piece or a plurality of pieces of concealed authentication information [w]i∈[F]L which is/are pre-registered is/are stored in the storage 123-i of each secure computation device 12-i (where i=1, . . . , N). Authentication information w itself is not made public to each secure computation device 12-i. A secret sharing scheme employed in the secure computation authentication system 1 is predetermined, and the user device 11, a plurality of pieces of secure computation devices 12-1, . . . , 12-N, and the verification device 13 perform secure computation with respect to a secret sharing value conforming to this secret sharing scheme.
<Secure Computation Authentication Processing>
As illustrated in
As illustrated in
On the other hand, when it is determined that the size of the concealed authentication information [ω]i and the size of the concealed authentication information [w]i are mutually identical, the arithmetic unit 125-i (first arithmetic unit) obtains a concealed verification value [z]i=[w−ω]i (first concealed verification value) with secure computation by using these concealed authentication information [ω]i and concealed authentication information [w]i as inputs and outputs the concealed verification value [z]i(step S125-i,
In step S1292-i, whether or not processing on and after step S123-i has been executed is determined for all pieces of concealed authentication information [w]i stored in the storage 123-i (step S1292-i). When the processing on and after step S123-i has not been executed for all pieces of concealed authentication information [w]i, the processing is returned to step S123-i. On the other hand, when the processing on and after step S123-i has been executed for all pieces of concealed authentication information [w]i, the processing of step S1222-i is executed.
In step S1222-i, the concealed verification value [rmym]i obtained in step S127-i is inputted into the output unit 122-i. When there is no concealed verification value [rmym]i obtained in step S127-i, information representing “failure” is inputted into the output unit 122-i. The output unit 122-i outputs the concealed verification value [rmym]i or the information representing “failure” to the verification device 13 (step S1222-i).
As illustrated in
In step S136, the reconstruction unit 136 reconstructs the verification value rmym by using concealed verification values [rmym]φ(1), . . . , [rmym]φ(K), which correspond to an identical w, and outputs the verification value rmym. Here, {φ(1), . . . , φ(K)}⊆{1, . . . , N} holds When it is determined that rmym=0 is satisfied for all of m=0, . . . , M−1, the determination unit 137 outputs “information representing that authentication is successful” (step S1321). On the other hand, when it is determined that rmym=0 is not satisfied for any m, the determination unit 137 subsequently determines whether or not processing of step S136 has been performed for all w (step S1372). When it is determined that processing of step S136 has not been performed for any w, the processing returns to step S136. On the other hand, when it is determined that the processing of step S136 has been performed for all w, processing of step S1322 is executed. In step S1322, the determination unit 137 outputs “information representing that authentication is failed” (step S1322).
An authentication result which is the “information representing that authentication is successful” outputted in step S1321 or the “information representing that authentication is failed” outputted in step S1322 is inputted into the output unit 132. The output unit 132 outputs the authentication result to the user device 11. The authentication result is inputted into the input unit 111 of the user device 11 (
The verification device 13 may perform an operation including secure computation using at least part of [r0y0]i, . . . , [rM−1yM−1]i and reconstruction and determine whether or not rmym=0 is satisfied for all of m=0, . . . , M−1 by using a reconstructed value obtained through the operation. As well as the above-described example, the verification device 13 may obtain secret sharing values [r0y0+r1y1]μ, [r2y2+r3y3]μ, . . . , [rM−2yM−2+rM−1yM−1]μ with secure computation using [r0y0]μ, . . . , [rM−1yM−1]μ, and determine that rmym=0 is satisfied for all of m=0, . . . , M−1 when all of r0y0+r1y1, r2y2+r3y3, . . . , rM−2yM−2+rM−1yM−1 reconstructed from these secret sharing values [r0y0+r1y1]μ, [r2y2+r3y3]μ, . . . , [rM−2yM−2+rM−1yM−1]μ are 0 or determine that rmym=0 is not satisfied for any of in =0, . . . , M−1 when any of r0y0+r1y1, r2y2+r3y3, . . . , rM−2yM−2+rM−1yM−1 is not 0, for example.
A second embodiment according to the present invention is next described with reference to the accompanying drawings. The second embodiment is an example of the scheme 2. Differences from the first embodiment are mainly described and description of common matters to the first embodiment is simplified by referring to the same reference characters below. Further, not explained one by one below, the present embodiment employs the (2, N) Shamir's secret sharing scheme as a secret sharing scheme unless otherwise specifically noted.
<Configuration>
As illustrated in
As illustrated in
<Preprocessing>
Same as the first embodiment.
<Secure Computation Authentication Processing>
As illustrated in
After that, the random number generation unit 228-i (second random number generation unit) obtains and outputs a concealed extension field random number (second concealed extension field random number) [Rm]i=Rm+Rsm·I∈Fε which is a secret sharing value of the extension field random number (second extension field random number) Rm∈Fε (step S228-i). Then, the arithmetic unit 223-i (fourth arithmetic unit) multiplies the concealed extension field random number [Rm]i by I on the extension field Fε of the order ε to obtain and output an extension field multiplication value [Rm]i·I=Rm·I+Rsm·I2∈Fε. Here, Rsm∈Fε holds (step S223-i). Further, the arithmetic unit 224-i (fifth arithmetic unit) obtains a concealed verification value (fourth concealed verification value) [rmym]i+[Rm]i·I=rm·ym+(rm·ysm+rsm·ym+Rm)·I+(rsm·ysm+Rsm)·I2∈Fε by using the concealed verification value [rmym]i and the extension field multiplication value [Rm]i·I and outputs the concealed verification value [rmym]i+[Rm]i·I (step S224-i).
In step S1292-i, whether or not processing on and after step S123-i has been executed is determined for all pieces of concealed authentication information [w]i stored in the storage 123-i (step S1292-i). When the processing on and after step S123-i has not been executed for all pieces of concealed authentication information [w]i, the processing is returned to step S123-i. On the other hand, when the processing on and after step S123-i has been executed for all pieces of concealed authentication information [w]i, the processing of step S2222-i is executed.
In step S2222-i, the concealed verification value [rmym]i+[Rm]i·I obtained in step S224-i is inputted into the output unit 122-i. When there is no concealed verification values obtained in step S224-i, information representing “failure” is inputted into the output unit 122-i. The output unit 122-i outputs the concealed verification value [rmym]i+[Rm]i·I or the information representing “failure” to the verification device 13 (step S2222-i).
As illustrated in
In step S236, the reconstruction unit 236 reconstructs the verification value rmym by using [rmym]K(1)+[Rm]K(1)·I, [rmym]K(2)+[Rm]K(2)·I, and [rmym]K(3)+[Rm]K(3)·I in accordance with the (3, N) Shamir's secret sharing scheme and outputs the verification value rmym. Here, {K(1), K(2), K(3)}⊆{1, . . . , N} holds (step S236). The determination unit 137 determines whether or not rmym=0 is satisfied for all of m=0, . . . , M−1 by using r0y0, . . . , rM−1yM−1 as inputs (step S1371). When it is determined that rmym=0 is satisfied for all of m=0, . . . , M−1, the determination unit 137 outputs “information representing that authentication is successful” (step S1321). On the other hand, when it is determined that rmym=0 is not satisfied for any m, the determination unit 137 subsequently determines whether or not processing of step S236 has been performed for all w (step S1372). When it is determined that the processing of step S236 has not been performed for any w, the processing returns to step S236. On the other hand, when it is determined that processing of step S236 is performed for all w, processing of step S1322 is executed. In step S1322, the determination unit 137 outputs “information representing that authentication is failed” (step S1322). Processing on and after this is the same as that of the first embodiment.
The verification device 23 may perform an operation including secure computation using at least part of [r0y0]i″+[R0]i″·I″, . . . , [rM−1yM−1]i″+[RM−1]i″·I″ and reconstruction and determine whether or not rmym=0 is satisfied for all of m=0, . . . , M−1 by using a reconstructed value obtained through the operation. Here, i″=φ(1), φ(2), φ(3) and I″=(i″, 0, . . . , 0)∈Fε hold. As well as the above-described example, the verification device 23 may generate secret sharing values for r0y0+r1y1, r2y2+r3y3, . . . , rM−2yM−2+rM−1yM−1 with secure computation using [r0y0]i″+[R0]i″·I″, . . . , [rM−1yM−1]i″+[RM−1]i″·I″, and determine that rmym=0 is satisfied for all of m=0, . . . , M−1 when all of r0y0+r1y1, r2y2+r3y3, . . . , rM−2yM−2+rM−1yM−1 reconstructed from these secret sharing values are 0 or determine that rmym=0 is not satisfied for any of m=0, . . . , M−1 when any of r0y0+r1y1, r2y2+r3y3, . . . , rM−2yM−2+rM−1yM−1 is not 0.
[Modification Etc.]
The present invention is not limited to the above-described embodiments. For example, at least part of the secure computation devices 12-1 to 12-N (for example, all of the secure computation devices 12-1 to 12-N) may include the user device 11 and/or include the verification device 13. Further, all secret sharing values handled in each unit of each device may conform to the same secret sharing scheme or do not have to do so. In the latter case, a secret sharing value conforming to a specific secret sharing scheme may be converted into a secret sharing value conforming to another secret sharing scheme by a well-known secret sharing value conversion method. Further, “obtaining β by using α” may be calculating β through computation using α or extracting β which has been preliminarily computed by retrieval processing using α.
The above-described various kinds of processing may be executed, in addition to being executed in chronological order in accordance with the descriptions, in parallel or individually depending on the processing power of a device that executes the processing or when necessary. In addition, it goes without saying that changes may be made as appropriate without departing from the spirit of the present invention.
The above-described each device is embodied by execution of a predetermined program by a general- or special-purpose computer having a processor (hardware processor) such as a central processing unit (CPU), memories such as random-access memory (RAM) and read-only memory (ROM), and the like, for example. The computer may have one processor and one memory or have multiple processors and memories. The program may be installed on the computer or pre-recorded on the ROM and the like. Also, some or all of the processing units may be embodied using an electronic circuit that implements processing functions without using programs, rather than an electronic circuit (circuitry) that implements functional components by loading of programs like a CPU. An electronic circuit constituting a single device may include multiple CPUs.
When the above-described configurations are implemented by a computer, the processing details of the functions supposed to be provided in each device are described by a program. As a result of this program being executed by the computer, the above-described processing functions are implemented on the computer. The program describing the processing details can be recorded on a computer-readable recording medium. An example of the computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium include a magnetic recording device, an optical disk, a magneto-optical recording medium, and semiconductor memory.
The distribution of this program is performed by, for example, selling, transferring, or lending a portable recording medium such as a DVD or a CD-ROM on which the program is recorded. Furthermore, a configuration may be adopted in which this program is distributed by storing the program in a storage device of a server computer and transferring the program to other computers from the server computer via a network.
The computer that executes such a program first, for example, temporarily stores the program recorded on the portable recording medium or the program transferred from the server computer in a storage device thereof. At the time of execution of processing, the computer reads the program stored in the storage device thereof and executes the processing in accordance with the read program. As another mode of execution of this program, the computer may read the program directly from the portable recording medium and execute the processing in accordance with the program and, furthermore, every time the program is transferred to the computer from the server computer, the computer may sequentially execute the processing in accordance with the received program. A configuration may be adopted in which the transfer of a program to the computer from the server computer is not performed and the above-described processing is executed by so-called application service provider (ASP)-type service by which the processing functions are implemented only by an instruction for execution thereof and result acquisition.
Instead of executing a predetermined program on the computer to implement the processing functions of the present devices, at least some of the processing functions may be implemented by hardware.
| Number | Date | Country | Kind |
|---|---|---|---|
| JP2018-027999 | Feb 2018 | JP | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2019/005351 | 2/14/2019 | WO | 00 |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO2019/163636 | 8/29/2019 | WO | A |
| Entry |
|---|
| Kikuchi, Ryo, et al. “Password-based authentication protocol for secret-sharing-based multiparty computation.” IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences 101.1 (2018): 51-63. [online][retrieved on Dec. 17, 2021]. Retrieved from: https://search.ieice.org/ (Year: 2018). |
| Ryo Kikuchi, et al., “Password-Based Authentication Protocol for Secret-Sharing-Based Multiparty Computation” The Institute of Electronics, Information and Communication Engineers Trans. Fundamentals, XP 55849486, vol. E101-A, No. 1, Jan. 2018, pp. 51-63. |
| International Search Report dated Apr. 9, 2019 in PCT/JP2019/005351 filed Feb. 14, 2019. |
| I. Damgard et al., “Unconditionally Secure Constant-Rounds Multi-party Computation for Equality, Comparison, Bits and Exponentiation”, TCC 2006, pp. 285-304. |
| D. Ikarashi et al., “Secure Database Operations Using an Improved 3-party Verifiable Secure Function Evaluation”, In SCIS 2011, 2011, 9 total pages (with English abstract). |
| A. Shamir, “How to Share a Secret”, Communications of the ACM, Nov. 1979, vol. 22, No. 11, pp. 612-613. |
| Number | Date | Country | |
|---|---|---|---|
| 20210028926 A1 | Jan 2021 | US |
