JP2016015578A - Decryption system using encryption information code, program, and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a decryption system that has reinforced a security function in decryption processing.SOLUTION: A decryption device 104 includes: a first acquisition part 104a that acquires an encryption information code having encryption information in which predetermined information is encrypted using an encryption key from an image including the encryption information code; a second acquisition part 104b that acquires identification information associated with a decryption key for decrypting the encryption information from an image including a decryption key element having the identification information; a third acquisition part 104c that acquires a decryption key associated with the identification information from a table storing the decryption key associated with the identification information; and a decryption part 104d that decrypts the encryption information code by using the decryption key to acquire the predetermined information.

Description

  The present invention relates to a decryption system, a program, a recording medium, and a method using an encryption information code.

  The two-dimensional code can have more information in a narrow area than the one-dimensional code, and is widely used for various purposes such as article management and web guidance using a mobile phone.

  Patent Document 1 discloses an ID certificate with an authenticity determination function that can be issued at low cost and an authenticity determination method thereof. On the ID certificate, at least three pieces of information are printed: an encryption key two-dimensional code, a decryption key two-dimensional code printed over a face photograph, and user authentication information as character information. The ID certificate is authenticated by comparing the storage information of the encryption key two-dimensional code decrypted using the decryption key two-dimensional code with the user authentication information read by OCR or the like.

  In Patent Document 2, a decryption key two-dimensional code that is superimposed on a face image and is difficult to see is recorded on an authentication card for authenticating an individual on which encrypted magnetic information is recorded. A system for determining the authenticity of an authentication card by decrypting the magnetic information of the authentication card using a two-dimensional code is disclosed.

  Patent Document 3 discloses a system for determining the authenticity of an electronic ticket using an authentication image (two-dimensional code) encrypted using a key generated from image data of a facial photograph.

JP 2006-315305 A Japanese Patent Laid-Open No. 11-073504 JP 2007-122143 A

  In the method described in Patent Document 1, the decryption key two-dimensional code is superimposed on the face photograph and printed on the ID certificate. Therefore, if the decryption key code is cut from the ID certificate and the cut decryption key code is pasted on another face photograph to forge the ID certificate, the forged ID certificate is correctly authenticated.

  The method described in Patent Document 2 requires a dedicated device for reading a decryption key that is difficult to see, so a system for easily determining the authenticity of an authentication card using a general-purpose device such as a smartphone is constructed. Difficult to do.

  Further, in the methods described in Patent Documents 1 to 3, since the decryption key is on the user side, the service provider cannot perform control such as invalidating the decryption key.

  As described above, the decryption system of the prior art cannot be said to have a sufficient security function.

  It is an object of the present specification to provide a decryption system with an enhanced security function for authentication.

  It is another object of the present specification to provide a program that causes a computer to execute a decryption process with an enhanced security function for authentication.

  Furthermore, it is an object of the present specification to provide a decryption processing method with an enhanced security function for authentication.

  According to the decryption system disclosed in the present specification, a first acquisition unit that acquires the encryption information code from an image including an encryption information code having encryption information in which predetermined information is encrypted using an encryption key; A second acquisition unit that acquires the identification information from an image including a decryption key element having identification information associated with a decryption key for decrypting the encryption information code, and stores the decryption key associated with the identification information A third acquisition unit that acquires the decryption key associated with the identification information from the table, and a decryption unit that decrypts the encryption information code using the decryption key and acquires predetermined information. .

  Further, according to the program disclosed in the present specification, the step of obtaining the encryption information code from an image including an encryption information code having encryption information in which predetermined information is encrypted using an encryption key, and the encryption information Obtaining the identification information from an image including a decryption key element having identification information associated with a decryption key for decrypting the code; and from the table storing the decryption key associated with the identification information. Causing the computer to execute a step of obtaining the decryption key associated with the information and a step of decrypting the encryption information code using the decryption key to obtain predetermined information.

  Further, according to the method disclosed in the present specification, the operation unit obtains the encryption information code from an image including encryption information code having encryption information in which predetermined information is encrypted using an encryption key; Obtaining the identification information from an image including a decryption key element having identification information associated with a decryption key for decrypting the encryption information code; and a table storing the decryption key associated with the identification information Then, a step of obtaining the decryption key associated with the identification information and a step of obtaining the predetermined information by decrypting the encryption information code using the decryption key are executed.

  According to the decryption system disclosed in the present specification described above, the security function for authentication is enhanced.

  Moreover, according to the program disclosed in the present specification described above, the security function for authentication is strengthened.

  Moreover, according to the recording medium disclosed in the present specification described above, the security function for authentication is enhanced.

  Furthermore, according to the method disclosed in the present specification, the security function for authentication is enhanced.

FIG. 1 is a diagram showing a certificate used in the system disclosed in this specification. FIG. 2 is a diagram illustrating a configuration of a system disclosed in this specification. FIG. 3 is a diagram for explaining the authentication center and the certificate issuing device. FIG. 4 is a flowchart for explaining the operation of the system for issuing a certificate. FIG. 5 is a diagram for explaining the data portion of the encryption information code. FIG. 6 is a block diagram of the decoding device. FIG. 7 is a diagram illustrating an example of a hardware configuration for realizing the decoding device. FIG. 8 is a flowchart (part 1) for explaining the operation of the system for authenticating the certificate. FIG. 9 is a flowchart (part 2) for explaining the operation of the system for authenticating the certificate. FIG. 10 is a diagram illustrating a first modification of the system disclosed in this specification. FIG. 11 is a diagram illustrating a second modification of the system disclosed in this specification. FIG. 12 is a diagram illustrating a third modification of the system disclosed in this specification. FIG. 13 is a diagram illustrating a fourth modification of the system disclosed in this specification. FIG. 14A is a diagram (No. 1) illustrating a fifth modification of the system disclosed in this specification. FIG. 14B is a (second) diagram illustrating a fifth modification of the system disclosed in this specification.

  Hereinafter, a preferred embodiment of a system having a decryption process with an enhanced security function for authentication disclosed in the present specification will be described with reference to the drawings. However, the technical scope of the present invention is not limited to these embodiments, but extends to the invention described in the claims and equivalents thereof.

  In the decryption process of the encryption information code, the system of this embodiment determines the authenticity of the certificate and authenticates the certificate for preventing the use of the forged certificate.

  FIG. 1 is a diagram showing a certificate used in the system disclosed in this specification. FIG. 2 is a diagram illustrating a configuration of a system disclosed in this specification.

  As shown in FIG. 1, the certificate 130 used in the system 1 includes at least a two-dimensional code 132, which is an encryption information code having encryption information in which predetermined information is encrypted using an encryption key, and a two-dimensional code. A decryption key element 131 having identification information associated with a decryption key for decrypting the code 132 is printed. The certificate 130 is handed over to the user when the service provider managing the system 1 that authenticates the certificate mails the certificate 130 to the user.

  In the certificate 130, the decryption key element 131 is a photograph of the user's face. The identification information is an image feature amount acquired from the face photograph image that is the decryption key element 131.

  Since the decryption key element 131 itself printed on the certificate 130 is not a decryption key for decrypting the two-dimensional code 132, the two-dimensional code 132 is used by using the decryption key element 131 printed on the certificate 130. Cannot be decrypted.

  First, after describing the outline of the operation of the system 1, each operation will be described in detail.

  FIG. 2 is a diagram illustrating an example of the overall configuration of the system 1 of the present embodiment. The system 1 includes, for example, a portable terminal 2 used by a user having a certificate 130, an authentication center 100 formed by a server computer, a base station 101 of a mobile communication network, a network 102, and a certificate issuing device. 103 and a decryption device 104 that takes an image of the certificate 130, determines the authenticity of the certificate 130, and authenticates the certificate 130. In FIG. 2, the mobile terminal 2, the authentication center 100, the certificate issuing device 103, and the decryption device 104 are communicably connected via the network 102 of the mobile communication network, but may be connected via a dedicated line. Good.

  The process for issuing the certificate 130 will be described below.

  The user of the portable terminal 2 takes a photograph of the user's face using the portable terminal 2, and the photographed face photograph image is transmitted to the authentication center 100 managed by the service provider via the network 102.

  The authentication center 100 receives the face photo image of the user transmitted from the mobile terminal 2, and extracts an image feature amount that is identification information from the received face photo image. The authentication center 100 generates an encryption key for encrypting predetermined information stored in the certificate 130 and a decryption key for decrypting the encrypted encryption information. As will be described in detail later, the image feature amount, which is identification information, is information associated with the decryption key, and can be acquired by the technique disclosed in, for example, JP2011-028374A. The authentication center 100 inputs predetermined information stored in the certificate 130, creates encrypted information in which the predetermined information is encrypted using an encryption key, and then generates a two-dimensional code 132 based on the encrypted information To do.

  The authentication center 100 decrypts the two-dimensional code 132 printed on the user certificate 130 using the image feature amount acquired from the user's face photograph image as the decryption key element 131 as a comparison image feature amount. Store it in association with the decryption key. The authentication center 100 stores many users' decryption keys and comparison image feature quantities in association with each other.

  The authentication center 100 transmits the two-dimensional code 132 and the data of the decryption key element 131 (face photograph) having the image feature amount as identification information to the certificate issuing device 103 via the network 102.

  Based on the received data of the two-dimensional code 132 and the decryption key element 131 (user's face photograph), the certificate issuing device 103 transfers the two-dimensional code 132 and the decryption key element 131 (user's face photograph) to a medium such as paper. Print on top and issue a certificate 130. The issued certificate 130 is mailed to the user of the mobile terminal 2. In this embodiment, the certificate issuing device 103 and the authentication center 100 are connected via the network 102. However, a known recording medium is used to transmit data to the certificate issuing device 103 and the authentication center 100. You may go.

  A process in which the decryption device 104 authenticates the certificate 130 will be described below.

  The decryption device 104 captures a face photograph that is the decryption key element 131 of the certificate 130, acquires a search image feature amount that is an image feature amount from the captured face photograph image, and obtains the search image feature amount as the authentication center 100. Send to.

  The authentication center 100 searches for a comparison image feature amount that approximates this search image feature amount based on the search image feature amount that is the image feature amount transmitted from the decoding device 104. When a comparison image feature value approximate to the search image feature value is found, the authentication center 100 transmits a decryption key associated with the comparison image feature value to the decryption device 104 via the network 102. Here, the image feature amount acquired from the face photograph image of the certificate 130 taken by the decryption device 104 is referred to as a search image feature amount, and the authentication center 100 stores the comparison in association with the decryption key. A name different from the image feature amount is used. This is because the images taken by the mobile terminal 2 and the decoding device 104 rarely coincide with each other in units of pixels, and therefore are different from each other. In this embodiment, for example, the comparison image feature quantity and the search image feature quantity are subtracted as they are (NOT calculation), and an image in which the total value of the subtraction is smaller than a predetermined value is specified as a search hit image. When the certificate 130 is forged, the search hit image does not exist because the total value of the subtraction described above is set to exceed a predetermined value.

  The decryption device 104 decrypts the two-dimensional code 132 of the certificate 130 photographed by the decryption device 104 using the decryption key acquired from the authentication center 100, acquires predetermined information, and displays the predetermined information. Indicates that the certificate 130 is authenticated. As will be described later, when the two-dimensional code 132 is decrypted by including the message authentication code in the two-dimensional code 132, the security of authentication may be enhanced based on the message authentication code.

  Examples of the certificate 130 include an exhibition admission ticket. At the entrance of the exhibition, the exhibition manager photographs the decryption key element 131 (the user's face photo) and the two-dimensional code 132 on the certificate 130 using the decryption device 104. If the admission ticket is not forged, the decryption device 104 decrypts the two-dimensional code 132 using the acquired decryption key, and outputs predetermined information stored in the two-dimensional code 132.

  As shown in FIG. 2, the mobile terminal 2 has a display function (display screen), and further has a shooting (camera) function (not shown), and displays the captured image on the display screen. The mobile terminal 2 has a function of executing various arithmetic processes and image processing of captured images in addition to the communication function. It is also possible to use a dedicated code reading device instead of the portable terminal 2.

  The portable terminal 2, the authentication center 100, and the certificate issuing device 103 can be formed as an integrated authentication device. The portable terminal 2, the authentication center 100, and the certificate issuing device 103 can be configured using a computer having a communication function or a printing function, for example. The computer implements the functions of the portable terminal 2, the authentication center 100, and the certificate issuing device 103 by executing a predetermined program.

  The above is the outline of the operation of the system 1.

  Next, the authentication center 100 and the certificate issuing device 103 will be further described.

  FIG. 3 is a diagram for explaining the authentication center and the certificate issuing device.

  The authentication center 100 includes a generation unit 100a, an extraction unit 100b, and a table 100c.

  The generation unit 100a generates an encryption key for encrypting input predetermined information and generating encryption information, and a decryption key for decrypting the encryption information. In addition, the generation unit 100a generates encryption information by encrypting predetermined information using an encryption key, and then generates a two-dimensional code 132 based on the encryption information.

  The extraction unit 100 b extracts a comparison image feature amount from the user's face photo image transmitted from the mobile terminal 2. A known technique can be used as a technique for extracting a comparison image feature quantity from a user's face photographic image. For example, the image recognition technique disclosed in Japanese Patent Application Laid-Open No. 2011-028374 described above may be used. .

  The table 100c stores the decryption key for decrypting the two-dimensional code 132, the comparison image feature amount that is the identification information acquired by the extraction unit 100b, and the predetermined information to be encrypted in association with each other. The table 100c is realized as a database disposed in the authentication center 100, for example. Note that the process of extracting the comparison image feature quantity from the face photograph image may be performed by the mobile terminal 2. In this case, the table 100c stores the comparison image feature amount transmitted from the mobile terminal 2 in association with the decryption key and the predetermined information to be encrypted. In the embodiment of the present invention, there are various databases such as a relational database, an XML database, an object-oriented database, a database using a network data model, a database using a hierarchical data model, a schemaless database such as a key-value store, etc. You may use this database.

  The authentication center 100 is formed by a server computer having high security, for example.

  The certificate issuing device 103 includes a print unit 103a. Based on the received data of the two-dimensional code 132 and the decryption key element 131 (user's face photograph), the print unit 103a places the two-dimensional code 132 and the decryption key element 131 (user's face photograph) on a medium such as paper. Print.

  Next, the operation of the system 1 for issuing the certificate 130 will be described in detail below with reference to FIG.

  In the system 1, the certificate 130 can be issued using various encryption key methods, but unless otherwise specified, information is encrypted using a common key encryption method. Therefore, the encryption key and the decryption key are common.

  First, in step S <b> 10, the user of the mobile terminal 2 takes a picture of the user's face using the mobile terminal 2. The photographed face photograph image is transmitted to the authentication center 100 via the network 102. The authentication center 100 extracts a comparison image feature amount from the face image of the user transmitted from the mobile terminal 2.

  Next, in step S12, the authentication center 100 prepares predetermined information to be encrypted and creates information to be included in the two-dimensional code 132, which is an encryption information code.

  Next, in step S14, the authentication center 100 creates an encryption key and a decryption key. When the common key encryption method is used, the encryption key and the decryption key are the same. On the other hand, when the public key cryptosystem is used, the encryption key and the decryption key are different.

  Next, in step S16, the authentication center 100 creates a first message authentication code using predetermined information to be encrypted and an encryption key.

  Next, in step S <b> 17, the authentication center 100 encrypts predetermined information using an encryption key to create encrypted information.

  Next, in step S18, the authentication center 100 stores the decryption key, the comparison image feature amount, and the predetermined information in the table 100c in association with each other. In this way, the decryption key is associated with the comparison image feature quantity that is the identification information, so that the decryption key element 131 that is a face photograph in the face photograph image having the comparison image feature quantity, Are associated.

  Next, in step S <b> 19, the authentication center 100 transmits the two-dimensional code 132 and the data of the decryption key element 131 (user face photograph) to the certificate issuing device 103 via the network 102. Based on the received data of the two-dimensional code 132 and the decryption key element 131 (user's face photograph), the certificate issuing device 103 transfers the two-dimensional code 132 and the decryption key element 131 (user's face photograph) to a medium such as paper. Print on top and issue a certificate 130. Note that issuing the certificate 130 may be arranging the two-dimensional code 132 and the decryption key element 131 in a recognizable state on an output medium such as a liquid crystal panel.

  As described above, the certificate 130 in which the face photograph as the decryption key element 131 and the two-dimensional code 132 as the encryption information code are printed adjacent to each other is completed. In this case, the administrator of the system 1 knows that the decryption key element 131 printed on the certificate 130 is a face photograph. The user who receives the certificate 130 may recognize this. Hereinafter, a case where the user who receives the certificate 130 recognizes this will be described as an example.

  Various decryption key elements can be used in addition to a face photograph. For example, it may be a photograph or an image other than a face photograph, a barcode, and an unencrypted two-dimensional code. If the generation unit 100a of the authentication center 100 is an image feature amount extraction process for a photograph or image other than a face photograph, it can be performed using the technique described in Japanese Patent Application Laid-Open No. 2011-028374. Code and non-encrypted two-dimensional code can be performed using existing analysis technology. Further, it is desirable that these decryption key elements are printed together on a medium (for example, paper) on which the encrypted information code is printed, but the present invention is not limited to this. For example, what is necessary is just to be understood that the user holding the encryption information code is used as a decryption key element when acquiring the encryption information code.

  For example, physical features such as a user's face, palm print, and fingerprint (hereinafter referred to as an identification element) holding an encryption information code are used as a decryption key element, and the characteristics of an image obtained by capturing these are extracted as identification information. Good. If the person holding the encryption information code is the person of the other party who issued the encryption information code, the physical characteristics of the person holding the encryption information code can be easily obtained.

  The two-dimensional code that is the encryption information code can be determined as follows, for example.

  If the data length of the message of the encryption information code by the two-dimensional code can be fixed, the message data length of the encryption information code is fixed to a predetermined data length, and the encryption information code is based on the data length of the message. It may be identified. Further, when the data length of the message of the encryption information code cannot be fixed, the encryption information code may be identified based on an identifier included at the head or the tail of the message data.

  FIG. 5 is a diagram for explaining a data portion of an encryption information code using a block cipher of a common key encryption method.

  The data portion of the cryptographic information code has a segment including a message and a header that modifies the message. The data portion may have one or more segments.

  The message is, for example, an identifier indicating that the encryption information code is a code including encrypted information, encryption information obtained by encrypting predetermined information, an initialization vector used for the first block, and authenticating the message For example, a first message authentication code that is short information may be included.

  The header may include, for example, a message type, a message size, an encryption information flag indicating that the encryption information code is a code including encrypted information, and the like.

  The data portion of the encryption information code has an error correction code and a format information portion including information related to the code.

  In the encryption information code, each piece of information in the data part is converted into a binary code.

  A public key cryptosystem can also be applied to an encryption information code using a two-dimensional code.

  Next, the decoding device 104 will be described.

  FIG. 6 is a block diagram of the decoding device.

  The decrypting device 104 includes a first obtaining unit 104a that obtains an encryption information code from an image including an encryption information code having predetermined information encrypted with an encryption key, and for decrypting the encryption information code. The second acquisition unit 104b that acquires the identification information from the image including the decryption key element having the identification information associated with the decryption key, and the table that stores the decryption key associated with the identification information are associated with the identification information. A third obtaining unit 104c that obtains the decryption key and a decryption unit 104d that decrypts the encryption information code using the decryption key and obtains predetermined information.

  FIG. 7 is a diagram illustrating an example of a hardware configuration for realizing the decoding device.

  The decryption device 104 includes a calculation unit 10, a storage unit 11, an operation unit 12, a display unit 13, a communication unit 14, and a photographing unit 15 that captures an image of the certificate 130.

  The photographing unit 15 is controlled by the arithmetic unit 10 to photograph the encryption information code 132 and the decryption key element 131 of the certificate 130 with one image. As the imaging unit 15, for example, a CCD or a CMOS imaging element can be used.

  The arithmetic unit 10 controls each element of the decoding device 104 and performs various processes according to a predetermined program stored in the storage unit 11 in advance, and stores the storage unit 11 in order to temporarily store data generated during the processing. Use. The storage unit 11 may include a primary storage device and a secondary storage device. The storage unit 11 may include a drive that can read the recording medium 11a that stores a predetermined program. Here, the recording medium storing the program may be a non-transitory recording medium. The non-transitory recording medium is not particularly limited, but may be a recording medium such as a CD-ROM. The first acquisition unit 104a, the second acquisition unit 104b, the third acquisition unit 104c, and the decoding unit 104d of the decoding device 104 illustrated in FIG. 6 are realized by the arithmetic unit 10 cooperating with each unit.

  The operation unit 12 is operated by an operator or the like of the decoding device 104 and inputs various types of information. As the operation unit 12, for example, a touch panel can be used. The calculation unit 10 performs various types of processing using various types of information input from the operation unit 12.

  The display unit 13 displays various types of information under the control of the calculation unit 10. For example, a liquid crystal panel can be used as the display unit 13.

  The communication unit 14 inputs image data from the imaging unit 15. Further, the communication unit 14 can transmit and receive data such as information decrypted with another apparatus via the external network 102 or the like.

  As the decoding device 104, for example, a multi-function mobile phone, a tablet terminal, a notebook personal computer, or the like can be used.

  In the system 1, as described above, the authentication center 100 has a table for storing the decryption key associated with the comparison image feature quantity (identification information). Accordingly, when acquiring the decryption key associated with the identification information, the decryption device 104 acquires the decryption key from the authentication center 100 via the network 102. Further, the decryption apparatus 104 may store this table in the storage unit 11 and acquire the decryption key associated with the comparison image feature amount (identification information) from the storage unit 11. The table is preferably stored in a database or an HDD or a memory having a function of storing a table, and can be accessed from the decryption device 104.

  Next, the operation of the system 1 for authenticating the certificate 130 by photographing the two-dimensional code 132 and the decryption key element 131 (face photograph) on the certificate 130 will be described below with reference to FIGS. explain.

  First, in step S <b> 20 of FIG. 8, the decryption device 104 captures a face photograph that is the encryption information code 132 and the decryption key element 131 simultaneously using the image capturing unit 15 as one image. Each captured image is displayed on the display unit 13 and stored in the storage unit 11.

  Next, in step S <b> 22, the decryption device 104 acquires a search image feature amount (identification information) from the captured face photograph (decryption key element 131), and uses the acquired search image feature amount as the network 102. To the authentication center 100. A known technique can be used as a technique for extracting the search image feature quantity from the photographed face photograph (decryption key element 131). For example, an image disclosed in the above-described Japanese Patent Application Laid-Open No. 2011-028374 or the like. Recognition technology can be used. Note that the decryption device 104 transmits the image data of the photographed face photograph (decryption key element 131) to the authentication center 100, and the authentication center 100 retrieves the image from the image of the face photograph (decryption key element 131). An image feature amount may be acquired.

  Next, in step 40 of FIG. 9, the authentication center 100 searches the table 100 c for a comparison image feature amount that approximates the search image feature amount based on the search image feature amount received from the decryption device 104. To do. As the search process, for example, a matching process can be used.

  Next, in step S42, when the comparison image feature quantity of the search hit image is searched from the table 100c, the authentication center 100 authenticates the decryption key element having the search image feature quantity. The authentication center 100 reads the decryption key associated with the comparison image feature quantity from the table 100c. If the comparison image feature quantity of the search hit image is not searched from the table 100c, it is determined that the certificate 130 is not authenticated, and the process proceeds to step S34 in FIG.

  Next, in step S44, the authentication center 100 transmits the decryption key read from the table 100c to the decryption device 104 via the network 102.

  Next, in step S <b> 24 of FIG. 8, the decryption apparatus 104 extracts the encryption information and the first message authentication code from the two-dimensional code that is the encryption information code 132. The decryption device 104 receives a decryption key from the authentication center 100. Since the two-dimensional code that is the encryption information code 132 has an error correction code, even if the code is dirty, the information contained in the code can be extracted by removing the influence of the dirt.

  Next, in step S26, the decryption device 104 decrypts the encryption information extracted from the two-dimensional code, which is the encryption information code 132, using the decryption key, and creates predetermined information.

  Next, in step S28, the decryption device 104 generates a second message authentication code using the decryption key and predetermined information.

  Next, in step S30, the decoding device 104 determines whether or not the first message authentication code matches the second message authentication code. If the first message authentication code matches the second message authentication code, it is determined that the decrypted predetermined information has not been altered, the certificate 130 is authenticated, and the process proceeds to step S32. On the other hand, if they do not match, the process proceeds to step S34. When the process proceeds to step S34, the decryption device 104 outputs to the display unit 13 that the certificate 130 is not authenticated.

  When the process proceeds to step S <b> 32, the decoding device 104 outputs the decoded predetermined information to the display unit 13.

  Next, in step S <b> 34, the decryption device 104 deletes the decryption key so that the decryption key does not remain in the decryption device 104.

  Next, modifications 1 to 5 of the system 1 disclosed in this specification will be described below with reference to FIGS.

  FIG. 10 is a diagram illustrating a first modification of the system disclosed in this specification.

  The modification 1 demonstrates the operation example in case a decoding apparatus is the multifunctional mobile telephone 40, such as a smart phone.

  The operator of the multi-function mobile phone 40 presses the shooting button 42 (corresponding to the operation unit 12) and is displayed on the display unit 41 (corresponding to the display unit 13) with a camera (corresponding to the shooting unit 15) (not shown). The decryption key element 131 and the encryption information code 132 are photographed as one image so that the decryption key element 131 such as a face photograph can be accommodated in the frame K1 and the two-dimensional code as the encryption information code 132 can be accommodated in the frame K2. . If the search image feature quantity approximates the comparison image feature quantity and the first message authentication code and the second message authentication code match, the authentication is successful and “decryption success, encryption information is“ “abc” is displayed on the display unit 41. Or you may output the same content by an audio | voice. Alternatively, when the decryption information is a URL, web guidance may be performed.

  On the other hand, if the search image feature quantity and the comparison image feature quantity are not approximate or the first message authentication code and the second message authentication code do not match, the display unit 41 indicates that the decryption element 131 is not authenticated. To display.

  FIG. 11 is a diagram illustrating a second modification of the system disclosed in this specification.

  Modification 2 differs from Modification 1 described above in that the decryption key element 131 is an identification code such as a two-dimensional code or a barcode. For example, if a technique for inserting a photograph into a two-dimensional code is used, it can be used as a substitute for the facial photograph in Operation Example 1.

  FIG. 12 is a diagram illustrating a third modification of the system disclosed in this specification.

  In the third modification, the operator of the multi-function mobile phone 40 presses the photographing button 42 and sets the decryption key element 131 so that the decryption key element 131 fits in the frame K1 displayed on the display unit 41 with a camera (not shown). Take a picture. The search image feature amount acquired from the captured image of the decryption key element 131 is sent to the authentication center 100. When the search image feature amount and the comparison image feature amount approximate, the decryption key is received from the authentication center 100. Sent.

  Next, the operator of the multi-function mobile phone 40 presses the photographing button 42 and photographs the encryption information code 132 with a camera (not shown) so that the encryption information code 132 fits in the frame K2 displayed on the display unit 41. . An encryption information code 132 is displayed on the display unit 41, and the captured encryption information code 132 and decryption key element 131 are stored in the storage unit 11 as one image.

  In this specification, in order to photograph the encryption information code 132 and the decryption key element 131 in one image, one image is photographed and the other is photographed. Displaying or storing in the storage unit 11 is included.

  If the first message authentication code matches the second message authentication code, the authentication is successful, and the display unit 41 displays “decryption successful, encrypted information is“ abc ””. .

  FIG. 13 is a diagram illustrating a fourth modification of the system disclosed in this specification.

  In the fourth modification, a plurality of encryption information codes 132 and one decryption key element 131 are photographed with one image. In this variation, the two-dimensional code that is the plurality of encryption information codes 132 includes encryption information encrypted using the same encryption key.

  The operator of the multi-function mobile phone 40 presses the shooting button 42, and with a camera (not shown), the decryption key element 131 is placed in the frame K1 so that the plurality of encryption information codes 132 are contained in the frame K2 displayed on the display unit 41. The encryption information code and the decryption key element are photographed with one image so that the When the search image feature quantity approximates the comparison image feature quantity and the first message authentication code included in each encryption information code matches the second message authentication code, authentication of each encryption information code Is successfully displayed, and the display section 41 displays “Successful decryption, encryption information is“ abc ”,“ def ”,“ ghi ”...

(Please check the description here)
In addition, m pieces of encryption information codes and n pieces of decryption key elements may be captured with one image. Here, m and n are positive integers. The multi-function mobile phone 40 acquires the search image feature quantity from the image of each decryption key element, and receives the decryption key associated with each decryption key element from the authentication center 100. In addition, the multi-function mobile phone 40 performs the decryption process to check all combinations of the first message authentication code and the second message authentication code, so that m number of encryption information codes and n number of decryption key elements are obtained. (M × n correspondences) and the decryption information is output for a pair of codes that have the same authentication code.

  14A and 14B are diagrams illustrating a fifth modification of the system disclosed in this specification.

  In the fifth modification, the decryption key element 131 is the face of the person to whom the encryption information code 132 is issued, and the decryption device is the multi-function mobile phone 40.

  FIG. 14A shows an external view of a multifunctional mobile phone 40 used in the fifth modification and a photographing method.

  As shown in FIG. 14A, the multi-function mobile phone 40 has a first (front) camera 15A on the front (screen side) 40A side and a second (rear) camera 15B on the back 40B side. In order to prove that the person to whom the two-dimensional code which is the encryption information code 132 is issued carries the encryption information code 132 and is the person concerned, the encryption information code 132 and the person's face 131 are Simultaneously with the mobile phone 40. In this case, as shown in FIG. 14B, the encryption information code 132 is arranged on a table (not shown) in front of the person, and the elbow of the arm holding the multi-function mobile phone 40 is fixed to the table. ) The image of the person's face 131 taken by the camera 15A and the image of the encryption information code 132 taken by the second (rear) camera 15B are taken at the same time in a state where they are arranged at predetermined positions on the screen. In this manner, the image of the person's face 131 and the image of the encryption information code 132 can be taken so as to enter one screen.

  As described above, the case where the person carrying the encryption information code 132 knows what is the decryption key element has been described as an example. However, the present invention is not limited to this, and various modifications are possible. For example, the issuer who issued the certificate has decided to use the photo of the certificate issuer's face as the decryption key element, and the face of the issuer's face taken when issuing the certificate Issue processing is performed using the image as a decryption key element, and the face image is registered as a decryption key element. When a person brings a certificate, the face of the person who brought the certificate may be photographed and used as a decryption key element. In the present embodiment, the method for extracting the image feature amount from the captured image has been mainly described. However, for example, watermark information embedded in a photograph using a known digital watermark technique can be used.

  As mentioned above, although embodiment and the Example of this invention were described, it cannot be overemphasized that various modifications are possible, and this invention is not limited to described embodiment and the modification.

DESCRIPTION OF SYMBOLS 1 System 2 Mobile terminal 10 Arithmetic unit 11 Storage unit 11a Recording medium 12 Operation unit 13 Display unit 14 Communication unit 15 Imaging unit 40 Multi-function mobile phone 100 Authentication center (server)
100a generation unit 100b extraction unit 100c table 101 base station 102 network 103 certificate issuing device 103a printing unit 104 decryption device 104a first acquisition unit 104b second acquisition unit 104c third acquisition unit 104d decryption unit 130 certificate 131 decryption key element 132 Cryptographic information code (two-dimensional code)

Claims (8)

A first acquisition unit for acquiring the encryption information code from an image including an encryption information code having encryption information obtained by encrypting predetermined information using an encryption key;
A second acquisition unit for acquiring the identification information from an image including a decryption key element having identification information associated with a decryption key for decrypting the encryption information code;
A third acquisition unit that acquires the decryption key associated with the identification information from a table that stores the decryption key associated with the identification information;
A decryption unit for decrypting the encryption information code using the decryption key to obtain predetermined information;
A decoding system comprising:   The decryption system according to claim 1, wherein the identification information is an image feature amount acquired from an image including the decryption key element.   The decryption system according to claim 1, wherein the decryption unit discards the decryption key after obtaining predetermined information.   The decryption system according to any one of claims 1 to 3, wherein the image including the encryption information code and the image including the decryption key element are photographed by two photographing units mounted on one device. .   The decryption system according to claim 1, wherein the encryption information code and the decryption key element are included in the same image. The encryption information code includes a first message authentication code for authenticating the decryption key,
The decryption unit decrypts the cipher information when the second message authentication code created using the decryption information of the cipher information included in the decryption key and the cipher information code matches the first message authentication code. The decoding system according to any one of claims 1 to 5, wherein the predetermined information is output. Obtaining the encryption information code from an image including an encryption information code having encryption information in which predetermined information is encrypted using an encryption key;
Obtaining the identification information from an image including a decryption key element having identification information associated with a decryption key for decrypting the encryption information code;
Obtaining the decryption key associated with the identification information from a table storing the decryption key associated with the identification information;
Decrypting the encryption information code using the decryption key to obtain predetermined information;
A program that causes a computer to execute. The calculation unit
Obtaining the encryption information code from an image including an encryption information code having encryption information in which predetermined information is encrypted using an encryption key;
Obtaining the identification information from an image including a decryption key element having identification information associated with a decryption key for decrypting the encryption information code;
Obtaining the decryption key associated with the identification information from a table storing the decryption key associated with the identification information;
Decrypting the encryption information code using the decryption key to obtain predetermined information;
How to run.

Images