JPH082051B2 - Credential authentication method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION "Industrial field of use" The present invention relates to a method of authenticating whether or not a communication partner or a user is who he / she really thinks in a network or computer system. is there.

"Conventional technology" The conventional password authentication method is the most basic method for authenticating the qualifications of a communication partner or a user.

FIG. 5 is a diagram showing the most basic password authentication method. In FIG. 5, x is a password, where A is the system and B is the user. As shown in FIG. 5, the user B registers the password x in the system A in advance, and the user B sends the password x to the system A at the time of authentication. The system A compares the received password x with the password x of the registered user B to judge the validity of the user B.

The password system shown in FIG. 5 has the following problems.

Since the password is stored in the system as it is, the password, which is confidential information, will be stolen by peeping at the password file.

Since password x is sent to the system as it is, password x can be obtained by eavesdropping on the line during communication.
Is stolen.

As a method for solving these problems, there is a method using a one-way function. A method using the one-way function will be described with reference to FIG. In FIG. 6, f is a one-way function, and when x is an input and y is an output, y = f
Write (x). As shown in FIG. 6, user B sends password x to system A in advance. System A
Registers unidirectionally converted y as the password of user B. Then, upon authentication, user B sends password x to system A. The system A unidirectionally converts the received password x to calculate y, compares it with the registered y, and judges the validity of the user B.

The password system shown in FIG. 6 solves the problems of the password system shown in FIG. In other words, since the one-way function is a function that has no effective means for obtaining input from the output other than smashing the input, it is possible to guess the original password even if a fraudulent person snoops on the password file. Have difficulty. However, the problem still remains.

To solve the above problem, it is possible to apply an encryption method to the password for communication, but there are various problems such as how to share the secret key. A method for elegantly solving this was proposed by Lamport in 1981 (L. Lamport, “Password Authentication with Insecur
e Communications "Comm.ACM, Nov, 1981, Vol.24, No.11, p
p.770-772.). Figure 7 shows the Lamport method. In FIG. 7, fn (n = 1 ...) Shows the result of continuously applying the one-way function f to the password x n times. For example, f3 = f (f (f (x))). User B transmits, for example, f1000 to system A. System A records this. And at the first authentication,
B calculates f999 to A and sends it. System A unidirectionally converts the received f999 to calculate f1000, compares it with f1000 received from B last time, and judges B as valid if they match. Furthermore, instead of f1000, f999 is newly recorded. At the time of the next certification, B is f998 and then f9.
The number of unidirectional conversions such as 97 is gradually reduced. A also re-registers the authentication data one after another. And B
Will receive authentication from F until finally showing x to A that is considered to be f0. In other words, if f1000 is first prepared, authentication can be performed 1000 times.

 The features of the Lamport method are as follows.

Since the one-way conversion result of the password is used as a single-use, even if the fraudulent person obtains the data during communication by wiretapping, the original password cannot be calculated backward. Furthermore, it cannot be used for subsequent authentication.

You can authenticate yourself without telling the other party your secret information.

 The problems with the Lamport method are as follows.

The user B side has to perform the unidirectional conversion process a considerable number of times at the time of authentication. (If f1000 is initialized, next time is 999 times, next time is 998 times.) Since the one-way conversion result is thrown away, you have to set a new password again every time it is used up.

In particular, the problem (1) indicates that when the processing capacity of the user B is small, the Lamport method cannot be applied to, for example, an IC card of B or a small terminal.

The object of the present invention is that it is safe against sniffing of password files in the system and wiretapping of communication lines, does not disclose one's own secret information to the other party, and has a smaller amount of calculation.
It is to provide a qualification authentication method that can realize a password authentication method that is not disposable.

"Means for Solving the Problem" The qualification authentication method of the present invention uses one-way conversion, and the authenticated side sends information to the authenticating side to prove the qualification of the user in advance. It is characterized in that the information that proves the validity of the information that becomes the proof of the credential and the information that becomes the proof of the subsequent qualification are sent. As a result, it is possible to realize a password authentication method that does not disclose one's own secret information to the other party and is not disposable with a small calculation amount.

[Embodiment] FIG. 1 shows an embodiment of a functional block for realizing the qualification authentication method of the present invention. In FIG. 1, 1 is an authentication control mechanism, 2 is an authenticated control mechanism, 3 is a public list, 4 is a secret information input mechanism, 5 is a random number generation mechanism, 6 is a one-way information generation mechanism, and 7 is a random number recording mechanism. , 8 is an information transmitting mechanism, 9 is an information receiving mechanism, 10 is an information recording mechanism, and 11 is an information comparing mechanism.

The operation of the functional blocks shown in FIG. 1 will be described below. Before describing the authentication method, the one-way function will be described first.

The one-way function is, in addition to smashing the input data,
It is a function that has no effective method of back-calculating the input data x from the output data. In this way, it is described that it is difficult to obtain the input data from the output data in terms of the amount of calculation, simply saying that the input data cannot be back-calculated from the output data. Using secret key cryptographic algorithms such as DES and FEAL,
Such a property can be realized. In particular, FEAL is a 200Kbps software on a 16-bit personal computer.
It is an excellent secret key cryptosystem that realizes an encryption processing speed of 96 Mbps (clock 10 MHz) as an LSI.

The secret key encryption algorithm is represented by C = E (P, K). C
Is a ciphertext, P is a plaintext, and K is a secret key. In this case, P
Is a constant, K is input data, and C is output data, then E is a one-way function. That is, even if P and C are known, the input data K cannot be calculated backward.

Next, an example of the authentication procedure of the present invention will be described. This is shown as an authentication procedure when the entity A authenticates the entity B. The procedure is divided into an initial procedure and a general procedure.
The authentication control mechanism 1 performs the authentication control of A on the authenticating side. The authenticated control mechanism 2 controls the authenticated side of the authenticated side B.

For ease of understanding, the data flow in the initial procedure is shown in FIG. The data flow in the general procedure is shown in FIG. In addition, the calculated data for each of the A and B sides, including the initial procedure and the general procedure, and A from the B side
FIG. 4 shows the data transmitted to the side.

The following notations are used in the description of the procedure from FIG. 2, FIG. 3 and FIG.

E: Secret key encryption described above, second parameter is secret information of key S ^B : A N _n : Variable (can be set arbitrarily as session No. (n = 0 ...)) P ^A : Constant (Authenticator is A M _n : Authenticator: Exclusive OR for each bit [Initial procedure] A: Register P ^A as your own ID in the public domain 3.

B: The secret information S ^B is fetched by the secret information input mechanism 4. P ^A is read from the public book 3, N ₀ and N ₁ are arbitrarily set by the random number generation mechanism 5, and the following data is calculated by the one-way information generation mechanism 6. The one-way conversion process uses the secret key encryption process E as described above.

E ₀ = E (P ^A , S ^B N ₀ ) E ₀ ′ = E (P ^A , E ₀ ) E ₁ ＝ E (P ^A , S ^B N ₁ ) E ₁ ′ = E (P ^A , E ₁ ) Further, the next authenticator is calculated.

M ₀ = E (E ₁ ′, E ₀ ) The random number recording mechanism 7 records N ₀ and N ₁ .

B: After the above preparation, the information transmission mechanism 8 sends the following data to A.

E ₀ ′, E ₁ ′, M ₀ A: The data received by the information receiving mechanism 9 is recorded by the information recording mechanism 10 as follows.

Next time, record E ₀ ′ as authentication data.

Record E ₁ ′ as authentication data _one after another.

Record M ₀ to verify the correctness of E ₁ ′.

[General procedure]

The n-th (n = 1 ...) Authentication procedure after the completion of the initial procedure is as follows.

B: N _n−1 and N _n are read from the random number recording mechanism 7, N _{n + 1} is arbitrarily set by the random number generating mechanism 5, and the following data is calculated by the one-way information generating mechanism 6. The secret information S ^B is taken in by the secret information input mechanism 4.

E _n-1 = E (P ^A , S ^B N _n-1 ) E _n = E (P ^A , S ^B N _n ) E _{n + 1} = E (P ^A , S ^B N _{n + 1} ) E _{n + 1} ′ = E (P ^A , E _{n + 1} ) Further, the following authenticator is calculated.

M _n = E (E _{n + 1} ′, E _n ) B: The following data is sent to A by the information sending mechanism 8.

E _n-1 , E _{n + 1} ′, M _n A: E _n-1 received by the information receiving mechanism 9 is E _n-1 ′ = E (P ^A , E
_n-1 ) is calculated.

Calculated 'and, E _n-1, which is previously registered in the information recording mechanism 10' E _n-1 compared with the information comparator 11, If there is a match A is assumed to be legitimate. Furthermore, E _n-1 and the information recording mechanism
Calculating a _{'(, E n-1 M} n-1 = E E n) by one-way information generation mechanism 6 by' E _n which are recorded in 10, the information recording mechanism 1
At 0, the previously recorded M _n-1 is compared by the information comparison mechanism 11. If they match, it is assumed that the E _n ′ received earlier is valid.

A: The information recording mechanism 10 records as follows.

Next, record E _n ′ as authentication data.

E _{n + 1} ′ is recorded as authentication data _one after another.

Record M _n to verify the correctness of E _{n + 1} ′.

"Effects of the Invention" The qualification authentication method of the present invention described above certifies one's qualification to the authenticating side by the authenticated side, and
Information that proves the validity of the information that has been sent in advance as proof of credential and information that will be used for subsequent credential are sent. Therefore, even if a fraudulent person falsifies the authentication information during communication into something convenient for him, he cannot guarantee the legitimacy and cannot receive the next authentication. Further, in the authentication procedure shown in the embodiment, the authentication-side unidirectional information generation process is performed five times for each authentication. This is significantly smaller than the Lamport method, which is 100 to 1000 times. Further, due to the property of one-way conversion, a password authentication method that is not disposable can be realized without showing the secret information of oneself to the other party.

For the sake of simplicity, the authentication procedure shown in the present embodiment shows a case where the authenticated side B does not transmit the random number information, which is the source of the one-way conversion information generation, to the authenticating side A. It was If a random number is used as the session management number and this is sent to the authentication side, it is possible to recover to the previous state based on this number if some trouble occurs.

In the embodiment of the present invention, the one-way function is continuously applied to the secret information twice, and the one-time application data is shown to the other party so that the sender of the two-time application data sent in advance can The method to authenticate the existence is shown. For this application, it is conceivable to use the Lamport method for the above one-way function application part. That is, the one-way function is applied multiple times, and this is used for authentication in reverse order. This application method can further improve the safety of the present invention. However, the processing amount increases.

A part shown as a mechanism in the embodiment of the functional block of the present invention may be partially realized by software depending on the application form.

The qualification authentication method of the present invention can be applied to qualification authentication of a partner in any situation in a network, communication, or computer system. For example, it can be applied to an IC card authentication system because the amount of processing on the authenticated side is small. By applying this, it can be applied to systems such as IC card telephones. It can also be applied to mutual authentication between users of the same level on the network. Applicable to authentication of access credentials to database information.
In addition, user groups with different interests have the same LAN.
When coexisting on the above, it is also possible to apply to authentication of access qualification to information of each group. In this case, a considerably high speed is required, so it is necessary to use an LSI as the secret key cryptosystem that realizes the one-way conversion process.

The present invention realizes an authentication method in which the authenticity of the authentication information sent at a certain authentication is verified next time and the information is used for actual authentication one after another. That is, there is a time difference once when the authentication information is sent and when the validity is confirmed, and once when the validity is confirmed and once when the authentication is actually used. As an application of the present invention, it is easily conceivable to increase this time difference a plurality of times. In this case, the amount of stored information on each side of authentication and authentication increases.

[Brief description of drawings]

FIG. 1 is a diagram showing an embodiment of functional blocks of the present invention, FIG. 2 is an explanatory diagram of an initial procedure in an authentication procedure of the present invention,
FIG. 3 is an explanatory view of a general procedure in the authentication procedure of the present invention, FIG. 4 is a list of calculated data and transmission data in the authentication procedure of the present invention, and FIG. 5 is a most basic password authentication method as a conventional technique. FIG. 6 is an explanatory diagram of a password authentication system using a one-way function as a conventional technique, and FIG. 7 is an explanatory diagram of a Lamport password authentication system as a conventional technique.

Claims (6)

[Claims] 1. A method in which a person-to-be-authenticated B can authenticate himself / herself to the person-to-be-authenticated A without having to inform the person-to-be-authenticated A of information that the person-to-be-authenticated B holds secretly, The information that proves that the person B is the creator of the authentication information that has been sent two times before, and that further certifies the validity of the authentication information that has been sent last time, the authentication information for one time after another, and the authentication for one time after another. Using the one-way information generation mechanism that generates one-way output information that makes it difficult to calculate the input information, which is the basis for confirming the validity of the business information Created and sent to the certifier A, the certifier A uses the received information I to indicate that the person B to be authenticated is the creator of the authentication information received two times before by using the one-way information generation mechanism. And confirm with information I last time The authenticity of the authentication information being taken is confirmed using the one-way information generation mechanism, the information other than I sent from the authenticated person is saved, and the above authentication procedure is continued one after another in order. A qualification authentication method characterized by performing qualification authentication. 2. The B side uses a secret information input mechanism for inputting secretly held information, a random number generation mechanism for generating random numbers, a random number recording mechanism for recording the generated random numbers, and arbitrary parameter information. The A side has an unidirectional information generation mechanism that generates output information having unidirectionality such that it is difficult to calculate input information in terms of computational complexity, and an information transmission mechanism that transmits information to A. An information receiving mechanism for receiving information from B, a receiving information recording mechanism for recording the received information from B, the unidirectional information generating mechanism, the receiving information from B and the generated unidirectional information As an initial procedure (n = 0), the B side has an information comparison mechanism that compares the secret information input by the secret information input mechanism with the constant information as a parameter, and n = generated by the random number generation mechanism.
The information obtained by fusing the 0-corresponding random numbers is used as the input information, the n = 0-corresponding authentication information verification information is generated by the one-way information generation mechanism, and the n = 0-corresponding authentication information verification information is used as the input information with the same parameter. The one-way information generating mechanism generates the n = 0-corresponding authentication information, and then the n = 1-corresponding random number generated by the random number generating mechanism is used to perform the n = 1-corresponding authentication information verification information and n = 1-corresponding authentication information is further generated, and n = 1-corresponding authentication information is used as a parameter and n = 0-corresponding authentication information verification information is input information to generate correctness confirmation information of the n = 1-corresponding authentication information. Transmits n = 0 compatible authentication information, n = 1 compatible authentication information, and validity confirmation information of n = 1 compatible authentication information to A, and the A side uses the information receiving mechanism to obtain n = 0 compatible authentication information, n = Approval of 1 correspondence Receives the validation information of the information and n = 1 corresponding authentication information, and records the information by the reception information recording mechanism, after the initial procedure, the m-th time of authentication (n = m; the m 1
In the above), the B side inputs the secret information input by the secret information input mechanism and the information recorded by the random number recording mechanism and the fusion processing of the n = m-1 correspondence random numbers, using the same constant as the initial procedure as a parameter. Information, and n = m− by the one-way information generation mechanism.
1 Corresponding authentication information verification information is generated, and n = m correspondence random number recorded by the random number recording mechanism is used to generate n = m correspondence authentication information verification information in the same procedure, and the same constant is used as a parameter. , For verification of authentication information corresponding to n = m + 1 by the one-way information generation mechanism, using information obtained by fusing the secret information input by the secret information input mechanism and the random number corresponding to n = m + 1 newly generated by the random number generation mechanism as input information. Generate the information and use this n = m with the same parameters
Using the +1 correspondence authentication information verification information as input information, the one-way information generation mechanism generates n = m + 1 correspondence authentication information, and further, n = m + 1 correspondence authentication information is a parameter, and n = m.
N = m + 1 corresponding authentication information verification information, n = m + 1 corresponding authentication information, and n = m + 1 corresponding authentication information and n are generated by the information transmission mechanism. = M + 1 corresponding authenticity confirmation information is transmitted to A, and the A side uses the information receiving mechanism for n = m-1 corresponding authentication information verification information, n = m + 1 corresponding authentication information and n = m + 1 corresponding authentication information. The validity confirmation information is received, and the validity confirmation information of n = m + 1 correspondence authentication information and n = m + 1 correspondence authentication information is recorded by the reception information recording mechanism, and n = m-1 correspondence authentication information verification information is input information. And B
Using the same constant as that used as a parameter by the one-way information generation mechanism, n = m-1 correspondence authentication information is generated, transmitted from B first, and recorded by the reception information recording mechanism.
= M-1 corresponding authentication information and information comparison mechanism,
If they match, B is judged to be valid, and if they do not match, B
Is not justified, and if B is judged to be justified, then n = m-1
Corresponding authentication information verification information is used as input information, n = m corresponding authentication information is used as a parameter, and the one-way information generating mechanism generates validity confirmation information for n = m corresponding authentication information, which is transmitted from B first. N = recorded by the reception information recording mechanism
A procedure of comparing the validity confirmation information of the m-corresponding authentication information with the information comparison mechanism, and if they match, judge that the n = m-corresponding authentication information is valid, and if they do not match, do not judge the n = m-corresponding authentication information to be valid. The qualification authentication method according to claim 1, characterized in that the authentication is performed by. 3. The qualification authentication method according to claim 2, wherein identification information of the authenticating side, that is, A is used as a constant used as a parameter. 4. The qualification authentication method according to claim 2, wherein the exclusive OR of the secret information and the random number is used as a fusion process. 5. A secret key cryptosystem is used as a one-way information generating mechanism, parameters are plaintext information of the secret key cryptosystem, input information is secret key information of the secret key cryptosystem, and output information having one direction. The qualification authentication method according to claim 2, wherein ciphertext information is used. 6. The B side uses a random number generated by a random number generation mechanism,
3. The qualification authentication method according to claim 2, wherein the information transmitting mechanism transmits to A, and the A side receives this by the information receiving mechanism and records it by the received information recording mechanism.