JP2001036522A - Qualification authentication method using variable authentication information - Google Patents

Abstract

(57) [Summary] [PROBLEMS] In a qualification authentication method using variable authentication information, the amount of processing to be executed on the authenticatee side and the authenticatee side in each authentication phase is extremely reduced, thereby realizing a simple and small program size. Provided is a method capable of performing secure authentication that is possible and that is strong against eavesdropping on a communication path. A person to be authenticated calculates a current authentication data and a next authentication data based on a random number, a user ID, and a password using a one-way function, and further calculates the authentication data using exclusive OR. Encrypted so that it cannot be deciphered by anyone other than the authenticator, and transmits these to the authenticator together with the user ID of the authenticated person. The authenticator receives the above three information from the authenticated person and The validity check parameter calculated using the one-way function based on the data is compared with the authentication parameter registered in the previous authentication phase, and if they match, it is determined that the current authentication has been established, and the next authentication data is replaced with the next authentication data. Register as an authentication parameter.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a qualification authentication method in which an authenticator authenticates a subject. The authentication method using the variable authentication information is a method of performing authentication by changing authentication information such as a password for each authentication request from the subject to the authenticator.

[0002]

2. Description of the Related Art Conventional methods for authenticating the qualifications of a communication partner and a user by using authentication information such as a password are roughly classified into two methods, one using a public key encryption method and one using a common key encryption method. However, in the case of embedding in Internet-related communication protocols, etc., a method applying a common key type encryption method capable of processing much faster than a public key encryption method, particularly a password authentication method is often used. . The basic password authentication procedure is as follows. First, a person to be authenticated (including a device) registers a password with an authenticator (including a device such as a server). At the time of authentication,
The subject sends the password to the certifier. The certifier
Compare the received password with the registered password.

[0003] However, this method has the following problems. (A) The password is stolen by prying the password file on the authentication side. (B) During communication, the password is stolen by wiretapping. (C) The person to be authenticated needs to disclose the password, which is his / her secret information, to the authenticator.

[0004] As a method for solving the first problem (a), for example, the authenticated person registers data obtained by applying a one-way function to the password to the authenticator, and the authenticator receives the password received at the time of authentication. To the same one-way function and compare the results (references: A. Evans,
W. Kantrowitz and E.A. Weiss:
“A user authentication sc
heme not requiring secrecy
in the computer, "Commu
n. ACM, 17, 8, pp. 437-442
(1974) and R.A. Morris and K.M. Th
mpson: “Password security
y: A case history, "UNIXXP
programmer's Manual, Save
nth Edition, 2B (1979)).

[0005] A one-way function is a function in which there is no efficient means for obtaining an input from an output other than the brute force of an input. By calculating input data, it is possible to prevent impersonation. Generally, the one-way function is DES or F
It can be obtained by a common key encryption method such as EAL. The common key encryption method processes a plaintext input using a common secret key to obtain a ciphertext as an output. Even if a plaintext and a ciphertext are given, a common secret key cannot be calculated. In particular, the FEAL has a feature that even if the input of the plaintext or the common secret key changes by one bit, an output that does not completely keep track of the input change can be obtained.

As described above, the problem (a) of the basic password authentication method can be solved by the method using the one-way function. However, if this is applied to the Internet where line tapping is easy, problem (b) cannot be solved. Regarding problem (c), this basic password authentication method can be applied to bank customer authentication and the like, but is not suitable for qualification authentication between users at the same level.

As a method for solving such a problem, there is a qualification authentication method in which authentication information such as a password is made variable. For example, the method of Lamport (L. Lampo
rt: “Password authenticatici
on with insecure communic
ation, "Commun. ACM, 24, 1
1 pp. 770-772 (1981)) (S / K
EY-type password authentication method) and a CION method (Chained One-way Data Ver.) Which is a dynamic password authentication method proposed by the inventor of this application.
modification method) (A. Shimiz
u, “ADdynamic Password Out
Hentication Method Usage
a One-way Function "System
ms and Computers in Japan,
Vol. 22, no. 7, 1991 pp.
32-40) ("Qualification Authentication Method")
/ Patent No. 2098267).

[0008] The Lamport method is a method in which a one-way function is applied to a password a plurality of times, and data before one application is shown to the certifier one after another so that authentication can be performed a plurality of times. is there. In this method, it is necessary to subtract 1 each time authentication is performed from the initially set maximum number of authentications, and reset the password when the number of authentications is exhausted. If the number of applications of the one-way function is increased in order to increase the maximum number of authentications, the processing amount increases. In customer authentication of a bank, several hundreds to 1,000 or the like is used as the maximum number of times of authentication. Furthermore, the processing capacity is smaller than that of the authenticator.
There is a problem that the processing load on the person to be authenticated is large.

[0009] According to the CISON method, the authenticated person (user) gives the authenticator (host) the data based on the registered authentication data that has been previously verified and the authentication data used for authentication one after another. By transmitting the three data of the validity verification data of the authentication data that has been transmitted last time and used for the next authentication in each authentication phase, it is possible to successively perform authentication one after another while safely updating the authentication information. Is the way. As described above, in the CISON method, in order for the subject to obtain the authentication of the certifier, the two random numbers N generated last time are used.
_(k-1) and N _(k) need to be used. Therefore, when the user obtains the authentication of the certifier from the terminal at the destination, the user must carry a storage medium such as an IC card storing the random numbers and use the storage medium at the terminal at the destination.
In addition, the terminal needs a function of generating a random number and a function of reading and writing an IC card. On the other hand, in the Internet, a product called an Internet home appliance which has an Internet connection function added to a television set, a word processor, and a mobile terminal is about to be introduced to the market.

[0010] With the spread of such Internet home appliances, the demand for transmission and reception of information having an authentication process is expected to increase. However, since Internet home appliances place the highest priority on cost, In most cases, there is no mechanism for generating the above-mentioned random numbers or reading and writing them to and from a storage medium such as an IC card. Further, since the storage area of the processing program is also limited, it is desired to realize such authentication processing as simply and with a small program size as possible.

In order to solve this problem, the user authentication method proposed in the "Information transmission / reception control method having a user authentication function" proposed by the inventor of the present application (Japanese Patent Application No. 8-240190) has sufficient security such as the Internet. In the transmission and reception of information between an authenticated person and a non-authenticated person on a network, a mechanism for reading and writing a storage medium such as an IC card is not required on the authenticated person side, and the user authentication process can be performed with a small program size. An object of the present invention is to provide a secure information transmission / reception control method and apparatus and a recording medium on which the method is recorded.
As an improvement of the NON method, a parameter that must be synchronized between the authenticated user and the authentication server in order to make the values of various authentication data one-time only is replaced with the random number used when the authentication data was generated. The main feature is that the number of authentications is used. The process to be performed by the user to be authenticated is slightly simpler than the above “qualification authentication method”. In the present invention, the one-way function used for generating the authentication data includes DES and FEAL.
And a common key encryption method such as However, security depends on the one-way function used, that is, the strength of the common key encryption method, and there is no effect of changing the random number to the number of times of authentication.

The authentication methods in the above three methods are all qualification authentication methods using variable authentication information. An important feature of such a qualification authentication method is that authentication data passed from the subject to the authenticator through a communication path such as the Internet differs for each authentication phase (different each time). However, in the next authentication phase (at the time of the next authentication), authentication will not be performed unless another authentication data is sent from the subject to the authenticator, so that the unauthorized eavesdropper cannot impersonate the legitimate subject. It is.

[0013]

The Lamport method has a problem that the amount of processing (calculation) on the authenticated user side is very large, and that the authenticated person needs to periodically update the password. There was a problem. In the CISON method, the necessity of updating the password, which is a drawback of the Lamport method, could be eliminated, but the problem of a large amount of processing (calculation) in the authenticated person and the authenticated person remained. The user authentication method in the "information transmission / reception control method having a user authentication function" was able to reduce the processing (computation amount) of the authenticated person, which is a disadvantage of the CISON method. The procedure is rather complicated, and there is a lot of data that needs to be managed on the authentication server side in accordance with the user, and during actual operation, it is necessary to carefully consider the processing procedures of the quasi-normal system and the abnormal system. there were.

[0014] An object of the present invention is to provide a qualification authentication method using variable authentication information for authenticating an authenticated person on a network having insufficient security on a network. By providing a very small amount of processing (calculation) to be executed, both the authenticated side and the authenticating side can realize a simple and small program size, and provide a method that can perform secure authentication that is strong against eavesdropping on the communication path. Is to do.

[0015]

In order to solve the above-mentioned problems, a qualification authentication method using variable authentication information according to the present invention is characterized in that the subject is kept secret from the authenticator and the subject is kept secret. In a qualification authentication method in which the user can be authenticated without giving a password and the authentication information transmitted from the subject to the certifier is made variable at each authentication request, in the initial registration phase, The first time using a one-way function that generates one-way output information such that it is difficult to calculate input information based on its user ID, password, and random number A step of generating authentication data, a step in which the authenticated person transmits his / her user ID and initial authentication data to the authenticator, and a step in which the authenticator receives the first authentication data received from the authenticated person at the time of the first authentication. for In the authentication phase, the subject to be authenticated uses the one-way function and the intermediate data for the current authentication data and the current The authentication data and the next authentication data are generated, and the exclusive OR operation for the current authentication and the next authentication are performed by performing an exclusive OR operation on the intermediate data for the current authentication and the next authentication data with the current authentication data. Generating an exclusive-OR for the authenticated person; and transmitting the user's own user ID, an exclusive-OR for the current authentication, and an exclusive-OR for the next authentication to the authenticator. The authenticator uses, as input information, the exclusive OR of the currently authenticated exclusive OR received from the authenticated subject and the previously registered authentication parameter, and uses the one-way function to validate the authenticated subject. Generating an authentication parameter, comparing the validity check parameter with the previously registered authentication parameter, determining that the authentication has been established if they match, and determining that the authentication has not been established if they do not match, and that the authentication has been established. In this case, an authentication parameter for the next authentication is generated by an exclusive OR of the next authentication exclusive OR obtained from the subject and the authentication parameter registered last time, and instead of the authentication parameter registered last time. There is a step of registering the authentication parameters for the next authentication, and the above steps are successively performed to authenticate a person to be authenticated.

That is, according to the present invention, the person to be authenticated (including the device) generates a random number for each authentication phase and unidirectionally converts the current authentication data and the next authentication data based on the random number, the user ID, and the password. This is calculated using a function, and the result is further encrypted using exclusive OR so that only the person to be authenticated can decipher it, and these are combined with the user ID of the person to be authenticated, and the authenticator (including a device such as a server). ), And the authenticator receives the above three pieces of information from the person to be authenticated, and uses the one-way function based on the current authentication data to calculate the validity check parameters and the previous authentication phase. The authentication parameters are compared with the registered authentication parameters, and if they match, it is determined that the current authentication has been established, and the next authentication data is registered as the next authentication parameter.

According to the present invention, (1) transmission and reception of authentication-related information performed between a person to be authenticated and the authenticator at the time of performing one authentication process in the above-described prior art is viewed from the person to be authenticated. The one-and-a-half round trip (a total of three transmissions / receptions) required more than one transmission to the authenticated person. (2) In the prior art described above, the authenticated person In contrast to four or more authentication-related data items managed by each user, this method requires only one data item. (3) Excluded by the authenticated person and authenticator in each authentication phase Since the number of encryption or compound processes other than the logical OR operation is reduced to twice on the authentication side and four times on the subject side, the processing amount (computation amount) executed by the subject and the authenticator is extremely small. The main effect is that you can.

Further, DES and FE are used as the one-way function E.
It is preferable to use a function used for a secret key cryptosystem such as AL. Decryption of authentication information is impossible, and F
EAL realizes high-speed encryption processing.

[0019]

BEST MODE FOR CARRYING OUT THE INVENTION

First Embodiment Before describing a qualification authentication method using variable authentication information according to the present invention, a one-way function will be described first. A one-way function refers to a function that has no effective method of back-calculating input data from output data other than crushing input data. Such a property can be realized by using a secret key encryption algorithm such as DES or FEAL.
In particular, FEAL is software on a 16-bit personal computer, 200 Kbps, and 9 LSIs.
This is an excellent secret key cryptosystem that realizes an encryption processing speed of 6 Mbps (clock 10 MHz).

The secret key encryption algorithm is defined as C = E (P _A ,
S _B ). E is a one-way function (secret key encryption function, the second parameter is the private key), C is the ciphertext, the P _A plaintext, S _B is a secret key. The P _A plaintext, S _B input information, when the output information C, even if found plaintext P _A and the output information C can not be calculated back input information S _B.

Next, an embodiment of the qualification authentication method of the present invention will be described. The data flow of the authentication method of the present invention is shown in FIGS. 1 shows the data flow in the initial registration phase, FIG. 2 shows the data flow in the first authentication phase, and FIG. 3 shows the data flow in the k-th authentication phase. Data flows from top to bottom or along arrows. In the figure and the following description, the one-way operation C = E (P _A ,
S _B ) is represented as C ← E (P _A , S _B ). The exclusive OR operator is represented by ＠.

FIG. 4 shows an embodiment of a functional block for realizing the qualification authentication method of the present invention. 4, 1 is an authentication control mechanism, 2 is an authentication control mechanism, 3 is a public list, 4 is a secret information input mechanism, 5 is a random number generation mechanism, 6 is a one-way information generation mechanism, 7 is a random number recording mechanism, 8 is an information transmitting mechanism, 9 is an information receiving mechanism, 10 is an information recording mechanism, 11 is an information comparing mechanism,
Numeral 12 is an arithmetic mechanism. In the present embodiment, the authentication procedure will be described with the authenticator U _A as the authentication server and the user U _B as the user to be authenticated. User to be authenticated U _B has a user ID = A self published as P _A, and those with Pasuwado S that managed in secret only themselves, using the exclusive OR of the Pasuwado S and random number as S _B Shall be.

The authentication method in the present embodiment is roughly divided into two phases, an initial registration phase and a subsequent authentication phase. Authentication phase is first, second
The third, third, etc. are sequentially repeated. Authentication server U _A
Is performed by the authentication control mechanism 1. The authenticated user U _B is controlled by the authenticated control mechanism 2. Also,
The user ID A is registered in the public list 3.

[Initial Registration Phase] First, the initial registration phase will be described. User to be authenticated U _B side (processing) password S is taken by the secret information input mechanism 4. Use P _A = A as your user ID. N ₍₀₎ is arbitrarily set by the random number generation mechanism 5 and the random number recording mechanism 7
To record. The following data is calculated by the one-way information generation mechanism 6. The secret key encryption processing function E is used as the one-way function. First, the first authentication intermediate data E ₍₀₎ ← E (A, S ＠ N ₍₀₎ ) is generated, and the first authentication data E ² ₍₀₎ ← E (A, E ₍₀₎ ) is generated. Generate.

[0025] In terms of the preparation of the above user to be authenticated U _B side (transmission processing), send the following data to the authentication server U _A by the information transmission mechanism 8, a request for registration. In this case, the transmission is performed through a secure route (secure route) without fear of eavesdropping. User ID A, first authentication data E ² ₍₀₎

Authentication Server U _A (Reception and Registration Processing) The information receiving mechanism 9 receives the user ID A and the first (next) authentication data E ² _(0), and receives the received data E ² _(0).
Is stored (registered) as the first authentication parameter (initial authentication parameter value) Z in the information recording mechanism 10.

[Authentication Phase] Next, the authentication phase will be described. First, the first (k = 1) authentication procedure will be described. Authenticated user U _B side (arithmetic processing) N ₁ is arbitrarily set by the random number generation mechanism 5 and stored in the random number recording mechanism 7. Next, the following data is calculated by the one-way information generation mechanism 6. Generate next authentication intermediate data E ₍₁₎ ← E (A, S ＠ N ₍₁₎ ), and generate next authentication data E ² ₍₁₎ ← E (A, E ₍₁₎ ). . Next, the N stored in the random number recording mechanism 7 in the initial registration phase
_{Using (0)} , the intermediate data for authentication this time E ₍₀₎ ← E
(A, S ＠ N ₍₀₎ ) is generated, and the current authentication data E ² ₍₀₎ ← E (A, E ₍₀₎ ) is generated. Next, the following data is calculated by the arithmetic mechanism 12. This time, the exclusive OR F ₍₀₎ = E ₍₀₎ ＠ E ² ₍₀₎ for authentication is calculated.
Calculate the exclusive OR G ₍₁₎ = E ² ₍₁₎ ＠E ² ₍₀₎ for the next authentication.

[0028] transmits the following data to the authentication server U _A by a user to be authenticated U _B side (transmission processing) information transmission mechanism 8. User ID A, exclusive OR F ₍₀₎ for the current authentication, exclusive OR G ₍₁₎ for the next authentication At this time, the transmitted data is encrypted so that only the person to be authenticated can decrypt it. Alternatively, a route (general route) that may be intercepted, such as the Internet, may be used.

Authentication server U _A side (reception and authentication processing) Receives user ID A, exclusive OR F ₍₀₎ for current authentication, exclusive OR G ₍₁₎ for next authentication, and The intermediate parameter X for validity confirmation is generated by the operation mechanism 12 by the following operation. X = F ₍₀₎ ＠Z Here, Z = E ² ₍₀₎ is an authentication parameter registered in the information recording mechanism 10 in the initial registration phase. In this exclusive OR operation, if F ₍₀₎ = E ₍₀₎ ＠E ² ₍₀₎ is received from the authenticated user U _B , the operation result becomes X = E ₍₀₎ . Should be. Next, the validity check parameter Y is generated by the one-way information generation mechanism 6 by the following calculation. Y ← E (A, X) If the validity confirmation parameter Y matches the authentication parameter Z = E ² ₍₀₎ stored (registered) in the initial registration phase, the current authentication is established, If they do not match, authentication is not established.

Authentication Server U _A (Registration Processing) When the authentication is established, the next authentication parameter Z ′ is generated by the arithmetic mechanism 12 by the following calculation. Hereinafter, as for the authentication parameters Z and Z ', those obtained by calculating based on the received data are used as Z', and the registered parameters are used as Z. Z ′ = G ₍₁₎ ＠Z Here, Z = E ² ₍₀₎ is an authentication parameter registered in the information recording mechanism 10 in the initial registration phase, and G ₍₁₎ = E ²
₍₁₎ ＠E ² ₍₀₎ is data received from the user U _B to be authenticated. Since the authentication has already been established, G ₍₁₎ is the user ID
= A, and the calculation result should be Z '= E ² ₍₁₎ . Finally, Z '
= E ² ₍₁₎ is stored (registered) in the information recording mechanism 10 as an authentication parameter Z to be used next time, that is, in the second authentication. If the authentication is not successful, the authentication parameter Z is unchanged.

Generally, the k-th (k is a positive integer) authentication procedure is as follows. Authenticated user U _B side (arithmetic processing) N _(k) is arbitrarily set by the random number generation mechanism 5 and stored in the random number recording mechanism 7. The following data is calculated by the one-way information generation mechanism 6. Intermediate data for next authentication E
_(k) ← E (A, S ＠ N _(k) ) is generated, and the next authentication data E ² _(k) ← E (A, E _(k) ) is generated. next,
N stored in the random number recording mechanism 7 in the previous authentication phase
_{Using (k-1)} , the intermediate data for authentication this time E _(k-1) ← E
It generates (A, S @ N (k -1)), further, the current authentication data _{^{E 2 (k-1) ←}} E generates the _{(A, E (k-1} )). next,
The following data is calculated by the arithmetic mechanism 12. The exclusive OR F _(k-1) = E _(k-1) ＠E ² _(k-1) for the current authentication is calculated, and the exclusive OR G _k = E ² _(k) ＠ for the next authentication is calculated. E ²
Calculate _(k-1) .

[0032] transmits the following data to the authentication server U _A by a user to be authenticated U _B side (transmission processing) information transmission mechanism 8. User ID A, exclusive OR F _(k-1) for the current authentication, exclusive OR G _{( k)} for the next authentication At this time, the transmitted data is encrypted so that only the person to be authenticated can decrypt it. Alternatively, a route (general route) that may be intercepted, such as the Internet, may be used.

The authentication server U _A side (reception and authentication processing) receives the user ID A, the exclusive OR F _(k-1) for the current authentication, and the exclusive OR G _{( k)} for the next authentication. The intermediate parameter X for validity confirmation is generated by the operation mechanism 12 by the following operation. X = F _(k-1) ＠Z Here, Z = E ² _(k-1) uses the authentication parameter registered in the information recording mechanism 10 in the previous authentication phase. In this exclusive OR operation processing, F _{(k - 1)} as long as it has received from the authorized user to be authenticated U _B, operation results X =
It should be E _(k-1) . Next, the validity check parameter Y is generated by the one-way information generation mechanism 6 by the following calculation. Y ← E (A, X) If the validity confirmation parameter Y matches the authentication parameter Z = E ² _(k−1) registered in the previous authentication phase,
This authentication is established, and if they do not match, the authentication is not established.

Authentication server U _A side: If authentication is successful, the next authentication parameter Z ′ is generated by the arithmetic mechanism 12 by the following calculation. Z ′ = G _(k) ＠Z Here, Z = E ² _(k−1) is an authentication parameter registered in the information recording mechanism 10 in the previous authentication phase, and G _(k) =
^{_{E 2 (k) @E 2 (}} k-1) is a data received from the authenticated user U _B. Since the authentication has already been established, G _(k) is correctly received from the authenticated user having the user ID = A, and the calculation result should be Z ′ = E ² _(k) . Finally, Z ′ = E ² _(k) is stored (registered) in the information recording mechanism 10 as a new authentication parameter Z used by the user to be authenticated having the user ID = A in the next authentication. If the authentication is not successful, the authentication parameter Z is unchanged. The above authentication phase is sequentially continued with k = 1, 2, 3,... To authenticate the password of the subject.

The effects of the qualification authentication method according to the present embodiment are as follows. In the k-th authentication phase, the exclusive OR F _(k-1) for the current authentication and the exclusive OR G _(k) for the next authentication transmitted by the user U _B to the authentication server U _A are unidirectional. Since a kind of encryption is performed by exclusive OR operation with E ² _(k-1) generated using the sex function, it is impossible to decrypt the actual data even if a third party illegally eavesdrops. Can not.

In the k-th authentication phase, the authentication server U
_A is exclusive F for authentication time received from the user to be authenticated U _{B (k-1)} and exclusive OR G next authentication _(k), respectively authentication parameter Z = E ² and _(k-1) A kind of encryption is performed by the exclusive OR operation of E2 _(k-1) , but E ² _(k-1) has already been registered in the authentication server U _A in the previous authentication phase (the initial registration phase when k = 1). Since the exclusive OR operation is performed again with E ² _(k−1) , the intermediate parameter for validity authentication X = E
_(k-1) and the next authentication parameter Z = E ² _(k) can be decrypted. The exclusive OR operation is one of the simplest one-way functions with the simplest processing load, and has the characteristic that the original data can be restored if it is operated twice.

On the authentication server side, only one of the above-mentioned authentication parameters Z = E ² _(k−1) needs to be stored (managed) for each user to be authenticated. The number of decryption processes (use of the one-way function) other than the exclusive OR operation that must be executed in the authentication server is only twice (generation of the validity authentication parameter Y and the authentication parameter Z), and the processing load is high. Can be made very light.

On the side of the user to be authenticated, the encryption processing (use of the one-way function) other than the exclusive OR operation that must be executed for each authentication phase is performed four times (the current authentication intermediate data E _{(k -1)} , the current authentication data E ² _(k−1) , the next authentication intermediate data E _(k) , and the next authentication data E ² _(k) ), and the processing load can be sufficiently reduced.

The number of times information is exchanged between the authenticated user and the authentication server is only one transmission from the authenticated user to the authentication server in each authentication phase. Authentication processing can be reliably performed even in a network where is unstable.

[0040]

Second Embodiment In the first embodiment, in the k-th authentication phase, the authenticated user U _B uses the random number generation mechanism 5 to generate N _(k)
Is set arbitrarily and stored in the random number recording mechanism 7. In the present embodiment, E _(k) and E ² _(k) are stored instead of N _(k) . Thus, it is possible to reduce the user to be authenticated U _B must be performed in side XOR operation other than the encryption processing only 2 times each authentication phase.

In the above procedure, the certifier in the registration phase
The first authentication data to be stored is E^Two ₍₀₎But safety
Use one-way functions more often
Then E ^Two ₍₀₎Instead of Z₍₀₎=
E^Three ₍₀₎← E (A, E^Two ₍₀₎) Is stored and the k-th authentication
In the phase, the subject is given the user ID
A, Exclusive OR F for authentication this time_(k-1)= E^Two _(k-1)＠E^Three
_(k-1), Exclusive OR G for next authentication_(k)= E^Three _(k)＠E^Three
_(k-1)(E here^Two _(k-1)Is the intermediate data for authentication this time, E^Three _(k
-1)Is the authentication data of this time, E^Three _(k)Is the next authentication data
is there. ), The certifier who received it remembers
Authentication parameter Z = E^Three _(k-1)From this time intermediate day for certification
TA E^Two _(k-1)And the next authentication data E^Three _(k)Restore and get
E^Two _(k-1)And validity confirmation parameters from user ID A
Y = E^Three _(k-1)To generate the stored authentication parameters
Z = E^Three _(k-1)Authentication by comparing with
E if^Three _{( k)}As the next authentication parameter Z
It is also possible to adopt the following procedure. Or user ID
A, Exclusive OR F for authentication this time_(k-1)= E_(k-1)＠E^Three _(
k-1), Exclusive OR G for next authentication_(k)= E^Three _(k)＠E^Three
_(k-1)(Here E_{(k- 1)}Is the intermediate data for authentication this time,
E^Three _(k-1)Is the authentication data of this time, E^Three _(k)Is the next certification day
It is. ), The certifier who received it remembered
Authentication parameter Z = E^Three _(k-1)From this time intermediate data for authentication
E_(k-1)From user ID A to validity confirmation parameter Y
= E^Three _(k-1)Is generated, and the stored Z = E^Three _(k-1)And ratio
Authentication by comparison, and if authentication is successful, E^Three _(k)Next
It is also possible to adopt a procedure of storing as authentication data
It is. In addition, during the registration phase,
Times authentication data, E^Four ₍₀₎= E (A, E^Three ₍₀₎) And E^Five ₍₀₎=
E (A, E^Four ₍₀₎) Is also possible.

[0042] In the above embodiment has been described credential authentication method with the authentication server U _A and the object to be authenticated user U _B, the present invention can also be applied to credential among Internet users. In addition, it goes without saying that various changes can be made without departing from the spirit of the present invention.

[0043]

As described above, in the qualification authentication method using the variable authentication information according to the present invention, data to be transmitted from the authenticated side to the authenticated side is calculated using a one-way function.
Since this is further encrypted using exclusive OR so that it cannot be decrypted by anyone other than the person to be authenticated, a non-disposable qualification authentication method can be realized without showing its own secret information to the other party. Further, even if the fraudster alters the authentication information being communicated to one that is convenient for him, the validity cannot be guaranteed, and the next authentication cannot be received.

Further, in the authentication procedure shown in the embodiment, the one-way information generating process of the authenticated side only needs to be performed two to four times for one authentication. This is the number 10 of Lamport's method.
It is significantly smaller than 0 to 1000 times. Also, CINO
According to the N method, it is necessary for the authenticated person to exchange authentication-related information between the authenticated person and the authenticator at the time of performing the authentication process one time and a half round trip (total three times of transmission and reception). However, in the present invention, only one transmission from the subject to the authenticator is required.

Further, while there are four types of authentication-related information managed by the certifier for each person to be authenticated in the prior art, only one piece of information is required in this method.

As described above, according to the present invention, in particular, the processing amount (calculation amount) to be executed on the authenticatee side and the authenticatee side in each authentication phase can be extremely reduced. Therefore,
As an authentication method for authenticating the authenticated person on the network with insufficient security, both the authenticated side and the authenticating side perform only processing that can be realized with a simple and small program size, and It is possible to provide a method capable of performing secure authentication that is strong against eavesdropping.

The qualification authentication method using the variable authentication information of the present invention can be applied to qualification authentication in any situation in a network, communication, and computer system.
For example, since the amount of processing on the side to be authenticated can be reduced, IC
It can be applied to a card authentication system. This can be applied to a system such as an IC card telephone. Further, the present invention can be applied to mutual authentication between users at the same level on a network. Applicable to authentication of access qualification to database information. Further, when user groups having different interests coexist on the same LAN, application to authentication of access qualification to information of each group is also possible. In this case, since a considerably high speed is required, it is necessary to use an LSI for the secret key encryption for realizing the one-way conversion process.

[Brief description of the drawings]

FIG. 1 is a diagram showing an embodiment of a qualification authentication method (initial registration phase) according to the present invention.

FIG. 2 is a diagram showing an embodiment of a qualification authentication method (initial authentication phase) in the present invention.

FIG. 3 is a diagram showing an embodiment of a qualification authentication method (k-th authentication phase) according to the present invention.

FIG. 4 is a diagram showing an embodiment of a functional block according to the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Authentication control mechanism 2 Authentication control mechanism 3 Public list 4 Secret information input mechanism 5 Random number generation mechanism 6 One-way information generation mechanism 7 Random number recording mechanism 8 Information transmission mechanism 9 Information reception mechanism 10 Information recording mechanism 11 Information comparison mechanism 12 Arithmetic Mechanism A User ID C Output information E One-way function (secret key encryption processing function, second parameter
Data is a secret key)^Two _(k-1) This time authentication data E^Two _(k) Next authentication data F_(k-1) Exclusive OR for authentication this time  G_(k) Exclusive OR N for next authentication_(k) Random number P_A Plaintext S Password S_B Input information (secret key) U_A Authenticator (including device) U_B Subject (including device) X Intermediate parameter for validity confirmation Y Validity confirmation parameter Z Authentication parameter (registered) Z 'Next authentication parameter (calculated based on received data
And obtained)

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Inventor Satomi Kurihara 1-3-1 Gotenyama, Musashino City, Tokyo F-term in NTT Advanced Technology Co., Ltd. 5B085 AE09 AE23 5J104 AA07 JA13 JA14 KA01 NA05 NA11 PA07

Claims (2)

[Claims] 1. A method in which an authenticated person can authenticate himself without giving the authenticated person a password kept secret by the authenticated person. In a qualification authentication method using variable authentication information in which authentication information sent at each authentication request is variable, in an initial registration phase, a subject to be authenticated calculates input information based on his / her own user ID, password, and random number. Generating the first authentication data using a one-way function that generates one-way output information that is difficult to calculate in terms of computational complexity. The method includes the steps of transmitting a user ID and first-time authentication data, and registering the first-time authentication data received from the person to be authenticated as authentication parameters used in the first authentication. The user generates the intermediate data for the current authentication data, the current authentication data, and the next authentication data using the one-way function based on the user ID, the password, and the random number of the user. Generating an exclusive OR for the current authentication and an exclusive OR for the next authentication by performing an exclusive OR operation on the current authentication data with each of the next authentication data; and Transmitting the user ID of the user, the exclusive OR for the current authentication, and the exclusive OR for the next authentication to the authenticator; Using the one-way function as the input information, an exclusive OR of the sum and the previously registered authentication parameter is used to generate a validity confirmation parameter of the subject, and the validity confirmation parameter and the previously registered authentication parameter are generated. The authentication parameters are compared. If they match, the authentication is determined to be successful. If they do not match, the authentication is determined to be unsuccessful. If the authentication is successful, the exclusive logic for the next authentication received from the subject is authenticated. Generating an authentication parameter for the next authentication by an exclusive OR of the sum and the authentication parameter registered last time, and registering the authentication parameter for the next authentication in place of the authentication parameter registered last time, A qualification authentication method using variable authentication information, characterized in that the above steps are sequentially performed to authenticate a person to be authenticated. 2. The qualification authentication method using variable authentication information according to claim 1, wherein a function used for a secret key cryptosystem such as DES or FEAL is used as the one-way function E.