JP2003006163A - Method for generating and registering login/password - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a login/password for generating and registering method for preventing a password registered in a password file of a host computer from beingsily recognized by a third person through dictionary attacks or the like. SOLUTION: This login password generating and registering method consists of the steps of inputting ID data and a password from an input means, of generating a combined characters string obtained by combining a character string of the ID data inputted from the input means with a character string of the password in turn, of processing the combined character string by using a hash function to generate a character string of a hash value of an optional length, of extracting a prescribed portion of a character string in the character string of the hash value, adding a character string to the password character string inputted from the inputting means to be combined and generating a new combined password, and of registering the combined password as a login password, in a password file of a server.

Description

Description: BACKGROUND OF THE INVENTION [0001] 1. Field of the Invention [0002] The present invention relates to a method for generating and registering a login password for performing user authentication when logging in to a computer system. 2. Description of the Related Art Conventionally, when accessing a host computer from a communication terminal, user authentication is performed by a user inputting an ID and a password. In particular, a password uses a character string of several digits that only the user himself knows, and is registered in a password file of the host computer in advance, so that the password is used as information for comparison and collation. In other words, the user inputs ID data and a password from the communication terminal, compares the password with a password registered in the password file, and then makes various accesses possible only when they match. [0003] Since these passwords are freely determined by the user, a password that is difficult to remember, such as their name, date of birth or telephone number, is often used as a password. If the data registered in the password file is subjected to a dictionary attack, etc., the password is often easily known, and information related to privacy, confidentiality, etc. by unauthorized access by a third party who knew the password There is a danger of leaking or being damaged by unauthorized access. [0004] The present invention is intended to prevent a password registered in a password file of a host computer from being easily disclosed to a third party by a dictionary attack or the like. Provide a login password generation and registration method. [0005] A method for generating and registering a login password according to the present invention generates and registers an encrypted login password from ID data and a password input when logging in to a computer system. A method for generating and registering a login password, comprising the steps of:
Inputting D data and a password, generating a character string in which the character string of the ID data and the character string of the password input from the input unit are sequentially combined,
Processing the character string using a hash function to generate a character string of a hash value of an arbitrary length; extracting a predetermined part of the character string from the character string of the hash value; And generating a new combined password by adding the combined password to the character string of the password input from the input unit, and registering the combined password as a login password in a password file of a server. And Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a system block diagram of a system to which a method for generating and registering a login password according to the present invention is applied. FIG. 2 is a display example when ID data and a password are input from a communication terminal. FIG. 4 is a flowchart for explaining a method for generating a login password. FIG. 4 is a flowchart showing a processing procedure of a method for generating and registering a login password of the present invention. As shown in FIG. 1, a system 1 to which a method for generating and registering a login password according to the present invention is applied includes a server 2 and a local area network (L
A communication terminal 4 provided so as to be accessible via a line 3 by an in-house network such as AN), and a public line network 5 such as the Internet, which is communicably connected between the server 2 and an external server or communication terminal. [0008] The communication terminal 4 comprises a display means 6, a storage means 7, an input means 8, a communication means 9, and a control means 10. The server 2 includes a communication unit 11, a hash processing unit 12, a login password generation unit 13, a storage unit 14, a password file 15, a control unit 16, and a comparison and collation unit 19. The hash processing means 12 is a means for generating a hash value of a predetermined length regardless of the length of the original data by processing the original data with a hash function. When the original data is processed by the hash function, the hash value is greatly different if the original data is slightly different, and it is almost impossible to guess the original data from the hash value. The login password generating means 13 is a means for generating a login password, which is authentication data, from ID data and a password input when a user accesses the server 2 from the communication terminal 4. Then, the login password generated by the login password generation means 13 is registered in the password file 15 as authentication data for comparison and comparison when accessing the server 2 from the communication terminal 4. When the user communicates with the server 2 using the communication terminal 4 or communicates with an external server or communication terminal via the server 2 using a public network such as the Internet. First, it is necessary to send a login command from the communication terminal 4 to the server 2. Then, on condition that the login command is authenticated by the server 2, access from the communication terminal 4 to the server 2 is permitted thereafter. Next, a processing procedure for generating and registering a login password will be described. First, when the user accesses the server 2 using the communication terminal 4, after displaying a display screen for login input as shown in FIG. ID from input means 8
Enter the data 17 and the password 18 respectively (S
1). For example, as an example of the input data from the input unit 8, the ID data 17 is “K” and the password 18 is “04”.
15 ". The ID data 17 and the password 18 input to the communication terminal 4 are transmitted from the communication means 9 to the server 2 (S2). The server 2 that has received the ID data 17 and the password 18 converts the character string “K0415” in which the ID data 17 and the password 18 are sequentially arranged into the character string “K0415” of the original data by the hash processing unit 12. A hash function is used to calculate a hash value (S3). FIG. 3 shows the character string “K0415” of the original data.
2 shows a state in which a hash value composed of 20 bytes is calculated by processing with a hash function. Next, the login password generation means 13 extracts a part of the character string of the hash value generated by the hash processing means 12 and converts this character string into the original data of the password received by the server 2 from the communication terminal 4. The string "04
15 "and synthesized to generate synthesized password data composed of a new character string (S4). For example, login password generating means 13
Then, as shown in FIG. 3, the ID data 17 received by the server 2 and the password 1
After generating a 20-byte hash value obtained by processing the character string “K0415” in which the 8 are arranged in order by a hash function, 4-byte data arbitrarily extracted from the 20-byte hash value, for example, “ Xxxx "is inserted into the character string" 0415 "of the original data of the password received by the server 2 to synthesize the new character string" 04xxx15 ". Generate a composite password. Then, by registering the new character string "04xxx15" which is the composite password in the password file 15 of the server 2, the new character string is used as authentication data for the next access. It is stored as a login password (S5). Since the login password generated and registered in this way is composed of a part of a hash-processed character string in the password input from the communication terminal, even if a third party is registered in the password file 15, Even if the login password is stolen, the password, which is input data from the input means, cannot be easily deciphered, so that security from a third party who tries to act illegally can be maintained. As described above, the login password is generated and registered in the password file 15. In the processing at the time of access after the login password is registered in the password file 15, when the user accesses the server 2 from the communication terminal 4, the same ID as input in the first access is used. The authentication process is performed by inputting the data 17 such as “K” and the password 18 such as “0415”. That is, when the user inputs the ID data 17 and the password 18 from the communication terminal 4 and transmits this data to the server 2, the character string “K0415” in which the ID data 17 and the password 18 are arranged in order in the server 2 Against
By the hash processing means 12, the character string "K0
415 "is processed by a hash function to calculate a hash value. Next, a part of the character string of the hash value generated by the hash processing means 12 is extracted by the login password generating means 13, and the character string is converted into the original data of the password received by the server 2 from the communication terminal 4. The string "04
15 "to generate new character string data. A character string extracted from the hash value generated by the hash processing means 12 and a position where the character string is inserted into the original data of the password are subjected to the same processing as the above-described processing procedure in generating the login password. . Then, the login password generating means 13
Is compared with the data already registered in the password file 15 by the comparison and collation means 19, and if the data match, authentication is established. Is set to be accessible. As a result, the user can access the server 2 from the communication terminal 4.
Various communication services can be used by using a public communication line such as the Internet via the Internet. As described above, according to the method for generating and registering a login password of the present invention, a part of a password registered in a password file of a host computer is replaced with a part of data processed by a hash function. Is included, so even if a third party performs a dictionary attack for the purpose of stealing the password, the password will not be easily known to the third party, so the security is high,
It is possible to construct a computer system in which security is maintained.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a system block diagram of a system to which a method for generating and registering a login password according to the present invention is applied. FIG. 2 is a display example when inputting ID data and a password from a communication terminal. FIG. 3 is a diagram illustrating a method for generating a login password from ID data and a password. FIG. 4 is a flowchart illustrating a processing procedure of a method for generating and registering a login password according to the present invention. DESCRIPTION OF THE SYMBOLS 1 A system to which a method for generating and registering a login password according to the present invention is applied 2 A server 3 A line by an in-house network 4 A communication terminal 5 A public line network such as the Internet 6 A display unit 7 A storage unit 8 Input units 9 and 11 Means 10, 16 Control means 11 Communication means 12 Hash processing means 13 Login password generation means 14 Storage means 15 Password file 17 ID data 18 Password 19 Comparison and collation means

Claims (1)

Claims: 1. A login password generation and registration method for generating and registering an encrypted login password from ID data and a password input when logging in to a computer system, comprising: Inputting the ID data and the password from the input device; generating a character string in which the character string of the ID data and the character string of the password input from the input unit are sequentially combined; and processing the character string using a hash function. Generating a character string of a hash value of an arbitrary length, extracting a predetermined part of the character string from the character string of the hash value, and converting the character string to a character of a password input from the input means. Generating a new synthesized password by adding the synthesized password to a password in a server. Registering a login password in a file as a login password.