JP2018117318A - Authentication system, method and program, mobile device and server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication technique capable of performing authentication by an amount of calculation smaller than before.SOLUTION: An authentication system comprises a server, and a mobile device including a message authentication code-generating unit which uses a predetermined secret key K, a current time T and a predetermined message authentication code-generating function to generate a message authentication code C', and serve to transmit the message authentication code C' to the server, where i is one of integers given by i=1,2,.., N. The server includes a message authentication code-generating unit which performs a process of using a predetermined secret key K, a current time T and a predetermined message authentication code-generating function to generate a message authentication code C, for each of j=1,2,.., N, and an authentication unit which determines that the authentication of the mobile device has succeeded if there is the message authentication code Cwhich matches with the received message authentication code C'.SELECTED DRAWING: Figure 1

Description

  The present invention relates to information security technology. In particular, the present invention relates to a technology for protecting user privacy that may be leaked from information output from a mobile device using encryption technology.

  With the advent of the IoT (Internet of Things) era, mobile devices that perform communications such as RFID (Radio Frequency IDentifier) tags are being used. Some of such mobile devices transmit device-specific information at any time, and when the communication is intercepted, the movement route of the device may be specified. Holding such a device and acting may reveal a history of behavior and cause serious privacy damage.

  To deal with such problems, Patent Documents 1 to 4 invent a method for changing the transmission ID to a value that is indistinguishable from a cryptographically safe random number for RFID, so that transmission information cannot be linked. (For example, refer to Patent Document 1).

JP 2009-38816 A JP 2006-203743 A JP 2005-117460 A International Publication No. 2005/031579

  In order to realize the method of the prior art, it is necessary to share secret information between the mobile device on the transmission side and the server on the reception side. If this secret information is set to the same value for all mobile terminals, a problem will occur in the entire system if it is leaked. On the other hand, if different secret information is assigned to all mobile terminals, it is necessary to try all possible secret information on the server side in order to identify the information from which terminal, which is inefficient. There's a problem.

In fact, if the number of mobile terminal devices is N, the server side needs to calculate O (N) times each time data is received. If the mobile terminal performs data at the same frequency, Therefore, a calculation amount of O (N ² ) times is required every certain time. To solve this problem, if the private key is stored on the server side and the public key is stored on the mobile terminal side, the data received on the server side can be decrypted even if there is secret information that differs for each mobile terminal. By doing so, it can be calculated in O (1) times.

  However, public key cryptography requires more than 1000 times the amount of calculation compared to the common key cryptosystem based method used in the prior art, and in powerless IoT devices, the data transmission interval is limited, and the battery becomes bad. There is a risk of

  An object of the present invention is to provide an authentication system, method and program, mobile device, and server that can perform authentication with a smaller amount of calculation than before.

An authentication system according to an aspect of the present invention uses i as an integer of any one of i = 1, 2,..., N, a predetermined secret key K _i , a current time T, and a predetermined message authentication code generation function. 'includes a message authentication code generator for generating a message authentication code C _i' authentication code C _i and the mobile device that transmits to the server, a predetermined secret key K _j, the current time T and the predetermined message authentication code generating function There is a message authentication code generation unit that performs processing for generating a message authentication code C _j for each of j = 1, 2,..., N, and a message authentication code C _j that matches the received message authentication code C _i ′ In this case, the server includes an authentication unit that the mobile device authentication is successful.

An authentication system according to an aspect of the present invention uses i as an integer of i = 1, 2,..., N, a predetermined secret key K _i , a counter value c, and a predetermined message authentication code generation function. 'includes a message authentication code generator for generating a message authentication code C _i' message authentication code C _i and a mobile device that transmits to the server, a predetermined secret key K _j, the counter value c and a predetermined message authentication code generation A message authentication code C _j that matches the received message authentication code C _i ′ and a message authentication code generation unit that performs processing for generating a message authentication code C _j for each of j = 1, 2 _,. If there is, there is provided a server including an authentication unit that the mobile device has been successfully authenticated.

  Authentication can be performed with a smaller amount of calculation than before.

The block diagram for demonstrating the example of an authentication system. The flowchart for demonstrating the example of the authentication method (process of a mobile device). The flowchart for demonstrating the example of the authentication method (server process).

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  A message authentication code (MAC), which is one of common key encryption techniques, is used. A different MAC secret key is assigned to each mobile terminal, and the MAC target that must be changed each time is information that can be shared between the mobile terminal and the server without communication, such as time information, a counter value, and the like. As a result, the server can efficiently retrieve the MAC value by O (N) hash calculations, and solves the privacy problem and the matching problem on the server side.

For cryptographically secure MAC used throughout the system, if the data to be authenticated is D and the secret key is K,
C ← G _K (D)
It shall be calculated by A code C is a predetermined message authentication code generation function using G and _K.

The authentication system includes, for example, a mobile device 1 _i (i = 1, 2,..., N) and a server 2. The mobile device 1 _i includes, for example, a message authentication code generation unit 11. The server 2 includes, for example, a message authentication code generation unit 21 and an authentication unit 22.

The mobile device 1 _i may further include an encryption unit 22 described later. In this case, the server 2 may further include a decryption unit described later.

  The authentication method is realized by each part of the authentication system performing the processing from step S11 to step S22 described below with reference to FIGS.

As advance preparation, first, a secret key K _i is generated for the mobile device 1 _i (i = 1, 2,..., N), and the generated secret key K _i is stored in the mobile device and the server 2. . Generation processing of the secret key K _i may be performed by the server 2 may be performed by the key generation device (not shown).

When authenticating, the mobile device 1 _i gives the server 2 the time T,
C _i '← G _Ki (T)
And C _i 'is transmitted to the server 2.

That is, the message authentication code generation unit 11 of the mobile device 1 _i generates a message authentication code C _i ′ using a predetermined secret key K _i , the current time T, and a predetermined message authentication code generation function (step S11). Then, the mobile device 1 _i transmits the generated message authentication code C _i ′ to the server 2.

Server 2 in advance
C _j ← G _Kj (T) for j = 1,2,…, N
The previously calculated, searching for a C _j to match the C _i 'received. If there is a match, the server 2 can confirm that the transmission is from the mobile device j.

That is, the message authentication code generation unit 21 of the server 2 performs the process of generating the message authentication code C _j using the current time T and a predetermined message authentication code generation function for each of j = 1, 2,. (Step S21). Then, if there is a message authentication code C _j that matches the received message authentication code C _i ′, the authentication unit 22 of the server 2 assumes that the authentication of the mobile device 1 _i has succeeded (step S22).

Hereinafter, the safety of the above embodiment will be described. The secret key K _i generated in advance preparation must be made unpredictable using a cryptographically secure (pseudo) random number generator and securely stored in all the mobile devices 1 _i and the server S. By any chance, even if the secret key K _i of the mobile device 1 _i leaks, other than the mobile device 1 _i is the fact that do not use, the problem can be localized only to the mobile device 1 _i.

The MAC used in the system must be indistinguishable from the pseudo random function (PRF). Many standard methods such as CMAC and HMAC satisfy this property. When this method that cannot be distinguished from PRF is used, due to the nature of C _i ′ sent from the mobile device, the probability of superiority for any C _i1 ′ and any C _i2 ′ by just looking at it Privacy is preserved because it cannot be related with.

The effects of the above embodiment will be described below. For each mobile terminal 1 _i , since the MAC is calculated only once to calculate the authentication code C _i ′ each time, it can be handled with a considerably smaller calculation amount than public key cryptography.

For the server S, at each time T, N MAC calculations and a calculation amount for searching for a C _i that matches the received C _i ′ are required. The amount of computation for checking the coincidence between C _i ′ and C _i is O (1) times by hashing C _i (i = 1,2, ..., N) (for retrieval). Since it can be found by calculation, it can be calculated by MAC calculation and hash of O (N) times at the maximum.

The length of the secret key K _i is long enough so that impossible exhaustive search like set to, for example, 80 bits or more. By setting it to about 80 bits or more, the length of the code C, which is the MAC output, can withstand a brute force attack.

  According to the above embodiment, communication from a mobile communication device can be specified with a calculation amount based on a common key encryption while protecting privacy, and even if there is a secret key leakage from the mobile communication device, the entire system is not affected. Can be.

[Modification]
In the above embodiment, instead of using the time T for input to the MAC, a counter shared between the mobile device 1 _i and the server 2 may be used. The counter may be updated by LFSR or a hash function as well as simply adding +1.

That is, the message authentication code generation unit 11 of the mobile device 1 _i may generate the message authentication code C _i ′ using a predetermined secret key K _i , a counter value c, and a predetermined message authentication code generation function. Further, the message authentication code generation unit 21 of the server 2 performs a process of generating a message authentication code C _j using a predetermined secret key K _j , a counter value c, and a predetermined message authentication code generation function, j = 1, 2 ,..., N may be performed.

Each mobile device 1 _i has a different counter for each mobile device 1 _i, server 2 has a counter corresponding to each mobile device 1 _i. When the server 2 generates the message authentication code C _j corresponding to the mobile device 1 _j , the message authentication code generation unit 21 of the server 2 includes the mobile device 1 _j s in the plurality of counters of the server 2. The message authentication code C _j is generated using the counter value corresponding to.

In the above embodiment, the message authentication code C _i may be calculated for a time that may be shifted on the server 2 side in preparation for the case where the time synchronization between the mobile device 1 _i and the server 2 is shifted. . This is an additional calculation if the previous generations are saved without calculating all possible deviations as time progresses as time T ₁ , T ₂ , ... Can be achieved without quantity.

That is, the message authentication code generation unit 21 of the server 2 may perform the process of generating the message authentication code C _j not only for the current time T but also for each time included in a predetermined time interval including the current time T. Good.

In the above embodiment, in addition to the secret key K _i for MAC, (authentication) is also key L _i for encryption, may be previously shared-storage in each mobile device 1 _i and the server 2 side.・ As an arbitrary data to be encrypted, send (with authentication) cipher E _Li (・) along with authentication from mobile terminal 1 _i to server 2, and if the server 2 side verifies the MAC, it will move Since the device 1 _i can be specified, the encryption key L _i is also found, and encrypted communication can be performed simultaneously.

That is, the mobile device 1 _i may further comprises an encryption unit 12, the encryption unit 12 generates a ciphertext by encrypting the encryption target data D using a predetermined common key L _i Also good.

In this case, the mobile device 1 _i transmits not only the message authentication code C _i ′ but also the ciphertext to the server 2. In this case, the server 2 further includes a decoding unit 23, the decoding unit 23, upon a successful authentication the mobile device 1 _i decrypts the ciphertext using a predetermined common key L _i May be.

In the above embodiment, the key shared between the server 2 and the mobile device 1 _i may be updated by a method having forward-security as described in, for example, Japanese Patent No. 4866407. Thereby, safety can be further improved.

That is, the predetermined secret key K _i may be updated in each of the mobile device 1 _i and the server 2.

  Needless to say, other modifications are possible without departing from the spirit of the present invention. For example, the above modifications may be combined as appropriate.

[Program and recording medium]
When implementing the respective processes in the mobile device 1 _i or the server 2 by the computer, processing of the mobile device 1 _i or function server 2 should have is described by the program. Then, by executing this program on the computer, the processing of the mobile device 1 _i or the server 2 is realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  Each processing means may be configured by executing a predetermined program on a computer, or at least a part of these processing contents may be realized by hardware.

An authentication system according to an aspect of the present invention uses i as an integer of any one of i = 1, 2,..., N, a predetermined secret key K _i , a current time T, and a predetermined message authentication code generation function. 'includes a message authentication code generator for generating a message authentication code C _i' authentication code C _i and the mobile device that transmits to the server, a predetermined secret key K _j, when time T and the predetermined message authentication code generating function j = 1, 2 the process of generating a message authentication code C _j using, ..., a message authentication code that matches the message authentication code generating unit to put me advance line for each N, the message authentication code C _i 'received When C _j is present, the server includes an authentication unit that the mobile device authentication is successful.

Claims (8)

Message authentication for generating message authentication code C _i ′ using _i as an integer of any one of i = 1, 2,..., N using a predetermined secret key K _i , current time T, and a predetermined message authentication code generation function A mobile device including a code generator and transmitting the message authentication code C _i ′ to the server;
A message authentication code generation unit that performs processing for generating a message authentication code C _j for each of j = 1, 2,..., N using a predetermined secret key K _j , a current time T, and a predetermined message authentication code generation function; If there is a message authentication code C _j that matches the received message authentication code C _i ′, an authentication unit that the mobile device has been successfully authenticated, and a server including:
Including authentication system. A message that generates a message authentication code C _i ′ using _i as an integer of any one of i = 1, 2,..., N, using a predetermined secret key K _i , a counter value c, and a predetermined message authentication code generation function A mobile device including an authentication code generation unit and transmitting the message authentication code C _i ′ to the server;
A message authentication code generation unit that performs processing for generating message authentication code C _j for each of j = 1, 2,..., N using a predetermined secret key K _j , a counter value c, and a predetermined message authentication code generation function And a message authentication code C _j that matches the received message authentication code C _i ′, an authentication unit that the mobile device has been successfully authenticated, and a server including:
Including authentication system. The authentication system of claim 1,
The message authentication code generation unit of the server performs processing for generating a message authentication code C _j for each of the times included in a predetermined time interval including the current time T as well as the current time T.
Authentication system.   The mobile device of the authentication system according to claim 1.   The server of the authentication system in any one of Claim 1 to 3. The message authentication code generation unit of the mobile device uses i as an integer of i = 1, 2,..., N, and a message using a predetermined secret key K _i , current time T, and a predetermined message authentication code generation function. A message authentication code generation step for generating an authentication code C _i ′;
A transmitting step in which the mobile device transmits the message authentication code C _i ′ to a server;
The message authentication code generation unit of the server generates a message authentication code C _j using a predetermined secret key K _j , a current time T, and a predetermined message authentication code generation function, j = 1, 2,. A message authentication code generation step to be performed for each of
If the authentication unit of the server has a message authentication code C _j that matches the received message authentication code C _i ′, an authentication step that the authentication of the mobile device has succeeded;
An authentication method that includes: The message authentication code generation unit of the mobile device uses i as an integer of i = 1, 2,..., N, using a predetermined secret key K _i , a counter value c, and a predetermined message authentication code generation function A message authentication code generation step for generating a message authentication code C _i ′;
A transmitting step in which the mobile device transmits the message authentication code C _i ′ to a server;
The message authentication code generation unit of the server generates a message authentication code C _j using a predetermined secret key K _j , a counter value c, and a predetermined message authentication code generation function, j = 1, 2,. A message authentication code generation step for each of N,
If the authentication unit of the server has a message authentication code C _j that matches the received message authentication code C _i ′, an authentication step that the authentication of the mobile device has succeeded;
An authentication method that includes:   A program for causing a computer to function as each unit of the mobile device according to claim 4 or the server according to claim 5.

Images