JP3583987B2 - Electronic authentication method and electronic authentication device - Google Patents

Description

ここで、乗法と加法は、考えている有限体の演算を用いるものとする。
【００８８】
この手順：プロシージャにおいて、書き換えようとするｉ番目のアファイン鍵Ｋ［ｉ］の係数ａは、書換の参考となるｊ番目のアファイン鍵Ｋ［ｊ］の係数ａと係数ｂとに基づき、書き換えられていることがわかる。
【００８９】
なお、この書き換え処理は、基本形とよぶべきであり、発生する乱数の容量を非常に大きくする場合などは、以下に述べる基本形の書き換え方法を反復することにより、鍵が“０”に収束する場合が考えられる。しかし、本願に述べた第２実施形態でのマスターキーシステムの応用について言えば、発生する乱数の容量は非常に小さいので、以下に述べる基本形の書き換え処理を実施したとしても鍵が“０”に収束することは考えられない。更に、図１３の乱数生成のフローチャートを用いて以下に説明する応用型の書き換え方法によれば、より完全に鍵が“０”に収束する場合を回避することが可能となる。
【００９０】
更に書き換えようとするｉ番目のアファイン鍵Ｋ［ｉ］の係数ｂは、書換の参考となるｊ番目のアファイン鍵Ｋ［ｊ］の係数ａと係数ｂとに基づき、書き換えられることがわかる。
【００９１】
このような多重アファイン鍵を用いた乱数生成装置（多重アファイン鍵システム）は、各初期値を与えられると複数の鍵から選ばれた一つの鍵に応じて乱数を生成し続けるのであり、鍵の使用回数を越えると、鍵を書き換えるための鍵が選ばれてアファイン鍵の係数ａとｂとが書き換えられる。
【００９２】
このような多重アファイン鍵システムを用いた乱数生成装置は、上述した手順に応じて構成されたデジタル回路をもつ電子回路基板により実現される。更に、上述した手順に応じてアファイン鍵データをコンピュータが処理するべくプログラムを作成しこれをコンピュータ装置に実行させることで、容易に同等の作用効果を得ることができる。このような手順で生成された擬似乱数は、真性乱数に限りなく近いものであり測定不可能なほどに周期が長いため、ストリーム暗号に使用されたとしても、第三者の既知平文攻撃にあって未定係数法などで解読しようとしても原理的に不可能である。
【００９３】
［多重アファイン鍵システムに用いられる変数］
ここで、本発明の多重アファイン鍵を用いる乱数生成装置等で繰り返し使用される変数、演算子、関数を以下に定義しておくものである。
変数として、以下のように定義しており、
Ｍが、アファイン鍵の数、
Ｋ［ｉ］．ａが、ｉ（０≦ｉ≦Ｍ−１）番目のアファイン鍵の係数ａ
Ｋ［ｉ］．ｂが、ｉ（０≦ｉ≦Ｍ−１）番目のアファイン鍵の係数ｂ
Ｋ［ｉ］．ｃが、ｉ（０≦ｉ≦Ｍ−１）番目のアファイン鍵の使用回数ｃ
Ｋ［ｉ］．ｎが、ｉ（０≦ｉ≦Ｍ−１）番目のアファイン鍵の寿命ｎ
Ｋが、アファイン鍵全体であり、Ｋ＝｛Ｋ［ｉ］ ｜０≦ｉ≦Ｍ−１｝で示され
Ｋ［ｉ］＝｛Ｋ［ｉ］．ａ， Ｋ［ｉ］．ｂ， Ｋ［ｉ］．ｃ， Ｋ［ｉ］．ｎ｝となり、
ｋが、暗号化／復号化のワード数（ｋ＝１，２，……）
ｘ０が、内部乱数の初期値
ｘ_ｋが、内部乱数用変数
Ｒ_ｋが、乱数出力
ｍ_ｋが、平文
ｃ_ｋが、暗号文
ｉが、乱数生成用アファイン鍵ポインタ
ｊが、アファイン鍵係数ａ書き換え用ポインタ
ｊ_ｂが、アファイン鍵係数ｂ書き換え用ポインタオフセットであり、１≦ｊ_ｂ＜Ｍの範囲で設定されるが、１でも構わない
ｖｋｅｙが、鍵回転用変数
ｖ_０が、鍵回転用変数の初期値
ｖが、鍵回転用変数の増分
ｚが、処理単位の１／２
ｚ_ｒが、乱数出力に使用するビット位置の集合
ｚ_ｐが、アファイン鍵指定に使用するビット位置の集合
演算子を、以下のように定義しており、
＊，×が、乗算
＋が、加算
（ｍｏｄ）が、剰余
（＋）が、Ｍを法とする加算
（ａｎｄ）が、論理積
（ｏｒ）が、論理和
（ｘｏｒ）が、排他的論理和
（ｓｈｌ）ｚが、左シフトであり、全体のビット長が２ｚである際に２のｚ乗でわることで、例えば（１１１１０１１０）（ｓｈｌ）４＝（００００１１１１）となる。
【００９４】
又、関数を以下のように定義しており、
ｆ（ｘ_ｋ、ｚ_１）が、ｘ_ｋからｚ_ｌで示すビット列を取り出したものとして定義される。
【００９５】
＜多重アファイン鍵システムの乱数発生の工程＞
以下に、各フローチャートを示して、第２実施形態で用いるマスターキーシステムが内蔵する乱数生成方法の各工程を詳細に説明する。
【００９６】
図１３は、乱数生成の手順を示したフローチャートであり、いわゆる鍵回転型の多重アファイン鍵を用いるものである。一般的なコンピュータ装置において、アルゴリズムが作成されたプログラムは、例えばハードディスク等の記憶領域に格納され、操作画面に応じるユーザの操作に従って実行されていく。
【００９７】
この乱数生成の手順は、上述した基本形の鍵書き換えの手法とは異なり、より確実に鍵が“０”に収束する場合を回避するものである。しかしながら、本願に述べた第２実施形態でのマスターキーシステムの応用について言えば、発生する乱数の容量は非常に小さいので、基本形の書き換え処理を実施したとしても鍵が“０”に収束することは考えられない。
【００９８】
乱数生成される手順としては、最初に多重アファイン鍵の各種の設定がなされ、それは例えばワード数ｋ、アファイン鍵のポインタｉ、変数ｘ_０等の設定がなされるが、それはユーザの操作を介してＲＡＭ４１５の各記憶領域にそれぞれ格納される（Ｓ１７１）。次に乱数生成用のアファイン鍵のポインタｉを決定し、これは、内部乱数ｘ_０から一つのアファイン鍵を指定するためのビット位置の集合ｚ_ｐに格納されているデータから決定される（Ｓ１７２）。次に、指定された鍵Ｋ［ｉ］に応じて、レーマー法の疑似乱数をＫ（ｘ）＝ａｘ＋ｂの式に従って生成する（Ｓ１７３）。乱数が生成されると、カウンタの値を１だけカウントアップする（Ｓ１７４）。その後、鍵書換用のポインタｊを、内部乱数ｘ_ｋからアファイン鍵指定に使用するビット位置の集合ｚ_ｐの値に加えて、鍵開演用変数ｖｋｅｙ＋ｖを加えてポインタ位置を特定する（Ｓ１７５）。
【００９９】
この鍵回転処理により、既に第１実施形態等で詳述したように、擬似乱数の周期を更に長くすることにより真性乱数に限りなく近づけることが可能となる。すなわち、アファイン鍵の書換のために複数のアファイン鍵から一つを特定するためのポインタｊを、ｊ＝ｆ（ｘ_ｋ，ｚ_ｐ）（＋）ｖｋｅｙとして、新たに鍵回転用変数ｖｋｅｙを加えることにより、使用する鍵を指定するアルゴリズムをより複雑化することができる。
【０１００】
つまり、繰り返しアファイン鍵を書き換える際に、アファイン鍵の書換の際のポインタ値ｊが反復性をもってくると鍵周期がそれだけ短くなってしまうが、新たな鍵回転用変数ｖｋｅｙはこれを改善するものであり、使用する鍵を特定するアルゴリズムを複雑化すればする程ポインタ値ｊの周期を長くすることができ、その結果、本発明の乱数生成装置は、真性乱数と実用上は変わりのない程の非常に長い周期をもつ擬似乱数の生成を可能としている。
【０１０１】
ここでは、書換を行うたびに一定値ｖずつ増えていく値として定義されているが、これに限るものではない。
【０１０２】
そして、アファイン鍵のカウンタ値ｃがアファイン鍵の寿命を示す値と同等となるまで、アファイン鍵が使用されておればアファイン鍵の書換を行う（Ｓ１７６）。最初に鍵カウンタの値をゼロとし（Ｓ１７７）、選ばれたアファイン鍵データＫ［ｊ］．ａ、Ｋ［ｉ］．ａ、Ｋ［ｊ］．ｂとに基づき、新たな係数ａと係数ｂとを決定していくが、この時、係数の上位１／２の値を下位１／２にシフトして、繰り返し鍵を書き換えることにより鍵データがゼロになる状況を完全に排除するものである（Ｓ１７８）。また、この時、更に“１”との論理和を加えることにより強制的に１ビット目を“１”とすることで、いわゆる弱鍵の排除を完全に行っている。
【０１０３】
さらに係数ｂにおいては、ポインタｊの値に更にｊ_ｂを加えることで、係数ａの書換用のアファイン鍵の遷移と、係数ｂの書換用のアファイン鍵の遷移とが異ならせることができ、生成する擬似乱数を真性乱数に限りなく近づけ、生成乱数の周期性を一層長くすることが可能となる（Ｓ１７９）。また、この時、更に“２”との論理和を加えることにより強制的に２ビット目を“１”とすることで、いわゆる弱鍵の排除を完全に行っている。
【０１０４】
その後、ｉ＝ｊとした後に（Ｓ１８０）、変数ｘ_ｋの所定ビット（ｚ_ｒ）を出力するべき乱数列｛Ｒ_ｋ｝として出力する（Ｓ１８１）。更に、ｋ＝ｋ＋１としてステップ５３に戻るものである（Ｓ１８２）。
【０１０５】
以上説明した手順により、第２実施形態で用いるマスターキーシステムが内蔵する乱数生成装置においては、乱数列が生成され、生成された乱数列に基づき、非常に高いセキュリティを発揮しながら、親鍵から子鍵が生成されるものである。従って図４の登録処理の場合に、ＧＫＥＹに基づいて、ＭＫＥＹが多重アファイン鍵システムを用いるマスターキーシステムにより生成され（Ｓ７３）、更に、この生成されたＭＫＥＹに基づいて、同様に多重アファイン鍵システムを用いるマスターキーシステムにより生成される（Ｓ７４）。更に、図５及び図６の認証処理においても、一度使用されたＴＫＥＹが例えば認証コードに基づいて、多重アファイン鍵システムを用いるマスターキーシステムにより生成される（Ｓ９０ａ）。これと並行して、一度使用されたＴＫＥＹが、被認証装置２において、例えば認証コードに基づいて、多重アファイン鍵システムを用いるマスターキーシステムにより生成される（Ｓ９０ｂ）。
【０１０６】
以上詳細に説明したように、第２実施形態においては、被認証者の写真データ等を暗号化する際に使用する鍵データを生成する際に、非常に第三者の解読を困難とする多重アファイン鍵システムを用いるマスターキーシステムを利用してこれを行うことによって、システムの簡便性と共に、認証システムの不正使用を意図する第三者に対しても非常に高いセキュリティを発揮させることが可能となる。
【０１０７】
又更に、第２実施形態の応用例として、認証局３での共通鍵であるＧＫＥＹについても、認証局３で独自に用意するのではなく、この認証局３の更に上位のシステムにおいて、上述したマスターキーシステム等の多重アファイン鍵システムを利用して用いることが考えられる。すなわち、複数の認証局３に対して、これらを管理する上位のシステムにより、マスターキーシステム等の多重アファイン鍵システムを利用して、それぞれの共通鍵であるＧＫＥＹを供給するものである。こうすることにより、認証局３で共通鍵であるＧＫＥＹを紛失したり誤って消去したりした場合でも、上位のシステムにより再度、マスターキーシステム等の多重アファイン鍵システムを利用してこのＧＫＥＹを提供することが可能となり、一層のシステムの信頼性・安定性を図ることが可能となる。
【０１０８】
又更に、第２実施形態においては、この被認証者の写真データ等を暗号化する際の暗号化そして復号化の手法においても、上述した多重アファイン鍵システムによる乱数生成機能に基づく暗号化復号化機能を応用することで、他の暗号化復号化手法を用いた場合以上の、格段に高いセキュリティの向上を望むことが可能となる。
【０１０９】
このように第１実施形態及び第２実施形態について本発明を詳述したが、本実施形態では認証が行われるたびに暗号データ及び認証コードを更新する例を示したが、これに限定されるものではなく、登録時の暗号データ及び認証コードを繰り返し使用するものでもよい。
【０１１０】
また、ＭＫＥＹとＴＫＥＹに基づいて暗号データを復号あるいは写真データを暗号化する場合を示したが、これに限定されるものではない。例えば、一旦暗号データをＭＫＥＹで復号化し、さらにＴＫＥＹで復号化する場合や、一旦画像データをＭＫＥＹで暗号化し、さらにＴＫＥＹで暗号化する場合でもよい。また、ＭＫＥＹあるいはＴＫＥＹの一方のみで暗号化及び復号化してもよい。
【０１１１】
例えばＭＫＥＹのみで暗号化及び復号化を行う場合、一のＭＫＥＹは暗号データの復号化（Ｓ８６）まで用いられる。認証（Ｓ８５）後、認証コードに基づいて新たなＴＫＥＹを生成するステップは、認証コードに基づいて新たなＭＫＥＹを生成するステップに置換される。なお、顧客２側の処理フローも同様に置換される。ＭＫＥＹのみで暗号化及び復号化を行う場合の流れを図１０に示す。図５と共通する部分には同一符号を付し、説明は省略する。
【０１１２】
また、図４〜図６に示す登録ステップ及び認証ステップは、それぞれ顧客２と認証局３の間で行われる場合を示したが、これに限定されるものではない。例えば、加盟店１が取引システム４を有し、かつ認証局３の機能を有する場合には、加盟店１と顧客２との間で直接登録及び認証を行ってもよい。
【０１１３】
また、上記図１に示したシステムはほんの一例にすぎない。例えば、上記システムに電子商取引の決済を行うクレジット会社が上記システムのネットワークに存在し、このクレジット会社が上記取引システム４を有していてもよい。また、クレジット会社が存在する場合でも、取引システム４と別個に設けられていてもよい。また、上記システムは電子商取引を行う場合を示したが、これに限定されず、例えば会社内の役員会議における昇格や降格事項を社員に報知する報知システム、給与明細を各社員に報知する給与明細報知システム、企業内での電子書類の閲覧システム等、本人や特定人しか見ることのできない書類等を報知するシステムであれば何でも適用可能である。例えば、給与明細を各社員に報知する給与明細報知システムの場合、図１の取引システム４を企業が有し、各社員が顧客２に該当し、各社員が自分だけの電子給与明細を見る場合に認証局３に認証要求を出す。このように、認証局３がアクセスした者が電子給与明細を求める社員本人であると認証できるため、各社員は自分だけの電子給与明細を見ることが可能となる。同様に、例えば企業内での電子書類の閲覧システムの場合、認証局３にアクセスし、認証局３により認証された者のみが電子書類の閲覧を行うことができる。さらに、このような認証局３による認証に加えて、各社員に例えば役職等に応じて新たな役職コードを顧客データ１８２に対応付け、この役職コードに基づいて特定書類のみを特定の役職にある者のみが閲覧することが可能となる。これにより、例えば役職の無い一般社員に重要事項が漏洩する恐れが無くなる。
【０１１４】
また、情報更新処理を行わない場合には、タグ２７１として書き換え可能な記憶媒体を用いる必要はない。ＣＤ−Ｒを用いる場合には、情報更新は追記することにより対応可能である。また、仮にＣＤ−Ｒの記憶容量を超えて追記できなくなった場合でも、ＣＤ−Ｒ上のデータを他のＣＤ−Ｒに移すことにより再度使用可能となる。
【０１１５】
また、上記実施形態においてネットワークといった場合には、例えばネットワークのプロバイダを介して有線でサーバ等が接続される場合のみならず、無線で接続されている場合も含まれることはもちろんである。また、顧客２としては、個人である場合のみならず、例えば認証局３と所定の契約に基づいて電子商取引を行う取引業者も含まれる。
【０１１６】
また、暗号化及び復号化手段や認証コード、暗号データの照合手段は顧客２及び認証局３ともに、端末内のプログラムにより実現する場合を示したが、これに限定されるものではなく、ハードウェアとしてこのような装置を端末に別途設けてもよい。
【０１１７】
また、認証局３側から顧客２側にＴＫＥＹを送信する際に、何ら暗号化を行わない例を示したがこれに限定されるものではなく、ＴＫＥＹを暗号化して送信してもよい。この場合、ＴＫＥＹを復号化するための鍵を認証登録時に予めタグ２７１に記録しておくのが好ましい。
【０１１８】
また、上記実施形態では認証コード及び暗号データを顧客２が送信し、認証局３側でこれらに基づいて認証する場合を示したが、これに限定されるものではない。例えば、暗号データを用いずに認証コードのみで認証を行い暗号データは顧客２が送信しなくてもよい。逆に、暗号データのみを送信して暗号データのみで認証を行っても良い。また、例えばＳ８２では認証局３は認証コード及び暗号データの送信を顧客２に要求したが、これらのみならず、例えば予め認証登録時に設定したパスワードを要求し、あるいはこの要求時にその要求時を特定する時間とともに送信してもよい。この要求時を特定する時間を送信した場合、さらに顧客２から認証コード等の送信時と比較して所定時間以上のタイムラグがある場合に認証を否認することができる。これにより、Ｓ８２で認証コード等の送信要求時の通信を傍受し、あるいはタグ２７１の不正コピー等を行った場合に、所定の時間をかけてデータを改竄したり、暗号解読をして悪意の第三者が不正に認証許可を受けようとするのを防止することができる。
【０１１９】
また、顧客２と認証局３で同一の認証コードを生成する場合を示したが、異なるコードを生成する場合でも両者が照合可能に対応づけられていればよい。
【０１２０】
さらに、本実施形態では顧客２側で本人を特定する画像を表示したが、これに限定されるものではない。本人を特定する音声等、端末で使用され得る識別情報であれば何でもよい。
【０１２１】
【発明の効果】
以上詳述したように本発明によれば、電子認証により認証を受けた使用者側の画面にその使用者に対応づけられた画像が表示されるため、認証を受けた者が作業を行う際の第三者の監視が可能となり、不正使用者のアクセスが少なくなるため、セキュリティが格段に向上する。
【図面の簡単な説明】
【図１】本発明の第１実施形態に係る電子認証システムの全体構成を示す図。
【図２】同実施形態に係る顧客の有する端末のハードウェア構成の一例を示す図。
【図３】同実施形態に係る認証局の有する端末のハードウェア構成の一例を示す図。
【図４】同実施形態に係る認証登録の流れを説明するための図。
【図５】同実施形態に係る電子認証の流れを説明するための図。
【図６】同実施形態における電子認証の認証否認の場合の流れを説明するための図。
【図７】同実施形態に係る認証登録のフローチャートを示す図。
【図８】同実施形態に係る認証局側の電子認証のフローチャートを示す図。
【図９】同実施形態に係る顧客側の電子認証のフローチャートを示す図。
【図１０】同実施形態の変形例に係る電子認証の流れを説明するための図。
【図１１】第２実施形態であるマスターキーシステムを利用した場合に用いるマスターキーシステムを説明するためのフローチャート。
【図１２】同実施形態に係るマスターキーシステムの原理を説明する原理図。
【図１３】同実施形態に係るマスターキーシステムの乱数生成を説明するフローチャート。
【符号の説明】
１．．．加盟店
２．．．顧客
３．．．認証局
４．．．取引システム
２１．．．バス
２２．．．ＣＰＵ
２３．．．メモリ
２４．．．キーボード
２５．．．ディスプレイ
２６．．．通信デバイス
２７．．．外部入力端子
２８．．．データ制御部
２９．．．プログラム制御部
８１．．．データ記憶部
９１．．．プログラム記憶部
９２，１９２．．．メインプログラム
９３，１９５．．．復号化プログラム
９４，１９６．．．暗号化プログラム
９５，１９７．．．認証コード生成プログラム
９６．．．表示プログラム
９７．．．ＴＫＥＹ生成プログラム
１８２．．．顧客データ
１９３．．．リクエストプログラム
１９４．．．照合プログラム
１９８．．．ＫＥＹ生成プログラム
２７１．．．タグ[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an electronic authentication method for confirming the identity of a user using a network, a storage medium storing an electronic authentication program, an electronic authentication device, and an authentication registration method, and more particularly to a method using a master key system. .
[0002]
[Prior art]
With the development of networks, needs for e-commerce, e-payment, and the like are increasing. Accordingly, it is necessary to confirm that the user of the network is who he or she is.
[0003]
[Problems to be solved by the invention]
By the way, recently, electronic authentication can be performed by using various mathematical algorithms.
[0004]
However, conventional electronic authentication does not always have high security. An authentication method in which a mathematical algorithm is complicated has been devised in order to increase security, but it is far from feasible in consideration of the current data transmission speed of a network.
[0005]
The present invention has been made to solve the above problems, and has as its object to provide an electronic authentication method capable of performing authentication easily and with high security, a storage medium storing an electronic authentication program, an electronic authentication device, and an authentication apparatus. To provide a registration method.
[0006]
[Means for Solving the Problems]
The present invention Electronic An authentication method in which an authentication device authenticates an authentication code in a recording medium detachably connected to a device to be authenticated connected to the network by a network, wherein a first common key and a second common key are stored in a storage area of the authentication device. In a state where the common key, the encrypted data and the authentication code are stored, and the first common key, the encrypted data and the authentication code are stored in the recording medium of the device to be authenticated, the device to be authenticated The authentication code is transmitted to the authentication device via a network, and the authentication device compares the authentication code read from the storage area with the received authentication code, and determines that the authentication is successful if the authentication codes match. If the authentication process is successful, and the authentication process results in successful authentication, the authentication device uses the first common key and the second common key of the storage area to convert the image data from the encrypted data in the storage area. And transmitting a second common key to the device to be authenticated, and the device to be authenticated uses the first common key of the recording medium and the received second common key to convert the encrypted data of the recording medium into image data. Is restored, a new second common key is generated using the authentication code in both the authentication device and the device to be authenticated, and new encryption data is generated using the new second common key and the first common key. Is generated, a new authentication code is generated from the first common key, the new second common key, and the new encrypted data, and the authentication device generates a new second common key, new encrypted data, and a new encrypted data. An information update process for rewriting the storage area is performed by the authentication code, and in the device to be authenticated, the recording medium is rewritten by the new encrypted data and the new authentication code, and in the next authentication process, the rewritten storage area and Using storage media Characterized in that Electronic Authentication method.
The present invention Electronic authentication method according to As described above, authentication is performed by a combination of the “first common key (MKEY) used only in the device” and the “second common key (TKEY) transmitted and received between devices via the network”. By performing the processing, it is possible to perform authentication processing with high security even for an open network. Therefore, even if an unauthorized third party via the open network monitors the incoming and outgoing signals of the authentication device 2 and the device 3 to be authenticated, it obtains the “first common key MKEY used only in the device”. Because they cannot do so, they cannot do so-called “spoofing” to fake customers. Further, even if the “first common key MKEY used only inside the device” is stolen from the inside of the personal computer which is the device 3 to be authenticated, it is possible to transmit / receive data between the devices via the network supplied via the network. If the second shared key TKEY cannot be obtained, “spoofing” cannot be performed. Therefore, according to the present invention, for example, highly secure authentication processing using a network such as the Internet can be easily performed.
[0023]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0024]
<< 1st Embodiment >>
FIG. 1 is a diagram showing an overall configuration of an electronic commerce system to which an authentication system according to a first embodiment of the present invention is applied. The e-commerce system includes a member store 1 that performs e-commerce, a customer 2 who wants to purchase goods from the member store 1 using e-commerce, a certificate authority 3 that authenticates the customer 2, a member store 1, It comprises a transaction system 4 provided with a system for realizing electronic commerce between the customer 2 and the certificate authority 3. In the system shown in FIG. 1, the settlement in the electronic commerce may be performed by a credit company, a bank, or the like, or may be performed by the member store 1 itself. In this authentication system, the components 1, 2, 3, and 4 are connected by a network, and data is exchanged via a so-called electronic communication path unless otherwise specified below.
[0025]
As shown in FIG. 1, a customer 2 sets up a shopping site for a home page of a member store 1 using a personal computer installed at home, for example. Then, when the customer 2 desires to purchase at the shopping site on the homepage, he makes a purchase request to the member store (S1). In response to the purchase request, the member store 1 displays a page corresponding to the purchase request on the homepage (S2).
[0026]
The customer 2 looks at the displayed screen, and if he / she wants to purchase, for example, connects a predetermined tag 271 to the external input terminal 27 of the terminal 20 of the customer 2 described later. Then, the authentication program stored in the tag 271 is started on the personal computer, and an authentication request is made to the transaction system 4 based on the authentication program (S3). Upon receiving the authentication request, the transaction system 4 requests the certificate authority 3 for authentication (S4). Based on the authentication request, the certificate authority 3 checks whether or not the customer 2 is himself. The obtained authentication result and approval code are sent to the customer 2 via the transaction system 4 (S5, S6). As a result, since the customer 2 has been authenticated as a registered person, the customer 2 is qualified to purchase a product on the website of the member store 1.
[0027]
The customer 2 selects and inputs a product item to be purchased (S7). By selecting this product item, the terminal of the member store 1 transmits an approval code and a confirmation request to the transaction system 4 (S8). The transaction system 4 receives the approval code and the confirmation request and performs settlement. Then, the notice of the settlement is transmitted to the member store 1 together with the approval code (S9).
[0028]
The member store 1 sends out the merchandise to the customer 2 based on the notice of the settlement and the approval code (S10).
[0029]
The customer 2 performs electronic commerce using the terminal 20 via the network. FIG. 2 shows a specific configuration example of the terminal 20. FIG. 2 shows a terminal 20 connected to a network. A bus 22 has a CPU 22 containing an OS (Operating System) for controlling the terminal 20 as a whole, and a program or data to be executed. A memory 23 for storing data and the like, a keyboard 24 for commanding the operation of the CPU 22 and the like, a monitor 25 for monitoring input data and outputting various network information and the like, a member store 1, a customer 2, a transaction system 4 A communication device 26 for transmitting and receiving data to and from another terminal, and an external input terminal 27 to which an external memory such as a tag described later can be connected are connected. The bus 21 is further connected to a data storage unit 81 via a data control unit 28 and a program storage unit 91 via a program control unit 29.
[0030]
The data storage unit 81 and the program storage unit 91 are storage means such as a hard disk, a flexible disk, or an optical disk, and store various data or programs created for performing the electronic authentication of the present invention.
[0031]
Specifically, the program storage unit 91 includes a decryption program 93 for decrypting encrypted data, an encryption program 94 for encrypting photo data, and an authentication code for generating an authentication code from the encrypted data. A generation program 95, a display program 96 for displaying photograph data, and a TKEY generation program 97 for generating a new TKEY based on an authentication code (using a master key system) are stored. In the TKEY generation program 97, the master key system is not used in the first embodiment, but is used in the second embodiment. Each of the programs 93 to 97 is routineized, and an application for executing each of the programs 93 to 97 is a main program 92. Note that these programs 93 to 97 may be stored in the tag 271 instead of in the program storage unit 91. In addition, if data necessary for authentication can be stored in the tag 271, the data control unit 28 and the data storage unit 81 do not necessarily need to be provided. The decryption program 93 is used when decrypting encrypted data into photo data, and the encryption program 94 is used when encrypting photo data based on MKEY and TKEY.
[0032]
For example, assuming that MKEY is X1, TKEY is X2, and photograph data is p, the encryption program 94 first generates a random number α, and generates a new key Xα based on the MKEY and TKEY. The key Xα is generated, for example, as Xα = (X1 * X2) × α, and encrypted data pc = [p, Xα] is generated based on the key Xα. Note that (a * b) indicates a symbol for performing a predetermined operation with a and b. For example, a logical operation such as a logical sum, a logical product, or a negation of a and b may be performed. Not limited to the calculation, but may be generated using a predetermined function. The encrypted data pc = [p, Xα] indicates that the photograph data p has been encrypted with the key Xα. Hereinafter, the symbol represented by [a, b] indicates that the data a is encrypted with the key b. The encryption program 94 is configured by such an algorithm. Also, the decryption program 93 performs the reverse process of the encryption program 94, and a detailed description is omitted.
[0033]
The authentication code generation program 95 is used when an authentication code is generated based on encrypted data, MKEY, and TKEY. The authentication code is a hash value calculated based on the MKEY, TKEY, and the encrypted data, and a data amount of about 200 bytes is sufficient. MKEY and TKEY in the authentication code generation are not used for encryption, and need not be used. That is, the authentication code may be generated by simply encoding the encrypted data without using the MKEY and the TKEY. This authentication code is stored in a data storage unit 181 of the certificate authority 3 and a tag 271 of the customer 2 which will be described later. The authentication code is a code used for verification at the time of authentication. Each time authentication is performed, the authentication authority 3 and the customer 2 rewrite the authentication code 3 with new values by an update process described later. After that, the same authentication code is not used.
[0034]
The authentication code S (n) is calculated based on the encrypted data based on the key Xα. More specifically, the authentication code generation program 95 is configured by the same encryption and coding algorithm as the encryption program 95 for the photo data p. As a coding algorithm, a normal data coding algorithm is applied. Note that the photo data may be encrypted two or more times to obtain the encrypted data.
[0035]
The TKEY generation program 97 is used when generating a TKEY based on an MKEY and when generating a TKEY based on an authentication code, and the algorithm is the same as an ordinary common key generation algorithm. Here, in the second embodiment, as described later, a master key system using a multiple affine key is used.
[0036]
The external input terminal 27 is connected to, for example, a tag 271 as a removable external memory. The tag 271 is a removable and rewritable storage means, and may be any rewritable storage medium such as a floppy disk, CD-R, CD-RW, DVD-RAM, MO, memory card, and the like. It is desirable that the external memory be a highly versatile external memory. The tag 271 stores various data required for authentication. By connecting the tag 271 to the external input terminal 27, the CPU 22 reads the tag 271 so that the tag 271 can transmit the data to another terminal via a network. Has become.
[0037]
The certificate authority 3 uses the terminal 30 to authenticate electronic commerce via a network. FIG. 3 shows a specific configuration example of the terminal 30. As shown in FIG. 3, the certificate authority 3 has a terminal 30 having substantially the same configuration as that shown in FIG. In the case of the terminal 30, the data storage unit 181 stores customer data 182 required for authentication of a plurality of customers, the number of which is equal to the number of customers for each customer. The customer data 182 includes MKEY, TKEY, encrypted data, and an authentication code, and stores a corresponding user code of the customer 2 in association with the key data. The user code may be, for example, a serial number assigned in the order of use of the electronic commerce system or a number obtained by randomly converting the serial number, but no two or more customers 2 have the same user code.
[0038]
The program storage unit 191 stores a request program 193 for requesting the customer 2 to transmit the user code, the authentication code, and the encrypted data, a collation program 194 for collating the authentication code, and stores the encrypted data based on TKEY and MKEY. Decryption program 195 for decryption, encryption program 196 for encrypting various data such as photo data based on TKEY and MKEY, authentication code generation program 197 for generating an authentication code based on the encrypted data, TKEY, MKEY A KEY generation program 198 for generating a key is stored. Each of the programs 193 to 198 is made into a routine, and an application for executing each of the programs 193 to 198 is a main program 192. Other configurations are the same as those shown in FIG. Further, the keyboard 24, the display 25, and the external input terminal 27 do not always need to be provided.
[0039]
The algorithms of the decryption program 195, the encryption program 196, the authentication code generation program 197, and the KEY generation program 198 are common to the respective programs 93, 94, 95, and 97 shown in FIG. Note that a general random number generation algorithm is used as the MKEY generation algorithm in the KEY generation program 198. In the second embodiment, a master key system using a multiple affine key system is used.
[0040]
FIG. 4 shows a data flow of customer registration necessary for realizing such an electronic commerce system, and FIG. 7 shows a process flow. Hereinafter, data transmission and reception between the certificate authority 3 and the customer 2 in FIGS. 4 to 6 are performed on the network via the transaction system 4 unless otherwise specified.
[0041]
As shown in FIG. 4 and FIG. 7, first, the customer 2 who wants to conduct electronic commerce using the electronic commerce system issues a registration request to the certificate authority 3 (S71). This registration request is transmitted to the certificate authority 3 including personal information.
[0042]
The certificate authority 3 issues a unique user code to the customer 2 based on the obtained personal information (S72), and particularly (in a second embodiment described later, a master key system using a multiple affine key system is used. T) Generate MKEY (S73). The MKEY is one of the so-called “keys” for encrypting / decrypting photo data as identification image data and generating an authentication code described later. The encryption is performed using MKEY and TKEY described later, and both keys are required at the time of decryption. The MKEY is generated only once by the certificate authority 3 as a user at the time of registration, and is stored in the data storage unit 181 of the certificate authority 3 and the tag 271 held by the customer 2. The MKEY is a common key, and can be realized by using a key of any method that is generally used. For example, an exclusive OR FSAngo (using a multiple affine key system) with a random number, and substitution or substitution are used. One that uses the existing DES algorithm is conceivable.
[0043]
The user code is a code for identifying the customer 2 assigned to each customer 2 by the certificate authority 3 at the time of registration. The assigned user code is stored in the tag 271. Note that the user code may be stored in the data storage unit 81. The user code is input by the customer 2 from the terminal of the customer 2 at the time of authentication, and the certificate authority 3 searches the data storage unit 181 based on the user code, and reads out the customer data 182 associated with the user code. .
[0044]
The user code issued in this manner is transmitted to the customer 2 (S72) and stored in, for example, the data storage unit 81 of the terminal of the customer 2. At the time of this registration request, the certificate authority 3 requests a face photograph as an identification image for specifying the customer 2. The face photograph may be included in personal information in the form of photograph data as identification image data and transmitted via a network that constructs a system, or the photograph itself may be sent to the certificate authority 3 by mail. When the photograph itself is received by mail, the certificate authority 3 obtains photograph data by digitizing the photograph. Note that the photo data refers to data obtained by converting an image into digital information, and is not related to a file format such as a JPEG format or a bitmap format. The photograph data is trimmed to make the customer 2 easily identifiable.
[0045]
On the other hand, the certificate authority 3 generates a TKEY from the MKEY based on the obtained MKEY (particularly, in a second embodiment described later using a master key system using a multiple affine key system) (S74). TKEY is one of so-called "keys" for encrypting / decrypting photo data and generating an authentication code. After registration, each time authentication is performed, the key is rewritten with an authentication code. The latest TKEY is stored in the database of the certificate authority 3, but is not stored in the tag 271 of the customer 2. Therefore, the customer 2 cannot decrypt the encrypted data on the tag 271 before the authentication is completed. The TKEY is transmitted from the certificate authority 3 to the customer 2 after the completion of the authentication. Since encryption is performed using MKEY and TKEY, both keys are required at the time of decryption. TKEY is a common key and can be applied to any type of key that is commonly used. For example, TKEY is used for exclusive OR FSango with a random number (using a multiple affine key system), substitution, substitution, and the like. For example, one using the DES algorithm can be considered.
[0046]
Next, the photo data sent from the customer 2 is encrypted based on MKEY and TKEY. The photo data is replaced with the encrypted data by this encryption (S75). This encrypted data is stored in the data storage unit 181 of the certificate authority 3 and the data 271 of the customer 2. This encrypted data is authenticated, and when the authentication is completed, it is decrypted by the certificate authority 3 and the customer 2. At the time of this decryption, new encrypted data is generated using the MKEY and the new TKEY.
[0047]
Next, based on the encrypted data, an authentication code is generated using TKEY and MKEY (S76). In the present embodiment, the authentication code is generated by encoding the encrypted data. Note that TKEY and MKEY in the generation of the authentication code are used to prevent the authentication code from becoming codes that can be easily decoded, and are not used for encryption.
[0048]
Through the above steps, the user code, TKEY, MKEY, encryption code, and authentication code are stored as the customer data 182 in the data storage unit 181 of the certificate authority 3. On the other hand, the tag 271 stores the MKEY, the encryption code, and the authentication code (S77), and is sent to the customer 2 by mail or the like, for example. As described above, TKEY is not written in the tag 271.
[0049]
Next, the flow of the authentication process will be described with reference to FIGS. 5, 6, 8, and 9. FIG. 5 is a diagram showing a data flow when authentication is possible, and FIG. 6 is a diagram showing a data flow when authentication is denied. FIG. 8 is a diagram showing a process flow on the certificate authority 3 side, and FIG. 9 is a diagram showing a process flow on the customer 2 side.
[0050]
As shown in FIGS. 5 and 8, an authentication request is first made from the customer 2 to the certificate authority 3 via the transaction system 4. In this authentication request, specifically, for example, a user code is transmitted to the certificate authority 3 (S81). In response to the authentication request, the certificate authority 3 requests transmission of the authentication code and the encrypted data based on the transmitted user code (S82).
[0051]
The customer 2 connects the tag to a terminal owned by the customer 2 in response to the transmission request. Then, predetermined software is started, and the encrypted data and the authentication code are transmitted to the authentication 3 (S83). The certificate authority 3 reads the encrypted data and the authentication code at the time of registration corresponding to the transmitted user code from the customer data 182 stored in the data storage unit 181 (S84), and reads the encrypted data and the authentication transmitted from the customer 2. Check with the code (S85). If the authentication is possible, the certificate authority 3 decrypts the encrypted data in the data storage unit 181 based on the MKEY and the TKEY (S86), and transmits the TKEY to the customer 2 (S87). Note that the result of the authentication is transmitted to the customer 2 together with the transmission of the TKEY (S87 '). Upon receiving the authentication result (S87 "), the customer 2 can determine whether or not the transaction can be started for the first time.
[0052]
When authentication is possible, when the encrypted data is decrypted, photograph data at the time of registration is obtained, and an image of the customer 2 is displayed on the screen. At the time of displaying the photo data, as shown in S86 'of FIG. 5, an image of the user himself / herself can be acquired from the customer 2 in real time, and this image can be collated with the certificate authority 3 side. At the time of acquiring the personal image, an image recognition algorithm for recognizing the personal image is required in the program storage unit 191. By collating the personal image in this way, it is possible to perform double collation with the collation using the authentication code and the encrypted data, thereby improving the reliability of the authentication. In addition, the authentication may not be performed on the authentication station 3 side, but may be performed only on the basis of the authentication code and the encrypted data.
[0053]
On the other hand, the customer 2 decrypts the encrypted data in the tag based on the transmitted TKEY and the MKEY in the tag (S88). By decrypting the encrypted data, photo data at the time of registration is obtained in the same manner as in the case of the certificate authority 3, and an image of the customer 2 is displayed on the screen (S89). In this image display method, for example, it is preferable that the display area on the screen of a window used for electronic commerce is limited to a certain area, and the remaining area is displayed large. By displaying the image of the person on the screen in this way, it is possible for a third party to monitor the work when the customer 2 is performing electronic commerce. That is, for example, when the access applicant is conducting a transaction in the company, if the tag from the customer 2 is picked up and the certificate authority 3 is accessed and the authentication is obtained, the customer registered by the customer 2 is registered. Since the work is performed on the screen on which the photograph of the face of the two persons is displayed, the work can be monitored by a third party. Therefore, when a malicious third party makes access, it is possible to give psychological pressure to deny the third party psychological access.
[0054]
Further, at the stage when the photo data at the time of registration is obtained, the customer 2 and the authentication device 3 perform pattern recognition processing between the personal image data obtained from a digital camera or the like (not shown) and the reproduced photo data. Can also perform identity verification. It is possible to reflect the result of this personal identification in the judgment of the authentication, or it is also possible to simply display or record it. Various usage patterns can be considered depending on the reliability of pattern recognition and the state of photographic data from a digital camera or the like.
[0055]
When the above authentication processing is completed, the authentication result is sent from the certificate authority 3 to the customer 2 via the transaction system 4 as shown in FIG. The authentication result may be sent to the customer 2 via the transaction system 4 at the stage of (S87 '). From this point, the customer 2 can start electronic commerce directly with the member store 1 via the transaction system 4 without going through the certificate authority 3.
[0056]
When the electronic authentication between the customer 2 and the certificate authority 3 succeeds, an information update process is performed next. The information updating process is performed in both the certificate authority 3 and the customer 2. In the information updating process in the certificate authority 3, first, the certificate authority 3 generates a new TKEY based on the authentication code (in particular, in a second embodiment described later, using a master key system using a multiple affine key system). Then, using the TKEY and the MKEY generated at the time of registration, the photo data decrypted at the time of authentication is re-encrypted to generate new encrypted data (S91a). Since the TKEY at the time of generating new encrypted data is different from that at the time of registration, the generated encrypted data is naturally different from that at the time of registration. Based on this new encrypted data, a new authentication code is generated using MKEY and TKEY (S92a). When the information is updated, the newly updated authentication code, encrypted data, and TKEY are stored in a database in the certificate authority 3.
[0057]
On the other hand, in the information update process of the customer 2, a new TKEY is generated based on the authentication code generated at the time of registration (in particular, in a second embodiment described later, using a master key system using a multiple affine key system). (S90b). Then, the photo data is encrypted based on the TKEY and the MKEY at the time of registration to generate new encrypted data (S91b). Further, an authentication code is generated using TKEY and MKEY based on the new encrypted data (S92b). Then, the updated encrypted data and the authentication code are rewritten to the tag 271 (S93b).
[0058]
On the other hand, when the authentication is denied, the certificate authority 3 does not decrypt the encrypted data and does not transmit the TKEY to the customer 2 as shown in FIG. Further, since the customer 2 cannot receive the TKEY, the customer 2 cannot decrypt the encrypted data. The customer 2 receives an authentication result indicating that the authentication has been rejected from the certificate authority 3 (S87 ').
[0059]
Therefore, the certificate authority 3 and the customer 2 do not decrypt the encrypted data, and perform the same information updating process as in the case where the authentication is possible shown in FIG. 5 without displaying the photograph data on the screen. That is, a new TKEY is generated without going through S86, S87, S88, S89, S91a, and S91b (S100a), and an authentication code based on the original encrypted data and the new TKEY is generated (S102a). On the other hand, the customer 2 generates a new TKEY based on the authentication code (S100b), generates a new authentication code based on the new TKEY (S102b), and rewrites the tag 271 (S103b).
[0060]
In this way, by updating the information necessary for authentication, even if the tag 271 is lost by the person to be authenticated or a malicious third party attempts to copy and exploit the tag 271, the information is updated. Therefore, the authentication is denied for the tags 271 having the same contents. Therefore, the reliability of authentication is dramatically improved.
[0061]
<< 2nd Embodiment >>
The second embodiment describes a case where a master key system using a multiple affine key system is applied to MKEY generation and TKEY generation in the authentication system according to the present invention. That is, in the authentication system according to the present invention, a key necessary for establishing this system is encrypted, and photo data and the like are encrypted to generate encrypted data and an authentication code, and MKEY stored in a tag and passed to the customer is generated. A master that generates a child key from a master key using a one-way function when generating a TKEY that encrypts photo data and the like to generate encrypted data and an authentication code but is not passed to the customer. Apply the key system. As a result, an authentication system exhibiting higher security can be provided.
[0062]
Further, in the second embodiment, the multiple affine key system used in the master key system is used by the certificate authority 3 shown in FIG. 5 and FIG. Can be used for the decryption process (S86) of the device or the decryption process in the device to be authenticated (customer) 2. In this case, based on a random number generated by a random number generation device using a multiple affine key system described in detail below, image data to be encrypted and the like are subjected to an exclusive OR operation to obtain encrypted data. In the case of further decrypting the encrypted data, an exclusive-OR operation is performed between the random number generated by the random number generation device using the multiple affine key system and the decrypted data in the same manner, This is to decrypt the first photo data. By utilizing the encryption / decryption function using the random number generation function using the multiple affine key system as described above, a remarkable improvement in security is desired as compared with the case where ordinary encryption / decryption processing is performed.
[0063]
When a master key system using a multiple affine key system is applied to MKEY generation and TKEY generation in the authentication system according to the present invention, encryption is performed by using the multiple affine key system as described above for subsequent encryption processing. If so, MKEY and TKEY can be used as they are. However, when another encryption algorithm is used for the encryption process, the MKEY or TKEY cannot be used as it is. In this case, a random number is used based on the MKEY or TKEY, for example, using a multiple affine key system or the like. For example, it is necessary to convert the key data into the key data having the conditions required by the encryption algorithm before use.
[0064]
Hereinafter, the principle of the master key system will be described, and further, generation of the MKEY and generation of the TKEY using the master key system will be described.
[0065]
FIG. 11 is a flowchart for explaining a master key system used when the master key system according to the second embodiment is used, FIG. 12 is a principle diagram for explaining the principle of the master key system, and FIG. It is a flowchart explaining random number generation.
[0066]
Further, an embodiment of generating a child key using a master key system, that is, a multiple affine key system will be described with reference to the flowchart of FIG. In the case shown below, the key rewriting method of the multiple affine key system is merely an example of generating child key data from parent key data according to a parameter called key topology. A method is conceivable. Also in those methods, the child key data owner cannot specify the parent key data as in the following cases.
[0067]
In FIG. 11, the generation of MKEY and the generation of TKEY ₁ To child key data L _N A general case of key generation when generating a key will be described. First, the master key data L ₁ The affine key data K and the initial value x of the multiple affine key system described in detail below. ₀ (S31). Next, a specific bit ω of the key topology ω _i Is performed as follows (S32). Next, about 2nM random numbers R are generated by the random number generation function of the multi-affine key system. _k Is generated (S33). Here, n is the life of the key, and M is the number of keys. Next, the value of the i-th bit of the key topology, ω _i Is, for example, "1" (S34), 2M random numbers are generated by the multiple affine key system, and set as a new affine key K (S35). In order to perform such an operation for each bit value of the key topology ω, all ω _i Is determined (S36), and the next ω _i Is selected (S37). The processing order at this time may be such that processing is performed in order from the first bit to the last bit, or may be another predetermined order. For a single value of the key topology ω, new child key data L is obtained by rewriting the value of the affine key K as described above. _N Is generated and output (S38).
[0068]
As described above, the child key data is generated from the master key data by using the random number generation operation of the multi-affine key system. The multi-affine key system is based on a plurality of key data as described in detail later. Because the random number is generated in a very unique way, even if the owner of the child key data attempts to predict the master key data from the key topology and its own child key data, multiple key data of the multi-affine key system will be Since it cannot be specified, the master key data cannot be specified. Therefore, the identification information of the parent key (primary key and key topology sequence for reproducing the parent key) and the key topology which is a parameter related to the generation of the child key, which are features unique to the master key management system of the present invention, are disclosed. Using this public information, the master key owner can reproduce an enormous amount of descendant key data by himself, and easily decrypt all ciphertext data using all lower-order descendant key data. Therefore, a tree structure of a common key can be constructed.
[0069]
Here, it can be said that the multiple affine key system is an infinitely one-way function. The one-way function referred to here is a function such that when f (x) = y in a certain function f (x), the original value of x cannot be specified from the value of y of the operation result. is there. In other words, although it is possible to predict that x → y in the function f (x), it is a problem whether it is possible to specify the value of x that was the source of the operation from the value of y, According to the processing, the first value of x can be specified from the value of the operation result y after various trials and errors, and the master key management system of the present invention is implemented using such a general function. It cannot be realized.
[0070]
A function that is a one-way function in a practical sense, for example, such as the multiple affine key system according to the present invention, in which it is extremely difficult as a practical matter to specify the original value of x from the operation result y. Further, a function that functions with a certain speed or more even when incorporated in a key management system, and furthermore, a function that generates a calculation result that is appropriate as encryption key data, is used. This claim indicates that the system can be implemented. At present, it is difficult to specifically increase such a function.
[0071]
In the master key system, as shown in FIG. 7, the common key 131, which is the parent key data, uses the key topology 134, which is a parameter, to generate a one-way function (pseudo random numbers as close as possible to true random numbers. , Using a multiple affine key system 132 which is an actual one-way function in the sense that it is extremely difficult to specify the value before the operation from the operation result). Supply the key 133.
[0072]
<Multi-affine key system>
Further, here, the multiple affine key system used in the above-described master key system for key data generation, from the principle (basic form) to the specific usage (application system) and the operation and effect, will be described with reference to the drawings. This will be described in detail.
[0073]
[Features of random number generator using multiple affine keys]
The master key system used in the second embodiment uses a random number generator using a multiple affine key (multiple affine key system), which is a weak point due to a known plaintext attack on a stream cipher that can operate at high speed. In order to solve the problem, a high-quality pseudorandom number having a periodicity extremely close to a true random number is generated, and a stream cipher is created using the pseudorandom number. In this way, it is intended to completely eliminate the decryption of a third party stream cipher.
[0074]
In other words, the stream cipher that achieves the high speed required by the encryption technology, if the pseudorandom number used for encryption has periodicity, is a constant that can easily be a source of random numbers by a third party. And algorithms are discovered. Therefore, it cannot be used in situations where high security is required.
[0075]
The random number generation device (multiple affine key system) incorporated in the master key system used in the second embodiment is intended to generate a very high-quality random number that makes it impossible to decrypt a stream cipher.
[0076]
Shannon has proved that there is no decryption method for the Vernam cipher, which is a stream cipher that uses a complete random number only once. Therefore, if we can provide a random number generator that can generate pseudo-random numbers as close as possible to perfect random numbers, the stream cipher will not be analyzed by a third party for pseudo-random number generation even with the known plaintext attack method. , Can be used as a high-speed and highly confidential encryption device.
[0077]
The random number generation device (multiple affine key system) incorporated in the master key system used in the second embodiment is for rewriting a plurality of affine keys every predetermined number of times of use, and replaces one of the affine keys with one another. A method of selecting and generating a random number sequence is employed. In this way, a third party who intends to break the cipher collects random number sequence data and applies a plurality of key data, Even trying to clarify the algorithm, the random number itself has only short-term information while the key is being rewritten, and there are more than one key to specify, and it can be determined which key was selected when the random number was generated. Not possible in principle.
[0078]
Specifically, the random number generation device generates a high-quality random number using a multiple affine key. At this time, the coefficient of the multiple affine key is rewritten every certain number of times of use. In other words, a multiple affine key that is rewritten every certain number of uses is used as an encryption / decryption key that is difficult for a third party to decrypt, and multiple multiple affine keys are prepared. The keys are mutually referred to and the coefficients are automatically updated, thereby eliminating the decryption by a third-party undetermined coefficient method.
[0079]
In other words, this random number generation device defines a key lifetime for each of a plurality of affine keys, and has the function of automatically rewriting old keys (coefficients of multiple affine keys). Instead of a pseudorandom number having regularity as described above, a pseudorandom number sequence having a property that is close to a true random number and has a period that is so long that it is practically difficult to measure is generated. As a result, a stream cipher that could not be used because of the risk of decryption even if it was known to be high-speed can be used without being seen by a third party.
[0080]
[Explanation of affine key]
The affine key used in the present embodiment will be described below.
[0081]
The affine key used in the present invention corresponds to a coefficient of a multiple affine key for generating a random number sequence used for encryption.
[0082]
The affine key K can be represented by four integers K = {a, b, c, n}.
[0083]
Further, the affine key is used for random number generation and updating of the affine key itself. Therefore, when these two are defined, the function of the multi-affine key system is specified.
[0084]
Generation of a random number by the integer affine key K is defined by the following equation.
K (x) = ax + b
Note that c is a counter that counts how many times the affine key has been used, and n is the upper limit (lifetime) of the number of times this key can be used. Then, one affine key generates a pseudorandom number of the Lemer method.
[0085]
In practice, instead of using one affine key, a plurality of affine keys are given, and a key used for random number generation and a key for rewriting the key are appropriately selected from the affine keys. Since it is a key system using a plurality of affine keys, it is called a multiple affine key system.
[0086]
In the multiple affine key system, assuming that the number of keys is M, a plurality of affine keys {K [i]} (0 ≦ i ≦ M−1) and one procedure showing a key rewriting process: a procedure (procedure) w (I, j: integer).
[0087]

Here, the multiplication method and the addition method use an operation of a finite field under consideration.
[0088]
In this procedure, in the procedure, the coefficient a of the i-th affine key K [i] to be rewritten is rewritten based on the coefficient a and the coefficient b of the j-th affine key K [j] which is a reference for rewriting. You can see that it is.
[0089]
This rewriting process should be called the basic form. When the capacity of generated random numbers is extremely large, for example, when the key converges to “0” by repeating the basic form rewriting method described below. Can be considered. However, regarding the application of the master key system in the second embodiment described in the present application, since the capacity of the generated random numbers is very small, even if the rewriting process of the basic form described below is performed, the key is set to “0”. It is unlikely to converge. Further, according to the applied rewriting method described below with reference to the flowchart of random number generation in FIG. 13, it is possible to more completely avoid the case where the key converges to “0”.
[0090]
Further, it can be seen that the coefficient b of the i-th affine key K [i] to be rewritten is rewritten based on the coefficients a and b of the j-th affine key K [j] which is a reference for rewriting.
[0091]
A random number generation device using such a multi-affine key (multi-affine key system), when given each initial value, continues to generate a random number according to one key selected from a plurality of keys. When the number of times of use is exceeded, a key for rewriting the key is selected, and the coefficients a and b of the affine key are rewritten.
[0092]
A random number generation device using such a multiple affine key system is realized by an electronic circuit board having a digital circuit configured according to the above-described procedure. Furthermore, by creating a program so that the computer processes the affine key data according to the above-described procedure and causing the computer device to execute the program, the same operation and effect can be easily obtained. The pseudo-random number generated by such a procedure is extremely close to a true random number and has a long period that cannot be measured. It is impossible in principle to try to decipher by the undetermined coefficient method.
[0093]
[Variables used in multiple affine key systems]
Here, variables, operators, and functions repeatedly used in a random number generation device using a multiple affine key of the present invention are defined below.
The variables are defined as follows,
M is the number of affine keys,
K [i]. a is the coefficient a of the i-th (0 ≦ i ≦ M−1) affine key
K [i]. b is the coefficient b of the i-th (0 ≦ i ≦ M−1) affine key
K [i]. c is the number of times i (0 ≦ i ≦ M−1) th affine key is used
K [i]. n is the lifetime n of the i-th (0 ≦ i ≦ M−1) affine key
K is the entire affine key and is represented by K = {K [i] | 0 ≦ i ≦ M−1}.
K [i] = {K [i]. a, K [i]. b, K [i]. c, K [i]. n｝
k is the number of words for encryption / decryption (k = 1, 2,...)
x0 is the initial value of the internal random number
x _k Is a variable for internal random numbers
R _k Is a random number output
m _k But plain text
c _k But the ciphertext
i is an affine key pointer for random number generation
j is an affine key coefficient a rewriting pointer
j _b Is the pointer offset for rewriting the affine key coefficient b, and 1 ≦ j _b <Set in the range of M, but may be 1
vkey is a key rotation variable
v ₀ Is the initial value of the key rotation variable
v is the increment of the key rotation variable
z is 処理 of the processing unit
z _r Is a set of bit positions used for random number output
z _p Is a set of bit positions used to specify the affine key
The operator is defined as follows,
* And × are multiplication
+ Is addition
(Mod) is the remainder
(+) Is addition modulo M
(And) is the logical product
(Or) is OR
(Xor) is exclusive OR
(Shl) z is a left shift, and when the entire bit length is 2z, it is raised to the power of 2 z, for example, (11110110) (shl) 4 = (000011111).
[0094]
Also, the function is defined as follows,
f (x _k , Z ₁ ) Is x _k To z _l Is defined as the extracted bit string.
[0095]
<Process of random number generation in multiple affine key system>
Hereinafter, each step of the random number generation method included in the master key system used in the second embodiment will be described in detail with reference to flowcharts.
[0096]
FIG. 13 is a flowchart showing a procedure of random number generation, which uses a so-called key rotation type multiple affine key. In a general computer device, a program in which an algorithm is created is stored in a storage area such as a hard disk, and is executed according to a user operation according to an operation screen.
[0097]
This random number generation procedure is different from the above-described basic key rewriting technique, and is intended to more reliably avoid the case where the key converges to “0”. However, regarding the application of the master key system in the second embodiment described in the present application, since the capacity of the generated random numbers is very small, the key converges to “0” even if the rewriting process of the basic form is performed. I can't imagine.
[0098]
As a procedure for generating a random number, first, various settings of a multiple affine key are made, for example, the number of words k, the pointer i of the affine key, the variable x ₀ Are set in the respective storage areas of the RAM 415 via a user operation (S171). Next, a pointer i of an affine key for random number generation is determined. ₀ A set z of bit positions for specifying one affine key from _p (S172). Next, according to the designated key K [i], a pseudo random number of the Lemer method is generated in accordance with the equation K (x) = ax + b (S173). When the random number is generated, the value of the counter is counted up by one (S174). Then, the key rewriting pointer j is set to the internal random number x. _k The set of bit positions z used to specify the affine key _p In addition to the value of, a key opening variable vkey + v is added to specify the pointer position (S175).
[0099]
By this key rotation processing, as already described in detail in the first embodiment and the like, by further increasing the period of the pseudorandom number, it becomes possible to approach the true random number without limit. That is, a pointer j for specifying one from a plurality of affine keys for rewriting the affine key is set to j = f (x _k , Z _p By adding a new key rotation variable vkey as () (+) vkey, the algorithm for specifying the key to be used can be further complicated.
[0100]
In other words, when the affine key is repeatedly rewritten, if the pointer value j at the time of rewriting the affine key becomes repetitive, the key cycle becomes shorter. However, the new key rotation variable vkey improves this. Yes, the more complicated the algorithm for specifying the key to be used, the longer the period of the pointer value j can be. As a result, the random number generation device of the present invention has a practically equivalent random number. This makes it possible to generate pseudo-random numbers with a very long period.
[0101]
Here, it is defined as a value that increases by a constant value v each time rewriting is performed, but is not limited thereto.
[0102]
If the affine key is used, the affine key is rewritten until the counter value c of the affine key becomes equal to the value indicating the life of the affine key (S176). First, the value of the key counter is set to zero (S177), and the selected affine key data K [j]. a, K [i]. a, K [j]. b, a new coefficient a and a new coefficient b are determined. At this time, the value of the upper half of the coefficient is shifted to the lower half, and the key data is repeatedly updated. This completely eliminates the situation of zero (S178). At this time, the so-called weak key is completely eliminated by forcibly setting the first bit to "1" by adding a logical sum with "1".
[0103]
Furthermore, in the coefficient b, the value of the pointer j is further added to _b The transition of the affine key for rewriting the coefficient a and the transition of the affine key for rewriting the coefficient b can be made different by adding The periodicity can be further lengthened (S179). At this time, the so-called weak key is completely eliminated by forcibly setting the second bit to "1" by adding a logical sum with "2".
[0104]
Then, after setting i = j (S180), the variable x _k Predetermined bits (z _r ) To output a random number sequence ｛R _k ｝ Is output (S181). Further, the process returns to step 53 with k = k + 1 (S182).
[0105]
According to the procedure described above, in the random number generation device incorporated in the master key system used in the second embodiment, a random number sequence is generated. A child key is to be generated. Therefore, in the case of the registration process of FIG. 4, the MKEY is generated by the master key system using the multiple affine key system based on the GKEY (S73), and the multiple affine key system is similarly generated based on the generated MKEY. (S74). Further, in the authentication processing of FIGS. 5 and 6, the once used TKEY is generated by a master key system using a multiple affine key system based on, for example, an authentication code (S90a). In parallel with this, the TKEY once used is generated in the device to be authenticated 2 based on, for example, an authentication code by a master key system using a multiple affine key system (S90b).
[0106]
As described in detail above, in the second embodiment, when generating key data to be used for encrypting the photo data and the like of the subject, multiplexing that makes it very difficult for a third party to decrypt the key data is used. By using a master key system that uses an affine key system, it is possible to demonstrate the simplicity of the system and the extremely high security against third parties who intend to illegally use the authentication system. Become.
[0107]
Further, as an application example of the second embodiment, the GKEY which is a common key in the certificate authority 3 is not prepared independently by the certificate authority 3 but described in a system higher than the certificate authority 3 as described above. It is conceivable to use a multiple affine key system such as a master key system. That is, GKEY which is a common key is supplied to a plurality of certificate authorities 3 by using a multiple affine key system such as a master key system by an upper system which manages them. By doing so, even if the common key GKEY is lost or erroneously erased by the certificate authority 3, the GKEY is provided again by a higher-level system using a multiple affine key system such as a master key system. It is possible to further improve the reliability and stability of the system.
[0108]
Further, in the second embodiment, in the encryption and decryption method for encrypting the photo data of the person to be authenticated, the encryption / decryption based on the random number generation function by the above-described multiple affine key system. By applying the function, it is possible to expect a much higher security improvement than when other encryption / decryption methods are used.
[0109]
As described above, the present invention has been described in detail with respect to the first embodiment and the second embodiment. In the present embodiment, an example in which the encrypted data and the authentication code are updated each time authentication is performed has been described, but the present invention is not limited to this. Instead, the encryption data and the authentication code at the time of registration may be repeatedly used.
[0110]
Further, the case where the encrypted data is decrypted or the photo data is encrypted based on the MKEY and the TKEY has been described, but the present invention is not limited to this. For example, the encryption data may be decrypted once with MKEY and then decrypted with TKEY, or the image data may be encrypted once with MKEY and then encrypted with TKEY. Alternatively, encryption and decryption may be performed using only one of MKEY and TKEY.
[0111]
For example, when encryption and decryption are performed using only the MKEY, one MKEY is used until decryption of encrypted data (S86). After the authentication (S85), the step of generating a new TKEY based on the authentication code is replaced with the step of generating a new MKEY based on the authentication code. The processing flow on the customer 2 side is similarly replaced. FIG. 10 shows a flow in the case of performing encryption and decryption only with the MKEY. 5 are denoted by the same reference numerals, and description thereof is omitted.
[0112]
Although the registration step and the authentication step shown in FIGS. 4 to 6 are performed between the customer 2 and the certificate authority 3, respectively, the present invention is not limited to this. For example, when the member store 1 has the transaction system 4 and the function of the certificate authority 3, registration and authentication may be performed directly between the member store 1 and the customer 2.
[0113]
Also, the system shown in FIG. 1 above is only an example. For example, a credit company that performs e-commerce settlement in the system may exist in the network of the system, and the credit company may have the transaction system 4. Further, even when a credit company exists, it may be provided separately from the transaction system 4. Further, the above-mentioned system has shown the case where electronic commerce is performed, but the present invention is not limited to this. Any system that notifies a document or the like that can be viewed only by the individual or a specific person, such as a notification system or a system for browsing electronic documents in a company, can be applied. For example, in the case of a salary statement reporting system that reports a salary statement to each employee, in a case where a company has the transaction system 4 in FIG. 1, each employee corresponds to the customer 2, and each employee views his or her own electronic pay statement. Issues a certification request to the certification authority 3. In this way, since the person accessed by the certification authority 3 can be authenticated as the employee who requests the electronic pay statement, each employee can see his / her own electronic pay statement. Similarly, for example, in the case of an electronic document browsing system in a company, the certificate authority 3 is accessed, and only a person who is authenticated by the certificate authority 3 can browse the electronic document. Further, in addition to such authentication by the certification authority 3, each employee is associated with a new post code corresponding to, for example, the post, etc., with the customer data 182, and based on this post code, only a specific document is in a specific post. Only the person can browse. Thereby, for example, there is no possibility that important matters leak to general employees who do not have a position.
[0114]
When the information updating process is not performed, it is not necessary to use a rewritable storage medium as the tag 271. When a CD-R is used, the information can be updated by adding the information. Further, even if the data cannot be additionally recorded beyond the storage capacity of the CD-R, the data on the CD-R can be reused by transferring the data on the CD-R to another CD-R.
[0115]
Further, in the above-described embodiment, the case of a network includes, of course, not only a case where a server or the like is connected by a wire through a network provider, but also a case where the server is connected wirelessly. Further, the customer 2 includes not only individuals, but also, for example, traders who conduct electronic commerce based on a predetermined contract with the certificate authority 3.
[0116]
Also, the case has been shown where the encryption and decryption means and the authentication code and encryption data collation means are realized by a program in the terminal for both the customer 2 and the certificate authority 3, but the present invention is not limited to this. Such a device may be separately provided in the terminal.
[0117]
In addition, when the TKEY is transmitted from the certificate authority 3 to the customer 2, an example is shown in which no encryption is performed. However, the present invention is not limited to this, and the TKEY may be encrypted and transmitted. In this case, it is preferable to record a key for decrypting the TKEY in the tag 271 in advance at the time of authentication registration.
[0118]
Further, in the above-described embodiment, the case where the customer 2 transmits the authentication code and the encrypted data and the authentication authority 3 authenticates based on these is shown, but the present invention is not limited to this. For example, the authentication may be performed using only the authentication code without using the encrypted data, and the customer 2 may not transmit the encrypted data. Conversely, authentication may be performed by transmitting only the encrypted data and using only the encrypted data. Further, for example, in S82, the certificate authority 3 requests the customer 2 to transmit the authentication code and the encrypted data, but not only these, but also requests, for example, a password set at the time of authentication registration, or specifies the request time at the time of this request. It may be transmitted together with the time to perform. When the time for specifying the request time is transmitted, and when there is a time lag of a predetermined time or more as compared with the time when the customer 2 transmits the authentication code or the like, the authentication can be denied. Thereby, if the communication at the time of the transmission request of the authentication code or the like is intercepted in S82, or the tag 271 is illegally copied, the data is falsified for a predetermined time or the malicious code is obtained by decrypting the data. It is possible to prevent a third party from illegally receiving authentication permission.
[0119]
Also, the case where the same authentication code is generated by the customer 2 and the certificate authority 3 has been described. However, even when different codes are generated, it is only necessary that both are associated so as to be able to be collated.
[0120]
Further, in the present embodiment, the image for identifying the user is displayed on the customer 2 side, but the present invention is not limited to this. Any identification information that can be used in the terminal, such as a voice for identifying the person, may be used.
[0121]
【The invention's effect】
As described in detail above, according to the present invention, an image associated with the user is displayed on the screen of the user who has been authenticated by the electronic authentication, so that when the authenticated person performs work. Can be monitored by third parties, and access by unauthorized users is reduced, so that security is significantly improved.
[Brief description of the drawings]
FIG. 1 is a diagram showing an overall configuration of an electronic authentication system according to a first embodiment of the present invention.
FIG. 2 is an exemplary view showing an example of a hardware configuration of a terminal owned by the customer according to the embodiment.
FIG. 3 is an exemplary view showing an example of a hardware configuration of a terminal of the certificate authority according to the embodiment.
FIG. 4 is an exemplary view for explaining the flow of authentication registration according to the embodiment;
FIG. 5 is an exemplary view for explaining the flow of electronic authentication according to the embodiment.
FIG. 6 is an exemplary view for explaining a flow in the case of authentication denial of electronic authentication in the embodiment.
FIG. 7 is an exemplary flowchart showing authentication registration according to the embodiment;
FIG. 8 is a view showing a flowchart of electronic authentication on the certificate authority side according to the embodiment.
FIG. 9 is an exemplary flowchart illustrating electronic authentication on the customer side according to the embodiment;
FIG. 10 is an exemplary view for explaining the flow of electronic authentication according to a modification of the embodiment.
FIG. 11 is a flowchart illustrating a master key system used when the master key system according to the second embodiment is used.
FIG. 12 is a principle diagram for explaining the principle of the master key system according to the embodiment;
FIG. 13 is an exemplary flowchart for explaining random number generation by the master key system according to the embodiment;
[Explanation of symbols]
1. . . Merchant
2. . . client
3. . . Certificate Authority
4. . . Trading system
21. . . bus
22. . . CPU
23. . . memory
24. . . keyboard
25. . . display
26. . . Communication device
27. . . External input terminal
28. . . Data control unit
29. . . Program control unit
81. . . Data storage unit
91. . . Program storage unit
92, 192. . . Main program
93, 195. . . Decryption program
94, 196. . . Encryption program
95, 197. . . Authentication code generation program
96. . . Display program
97. . . TKEY generation program
182. . . Customer data
193. . . Request program
194. . . Collation program
198. . . Key generation program
271. . . tag

Claims (3)

An authentication device is an electronic authentication method for authenticating an authentication code in a recording medium detachably connected to a device to be authenticated connected thereto via a network,
The first common key, the second common key, the encrypted data, and the authentication code are stored in the storage area of the authentication device, and the first common key, the encrypted data, and the authentication code are stored in the recording medium of the device to be authenticated. In the stored state,
The device to be authenticated transmits the authentication code in the recording medium to the authentication device via a network, and in the authentication device, compares the authentication code read from the storage area with the received authentication code. If they match, perform authentication processing to determine that authentication was successful,
As a result of the authentication processing, if the authentication is successful, the authentication device restores the image data from the encrypted data in the storage area using the first common key and the second common key in the storage area, and Sends the second secret key to
The device to be authenticated restores the image data from the encrypted data of the recording medium using the first common key of the recording medium and the received second common key,
In both the authentication device and the device to be authenticated, a new second common key is generated using the authentication code, and a new second common key is generated from the restored image data using the new second common key and the first common key. Generating encrypted data, generating a new authentication code from the first common key, the new second common key, and the new encrypted data;
The authentication device performs an information update process of rewriting a storage area with a new second common key, new encryption data, and a new authentication code,
An electronic authentication method, characterized in that a recording medium is rewritten with new encrypted data and a new authentication code in a device to be authenticated, and the rewritten storage area and storage medium are used in the next authentication processing, respectively. 2. The electronic authentication method according to claim 1, wherein the authenticated device displays the restored image data on a screen. An electronic authentication device that performs authentication processing of an authentication code in a recording medium detachably connected to a device to be authenticated connected via a network,
A storage area for storing a first common key, a second common key , encrypted data, and an authentication code;
Upon receiving the authentication code from the device to be authenticated via a network, comparing the received authentication code with the authentication code read from the storage area, if the authentication code matches, an authentication processing unit that determines that the authentication is successful,
As a result of the authentication processing, if the authentication is successful, the image data is restored from the encrypted data in the storage area using the first common key and the second common key in the storage area, and the second device is stored in the device to be authenticated. Send the secret key,
Further, a new second common key is generated using the authentication code, and new encrypted data is generated from the restored image data using the new second common key and the first common key. Information for generating a new authentication code from the first common key, the new second common key, and the new encryption data, and rewriting the storage area with the new second common key, the new encryption data, and the new authentication code And an update unit.
The electronic authentication apparatus, wherein the authentication processing unit performs the next authentication processing based on the information of the rewritten storage area.

Images