JP3690237B2 - Authentication method, recording medium, authentication system, terminal device, and authentication recording medium creation device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to security in an open network system, and more particularly to an authentication method executed by a server or a receiving terminal device.
[0002]
[Prior art]
The conventional authentication method compares the ID and password of a user registered and managed in advance with the server and the ID and password sent from the user, and confirms the identity of the user if they match. Authentication was performed. For example, FIG. 8 shows a processing flowchart of the authentication method disclosed in Japanese Patent Laid-Open No. 11-149542. According to the authentication method disclosed in Japanese Patent Application Laid-Open No. 11-149492, the terminal device encrypts the login name as an encryption key (S805, S806) and transmits the password to the host device. The host device encrypts the password using the login name registered in advance as an encryption key (S808). Then, the password transmitted after being encrypted by the terminal device is compared with the password encrypted by the host device (S809) to perform authentication.
[0003]
According to the authentication method disclosed in Japanese Patent Laid-Open No. 7-325785, the client encrypts the ID and password input by the user and the random number issued by the server with the server public key (Kp). Send to server. The server decrypts the ID, password, and random number sent from the client with its own private key (Ks), and checks whether the decrypted random number matches the random number issued by the server for authentication. is there.
[0004]
[Problems to be solved by the invention]
By the way, according to the conventional authentication method, the user ID and password are registered in the server, and the ID and password transmitted from the user are compared with the ID and password registered in the server to confirm the match. So, server-led authentication is performed. However, since many user IDs and passwords are under the control of the server, there is a possibility that many user IDs and passwords may be leaked due to server hacking or server administrator's fraudulent actions. Improvement is necessary. In particular, when a user's password is leaked, the user's risk increases in that the secrecy of communications such as e-commerce and e-mail using the network is not guaranteed. An object of the present invention is to propose an authentication method for solving the above problem.
[0005]
[Means for solving the problems]
  According to this inventionAuthentication systemID and password unique to each user recorded in the authentication recording medium in an encrypted state, and authentication data obtained by encrypting the ID and password input by the user using an encryption algorithm designated by the user And a decryption key for decrypting the authentication data, and an encryption parameter including the type of the encryption algorithmTerminal deviceThe authentication data is decrypted using the decryption key included in the encryption parameter, and the user authentication is performed by comparing the ID and password of the authentication recording medium and the ID and password input by the user.Authentication deviceIt is equipped with.
[0006]
  According to this inventionrecoding mediaIsHave the terminal device that asks the authentication device for authentication,A first encryption step of encrypting the ID and password of the authentication recording medium recorded by encrypting a unique ID and password for each user with a block cipher, the ID encrypted in the first encryption step A second encryption step of generating authentication data encrypted by an encryption algorithm designated by the user, including a password, a first decryption key for decrypting the password, and an ID and password input by the user An encryption data used in the second encryption step, an authentication data creation step including an encryption parameter creation step for creating an encryption parameter including a second decryption key for decrypting the authentication data;Causing the terminal device to perform authentication from the received data from the terminal device on the transmission side,A step of reading out the encryption algorithm and the second decryption key from the encryption parameter, decrypting the authentication data using the second decryption key, plaintext of the ID and password input by the user, and the record for authentication A step of reading an ID in the medium, a secret text of the password, and the first decryption key; a step of obtaining an ID and a password of the recording medium for authentication using the first decryption key; an ID input by the user; And comparing the password and the ID and password of the authentication recording mediumA program that causes a computer to execute the authentication processIt is.
[0008]
  Further, according to the present inventionrecoding mediaIncludes a first encryption step of encrypting the ID and password using an encryption key created according to the time when the terminal device reads the ID and password from the authentication recording medium.Recorded a program to be executed by a computerIs.
[0011]
The terminal device according to the present invention authenticates by comparing the ID and password in the authentication recording medium recorded by encrypting the ID and password included in the received data with the ID and password input by the user. An authentication unit for performing authentication, a first encryption unit for encrypting the ID and password in the authentication recording medium with a block cipher, an ID and password encrypted by the first encryption unit, and decrypting the ID and password A first encryption key for encrypting, and a second encryption means for generating authentication data by encrypting an ID and password input by the user using a predetermined encryption algorithm designated by the user, An encryption algorithm used by the second encryption means and a second decryption key used for decrypting the authentication data, and sent together with the authentication data; Those having an authentication data generation unit having a cryptographic parameter processing unit for creating a cryptographic parameters.
[0012]
  According to this inventionAuthentication systemIsID and password unique to each user recorded in the authentication recording medium in an encrypted state, authentication data obtained by encrypting the ID and password input by the user using an encryption algorithm designated by the user, A terminal device that transmits a decryption key for decrypting the authentication data, an encryption parameter including the type of the encryption algorithm, and decrypting the authentication data using the decryption key included in the encryption parameter, and An authentication device for performing user authentication by comparing the ID and password of the recording medium for use, and the ID and password input by the user;Using a unique ID and password for each user, an input unit to which an arbitrary key number corresponding to an encryption key for encrypting this is input, and a public key corresponding to the key number input from the input unit, An encryption processing unit that encrypts the ID and password using an algorithm of public key cryptography, and an output that writes the ID and password encrypted by the encryption processing unit and the key number to an authentication recording medium PartRecording medium creation device for authentication comprisingIt is equipped with.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
Embodiment 1 FIG.
FIG. 1 is a flowchart for explaining processing of an authentication method according to the present invention. FIG. 2 is a flowchart for explaining the processing of the authentication method according to the present invention. FIG. 3 is a conceptual diagram showing an example of a computer communication system according to the present invention. FIG. 4 is a block diagram showing the configuration of the terminal device. FIG. 5 is a block diagram showing the configuration of the server. FIG. 6 is a block diagram showing the configuration of the authentication recording medium creating apparatus according to the present invention. FIG. 7 is an explanatory diagram showing an example of encryption parameters.
[0014]
An example of a computer communication system according to the present invention will be described with reference to FIG. In FIG. 3, 1 is a transmission side user terminal device, 2 is an authentication device which is a server (hereinafter referred to as a server), 3 is a communication network, 4 is an authentication device which is a server (hereinafter referred to as a server), 5 Is a receiving-side user terminal device. The server 2 and the server 4 perform “authentication” by confirming whether the user of the terminal device 1 and the terminal device 5 is the person himself or herself, that is, the person who is authorized to use the communication system 3. The access to the communication network 3 of the devices 1 and 5 is controlled. Communication using electronic mail between the terminal devices 1 and 5 is performed via the communication network 3 after being authenticated by the servers 2 and 4 and being permitted to access the communication network 3. On the other hand, the terminal device 5 that has received the e-mail from the terminal device 1 performs the authentication to confirm whether the sender of the e-mail is from the principal, thereby spoofing that the third party is the principal. Is prevented.
[0015]
Next, the configuration of the terminal devices 1 and 5 shown in FIG. 3 will be described with reference to FIG. In FIG. 4, 6 is an authentication recording medium, 7 is a terminal device (1, 5 shown in FIG. 3), 8 is an authentication data creation unit, 9 is an authentication unit, 10 is a medium input unit, 11 is a decryption processing unit, 12 is an encryption processing unit, 13 is an input unit, 14 is a key input unit, 15 is an encryption parameter processing unit, 16 is an authentication data storage unit, 17 is a communication processing unit, 18 is a key reading unit, and 19 is a first decryption unit. 20 is a second decoding processing unit, and 21 is a comparison / determination unit. The terminal device 1 and the terminal device 5 encrypt the ID and password read from the authentication recording medium recorded by encrypting the user's own ID and password, and the ID and password input by the user to the terminal device. Authentication data creation unit 8 for creating the authentication data, and the ID and password read from the recording medium for authentication and the ID and password input by the user included in the received authentication data are decrypted and read. The authentication unit 9 is configured to perform authentication by comparing types of passwords.
[0016]
The authentication data creation unit 8 includes a medium input unit 10 that reads an encrypted ID and password from the authentication recording medium 6, a decryption processing unit 11 that decrypts the ID and password read by the medium input unit 10, and a decryption process. The ID and password decrypted by the unit 11 are encrypted by block cipher using an encryption key created from time information (year / month / day / time) when the ID and password are read from the authentication recording medium 6. Encryption processing unit 12, input unit 13 for receiving input of ID and password directly input to terminal device 7 by user, type of encryption algorithm selected by user among encryption algorithms of common key cryptosystem, encryption key, encryption Key input unit 14 that receives input of a conversion table used for encryption, ciphertext encrypted by the encryption processing unit 12 using block cipher, and input unit 1 The plaintext of the ID and password input from is encrypted using the encryption algorithm, encryption key, and conversion table selected by the user to create authentication data, and the encryption algorithm input via the key input unit 14 And a cryptographic parameter processing unit 15 that creates cryptographic parameters that are information for decrypting the authentication data on the receiving side.
[0017]
The authentication unit 9 uses the encryption parameters to read the encryption algorithm type, encryption key, and conversion table type key reading unit 18, and the encryption key read by the key reading unit 18 as a decryption key (in the case of encryption using a common key encryption method, The encryption key and the decryption key are the same), the first decryption processing unit 19 which decrypts the authentication data and obtains the ID of the authentication recording medium, the secret text of the password, and the plain text of the ID and password input by the user. The plaintext of the ID and password from the second decryption processing unit 20 and the first decryption processing unit 19 which obtain the plaintext by decrypting the plaintext of the ID and password of the authentication recording medium, and the second decryption It is comprised from the comparison determination part 21 which compares ID from the process part 20, and the plaintext of a password. The terminal device 1 shown in FIG. 3 performs a process of transmitting the authentication data and encryption parameters created by the authentication data creation unit 8 shown in FIG. 4, and the terminal device 5 receives the authentication data sent from the terminal device 1 as the authentication unit 9. Authentication processing is performed in
[0018]
Next, the configuration of the authentication devices 2 and 4 which are servers shown in FIG. 3 will be described with reference to FIG. In FIG. 5, 22 is a server, 23 is a communication processing unit, 24 is an authentication data storage unit, 25 is a key reading unit, 26 is a first decryption processing unit, 27 is a second decryption processing unit, and 28 is a comparison. It is a judgment part. The server 22 shown in FIG. 5 employs the same configuration as that of the authentication unit 9 of the terminal device 7 shown in FIG.
[0019]
Next, an authentication recording medium creating apparatus for creating the authentication recording medium 6 shown in FIG. 4 will be described with reference to FIG. In FIG. 6, 29 is an authentication recording medium creation device, 30 is an authentication recording medium, 31 is an input unit, 32 is an encryption processing unit, 33 is an output unit, and 34 is a storage unit. The authentication recording medium 30 is created by a medium creator who creates an authentication recording medium using the authentication recording medium creation device 29 and an administrator who manages the encryption key. The authentication recording medium creation device 29 encrypts the user ID and password using an encryption algorithm of a public key cryptosystem and writes it in the storage unit 34 of the authentication recording medium 30 to authenticate the user. Create a recording medium.
[0020]
The user notifies the medium creator of the ID and password in order to have the authentication recording medium issued. The medium creator inputs the key number assigned for the user and the ID and password notified from the user to the input unit 31. The input key number, user ID, and password are transmitted to the encryption processing unit 32 via the input unit 31. A public key corresponding to the key number is recorded in the encryption processing unit 32. The public key corresponding to the input public key number is selected, and the ID and password are encrypted. The encrypted ID and password are written into the storage unit 34 of the authentication recording medium 30 through the output unit 33 together with the key number.
[0021]
The medium creator can know the key number assigned to each user, but cannot know the public key for encrypting the ID and password. Only the administrator of the system that manages the encryption key can know the correspondence between the key number and the public key. The encrypted ID and password recorded in the authentication recording medium cannot be freely changed by the medium creator and the user himself / herself. Further, since the third party cannot know the secret key corresponding to the encrypted public key, the ID and password cannot be read from the authentication recording medium or tampered with. Therefore, if the ID and password input by the user at the time of authentication match the ID and password in the authentication recording medium, it can be confirmed that the user who owns the authentication recording medium is the person himself / herself.
[0022]
Based on the above, the authentication method according to the present invention will be described with reference to FIG. 1 and FIG. FIG. 1 shows an authentication method for controlling access to the communication network 3 executed by the servers 2 and 4 shown in FIG. Steps S105 to S112 are authentication data creation steps by the terminal device 1 on the transmission side, and steps S113 to S119 are authentication steps by the server 2. Hereinafter, the authentication data creation process will be described. In step S <b> 101, the transmission user terminal device 1 illustrated in FIG. 3 performs processing for transmitting an authentication start packet to the server 2. In step S102, the server 2 accepts an authentication start request from the terminal device 1, and transmits an authentication start prompt to the terminal device 1 in step S103. In step S <b> 104, the terminal device 1 receives an authentication start prompt from the server 2. In step S105, the transmission user who has confirmed the authentication start prompt inserts the authentication recording medium 6 shown in FIG. 4 into the terminal device.
[0023]
In step S <b> 106, the terminal device 1 uses the decryption processing unit 11 to read the secret ID and password read from the authentication recording medium 6 via the medium input unit 10, and the public key (within the authentication recording medium). The plaintext of the ID and password is obtained by decrypting with the private key corresponding to the encryption key used for encrypting the ID and password. In step S107, the encryption processing unit 12 encrypts the ID / PW decrypted by the decryption processing unit 11 using a block cipher. The block cipher is an encryption method that encrypts a plurality of bytes at once. The encryption key used for the encryption in step S107 is automatically set based on time information such as year, month, date, and time when the transmission user inserts the medium into the terminal device. In step S107, the encrypted text of ID and password and the plaintext of the encryption key are transmitted to the encryption parameter processing unit 15.
[0024]
In step S108, the transmission user directly inputs the ID / PW of the person himself / herself into the transmission user terminal device. The ID and password input by the user are output to the encryption parameter processing unit 15 via the input unit 13. In step S 109, the transmission user designates an encryption algorithm, a conversion table, and an encryption key used for encryption, and inputs them to the terminal device via the key input unit 14. The encryption algorithm, conversion table, and encryption key specified by the transmission user are transmitted to the encryption parameter processing unit 15 via the key input unit 14. In step S 110, the encryption parameter processing unit 15 sends the ID encrypted by the encryption processing unit 12, the plaintext of the password, the plaintext of the encryption key used for the encryption, and the transmission user via the input unit 13. The plaintext of the ID and password directly input by the method is encrypted using the encryption algorithm, conversion table, and encryption key specified by the transmission user to generate authentication data.
[0025]
In step S110, the encryption parameter processing unit 15 creates authentication data, and also creates an encryption parameter that is transmitted together with the authentication data, including the encryption algorithm, conversion table, and encryption key used to create the authentication data. . The encryption parameter provides information necessary for decrypting the authentication data to the authentication device on the receiving side, and includes an encryption algorithm, a conversion table, and an encryption key used for encrypting the authentication data. The server 2 or the receiving user terminal device 5 shown in FIG. 3 receives the authentication data and encryption parameters transmitted from the transmitting user terminal device, and reads the authentication algorithm, conversion table, and encryption key from the encryption parameters for authentication. Decrypt data and authenticate. An example of the encryption parameter is shown in FIG. As shown in FIG. 7 “Encryption Parameter Format”, the encryption parameter (Key.s) includes three pieces of information, that is, an encryption algorithm, a conversion table, and an encryption key selected by the transmission user and used for encryption of authentication data. Contains.
[0026]
For example, as shown in FIG. 7 “Available Cryptographic Algorithms”, it is assumed that there are “Complex Shift Register (10)”, “DES (11)”, and the like as usable cryptographic algorithms. As shown in “Input Example”, it is assumed that “DES (11)” is set as the encryption algorithm, “Table 32” is set as the conversion table, and “0123456789abcde” is set as the encryption key. In this case, the encryption parameter Key.s is “11320123456789abcde” as shown in “Example of setting of encryption parameter”. This encryption parameter is simply created by arranging the encryption algorithm and the conversion table number and the encryption key as they are. However, since the encryption parameter is transmitted together with the authentication data and includes information for decrypting the authentication data, it is actually used in a more complicated form by increasing the security strength. The In step S 111, the authentication data and encryption parameters generated by the encryption parameter processing unit 15 are output to the authentication data storage unit 16. In step S112, the communication processing unit 17 reads and transmits the authentication data and the encryption parameter stored in the authentication data storage unit 16.
[0027]
The following steps are authentication steps executed by the server 2 shown in FIG. 3 or the server 22 shown in FIG. In step S113, the communication processing unit 23 of the server 22 receives the authentication data and the encryption parameter transmitted from the terminal device 7 illustrated in FIG. After the received authentication data is stored in the authentication data storage unit 24, the key reading unit 25 automatically reads the encryption algorithm, conversion table, and encryption key from the encryption parameters, and recognizes information necessary for decrypting the authentication data. . In step S114, the first decryption processing unit 26 decrypts the authentication data using the conversion table and the encryption key read by the key reading unit 25, and the plain text of the ID and password directly input to the terminal device by the transmission side user. Then, the ID encrypted with the block cipher, the secret text of the password, and the encryption key are read out.
[0028]
In step S115, the second decryption processing unit 27 decrypts the ID and password text with the first decryption key to obtain the plain text of the ID and password recorded in the authentication recording medium. In step S116, the comparison / determination unit 28 compares the ID and password input from the user with the ID and password recorded in the authentication recording medium to confirm that they match. In step S117, if the two match, it is determined that the transmission user is the user, and in step S118, an authentication confirmation prompt is transmitted to the transmission-side user terminal device. On the other hand, if they do not match in step S117, it is determined that the transmitting user is a third person who is not the principal, and in step S119, an unauthenticated prompt is transmitted to the transmitting-side user terminal device.
[0029]
Next, an authentication method executed between the transmitting-side user terminal device 1 and the receiving-side user terminal device 5 shown in FIG. 3 for confirming whether or not the transmitting user is the person himself / herself is shown in FIG. Will be described with reference to FIG. Before executing the processing after step S201 shown in FIG. 2, the terminal device 1 and the terminal device 5 (both the terminal device 7 shown in FIG. 4) are authenticated by the server 2 and the server 4, respectively, and are sent to the communication network 3. You are allowed to log in. In step S201, the terminal device 1 attaches the authentication data and encryption parameters created in steps S105 to S112 shown in FIG. In step S202, an e-mail attached with authentication data and encryption parameters is transmitted to the terminal device 5. In step S <b> 203, the terminal device 5 receives the email transmitted from the terminal device 1.
[0030]
In step S204, the key reading unit 18 shown in FIG. 4 of the terminal device 5 reads the encryption algorithm, the conversion table, and the encryption key from the encryption parameter, and the first decryption processing unit 19 authenticates using the conversion table and the encryption key. The data is decrypted, and the plaintext of the ID and password input by the user, the plaintext obtained by encrypting the ID and password read from the authentication recording medium by the block cipher, and the plaintext of the block cipher key are obtained. In step S205, the second decryption processing unit 20 decrypts the ciphertext encrypted by the block cipher using the block cipher key to obtain the plaintext of the ID and password recorded on the authentication recording medium. . In step S206, the comparison / determination unit 21 compares the ID and password input by the user with the ID and password recorded on the authentication recording medium to confirm whether they match. If they match in step S207, an authentication confirmation message is displayed on the display screen of the receiving user terminal device in step S208. On the other hand, if the two do not match, an authentication unconfirmed message is displayed on the display screen.
[0031]
As described above, the authentication method according to the above description is that the encrypted ID, the password read from the recording medium for recording the password, the ID entered by the user to the terminal device, and the authentication obtained by encrypting the password. The data is created and transmitted to the server, and the server decrypts the authentication data and performs authentication by confirming that the ID and password of the authentication recording medium included in the authentication data match the ID and password entered by the user. Therefore, if the server manages only the user ID, authentication can be performed without knowing the user password. Therefore, it is not necessary for the server to manage the user's password, and the risk that the user's password is leaked to the outside due to an illegal act on the server can be suppressed.
[0032]
In addition, since the authentication method can be applied not only to authentication for the purpose of controlling access to the network by the server, but also to authentication for confirming that the sender is the identity of the sender himself, Reliability of computer communication is ensured.
[0033]
In addition, the above authentication method automatically decrypts authentication data without requiring user operation on the receiving side such as a server by including information for decrypting the authentication data in the encryption parameter. It becomes possible. In addition, by using this encryption parameter, the user can freely change the encryption algorithm used for encryption, and can notify the contents to the receiving side. It is difficult to guess the encryption algorithm that is being used.
[0034]
Further, the authentication recording medium according to the above description encrypts and records the user ID and password, so that the person who has acquired the authentication recording medium cannot know the ID and password in the authentication recording medium. Further, since the data in the authentication recording medium cannot be falsified, the ID and password in the authentication recording medium cannot be falsified with another ID and password to access the communication network. It is possible to prevent fraudulent impersonation of the owner.
[0035]
In addition, the terminal device creates authentication data using an encryption algorithm selected by the user himself and includes the encryption algorithm, decryption key, and conversion table used for the encryption, and decrypts the authentication data on the receiving side. Since the encryption parameter, which is information necessary for the transmission, is transmitted together with the authentication data, the encryption algorithm can be freely set between the sender and the receiver, and the confidentiality of the communication with respect to the third party who intercepts the communication is improved. In addition, authentication data can be automatically decrypted and authenticated.
[0036]
Further, the authentication recording medium creating apparatus stores therein the public key corresponding to the key number, and encrypts the user ID and password with the public key corresponding to the key number. Since the media creator who operates cannot know the public key corresponding to the key number, the data in the authentication recording medium cannot be falsified. Further, since the public key cryptosystem has a smaller number of keys to be managed than the common key cryptosystem, key management is also easy.
[0037]
【The invention's effect】
  According to this inventionAuthentication systemID and password unique to each user recorded in the authentication recording medium in an encrypted state, and authentication data obtained by encrypting the ID and password input by the user using an encryption algorithm designated by the user And a decryption key for decrypting the authentication data, and an encryption parameter including the type of the encryption algorithmTerminal deviceThe authentication data is decrypted using the decryption key included in the encryption parameter, and the user authentication is performed by comparing the ID and password of the authentication recording medium and the ID and password input by the user.Equipped with an authentication deviceTherefore, the server can authenticate without knowing the user's password.This eliminates the need for the server to manage user passwords.
[0038]
  According to this inventionrecoding mediaIsHave the terminal device that asks the authentication device for authentication,A first encryption step of encrypting the ID and password of the authentication recording medium recorded by encrypting a unique ID and password for each user with a block cipher, the ID encrypted in the first encryption step A second encryption step of generating authentication data encrypted by an encryption algorithm designated by the user, including a password, a first decryption key for decrypting the password, and an ID and password input by the user An encryption data used in the second encryption step, an authentication data creation step including an encryption parameter creation step for creating an encryption parameter including a second decryption key for decrypting the authentication data;Causing the terminal device to perform authentication from the received data from the terminal device on the transmission side,A step of reading out the encryption algorithm and the second decryption key from the encryption parameter, decrypting the authentication data using the second decryption key, plaintext of the ID and password input by the user, and the record for authentication A step of reading an ID in the medium, a secret text of the password, and the first decryption key; a step of obtaining an ID and a password of the recording medium for authentication using the first decryption key; an ID input by the user; And password, and an authentication step including a step of comparing the ID and password of the authentication recording mediumSince a program for causing a computer to execute is recorded, authentication data that is difficult to be tampered with by a third party, can be created with high confidentiality, and authentication of received data is performed automatically. It is possible to confirm whether the caller is the person by decrypting.
[0040]
  Further, according to the present inventionrecoding mediaIncludes a first encryption step of encrypting the ID and password using an encryption key created according to the time when the terminal device reads the ID and password from the authentication recording medium.Recorded a program to be executed by a computerTherefore, there is an effect that it becomes difficult for a third party who intercepts communication to guess the encryption key.
[0043]
The terminal device according to the present invention authenticates by comparing the ID and password in the authentication recording medium recorded by encrypting the ID and password included in the received data with the ID and password input by the user. An authentication unit for performing authentication, a first encryption unit for encrypting the ID and password in the authentication recording medium with a block cipher, an ID and password encrypted by the first encryption unit, and decrypting the ID and password A first encryption key for encrypting, and a second encryption means for generating authentication data by encrypting an ID and password input by the user using a predetermined encryption algorithm designated by the user, An encryption algorithm used by the second encryption means and a second decryption key used for decrypting the authentication data, and sent together with the authentication data; Since an authentication data generation unit having a cryptographic parameter processing unit for creating a cryptographic parameters, can be freely set the encryption algorithm between the transmitter's confidentiality of the communication to the third party intercepting the communication is enhanced. In addition, authentication data can be automatically decrypted and authenticated.
[0044]
  According to this inventionAuthentication systemIsID and password unique to each user recorded in the authentication recording medium in an encrypted state, authentication data obtained by encrypting the ID and password input by the user using an encryption algorithm designated by the user, A terminal device that transmits a decryption key for decrypting the authentication data, an encryption parameter including the type of the encryption algorithm, and decrypting the authentication data using the decryption key included in the encryption parameter, and An authentication device for performing user authentication by comparing the ID and password of the recording medium for use, and the ID and password input by the user;Using an input unit for inputting a unique ID and password for each user, and an arbitrary key number corresponding to the encryption key for encrypting the user, and a public key corresponding to the key number input from the input unit An encryption processing unit that encrypts the ID and password using a public key encryption algorithm, and writes the ID and password encrypted by the encryption processing unit and the key number in an authentication recording medium Output sectionAn authentication recording medium creation device comprising:Therefore, it is possible to create an authentication recording medium so that key management is easy and the public and private keys corresponding to the key numbers are not known to the medium creator.
[Brief description of the drawings]
FIG. 1 is a flowchart illustrating processing of an authentication method according to the present invention.
FIG. 2 is a flowchart illustrating processing of an authentication method according to the present invention.
FIG. 3 is a conceptual diagram showing an example of a computer communication system according to the present invention.
FIG. 4 is a block diagram illustrating a configuration of a terminal device.
FIG. 5 is a block diagram showing a configuration of a server.
FIG. 6 is a block diagram showing a configuration of an authentication recording medium creating apparatus according to the present invention.
FIG. 7 is an explanatory diagram showing an example of encryption parameters.
FIG. 8 is a flowchart illustrating processing of a conventional authentication method.
[Explanation of symbols]
1 terminal device, 2 authentication device (server), 3 communication network,
4 authentication device (server), 5 terminal device, 6 recording medium for authentication, 7 terminal device,
8 authentication data creation unit, 9 authentication unit, 10 medium input unit, 11 decryption processing unit,
12 encryption processing unit, 13 input unit, 14 key input unit,
15 encryption parameter processing unit, 16 authentication data storage unit, 17 communication processing unit,
18 key reading unit, 19 first decryption processing unit, 20 second decryption processing unit,
21 comparison determination unit, 22 server, 23 communication processing unit,
24 authentication data storage unit, 25 key reading unit, 26 first decryption processing unit,
27 second decoding processing unit, 28 comparison determining unit,
29 authentication recording medium creation device, 30 authentication recording medium, 31 input unit,
32 encryption processing unit, 33 output unit, 34 storage unit

Claims (4)

  First encryption step for encrypting the ID and password of the authentication recording medium recorded by encrypting a unique ID and password for each user, which is executed by a terminal device that requests authentication from the authentication device, with block cipher Including the ID and password encrypted in the first encryption step, the first decryption key for decrypting the ID and the password, and the ID and password input by the user, and encrypted by the encryption algorithm designated by the user A second encryption step for generating encrypted authentication data, an encryption algorithm used in the second encryption step, and a encryption parameter including a second decryption key for decrypting the authentication data The authentication data creation step including the encryption parameter creation step and the terminal device that performs authentication from the received data from the terminal device on the transmission side, A step of reading the encryption algorithm and the second decryption key from an encryption parameter; decrypting the authentication data using the second decryption key; and plain text of an ID and password input by the user; and the authentication recording medium The ID, password secret, and the first decryption key are read out, the authentication recording medium ID and password are obtained using the first decryption key, and the ID input by the user A computer-readable recording medium storing a password and a program for causing a computer to execute an authentication step including a step of comparing the ID of the recording medium for authentication and the password. First encryption process according to claim 1 in which the terminal device is characterized by encrypting the ID and password by using the encryption key created according to the time reading the ID and password from the authentication recording medium The recording medium described in 1.   An authentication unit that performs authentication by comparing the ID and password in the recording medium for authentication recorded by encrypting the ID and password included in the received data, and the ID and password input by the user; and the authentication First encryption means for encrypting the ID and password in the recording medium by block cipher, ID and password encrypted by the first encryption means, and first decryption for decrypting the ID and password Second encryption means for generating authentication data by encrypting a key and an ID and password input by the user using a predetermined encryption algorithm designated by the user, and the second encryption means Encryption parameters to be transmitted together with the authentication data, and a second decryption key used for decrypting the authentication data. Terminal apparatus comprising the authentication data creation unit having an encryption parameter processing unit for.   ID and password unique to each user recorded in the authentication recording medium in an encrypted state, authentication data obtained by encrypting the ID and password input by the user using an encryption algorithm designated by the user, A terminal device that transmits a decryption key for decrypting the authentication data, an encryption parameter including the type of the encryption algorithm, and decrypting the authentication data using the decryption key included in the encryption parameter, and ID and password of the recording medium, an authentication device that performs user authentication by comparing the ID and password input by the user, an ID and password unique to each user, and an arbitrary key corresponding to the encryption key that encrypts this Using the input unit to which the key number is input, and the public key corresponding to the key number input from the input unit, An encryption processing unit that encrypts a password using a public key encryption algorithm, and an output unit that writes the ID and password encrypted by the encryption processing unit and the key number to an authentication recording medium An authentication system comprising an authentication recording medium creation device.

Images