KR102120328B1 - User Authentication using ECC and Hash - Google Patents

Abstract

The present invention is a block chain (Block Chain) and IoT (Internet of Things: Internet of Things: IoT) in a converged network integrated Elliptic Curve Cryptography (ECC) Key Pair, ECC Child Key (Hierarchical Deterministic Wallet: BIP32 Wallet), Hash (Hash) Regarding a method of performing user authentication using a value, the authentication client registers the ECC public key generated by the authentication client on the blockchain, and the authentication client generates a first hash value and a child key from an arbitrary integer. Then, when a second hash value is generated from the child key and authentication is requested using the first hash value and the second hash value, the authentication server generates a new child key based on the key obtained from the blockchain and the first hash value. Then, authentication is performed by comparing the new hash value generated from the new child key with the second hash value. According to the present invention, after one key value is registered once on the blockchain, it can be used even when using application services of several different IoT service providers, and recognizes whether the registrant is initially registered without user's personal information or certificate. It has the advantage of being able to be verified safely, so it can be used in various IoT services connected to the electronic account of the blockchain.

Description

User authentication using ECC public key method and hash value{User Authentication using ECC and Hash}

The present invention relates to a user authentication method, and more particularly, to a method of performing user authentication in a blockchain (Block chain) and the Internet of Things (IoT) convergence network.

When the authentication client requesting authentication performs user registration on a specific server, the authentication server stores the ID/password of the authentication client, a public certificate, or other authentication key, and compares it when requesting user authentication.

In the ID/password method, a user's password or authentication-related contents are stored in a server, and authentication is performed using this. However, as personal information for a specific user is stored on the server, attacks on the server storage are becoming frequent, and recently, attacks on ID information transmitted on the network during authentication are also increasing.

In the public certificate system, authentication is performed using a certificate issued by a specific institution. Since authentication is only possible through a certificate, the procedure is complicated, but a lot of important personal information can be stored. However, since an encryption method is used to protect personal information, there is a disadvantage that the load on the system is increased.

Accordingly, there is a need to overcome the limitations of the prior art by developing a user authentication method that can be used in all services with only one key registration, without registering personal information in the third place, without using a fixed ID for authentication. .

Republic of Korea Registered Patent Publication No. 10-1780636 (Announcement date 2017.09.21.), "How to issue authentication information and a blockchain-based authentication information management server that supports it"

Therefore, the present invention has been made to solve the above-described problems of the prior art, and the object of the present invention is to provide authentication services when providing application services in a convergence network of blockchain and IoT technology, and authentication with different information each time. To provide a user authentication method using an ECC public key method and a hash value that enables user authentication for all IoT services by requesting and registering only once.

The user authentication method using the ECC public key method and hash value of the present invention for achieving the above object is, in a blockchain (Block chain) and the Internet of Things (IoT) convergence network, (a) the authentication client himself Registering the generated ECC public key on the blockchain; (b) generating a first hash value and a child key from an arbitrary integer selected based on the ECC key generated by the authentication client, and generating a second hash value from the child key to generate the first hash value and the second Requesting authentication using a hash value; And (c) an authentication server generates a new child key based on the key obtained from the blockchain and the first hash value, and compares the new hash value generated from the new child key with the second hash value for authentication. It characterized in that it comprises a.

The step (a) includes: generating an EC domain parameter (T = (p,a,b,G,n.h)); Selecting an integer d^ based on n of the parameters; Generating Q^ based on the integers d^ and G; Generating an ECC-based public key pair (d^, Q^); And registering d^ among the public key pairs as an authentication key on the blockchain.

The step (b) includes: selecting an arbitrary integer j; Generating a first hash value (H1 = hash(j, Q^)) and a child key {dj = (d^ + H1 mod p)} from the arbitrary integer j; Generating a second hash value {H2 = hash(dj)} from the child key; And requesting authentication using the first hash value and the second hash value.

The step (c) comprises: fetching a key (d^) from the blockchain; Generating a new child key {*dj = (d^ + H1 mod p)} based on the first hash value; Generating a new hash value {*H2 = hash(*dj)} from the new child key; Comparing the new hash value with a second hash value; And completing authentication when the new hash value and the second hash value are the same.

As described above, according to the ECC public key method and the user authentication method using the hash value according to the present invention, since personal information is not registered in the third place, the risk of leakage of personal information can be fundamentally prevented.

In addition, since a different hash value is used each time for authentication, even if it is leaked to a network attack, it is safe for a network attack because the key required for authentication cannot be extracted in reverse based on the hash value.

In addition, user authentication can be performed from all IoT services that use a blockchain node registered in the network with one-time key registration, which not only improves user convenience, but also generates a key required for authentication even when the authentication key is released. Since there is no authentication safety can be improved.

1 is a conceptual diagram of a user authentication method using an ECC public key method and a hash value in a blockchain and IoT convergence network as an embodiment of the present invention.
2 is a flowchart of an user authentication method using an ECC public key method and a hash value in a blockchain and IoT convergence network as an embodiment of the present invention.

Hereinafter, the present invention will be described in detail with reference to preferred embodiments of the present invention and the accompanying drawings, and the same reference numerals in the drawings will be described on the assumption that they refer to the same components.

When one component in the detailed description of the invention or the claims "includes" another component, it is not interpreted as being limited to only the component, unless specifically stated otherwise. It should be understood that it may further include.

In the present invention, a method of performing user authentication using a ECC public key method and a hash value in a blockchain and IoT convergence network is proposed.

In the present invention, when providing an application service in a convergence network of blockchain and IoT technology, we propose a method that enables user authentication in all IoT services with only one user registration without providing personal information of the service.

That is, the user registers one authentication key in his/her own blockchain account without registering personal information to enable user authentication to IoT service providers sharing the same blockchain.

In order to receive user authentication to receive such a service, the user does not register any personal information of himself, and in order to prevent network attacks of the key key (Q^), which is a clue to generate a child key even during authentication, Instead of transmitting a fixed ID or personal information, a one-way hash function based on a one-time key is used to transmit the data.

In addition, the key set can be exchanged periodically while using the service, and there is no need to notify other authentication servers even if the key registered in the blockchain is changed, and heavy encryption or complicated procedures are not required to perform such user authentication. To prevent this, we propose a user authentication method that can be used for various IoT application services in a secure and low system load.

1 is a conceptual diagram of a user authentication method using an ECC public key method and a hash value as an embodiment of the present invention.

Referring to FIG. 1, the user authentication system of the present invention is a subject requesting user authentication, an authentication client 1 that registers an authentication key and uses a service, and several blockchains distributed in a network and storing the same block It includes a key storage (2) including a node, and an authentication server (3) that performs authentication when the user uses the service.

Here, the authentication client 1 includes application logic for authentication.

The key storage 2 means a blockchain that stores and manages as a block when a user registers a key.

The authentication server 3 refers to a service providing an IoT application, and includes authentication server logic for performing authentication.

In the user authentication system of the present invention configured as described above, the authentication client 1 generates an ECC public key pair (d^, Q^) and registers only d^ among them (key registration step).

Subsequently, the authentication client 1 selects an arbitrary integer j to request authentication, generates a child key, and generates two hash values to request authentication (authentication request step).

Accordingly, the authentication server 3 obtains the user's authentication key from the blockchain for user authentication, generates a hash value, verifies that the user has the same hash value sent, and authenticates the user (key verification and authentication steps) ).

Here, the Elliptic Curve Crypto system (ECC) cryptographic algorithm that uses an elliptic curve to generate a public key and a private key (private key) is a technology that enables secure and various cryptographic system design as it can utilize an elliptic curve, ECC cryptography Since the algorithm is well known, detailed descriptions thereof will be omitted.

Then, the ECC public key method of the present invention using the system configured as described above and a user authentication method using a hash value will be described.

2 is a flowchart of an user authentication method using an ECC public key method and a hash value in a blockchain and IoT convergence network as an embodiment of the present invention.

Specifically, it is a flow chart showing the process of registering an authentication key on the blockchain and receiving user authentication to use the IoT service.

As shown in FIG. 1, the present invention largely includes a key registration step, an authentication request step, a key confirmation and authentication step.

Referring to FIG. 2, in the authentication client 1, a user who wants to be authenticated generates an EC domain parameter (T = (p,a,b,G,nh)) (S1), and n of the generated parameters Select the integer d^ as the base, generate the Q^ based on the d^ and G, generate ECC Key Pairs (d^, Q^) (S2), and of the d^ to the blockchain's own account Register (S3 ~ S4).

In the authentication client 1, the user selects an arbitrary integer j (S5) to generate hash 1 {H1 = hash(j, Q^)} (S6), and generates a J-th child key {dj = (d^ + H1 mod p)} (S7), then generate hash 2 {H2 = hash(dj)}, which is the hash value of the generated child key (S8), and send two hash values (H1, H2) to request authentication. (S9).

In the authentication server 3 (such as an IoT service that performs authentication), a new child key {*dj = (d^ + H1) using the first hash value received by taking d^ of the user stored in the blockchain (S10) mod p)}, and using the generated new child key to generate New Hash 2{*H2 = hash(*dj)} (S11), compare the transmitted Hash 2 with the generated New Hash 2 Check for identity. If it is the same (H2 = *H2), it is the hash value transmitted by the first registered user, and if it is not the same (H2 ≠ *H2), authentication is failed because the user's identity is not confirmed (S12).

As described above, in the present invention, a block chain (Block Chain) and an Internet of Things (IoT) are integrated network, the ECC (Elliptic Curve Cryptography) Key Pair, ECC Child Key (Hierarchical Deterministic Wallet: BIP32 Wallet), hash We proposed a method for performing user authentication using (Hash) value. That is, the user generates an ECC public key type key pair and stores one of them in the blockchain, and the user requests authentication when the user actually authenticates to use the IoT application service. , In order to perform user authentication in the authentication server (3), an authentication method is proposed, including the step of fetching a key from the blockchain and verifying the user.

According to the present invention, in a network in which blockchain and IoT are fused, one key value is registered once in the blockchain, and there is an advantage that can be used even when using application services of several different IoT service providers. It has the advantage of safely verifying the identity of the initially registered registrant without personal information or certificates, so it can be used in various IoT services connected to the electronic account of the blockchain.

In more detail, the user registers one authentication key generated on the basis of EC domain parameters to the blockchain only once, so that the blockchain user ID (User) is used in all IoT services that use the blockchain node registered in the same network. Account) can be used for user authentication. The authentication key to be registered is only a meaningless random number because it does not become a clue to generate a key required for authentication even when it is released.

If only one key is stored, it is possible to check whether the user who registered for the first time is the correct address (blockchain ID) of the transaction where the authentication key is stored without registering other personal information, so there is no risk of personal information leakage and anonymity can be provided for the use .

In addition, even if the key registered in the blockchain is periodically changed, the most recent authentication value is managed as a characteristic of the blockchain that organizes blocks in chronological order, so there is no need to notify other IoT service providers.

In addition, since a different hash value is transmitted each time based on the generated value by selecting a different integer (j) for each authentication, even if it is leaked to the network attack, the key required for authentication cannot be extracted in reverse, based on the hash value. It also provides a secure authentication method.

On the other hand, according to the present invention, in a blockchain and IoT convergence network, a user may trade various items using a blockchain ID (User Account of an electronic payment account), use an application service, and register any personal information. And no storage required, providing complete anonymity.

In one or more example implementations, the functions presented herein can be implemented through hardware, software, firmware, or combinations thereof. When implemented in software, the functions may be stored as one or more instructions or code on a computer-readable medium, or transmitted through them. Computer-readable media includes computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. The storage medium can be a general purpose computer or any available medium that can be accessed by a special purpose computer. For example, such computer readable media may be RAM, ROM, EEPROM, CD-ROM or other optical disk storage media, magnetic disk storage media or other magnetic storage devices, or program code means required in the form of instructions or data structures It may be used to store, and includes, but is not limited to, a general purpose computer, a special purpose computer, a general purpose processor, or any other medium that can be accessed by a special processor.

Also, any connecting means can be considered a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source via wireless technologies such as coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or infrared radio, and microwave. Wireless technologies such as cable, fiber optic cable, twisted pair, DSL, or infrared radio, and microwaves can be included within the definition of this medium. The disks and discs used herein include compact discs (CDs), laser discs, optical discs, DVDs, floppy disks, and Blu-ray discs, where disks play data magnetically, but discs are optical To play the data. Combinations of the above should also be included within the scope of computer readable media.

Those skilled in the art will appreciate that the various exemplary elements, components, logic blocks, modules, and algorithm steps described above may be implemented as electronic hardware, computer software, or a combination thereof. To clarify the interoperability of hardware and software, various exemplary elements, blocks, modules, and steps have been described in terms of their functionality. Whether this functionality is implemented in hardware or software depends on the specific application and design restrictions imposed for the overall system. Those skilled in the art can implement these functions in various ways for each specific application, but such implementation decisions are not outside the scope of the present invention.

Various exemplary logic blocks and modules described in connection with this disclosure are general purpose processors, digital signal processors (DSPs), semiconductors on demand (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates Or transistor logic, discrete hardware components, or any combination designed to implement the functions described herein. A general purpose processor can be a microprocessor; In alternative embodiments, such a processor may be an existing processor, controller, microcontroller, or state machine. The processor may be implemented as a combination of computing devices, such as, for example, a DSP and microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP core, or a combination of these configurations.

For hardware implementation, various example logics, logic blocks and modules of processing units described in connection with aspects disclosed herein, include one or more on-demand semiconductors (ASICs), digital signal processors (DSPs), Digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), discrete gate or transistor logic, discrete hardware components, general purpose processors, controllers, micro- Controllers, microprocessors, other electronic units designed to perform the functions described herein, or combinations thereof. A general purpose-purpose processor can be a microprocessor, but alternatively, can be any existing processor, controller, microcontroller, or state machine. The processor may also be implemented with a combination of computing devices (eg, DSP and microprocessor, multiple microprocessors, a combination of one or more microprocessors associated with a DSP core, or any other suitable configuration). Additionally, the at least one processor can include one or more modules capable of implementing one or more of the steps and/or operations described herein.

In addition, various aspects or features described herein can be implemented as a method, apparatus, or article of manufacture using standard programming and/or engineering techniques. Further, the steps and/or operations of a method or algorithm described in connection with the aspects disclosed herein may be implemented directly in hardware, in a software module executed by a processor, or in a combination thereof. Additionally, in some aspects, steps or operations of a method or algorithm may exist as at least one or any combination of a set of codes or instructions on a machine-readable medium, or computer-readable medium, which Can be incorporated into computer program objects. The term product as used herein is intended to include computer programs accessible from any suitable computer-readable device or medium.

The description of the presented embodiments is provided to enable any person of ordinary skill in the art to use or practice the present invention. Various modifications to these embodiments will be apparent to those skilled in the art of the present invention, and the general principles defined herein can be applied to other embodiments without departing from the scope of the present invention. Thus, the present invention should not be limited to the embodiments presented herein, but should be interpreted in the broadest scope consistent with the principles and novel features presented herein.

1: Authentication client
2: key store
3: authentication server

Claims (4)

In the block chain and the Internet of Things (IoT) convergence network,
(a) the authentication client registering the ECC public key generated by the authentication client on the blockchain;
(b) generating a first hash value and a child key from an arbitrary integer selected based on the ECC key generated by the authentication client, and generating a second hash value from the child key to generate the first hash value and the second Requesting authentication using a hash value; And
(c) The authentication server generates a new child key based on the key obtained from the blockchain and the first hash value, and performs authentication by comparing the new hash value generated from the new child key and the second hash value. Comprising;
Step (b) is,
Selecting an arbitrary integer j;
Generating a first hash value {H1 = hash(j, Q^)} and a child key {dj = (d^ + H1 mod p)} from the arbitrary integer j;
Generating a second hash value {H2 = hash(dj)} from the child key; And
Requesting authentication using the first hash value and the second hash value; ECC public key method and user authentication method using the hash value. According to claim 1,
Step (a) is,
Generating an EC domain parameter (T=(p,a,b,G,nh));
Selecting an integer d^ based on n of the parameters;
Generating Q^ based on the integers d^ and G;
Generating an ECC-based public key pair (d^, Q^); And
Registering d^ in the blockchain as an authentication key among the public key pairs; User authentication method using ECC public key method and hash value. delete According to claim 1,
Step (c) is,
Fetching a key (d^) from the blockchain;
Generating a new child key {*dj = (d^ + H1 mod p)} based on the first hash value;
Generating a new hash value {*H2 = hash(*dj)} from the new child key;
Comparing the new hash value with a second hash value; And
Completing the authentication if the new hash value and the second hash value are the same; ECC public key method comprising and a user authentication method using the hash value.

Images