KR20030093605A - Fault tolerant password authentication system using secret sharing - Google Patents

Abstract

PURPOSE: An error-tolerant password authentication system using a secret distribution method is provided to share an encrypted key and the authentication information by using only a part of servers of a server system. CONSTITUTION: An error-tolerant password authentication system using a secret distribution method includes a server system(11). The server system(11) is formed with a plurality of severs. The error-tolerant password authentication system using a secret distribution method further includes a structure of server/client. Only the authentication information instead of a client's password is registered to the error-tolerant password authentication system. The client(10) and a part of servers of the server system(11) share a strong password encrypted key by using the registered authentication information of the client(10) and the client's password.

Description

Fault tolerant password authentication system using secret sharing}

The present invention relates to a method for securely authenticating each other and sharing a high-secret secret key when a client using only a password for authentication in a client / server system attempts to access a remote system through an open network, in particular a password. It is proposed to prevent the case of dictionary attack, which is an attack method for cryptosystem using information with limited entropy. A password authentication system with secret distribution that can provide a method.

Password has the disadvantage of not being able to strengthen the security arbitrarily, but it is adopted by many systems due to the advantages of user convenience and low cost. Many password authentication protocols have been proposed to secure the shortcomings of passwords, and in recent years, a system has been proposed that considers the dictionary search attack against password authentication information stored in the server.

In the current authentication system, one-way hash function is used to store the hash result of the password as authentication-related information in the server to hide the password transmitted through the open network, and the client calculates the hash value of the password every time the client connects to the server. The system for performing the client authentication process by the server by transmitting to the server has been used. In this way, the client does not send its own password, but sends authentication-related information, which is the hash value of the password. In this method, it is difficult for an attacker to know the password of the client, but the problem of the replay attack that can be authenticated by the server at any time using the hash value after stealing the network packet and the server authentication method by the user There is a serious problem of not providing it.

In addition, a representative method of a protocol in which cryptographic problems are not found while implementing mutual authentication and key sharing is SLS (SSL) based on a public key infrastructure. However, this method also requires the assistance of the public key infrastructure for secure mutual authentication. Therefore, there is a problem that the authentication information can be transmitted to an attacker who is not a legitimate counterpart without the public key infrastructure.

In order to solve the problems occurring in the above authentication system, that is, from the 1990s to provide a method for entropy to securely authenticate each other through a low password and a public network, and to share a secret key with sufficient entropy that is cryptographically secure. Many cryptographic protocols have been proposed.

Looking at the proposed cryptographic protocol, S. M. S. M. Bellovin and M. M. Merritt first proposed a user authentication and key distribution method in 1992 using secure passwords for dictionary search attacks.

("Password-Based Protocols Secure Against Dictionary Attacks," Proceedings of the IEEE Symposium on Research in Security and Privacy, Oakland, May 1992).

Also, d. Jablon (D. Jablon) developed the concept of Velobin and Merritt in 1996 and proposed the Strong Password Encrypted Key Exchange (SPEKE), which is safe against dictionary attacks ("Strong Password-Only Authenticated Key Exchange," Computer Communication Review, ACM SIGCOMM, vol. 26, no. 5, pp. 5-26, October 1996).

Since then, an active study of password authentication system has been conducted, and the IEEE standards organization has also been able to clean up the password authentication protocol.In addition, the server system stores only the authentication information of the password and not the password itself. Asymmetric password authentication system that can perform user authentication while protecting is proposed.

In addition, the introduction of a password authentication system having a plurality of servers considering a dictionary attack attack on the password authentication-related information contained in the password file of the server system in consideration of a stronger attack method. Ford and B. It was done by B. Kaliski.

W. Ford and Kaliski have multiple servers that allow users to generate authentication keys with the help of all servers, so that attackers must attack multiple servers simultaneously to obtain the user's password ("Server-Assisted Generation of a Strong Secret from a Password, "Proceedings of the IEEE 9th International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises, NIST, Gathersburg, MD, June 14-16, 2000).

The authentication protocol proposed by Ford and Kalowski is disclosed in US Patent Publication No. 2001/0055388 A1.

However, even in all the authentication systems described above, in a system having a plurality of servers, there may be a problem about an increase in the probability of failure due to an increase in the number of servers. In addition, an attacker who wants to paralyze the server function to intentionally prevent user authentication has a disadvantage that server management becomes more difficult than before because only one of the plurality of servers needs to be attacked.

Therefore, the present invention has an object to solve the problems occurring in all the above system.

The present invention provides a method for configuring mutual authentication and a key sharing system based on a low entropy password on a public network, and having a plurality of servers prevents a pre-browsing attack on a password file of a server. Its purpose is to provide a cryptographic solution to a problem that is a problem.

Accordingly, a main object of the present invention is to provide a password authentication method that is secure against a dictionary search attack on a server by distributing password authentication related information of a user in a plurality of servers through secret distribution in an environment where a certain degree of failure is expected. .

1 is a block diagram of a server system 10 composed of a client 10 and a plurality of servers, which are core components of a system according to the present invention.

2A and 2B show initial user registration in which a user performs user registration in the authentication system.

3A and 3B are schematic diagrams illustrating a process of performing mutual authentication and key sharing.

[Description of Symbols for Main Parts of Drawing]

10: client

11: server system

100, 101, 102: server

In order to achieve the above object, the present invention provides a method of dividing a user's password related information into a plurality of servers through a secret distribution method, and a method of mutually authenticating each other and performing key sharing between a user and a plurality of servers.

Examples of the configuration and protocol implementation of the system according to the present invention will be described in detail with reference to the accompanying drawings.

A key component of the system according to the present invention is a server system 10 consisting of a client 10 and a plurality of servers as shown in FIG.

In addition, the following public variables must be set in advance:

1) prime p, q satisfying p = 2 * q + 1

2) one-way hash function h

3) (n, t) System parameters for secret dispersion.

If you use n recovery servers and more than t servers work normally, you can successfully complete the authentication process. In terms of security, this means that even if an attacker attacks a server with fewer than t servers, obtains a password file, and performs a dictionary search attack, it cannot find any information about the user's password. (Where t n.)

FIG. 2A illustrates a diagram of transmitting password related information to servers upon initial user registration. FIG. 2A is described below.

The client generates the password related information and sends it to the server according to the following procedure.

The client selects the password P and calculates the element g _p of Gq corresponding to the password P as follows.

The client secretly generates a random value y.

Client Master Key Calculate as

Client hash function Confirmation usingVCalculate as

Clients T-1 polynomial Create a secret.

The client uses the polynomial f (x) generated above as a function value for the index of each server. Calculate as

Client has a random value Then, V is sent to server i and each server stores the received data with the client's account ID.

Figure 2b is the calculated authentication key of the server i Is a diagram illustrating a step of transmitting to the servers and proceeds according to the following procedure.

Client authenticates with server i Calculate as

The client calculated Is registered on the server i to perform mutual authentication.

As described above with reference to FIGS. 2A and 2B, after initial user registration is performed, the client may perform mutual authentication and secret channel formation with the server using only a password.

In the following description of the authentication process, the client uses only t servers among the n servers. For convenience, the client uses t servers from the first server to the t server.

3A is a diagram illustrating a process of sending a challenge from a client to a server when a client registered as a user performs authentication and key exchange using t recovery servers.

Select a random number x to calculate the challenge Q and send it to the server.

3B is a diagram illustrating a process in which a server receiving a client's challenge transmits response information thereto to the client.

The server has received and stored in the initial registration process Response information using client's challenge Q Create as follows and send it to the client.

At this time, V is also transmitted.

From the server Clients that receive V and V first Calculate as

V received from the server to verify that the master key is configured correctly. Compare

Server i's authentication key for i = 1,2, ... t Calculate as

Encrypted secret key between server and client by this method Was shared. Especially master key The client can then share the secret key with any server.

The encryption protocol is established between the client and each server by the above method, because there is a challenge and response information with random values, which are set to different values for each session, which are used to derive the shared key. It is possible to mutually authenticate each other through the general authentication method used by.

As described above, the present invention is safe against a dictionary search attack of the server, and unlike the conventional Pod-Kalski method, authentication and secret key sharing are securely performed without all servers participating in the authentication and secret key sharing process. .

In addition, the present invention has its own security features without using with SSL in the calculation and authentication process, and provides a countermeasure against a high possibility of failure of a server system that may occur by having a plurality of servers.

Claims (4)

In the asymmetric authentication and secret key sharing system using a password, a system having a server / client structure having a plurality of servers, the system registers only authentication related information, not a password of a client, and authenticates the registered client. A method and system in which a plurality of servers all use only a portion of a server in sharing information and a high entropy secret key between a client and a server using information and the client's password. The method of claim 1, wherein the password related information of the user is secretly distributed to a plurality of servers. The method of claim 1, wherein the client and the server share a secret key having sufficient entropy to form a cryptographic channel at the same time as mutual authentication, which is impossible to replay attack using a password, authentication information and random number, respectively. 4. The method of claim 3, in order to form a cryptographic channel with sufficient entropy, using only a portion of servers rather than all of a plurality of servers.