JP2008177824A - Key exchange system and key exchange method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a key exchange system that has a function for sharing a session key between a user and a server while managing passwords different in each server. <P>SOLUTION: A client terminal 1 generates a password, and the password is shared between the client terminal 1 and a password manager 2. The password manager 2 generates a random number in each server 3-i to be registered, uses the password and the random number to generate a password between the password manager 2 and the server 3-i and shares the password. Between the client terminal 1 and the password manager 2, and between the pass manager 2 and the server 3-i, the password generated by the client terminal 1 and the password generated by the password manager 2 are used respectively to perform authentication, and a session key is exchanged between the client terminal 1 and the server 3-i. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a key exchange system and a key exchange method suitable for exchanging session keys for a plurality of sites on the Internet.

  In recent years, with the rapid spread of the Internet, many people browse and use websites. Since the Internet is an open environment and has anonymity, security against attacks such as eavesdropping and spoofing is not guaranteed. In particular, in order for a legitimate user to safely use a website that requires input of personal information and payment, it is necessary to perform identity authentication.

  As a means for performing personal authentication, a password is practical and widely used at present. However, when using a plurality of websites, using only one password is not secure. On the other hand, setting different passwords requires users to remember many passwords.

Therefore, in the technique shown in Non-Patent Document 1, it is possible to set a different password for each website by a function called “login book” that stores a website, an ID, a password, and the like as a set. You can manage your "login book" with only one master password. Similarly, the technique disclosed in Patent Document 1 can also use a “specific site password management tool” that centrally manages IDs and passwords for each website. Furthermore, in patent document 1, fingerprint authentication is used instead of a password as the personal authentication means for the tool.
Internet <URL: http: // www. robot. com / jp /> JP 2002-169779 A

  The above-described conventional technology uses a single password or fingerprint authentication to authenticate the user with a different password for each website. However, in the above-described conventional technology, the user is only confirmed to be the person himself and does not guarantee the safety of subsequent communication. Therefore, there is a problem that the Internet, which is an open environment, may be wiretapped.

  Therefore, the present invention has been made in view of the above-described problems. A user uses only one password, and personal authentication is executed with a different password for each server, and a “session” used for protecting subsequent communications. It is an object to provide a key exchange system and a key exchange method having a function of sharing an encryption key called a “key” between a user and a server.

In order to solve the above-described problems, the present invention proposes the following matters.
(1) The present invention includes a client terminal (for example, equivalent to the client terminal 1 in FIG. 1), a password manager (for example, equivalent to the password manager 2 in FIG. 1), and a plurality of servers (for example, the server 3 in FIG. 1). -1 to 3-i), and the client terminal has a first password generation means (for example, equivalent to the password generation unit 11 in FIG. 2). 1 password is shared, and the password manager has second password generation means (e.g., equivalent to the password generation unit 16 in FIG. 2), and the second password is respectively transmitted between the password manager and each server. And authenticating using the first password shared in advance between the client terminal and the password manager In addition, the authentication is performed using the second password shared in advance between the password manager and each server, and a session key is exchanged between the client terminal and each server. An exchange system is proposed.

  According to the present invention, the password manager is interposed between the client terminal and the plurality of servers, the first password is shared between the client terminal and the password manager, and the password manager and each server 2 is shared, authentication is performed using the first password shared in advance between the client terminal and the password manager, and the password is shared between the password manager and each server in advance. The user of the client terminal only remembers the password generated by the first password generation means by performing authentication using the password of No. 2 and exchanging the session key between the client terminal and each server. Authentication is performed with a different password for each server. Deployment key can be shared.

  (2) The present invention proposes a key exchange system in which the first password generation means generates one password as the first password for the key exchange system of (1). .

  According to the present invention, the first password generation unit generates one password as the first password. Therefore, the user of the client terminal can share the session key by simply remembering one password, performing personal authentication with a different password for each server.

  (3) In the key exchange system according to (1), the second password generation unit uses the first password and a random number to convert a plurality of passwords for each server into the second password. We propose a key exchange system characterized by

  According to the present invention, the second password generation means generates a plurality of passwords for each server as the second password using the first password and the random number. Therefore, by generating the second password as described above, it is possible to have a relationship between the first password and the second password.

  (4) The present invention provides a key exchange method in a key exchange system including a client terminal, a password manager, and a plurality of servers, wherein the client terminal generates a first password, and the client terminal and the A first step of sharing a first password with a password manager, the password manager generating a second password for each server, and a second password between the password manager and each server; A second step of sharing the password of the client, and performing authentication using the first password shared in advance between the client terminal and the password manager, and between the password manager and each server Authenticate using the second password shared in advance in Between the cement terminal and the respective server, it proposes a key exchange method characterized by comprising: a third step of exchanging a session key, a.

  According to the present invention, the password manager is interposed between the client terminal and the plurality of servers, the first password is shared between the client terminal and the password manager, and the password manager and each server 2 is shared, authentication is performed using the first password shared in advance between the client terminal and the password manager, and the password is shared between the password manager and each server in advance. By using the password of 2 and exchanging the session key between the client terminal and each server, the user of the client terminal only needs to remember the first password and differs from server to server. User authentication is performed using a password, and the session key can be shared. That.

  (5) The present invention is a program for causing a computer to execute a key exchange method in a key exchange system including a client terminal, a password manager, and a plurality of servers, wherein the client terminal uses a first password. A first step of generating and sharing a first password between the client terminal and the password manager; and the password manager generates a second password for each server; A second step of sharing a second password with the server, authentication using the first password shared in advance between the client terminal and the password manager, and the password Second shared in advance between the manager and each server Performs authentication using a password, in between the client terminal and the respective server, it proposes a program characterized by comprising a third step of exchanging a session key, a.

  According to the present invention, the password manager is interposed between the client terminal and the plurality of servers, the first password is shared between the client terminal and the password manager, and the password manager and each server 2 passwords are shared, authentication is performed using the first password shared in advance between the client terminal and the password manager, and the password manager and each server share the password. By using the password of 2 and exchanging the session key between the client terminal and each server, the user of the client terminal only needs to remember the first password and differs from server to server. User authentication is performed using a password, and the session key can be shared. That.

  According to the present invention, the user of the client terminal only needs to remember one password, and personal authentication is executed with a different password for each server, so that the session key can be shared. For this reason, there exists an effect that a user can communicate safely for every server on a website.

1. Basic Configuration of the Present Invention First, prior to the description of the present embodiment, the basic configuration of the present invention will be briefly described. This description is intended to facilitate understanding of the present embodiment, and does not limit the content of the present invention.

1-1. Overview of Password Generation FIG. 1 shows an overview of a system according to this embodiment. In FIG. 1, 1 is a client terminal, 2 is a password manager, 3-1, 3-2,..., 3-i,.

  The client terminal 1 generates a password pwC that can be stored by itself, and the password pwC is shared between the client terminal 1 and the password manager 2. The password manager 2 generates a random number for each of the servers 3-1 to 3-i to be registered, and uses the password pwC and the random number to connect the password manager 2 and the servers 3-1 to 3-i. Passwords pwC, 1 to pwC, i are generated, and passwords pwC, 1 to pwC, i are shared in advance. Then, passwords pwC and pwC, 1 to pwC, i shared in advance between the client terminal 1 and the password manager 2 and between the password manager 2 and the servers 3-1 to 3-i are used, respectively. Authentication is performed, and a session key is exchanged between the client terminal 1 and the servers 3-1 to 3-i.

1-2. Overview of Session Key Exchange Next, an overview of session key exchange will be described. Here, a session key exchange with the server 3-i is illustrated. A session key exchange using a Diffie-Hellman key exchange is used. In the following description, g is a generator, when it is labeled g ^x, this operation is performed on a finite field.

In FIG. 1, the client terminal 1 generates a random number ^x and obtains g ^x . This g ^x is sent to the password manager 2. At this time, authentication is performed between the client terminal 1 and the password manager 2 by using the password pwC shared between the client terminal 1 and the password manager 2.

The password manager 2 generates a random number ^y and obtains gy. Further, g ^xy is obtained from g ^x sent from the client terminal 1 and the generated y. Then, a ^{g y,} and ^{g xy,} and sends to the server 3-i. At this time, authentication is performed between the password manager 2 and the server 3-i using the password pwC, i shared between the password manager 2 and the server 3-i.

The server 3-i generates a random number z, ^obtains g ^xyz from g ^xy sent from the password manager 2 and z generated by itself, and uses this g ^xyz as a key K. Further, the server 3-i sends g ^z to the password manager 2. At this time, authentication is performed between the password manager 2 and the server 3-i.

The password manager 2 calculates g ^yz from y and g ^z, and sends this g ^yz to the client terminal 1. At this time, authentication is performed between the client terminal 1 and the password manager 2.

The client terminal 1 ^obtains g ^xyz from g ^yz sent from the password manager 2 and x generated by itself, and uses this g ^xyz as a key K.

As described above, the session key K (K = g ^xyz ) can be shared by both the client terminal 1 and the server 3-i. In the server 3-i, the session key K is generated by g ^xy sent from the password manager 2 and z generated by itself. On the client terminal 1 side, a session key K is generated from g ^yz sent from the password manager 2 and x generated by itself. The password manager 2 does not know the random numbers x and z. For this reason, the password manager 2 cannot generate the session key K, and can perform secure session key exchange as is known as Diffie-Hellman key exchange.

2. DESCRIPTION OF EMBODIMENTS Next, embodiments of the present invention will be described in detail. Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

2-1. Password Generation First, password generation in the embodiment of the present invention will be described in detail with reference to the functional block diagram of FIG.

  In FIG. 2, the password pwC is generated by the password generation unit 11 of the client terminal 1, and this password pwC is securely sent to the password manager 2. The password pwC is calculated by the hash function H by the calculation unit 12, and the hash value H (pwC) of the password is stored in the password storage unit 10.

  The password pwC from the client terminal 1 is received by the password manager 2. The password pwC received by the password manager 2 is calculated by the calculation unit 13 using the hash function H, and the hash value H (pwC) of the password is stored in the password storage unit 14.

  The random number generator 15 generates a random number ri. The random number ri, the hash value H (pwC) of the password, the identifier C of the client terminal 1, the identifier P of the password manager 2, and the identifier Si of the server 3-i are sent to the password generation unit 16. The password generator 16 calculates pwC, i = H (C, P, Si, ri, H (pwC)), and obtains the password pwC, i for each server. This password pwC, i is sent to the server 3-i. The password pwC, i is calculated by the calculation unit 17 using the hash function H, and the password hash value H (pwC, i) is stored in the password storage unit 18.

  The password pwC, i from the password manager 2 is received by the server 3-i. The password pwC, i received by the server 3-i is calculated by the calculation unit 19 using the hash function H, and the password hash value H (pwC, i) is stored in the password storage unit 20.

  Thus, in this embodiment, the password pwC shared between the client terminal 1 and the password manager 2 is generated, the password hash value H (pwC), the random number ri, the identifier C of the client terminal 1, The password pwC, i shared between the password manager 2 and the server 3-i is generated from the identifier P of the password manager 2 and the identifier Si of the server 3-i. Thereby, the password pwC shared between the client terminal 1 and the password manager 2 and the password pwC, i shared between the password manager 2 and the server 3-i can be related. it can.

  The password pwC shared between the client terminal 1 and the password manager 2 and the password pwC, i shared between the password manager 2 and the server 3-i are calculated and stored by a hash function. For this reason, there is almost no possibility that the password itself is eavesdropped, and security can be improved.

2-2. Session Key Exchange Next, session key exchange in the present embodiment will be described in detail with reference to the functional block diagrams of FIGS.

  FIG. 3 is a functional block diagram showing processing on the client terminal 1 side when exchanging session keys. FIG. 4 is a functional block diagram showing processing on the password manager 2 side when exchanging session keys. FIG. 5 is a functional block diagram showing processing on the server 3-i side when exchanging session keys.

In FIG. 3, the random number generator 31 of the client terminal 1 generates a random number x. The calculation unit 32 calculates a value X (X = g ^x ). The calculation unit 33 multiplies the calculated value X by the hash value H (pwC) of the password stored in the password storage unit 10 to calculate the value X * (X * = X × H (pwC)). . This value X *, the identifier C of the client terminal 1, and the identifier Si of the server 3-i are sent to the password manager 2.

In FIG. 4, the password manager 2 receives the value X * and sends this value X * to the computing unit 35. The calculation unit 35 divides the received value X * by the password hash value H (pwC) of the password storage unit 14 (X = X * / H (pwc)). Thereby, a value X (X = g ^x ) is obtained. This value X is sent to the calculation unit 38.

The random number generator 36 generates a random number y. The calculation unit 37 calculates Y (Y = g ^y ). The generated value y is sent to the calculation unit 38. The calculation unit 38 calculates a value Y & (Y & = g ^xy ) from the value X (X = g ^x ) and the value y. This value Y & is sent to the calculation unit 39.

In the calculation unit 39, the value (Y & = g ^xy ) is multiplied by the hash value H (pwC, i) of the password stored in the password storage unit 18 as a password, and the value Y * (Y * = Y & × H ( pwC, i)) is calculated. This value Y *, the value Y from the calculation unit 37, the identifier C of the client terminal 1, and the identifier P of the password manager 2 are transmitted to the server 3-i.

In FIG. 5, the server 3-i receives the value Y and the value Y *. The value Y * is sent to the calculation unit 51. The calculation unit 51 divides the received value Y * by the password hash value H (pwC, i) of the password storage unit 20 (Y & = Y * / H (pwC, i)). Thereby, the value Y & (Y & = g ^xy ) is obtained. This value Y & is sent to the calculation unit 54.

Further, the random number generator 52 generates a random number z. A value Z (Z = g ^z ) is calculated by the calculation unit 53. The generated value z is sent to the calculation unit 54. The calculation unit 54 calculates a value K (K = g ^xyz ) from the value Y & (Y & = g ^xy ) and the value z.

  In the key generation unit 55, the session key sk is obtained from the value K, the identifier C of the client terminal, the identifier P of the password manager, and the identifier Si of the server 3-i (sk = H ′ (C, P, Si, K)). However, H ′ is another hash function.

The received value Y (Y = g ^y ) is sent to the calculation unit 56. Further, the value z from the random number generator 52 is sent to the calculation unit 56. The calculation unit 56 calculates the value Z & (Z & = g ^yz ).

In the calculation unit 57, authentication is performed based on the value Y & (Y & = g ^xy ) from the calculation unit 51, the value Z & (Z & = g ^yz ) from the calculation unit 56, and the input value Y (Y = g ^y ). A child A1 (A1 = H (Y, Y &, Z &)) is calculated.

The password manager 2 from the server 3-i, the identifier Si server 3-i, the calculated value Z (Z = ^{g z),} and the authenticator A1 are transmitted.

In FIG. 4, the calculation unit 61 of the password manager 2 obtains a value Z ′ (Z ′ = g ^yz ) from the received value Z (Z = g ^z ) and the value y from the random number generator 36. From the calculated value Z ′ (Z ′ = g ^yz ), the value Y (Y = g ^y ) from the calculation unit 37, and the value Y & (Y & = g ^xy ) from the calculation unit 38, An authenticator A1 ′ is calculated. This authenticator A1 ′ is sent to the comparison unit 63.

  Further, the authenticator A1 obtained by the server 3-i is sent to the comparison unit 63. The comparison unit 63 determines whether or not the authenticator A1 obtained by the server 3-i matches the authenticator A1 'obtained by the password manager 2. If no falsification or the like has been performed, the authenticator A1 obtained by the server 3-i and the authenticator A1 'obtained by the password manager 2 should match.

  If the authenticator A1 obtained by the server 3-i and the authenticator A1 'obtained by the password manager 2 do not match, the process is terminated by the process end unit 66.

If they match, the value Z ′ (Z ′ = g ^yz ) from the calculation unit 61, the value Y & (Y & = g ^xy ) from the calculation unit 38, and the value X from the calculation unit 35 are It is sent to the calculation unit 64. The computing unit 64 calculates the authenticator A2 (A2 = H (X, Y &, Z ′)).

  The value Y, the value Z ′, the authenticator A 2, and the identifier P of the password manager 2 are sent from the password manager 2 to the client terminal 1.

In FIG. 3, the calculation unit 71 of the client terminal 1 obtains a value Y ′ (Y ′ = g ^xy ) from the received Y (Y = g ^y ) and the value x from the random number generator 31. The computing unit 72 calculates the authenticator A2 ′ from the calculated value Y ′, the value X from the computing unit 32, and the received value Z ′. This authenticator A2 ′ is sent to the comparison unit 73.

  Further, the authenticator A2 obtained by the password manager 2 is sent to the comparison unit 73. The comparison unit 73 determines whether or not the authenticator A2 obtained by the password manager 2 matches the authenticator A2 'obtained by the client terminal 1. If tampering or the like has not been performed, the authenticator A2 obtained by the password manager 2 and the authenticator A2 'obtained by the client terminal 1 should match.

  If the authenticator A2 obtained by the password manager 2 and the authenticator A2 'obtained by the client terminal 1 do not match, the process is terminated by the processing end unit 74.

The computing unit 75 calculates a value K (K = g ^xyz ) from the value of Z ′ (Z ′ = g ^yz ) received from the password manager 2 and the value x from the random number generator 31.

  In the key generation unit 76, the session key sk is obtained from the value K, the identifier C of the client terminal, the identifier P of the password manager, and the identifier Si of the server (sk = H ′ (C, P, Si, K)). Is generated as

  As described above, in the present embodiment, by using the password manager 2, the user of the client terminal 1 only needs to remember one password for each of the servers 3-1 to 3-i on the website. Session keys can be shared while authenticating with different passwords. For this reason, the user can communicate safely for each server on the website. In addition, this embodiment has an advantage that the processing on the client terminal 1 side does not become heavy.

  Note that the key exchange system of the present invention is realized by recording each process of the key exchange system on a computer-readable recording medium, causing the key exchange system to read and execute a program recorded on the recording medium. Can do. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The present invention is not limited to the above-described embodiments, and various modifications and applications can be made without departing from the gist of the present invention.

It is a block diagram which shows the outline | summary of the system of embodiment of this invention. It is a block diagram used for description of the production | generation of the password in the system of embodiment of this invention. It is a block diagram used for description of session key exchange in the system of the embodiment of the present invention. It is a block diagram used for description of session key exchange in the system of the embodiment of the present invention. It is a block diagram used for description of session key exchange in the system of the embodiment of the present invention.

Explanation of symbols

1: Client terminal 2: Password manager 3-1, 3-2, ..., 3-i, ...: Server

Claims (5)

It consists of a client terminal, a password manager, and multiple servers.
The client terminal has first password generation means, and shares the first password between the client terminal and the password manager;
The password manager has a second password generation means, and each of the password manager and each server shares a second password;
Authentication is performed using a first password shared in advance between the client terminal and the password manager, and a second password shared in advance between the password manager and each server A key exchange system characterized in that authentication is performed by using and a session key is exchanged between the client terminal and each of the servers.   The key exchange system according to claim 1, wherein the first password generation unit generates one password as the first password.   2. The key exchange according to claim 1, wherein the second password generation unit generates a plurality of passwords for each of the servers as the second password by using the first password and a random number. system. A key exchange method in a key exchange system comprising a client terminal, a password manager, and a plurality of servers,
A first step in which the client terminal generates a first password and shares the first password between the client terminal and the password manager;
A second step in which the password manager generates a second password for each server and shares the second password between the password manager and each of the servers;
Authentication is performed using a first password shared in advance between the client terminal and the password manager, and a second password shared in advance between the password manager and the servers. And a third step of exchanging a session key between the client terminal and the respective server;
A key exchange method characterized by comprising: A program for causing a computer to execute a key exchange method in a key exchange system composed of a client terminal, a password manager, and a plurality of servers,
A first step in which the client terminal generates a first password and shares the first password between the client terminal and the password manager;
A second step in which the password manager generates a second password for each server and shares the second password between the password manager and each of the servers;
Authentication is performed using a first password shared in advance between the client terminal and the password manager, and a second password shared in advance between the password manager and each server And a third step of exchanging a session key between the client terminal and the respective server;
A program characterized by comprising:

Images