JP2013218488A - Password authentication system and method without identifier (id) and only with one-time password - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a password authentication system and method without an identifier (ID) of an authenticated person and only with a one-time password.SOLUTION: Data (value) of all authenticated person side devices 100 which are respectively different data and in which identifiers (ID) 113 of the authenticated person side devices 100 to be data (value) different for each authenticated person side device 100, data (value) in which a date, time, or both are made digitization, and an authentication frequency 114 of the authenticated person side device 100 as needed are combined with one another, or the value of a function obtained by inputting the data (value) into a function 115 corresponding one-to-one, shared by the all authenticated person side devices 100 and authenticator side devices 300, is used as a one-time password 112.

Description

  The present invention relates to a password authentication system and method that uses only a one-time password without using an identifier (ID).

In the authentication between the person to be authenticated and the authenticator, generally, the authentication establishment is determined by using both the identifier (ID) of the person to be authenticated and the password. In the authentication using the identifier (ID) and the password together, damage is caused by a third party illegally acquiring and misusing the password by key logger, skimming, phishing, or the like.
As a preventive measure against the unauthorized use of the password, a one-time password that changes the password for each authentication is used, and the S / Key method (Non-Patent Document 1) devised by Lamport or RSA_SecurID A method using tokens has been put into practical use. Also, a password authentication system and method that solves the problems of the above methods have been applied and disclosed (Patent Documents 1 and 2).

Password authentication system and method, encrypted communication system and method Japanese Patent Application No. 2011-252771 Password Authentication System and Method, Encrypted Communication System and Method

L. Lampport: Password authentication with insure communication. Commun. ACM, 24, 11, pp. 770-772; 1981

  However, in the conventional password authentication, the authentication establishment is determined by using both the identifier (ID) of the person to be authenticated and the password, and for the malicious third party, the identifier (ID of the person to be authenticated) is determined. ) May be a clue to collecting information, and for the person to be authenticated, the identifier (ID), which is his own unique number, is not changed as it is. There may be a case where there is a sense of resistance to directly flowing its own identifier (ID).

  The present invention has been made in view of the above points, and a system for performing password authentication using only a one-time password, which is a different password each time, without using an identifier (ID) of the person to be authenticated. A method is provided.

  Furthermore, for the person to be authenticated, authentication using only a one-time password without using his / her own identifier (ID) may cause anxiety that the authenticator is authentically authenticating himself / herself. It is also possible to provide a system and method for a person to be authenticated to confirm correct and accurate authentication of a certifier to solve the problem.

  In order to solve the above-mentioned problem, in the present invention of claim 1, the identifier (ID) of the authenticated user side device assigned as different data (value) for every authenticated user side device, date, time, Or, combining both the date and time, or the data (value) in which both the date and time are digitized, and the number of times of authentication indicated by the counting means in addition to them as needed, A different data (value) is created in all the devices to be authenticated and can be used as it is, or this data (value) can be shared by all the devices to be authenticated and the devices on the authenticator. The value of the function obtained by entering the function is used as the one-time password. By doing so, it becomes possible to set the one-time passwords of all the devices to be authenticated to be different data (values) at all times.

  The present invention of claim 1 is a password authentication system that enables authentication without directly exchanging the identifier (ID) of the device to be authenticated.

  The present invention of claim 5 is an invention of a method performed by the system of claim 1.

  However, the fact that authentication is successful and that the person to be authenticated is convinced that the certifier has authenticated himself / herself correctly are different problems. The person to be authenticated himself / herself authenticates himself / herself to the certifier correctly. In many cases, it is not possible to proceed to the next procedure unless you are convinced that you have it.

  In order to solve this problem, in the present invention of claim 2, both the device to be authenticated and the device on the authenticator side create two one-time passwords for identification and confirmation in advance. After the side device identifies the device to be authenticated with the one-time password for identification, the device on the authenticator side returns the confirmation one-time password to the device to be authenticated and the one-time password for confirmation.・ Authentication is confirmed when the device to be authenticated confirms the password. By doing so, the present invention of claim 2 is a system that allows the authenticated person side apparatus to confirm that the authenticator side apparatus authenticates itself correctly.

  The present invention of claim 6 is an invention of a method performed by the system of claim 2.

  Another problem is that the person to be authenticated is mis-authenticated as another person to be authenticated, either by a numerical value that the person to be authenticated has intentionally entered randomly because of malicious or mischief, or by mistakenly entering a one-time password. There is a problem. For this, using check digits (check digits) has the effect of preventing many false authentications due to mere input mistakes, but it is not universal.

  In this case, if an incorrect input due to a simple mistake that is not malicious leads to false authentication, the confirmation one-time password returned from the certifier is the same as the confirmation one-time password created by the person to be authenticated. It can be solved by the person himself / herself noticing his / her wrong input because it is different, but sometimes a person to be authenticated intentionally enters a random number by malicious or mischief and the random number is accidentally changed to another person. If it is falsely authenticated by a certifier that matches one of the certifiers, or if the wrong input due to negligence is the cause of the misappropriation of the certifier, If you accept the one-time password for confirmation as it is, impersonate the wrong person as another person or third party as one person Possible to become.

  As one of the methods for solving this problem, in the present invention of claim 3, both of the authentication-subjected-side device and the authenticator-side device are preliminarily identified with three one-time operations for identification, confirmation, and reconfirmation. Create a password. First, after the certifier side device identifies the device to be authenticated with the one-time password for identification, the certifier side device gives the one-time password for confirmation to the device to be authenticated. The authenticated person side device confirms that the certifier side device is correctly identified, and the authenticated side device retransmits the one-time password for reconfirmation to the certifier side device. The certifier side apparatus reconfirms that the identification target person side apparatus is not accidentally identified by the first one-time password for identification, and the authentication is established.

  If the first one-time password for identification is used for authentication, the number or character string that the person to be authenticated has intentionally entered randomly and maliciously or mischiefly, or the number or character string that has been entered incorrectly by mistake. However, in the case of misidentification by a certifier as one of the other authenticated persons, it is easy for the authenticated person or mischief to accept the one-time password for confirmation of the certifier as it is, The one-time password for reconfirmation cannot be retransmitted for the person to be authenticated or the mischief. Accordingly, the present invention of claim 3 is a system that can solve the problem of erroneous authentication due to intention or accident.

  The present invention of claim 7 is an invention of a method performed by the system of claim 3.

  As another method for solving the problem of impersonation, in the present invention of claim 4, when the authenticator returns the verification one-time password to the person to be authenticated, the correct one-time for verification -In addition to the password, a plurality of data (values) including a fake one-time password for decoy are returned and the one to be authenticated selects the correct one-time password for confirmation. Thus, the certifier can reconfirm that the person to be authenticated knows the one-time password for regular confirmation. By doing so, the present invention of claim 4 is a system that can prevent the person to be authenticated from impersonating the certifier and spoofing from the middle and impersonating with high probability.

  The present invention of claim 8 is an invention of a method performed by the system of claim 4.

  In the present invention according to claims 1 to 8, the one-to-one correspondence function may use decimal arithmetic four arithmetic calculations, or any other function.

  In general, in the common key encryption method, if the encryption key is fixed and the data amount of the original data (plain text) is within one block, the original data (plain text) set and encryption are performed. A one-to-one correspondence with a set of data (ciphertext) is guaranteed, and this can be used as a one-to-one correspondence function in this case.

  According to the first and fifth aspects of the present invention, a password that enables a malicious eavesdropper to perform authentication without directly exchanging an identifier (ID) of the person to be authenticated that can be a clue to collecting information. Authentication systems and methods can be provided.

  According to the present invention of claim 2 and claim 6, even when authentication is performed without directly exchanging the identifier (ID) itself of the person to be authenticated according to the present invention of claim 1 and claim 5, It is possible to provide a password authentication system and method capable of confirming that a certifier authenticates himself / herself correctly.

  According to the present invention of claim 3, claim 4, claim 7, and claim 8, authentication according to the present invention of claim 1 and claim 5 is performed without directly exchanging the identifier (ID) of the person to be authenticated. In doing so, not only can the certifier authenticate himself / herself correctly, but sometimes the result of the certifier's negligence or third party's deliberate input, To provide a password authentication system and method capable of preventing a certifier from impersonating another person who is to be authenticated accidentally and impersonating the authentication as it is. it can.

  Here, “not directly exchanging identifiers (IDs)” does not mean that “identifiers (IDs) are exchanged as processed data such as encrypted ciphertexts without exchanging plaintexts as they are”. This means that the information of the identifier (ID) itself is also processed and incorporated in the one-time password itself and exchanged by changing it in one time.

It is a block diagram which represents typically the structural example of the password authentication system of Claim 3. It is a flowchart which shows the process in a to-be-authenticated person side apparatus and certifier side apparatus of Claim 3. 10 is a table showing one-time passwords of each person to be authenticated in the second embodiment. 14 is a table showing one-time passwords for identifying each person to be authenticated in the third embodiment. 10 is a table showing one-time passwords for confirmation of each person to be authenticated in the third embodiment. 10 is a table showing a modification example of the one-time password input method for each person to be authenticated in the second embodiment. 10 is a table showing an example of changing a method for inputting a one-time password for identifying each person to be authenticated in the third embodiment.

[Embodiment 1]
The first embodiment is a password authentication system according to a third aspect, which comprises a device to be authenticated and a device on the authenticator side, and will be described with reference to FIGS.
In the present embodiment, it is assumed that the person to be authenticated is 9000 executives of a large company deployed all over the world, and the certifier is a database of the large company headquarters. One person-to-be-authenticated apparatus is assigned to every person to be authenticated, and the apparatus on the certifier side is connected to the database of certifiers. All devices to be authenticated and certifier devices are connected to the Internet. In the present embodiment, the password authentication system of the present invention is used when the device to be authenticated is connected to the device on the authenticator side.

  First, FIG. 1 schematically shows a configuration example of the password authentication system in a block diagram. This password authentication system includes an authenticator side device 100 and an authenticator side device 300 that are communicably connected to each other via a communication network 200 (here, the Internet). In the present embodiment, the device 100 to be authenticated corresponds to a security token, a portable computer, a mobile phone, or the like as a mobile terminal device, and the server or computer corresponds to the device certifier 300.

  Both the authenticator side device 100 and the authenticator side device 300 are configured by storage units 110 and 310 and data processing means 120 and 320.

  Both storage units 110 and 310 correspond to devices and media that can be stored, such as a main storage device, a hard disk device, and a flash memory.

  The storage unit 110 of the person-to-be-authenticated apparatus 100 includes its own one-time password 112, its own identifier (ID) 113, its own number of authentications 114, all of the person-to-be-authenticated apparatuses 100 and the person who is authenticated. A one-to-one correspondence function 115 shared by 300, a protocol 116 for various processes, and various parameters 117 necessary for various processes are stored.

  The storage unit 310 of the authenticator side device 300 includes a one-time password table 312 that is a list of the one-time passwords 112 corresponding to each of all the authentication-subjected user-side devices 100, and all the authenticated-user-side devices 100. An identifier (ID) table 313 that is a list of the identifiers (ID) 113 assigned in advance to an authentication number, a table 314 of authentication counts that is a list of the number of authentications 114 for each authentication-subjected user side device 100, A one-to-one correspondence function 315 shared by the authenticator side device 100 and the authenticator side device 300, various processing protocols 316, and various parameters 317 necessary for various processing are stored.

  Both data processing means 120 and 320 are composed of one-time password creating means 122 and 322, calendar clock means 123 and 323, counting means 124 and 324, authentication determining means 128 and 328, and communication means 129 and 329. Is done.

  The one-time password creating means 122 of the person-to-be-authenticated apparatus 100 includes its own identifier (ID) 113, data (value) obtained by digitizing the date of authentication indicated by the calendar clock means 123, and counting means 124. Is combined with the number of times of authentication 114 shown on the authentication day, and three pieces of data (values) having different values are created for all of the devices 100 to be authenticated, and the three pieces of data (values) are further added to all of the pieces of received data. Three one-time passwords 112 for identification, confirmation, and reconfirmation are obtained by inputting the value of the function obtained by inputting into the one-to-one correspondence function 115 shared by the authenticator side device 100 and the authenticator side device 300. The past one-time password 112 created and stored in its own storage unit 110 is updated.

  The one-time password creating means 322 of the authenticator side device 300 includes an identifier (ID) table 313, data (value) obtained by digitizing the date of authentication indicated by the calendar clock means 323, and the number of authentication times / table. 314 for identification, confirmation, and reconfirmation corresponding to the authenticated user side device 100 in the same manner as the one-time password creating means 122 of each authenticated user device 100. A list of three one-time passwords for identification, confirmation, and reconfirmation corresponding to each of all devices to be authenticated is created in the same manner by creating three one-time passwords. The one-time password table 312 is created and the past one-time password table 312 stored in the storage unit 310 is updated.

  Here, as one-to-one correspondence functions 115 and 315 that are shared by all the authenticated-substance apparatus 100 and the authenticator-side apparatus 300, one block is the national new standard encryption standard of the United States that is a known encryption method. AES (Advanced Encryption Standard), which is a 128-bit block encryption method, is used. In the system of this embodiment, if the AES encryption key is fixed to one arbitrary value in the entire system, the data amount of 128 bits or less is required in AES in which one block is a 128-bit block encryption method. When a plaintext is encrypted to create a 128-bit ciphertext, the plaintext and the ciphertext have a one-to-one correspondence. Therefore, since one number or alphabet can be specified with a data amount of 8 bits, plain text of numbers or alphabets with numbers of 16 characters or less (= 128 bits) is encrypted with AES, and 128 bits encryption is performed. When the text is created, the plain text and the cipher text have a one-to-one correspondence.

  Here, as a ciphertext notation method using AES, a ciphertext obtained by encrypting P, which is a plaintext, using AES is denoted as AES [P].

  In this embodiment, the identifier (ID) 113 is randomly assigned to 9000 executives so that the identifier (ID) 113 of 8 digits or uppercase or lowercase alphabets is not duplicated. It is assumed that the identifier (ID) 113 of each of the 9000 executives is known only by the executive who is the person to be authenticated and the database of the head office. Further, the upper limit of the number of authentications per day in this embodiment is limited to 33 times.

  As a method for creating the one-time password 122 in the one-time password creating means 122 of the person-to-be-authenticated apparatus 100 in this embodiment, the person-to-be-authenticated apparatus 100 to which abcdefgh is assigned as the identifier (ID) 113 is used. “Abcdefghijklmnop” is determined as “abcdefghijklmnop”, which is the source of the one-time password 112 used for the first-time authentication on the 20th day of the year 20ij kl month mn. It is assumed that data (value) is plaintext and AES [abcdefghijklmnop], which is data (value) that is a ciphertext obtained by encrypting the plaintext using AES which is a one-to-one correspondence function 115, is a one-time password 112. Here, “a, b, c, d, e, f, g, h” are each a single digit number or an uppercase or lowercase alphabet, and “i, j, k, l, m, n, o, “p” is a single digit number, and “a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p” are all 8-bit data. And

  On the other hand, in the authenticator side device 300, the one-time password creating means 122 of each authenticated-user side device 100 creates the one-time password 112 in the same manner as that of the authenticated-user side device 100. A one-time password corresponding to each is created, and a list of one-time passwords corresponding to all devices to be authenticated is created as a one-time password table 312.

  Here, as described above, the upper limit of the number of authentications per day in this embodiment is determined as 33 times, and the number of authentications 114 from which “different data (values) for every person to be authenticated” is created is as follows: The identification number 114 of the identification one-time password indicates the actual number of authentications on the day of authentication as a two-digit number. The number of authentications 114 of the confirmation one-time password indicates the actual number of authentications on the day of authentication. It is assumed that a two-digit numerical value obtained by adding 33 to the number of authentications 114 of the one-time password for reconfirmation and a two-digit numerical value obtained by adding 66 to the actual number of authentications on the authentication day are used. Then, for example, the one-time password for identification at the 26th authentication on February 4, 2012 of the authentication-subjected device assigned 4k5LM37p as the identifier (ID) 111 is AES [4k5LM37p12020426], confirmation The one-time password for data is AES [4k5LM37p12020459], and the one-time password for reconfirmation is data (value) of binary 128 bits (16 bytes) represented by AES [4k5LM37p12020492].

  An example of a procedure executed in the password authentication system configured as described above will be described with reference to FIG. The left side of FIG. 2 shows an example of the procedure of the device to be authenticated, and the right side shows the procedure of the device of the authenticator. It is assumed that this is an example of the 26th authentication procedure performed on February 4, 2012.

First, the person-to-be-authenticated apparatus transmits a connection request signal to the apparatus to be authenticated (step S11). In this embodiment, for example, a connection button on an Internet homepage is clicked.
When the authenticator side apparatus receives the connection request signal from the authenticated person side apparatus [step S31], the authenticator side apparatus requests the authenticated person side apparatus to transmit an identification one-time password [step S32].
When the authenticator side device is requested by the authenticator side device to transmit an identification one-time password [step S12], AES [4k5LM37p12020426] is used as the identification one-time password stored in its storage unit. Transmit to the authenticator side device [step S13].
When the authenticator side apparatus receives AES [4k5LM37p12020426] as a one-time password for identification from the authenticated person side apparatus [step S33], the authentication determining means uses the received data (value) as one of its own storage unit. An authenticated person side device that has an identification (ID) of 4k5LM37p that requested the authentication of an authenticated person side device that has a one-time password for identification that matches the time password table. [Step S34], and AES [4k5LM37p12020459] as a one-time password for confirmation corresponding to the authenticated user side device 100 stored as a one time password table for the authenticated user side device. Transmit [step S35].
When the device to be authenticated receives AES [4k5LM37p12020459] as a one-time password for confirmation from the device on the authenticator side [step S15], the authentication determining unit stores the received data (value) in its own storage unit. Compared with the confirmation one-time password, it is confirmed that the two devices match each other, so that the authenticator side device correctly identifies the device to be authenticated [step S16], and is stored in its own storage unit. AES [4k5LM37p12020492] is transmitted to the authenticator side device as a one-time password for reconfirmation [step S17].
When the authenticator side apparatus receives AES [4k5LM37p12020492] as a one-time password for reconfirmation from the authenticated person side apparatus [step S37], the authentication determining means stores the received data (value) in its own storage unit. Refer to the one-time password table and re-confirm that the device to be authenticated has the same one-time password for reconfirmation that the two match, and that the device to be authenticated has the identifier (ID) 4k5LM37p. [Step S38] Thus, it is determined that the initial authentication was not a false authentication due to intention or accident, and the authentication is completed.

The degree of safety of the present system depends on the safety of AES, which is considered to be sufficiently safe at present. However, in this system, the AES key needs to be the same for all authenticated user devices 100 and authenticated user devices 300 at the same time, and the result is that one of the authenticated user devices 100 illegally enters. If the AES key is analyzed, the security of all the systems is compromised.
On the other hand, in the situation as in the present embodiment, it is possible for a reliable employee to carry the AES key regularly and to ensure sufficient safety by frequently changing the AES key. It seems to be.

[Embodiment 2]
The second embodiment is an example of the password authentication method according to claim 5 and will be described with reference to FIG.
In this embodiment, the person to be authenticated is six office workers who go to the company every day and enter the special management area and undergo a security check at a special door in the special management area. In this embodiment, the dedicated door in this special management area corresponds to the certifier. In this authentication, the one-time password invented in claim 5 is used. Now, the names of the six office workers are A, B, C, D, E, and F, and the unique employee numbers (ID = identifiers) of the respective office workers are 2, 3, 5, 6, 8, and 9.
In this embodiment, each office worker decides that the first digit of the number obtained by adding the number of his / her unique employee number (ID = identifier) to the number of the date on which the employee entered the company will be the one-time password for that day. To do. Then, as shown in FIG. 3, the one-time passwords for A, B, C, D, E, and F on Y1 of Y are 3, 4, 6, 7, 9, 0, respectively, The one-time passwords for A, B, C, D, E, and F on Y2 of YY are 4, 5, 7, 8, 0, and 1, respectively, and so on. , B, C, D, E, and F are one-time passwords 7, 8, 0, 1, 3, 4 respectively.
Each company employee's unique employee number (ID = identifier) and password creation method are stored in the company database. Using this information, the dedicated doors of this special management area are the six certified companies. Each member can be authenticated.

[Embodiment 3]
The third embodiment is an example of the password authentication method according to claim 6 and will be described with reference to FIGS. This example is composed of the same company and company employees as in the second embodiment, and the one-time password invented in claim 6 is used for this authentication.
In this embodiment, the two one-time passwords for identifying and confirming each company employee are each two-digit numbers. As a method for creating a one-time password, the first digit of the one-time password for identification is the unique employee number (ID = identifier) of the company employee in the number of the one-time password in the second embodiment. The first digit of the numerical value plus the month number of the date of work, the second digit of the one-time password for identification is the number of the one-time password of the second embodiment, or for confirmation The first digit of the one-time password is the numeric value of the one-time password of the second embodiment, the second digit of the confirmation one-time password is the numeric value of the one-time password of the second embodiment and the numeric value 12 It is decided that the first digit of the numerical value obtained by adding the numerical value of the employee number (ID = identifier) unique to the company employee and further subtracting the numerical value of the month of the date of office entry from there. Then, as shown in FIG. 4, the one-time passwords for identification of A, B, C, D, E, and F on March 1, X are 38, 40, 64, 77, 90, 02, respectively. The one-time passwords for identification of A, B, C, D, E, and F on March 2, X are 49, 51, 75, 87, 01, and 13, respectively, and so on. The one-time passwords for identifying A, B, C, D, E, and F on the 5th are 72, 84, 08, 10, 34, and 46, respectively, as shown in FIG. The one-time passwords for checking A, B, C, D, E, and F are 43, 64, 06, 27, 69, and 80, respectively, and A, B, C, and D on March 2, X , E, and F are confirmed as one-time passwords 54, 75, 17, 38, and 70, respectively. 91, similarly, A of X March 5, B, C, D, E, F one-time password for each of confirmation will be each 87,08,40,61,03,24 below.

  In this example, after identifying a company employee whose private door in this special controlled area is a certified person using a one-time password for identification, the next time in the one-time password table created by the certifier The one-time password for confirming the person to be authenticated is selected from the one-time passwords for confirming each company employee shown in FIG. 5 and displayed on the display section of the dedicated door. Authentication is established by confirming that you have been authenticated correctly and pressing the confirmation button.

  In the first embodiment, AES is used as a one-to-one correspondence function. However, other block ciphers may be used, or ordinary four arithmetic calculations may be used. A one-to-one correspondence function suitable for the system can be determined from the degree of security required for the system and the amount of practical one-time password.

  In Embodiments 2 and 3, in order to explain the principle in an easy-to-understand manner, the number of authentications is limited to once a day, and a one-time password uses a very small number of digits. The same one-time password is repeated in a short period of time. Especially in the second embodiment, even a third party who does not know anything because the number of digits in the one-time password is too small. It is very likely that someone will be authenticated and put into a special controlled area, which is not practical.

  As an improvement plan to put the second and third embodiments into practical use, it is intended to improve security and practicality by further increasing the number of digits of the identifier (ID) and the one-time password. In the second and third embodiments, as in the first embodiment, the digit of the identifier (ID) is significantly larger than the actual number of authenticated persons, and an empty identifier (ID that does not exist) ) Can be made more practical. In other words, even if there are six employees who are to be authenticated, the identifier (ID) has, for example, 6 to 8 digits, and each digit has a date, a month number, and a unique employee number (ID = identifier). As long as the same one-time password is not repeated in a relatively short period of time by performing calculations, etc., the second and third embodiments can be used in environments where the number of authentications can be limited to once a day. Even with this principle, it can be put to practical use.

  Another method for improving the practical use of the second and third embodiments is to change the one-time password input method. For example, in the second embodiment, a company employee who is a person to be authenticated arbitrarily enters a 6-8 digit number, but the actual one-time password number is the fourth digit (4 from the right). For example, FIG. 6 shows an example of the one-time password input for each of the office workers on year 1 month X 1 and year 2 month 2 X.

  Similarly, in the third embodiment, a company employee who is a person to be authenticated arbitrarily inputs a 6-8 digit number, but the first digit of the actual one-time password is the one-time password to be input. In the first digit of the password (the rightmost number), the second digit of the actual one-time password is the second largest digit (the second number from the leftmost one) of the entered numbers. For example, FIG. 7 shows an input example of a one-time password for identifying each company employee. The confirmation one-time password may be an actual two-digit number.

  In addition, especially in the case of assuming manual input, it is considered useful to use a check digit (check digit) in order to prevent erroneous authentication due to a simple input error.

  In the present invention, the one-time password is created in advance by both the person to be authenticated and the certifier, and then the password authentication is performed. However, when the person to be authenticated performs the password authentication, A password may be created, or the authenticator may create a one-time password table after receiving an authentication request of a certain person to be authenticated.

  Further, in claim 4 and claim 8, the fake one-time password for decoy is created after the authenticator receives the confirmation one-time password from the person to be authenticated. Also good.

  Although the three embodiments have been described as the best mode for carrying out the present invention as described above, the present invention is not limited to the embodiment and is within the scope not departing from the gist of the present invention. It can be implemented in various fields in various forms.

100 Authentication-subjected device 110, 310 Storage unit 112 One-time password 113 Identifier (ID)
114 Number of authentications 115, 315 One-to-one correspondence function 116, 316 Various processing protocols 117, 317 Various parameters 120, 320 Data processing means 122, 322 One-time password creation means 123, 323 Calendar clock means 124, 324 Count means 128, 328 Authentication decision means 129, 329 Communication means 200 Communication network 300 Authenticator side device 312 One-time password table 313 Identifier (ID) table 314 Number of authentication times table

Claims (8)

A password authentication system comprising a device to be authenticated and a device on the authenticator side,
All devices to be authenticated are assigned identifiers (IDs) as data (values) unique to each device to be authenticated so as not to overlap with other devices to be authenticated,
Both the person-to-be-authenticated device and the device to be authenticated have a storage unit and data processing means,
The storage unit of the authentication-subjected side device stores the identifier (ID) assigned to itself in advance and its own one-time password created by the one-time password creating means described later. When it is used when creating its own one-time password, a one-to-one correspondence function shared by all devices to be authenticated and the devices on the authenticator side, The number of authentications, various processing protocols, various parameters necessary for various processing, etc. are stored as necessary,
The storage unit of the authenticator side device includes an identifier (ID) table that is a list of the identifiers (IDs) assigned in advance to all the authenticated person side devices, and the one-time The same method as the password creation means creates, and collects the same one-time password as the one-time password of the device to be authenticated created by the one-time password creation means described later. When storing a one-time password table that is the same list of one-time passwords as each of all devices to be authenticated, and when using it to create the one-time password table , A one-to-one correspondence function shared by all devices to be authenticated and all devices to be authenticated, and each user to be authenticated counted by the counting means described later A list of authentication count for each device and the authentication number table, and the protocol of various processes, and various parameters necessary for various processes, and stores as needed also,
The data processing means of the device to be authenticated includes a one-time password creation means, a communication means, a calendar clock means for displaying the date and time, and if the number of authentications is used as a parameter, Counting means, and
The data processing means of the certifier side device includes a one-time password creation means, a communication means, a calendar clock means for displaying the date and time, an authentication determination means, and a case where the number of authentications is used as a parameter. A counting means for counting the number of times of authentication of each authenticated person side device,
The one-time password creation means of the device to be authenticated includes the identifier (ID) of the device and the date or time, or both the date and time, or both the date and time, as indicated by the calendar clock means. The data (values) converted into numerical values and, if necessary, in addition to the number of authentications counted by the counting means as appropriate, are different values for all devices to be authenticated. Create data (value) and input the data (value) to a one-to-one correspondence function shared by all devices to be authenticated and certifier devices stored in the storage unit The function value obtained as described above is created as a one-time password, and the past one-time password stored in the storage unit of itself is updated.
The one-time password creating means of the authenticator side device stores the identifier (ID) table stored in the storage unit and the date or time, or both the date and time, or the date indicated by the calendar clock means. A one-time password for each device to be authenticated, using a combination of data (value) in which both the date and time are digitized, and if necessary, the number of times of authentication and a table in addition to those as necessary. A one-time password corresponding to the device to be authenticated is created in the same manner as the creation means, and a one-time password list corresponding to each of all devices to be authenticated is similarly created. Create a time password table and update the past one-time password table stored in its memory
When actually performing password authentication, the communication means of the device to be authenticated that requests authentication first transmits the one-time password stored in its storage unit to the authenticator device, and then the authenticator. When the communication device of the side device receives the one-time password from the device to be authenticated, the authentication determination unit of the device on the side of the authenticator uses the one-time password received from the device to be authenticated to the one-time password in its storage unit. The person-to-be-authenticated device that matches the password table is identified, and the person-to-be-authenticated device that sent the one-time password is identified as the person-to-be-authenticated device assigned the identifier (ID) It is characterized in that authentication is established by
A password authentication system in which an authenticator device authenticates a device to be authenticated by exchanging only a one-time password without directly exchanging an identifier (ID) of the device to be authenticated. A password authentication system according to claim 1, comprising a device to be authenticated and a device on the authenticator side,
The data processing means of the device to be authenticated is composed of authentication determining means in addition to each means described in claim 1,
The one-time password creation means of the device to be authenticated creates two data (values) which are different values for all the devices to be authenticated by the timing and method according to claim 1 and generates them. Or two functions obtained by inputting these two data (values) into a one-to-one correspondence function shared by all the authentication-subjected-devices and the authenticator-side devices stored in the storage unit The two values for identification and confirmation are created as two one-time passwords for identification and confirmation, and the two one-time passwords for identification and confirmation stored in the storage unit are updated.
The one-time password creation means of the authenticator side device is the same as the one-time password creation means of each authenticated person device with the timing and method according to claim 1, and Create two one-time passwords for identification and confirmation corresponding to, and in the same way, list of two one-time passwords for identification and confirmation corresponding to each authentication target device. Create a one-time password table and update the past one-time password table stored in its own memory,
When actually performing password authentication, first, in accordance with the procedure described in claim 1, the authentication-subjecting means of the authenticator-side device is selected as the authentication-subject-side device that requests authentication using the one-time password for identification. Then, the authentication decision means of the authenticator side device further confirms the identification corresponding to the identified user side device from the one-time password table stored in its storage unit. The one-time password for use is selected, and then the communication means of the authenticator-side apparatus identifies the one-time password for confirmation corresponding to the selected authentication-subjected-user side apparatus. Next, when the communication means of the authentication-subjected device that requested the authentication receives the confirmation one-time password from the authenticator-side device, the authentication means of the authentication-target device The decision means compares the one-time password for confirmation received by the own communication means from the certifier side device with the one-time password for confirmation stored in its own storage unit, and authenticates if they match. By confirming that the authenticator device has correctly identified the authenticated user device itself, the authenticated user device that first transmitted the identification one-time password is the authenticated user device to which the identifier (ID) is assigned. It is characterized by being authenticated,
The authenticator's device identifies the device to be authenticated by exchanging only the one-time password without directly exchanging the identifier (ID) of the device to be authenticated. The password authentication system according to claim 1, wherein authentication is established by confirming identification. A password authentication system according to claim 2, comprising a device to be authenticated and a device on the authenticator side,
The one-time password creating means of the device to be authenticated creates three one-time passwords for identification, confirmation, and reconfirmation by the timing and method according to claim 2 and uses the storage unit of its own Update the three one-time passwords for past identification, confirmation and reconfirmation stored in
The one-time password creation means of the authenticator side device is the same as the one-time password creation means of each authenticated person device in the same timing and method as claimed in claim 2, and Create three one-time passwords for identification, confirmation, and reconfirmation that correspond to, and in the same way, for identification, confirmation, and reconfirmation corresponding to all authentication target devices. Create a one-time password table, which is a list of three one-time passwords, and update the past one-time password table stored in its storage unit,
When actually performing password authentication, first, in accordance with the procedure described in claim 2, the authentication-subjecting means of the authenticator-side device is used as the authentication-subject-side device that requests authentication using the one-time password for identification. Then, using the one-time password for confirmation, the authentication-subjected device confirms the correct identification of the authenticator-side device. The communication means of the certifier side device transmits its one-time password for reconfirmation to the certifier side device, and the communication means of the certifier side device confirms the one-time password for reconfirmation from the device to be authenticated. The authentication determining means of the authenticator side device receives the one-time password for reconfirmation received by the communication means from the authentication-subjected side device and the one-time password table of its own storage unit. Compared with the one-time password for reconfirmation corresponding to the recorded device of the person to be authenticated, reconfirms that both match, and the first one-time password for identification is first transmitted. A user device is authenticated as a device to be authenticated to which the identifier (ID) is assigned.
The authenticator's device identifies the device to be authenticated by exchanging only the one-time password without directly exchanging the identifier (ID) of the device to be authenticated. The password authentication system according to claim 2, wherein authentication is confirmed by confirming the identity and further confirming the authenticator side device by reconfirming the authenticator side device. A password authentication system according to claim 2, comprising a device to be authenticated and a device on the authenticator side,
The data processing means of the certifier side device is composed of a means for creating a fake one-time password for decoy in addition to each means of claim 2,
When actually performing password authentication, first, as described in claim 2, the authentication-subjected device whose authentication determining means of the authenticator-side device requests authentication using the one-time password for identification first. Then, the one-time password for confirmation corresponding to the identified user apparatus is selected from the one-time password table stored in its own storage unit, and then the request is made. Subsequently, the fake one-time password creation means for the decoy device on the decoyer side creates a fake one-time password for the decoy number determined in advance by this system, and then the authenticator side device. The communication means includes a combined one-time password for regular confirmation corresponding to the selected device to be authenticated and a fake one-time password for the decoy. Data (value) is transmitted to the identified authenticated person side device, and then the communication means of the authenticated person side device that requested the authentication sends the plurality of data (value) from the authenticated side device. Upon receipt, the authentication determining means of the device to be authenticated side collates the plurality of data (values) received from the device on the side of the authenticator with the one-time password for regular confirmation stored in its storage unit. The one-time password for regular confirmation is selected from the plurality of received data (values), and the communication means of the authentication-subjected device then selects the one-time password for regular confirmation. Or a mark indicating that the one-time password for regular confirmation has been screened is transmitted to the authenticator side device, and then the communication means of the authenticator side device receives the authenticity confirmation device from the authenticator side device. One-time password Or, when receiving a mark indicating that the one-time password for regular confirmation has been selected, the authentication determining means of the certifier side device correctly selects the one-time password for the regular confirmation by the certifier side device. Re-confirming that the authentication target device that first transmitted the identification one-time password is authenticated as the device to be authenticated to which the identifier (ID) is assigned. ,
The authenticator's device identifies the device to be authenticated by exchanging only the one-time password without directly exchanging the identifier (ID) of the device to be authenticated. The password authentication system according to claim 2, wherein authentication is confirmed by confirming the identity and further confirming the authenticator side device by reconfirming the authenticator side device. A password authentication method comprising a person to be authenticated and a certifier,
All authenticated persons are assigned in advance an identifier (ID), which is unique data (value), so as not to be duplicated with other authenticated persons. A list of identifiers (ID) of each assigned person to be authenticated is stored as an identifier (ID) table,
The person to be authenticated includes the identifier (ID) assigned to the user in advance and date (or time), data (value) obtained by quantifying both date and time, or both date and time, and If necessary, in addition to the data (value) added with a numerical value indicating the number of times of authentication itself, the data (value) that is different for each authenticated person created by appropriately combining the data (value), or the data Create a value of the function obtained by inputting (value) into a one-to-one correspondence function shared by all authenticated persons and authenticators as its own one-time password,
The certifier shall quantify the identifier (ID) table and the date or time, or both the date and time, or both the date and time, and further, if necessary. In addition to that, the data (value) added with a numerical value indicating the number of times of authentication of each authenticated person is used in an appropriate combination, and the same method as each authenticated person creates a one-time password, Create a one-time password corresponding to each person to be authenticated, and similarly create a list of one-time passwords corresponding to each person to be authenticated as a one-time password table.
In actual password authentication, first, the person who is requesting authentication notifies the certifier of his / her own one-time password created by himself / herself, and the certifier receives a one-time password notification from the person to be authenticated. The received one-time password is checked against the one-time password table to identify the person to be authenticated, and the person who has the one-time password is assigned the identifier (ID). It is characterized by authenticating that it is a person to be authenticated,
A password authentication method in which only the one-time password is exchanged without directly exchanging the identifier (ID) of the person to be authenticated. The password authentication method according to claim 5, comprising a person to be authenticated and a certifier,
The person to be authenticated creates two data (values) that are different values for all of the persons to be authenticated by the timing and method according to claim 5, and generates these two data (values). In addition, the values of the two functions obtained by inputting into the one-to-one correspondence function shared by all authenticated persons and certifiers are created as two one-time passwords for identification and confirmation,
The certifier uses the same timing and method as claimed in claim 5 in the same way that each authenticated person created two one-time passwords for identification and confirmation. Create two one-time passwords for identification and confirmation corresponding to each one, and one list of two one-time passwords for identification and confirmation corresponding to each of all authenticated persons. Create as a time password table,
In actual password authentication, first, the authenticator is requested to authenticate by using the identification one-time password in the manner described in claim 5, and in the present claim, further continued, From the one-time password table created by the certifier himself / herself, the one-time password for confirmation corresponding to the identified person to be authenticated is selected and notified to the person to be authenticated, and then the authentication is performed. When the requested authenticator is notified of the one-time password for confirmation by the certifier, the one-time password for confirmation and the one-time password for confirmation created by the user are compared. If the two match, the certifier verifies that the certifier is correctly authenticated, and the certifier who first communicated the one-time password for identification is identified. Characterized by authenticated as the person to be authenticated assigned the identifier (ID),
The authenticator identifies the person to be authenticated by exchanging only the one-time password without directly exchanging the identifier (ID) of the person to be authenticated, and then the person to be authenticated confirms that the authenticator has correctly authenticated himself / herself. The password authentication method according to claim 5, wherein authentication is established by doing. A password authentication method according to claim 6, comprising a person to be authenticated and a certifier,
The person to be authenticated creates three one-time passwords for identification, confirmation, and reconfirmation with the timing and method described in claim 6,
The certifier uses the same timing and method as claimed in claim 6 in the same manner that each one of the authenticated persons has created three one-time passwords for identification, confirmation and reconfirmation. Create three one-time passwords for identification, confirmation, and reconfirmation corresponding to each person to be authenticated, and for identification, confirmation, and reconfirmation corresponding to all persons to be authenticated in the same manner Create a one-time password table that lists all three one-time passwords
In actual password authentication, first, the certifier identifies the person to be authenticated for authentication using the identification one-time password in the manner described in claim 6, and then the confirmation one-time. -The authenticated person confirms the correct authentication of the certifier using the password, and further in this claim, the certifying person who requested the authentication uses the one-time password for reconfirmation as the certifier. When the certifier is informed of the one-time password for reconfirmation from the person to be authenticated, the one-time password for reconfirmation and the corresponding one-time password table registered in its own one-time password table. Compared with the one-time password for re-confirmation corresponding to the person to be authenticated, re-confirm that they match, and the person to be authenticated first communicated the one-time password for identification. The authenticator is authenticated by the exchange of only the one-time password without directly exchanging the identifier (ID) of the authenticated person. 7. The password authentication method according to claim 6, wherein authentication is established by further identifying the authenticator, confirming correct correct authentication of the authenticator, and re-confirming the authenticator by the authenticator. A password authentication method according to claim 6, comprising a person to be authenticated and a certifier,
First, using the one-time password for identification as described in claim 6, the certifier identifies the person to be authenticated that the certifier requests to authenticate. In addition to the legitimate confirmation one-time password corresponding to the subject to be authenticated according to claim 6, the number of newly created decoys for decoy previously determined by both 7. The method according to claim 6, wherein a plurality of data (values) including the one-time password of the user is communicated, and then the subject person himself / herself communicates the plurality of data (values) received from the certifier. The one-time password for regular confirmation is selected from the plurality of received data (values) by collating with the one-time password for confirmation created in step 1, and then the one-time password for regular confirmation selected. Time password or correct The certifier is informed of the fact that the one-time password for confirmation has been screened, and the certifier then confirms whether the one-time password for regular confirmation is received from the person to be authenticated or the one for regular confirmation. When notified that the time password has been screened, the certifier reconfirms that the person to be authenticated has correctly selected the one-time password for legitimate confirmation, so that the identification The authenticating person who has transmitted the time password is authenticated as the authenticated person assigned the identifier (ID).
The authenticator identifies the person to be authenticated by exchanging only the one-time password without directly exchanging the identifier (ID) of the person to be authenticated, and the person to be authenticated confirms the correct and accurate authentication of the authenticator. The password authentication method according to claim 6, wherein authentication is completed by reconfirming the person to be authenticated.

Images