JP2019068392A - Certificate issuance and authentication system - Google Patents

Abstract

To provide a system that performs user authentication easily and safely.SOLUTION: In response to a certificate issuance request from a PC 106, a certificate issuance system 101 extracts a part after a start point in a cyclic number sequence and issues a certificate. The certificate is securely shared by the certificate issuance system 101, an authentication device 105, and the PC 106. A user of the PC 106 can receive the authentication from the authentication device 105 by using the certificate.EFFECT: When a random number is exchanged only once at the time of setting the authentication environment, a different certificate can be safely exchanged each time between the user and a certificate authority for a long period of decades, and the logic is very easy, and therefore, the authentication can be performed safely even in an environment such as IoT where memory and CPU resources are not abundant.SELECTED DRAWING: Figure 1

Description

  The present invention is about an important authentication system that is the entrance to a computer system. It is an authentication system that verifies the presence or absence of access to important confidential data and systems that are important to the customer before the customer accesses the important confidential data and system from the application and allows access if there is an access right.

  There are a large number of authentication methods, from those based on user ID passwords to those using biometrics, and among these, the selection of an authentication method will be determined by the importance of data and the cost of the authentication system. However, cost-oriented adoption of the simple and fragile authentication system so far can be as easy as a hacker to break through, become a springboard and become a hotbed of crime, so it's simple logic but powerful An authentication system is required.

    Although there is a prior art as shown in Patent Document 1, in this technology, a method is used in which the present authentication number is calculated using a function from the previous authentication number and the n-th previous authentication number. In such a method, there is a problem that the previous authentication number is eavesdropped, and if the function being used is known, anyone can be authenticated. However, according to the method of the present invention, even if the eavesdropping is performed many times, the authentication is not performed unless the content of the circulation number sequence is known, so that a safe and secure environment which is not broken by hackers can be constructed.

    Although there is a prior art as shown in Patent Document 2, this technology can issue a large amount of passwords as in the present application, but the purpose is to group terminals using issued passwords, and every time I can not issue a different password and use it for measures such as eavesdropping.

JP, 2001-177519, A JP 2007-134990 A

The present invention relates to an inexpensive and simple authentication method for determining whether an access attempt is a legitimate user or a malicious attacker. With the spread of the Internet, unlawful access acts increase year by year, and many of the methods steal identity codes such as IDs. In addition, since the number of fraudulently obtained ID frauds through phishing sites is increasing, cheap, easy and strong authentication technology is required.

According to the present invention, if there is a terminal such as a PC, a smartphone, or a tablet computer easily from anywhere, the server and the terminal actually perform triple checks, but the user is only aware of one authentication It is the provision of technology whose main feature is that it can be authenticated safely without having to do it.

Since the authentication system of the present invention can use a triple strong and secure authentication system with only one authentication being aware, without requiring the user to prepare a special device such as biometrics, phishing is possible. It has the advantage of being able to take over accounts on sites etc. and not be victimized by fraudulent attacks such as stealing personal information.

An overall configuration diagram showing an example of the present invention Flowchart for Authentication of the Invention Cyclic sequence processing Initial authentication process Authentication process Safety degree proof diagram of circulation number sequence Random number sampling types by cyclic sequence Digit increase of cyclic number sequence When the number sequence and the number of divisions are natural numbers When the cyclic number sequence is a natural number and the division number is a prime number

FIG. 1 is an overall schematic view of a network system which is an example of an embodiment of the present invention.
The present invention is an authentication system that guards important confidential information and the like that should not be leaked to the outside by constructing an authentication system with a safe yet simple logic. In recent password authentication, it has become difficult to protect company confidential information against sophisticated hacker attacks such as “spoofing” and “illegal use”. Therefore, there is a growing need to strengthen information security measures, but biometric authentication requires expensive equipment and has the problem that it takes time for authentication because the logic is complicated and heavy. To this problem, the present invention has the advantage of performing triple authentication with simple logic and obtaining authentication of a certificate authority. As shown in FIG. 1, this authentication system authenticates the user from the 106 PC to the 101 certificate issuing system and issues a cyclic number sequence, and this cyclic number sequence is generated at three points of the 101 certificate issuing system, 105 authentication device, and 106 PC. Share and secure authentication.

Since the system of the present invention is constructed by each software and device uniquely named by the inventor and the applicant, the description of the name is described below.

101 certificate issuing system A system for issuing a certificate for obtaining authentication to a server or the like, creating an environment for issuing a certificate, or creating a one-time password.
-102 cycle number sequence A basic number sequence for creating a certificate or one-time password.
In the present application, the length and the number of the number sequence are expressed as "digit", but the expression "term" is considered to be the same.
・ 103 LAN
Common local area network.
104 Internet Computer network using Internet protocol.
105 authentication apparatus A system that performs 106 PC certification when logging in to a server or a device on a network.
・ 106 PC
Electronic devices such as PCs, smartphones, tablet computers, and IoT.

  FIG. 2 is a diagram describing initial user authentication of the present invention. The purpose of the initial user authentication is to prepare a correct user to be easily authenticated by the 105 authentication apparatus from the next time and receive a service such as a web server.

The 106 PCs provided to the user by the 201 administrator in FIG. 2 or the 106 PCs whose identity was certified by the 201 administrator, or the 201 administrator himself directly uses the 106 PC and 202 certificate issuance request to the 101 certificate issuing system The 101 certificate issuing system that received the 202 certificate issuance request creates information related to the authentication of the circulation number sequence etc. in the 204 circulation number sequence processing, and sends 205 circulation number sequence transmission to the 105 authentication device and 106 PC for circulation. Send information related to authentication, such as a sequence of numbers. Next, create points for creating certificates by creating 207 certificate points, and send certificate points to the 105 authentication device and 106 PC by transmitting 208 certificate points, and the 105 authentication devices and 106 PC have 209 certificates. Receive certificate points by receiving written points. The 105 authentication device and 106 PC use the received certificate points to create a certificate in 210 authentication creation processing, and the 106 PC sends the created certificate to the 105 authentication device, and the 105 authentication device receives 211 certificates. Receive a 106 PC certificate. The 105 authentication device confirms whether the received certificate and the certificate created by the 105 authentication device mutually agree that the certificate content is the same, and if it is the same, it is correct by recognizing the 106 PC as 213 new users as the 212 correct certificate. Recognize the user and register the 106 PC as a new user in the storage device of the 105 authentication apparatus.

FIG. 3 is a diagram describing cyclic sequence processing of the present invention. The purpose of cyclic sequence processing is to create a cyclic sequence and to create various information for creating a certificate by the cyclic sequence.

In the 301 cycle number sequence creation of FIG. 3, the cycle number sequence is created, but the logic for creation is described separately. Next, 302 random numbers are generated by using all available symbols from hexadecimal 00 to hexadecimal FF to generate random numbers for the number of digits of the cyclic number sequence, and the cyclic number sequence is encrypted with 303 cyclic number sequence encryption, 304 Encrypted random numbers are stored by cyclic sequence storage.

FIG. 4 is a diagram describing 210 initial authentication processing of the present invention. 101 A certificate is to extract a part of a cyclic sequence according to an instruction from a certificate issuing system.

At the 401 certificate point, using the indicated start point, divide the divided numbers by dividing the random number for the division numerical value from the start point of the cyclic sequence, hash the random number extracted by the 402 hashing with SHA1 etc., 403 cipher The time stamp, etc. is encrypted by unique encryption in the case of 化, and the two values are combined in the 404 combination.

FIG. 5 is a diagram describing user authentication of the present invention. The purpose of user authentication is to ensure that the correct user is easily and securely authenticated and can receive services such as a web server.

If the 106PC raises an action for the 101 certificate issuing system, the 501ID and PASSWORD request present the input screen of the ID and PASSWORD to the 106PC in the PASSWORD request, and the 106PC fetches the ID and PASSWORD in the 502ID · PASSWORD input, 101 It sends it to the certificate issuing system, confirms that the ID and PASSWORD are correct at 503 correct, and if correct, requests the transmission of the previously used certificate to the 106 PC at the 504 previous certificate request and makes the 505 last certificate 101 Send to the certificate issuing system, the 101 certificate issuing system received the previous certificate 505 by the previous 506 certificate reception, and when the 507 certificate was correct by the judgment of the 507 correct certificate, the 508 login notification 105 authentication device and 106 PC A notification of the login Te. When the 105 authentication device confirms that the approval request comes from the 106 PC with a new certificate, it creates a communicable situation such as opening the port for the 106 PC by the 509 login preparation, and the start point used last time at the 510 start point Create a new start point by adding the division value from to execute 210 authentication creation processing. On the other hand, the 106 PC that received the 508 login notification creates a new start point by adding a division value from the point of issuing the certificate used previously at the 511 start point, and executes 210 authentication creation processing, and stores 512 certificates. The created certificate is stored, and the certificate is transmitted to the 105 authentication apparatus by the 513 certificate transmission, and the 105 authentication apparatus receives the certificate by the reception of the 514 certificate. The 105 authentication unit puts together the certificates separately created by the 105 authentication unit and the 106 PC with the 515 correct certificate and confirms whether it is the same, and further, composites the time stamp contained in the certificate, and within n minutes If there is no problem, verify that the certificate was created, and log in as successful and start the service.

The purpose of creating a cyclic sequence is to change the random number generated once, without changing the length of the random number, and without reissuing the random number, depending on the number of digits of the cyclic sequence, tens of thousands, hundreds of thousands, hundreds of millions of times It also becomes possible to make different random numbers.

The definitions of the cyclic sequence and the number of divisions are described in the description of the names, but will be described again.
What is a cyclic number sequence:
-A set of random numbers created for prime digits.
Use a prime number larger than the number of divisions.
A set of random numbers generated using hexadecimal 00 to hexadecimal FF.
・ Conceptually, it is not a single column of numbers but a series of numbers consisting of rings.
(In practice, it repeats at a fixed length)
-For security, it is desirable to create for each user and each use device.
The division number is:
・ The prime number of 10 or more is said.
Although a single digit may be used, it is desirable to use a prime number of two or more digits for security.
· A prime number used when dividing a cyclic number sequence.
· A prime number smaller than the number of digits (a constant length of repetition) of a cyclic number sequence.
By changing the division number to a prime number other than the prime number currently used, it is possible to change the certificate without changing the certificate creation logic.
Relationship between cyclic sequence and number of divisions:
-Even if the number of divisions is used and random numbers for the number of divisions are extracted from the cyclic number sequence, the same numerical sequence can not be cut unless it is circulated several times the number of digits of the cyclic number sequence.
-A relationship in which the division number is changed to the next prime number and the new random number is extracted from the circulation number sequence, when the number of digits of the circulation number sequence has been circulated.

FIG. 6 is an explanatory diagram when the number of digits of the cyclic number sequence is 7 and 7 digits are used for the purpose of explanation, and the number of divisions is 2 prime, 3 prime and 5 prime.
If it is assumed that the 601 circulation number sequence has 7 digits and the division number is 2, it is an explanatory diagram using prime numbers 7 and 2. Although the numbers in the 1's to 7's are described in the 602 cycle number sequence, in practice, larger random numbers are used, but the numbers from 1 to 7 are used for the sake of clarity.
In the first division 603, the division number is taken out from the circulation number sequence. The random numbers taken out are 1 and 2.
In the second division 604, the division number is taken out from the circulating number sequence. The random numbers taken out are 3 and 4.
At the third division 605, the division number is taken out from the circulating number sequence. The random numbers taken out are 5, 6.
At the fourth division of 606, the division number is taken out from the circulating number sequence. The random numbers taken out are 7 and 1.
607 divided 5 times and taken out from the circulating number sequence by the division number. The random numbers taken out are 2 and 3.
At the sixth 608 division, the division number is taken out from the circulating number sequence. The random numbers taken out are 4 and 5.
In the seventh 609 division, the division number is taken out from the circulating number sequence. The random numbers taken out are 6 and 7.
At division 610 eighth time, it is taken out from the circulating number sequence by the division number. The extracted random numbers become 1 and 2 and return to the original.
Next, the division number is set to a prime number 3 without changing the circulating number sequence.
613 The first division cycle is taken out from the circulating number sequence by the division number. The random numbers taken out are 1, 2 and 3.
In 614 division second time, it is taken out from the circulating number sequence by the division number. The random numbers taken out are 4, 5, and 6.
At 615 division third time, it is taken out from the circulating number sequence by the division number. The random numbers taken out are 7, 1 and 2.
616 divided 4 times and taken out from the circulating number sequence by the division number. The random numbers taken out are 3, 4 and 5.
617 divided 5 times and taken out from the circulating number sequence by the division number. The random numbers taken out are 6, 7, and 1.
At 618th division in 618, the division number is taken out from the circulating number sequence. The random numbers taken out are 2, 3, and 4.
619 divided 7th time and taken out from the circulating number sequence by the division number. The random numbers taken out are 5, 6, and 7.
At the 620th division 8th time, it is taken out from the circulating number sequence by the division number. The extracted random numbers become 1, 2, 3 and so on, and return to the original.
Next, the division number is made prime number 5 without changing the circulating number sequence.
At 623 division first time, it is taken out from the circulation number sequence by the division number.
The random numbers taken out are 1, 2, 3, 4, and 5.
At 624 second time, it is taken out from the circulating number sequence by the division number.
The random numbers taken out are 6, 7, 1, 2 and 3.
625 divided 3rd time and taken out from the circulating number sequence by the divided number.
The random numbers taken out are 4, 5, 6, 7, 1.
626 divided 4 times and taken out from the circulating number sequence by the divided number.
The random numbers taken out are 2, 3, 4, 5, and 6.
627 divided 5 times and taken out from the circulating number sequence by the division number.
The random numbers taken out are 7, 1, 2, 3, and 4.
628 divided and taken out from the circulating number sequence by the division number 6th.
The random numbers taken out are 5, 6, 7, 1, and 2.
It is extracted from the circulation number sequence by the division number at the 7th time of the 629 division.
The random numbers taken out are 3, 4, 5, 6, and 7.
At the 630rd division 8th time, it is taken out from the circulating number sequence by the division number.
The extracted random numbers become 1, 2, 3, 4, and 5 and return to the original.
In any case where the circulating number sequence has 7 digits and the number of divisions is 2, 3 and 5, the eighth return is made to the original.
It has been proved that by changing the number of divisions, it is possible to extract different random numbers from the set of random numbers called cyclic number sequences by the length of the number of divisions by the number of digits of the cyclic number sequence x random number.
In other words, if you use a cyclic number sequence of prime numbers and a prime number smaller than the prime number used in the cyclic number sequence as the division number, you can take out random numbers by the number of digits of the cyclic number sequence and exchange random number sequences only once. If you do, you can retrieve random numbers infinitely.
In this case, 7-digit random numbers are used for the cyclic number sequence, but it becomes possible to take out 21 different random numbers with only 7 digits.

As shown in FIG. 7, assuming that the 702 circulation number sequence has 503 digits, even if the prime number from 11 is used for safety because the division number 703, there are 91 kinds of prime numbers up to prime number 503, and it is natural that they are prime numbers. The quotient is not divisible. The formula for calculating the type to extract random numbers is as follows.
503 × 91 = 45,773 (kinds of random numbers that can be extracted)
That 45,773 kinds of random numbers can be taken out is 45,773 divided by 5 times 365 days = 25.08 even if logged in 5 times a day, and 25 years of random numbers can be taken out. If this is a natural number and it is divided by using a cyclic number sequence and a division number, random numbers are extracted from the same place in the cyclic sequence, so it is impossible to take random numbers from different places for 25 years. For this reason, the combination of prime numbers and prime numbers becomes important, and it is possible to mutually authenticate each other by using different random numbers every 25 years in one exchange of cyclic sequence. After one cycle number exchange, there is no mutual exchange of information, and certificates can be issued which can authenticate each other.
There are a total of 168 primes less than 1000. 1009 × (168−4) = 165, 476 (types of random numbers that can be taken out) if a cyclic number sequence is created with a prime number 1009
165, 476 ÷ 5 times ÷ 365 days = 90.67
Therefore, even if authentication is performed 5 times a day, different certificates can be created easily and safely every time for 90 years. That is, it is also possible to increase the number of years of use exponentially according to the length of the cyclic number sequence. The "-4" in the above equation is because primes 2, 3, 5, 7 have been removed.

By issuing a safe and secure certificate called a cyclic number sequence once, it is possible to create an infinitely new certificate from the certificate safely.
If all the cyclic sequences have been used, it is sufficient to change the base cyclic sequence to new prime digits and add a random number for the shortfall. For example, when the cyclic number sequence is 503 digits, when changing the cyclic number sequence to the next large prime number 509, a 6-digit random number is added to the basic cyclic number sequence and the number of divisions becomes 503, so 509 new It is possible to make a certificate.
Further, if the next prime number 521 is used, the division numbers 503 and 509 become usable, and it becomes possible to extract 1030 random numbers altogether.
Since Euclidean's theorem proves that the number of prime numbers is infinite, the certificate can be issued infinitely. Furthermore, prime numbers can be easily obtained by using the Rabin-Miller prime number determination method or the like.

FIG. 8 is an explanatory diagram when the digit number increase of the circulation number sequence is increased from 5 digits of the circulation number sequence and 2 and 3 of the division number to 7 digits of the circulation number sequence and the division number is changed to 5 new. In this example, new random numbers a and b are continuously inserted at the beginning, but a and b are inserted separately at different places, and the inserted position information is between the 101 certificate issuing system, 105 authentication devices, 106 PCs You can synchronize at.
The advantage of this random number addition is that it is not necessary to exchange the original certificate on the net, and it is sufficient to synchronize only the random number to be newly inserted and the position information to insert the random number using the net and say that the leakage of the certificate. It is possible to avoid the problem.

When the random number is increased to 7 digits of the 827 cyclic number sequence and increased to 7 digits of the 830 cyclic number sequence and is included as in the case of 5 division number, the certificate for the number of places x divided number is included. It is possible to increase. In this case, the number of increased certificates in 0023 is further increased by random number × prime number.
However, it is desirable not to use this pattern in application technology, as it complicates management.

FIG. 9 shows an example where natural numbers are used without using prime numbers when the circulating number sequence and the division number are natural numbers.
In the case where the 901 circulation number sequence has eight digits and the division number is four, only two types of random numbers can be extracted although there are eight digits in the circulation number sequence.
In the case of 906 cyclic sequence with 8 digits and division number 4 and shifted by 1 digit, the cyclic sequence has 8 digits, so 1 random digit is shifted to extract random numbers at the maximum, but in this case 8 kinds of random numbers can be taken out If you compare the 908 division first and the 909 division second but you can see only 1 byte, from the viewpoint of the eavesdropper, if you add 1 byte or 256 types of Hex to the 908 division first, the 909 division second random number It is necessary to do complicated management because it is not safe because it can be easily deciphered.

As shown in FIG. 10, when the cyclic number sequence is a natural number and the division number is a number that can not divide the natural number, the cyclic number sequence division number both have the same result as the prime number, but the difference from the prime numbers Is in complex management. It has already been proved that prime numbers can not be divided by any means. Furthermore, although it is possible to easily know the kind and value of small prime numbers contained in large prime numbers by a large number of methods such as Euclidean theorem and Rabin-Miller prime number determination method, one natural number 1 It is necessary to investigate and manage by yourself and it becomes complicated.

It has a robust security function that logic can be implemented inexpensively because it is simple, and it has a disposable security password against the fact that logic is simple, so it does not know what to use next if brute force attacks or passwords leak. It will be used as an authentication system that can be used safely for IoT, etc., which is expected to become increasingly popular in the future.

Claims (3)

Composed of two prime numbers,
One prime number is used for the number of digits in the cyclic number sequence,
Another prime number is used for the division number,
The prime number used for the number of digits in the cyclic number sequence is
Greater than the prime used for the division number,
The cyclic sequence is a collection of random numbers created using hex 0 to hex F,
A cyclic number sequence is a sequence of random numbers consisting of one row of rings,
The division number is used to divide a cyclic number sequence,
Extract a random number for the prime digit of the division number from the cyclic number sequence and use it as a certificate,
The next time you extract a random number from the cyclic sequence,
Shift the location to extract the number of divisions,
Extract random numbers with different contents for the number obtained by multiplying the prime number used for the cyclic number sequence and the type of division number,
A certificate issuing system that can create different certificates each time. When all different random numbers are taken out from the cyclic number sequence issued by the cyclic number sequence issue consisting of a random number of the number of digits represented by the base prime number,
When reconstructing a cyclic sequence using new large prime numbers,
By synchronizing the random number for the number of missing digits with the insertion place of the random number and the random number for actually inserting between terminals such as the authentication device and PC,
Is a prime number smaller than the new large prime number,
At the same time, the number of types of prime numbers greater than the number of divisions used last and the new prime numbers,
A certificate issuing system that makes it possible to create new certificates. After extracting all kinds of random numbers from the cyclic sequence,
It is not necessary to disclose the basic circulation number sequence using communication means such as a network,
There is no need to create a new cyclic sequence and synchronize with each other in a network etc.
By synchronizing only the missing random number and the insertion point information of the random number,
A certificate issuing system that can create a new circulation number sequence.

Images