JP3433413B2 - User authentication device and method - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user authentication device and method for authenticating the authority of a user.

[0002]

2. Description of the Related Art User authentication is an essential procedure for controlling access to digital information (including proprietary information such as programs). Normally, user authentication is performed between the center, which centrally manages secret information unique to users such as passwords, and the user who wishes to access, through the network each time, and between the two parties sharing the two. This is done by confirming the existence of unique confidential information. However, this method has a problem that communication between the center and the user occurs frequently, and it also has problems such as inability to authenticate in a usage environment that is rarely assumed to be a network such as a laptop computer. Was.

On the other hand, the present applicant has filed a related patent application for the invention of "user authentication device and method" (Japanese Patent Application No. 8-62076: unpublished). In the invention of this related application, when a specific user tries to access specific digital information, he / she communicates with the center only once in advance, and depends on the information unique to the digital information and the information unique to the user. I will ask you to issue supplementary information. At the time of access, the verification device generates test information (challenge) from the information unique to the digital information, and hands it over to the certification device managed by the user. The certification device generates response information (response) from the challenge, the certification assistance information, and the user unique information by a predetermined method and sends the response information to the verification device. The verification device performs certain calculations on the response. At this time, if the certification assistance information used by the certification device to calculate the response is generated by the center based on the unique information of the correct digital information and the unique information of the user, the certification assistance information is fixed regardless of who the user is. The value (reference value) is calculated, and in other cases, the reference value is not calculated. Therefore, the verification device can know whether the user has a valid access right by checking whether the value obtained by the calculation is a correct value.

As is clear from the above description, according to the invention of this related application, the verification device does not need to know the individual user or the unique information of the individual, and who the user to be authenticated is. Even if there is, you should always carry out a certain procedure.

In implementing the present invention, the certification device is, for example, a program on a personal computer owned by the user, and the unique information of the user is stored in a portable computing device such as an IC card or a PC card in order to prevent unauthorized access by other users. It can be enclosed. The verification device can be a program on another computer connected to the user's personal computer through a network, but if it is configured as a program directly embedded in the digital information that is the access control target, authentication can be performed. This is even more effective because it can be performed in the user's personal computer.

The invention "user authentication device and method" of the related application will be described in detail below with reference to a specific example. In this example, the digital information is an application program, and the verification device is configured as a program embedded in the application program. Hereinafter, the verification device will be referred to as a verification program.

The main part of the application program uses, for example, DES (DataEn) by using the encryption key K.
encryption standard). Further, the encryption key K is an RSA (Rivest-Shamir-Adlem) registered in the center in advance.
an) using the public key (E, n)

[0008]

## EQU1 ## It is encrypted as K ^* = K ^E mod n, and K is stored in the verification program together with (E, n).

On the other hand, the user having the unique information dU requests the center to receive the certification auxiliary information t. The certification auxiliary information t is generated by the center as follows.

[0010]

## EQU00002 ## t = DF (d _U , n) where F is a function having d _U and n as arguments, and D
Is

[0011]

## EQU3 ## ED≡1 mod (p-1) (q-1) is satisfied. Here, p and q are two prime factors that satisfy n = pq.

Authentication is performed according to the following procedure. First, when the user starts the application program, the embedded verification program operates to generate a random number r. Then, the verification program

[0013]

Equation 4] by calculating ^{C = r E K * mod n} , delivered to a user of the certification apparatus with n.
In this example, the user certifying device is configured as a program on the user's personal computer, and will be referred to as a certifying program hereinafter. The unique information of the user is an IC having a calculation function.
Card or PC card, hereinafter referred to as token.

When the proof program passes (C, n) to the token, the token

[0015]

## ^EQU00005 ## R '= ^{CF (dU, n)} mod n is calculated and returned to the proof program. The proof program is

[0016]

[Equation 6] R ″ = C ^t mod n is calculated separately, and from R ′ received from the token,

[0017]

## EQU7 ## R = R'R '' mod n Is calculated and returned to the verification program.

In the verification program,

[0019]

The decryption key K is obtained from K ′ = r ⁻¹ R mod n. Here, K = only when the user uses the correct proof auxiliary information to perform the calculation.
K'is established.

Finally, the verification program decrypts the encrypted part of the application program with K'as a decryption key, and jumps to the execution start of the decrypted application program.

[0021]

In the concrete example of the invention of the above-mentioned related application, the legitimacy of the access right of the user is provided only when the inspection value calculated by the verification device for inspection coincides with the reference value. You can authenticate your sex. For example, if the verification device is configured as a program and operates on the user's personal computer, if an unauthorized user can retrieve this reference value by analyzing the verification program, correct authentication cannot be performed thereafter. Therefore, as already exemplified, the verification program does not hold the reference value itself and directly compare the inspection value with the reference value,
If a check value that does not match the reference value is obtained, make sure that subsequent processing is not performed correctly. In the above example, it is not necessary to hold the encryption key K itself in the verification program by devising such that the encrypted application program is correctly decrypted only when the correct check value is calculated. It has a simple structure.

However, in the above configuration, if an incorrect inspection value is obtained, there arises a problem that it is impossible to predict how the subsequent processing will be performed. For example, if K ′ ≠ K in the above example, the application program is not correctly decoded, and therefore, if the program jumps out of the verification routine, the program will run out of control, destroying other programs and files on the personal computer. Furthermore, in the worst case, the personal computer itself may be destroyed.

Even if the verification device cannot correctly calculate the inspection value, it does not always mean the result of the user attempting an illegal act, and may be caused by a communication error or the like. Therefore, even if the correct inspection value cannot be obtained, it is necessary to protect the environment of the user.

According to the present invention, in order to solve the above problems, the inspection value is different from the reference value without having a reference value in the verification device and without causing a disadvantage such as program runaway. The purpose is to enable detection.

[0025]

According to the present invention, in order to achieve the above object, a verification device for holding digital information and a proof device used by a user who attempts to access the digital information are provided. In the authentication device,
The verification device has digital information holding means, test information generation means, check value calculation means, check value redundancy checking means, error processing means and digital information processing means, and the proving device has user unique information holding means and response. and information generating means
Having the digital information holding means in the inspection device
Is the encrypted data that can be decrypted with a predetermined decryption key.
The digital information is held, the test information generating means in the verification device generates test information and sends it to the response information generating means in the proving device, and the response information generating means makes the test information and the user unique. Response information is generated from the user unique information held in the information holding means and sent to the inspection value calculation means in the verification device, the inspection value calculation means calculates an inspection value from the response information , and Exam information and above
If the user-specific information is correct, the above inspection value will be
No. key and certain redundant data (verification value is reference value
The inspection value calculation means delivers the inspection value to the inspection value redundancy inspection means, and the inspection value redundancy inspection means transfers the predetermined redundant data from the inspection value. If it can be detected, the digital information processing means is activated and the recovery information extracted from the inspection value for the digital information held in the digital information holding means is detected.
Processing including decryption using the No. key is performed, and the above predetermined redundancy
If such data cannot be detected, the error processing means is activated to perform error processing.

In this configuration, the reference value is generated so as to satisfy the conditions (redundancy) such as "a specific sequence appears at a specific position in the reference value" and "the reference value follows a specific format". The check value redundancy check means in the verification device checks whether or not the calculated check value satisfies the redundancy, and when the redundancy is not obtained, the error processing means is called to perform error processing. Therefore, it is possible to detect whether or not the inspection value is different from the reference value without having a reference value in the verification device and without causing a disadvantage such as program runaway.

Further, according to the present invention, in order to achieve the above object, a verification device for holding digital information,
In an authentication device comprising a certifying device used by a user who attempts to access the digital information, the verifying device comprises an encrypted digital information holding means, a test information generating means, a check value calculating means, a check value redundancy checking means and a decrypting means. and means and error processing means and digital processing means, said proof apparatus and a response information generation means user-specific information storage means, said test information generating means in the verification device generates test information And sends it to the response information generating means in the certifying device, and the response information generating means generates response information from the test information and the user unique information held in the user unique information holding means, and the verification device. The inspection value is transmitted to the inspection value calculation means in the inside, and the inspection value calculation means calculates an inspection value from the response information , and the test information and the user.
If the unique information is correct, the above check value is
Decrypt encrypted digital information stored in digital information storage means
It contains a decryption key and predetermined redundant data for
査値calculating means passing the test value to said check value redundancy check means, when the above-mentioned check value redundancy check means could be detected from the test values predetermined redundancy, the from the test value <br /> After calculating the decryption key and passing it to the decryption means, the decryption means decrypts the encrypted digital information held in the encrypted digital information holding means with the decryption key. The digital information processing means is called to process the decoded digital information, and when the predetermined redundancy cannot be detected, the error processing means is called to perform error processing.

Also in this configuration, it is possible to detect whether or not the inspection value is different from the reference value without having a reference value in the verification device and without causing a disadvantage such as program runaway. Also, the digital information itself is encrypted,
Protected against unauthorized access.

Further, according to the present invention, in order to achieve the above object, a verification device for holding digital information,
In the authentication device including a certifying device used by a user who attempts to access the digital information, the verifying device is an encrypted digital information holding means, a test information generating means, a check value calculating means, a decrypting means, and a decrypted value redundancy checking means. and a error handling means and digital processing means and, proof device chromatic and a response information generation means user-specific information storage means
Then , the test information generating means in the verification device generates test information and sends it to the response information generating means in the proving device, and the response information generating means is held in the test information and the user unique information holding means. The response information is generated from the user-specific information and sent to the check value calculation means in the verification device, and the check value calculation means calculates a decryption key as a check value from the response information and sends it to the decryption means. Upon delivery, the decryption means decrypts the encrypted digital information held in the encrypted digital information holding means with the decryption key using the decryption key, and the decrypted value redundancy check means decrypts the decrypted digital information. From information to a given redundant data
When obtained by detecting the data, the processing of digital information in which the digital processing means is being activated decoding is performed,
When the predetermined redundant data cannot be detected, the error processing means is activated and error processing is performed.

In this configuration, the check value is used as a decryption key for the encrypted digital information. Then, the digital information is provided with redundancy, the verification device decodes the digital information for the time being using the calculated check value as a key, and the decoded value redundancy checking means checks whether or not the decoding result satisfies the redundancy, and the redundancy is obtained. If the property is not obtained, the error processing means is called to perform error processing. Therefore, it is possible to detect whether or not the inspection value is different from the reference value without having a reference value in the verification device and without causing a disadvantage such as program runaway. The digital information itself is also encrypted and protected from unauthorized access.

Further, in the above configuration, the certifying device has certifying auxiliary information holding means, and the response information generating means together with the user unique information held in the user unique information holding means. The response information may be generated based on the certification auxiliary information held in the auxiliary information holding unit.

The verification device has verification basic information holding means, and the test information generation means has the key information K ^* , the random number r, and the RS held in the verification basic information holding means.
A = public key (E, n) and test information (C, n) C = r
^E K ^* mod n, the proof auxiliary information t is given by t = D−d _U + w (p−1) (q−1), and the response information generating means R = C ^t C ^dU mod.
The response information R may be generated by n, and the inspection value calculation means may calculate the inspection value L by L = r ⁻¹ R mod n.

Further, the verification device has verification basic information holding means, and the test information generating means has the key information K ^* , the random number r, and the RS held in the verification basic information holding means.
Test information (C, n) from A public key (E, n) C = r ^E
K ^* mod n, and the proof auxiliary information t is t = DF (using a predetermined function F (d _U , n) that takes at least the user-specific information d _U and n as arguments. d _U , n) and the response information generating means uses the function F (d _U , n) to obtain R = C ^t
The response information R is generated by C ^{F (dU, n)} mod n, and the inspection value calculation means converts the inspection value L into L = r ⁻¹ R
It may be calculated by mod n.

Further, the user unique information holding means and the response information generating means in the certifying device may be stored in a tamper resistant container resistant to physical intrusion of a probe or the like.

The response information generating means in the proving device comprises a first response information generating means and a second response information generating means, and the test information generating means stores the test information (C, n). Handing over to the first response information generating means,
The first response information generating means is R ″ = C ^t mod
In addition to calculating n, the test information (C, n) is passed to the second response information generating means, and the second response information generating means calculates R ′ = C ^dU mod n to calculate the first response. The response information R may be delivered to the information generating means, and the first response information generating means may calculate the response information R by R = R′R ″ mod n.

The response information generating means in the proving device comprises a first response information generating means and a second response information generating means, and the test information generating means stores the test information (C, n). Handing over to the first response information generating means,
The first response information generating means is R ″ = C ^t mod
In addition to calculating n, the test information (C, n) is passed to the second response information generating means, and the second response information generating means calculates R '= ^{CF (dU, n)} mod n. The first response information generating means may be delivered to the first response information generating means, and the first response information generating means may calculate the response information R 1 by R = R′R ″ mod n.

Further, the user unique information holding means and the second response information generating means in the certifying device may be stored in a tamper resistant container resistant to physical intrusion of a probe or the like.

Further, the proving apparatus has a usage control information holding means and a usage control information verification means, and the usage control information verification means verifies the usage control information held in the usage control information holding means, When the usage control information is authentic, the response information generation means may generate the response information and send it to the inspection value calculation means in the verification device.

In this configuration, the usage control information is verified, and when it is not authentic, the response information is not sent to the inspection value calculation means, so that the redundancy cannot be detected. Therefore, error processing is performed and the program does not run out of control. When the usage control information is authentic, it is possible to detect whether or not the inspection value differs from the reference value without having a reference value in the verification device and without causing a disadvantage such as program runaway. In addition, by verifying the usage control information, fine-grained user authentication can be performed.

Further, the verification device has verification basic information holding means, and the test information generating means has the key information K ^* , the random number r, and the RS held in the verification basic information holding means.
Test information (C, n) from A public key (E, n) C = r ^E
K ^* mod n, and the proof auxiliary information t is a predetermined function F (d _U , n, I) that takes at least the user-specific information d _U , the n, and the use control information I as arguments. Using t = DF (d _U , n, I)
The utilization control information verifying means verifies the utilization control information I, and when the utilization control information I is authentic, the response information generating means determines the function F (d _U , n,
I) is used to generate the response information R by R = C ^{t CF (dU, n, I)} modn, and the inspection value calculation means calculates the inspection value L by L = r ⁻¹ R mod n. You may do it.

Further, the user unique information holding means, the response information generating means and the use control information verifying means in the certifying device are stored in a tamper resistant container resistant to physical intrusion of a probe or the like. Good.

Further, the response information generating means in the proving device comprises a first response information generating means and a second response information generating means, and the test information generating means stores the test information (C, n). Handing over to the first response information generating means,
The usage control information verification means verifies the usage control information I held in the usage control information holding means, and when the usage control information I is authentic, the first response information generation means R ″ = The ^Ct mod n is calculated and the test information (C, n) is passed to the second response information generating means, and the use control information holding means transfers the use control information I to the second response information generating means. Upon delivery, the second response information generating means has R '= ^{CF (dU, n, I)} mod.
n is calculated and delivered to the first response information generating means,
The first response information generating means is R = R′R ″ mod.
The response information R may be calculated according to n.

Further, the user unique information holding means, the second response information generating means, and the usage control information verifying means in the certifying device are stored in a tamper resistant container resistant to physical intrusion of a probe or the like. You may do it.

Further, according to the present invention, in order to achieve the above-mentioned object, the data is encrypted so that it can be decrypted with a predetermined decryption key.
Information holding means for holding digital information
And a verification device equipped with
User authentication using the proof device used by the user
In the above-mentioned certification device, which was the user authentication method to certify
And the step of storing user-specific information Te, said proof instrumentation
A step of receiving test information from the verification device in the device, and a step of generating response information in the certification device according to the test information and the user unique information ;
The verification device sends the response information from the certification device.
A step of signal, and generating a test information from the response information in the verification apparatus, the test information
If the information and the user-specific information are correct, the inspection information
It also includes the above-mentioned decryption key and predetermined redundant data as information.
And generating from the steps of determining whether the predetermined redundant data included in the examination information in the verification apparatus, does not include the predetermined redundant data in the inspection information in the verification apparatus If it is determined that the error processing step and the verification device
It is to be executed and executing predetermined information processing in the case where the predetermined redundant data is determined to be included in the Oite the inspection information.

Also in this configuration, it is possible to detect whether or not the inspection value is different from the reference value without having the reference value in the verification device and without causing a disadvantage such as program runaway.

Further, according to the present invention, in order to achieve the above object, the user authentication device is decrypted with a predetermined decryption key.
A device that holds digital information encrypted in a possible manner.
Digital information holding means, means for storing user-specific information, means for receiving test information, means for generating response information according to the test information and the user-specific information, and means for generating inspection information from the response information. And the above test
If the test information and the above inspection user specific information are correct,
The above decryption key and predetermined redundant data are used as inspection information.
Means for generating those containing, in the predetermined in the inspection information
Means for determining whether contain redundant data, means for performing error processing when the predetermined redundant data is judged to be not included in the examination information, the predetermined redundancy in the inspection information Means for executing predetermined information processing when it is determined that such data is included.

Also in this configuration, it is possible to detect whether the inspection value is different from the reference value without having a reference value in the verification device and without causing a disadvantage such as program runaway.

[0048]

Embodiments of the present invention will be described below. FIG. 1 is a configuration diagram of a first embodiment of the present invention. In FIG. 1, the verification device 100 includes a verification basic information holding unit 101 and an encrypted digital information holding unit 102.
It has a test information generating means 103, a check value calculating means 104, a check value redundancy checking means 105, an error processing means 106 and a decoding means 107. Key information (K ^* ) 1010 and random number (r) 10 are stored in the verification basic information holding means 101.
11 and the RSA public key (E, n) 1012 are held, and the encrypted digital information holding means 100 holds the encrypted digital information.

The certification device 200 comprises a user unique information holding means 201, a certification auxiliary information holding means 202, a first response information generating means 203 and a second response information generating means 204. The user unique information holding means 201 and the second response information generating means 204 are combined together to form an IC card / P
It may be realized as a portable computing device such as a C card.

The data held in the encrypted digital information holding means 100 is, for example, DES (Data Encryption) by using plaintext digital information by using the encryption key K '.
It is digital information encrypted according to the "Action Standard". The key information K ^* held in the verification basic information holding means 101 is calculated from the key intermediate representation K obtained by adding redundancy to the encryption key K ′. The redundancy assumed in the key intermediate representation K has the following properties, for example. The first N bits of K have a predetermined constant bit pattern b ₁ b ₂ b ₃ ... b _N. K is a repetition of an arbitrary bit pattern with a constant length. The K having the above redundancy is generated as follows. The DES encryption key K'is generated using a random number generator. The generated encryption key K ′ is connected as a bit pattern after a predetermined bit pattern b ₁ b ₂ b ₃ ... b _N to form K. That is, the bit pattern of K'is set to k ₁
If you write k ₂ ... k ₆₄ ,

[0051]

[Expression 9] K = b ₁ b ₂ ... b _N-1 b _N k ₁ k ₂ ... k ₆₃ k ₆₄ The DES encryption key K'is generated using a random number generator. K is a bit pattern obtained by repeating the bit pattern k ₁ k ₂ ... K ₆₄ of K ′ a fixed number of times. That is, if the number of repetitions is k,

[0052]

[Equation 10] The key intermediate expression K is an RSA registered in advance in the center.
Using the public key (E, n)

[0053]

[Equation 11] K^*= K^E   mod n Key information K encrypted with^*Becomes Key information K^*Is RSA
Verification basic information holding means 101 together with open key (E, n)
Held in. Here, K and K ′ are in the verification device 100.
Is not retained in.

The unique information d _U is held in the user unique information holding means 201. At the same time, the auxiliary certification information holding unit 202 holds the auxiliary certification information t issued by the center. The certification auxiliary information t is generated by the center as follows.

[0055]

T = D−d _U + w (p−1) (q−1) where p and q are two prime factors that satisfy n = pq, w is a random number, and D is the public key of the RSA encryption ( E, n) is the private key corresponding to

[0056]

[Equation 13] ED≡1 mod (p-1) (q-1) Meet

Authentication is performed according to the following procedure. When accessing digital information, the verification device 1
00, first, the random number r is verified basic information holding means 101 for verification.
Take out from. At this time, the random number r may be calculated each time by a random number generator, or may be extracted from a random number sequence given in advance. Next, the test information C is calculated according to the following formula using E and n which are also taken out from the verification basic information holding unit 101.

[0058]

C = r ^E K ^* mod n The verification device 100 passes the calculated test information C together with n to the proving device.

The proving apparatus 200 delivers (C, n) to the first and second response information generating means 203 and 204. The second response information generating means 204 uses the user unique information d _U in the user unique information holding means 201,

[0060]

[ ^Mathematical formula-see original document] R '= C ^dU mod n is calculated and passed to the first response information generating means 203.
On the other hand, the first response information generating means 203 uses t in the certification auxiliary information holding means 202,

[0061]

[Mathematical formula-see original document] R ″ = C ^t mod n is calculated in advance, and further the second response information generating means 204
Using R'received from

[0062]

## EQU17 ## The response information R is calculated according to R = R'R''mod n. The proving apparatus 200 uses the calculated response information R as the inspection value calculation means 1 in the verification apparatus 100.
Return to 04.

In the inspection value calculation means 104,

[0064]

The check value L is calculated by L = r ⁻¹ R mod n, and the check value redundancy check means 10
Hand over to 5. The inspection value redundancy inspection means 105 inspects the redundancy of the inspection value L. The redundancy check is performed as follows, for example. The _first N bits l ₁ l ₂ l ₃ ... l _N of L are taken out,
It is compared with the bit patterns b ₁ b ₂ ... b _N held in the check value redundancy check means 105. As a result of the comparison, if the two are completely equivalent, the inspection result is passed, and if they are not equivalent, it is rejected. If the check is successful, the bit string obtained by removing the first N bits from L is set as the decryption key K. The leading 64 bits of L ₁ l ₂ l ₃ ... l ₆₄ are removed and compared with the shortened leading 64 bits of L. If they are not the same as the result of the comparison, it is rejected. This comparison work is repeated k-1 times, and the inspection result is determined to be acceptable if the inspection is never rejected. If the check is successful, the last obtained l ₁ l ₂ l ₃ ... l ₆₄ is the decryption key K
And

When the inspection result by the inspection value redundancy inspection means 105 is unacceptable, the error processing means 106 is activated. The error processing means 106 is the proof device 200.
To the verification device 10 that the response information is incorrect.
Necessary processing such as 0 initialization is performed.

On the other hand, if the check result is acceptable, the check value redundancy check means 105 decrypts the decryption key K.
Hand over to. The decryption means 107 decrypts the encrypted digital information in the encrypted digital information holding means 102 with the decryption key K and the DES algorithm.

When the decoded digital information is, for example, image information / moving image information, the display device is continuously activated and the displayed image / moving image is provided to the user.
When the decrypted digital information is, for example, an application program, after the processing by the decryption unit 107 is completed, the execution jumps to the execution start point of the decrypted application program and the application program is executed.

Next, a second embodiment of the present invention will be described. FIG. 2 is a block diagram of the second embodiment of the present invention. In FIG. 2, the verification device 100 includes a verification basic information holding unit 101 and an encrypted digital information holding unit 102.
It has a test information generating means 103, a check value calculating means 104, a decoded value redundancy checking means 108, an error processing means 106 and a decoding means 107. Key information (K ^* ) 1010 and random number (r) 10 are stored in the verification basic information holding means 101.
11 and the RSA public key (E, n) 1012 are held, and the encrypted digital information holding means 102 holds the encrypted digital information.

The proving apparatus 200 comprises user unique information holding means 201, proof auxiliary information holding means 202, first response information generating means 203 and second response information generating means 204. The user unique information holding unit 201 and the second response information calculation unit 204 are combined together to form an IC card / PC.
It may be realized as a portable computing device such as a card.

The data held in the encrypted digital information holding means 102 is obtained by further adding redundancy to the digital information I obtained by encrypting plaintext digital information using the encryption key K, for example, by DES. Is. The redundancy is generated as follows, for example. A predetermined bit pattern b ₁ b ₂ ... b _N is added to the beginning of the encrypted digital information I.
The bit string of the data after the redundancy is added is as follows.

[0071]

[Formula 19] It is a bit pattern obtained by adding a copy of the head N-bit bit pattern l ₁ l ₂ l ₃ ... l _N of the encrypted digital information to the head a fixed number of times. That is, when the number of repetitions is set to k, the result is as follows.

[0072]

[Equation 20] The encryption K uses the RSA public key (E, n) registered in the center in advance.

[0073]

[Equation 21] The key information K is obtained by encrypting K ^* = K ^E mod n. The key information K is held in the verification basic information holding means 101 together with the RSA public key (E, n). Here, the encryption key K is not held in the verification device 100.

The verification apparatus 100 and the proof apparatus 200 in the second embodiment operate in the same manner as in the first embodiment until the inspection value calculation means 104 calculates the inspection value.
Below, only the operation after the inspection value calculation means 104 has calculated the inspection value L will be described.

The check value calculation means 104 passes the check value L as a decryption key to the decryption means 107. The decryption means 107
The encrypted digital information held in the encrypted digital information holding means 102 is decrypted by the obtained L and DES algorithm. Then, the decoded value redundancy checking means 108 checks the preparation of the decoded digital information. The redundancy check is performed as follows, for example. First N bits of decoded digital information l ₁ l ₂ l
₃ ... 1 _N are removed and compared with the bit patterns b ₁ b ₂ ... b _N held in the decoded value redundancy check means 105. As a result of the comparison, if the two are completely equivalent, the inspection result is passed, and if they are not equivalent, it is rejected. First N bits of decoded digital information l ₁ l ₂ l
₃ ... l _N is removed and the leading N of the remaining digital information
Compare with a bit. If they are not the same as the result of the comparison, it is rejected. This comparison work is repeated k-1 times,
The inspection result is passed if the test is never rejected.

When the check result by the decoded value redundancy check means 108 is unacceptable, the error processing means 106 is activated. The error processing means 106 is the proof device 200.
Notify that the response information was not correct, and perform necessary processing such as initialization of the verification device. If the inspection result is acceptable, the digital information has been correctly decoded.
Processing continues.

In the first and second embodiments, the center may generate the certification auxiliary information t as follows.

[0078]

T = D−d _U + w (p−1) (q−1) where p and q are two prime factors that satisfy n = pq, w is an integer, and D is the public key of the RSA encryption ( E, n) is the private key corresponding to

[0079]

[Equation 23] ED≡1 mod (p-1) (q-1) is satisfied. In this case, the second response information generating means 204
Uses the user unique information d _U in the user unique information holding unit 201,

[0080]

[ ^Mathematical formula-see original document] R '= C ^dU mod n is calculated and passed to the first response information calculation means 203.
Even with this configuration, the user authentication device of the first embodiment and the user authentication device of the second embodiment operate in the same manner as described above. Further, in this configuration, since it is not necessary to calculate the function F by the second response information generating means 204, the processing can be simplified.

Next, a third embodiment of the present invention will be described. FIG. 3 is a block diagram of the third embodiment of the present invention. In FIG. 3, the verification device 100 includes a verification basic information holding unit 101 and an encrypted digital information holding unit 102.
It has a test information generating means 103, a check value calculating means 104, a check value redundancy checking means 105, an error processing means 106 and a decoding means 107. Key information (K ^* ) 1010 and random number (r) 10 are stored in the verification basic information holding means 101.
11 and the RSA public key (E, n) 1012 are held, and the encrypted digital information holding means 100 holds the encrypted digital information.

The proving apparatus 200 has a user unique information holding means 201, a proof auxiliary information holding means 202, a first response information generating means 203, a second response information generating means 204, a use control information holding means 205, and a use control. Information verification means 2
06 and. The usage control information holding means 205 holds usage control information 2050, and the usage control information verification means 206 holds a clock 2060 that returns the current date and time. The user unique information storage unit 201, the second response information generation unit 204, and the usage control information verification unit 206 may be combined and implemented as a portable computing device such as an IC card or a PC card.

In the third embodiment, the certification auxiliary information t held in the certification auxiliary information holding means 202 is generated by the center as follows.

[0084]

T = DF (d _U , n, I) where F is a function having d _U , n and usage control information I as arguments. In this embodiment, the usage control information I is assumed to be the date and time indicating the expiration date. Further, the usage control information holding unit 205 can receive the above-mentioned usage control information I from the center and store it in advance. When a value different from the above I is held in the usage control information holding means, this embodiment fails in user authentication as described below.

The verification apparatus 100 and the proof apparatus 200 in the third embodiment operate in the same manner as in the first embodiment until the test information C calculated by the verification apparatus 100 is delivered to the proof apparatus 200 together with n. . Below, only the operation after the test information C and n has been delivered to the proving device 200 will be described.

The proving apparatus 200 delivers (C, n) to the first and second response information generating means 203 and 204. The second response information generation means 204 is the usage control information verification means 20.
The process of 6 is started. Usage control information verification means 206
Verifies whether the usage control information (I) 2050 held in the usage control information holding means 205 is authentic.

In this embodiment, the usage control information verification means 20
The current date / time and time returned by the clock 2060 in 6 are compared with the use control information I, and when the current date / time is less than or equal to I, it is determined that the use control information I is authentic.

When the usage control information verification unit 206 determines that the usage control information I is not authentic, the second response information generation unit 204 notifies the first response information generation unit 203 that the calculation has failed. To do. The first response information generating means 203 notifies the inspection value calculating means 104 that the generation of the response information R has failed. The inspection value calculation means 104 notifies the inspection site redundancy inspection means 105 of the failure, and as a result,
The error processing means 106 is activated.

When the usage control information verifying means 206 determines that the usage control information I is authentic, the second response information generating means 204 has already been delivered from the proving device 200 (C, n). , User unique information holding means 2
Using the user unique information d _{U in} 01 and the usage control information I in the usage control information holding unit 205,

[0090]

[ ^Mathematical formula-see original document] R '= ^{CF (dU, n, I)} mod n is calculated and passed to the first response information generating means 203.
On the other hand, the first response information generating means 203 uses t in the auxiliary information for certification 202,

[0091]

[Mathematical formula-see original document] R '' = C ^t mod n is calculated in advance, and the second response information generating means 204 is further calculated.
Using R'received from

[0092]

## EQU00008 ## Compute the response information R according to R = R'R '' mod n. The proving apparatus 200 uses the calculated response information R as the inspection value calculation means 1 in the verification apparatus 100.
Return to 04.

The subsequent verification device 100 and proof device 200 operate in the same manner as in the first embodiment.

In the third embodiment, when the usage control information 2050 in the usage control information holding means 205 is not authentic, the error processing means 106 is activated. Also,
Even when the usage control information 2050 is replaced with a false value and the usage control information verifying means 206 appears to be authentic, the second response information generating means 204 calculates based on the false usage control information 2050. The correct response information R cannot be calculated to do. As a result, the check value redundancy check means 105 cannot detect the predetermined redundancy, and the error processing means 106 is also activated.

As described above, in the third embodiment, fine-grained user authentication control based on the usage control information 2050 can be performed. In this embodiment, the usage control information 2
Using 050 as the expiration date, the usage control information verification means 2
This is achieved by placing the clock 2060 in 06. Implementation with other configurations is also possible.

For example, the use control information 2050 is used as the maximum number of times of authentication, and a counter is held in the use control information verifying means 206, whereby the number of times of successful user authentication can be controlled.

[0097]

As described above, according to the present invention, does the verification value differ from the reference value without having the reference value in the verification device and without causing a disadvantage such as program runaway? Can detect.

[Brief description of drawings]

FIG. 1 is a block diagram showing a first embodiment of the present invention.

FIG. 2 is a block diagram showing a second embodiment of the present invention.

FIG. 3 is a block diagram showing a third embodiment of the present invention.

[Explanation of symbols]

100 Verification device 101 verification basic information holding means 102 encrypted digital information holding means 103 test information generation means 104 Inspection value calculation means 105 inspection value redundancy inspection means 106 error handling means 107 Decoding means 108 Decoded value redundancy checking means 200 Proof device 201 User unique information holding means 202 Auxiliary information holding means for certification 203 First Response Information Generating Means 204 Second response information generating means 205 Usage control information holding means 206 Usage control information verification means

Continuation of the front page (56) Reference JP-A-4-40128 (JP, A) JP-A-4-117826 (JP, A) JP-A-4-247737 (JP, A) (58) Fields investigated (Int .Cl. ⁷ , DB name) H04L 9/32 H04L 9/08 H04L 9/36

Claims (17)

(57) [Claims] 1. A verification device for holding digital information,
In an authentication device comprising a proof device used by a user who attempts to access the digital information, the verification device includes digital information holding means, test information generating means, check value calculating means, check value redundancy checking means and error processing means. and and a digital information processing means, said proof apparatus and a response information generating means with a user-specific information storage means, the
The digital information holding means in the inspection device is provided with a predetermined recovery
Encrypted digital information that can be decrypted with the
Holding, in said test information generating means in the verification apparatus to generate test information sent to the response information generation means in said proof devices, the response information generation means the test information and the user unique identifying information holding means Response information is generated from the user-specific information held in and sent to the inspection value calculation means in the verification device, the inspection value calculation means calculates an inspection value from the response information , the test information and User specific
If the information is correct, the above check value is the above decryption key and location.
Constant redundant data.
When the check value is passed to the check value redundancy check means, and the check value redundancy check means can detect the predetermined redundant data from the check value, the digital information processing means is activated and the digital information is activated. Retrieved from the inspection value for the digital information held in the holding means
User authentication characterized in that a process including decryption using the decryption key is performed, and when the predetermined redundant data cannot be detected, the error processing means is activated and error processing is performed. apparatus. 2. A verification device for holding digital information,
In an authentication device comprising a certifying device used by a user who attempts to access the digital information, the verifying device comprises an encrypted digital information holding means, a test information generating means, a check value calculating means, a check value redundancy checking means and a decrypting means. and means and error processing means and digital processing means, said proof apparatus and a response information generation means user-specific information storage means, said test information generating means in the verification device generates test information And sends it to the response information generating means in the certifying device, and the response information generating means generates response information from the test information and the user unique information held in the user unique information holding means, and the verification device. The inspection value is transmitted to the inspection value calculation means in the inside, and the inspection value calculation means calculates an inspection value from the response information , and the test information and the user.
If the unique information is correct, the above check value is
Decrypt encrypted digital information stored in digital information storage means
It contains a decryption key and predetermined redundant data for
査値calculating means passing the test value to said check value redundancy check means, when the above-mentioned check value redundancy check means could be detected from the test values predetermined redundancy, the from the test value <br /> After calculating the decryption key and passing it to the decryption means, the decryption means decrypts the encrypted digital information held in the encrypted digital information holding means with the decryption key. A user characterized by calling the digital information processing means, processing the decoded digital information, and calling the error processing means to perform error processing when the predetermined redundancy cannot be detected. Authentication device. 3. A verification device for holding digital information,
In the authentication device including a certifying device used by a user who attempts to access the digital information, the verifying device is an encrypted digital information holding means, a test information generating means, a check value calculating means, a decrypting means, and a decrypted value redundancy checking means and a error handling means and digital processing means and, proof device chromatic and a response information generation means user-specific information storage means
Then , the test information generating means in the verification device generates test information and sends it to the response information generating means in the proving device, and the response information generating means is held in the test information and the user unique information holding means. The response information is generated from the user-specific information and sent to the check value calculation means in the verification device, and the check value calculation means calculates a decryption key as a check value from the response information and sends it to the decryption means. Upon delivery, the decryption means decrypts the encrypted digital information held in the encrypted digital information holding means with the decryption key using the decryption key, and the decrypted value redundancy check means decrypts the decrypted digital information. From information to a given redundant data
When obtained by detecting the data, the processing of digital information in which the digital processing means is being activated decoding is performed,
A user authentication device characterized in that when the predetermined redundant data cannot be detected, the error processing means is activated to perform error processing. 4. The attestation device has attestation auxiliary information holding means, and the response information generating means together with the user unique information held in the user unique information holding means, the attestation auxiliary information holding means. The user authentication device according to claim 1, 2 or 3, wherein the response information is generated based on the certification auxiliary information held in. 5. The verification device has verification basic information holding means, and the test information generation means has key information K ^* , a random number r, and an RSA public key (E) held in the verification basic information holding means. , the test information from a n) and ^{(C, n) C = r} E K
^* Modn, the proof auxiliary information t is given by t = D−d _U + w (p−1) (q−1), and the response information generating means R = C ^t C ^dU mod.
5. The user authentication device according to claim 4, wherein the response information R is generated by n, and the inspection value calculation means calculates the inspection value L by L = r ⁻¹ R mod n. 6. The verification device has verification basic information holding means, and the test information generation means has key information K ^* , a random number r, and an RSA public key (E) held in the verification basic information holding means. , N) from the test information (C, n) to C = r ^{EK *}
mod n, and the proof auxiliary information t is t using at least the user unique information d _U and a predetermined function F (d _U , n) taking the n as arguments.
= D−F (d _U , n), the response information generating means uses the function F (d _U , n) to obtain R = C ^t C.
The response information R is generated by F ^{F (dU, n)} mod n, and the inspection value calculation means L =
The user authentication device according to claim 4, wherein the user authentication device is calculated by r ⁻¹ R mod n. 7. The user unique information holding means and the response information calculation means in the certification device are stored in a tamper resistant container resistant to physical intrusion of a probe or the like. 5. The user authentication device as described in 5 or 6. 8. The response information generating means in the proving device comprises a first response information generating means and a second response information generating means, and the test information generating means has the test information (C,
n) is passed to the first response information generating means, the first response information generating means calculates R ″ = C ^t mod n, and the test information (C, n) is transferred to the second response information. Then, the second response information generation means calculates R ′ = C ^dU mod n and delivers it to the first response information generation means, and the first response information generation means R = R′R. The user authentication device according to claim 5, wherein the response information R is calculated by ″ mod n. 9. The response information generating means in the proving device comprises a first response information generating means and a second response information generating means, and the test information generating means includes the test information (C,
n) is passed to the first response information generating means, the first response information generating means calculates R ″ = C ^t mod n, and the test information (C, n) is transferred to the second response information. The second response information generation means delivers R ′ = ^{CF (dU, n)} mod n to the first response information generation means, and the second response information generation means delivers the first response information generation means. 7. The user authentication device according to claim 6, wherein the response information R 1 is calculated by R = R′R ″ mod n. 10. The tamper resistant container having resistance to physical intrusion of a probe or the like, wherein the user unique information holding means and the second response information calculating means in the certifying device are stored in a tamper resistant container. User authentication device. 11. The certifying device has a usage control information holding means and a usage control information verification means, and the usage control information verification means verifies the usage control information held in the usage control information holding means, The response information generating means generates response information when the usage control information is authentic, and sends the response information to the inspection value calculating means in the verification device.
Alternatively, the user authentication device described in 4. 12. The verification device has verification basic information holding means, and the test information generation means has key information K ^* , a random number r, and RSA held in the verification basic information holding means.
Public key (E, n) test information from the ^{(C, n) C = r} E K
^* Modn, and the proof auxiliary information t is a predetermined function F that takes at least the user-specific information d _U , the n, and the usage control information I as arguments.
Using (d _U , n, I), t = D−F (d _U , n, I)
The usage control information verification means verifies the usage control information I, and when the usage control information I is authentic, the response information generation means determines the function F (d _U , n,
R = C ^t C ^{F (dU, n, I)} mod using ^I)
The user authentication device according to claim 11, wherein the response information R is generated by n, and the inspection value calculation means calculates the inspection value L by L = r ⁻¹ R mod n. 13. The user unique information holding means, the response information generating means and the usage control information verifying means in the certification device are stored in a tamper resistant container resistant to physical intrusion of a probe or the like. 11. The user authentication device described in 11 or 12. 14. The response information generating means in the certification device comprises a first response information generating means and a second response information generating means, and the test information generating means stores the test information (C, n). Handing over to the first response information generating means,
The usage control information verification means verifies the usage control information I 1 held in the usage control information holding means, and when the usage control information I is authentic, the first response information generation means R ″ = C ^t mod n is calculated and the test information (C, n) is passed to the second response information generating means, and the use control information holding means transfers the use control information I to the second response information generating means. Upon delivery, the second response information generating means has R ′ = ^{CF (dU, n, I).}
mod n is calculated and delivered to the first response information generating means, and the first response information generating means R = R′R ″.
The response information R is calculated by mod n.
2. The user authentication device described in 2. 15. The user unique information holding means, the second response information generating means and the usage control information verifying means in the certification device are stored in a tamper resistant container resistant to physical intrusion of a probe or the like. The user authentication device according to claim 14, 16. An encryption so that it can be decrypted with a predetermined decryption key
Digital information holding hand holding digitized digital information
A verification device having a step and an access to the digital information.
User using the certification device used by the user
In the user authentication method for performing authentication, a step of storing user unique information in the certification device, a step of receiving test information from the verification device in the certification device, and the test information and the user unique information in the certification device. In response to the step of generating response information, and in the verification device, the response information from the proving device.
And a step of generating inspection information from the response information in the verification device, the test information and the user-specific
If the information is correct, the above decryption key as the above inspection information
And a step <br/> flop that generates those containing predetermined redundant data, the predetermined redundant to the test information in the verification apparatus
A step of judging whether or contains data, the predetermined redundant to the test information in the verification apparatus
And performing error processing if it is determined that data is not contained, the predetermined redundant to the test information in the verification apparatus
And a step of executing predetermined information processing when it is determined that the data is included. 17. A cipher that can be decrypted with a predetermined decryption key
Digital information holding that holds digitized digital information
Means, receiving means for storing user-specific information, test information, and means for generating response information in accordance with the above test information and the user unique identifying information, and means for generating inspection information from the response information , Above test information and above inspection
If the user-specific information is correct, it will be displayed as the above inspection information.
Generates a key containing a decryption key and predetermined redundant data
Means that, the means for determining whether the predetermined redundant data included in the examination information, when the <br/> predetermined redundant data is judged to be not included in the inspection information means for performing error processing, the predetermined redundancy in the inspection information
A user authentication device comprising: means for executing predetermined information processing when it is determined that long data is included.