JP4392510B2 - Authentication apparatus and authentication method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an authentication apparatus and an authentication method capable of performing authentication while being anonymous without requiring a third-party authentication organization.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, an anonymous authentication device is known in which an authenticator and a person to be authenticated manage the number of authentications, and the authenticator can authenticate the person to be authenticated with a pseudonym and know the real name (see, for example, Patent Document 1). This is because the pseudonym and real name are managed separately, and the authenticator authenticates the person to be authenticated while the pseudonym registration device issues a certificate, and the real name is obtained through the pseudonym registration device and the real name registration device. It is something that can know.
[0003]
[Patent Document 1]
Japanese Patent Laid-Open No. 2001-094553
[Problems to be solved by the invention]
However, the anonymous authentication device disclosed in Patent Document 1 requires an authenticator device, a real name registration device, and a pseudonym registration device, and has a problem that the device configuration becomes very complicated.
The present invention has been made in view of such circumstances, and an object thereof is to provide an authentication device and an authentication method capable of performing anonymous authentication with a simple configuration.
[0005]
[Means for Solving the Problems]
The invention according to claim 1 is an authentication apparatus comprising a service providing server that provides a service and a user terminal that receives the service provided by the service providing server, wherein the user terminal generates a random number a on Zq ^* Means for calculating b satisfying a predetermined conditional expression including a user identification number A given in advance, means for generating a random number r on Zq ^* , and a primitive element g on Gq given in advance to the value ^g r on three ^Gq, g ^ar, means for calculating a ^{g br,} transmission value ^g r on three Gq obtained by the ^calculation, g ^ar, the ^{g br} to the service providing server Means for receiving a validity evaluation result of four values (g ^r , ^gar , g ^br , g ^rA ) obtained by adding g ^rA obtained by calculating from g ^r and A from the service providing server; Offer A means for generating new random numbers m and n on Zq ^* , when the validity is recognized by the server, and a value g ^rm on two Gq from the primitive element g, random number r and m and n, means for calculating and transmitting g ^rn to the service providing server; and means for receiving the service usage right generated by the service providing server, wherein the service providing server comprises the user identification number A and the user terminal. three values ^g r ^transmitted, g ^ar, the four values obtained from the ^{g br (g r, g ar} , g br, g rA) means for evaluating the validity of the four values (g ^r , g ^ar , g ^br , g ^rA ) are validated, a blind signature is applied to the four values ( ^gar , g ^br , g ^mr , g ^nr ) transmitted from the user terminal. By granting It generates a service usage right, characterized by comprising a means for transmitting to the user terminal. Here, p and q are prime numbers, q is divisible by p-1, Zq represents a prime field consisting of integers from 0 to q-1, and Zq ^* is a set of numbers obtained by subtracting 0 from Zq ^. To do. Gq is a multiplicative group of order q.
[0006]
According to a second aspect of the present invention, the service server generates a random number α on Zq ^* and transmits it to the user terminal when the service usage right is presented from the user terminal at the time of providing the service. And means for storing the values mα + a and nα + b on the two Zqs transmitted from the user terminal and the random number α as log data, wherein the user terminal receives the random number α and the random number α received from the service providing server. Means for calculating the values mα + a, nα + b on Zq using the values a, b, m, n on Zq ^* and transmitting them to the service providing server, wherein the service providing server comprises the log It is characterized by searching for unauthorized use by analyzing data.
[0007]
According to a third aspect of the present invention, the user terminal generates a new random number a ′ on Zq ^* , obtains b ′ satisfying a predetermined conditional expression including a user identification number A given in advance, and a new random number a ′. ^Means for generating g ^a , g ^b , g ^{a′r ′} , g ^b′r ′ by generating a random number r ′, and the four values (g ^a , g ^b , g ^{a′r ′} , g ^{b 'r'} ) to the service providing server, the service providing server including the values ^a , g, g ^b , g ^{a'r '} , g ^b'r' from the ^four values A means for updating the right to use the service when b and the values a ′ and b ′ are verified is provided.
[0008]
The invention according to claim 4 is an authentication method comprising a service providing server that provides a service and a user terminal that receives the service provided by the service providing server, wherein the user terminal generates a random number a on Zq ^*. A process of calculating b satisfying a predetermined conditional expression including a user identification number A given in advance, a process of generating a random number r on Zq ^* , and a primitive element g on Gq given in advance to the value of the three Gq ^{g r,} g ^ar, a process of calculating the ^{g br,} transmission value ^g r on three Gq obtained by the ^calculation, g ^ar, the ^{g br} to the service providing server Receiving a validity evaluation result of four values (g ^r , ^gar , g ^br , g ^rA ) obtained by adding g ^rA obtained by calculating from g ^r and A from the service providing server, and the service Offer A process for generating new random numbers m and n on Zq ^* , and a value g ^rm on two Gqs from the original element g, random number r, and m and n, when the validity is recognized by the server. g ^rn is calculated and transmitted to the service providing server, and a service use right generated by the service providing server is received. The service providing server includes the user identification number A and the user terminal. A process of evaluating the validity of the four values (g ^r , ^gar , g ^br , g ^rA ) obtained from the three values g ^r , ^gar , g ^br transmitted by ^{g r, g ar, g br} , when the validity of the ^{g rA)} were observed, four values transmitted from the user terminal ^{(g ar, g br, g} mr, blind signature to ^{g nr)} By granting It generates a service usage right, characterized by having a process of transmitting to the user terminal.
[0009]
In the invention according to claim 5, the service server generates a random number α on Zq ^* and transmits it to the user terminal when the service usage right is presented from the user terminal at the time of providing the service. And a step of storing the values mα + a and nα + b on the two Zqs transmitted from the user terminal and the random number α as log data, wherein the user terminal receives the random number α received from the service providing server. And calculating values mα + a, nα + b on Zq using the values a, b, m, n on Zq ^* and transmitting them to the service providing server, wherein the service providing server comprises: The unauthorized use is searched by analyzing the log data.
[0010]
In the invention according to claim 6, the user terminal generates a new random number a ′ on Zq ^* , obtains b ′ satisfying a predetermined conditional expression including a user identification number A given in advance, and a new random number a ′. A process of calculating random numbers r ′ to calculate g ^a , g ^b , g ^{a′r ′} , g ^{b′r ′} , and the four values (g ^a , g ^b , g ^{a′r ′} , g ^{b 'r')} a and a process of transmitting to the service providing server, the service providing server, the four values ^{(g a, g b, g} a'r ', g b'r') from the value a , B and the values a ′, b ′ are verified, the service usage right is updated.
[0011]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an authentication apparatus according to an embodiment of the present invention will be described with reference to the drawings. In the following description, p and q are prime numbers, q is divisible by p-1, Zq represents a prime field consisting of integers from 0 to q-1, and Zq ^* is a number obtained by removing 0 from Zq ^. A set of Gq is a multiplicative group of order q.
[0012]
FIG. 1 is a block diagram showing the configuration of the embodiment. In this figure, reference numeral 1 denotes a user terminal used by a user who is authenticated before receiving service provision. Reference numeral 2 denotes a service providing server that performs user authentication when providing a service. A symbol N is a communication medium for performing communication between the user terminal 1 and the service providing server 2.
[0013]
Reference numeral 11 denotes an input unit composed of a keyboard and a mouse. Reference numeral 12 denotes a display unit configured by a display. Reference numeral 13 denotes a communication unit for performing communication via the communication medium N. Reference numeral 14 denotes an authentication processing unit that receives anonymous authentication from the service providing server 2. Reference numeral 15 denotes a random number generator for generating a random number on Zq ^* . Reference numeral 16 denotes a numerical calculation unit that calculates a value on Gq. Reference numeral 17 denotes a zero knowledge proof unit that performs zero knowledge proof processing.
[0014]
Reference numeral 21 denotes an input unit composed of a keyboard and a mouse. Reference numeral 22 denotes a display unit configured by a display. Reference numeral 23 denotes a communication unit for performing communication via the communication medium N. The code | symbol 24 is an authentication part which authenticates the user of the user terminal 1 anonymously. Reference numeral 25 denotes a zero knowledge verification unit that performs zero knowledge verification processing by repeating information communication with the zero knowledge proof unit 17 several times. Reference numeral 26 denotes a signature processing unit that performs signature processing on information. Reference numeral 27 denotes a numerical calculation unit that calculates a value on Gq. Reference numeral 28 denotes a random number generator that generates a random number on Zq ^* . Reference numeral 29 denotes a log file that stores service provision results for the user.
[0015]
Next, the operation of the apparatus shown in FIG. 1 will be described.
First, when a user intends to receive service provision, the user connects the user terminal 1 to the service provision server 2, and the authentication processing unit 14 transmits an issuance request for the user identification number A to the authentication unit 24. . In response to this, the authentication unit 24 sends the user identification numbers A and Gq on the user identification numbers A and Gq input by the service provider from the input unit 21 to the authentication processing unit via the communication units 23 and 13. 14 to send. As a result, the authentication processing unit 14 receives the three values A, g, and h from the service providing server 2. The authentication processing unit 14 holds these three values inside.
The issue request does not necessarily have to be performed using a computer or the like, but may be applied by mail or the like, and the user identification number A and the two values g and h may be notified by mail or the like.
[0016]
Next, the authentication processing unit 14 requests the random number generation unit 15 to generate a random number a on Zq ^* . In response to this, the random number generation unit 15 generates a random number a and returns it to the authentication processing unit 14. And the authentication process part 14 calculates | requires the value b which satisfies (a * b) / h = x ... A. That is, values a and b are determined such that the remainder when dividing by the value h received from the service provider becomes the user identification number A. In order to simplify the explanation, when the received values are A (user identification number) = 1, h = 5, and b = 2, for example, 2 × 3/5 = 1... 1 or 2 × 8/5 = 3 ... 1, so b = 3 and b = 8.
[0017]
Next, the authentication processing unit 14 holds these two values a and b inside. Subsequently, the authentication processing unit 14 instructs the random number generation unit 15 to generate a random number. In response to this, the random number generation unit 15 generates a random number r on Zq ^* using a known process and notifies the authentication processing unit 14 of the random number.
[0018]
Next, the authentication processing unit 14 passes the values g, a, b, and r held therein to the numerical value calculation unit 16. Numerical calculation unit 16 receives this, three values ^g r Using this ^value, g ^ar, calculates the ^{g br,} three values ^g r calculated ^results, g ^ar, authenticate ^{g br} processing unit 14 Return to.
[0019]
Next, the authentication processing unit 14 transmits the three values g ^r , ^gar and g ^br obtained by the calculation to the authentication unit 24 via the communication units 13 and 23. In response to this, the authentication unit 24 calculates g ^rA by using the received three values g ^r , g ^ar , and g ^br and the user identification number A issued earlier, and passes it to the zero knowledge verification unit 25. .
[0020]
Next, the zero knowledge verifying unit 25 and the zero knowledge proving unit 17 use the four given values to confirm the validity of the four given values by the zero knowledge proving process. Zero Knowledge Interactive Proof means that the user knows the secret information in the authentication using secret information (here, two values a and b) that only the user knows, such as a password. This is a method of certifying secret information without sending / receiving it. In open networks such as the Internet, there is a risk of being stolen if secret information is exchanged as it is at the time of authentication, so this zero knowledge proof is used. . Here, in the arithmetic system in which the four-tuple (x, y, z, w) is specified, the discrete logarithm values with x and z as the bases match, that is, log _x y = log _z w is satisfied. We use zero knowledge proof to prove this without revealing the discrete logarithm. As a specific method, a method by Chaum, Pedersen et al. Is known, and the document “Wallet database with observers, Proceedings of CRYPTO'1992, LNCS740.Springer Verlag, pp.89-105,1992”. Detailed description will be omitted.
[0021]
Subsequently, the zero knowledge verification unit 25 and the zero knowledge proof unit 17 perform the validity evaluation of the four values and notify the authentication unit 24 of the evaluation results. Upon receiving this result, the authentication unit 24 notifies the user terminal 1 of the fact if it is not valid, and ends the process. On the other hand, if it is valid, the authentication unit 24 instructs the user terminal 1 to input two new values.
[0022]
In response to this, the authentication processing unit 14 instructs the random number generation unit 15 to generate two random numbers m and n. In response to this, the random number generation unit 15 generates two random numbers m and n on Zq ^* and returns them to the authentication processing unit 14. Then, the authentication processing unit 14 uses the obtained two random numbers m and n to obtain new values g ^rm and g ^rn by calculation, and transmits them to the authentication unit 24.
[0023]
Next, the authentication unit 24 blind-signs the four values g ^ra , g ^rb , g ^rm , and g ^rn transmitted from the authentication processing unit 14 and returns them to the authentication processing unit 14. The blind signature used here receives a signature from the signer without the signer knowing the contents of the data. Since this blind signature has a publicly known content, detailed description thereof is omitted.
[0024]
This signature ^{processing, g a, g b, g} m, g n, sign is ^{(g a, g b, g} m, g n) of the value column is generated. This becomes a service use right for anonymous authentication. By presenting this service use right at the time of service provision, it becomes possible to receive service provision anonymously.
[0025]
Next, the processing operation in the case where the user presents the service use right generated earlier and receives the service will be described. First, the user terminal 1 is connected to the service providing server 2 and a service providing request is transmitted. In response to this, the authentication unit 24 instructs the random number generation unit 28 to generate a random number α on Zq ^* . The random number generation unit 28 receives this instruction, generates a random number α, and returns it to the authentication unit 24. Then, the authentication unit 24 transmits this random number α to the authentication processing unit 14.
[0026]
In response to this, the authentication processing unit 14 transfers the values a, b, m, and n held therein and the random number α to the numerical value calculation unit 16. The numerical value calculation unit 16 calculates d ₁ = mα + a and d ₂ = nα + b using these five values a, b, m, n, and α, and returns d ₁ and d ₂ to the authentication processing unit 14.
[0027]
Next, the authentication processing unit 14 transmits the _two values d ₁ and d ₂ to the authentication unit 24. The authentication unit 24 records these two values d ₁ and d ₂ and the random number α in the log file 29. Then, a service is provided to the user terminal 1. As a result, log data is stored in the log file 29 each time a service is provided.
[0028]
Next, an operation in which the log analysis unit 30 searches for unauthorized use (double use) based on log data will be described. First, the log analysis unit 30 is activated once a day, for example, and from the log data in the log file 29,
d ₁ = mα + a
d ₂ = nα + b
d ₁ '= mα' + a
d ₂ '= nα' + b
A simultaneous equation consisting of the following four equations is established. Here, it is assumed that log data (d ₁ , d ₂ , α) at the first use and log data (d ₁ ′, d ₂ ′, α ′) at the second use are stored in the log file 29. . In this equation, d ₁ , d ₁ ′, d ₂ , d ₂ ′, α, α ′ are known numbers, and since the simultaneous equations can be solved, the log analysis unit 30 solves the simultaneous equations by a, b, m, and n are calculated. Then, the user identification number A is obtained from the obtained a and b. Thereby, it becomes possible to obtain the identification number A of the user who has illegally used (double use). If the equations are not solved, unauthorized use did not occur. By applying this process to all the log data, it is possible to find out unauthorized use that occurred in one day and to specify the user who has made unauthorized use.
[0029]
It should be noted that the process of finding unauthorized use may be executed each time a service provision request is made. In this way, it is possible to refuse to provide a service at the time of trying to execute unauthorized use.
[0030]
Next, an operation for updating the service usage right will be described. The user terminal determines a ′ and b ′ different from the previously determined a and b. Then, the random number generator 15 uses the newly generated random numbers r ′ and a ′, b ′, and then g ^{r ′} , g ^{r′a ′} , g ^{r′b ′} , g ^a , g ^b , g ^The numerical calculation unit 16 calculates ^r′A . These six values g ^{r ′} , g ^{r′a ′} , g ^{r′b ′} , g ^a , g ^b , and g ^r′A are transmitted to the authentication unit 24 by the authentication processing unit 14.
[0031]
Next, the authentication unit 24 passes these six values to the zero knowledge verification unit 25. In response to this, zero-knowledge verification part 25, four values ^{(g a, g b, g} r'a, g r'b) to evaluate the validity of using, via the communication unit 23, 13 Then, information on zero knowledge proof processing is exchanged with the zero knowledge proof unit 17. Subsequently, the zero knowledge verification unit 25 uses the four values (g ^{r ′} , g ^{r′a ′} , g ^{r′b ′} , and g ^r′A ) to evaluate the validity, so that the communication unit 23, 13, information of zero knowledge proof processing is exchanged with the zero knowledge proof unit 17. Further, the zero knowledge verification unit 25 uses the four values (g ^{r ′} , g ^{r′a ′} , g ^{r′b ′} , and g ^r′A ) to evaluate the validity, so that the communication unit 23, 13, information of zero knowledge proof processing is exchanged with the zero knowledge proof unit 17. As a result of the three times of validity evaluation, if the validity is obtained in any evaluation result, it is proved that the inputted six values are valid values, so the user identification number A itself is presented. It is possible to perform authentication while maintaining anonymity without changing the service usage right.
[0032]
Note that the values a, b, a ′, and b ′ may be input directly from the input unit 11 by the user.
[0033]
Next, an application example of the authentication method described above will be described.
(1) Application example 1
In amusement parks, we issue passes that allow you to enjoy popular attractions even if there are no customers. This pass is a mechanism that you can get on that attraction once you receive it, or you can not receive a new pass until a certain time has passed, and the management server must always manage whether it is currently in use, Centrally managed by a unique identification number given to the admission ticket. However, there is a possibility that the person who owns the admission ticket to which the unique number is assigned knows when and which attraction is used. In order to protect this privacy, the privacy can be surely protected by updating the service use right every time a path is received by the above-described updating method.
[0034]
(2) Application example 2
In the case of a renting service such as a library or a rental video store, since the use card and the user correspond to each other, the borrower who borrows what can do it. However, the user always uses the right to use the service twice and deposits one in a reliable organization. Renew service use rights when borrowed items are returned. If the user does not return after the return period, the lending institution will appeal to a reliable institution and receive one of the service usage rights. Since the name etc. which specify a user can be acquired when two service use rights are prepared, the lending institution can track unreturned persons. That is, by using double from the beginning, it becomes possible to trace later. In addition, since the person cannot be tracked with only one right to use the service, even a reliable organization cannot know who is using the lending organization.
[0035]
(3) Application example 3
For example, when it is desired to collect information on the usage status of a terminal such as an information appliance, it is desirable to collect information anonymously. However, it is necessary to authenticate whether or not the person has actually purchased the home appliance, that is, whether or not a person is worth collecting information in information collection. Therefore, the right to use the service is distributed to all qualified persons such as purchasers, and necessary information is collected anonymously. Information can be collected semi-permanently by updating after collection. Further, by not updating the person who provides false information too much, this person can be excluded by the collecting side.
[0036]
1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed to execute an authentication process. You may go. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.
[0037]
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.
[0038]
【The invention's effect】
As described above, according to the present invention, there is an effect that anonymous authentication can be performed with a simple configuration. In addition, since the user identification information can be obtained only when there is an unauthorized use, it is possible to always keep the anonymous state. In addition, since the service usage right can be updated while maintaining an anonymous state, an effect that privacy can be reliably protected is also obtained.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... User terminal 11 ... Input part 12 ... Display part 13 ... Communication part 14 ... Authentication process part 15 ... Random number generation part 16 ... Numerical calculation part 17 ... Zero Knowledge proof part 2 ... service providing server 21 ... input part 22 ... display part 23 ... communication part 24 ... authentication part 25 ... zero knowledge verification part 26 ... signature processing part 27 ... Numerical calculator 28 ... Random number generator 29 ... Log file 30 ... Log analyzer N ... Communication medium

Claims (6)

An authentication device comprising a service providing server that provides a service and a user terminal that receives the service provided by the service providing server,
The user terminal is
Means for generating a random number a on Zq ^* and calculating b satisfying a predetermined conditional expression including a user identification number A given in advance;
Means for generating a random number r on Zq ^* ;
Means for calculating values g ^r , ^gar and g ^br on three Gqs using a primitive element g on Gq given in advance;
The three values G ^r , g ^ar , and g ^br on Gq obtained by the calculation are transmitted to the service providing server, and four values (g ^r obtained by adding g ^rA obtained from g ^r and A are added. , ^Gar , ^gbr , ^grA ) from the service providing server,
Means for generating random numbers m and n on a new Zq ^* when legitimacy is recognized by the service providing server;
Means for calculating values g ^rm and g ^rn on two Gqs from the primitive element g, the random number r, and the m and n, and transmitting them to the service providing server;
Means for receiving a service use right generated by the service providing server,
The service providing server includes:
The validity of the four values (g ^r , ^gar , g ^br , and g ^rA ) obtained from the user identification number A and the three values g ^r , ^gar , and g ^br transmitted from the user terminal is evaluated. Means to
When the four values (g ^r , ^gar , g ^br , and g ^rA ) are validated, a blind signature is applied to the four values (g ^ar , g ^br , g ^mr , and g ^nr ). An authentication apparatus comprising: means for generating a service use right by giving and transmitting the service use right to the user terminal.
Here, p and q are prime numbers, q is divisible by p-1, Zq represents a prime field consisting of integers from 0 to q-1, and Zq ^* is a set of numbers obtained by subtracting 0 from Zq ^. To do. Gq is a multiplicative group of order q. The service server
Means for generating a random number α on Zq ^* and transmitting it to the user terminal when the service usage right is presented by the user terminal at the time of service provision;
Means for storing the values mα + a, nα + b on the two Zqs transmitted from the user terminal and the random number α as log data;
The user terminal is
Means for calculating values mα + a, nα + b on Zq using random numbers α received from the service providing server and values a, b, m, n on Zq ^* , and transmitting the calculated values to the service providing server; Prepared,
The authentication apparatus according to claim 1, wherein the service providing server searches for unauthorized use by analyzing the log data. The user terminal is
A new random number a ′ on Zq ^* is generated, b ′ satisfying a predetermined conditional expression including a user identification number A given in advance is obtained, and a new random number r ′ is generated to generate g ^a , g ^b , means for calculating g ^{a′r ′} , g ^{b′r ′} ;
And means for transmitting the four values ^{(g a, g b, g} a'r ', g b'r') a to the service providing server,
The service providing server includes:
The four values ^{(g a, g b, g} a'r ', g b'r') value based on the a, b and the value a ', b' when the validity of has been proved, the service The authentication apparatus according to claim 1, further comprising means for updating a right. An authentication method comprising a service providing server that provides a service and a user terminal that receives the service provided by the service providing server,
The user terminal is
Generating a random number a on Zq ^* and calculating b satisfying a predetermined conditional expression including a user identification number A given in advance;
Generating a random number r on Zq ^* ,
Calculating values g ^r , ^gar and g ^br on three Gqs using a primitive element g on Gq given in advance;
The three values G ^r , g ^ar , and g ^br on Gq obtained by the calculation are transmitted to the service providing server, and four values (g ^r obtained by adding g ^rA obtained from g ^r and A are added. , ^Gar , ^gbr , ^grA ) from the service providing server,
A process of generating new random numbers m and n on Zq ^* when the service providing server confirms the validity;
Calculating two values G ^rm and g ^rn on Gq from the primitive element g, the random number r and the m and n, and transmitting them to the service providing server;
Receiving a service use right generated by the service providing server,
The service providing server includes:
The validity of the four values (g ^r , ^gar , g ^br , and g ^rA ) obtained from the user identification number A and the three values g ^r , ^gar , and g ^br transmitted from the user terminal is evaluated. The process of
When the four values (g ^r , ^gar , g ^br , and g ^rA ) are validated, a blind signature is applied to the four values (g ^ar , g ^br , g ^mr , and g ^nr ). An authentication method comprising: a step of generating a service use right by giving and transmitting the right to use to the user terminal.
Here, p and q are prime numbers, q is divisible by p-1, Zq represents a prime field consisting of integers from 0 to q-1, and Zq ^* is a set of numbers obtained by subtracting 0 from Zq ^. To do. Gq is a multiplicative group of order q. The service server
A process of generating a random number α on Zq ^* and transmitting it to the user terminal when the service usage right is presented by the user terminal at the time of providing the service;
A step of storing the values mα + a and nα + b on the two Zqs transmitted from the user terminal and the random number α as log data;
The user terminal is
A step of calculating values mα + a, nα + b on Zq using random numbers α received from the service providing server and values a, b, m, n on Zq ^* , and transmitting the calculated values to the service providing server; Prepared,
The authentication method according to claim 4, wherein the service providing server searches for unauthorized use by analyzing the log data. The user terminal is
A new random number a ′ on Zq ^* is generated, b ′ satisfying a predetermined conditional expression including a user identification number A given in advance is obtained, and a new random number r ′ is generated to generate g ^a , g ^b , calculating g ^{a′r ′} and g ^{b′r ′} ;
And a process of transmitting the four values ^{(g a, g b, g} a'r ', g b'r') a to the service providing server,
The service providing server includes:
The four values ^{(g a, g b, g} a'r ', g b'r') value based on the a, b and the value a ', b' when the validity of has been proved, the service 6. The authentication method according to claim 4, further comprising a step of updating the right.

Images