JP6720113B2 - Authentication system, service providing server, authentication method, and program - Google Patents

Description

The present invention relates to an authentication system, a service providing server, an authentication method , and a program.

In conventional knowledge authentication, OTP (one-time password), PAKE (Password Authenticated Key Exchange), etc. are often used. Strong against, but weak against an exhaustive search attack.

On the other hand, M-Pin has been proposed as an authentication method that is strong against both phishing attacks and exhaustive search attacks (see Non-Patent Document 1, for example). That is, the M-Pin can prevent a phishing attack by not directly transmitting a password and can prevent an exhaustive search attack by two-factor authentication.

Michael S., M-Pin: A Multi-Factor Zero Knowledge Authentication Protocol, (2016), Internet <URL: https://www.miracl.com/hs-fs/hub/230906/file-63954152-pdf/downloads /certivox_labs_mpin.pdf>

However, the authentication process by M-Pin is executed for each server that provides the service. Therefore, if secret information (master secret key) is leaked from the key issuing authority, in order to prevent spoofing attacks, contact all service providers using the key issuing authority of the leak source and It is necessary to stop the server of the provider, and there is a problem that the work load is heavy.

The present invention has been made in view of the above points, and an object of the present invention is to reduce the work load when secret information for M-Pin is leaked.

Therefore, in order to solve the above problems, an authentication system includes a service providing server connected to a client terminal via a network, and an authentication server connected to the service providing server via a network. When transmitting parameters required for M-Pin authentication of the user of the client terminal to the authentication server, a value to which a common random number is applied is applied to the authentication server as a public key and a secret key of the service providing server. When the authentication server receives the parameter, the authentication server executes a calculation for M-Pin based on the parameter and transmits a calculation result to the service providing server. Have.

It is possible to reduce the work load when the confidential information for the M-Pin is leaked.

It is a figure which shows the structural example of the authentication system in 1st Embodiment. It is a figure which shows the hardware structural example of the service provision server 10 in 1st Embodiment. It is a figure which shows the function structural example of the service provision server 10 and the authentication server 20 in 1st Embodiment. It is a sequence diagram for explaining an example of a processing procedure of preprocessing before operation of the first embodiment. FIG. 9 is a sequence diagram for explaining an example of a processing procedure at the time of authentication according to the first embodiment. It is a sequence diagram for explaining an example of a processing procedure at the time of authentication of the second embodiment.

The first embodiment will be described below with reference to the drawings. FIG. 1 is a diagram showing a configuration example of an authentication system according to the first embodiment. In FIG. 1, the authentication system 1 includes a plurality of service providing servers 10 such as service providing servers 10a and 10b, one or more client terminals 30 such as client terminals 30a and 30b, a key issuing station 40, an authentication server 20 and the like. The service providing server 10 is connected to the client terminal 30, the key issuing station 40, and the authentication server 20 via a network. The client terminal 30 can also communicate with the key issuing station 40 via the network.

The service providing server 10 is one or more computers that provide some kind of service to the client terminal 30, such as a Web server.

The client terminal 30 is a terminal that functions as a user interface of a service provided by the service providing server 10. For example, a PC (Personal Computer), a smartphone, a tablet terminal, or the like may be used as the client terminal 30.

The authentication server 20 is one or more computers that execute authentication processing for a user of the client terminal 30 requesting access to any of the service providing servers 10. In the present embodiment, the authentication server 20 is shared by a plurality of service providing servers 10. That is, in the present embodiment, the service providing server 10 and the authentication server 20, which are not distinguished in the related art (for example, Non-Patent Document 1), are separated from each other, and the authentication processing regarding a plurality of service providing servers 10 is performed. , Is centrally executed by the authentication server 20.

The key issuing station 40 is one or more computers that issue an encryption key used for authentication (M-Pin) of the user of the client terminal 30.

FIG. 2 is a diagram illustrating a hardware configuration example of the service providing server 10 according to the first embodiment. The service providing server 10 in FIG. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, etc., which are connected to each other by a bus B.

The program that realizes the processing in the service providing server 10 is provided by the recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed in the auxiliary storage device 102 from the recording medium 101 via the drive device 100. However, the program does not necessarily have to be installed from the recording medium 101, and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

The memory device 103 reads the program from the auxiliary storage device 102 and stores the program when an instruction to activate the program is given. The CPU 104 executes the function related to the service providing server 10 according to the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

The authentication server 20, the key issuing authority 40, and the like may also be configured by one or more computers as shown in FIG.

FIG. 3 is a diagram illustrating a functional configuration example of the service providing server 10 and the authentication server 20 according to the first embodiment.

In FIG. 3, the service providing server 10 includes a key receiving unit 11, a login request receiving unit 12, an authentication information receiving unit 13, an authentication requesting unit 14, an authentication result receiving unit 15, and the like. Each of these units is realized by a process that causes the CPU 104 to execute one or more programs installed in the service providing server 10. The service providing server 10 also uses the key storage unit 121. The key storage unit 121 can be realized by using, for example, the auxiliary storage device 102 or a storage device that can be connected to the service providing server 10 via a network.

On the other hand, the authentication server 20 includes an elliptic curve issuing unit 21, an authentication processing unit 22, and the like. Each of these units is realized by a process that causes the CPU of the authentication server 20 to execute one or more programs installed in the authentication server 20. The authentication server 20 also uses the trap door information storage unit 211. The trap door information storage unit 211 can be realized using, for example, the auxiliary storage device 102 or a storage device that can be connected to the authentication server 20 via a network. As the trap door information storage unit 211, HSM (Hardware Security Module) is suitable.

The processing procedure executed in the authentication system 1 will be described below. FIG. 4 is a sequence diagram for explaining an example of a processing procedure of preprocessing before operation according to the first embodiment.

In step S101, the elliptic curve issuing unit 21 of the authentication server 20 issues a supersingular elliptic curve E(Z/NZ). At this time, the elliptic curve issuing unit 21 stores trap door information T(p1, p2, j1, j2), which is the order information of the elliptic curve E and is used in the calculation of the pairing e described later, in the trap door information storage. It is stored in the section 211. Z is a rational integer ring, and N=p1p2. Further, each jd (d=1, 2) is a sufficiently large prime number that satisfies jd|(pd+1). Here, jd|(pd+1) means that jd is divisible by (pd+1).

Then, the elliptic curve issuing unit 21 transmits the elliptic curve E to the key issuing authority 40 (S102). The key issuing station 40 generates an integer as the master secret key s (S103), and transmits Q and sQ to the service providing server 10 (S104). Here, Q is a point on the elliptic curve E, and sQ means scalar multiplication on the elliptic curve E. The elliptic curve E is common to a plurality of service providing servers 10. On the other hand, the master secret keys s, Q and sQ are different for each service providing server 10 (each service). In the following, basically, one lowercase alphabetic character indicates an integer. One uppercase letter indicates a point on the elliptic curve E. When a is an integer and B is a point on the elliptic curve E, aB represents a scalar multiplication of B on a elliptic curve E by a.

Upon receiving Q and sQ, the key receiving unit 11 of the service providing server 10 stores Q as a public key and sQ as a secret key in the key storage unit 121 (S105). The communication between the service providing server 10 and the authentication server 20 is assumed to be encrypted.

On the other hand, the client terminal 30 transmits a registration request including A=H(ID), which is a hash value of the ID, to the key issuing authority 40 (S111). H(x) is a function that calculates a hash value on the elliptic curve E for x. The ID is identification information for each client terminal 30, and is stored in advance in each client terminal 30, for example.

Upon receiving the registration request, the key issuing station 40 issues (calculates) sA based on the master secret key s and A included in the registration request (S112), and sA is encrypted by communication with the client terminal. 30 (S113). Subsequently, when the user inputs a PIN (Personal Identification Number) α1 (S114), the client terminal 30 stores (s−α1)A in the client terminal 30 (S115).

With that, the preprocessing ends. Subsequently, a processing procedure at the time of authentication will be described. FIG. 5 is a sequence diagram for explaining an example of a processing procedure at the time of authentication according to the first embodiment.

When PINα2 is input to the client terminal 30 by the user (S201), the client terminal 30 generates a random number x (S202). Subsequently, the client terminal 30 calculates U=xA (S203), and transmits a login request including (ID, U) to the service providing server 10 designated by the user (S204), for example.

Upon receiving the login request, the login request receiving unit 12 of the service providing server 10 generates a random number y (S205) and transmits the random number y to the client terminal 30 (S206).

Upon receiving the random number y, the client terminal 30 generates (calculates) the authentication information V=−(x+y)((s−α1)A+α2A) (S207), and transmits the authentication information V to the service providing server 10 (S208). ). Here, (s-α1)A is a value stored in the client terminal 30 in advance. If the user is correct, α1=α2.

When the authentication information receiving unit 13 of the service providing server 10 receives the authentication information V, the authentication requesting unit 14 generates a random number r1 (S209). Then, the authentication requesting unit 14 transmits an authentication request including (V, r1Q, (U+yA), r1sQ) to the authentication server 20 (S210). That is, the common random number r1 is applied to Q and sQ. The random number r1 is applied to sQ because it is not preferable in terms of security to distribute the secret key sQ on the network as it is. The reason why the random number r1 is applied to Q is that the same random number as the random number r1 applied to sQ is applied to enable calculation of the pairing e described later. The authentication requesting unit 14 calculates A based on the ID received in step S204, and further calculates yA.

Upon receiving the authentication request, the authentication processing unit 22 of the authentication server 20 uses the trap door information T stored in the trap door information storage unit 211 to g=e(V,r1Q)e((U+yA),r1sQ. ) Is calculated (S211). That is, the pairing e is calculated. Here, if α1=α2 and (s-α1)A stored in the client terminal 30 is correct, g=0, and if not, g≠0. The calculation method is based on, for example, "http://www.ieice-hbkb.org/files/01/01gun_03hen_07.pdf" and "https://www.researchgate.net/publication/225174550_Hidden_Pairings_and_Trapdoor_DDH_Groups". be able to. Subsequently, the authentication processing unit 22 transmits the calculation result g to the service providing server 10 (S212).

Upon receiving the calculation result g, the authentication result receiving unit 15 of the service providing server 10 determines the success or failure of the authentication based on g (S213). Specifically, if g=0, the authentication is determined to be successful, and otherwise, the authentication is determined to be unsuccessful. Subsequently, the authentication result receiving unit 15 transmits the authentication result to the client terminal 30 (S214). Specifically, accept is transmitted to the client terminal 30 if g=0, and reject otherwise.

As described above, according to the present embodiment, the authentication server 20 is separated from the service providing server 10, and the login request for each of the plurality of service providing servers 10 is centrally authenticated by one authentication server 20. To be executed. Therefore, even if the secret information (master secret key s) is leaked from the key issuing authority 40, the fraudulent act such as spoofing can be prevented by stopping the processing by the authentication server 20. As a result, it is possible to reduce the work load when the confidential information for the M-Pin is leaked.

Further, when the parameter necessary for the M-Pin is transmitted from the service providing server 10 to the authentication server 20, the random number r1 is applied to the secret key sQ of the service providing server 10. Therefore, it is possible to reduce the possibility that the secret key sQ is leaked, and it is possible to suppress the decrease in security due to the separation of the service providing server 10 and the authentication server 20.

Further, by applying the same random number r1 as the secret key sQ to the public key Q of the service providing server 10, it is possible to calculate the pairing e in the authentication server 20.

There may be a plurality of key issuing stations 40. Even in this case, the communication between the service providing server 10 and the authentication server 20 may be as described above.

Next, a second embodiment will be described. In the second embodiment, the points different from the first embodiment will be described. The points that are not particularly mentioned in the second embodiment may be the same as in the first embodiment.

FIG. 6 is a sequence diagram for explaining an example of a processing procedure at the time of authentication according to the second embodiment. 6, those steps which are the same as those corresponding parts in FIG. 5 are designated by the same step numbers, and a description thereof will be omitted. In FIG. 6, steps S209 to S211 of FIG. 5 are replaced with S209a to S211a.

Upon receiving the authentication information V in step S209a, the authentication information receiving unit 13 generates a random number r2 in addition to the random number r1 (S209). The random number r2 is a random number different from the random number r1. Subsequently, the authentication request unit 14 transmits an authentication request including (r2V, r1Q, r2(U+yA), r1sQ) to the authentication server 20 (S210a). That is, the random number r2 is applied to V and (U+yA).

Upon receiving the authentication request, the authentication processing unit 22 of the authentication server 20 uses the trap door information T stored in the trap door information storage unit 211 to g=e(r2V,r1Q)e(r2(U+yA), r1sQ) is calculated (S211). Here, if α1=α2 and (s-α1)A stored in the client terminal 30 is correct, g=0, and if not, g≠0. The calculation method may be the same as in the first embodiment.

In each of the above embodiments, the authentication requesting unit 14 is an example of a transmitting unit. The authentication processing unit 22 is an example of a calculation unit. The PIN is an example of an identification number.

Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications are possible within the scope of the gist of the present invention described in the claims. It can be modified and changed.

1 Authentication System 10 Service Providing Server 11 Key Receiving Section 12 Login Request Receiving Section 13 Authentication Information Receiving Section 14 Authentication Requesting Section 15 Authentication Result Receiving Section 20 Authentication Server 21 Elliptic Curve Issuing Section 22 Authentication Processing Section 30 Client Terminal 40 Key Issuing Bureau 100 Drive device 101 Recording medium 102 Auxiliary storage device 103 Memory device 104 CPU
105 Interface device 121 Key storage unit 211 Trap door information storage unit B bus

Claims (6)

An authentication system including a service providing server connected to a client terminal via a network, and an authentication server connected to the service providing server via a network,
The service providing server,
When a parameter required for M-Pin authentication of the user of the client terminal is transmitted to the authentication server, a public random number and a secret key of the service providing server are applied to the authentication server with a value to which a common random number is applied. Has a transmitter for transmitting,
The authentication server is
When the parameter is received, a calculation unit for executing calculation for M-Pin based on the parameter and transmitting the calculation result to the service providing server is provided.
An authentication system characterized by that. The transmitter is
The random number generated by the client terminal is x,
The random numbers generated by the service providing server are y and r1,
The correct identification number is α1,
The identification number input by the user to the client terminal is α2,
The master secret key is s,
The public key on the elliptic curve E of the service providing server is Q,
The private key of the service providing server is sQ,
The hash value of the ID of the client terminal on the elliptic curve E is A,
V=−(x+y)((s−α1)A+α2A),
U=xA,
, V, r1Q, U+yA, r1sQ are transmitted to the authentication server.
The authentication system according to claim 1, wherein: The transmitter is
The random number generated by the client terminal is x,
The random numbers generated by the service providing server are y, r1 and r2,
The correct identification number is α1,
The identification number input by the user to the client terminal is α2,
The master secret key is s,
The public key on the elliptic curve E of the service providing server is Q,
The private key of the service providing server is sQ,
The hash value of the ID of the client terminal on the elliptic curve E is A,
V=−(x+y)((s−α1)A+α2A),
U=xA,
In this case, r2V, r1Q, r2(U+yA) and r1sQ are transmitted to the authentication server,
The authentication system according to claim 1, wherein: The service providing server included in the authentication system according to claim 1. An authentication method executed by a service providing server connected to a client terminal via a network, and an authentication server connected to the service providing server via a network,
The service providing server,
When a parameter required for M-Pin authentication of the user of the client terminal is transmitted to the authentication server, a value to which a common random number is applied is applied to the authentication server as a public key and a secret key of the service providing server. Perform the send procedure to send,
The authentication server is
When the parameter is received, the calculation for the M-Pin is executed based on the parameter, and the calculation procedure for transmitting the calculation result to the service providing server is executed,
An authentication method characterized by the following. A program for causing a computer to function as the service providing server included in the authentication system according to any one of claims 1 to 3 .

Images