JPH02305039A - Authentication system - Google Patents

Abstract

PURPOSE:To execute an authentication of high safety without revealing useful information by sending authorized data constituted by performing an operation to a random number generated by a certifier to a confirmer. CONSTITUTION:A certifier constitutes a data to be authencated in which only one square remainder number is put in plural square non-remainer numbers by using a random number generator 101 and a computing element 103 and sends it to a confirmer. The confirmer brings the data for authenticated to cycle permutation at random, based on the authorized data sent from the certifier by using a random number generator 108 and a computing element 107, and also, constitutes question data obtained by multiplying each component by the square remainder and sends it to the certifier. The certifier confirms a fact that the confirmer sends correctly the question data by communication to the confirmer, and thereafter, sends back a digit of the cyclic permutation to the question data sent from the conformer as answer data to the confirmer by using a deciding device 104. Subsequently, the confirmer executes the authentication in accordance with whether the answer data sent from the certifier is correct or not. In such a way, the authentication can be executed safety and with high reliability without revealing important information.

Description

[Detailed Description of the Invention] [Industrial Application Field] This invention is used to authenticate the other party (for example, to authenticate that the person on the other end of the telephone conversation is the person you really want to talk to).

It relates to authentication methods in authentication systems such as personal authentication (for example, having everyone or another person authenticate that you are really the person you say you are) and data authentication (having people authenticate that the data is correct). - [Prior Art] Authentication methods use methods that base security on problems that are difficult to calculate, in the sense that no efficient calculation algorithm is currently known.

One such problem that is difficult to calculate is the square remainder problem.

When m is a given positive integer, X is coprime to m,
That is, (x, m)=1. and Jacobian symbol C, /m)
is defined as for a positive integer X where is 1. When the prime factorization of m is known, an algorithm for efficiently calculating +Q'' is known. However, when the prime factorization of m is not known, no algorithm to efficiently calculate it has been known to date. Therefore, if a person who has developed an algorithm to efficiently calculate Qm, or who knows the prime factorization of m, wants to convince the confirmer with whom he is communicating that he has the ability to calculate Qm, then this It is necessary to configure a highly reliable and secure communication system that achieves the following.The conditions that must be met for a highly reliable and secure communication system are 1. The verifier must be able to calculate Qrn. .

2. The verifier will not authenticate a person who does not have the ability to calculate Qm.

3. The prover only tells the verifier that he has the ability to calculate Qm, and does not divulge any other information.

03 can be mentioned.

A system conventionally known as a highly reliable and secure communication system for authenticating those who efficiently calculate Qm is GMR (Goldwa9ser-Micali-Rac).
kof f ) method (S, Goldwasser,
S, Micali.

and C, Rackoff, the knowle
dge CompIex-ity of InLsra
active Proof Sygtsms'.

Proceedings on the 17th
Annual ACMSymposium on Th
e-ory of Computing.

1985.291-304). Figure 2 is a block diagram of the authentication system.

(1) is a random number generator that generates random numbers by the operation of the prover, and (2) is the random number generated by the random number generator by the operation of the prover, the calculation results output from the arithmetic device, and the Memory that stores data to be sent.

(3) is an arithmetic device that performs calculations by the prover's operation, (4
) is a determination device that calculates Qm by the prover's operation and determines whether a given number is a square remainder, (5
) is the communication line used by the prover and the verifier, and (6) is used by the verifier to store random numbers generated by the random number generator, calculation results output from the arithmetic device, and data sent by the verifier. Memo! j, +71 is an arithmetic unit that performs calculations according to the operation of the confirmer, and (8) is a random number generator that generates random numbers according to the operation of the confirmer.

Next, the operation will be explained.

Step 1: The prover generates a positive integer random number a using a random number generator (1) and stores it in the memory (2).

Step 2: The prover calls the random number a from the memory (2) and uses the arithmetic device (3) to check whether the random number a is coprime to m, that is, whether it satisfies (a, m) = 1. Make a judgment.

("+m)" If it is 1, go to step 3 +("
If i')≠1, return to step 1.

Step 3: The prover calls the random number a from memory (2) and checks whether the original Jacobian symbol of the modulus m of the random number a is 1, that is, whether the (a / m) = 1 pot is satisfied. , is determined using the arithmetic unit @(3).

If ('a / m) = 'l, go to step 4, (
a/m)=-1, return to step 1.

Stage 4: The prover calls up the random number a from the memo Ut2+, and determines whether the random number a is square non-residue, ie.

Qm’(a) = 0 It is determined whether or not the following is satisfied using the first determining device (4).

If Qm (a') = O, go to step 5, Qm
If (a) = 1, return to step 1.

Step 5: The prover sends the random number to the verifier, which is one communication partner, through the AT communication line (5).

Step 6: The verifier saves the random number a sent by the prover in the memo January G), and checks whether the Jacobian symbol of the random number a is 1 or not.
That is, it is checked using the arithmetic device (7) whether or not (a/m') 1 is satisfied.

If (a/m) = 1, the process proceeds to step 1; otherwise, it is determined that the prover is not valid and the operation is terminated.

The following steps T to Step 21 f n = log
Turn around 2m times.

Step 7: The verifier randomly selects rQεc tt m−11Cxε(0,1) using the random number generator (8).

Step B: The confirmer uses an arithmetic device to calculate that if C = 0, then x =: r O2,CX ''1, then z = ar (1
Calculate 2.

Step 9: The confirmer sends the calculation result X to the communication line (5)
Through, testimonies, sent to intermediaries.

Step 10: The confirmer uses the random number generator (8) to create two random sets (however, the size is n=log2m) T=(tl, t2.-・, tn: J=r1modm)
).

3 = (kn+1, tn+2.・”, t2n:
ti= ar12 nod m )(tjE
[:1. m-1] j=1. −． 2n).

Step 11: The confirmer uses the random number generator (8) to
'S through the communication line (5) in a random order,
Send it to the certifier.

Step 12: The prover uses the random number generator (1) to
S Id, n (D, T""S' DH subset Z (CT"S) is selected at random.

Step 13: The prover sends the above 2 to the verifier through the communication line (5).

Step 14: Confirmer for each element 2θ2 of 2.

z = r2mod m or z = ar2m
r that satisfies ad m is calculated using the arithmetic unit (7). If the sizes of T-Z and S-Z differ by d, confirmer B uses a random number generator to randomly select d sets t11. from the larger set of T-Z and S-Z. ...,t
Select tct, tij −”ri j2mod
m or jij-”ri that satisfies Arlj2modm
l*”” and rid are calculated using the arithmetic unit (7).

Step 15: The confirmer is the ri1. ...+ 'id
is sent to the prover through the communication line (5).

Step 16: The prover uses the above ri1*..., rid is tij :l: rij2mod m or t1j=
ari''2nod m is satisfied.

Step 1T: The confirmer is X ”T Z (ttl, -, tfd)y=s
-z -(tll, ...°, ttd).

If Cx20, that is, x:ronodm.

X' = (r(Iri =: Dragon mad m l t
iεX)Y' = (yrori = 2 moc!
m 1tilEY )CX=1 or 1”Yrc3
If it's modm.

X = ()'rori =M nod m IJεX
)Y'= (rori = F mouth nod m l Jf
EY) is obtained using the arithmetic device (7).

Step 18: The confirmer uses the random number generator (8) to
The elements of 'Y' are sent to the prover in a random order through the communication line (5).

Step 19. The prover will be sent by the verifier x/
Check whether the element of '-' y/ is in the correct form. In other words, for any element W of X"'Y', for any element t1 of some X""Y, w2 = xt1 modm or w" = yx t i mod m, and lx"y'l >n/3 using the arithmetic device (3).

Step 20: If the above judgment result is correct, the prover
Send v=Qm(x) to the confirmer through the communication line (5). If it is not correct, cancel the operation.

Step 21: The confirmer uses the arithmetic device (7) to confirm whether or not v''CX. If v=Ce, return to step 6. If v*C1, the confirmer cancels the operation.

[Problem to be solved by the invention]

The conventional method is configured as described above.

The prover can convince the confirmer that he has the ability to calculate Qm without revealing any information other than that the random number a generated in step 1 is a square non-residue number. However, considering that a verifier who does not know the prime factors of 9m cannot obtain the information that random number a is a square non-remainder number, the authentication method using this device is based on the fact that random number a is a square non-remainder There was a problem in that important information such as numbers was definitely leaked.

The invention thus provides a safe and reliable way to convince all provers that the prover possesses the ability to calculate Qm without divulging important information such as that a certain number is a square non-residue number. The purpose is to obtain a certification system.

[Means to solve the problem]

The authentication method according to the present invention includes a prover-side random number generator that generates random numbers by the prover's operation, a prover-side arithmetic unit that performs a calculation by the prover's operation, and a prover-side random number generator that generates random numbers by the prover's operation. A determiner that determines whether a positive integer is a square remainder or a non-square remainder under the modulus N, and a random number generated by the random number generation means on the prover side and the calculation means on the prover side. A storage device that stores the calculation results obtained by and data sent from the confirmer, a confirmer-side random number generator that generates random numbers according to the confirmer's operations, and a confirmer-side arithmetic unit that performs calculations according to the confirmer's operations. , a storage device for storing random numbers generated by the random number generation means on the verifier side, calculation results obtained by the arithmetic means on the verifier side, and data sent from the prover; A communication line that communicates with the device, and a certification that the verifier enters only one square remainder number among multiple square non-residue numbers and does not tell the verifier the location of the square remainder number. Send the data to the reviewer,
By repeating questions and answers using this authentication data, the certifier knows an algorithm to efficiently calculate whether the prover is really a square remainder or a non-square remainder. Included is to confirm that you have a computing device.

[Effect]

The prover uses a random number generator and an arithmetic unit to compose authentication data in which only one square remainder number is included among a plurality of square non-residue numbers, and sends it to the verifier. The verifier uses a random number generator and an arithmetic unit to randomly permute the authentication data based on the authentication data sent from the prover, and then multiplies each component by the square remainder to form nine question data and sends it to the prover. send. The prover confirms through communication with the confirmer that the confirmer is sending the question data correctly, and then uses a 0 judgment device to determine the order of cyclic permutation for the question data sent by the confirmer as the answer data. and send it back to the confirmer. The verifier performs authentication based on whether the answer data sent from the prover is correct.

[Examples of actual inventions]

Hereinafter, one embodiment of the present invention will be described in detail.

FIG. 1 is a block diagram illustrating an example of this authentication method. In the figure, (101) is a random number generator that generates random numbers by the operation of the prover.

(102) is a memory for storing random numbers generated by a random number generator, calculation results output from an arithmetic device, and data sent by the certifier through the operation of the certifier.

(103) is an arithmetic device that performs arithmetic operations by the prover's operation.

(104) calculates Qm by the prover's operation.

A determination device that determines whether a given number is a square remainder, (105) is a communication line used by the prover and the confirmer, and (106) is a random number generator generated by the confirmer's operation. A memo that stores random numbers, calculation results output from the calculation device, and data sent by the confirmer! ,I,
(107) is an arithmetic device that performs calculations according to the operation of the confirmer.

The device configuration as described above is realized by, for example, an IC card and a computer system.

Next, the operation will be explained.

Step 1: The user generates a positive integer random number a using a random number generator (101) and stores it in the memo IJ (102).

Step 2: The prover memorizes the random number a (102
), and the arithmetic unit (105) is used to determine whether the random number a is coprime to m, that is, whether it satisfies (a, n'+)=1. If (a, m) = 1, go to step 3, (-, m) #
If it is 1, return to step 1.

Step 3: Memoize prover 1-j@memory random number a IJ (1
02), and the arithmetic unit (103) is used to determine whether the original Jacobian symbol of the modulo m of the random number & is 1, that is, whether (a/m)=1 is satisfied. If (a/m)=1, go to step 4, (a/m)=
If it is -1, return to step 1.

Step 4: The prover memorizes the random number a) (102
), and it is determined using a 0 determination device (104) whether the random number a is a square non-residue, that is, whether it satisfies Qm (a) = 0. If Qm (a) = 0, go to step 5.
If Qm(a) =:1, return to step 1.

Step 5: The prover uses a random number generator (101) and an arithmetic unit (103) to generate q rows p whose components are positive integer random numbers.
Column random number matrix R = (rij) O≦l≦pt, o≦j≦
q-L (where each rij is coprime to m) is stored in the generation memory (102).

Step 6: The prover uses a random number generator (101) to generate an integer random number vector B = (bo, ... * bq-1)
(0≦bj≦p-1) is generated and stored in the memory (102).

Step 7: The prover reads the random number vector B of positive integers, the random number a of positive integers which is the square non-residue, and the random number matrix R from the memory (1[11), and calls the arithmetic unit (105).
Using.

Calculate the authentication data s = (8Ij) o≦i≦p−
Construct 1゜0≦j≦q−t and memo') (102)
to be memorized.

Step 8: The prover memorizes the authentication data S
(102) sends it to the confirming person who will be the communication partner through the call 9 communication line (105).

Step 9: The verifier stores the authentication data S sent by the prover in the memory (106), and stores each S of the authentication data S.
The arithmetic unit (107) is used to check whether the Jacobian symbol (s t J/N) of ij is 1 or not.

Step 10 to Step 21 below = log2m
Repeat times.

Step 10: The confirmer uses a random number generator (108) to generate an integer random number vector C=(co,...,cl)-(0≦ej≦p~1) and a positive integer random number as components. Random number matrix T = (tfj) with q rows and p columns 0≦i≦p-1, 0≦j
≦q-1 is generated and stored in the memory (106).

Step 11: The verifier takes note of the authentication data S sent by the prover and the random number vector C1 random number matrix T generated by the verifier's random number generator (108)') (106
) using the Yoshi call arithmetic unit (io7).

G (i, j) = = (i + ajrriod p,
j ,)uij"5G(i,j)・Vij""tij2Xuij rnodN is calculated, and the question data v=(vij)o≦i≦p−1゜0≦j≦q−
1 and stores it in the memory (106).

Step 12: The confirmer stores the question data ■ in memory (1
06) and sends it to the prover through call 1 communication cycle l5 (105).

Step 13: The prover uses the random number generator (,01) to randomly select W numbers (eo,..., ew-1) (from (o, 1..., q-1)). However, 61#6j
) and check data E = (eo, ”・, e
w-1)' is stored in the configuration memory (102).

Step 14: The prover calls the @recorded random number vector E from the memory (102) and sends it to the verifier through one communication cycle l (105). .

Step 15. The verifier stores the verification data E=(eo,...+eW-1) sent from the prover in memory (1
06), and transform data T for each Q j of E
CE]= (tij) 0≦i≦p −4, j EF
C'[E') = (ej) Recall jEE from memory (106) 0 communication line (105)
send to the prover through

Step 16: The prover stores the conversion data sent from the @confirmer in the memo U (102), and determines whether the conversion data is valid, that is, G (t, j) = = (i + cjmnd p, j)
The arithmetic unit (103) is used to check whether ulj"5G(LJ)·vij""tB2Xul jmad N holds true for all O≦i≦rs-t, jEE.

Step 11: The prover is randomly selected (eO*...).

"Excluding W-11 < (0, 1, -, h from q-11
is selected and stored in the memory (102).

Step 18: The prover determines whether each Vij in the h rows of the question data V sent from the verifier is a square remainder,
The position of the square remainder is set as dh (0≦d≦p−1) and stored in the memory (102).

Step 19: The prover stores the calculation result dh obtained by the calculation means and the random number bh in a memory (102
) and use the arithmetic unit (1003) to write 0rdh.
=dh-bhn+odp is calculated to form judgment data (h, 0rdh) and stored in the memory (102).

Step 20: The prover uses the judgment data (h).

0rdh)! J, (102) sends it to the confirmer through the call 2 communication line (105).

Step 21: The confirmer stores the random number Ch in memory (10
6), and check whether the random number Ch and the 0rdh sent from the prover match.

In addition, in the above example, the prover and confirmer were explained, but
Needless to say, this can be realized using equivalent objects such as an IC card and a terminal.

〔Effect of the invention〕

As described in detail above, in the present invention, the prover sends the verifier authentication data in which only one square remainder number is included among a plurality of square non-residue numbers. However, the location of the square remainder is not known, and the verifier uses this authentication data to know an algorithm that efficiently calculates whether the prover is really a square remainder or a non-square remainder. . Alternatively, the fact that the verifier has a computing device is confirmed through repeated questions and answers, so the verifier uses this authentication system to obtain only one piece of information from the authentic prover in the authentication data initially sent from the prover. This means that there are two square remainder numbers, and we cannot obtain information about which elements are square remainder numbers or non-square remainder numbers. Therefore, the prover can perform highly secure authentication without leaking useful information compared to an authentication device using the conventional GMR method.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing the configuration of a device that implements the authentication method of the present invention, and FIG. 2 is a block diagram showing the configuration of a conventional device. <11 is a random number generator on the prover side, and (2) is a memory on the prover side. (3) is the prover side arithmetic device, (4) is the prover judgment device,
(5) is the communication line, (6) is the confirmer's memo! J, (7)
is a calculation device on the verifier side, (8) is a random number generator on the verifier side,
(101) is a random number generator on the prover side, and (102) is a memory on the prover side. (103) is the prover side arithmetic device, (104) is the prover judgment device, (105) is the communication line, (106)
is a memo from the confirmer! J, (107) represents an arithmetic unit on the verifier side, and (108) represents a random number generator on the verifier side.

Claims (2)

[Claims] (1) In a system that performs authentication communication, the prover composes authentication data by performing calculations on random numbers generated by the prover,
This authentication data is sent to the verifier, the verifier performs arithmetic operations on the authentication data and the random numbers generated by the verifier, composes question data, and sends this query data to the prover. An authentication method characterized in that answer data corresponding to the authentication data sent by the prover is sent to the verifier, and the verifier performs authentication by checking whether the answer data sent from the prover is correct. (2) In the authentication method according to claim 1, after the prover receives the question data from the confirmer, the prover performs an operation on the random numbers generated by the prover to form confirmation data and sends it to the confirmer; The verifier sends the conversion data used when configuring the question data from the authentication data to the prover in accordance with the confirmation data sent from the prover, and the prover converts the conversion data and authentication data sent from the confirmer to the prover. , an authentication method characterized by checking whether question data corresponding to confirmation data is a correct answer, and the prover sending answer data corresponding to the authentication data sent from the confirmer to the confirmer.