JPH0621939A - User confirming system - Google Patents

Abstract

PURPOSE:To confirm the propriety of a user by inspecting the propriety of the digital signature of the user with use of the random numbers transmitted from the open and secret keys of the digital signature and an opened unidirective function and based on both keys and the identification information. CONSTITUTION:A confirmer 200 retrieves an open key A out of a control list 270 based on the ID of a confirmed person 100 and generates a random number R by a random number generator 210 to send the number R to the person 100. Meanwhile the person 100 generates a random number U with use of a random number generator 110 and calculates M=F (R, U) from both numbers R and U by means of a unidirectional function computing element 140. Then the person 100 takes a secret key B out of a memory 150 and calculates S=GB (M) by means of a signature producer 180 to send S and U to the confirmer 200. The confirmer 200 calculates M=F (R, U) based on a unidirectional function F by means of a unidirectional function computing element 240 and inputs the key A to a signature inspector 290 to inspect whether a signature inspection function VA (M, S)=0 is satisfied or not.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method of confirming the identity of a sender, and more particularly to an efficient user authentication method which is highly secure and can reduce the amount of communication.

[0002]

2. Description of the Related Art Conventionally, the proposed method is F
There are iat and Shamir methods. This is as follows.

[Outer 1] Calculation of the square root in the above (mod N) is performed by calculating the prime factor (P
And Q) are known. The method is described, for example, by Rabin MO in "Digitalized Sign".
aturesand Public-key Functions as Intractable a
s Factorization "(Tech.Rep.MIT/LCS/TR-21
2 MIT Lab. Computer. Sci. 1979).
A concrete configuration example of the square root calculation device is described in the patent application “Public Key Cryptography System” by the applicant (Japanese Patent Application No. 61-169350).
No.). Sender A is authenticator B
On the other hand, the following procedure proves that A is genuine.

[Outside 2] For details of the above method, see Fiat A. and Shamir.
A: “How to proveyourself: Practical solution t
o identification and signature problems ", Proceedi
ngs of Crypto 86, Santa Barbara, Aug. 1986, pp.
It is described in 18-1-18-7. This method has been proved to be safe by a computational theory method. In other words, this method is a zero-knowledge proof.
Proven in the paper by T and Shamir. If the user authentication method is zero-knowledge proof, any fraudulent activity is difficult, but it is guaranteed from the viewpoint of computational complexity theory.

[0003]

[Problems to be Solved by the Invention] However, Fiat and Sham
In the ir method, the number of bits of the message is (1000 × t + k × t)
Since it is a bit and it is necessary to select k and t of a certain size to secure security, the amount of communication increases,
The problem is that the amount of transferred information is large. The present invention has been made in view of the above circumstances, and its object is to:
It is an object of the present invention to provide a user authentication method capable of solving the above-mentioned problems in the conventional technique and reducing the amount of transferred information.

[0004]

The above-mentioned object of the present invention is a system for realizing user authentication for confirming the legitimacy of a user, characterized by including the following items: It is achieved by the authentication method. (1) In the initial information setting step that the user performs only once when joining the system, (a) the user (authenticatee) who has joined the system generates a public key and a secret key of a digital signature, and stores the secret key. It is kept secret, and the public key is paired with the identification information (ID) of the person to be authenticated as public information and registered in the public key management list or the certifier management list. (2) In the authentication processing stage after the initial information setting stage, (a) First, the person to be authenticated transmits his / her own ID to the authenticator. (b) The authenticator receiving the ID generates a random number R after searching the public key in the management list based on the ID, and sends the random number R to the authenticated person. (c) The authenticated person who receives the random number R generates a random number U and then uses the public one-way function F to obtain M = F (R, U).
Is calculated, a digital signature S for M is generated using the private key of the authenticatee, and S and U are transmitted to the certifier. (d) The authenticator receiving S and U calculates M = F (R, U) using the public one-way function F, and verifies the authenticity of M and the digital signature S as the authenticated Verification is performed using the public key of the authentication person, and if the verification is passed, the authenticity of the authenticated person is confirmed.

[0005]

In the above-mentioned Fiat and Shamir method, since the authentication process is basically configured by repeating Yes / No (1 bit) question and answer, the communication amount increases, whereas Since the user authentication method according to the invention is basically configured to perform a query response of several 100 bits only once, it is possible to reduce the communication amount. It should be noted that, while the above-mentioned Fiat and Shamir method is a method limited to exponentiation, the method according to the present invention is also advantageous in that it can be configured based on an arbitrary digital signature method. .

[0006]

Embodiments of the present invention will now be described in detail with reference to the drawings. FIG. 2 is a block diagram showing the overall configuration of an embodiment of the present invention. In the figure, reference numeral 100 denotes a user (or station) to be authenticated, and 200 denotes an authenticator (or station) to perform authentication, and these are assumed to be coupled via an insecure communication path 300. First, the station 100 that has joined the system generates a public key and a private key and authenticates the public key according to the following procedure in the initial information setting stage that the station basically performs only once when joining the system. It is registered in the public key management book or the authenticator 200 in pairs with the user's identification information (ID). FIG. 3 is a block diagram showing the processing of the initial information setting stage of the station 100 that has joined the system in FIG. Here, the digital signature algorithm used for the process is determined, and the public key A and the secret key B are generated using the encryption key generator 120. A signature creation function GB used by the signature creation device, a signature verification function VA used by the signature verification device, and a one-way function F used by the one-way function calculator 140 are defined. In addition, among those defined above, the public key A and the one-way function F are the public information, and the secret key B is the secret information. As a digital signature method, a method ("A Fast Signature Sc
heme Based on Congruetial Polynominal Operation
s "IEEE Transactions on Information Theory,
vol.36, No.1, pp.47-53, 1990). With the above-mentioned one-way function, F (x) is easy to calculate, but F (x)
Is a function that is difficult to obtain from x. One-way function F
Is a high-speed conventional encryption device, for example, DES encryption (for example, Data Encryption Standard Federal Format).
ionProgressing Standards Publication 46, 1977), FEAL encryption (for example, Miyaguchi et al., "Extending FEAL encryption", NTT R & D, vol.39, No.10, pp.1439-145).
0, 1990) and hash functions (see, for example, Miyaguchi et al. “1.
28-bit hash function "N-Hash"", NTT R & D,
vol.39, No.10, pp.1451-1458, 1990) and the like. In this case, the calculation time of F (x) can be almost ignored.

Next, a user authentication procedure in which the station 100 proves its validity to the station 200 will be described.
In the following description, the station 100 will be referred to as a person to be authenticated and the station 200 will be referred to as an authenticator. Of course, the station 200 is the authenticated person,
It is also possible for station 100 to act as an authenticator. The authentication procedure will be described below with reference to FIGS. 4, 1A and 1B. Note that FIG. 4 is a diagram showing a state of communication between a person to be authenticated and a communication text of the person to be authenticated, and FIGS. 1A and 1B show a person to be authenticated 100 and an authenticator involved in the communication shown in FIG. 3 is a block diagram showing a user authentication process of 200. FIG. The user authentication procedure is as follows. Step 1: The authenticated person 100 inputs his own ID to the authenticator 2.
To 00. Step 2: The authenticator 200 searches the management book 270 for the public key A based on the received ID, then generates a random number R using the random number generator 210, and generates this random number R as the authenticated person 1
To 00. Step 3: The authenticated person 100 generates a random number U using the random number generator 110, and further, the one-way function calculator 140
After calculating M = F (R, U) from the received random number R and the above-described random number U using the one-way function F described above,
The private key B is taken out from the memory 150, and using this,
The signature creator 180 calculates S = GB (M) using the signature creation function GB described above, and sends S and U to the authenticator 200. Step 4: The authenticator 200 uses the one-way function calculator 24.
From 0, the one-way function F is used to calculate M = F (R, U) from the above-mentioned random number R and the received random number U, and the public key A retrieved in step S and M and S is subjected to signature verification. It is input to the device 290, and it is checked whether the signature verification function VA (M, S) = 0 described above is satisfied. The signature verifier 290 is VA (M, S)
If = 0 is satisfied, "pass" is output, and if not, "fail" is output. In addition, the transmission of the ID in the above step 1 is performed in the step 3
Alternatively, the search for the public key A in step 2 may be performed in step 4.

According to the above-described embodiment, as will be described below, the effects of safety and reduction of communication amount can be obtained. That is, (1) Security: Completeness: A legitimate subject (who knows B) passes with probability 1. Soundness: An unauthorized subject (not knowing B) has a negligible probability of passing because it is difficult to create a correct signature for arbitrary information M. Confidentiality: No matter what R is selected and transferred by the certifier, if the correct subject randomly selects U, the value of M will be randomly distributed, so the certifier will get a signature for a specific value. The certifier cannot obtain valid information regarding the confidential information of the authenticatee. (2) Regarding communication volume:

[Outside 3] The number of bits of the communication text is k = 4, t = when N is 512 bits
Comparing in the case of 5 (recommended value in the above-mentioned paper), the method of Fiat and Shamir: 5120 + 20 + ID bit number In this embodiment: 712 + ID bit number. In this embodiment, the communication amount is Fiat and Sh
It will be about 1/7 of the case of the amir method. This can be said to be a remarkable effect. It is needless to say that the above embodiment is an example of the present invention and the present invention should not be limited to this.

[0009]

As described above in detail, according to the present invention, a remarkable effect that a user authentication method capable of reducing the amount of transferred information while ensuring security can be realized can be achieved. Is.

[0010]

[Brief description of drawings]

FIG. 1 is a block diagram showing user authentication processing of a person to be authenticated and an authenticator in an embodiment of the present invention.

FIG. 2 is a block diagram showing the overall configuration of the embodiment.

FIG. 3 is a block diagram showing a process of an initial information setting stage of a station that has joined the system.

FIG. 4 is a diagram showing how communication is performed between the authenticated person and the authenticator.

[Explanation of symbols]

100: authenticated station, 200: certificate authority, 300: communication path,
110, 210: random number generator, 120: encryption key generator,
140, 240: one-way function calculator, 150: memory, 180: signature generator, 270: (public) management book, 29
0: Signature verifier.

[Procedure amendment]

[Submission date] August 9, 1993

[Procedure Amendment 1]

[Document name to be corrected] Drawing

[Correction target item name] All drawings

[Correction method] Change

[Correction content]

[Figure 1]

[Fig. 2]

[Figure 4]

[Figure 3]

Claims (1)

[Claims] 1. A system for realizing user authentication for confirming the legitimacy of a user, which includes the following items: (1) In the initial information setting step that the user performs only once when joining the system, (a) the user (authenticatee) who has joined the system generates a public key and a secret key of a digital signature, and stores the secret key. It is kept secret, and the public key is paired with the identification information (ID) of the person to be authenticated as public information and registered in the public key management list or the certifier management list. (2) In the authentication processing stage after the initial information setting stage, (a) First, the person to be authenticated transmits his / her own ID to the authenticator. (b) The authenticator receiving the ID generates a random number R after searching the public key in the management list based on the ID, and sends the random number R to the authenticated person. (c) The authenticated person who receives the random number R generates a random number U and then uses the public one-way function F to obtain M = F (R, U).
Is calculated, a digital signature S for M is generated using the private key of the authenticatee, and S and U are transmitted to the certifier. (d) The authenticator receiving S and U calculates M = F (R, U) using the public one-way function F, and verifies the authenticity of M and the digital signature S as the authenticated Verification is performed using the public key of the authentication person, and if the verification is passed, the authenticity of the authenticated person is confirmed.