JPS59154837A - Pass word verifying system - Google Patents

Abstract

PURPOSE:To prevent the interception of a pass word by dividing the pass word into a fixed part and a dynamic modification part, ciphering the ciphered fixed part together with the dynamic modification part further and transferring the result to an opposite device together with an identifier of user for verifying the device. CONSTITUTION:The fixed part (comprising user storage section 1 and fixed storage section 2) in the pass word is ciphered. The dynamic modification identifier 6 corresponding to the opposite party identifier 11 is read, the dynamic modification part 3 is read based on the identifier 6 from the storage section, ciphered together with the chiphered f(4) fixed part further and the ciphered result f(f(4)* 3) is transmitted to the opposite device 10. The user identifier 5 and the dyanmic modification identifier 6 are transmitted from a device 8, the cipher (4) and the dynamic modification part 3 are read from tables (5, f(4)), (6, 3) based thereupon, the result is ciphered and collated with the cipher transmitted from the device 8. Verification is finished when the result of collation is coincident with each other.

Description

DETAILED DESCRIPTION OF THE INVENTION (1) Description of the field to which the invention pertains The present invention relates to a password for authenticating a user of a partner device or the device using a password between two devices connected by one communication line. This invention relates to a password authentication method that prevents theft and eavesdropping of information.

(21 Description of conventional technology) Conventionally, as a password authentication method, a method that uses only the password that the user remembers has been widely used. There is a possibility that the 1974
Common-catlong of August issue
Byans et al.'s paper published in the ACM Vol. 17, No. 8, pp. 467-442 @A UserOut
hentlcation Scheme Not Re
quiring 5ecrecy 1nthe Com
puter", a method has been proposed to protect passwords from being copied from transmitted or stored information by converting passwords using a one-way function, but this method requires users to memorize passwords. The number of digits required for passwords must be large, and it is not possible to deal with situations such as when a password is intercepted when input, or when information intercepted on the line is leaked from the middle of the line and the user is disguised as a legitimate user. There are drawbacks.

(3) Purpose of the Invention The purpose of the present invention is to solve the drawbacks of each of the above-mentioned methods, and to reduce the amount of information stored by the user regarding passwords, and to prevent wiretapping during password input and wiretapping during transfer. This is to deal with the introduction of false information mid-way through the process, the molding of stored information for verification, etc.

(4) Explanation of structure and operation of the invention In order to achieve the above-mentioned object, the present invention provides a part for fixing passwords (
The fixed part is divided into a part that changes dynamically (dynamic change part) and a part that is stored by the user (user storage part) and a part that is recorded on a recording medium such as a card. (fixed recording section), the fixed section is encrypted, the fixed section is further encrypted together with the dynamic change section, and it is transferred to the other device along with the authentication identifier to authenticate the user or the device. The content of the present invention will be explained in detail below with reference to one drawing.

FIG. 1 shows the structure of the password. As shown in the figure, the password is composed of two parts: a fixed part 4 and a dynamic change part 3. 4 is a part whose value is fixed once it is determined, and is a part where the value is dynamically changed according to the rules described later in 3. Furthermore, 4 is recorded in the user storage unit 1 where the user memorizes and inputs directly by keying in, and in a recording medium such as a card or device.

It is constituted by a fixed recording part 2 that is read out simultaneously with the input of 1. 6 is recorded on the recording medium in the same way as 2.

Examples of recording formats for 2 and 3 include a format in which 2.3 is recorded on a card, a format in which 2.3 is recorded in a device, and a format in which 2 and 3 are recorded on a card and 3 is recorded on a device.

FIG. 2 is a diagram illustrating a procedure for authenticating a user using the above password. The user of the transmitting device to be authenticated inputs the stored user storage unit 1 into the device 8. Further, reference numeral 8 reads out the fixed recording section 2 and the dynamic changing section 3 from the recording medium. Note that this figure shows the case where 3 is read from the internal recording medium of the apparatus. If there are multiple partner devices 10 to be authenticated, input the partner device identifier 11, and 3 is recorded in the device (11.
6) and (6, 3) are extracted using 11 as a key (6 will be described later). Next, information on the connection of 1 and 2, that is, the fixed part 4 (hereinafter, this connection will be represented by ■), that is.

1■2-4゜For example, '10'■'110'-Ma101
10ma) is encrypted with f to make f(4), and then concatenated with 3, f(4)■ Applying f to 3, f<f14
)■3) is generated.

Here, the encryption f is a one-to-one conversion, and can be roughly divided into the following two types. (1) Transformation using a one-way function,
(Il+conversion using existing keyed encryption method.

Regarding the unidirectional function (1), an example of realization is shown in the paper by EVang et al. mentioned above, and has been realized in recent years.

It is used in public key cryptography and was published in IEEE Transaction on Infor in November 1975.
tion Theory, Volume 22, No. 6, 64
Diffle et al.’s paper published on pages 4 to 654”
New Direction in Cryptog
Another implementation of a one-way function is shown in ``Raph''.

Several other implementation examples have also been reported.

Note that a one-way function is one in which, given the transformation f and variable 2, f (Here, it is an inverse function of f''Fif.)

The keyed encryption method for (11) is the American NB
There is the R8A method, which is one of the DES+public key encryption methods standardized by S. In both cases, encryption is performed using a key, and if the function that performs encryption using key A is expressed as EA, then it is used in the present invention.

/ becomes -EJ. As shown above, there are various ways to realize f, but the present invention does not specify which one to select.

Note that when f is realized using method (1).

The algorithm for encryption f is basically made public. On the other hand, when f is realized using the method (11), the encryption/=EA decryption key is kept private. (In the case of DES, the decryption key is 4°R8A, the decryption key is not A).

Next, the f(/f41
(3) is transferred to the partner device 10 together with the authentication identifier.

Here, the authentication identifier refers to the user identifier 5 and the dynamic change unit identifier 6, but 6 is an option. 6 is the value determined for the pair t (s, 1o), 6fi,
This is the key for reading 3 from the table in 10.

Note that 5 and 6 are keyed in by the user or read from the recording medium at the same time as 1, 2, and 3 are input and read.

Next, in step 8, after confirming that the transfer was performed correctly,
Procedure for changing the value of 3 in advance (for example, adding the value t1r to the old value of 3 becomes the new value of 3)
The changed value is recorded on the recording medium as the value 3, and the old value is deleted.

/ (/ f4+■3) and received the authentication identifier 1
0, after reading f(4) and 3 stored in advance using the authentication identifier, generates /(/(4)■3) and verifies the user's authenticity by comparing it with the transferred information. authenticate gender.

The case where 5 and 6 are used as the authentication identifier will be described in more detail below, but when 6 is not used, 5 is used instead of 60.

First, 10th Hiro was registered in advance (5, / +41
') and C6,3> pairs are stored as a table.

When the information of / (/ (41■3), 5.6 is sent from 8, 10 reads 7141, 3 from each table using 5.6 as the key. Next, from them / (/ f41■3) and the transferred f
(/f4+■!1), and if they are the same, the user is recognized as the correct user. If they are different, it is possible that the values of 3 are 8 and 10 and are out of synchronization.

Performs synchronization processing.

Assuming that each device in 8.10 is functioning normally, it can be considered that synchronization will occur at most once, and due to the procedure 8.10. is 8 than changing the value of 3 first
It is assumed that the synchronization process is performed for the state that has been advanced one time. Therefore.

In step 10, if the user's legitimacy is denied by the verification process, the value of 3 is advanced and changed only once, and the verification process is performed again. If the user is recognized as a valid user at this stage, the user is recognized as 11, and if the user is not recognized at this stage, the user is deemed to be an unauthorized user and the value of 3 is returned to its original value. For synchronization errors that cannot be addressed by the above synchronization, the 8.10 operator performs 3 resetting.

In step 10, after the above matching process, the value of 3 is changed in the same procedure as in step 8, and the new value is written in the table while the old value is deleted. Next, the verification result 7 obtained in the above process (information on whether the user is recognized as a valid user or an unauthorized user) is transferred to 8.

Now, regarding the above-mentioned encryption f, the following implementation method is also possible. In other words, after performing the encryption f that is the one-to-one conversion described above, the resulting information (for example / +4
1) (for example, if the information length of /T41 is 100 bits, the first 50 bits of f(4) are extracted), and the result of encrypting t is #(4).
). Then, all encryption f in the above description is replaced with encryption t.

Since this encryption t is a many-to-one conversion, it is possible to make the decryption key public even if an existing keyed encryption method is used as f.

Additionally, the authentication process result information was intercepted during transfer.

If you want to protect against forgery, use the following method. First, in 10, match result 7 is / (/ +41■3■
7), transfer it to 8 together with 5, perform the same encryption in 8 based on 5, and compare it with the transferred information to obtain 7.

In addition, Fig. 2 and Fig. 3 (al, (b) described later)
), the information surrounded by bold lines is physically and logically isolated from the outside (for example, it is placed in a strongly protected box), and access from outsiders is strongly restricted. 2 etc. to encrypt data).

No one other than a special operator can read or write the information inside.

Next, an example is shown in FIG. Figure 3 (a) shows an example in which 1 is input by the user by keying in, 2 is recorded on a card and input by card input, and 3 is read out from the memory of 8 in synchronization with this. .

Further, it is assumed that there is no plural number 10 that performs authentication for 8, and the partner device identifier 11 is not used.

At this time, only one value of (6, 3) exists within 8.

In this embodiment, there is no need to add 3 to the user response, so a read-only card can be used;
Since the table in (6.5) is independent from user-specific information, it is isolated from operations such as registration, modification, and deletion of user-specific information.

It has the characteristics of high safety against theft etc. mentioned in 3.

In FIG. 3(b), the user enters 1 by keying in.

An example is shown in which 2.3 is recorded on a card and input by card input. In this case, since 3 is determined by the user, the table that stores 10 3s is composed of a pair (5, 3).

In this example, a card with a writing function is required.
10, even if an unauthorized write is made to the table (5,/(41)), the table (5,3) is protected, so it is safe.

Next, as an example of an information length of 1, 2.3, 1 in decimal notation is
By setting 4 to 6 digits, 2 to 10 to 15 digits, and 3 to 3 to 10 digits, the information length becomes sufficiently safe and easy to implement in practice.

Note that in consideration of applicability in implementation, either 1 or 2.3 may be set to 0 digits (that is, not used). for example,
When authenticating the device, 1 is assumed to be a 0 digit.

(5) Description of Effects As is clear from the above explanation, according to the present invention, even if / (f + 4 + ■ 3) in the transferred information is intercepted from the 9 line, due to the nature of the encryption f, the It is difficult to derive .3, and since 3 changes every time, / (/ +41 ■ 3) eavesdropped from 9 lines etc. cannot be used later, and from the information accumulated in 10, f Even if (4) is in the temperature range, it is difficult to find 1゜2 due to the nature of f, and even if one of 1 or 2 held by the user is stolen, the other is unknown, so it is safe. Even if the amount of information in 1 is reduced, the amount of information in 2 and 3 is increased to an appropriate size.For example, even if 1 is made into a 4-digit decimal number, 2 becomes 1.
Security is guaranteed by setting it to 0 digits (it is sufficiently secure if it is set to 0 digits), and it makes sense by encrypting the result information even if the authentication result information from 10 to 8 is illegally transmitted from the middle of the line. For reasons such as the inability to disseminate certain fraudulent information, the following effects can be obtained.

(1) The amount of information that the user memorizes can be reduced, and the user's memorized password that has been used in the past can be used as is (no need to change the man-machine interface).

(11) Safe against wiretapping and temperature range.

(III) It is safe from prying eyes when inserting passwords or theft of cards, etc.

(1v) It is safe against unauthorized access to the storage table for authentication processing.

(■) It is safe from fraudulent acts caused by the inflow of fraudulent information over the line.

[Brief explanation of drawings]

Fig. 1 is an explanatory diagram showing the password structure in the present invention, Fig. 2 is a diagram showing the execution procedure of the process in the present invention, Fig. 3 (a), Fig. 3 (bl is a diagram showing an embodiment) In the figure, 1 is a user storage section, 2 is a fixed recording section, 3 is a dynamic change section, 4 is a fixed section, and 5 is a user identifier.6 is a dynamic change section identifier, and 7 is authentication processing result information. 8 is a transmitting device (authenticated device), 9 is a line, 10 is a receiving device (authenticating device), 11 is a partner device identifier (identifier of 10), 12 is a user, 13 is a read-only card, 14
indicates a read/write card. Patent applicant: Nippon Telegraph and Telephone Public Corporation Patent attorney Mori 1) Hiroshi'$ 1 mouth

Claims (3)

[Claims] (1) In a system that performs authentication processing for the user of the other device or the other device using a password and an authentication identifier between two devices connected by a communication line, the password is divided into a fixed part and a dynamic change part. , one to one to the fixed part
Performs conversion and encryption. Furthermore, the encrypted version of the dynamic change part is sent to the other device along with the authentication identifier, and the receiving device stores the encrypted fixed part and the dynamic change part at the same value as the sender. The information is searched using the authentication identifier as a key and then encrypted. By checking the information transferred from the sender,
A password authentication method characterized by authenticating the user or the sending device. (2) In the above paragraph 1, one-to-one encryption is used.
A password authentication method that is characterized by encrypting a many-to-one conversion in which a part of the encrypted information is extracted after performing encryption, which is conversion. (3) The password authentication method according to the above item 1, characterized in that the result information after verification is encrypted when transferred to the partner device.