JPWO2019188251A1 - Authentication system, authentication device, authenticated device, authentication method, authentication method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To conventionally say that the unidirectional conversion function is applied three times in an authenticated device and one-way conversion function is applied once in an authenticated device, which is conventionally said to be the fastest SAS-. There are two authentication methods, but with such an authentication method, the one-time password authentication process is not sufficiently fast and the processing load is not sufficiently small, so it is possible to add security functions to a wider range of technical areas such as IoT. It was difficult to achieve. An authentication system including an authenticated device which is an authenticated device and an authentication device which is a device for authenticating the authenticated device, and a processing speed by an algorithm for reducing the number of executions of a one-way conversion function. By realizing a secure one-time password authentication method that speeds up the process, it is possible to add security functions to a wider range of IoT technical areas such as sensors and IC tags. [Selection diagram] Fig. 5

Description

The present invention relates to an authentication device or the like that authenticates the device to be authenticated.

Conventionally, a password authentication method has been widely used in which an authentication device requires a user to enter a password when authenticating the authenticated device or the user, and authenticates the user with the validity of the entered password.

In addition, in the password authentication method, in order to ensure the security of password authentication, there are a one-time password method that uses a disposable password for each authentication and a method that authenticates using authentication information generated from the password instead of the password itself. Are known.

For example, the authentication method called SAS-2 (Simple And Secure password authentication protocol ver.2) is an example of a one-time password authentication method, and the authentication device authenticates the authenticated device by the following procedure (for example, non-authentication device). See Patent Document 1). In the following, in order to make it easier to understand the essence of SAS-2, the user identifier is omitted from the algorithm described in Non-Patent Document 1, and the one-way conversion function is also simplified and described.

14 and 15 are flowcharts showing a user authentication processing process in the SAS-2 authentication method.

In the following explanation, the symbol "←" is assigned to the left side of the right side, the symbol "S" is the password kept secret by the user, the symbol "XOR" is the exclusive OR operation, and the symbol "n" is. The number of authentications and the symbol "N _n " indicate a random number (n is a natural number of 1 or more and is used to identify the random number). The symbol "H" indicates a one-way conversion function. The one-way conversion function may be called a one-way function. The one-way transformation function is a function that can be easily calculated, but the inverse function is very difficult to calculate. The one-way conversion function is, for example, a cryptographic hash function, but its type does not matter.

First, the user registers in advance with the authentication device to be authenticated (hereinafter, this registration work is referred to as "initial registration"). Hereinafter, the procedure of the initial registration process in the user's authenticated device will be described with reference to FIG. FIG. 14 is a flowchart showing a procedure of initial registration processing of the authenticated device according to the prior art. It is assumed that the authenticated device holds the secret password S in advance.

First, the authenticated device _{generates a random number N 1} and stores it in the recording medium (step S1101). Then, the prover uses the password S held in the random number N ₁ and the secret, and stored to calculate the time authentication information A ₁ shown in Equation 1 below (step S1102).

Next, the authentication device sends the _{A 1} to the prover (step S1103). Incidentally, the prover is a if possible, a secure means to send the A ₁ to the prover. Safe means include, for example, transmission of the information by a dedicated line, mailing of a storage medium storing the information, or writing the information in advance on a device or the like that becomes a certifier at the time of shipment from the factory. Is. The initial authentication information A ₁ is the authentication information used for the initial authentication (the number of authentications n = 1).

Then, the authentication device, keep the initial authentication information _{A 1} which is sent from the prover in step S1103 to the recording medium (step S1104). The above is the procedure for the initial registration work of the authenticated device.

Next, the authentication process at the time of the nth authentication after the first time (n = 1) will be described with reference to FIG. FIG. 15 is a flowchart showing the procedure of the authentication process at the time of the nth authentication after the first time (n = 1). At this time, the authenticated device stores the password S and the random number N _n in the recording medium. Further, the authentication device stores _An (n = 1 at the time of initial authentication) in the recording medium. First, the prover is from a random number _{N n} are stored to calculate the _{A n} shown in Equation 2 below (step S1201).

Next, the authenticated device _{generates and stores a new random number N n + 1} (step S1202). Then, the authentication device, by using the _{N n + 1,} to generate the _{A n + 1} by the equation 3 below. Next, the authentication device, by using the the A _{n + 1} and A _n, to calculate the data α by Equation 4 below. Furthermore, the prover uses the the _{A n + 1} and _{A n,} to calculate the data β by Equation 5 below (step S1203).

Next, the authenticated device sends the calculated α and β to the authenticated device (step S1204). At this time, _An is the current authentication information used for the current authentication process, and _{An + 1} is the next authentication information used for the next authentication process.

The authentication device receives α and β from the authenticated device. Then, the authentication device, by using the the alpha receiving beta, calculating run _{"H (β XOR A n) XOR} α ", the operation result to verify if it matches the current authentication information A _n ( Step S1205).

Then, if the two match, the authentication device determines that the authentication of the authenticated device or the user's qualification has been established, and _{saves An + 1} in the recording medium as the authentication information to be used for the next (n + 1) authentication (step). S1206). On the other hand, if the two do not match, the authentication device determines that the authentication has not been established, and performs processing such as sending an error message (step S1207). Then, the processing according to this flowchart is completed. Through the above processing, the authentication device authenticates the authenticated device or the user who has requested the authentication.

Takasuke Tsuji, 2 others, "Simple And Secure password authentication protocol, ver. 2 (SAS-2)", Technical Report of IEICE Technical Report Book, 2002, OIS2002-30, Vol. 102, No. 314, p7-11

When the one-time password authentication method is used in the upper layer, the authentication only needs to be performed once at the beginning of the process, so it does not require much speed performance. When the one-time password authentication method is used in the upper layer, for example, the one-time password authentication method is used for authentication at the time of login to the cloud service system or the application providing service system.

In addition, in the lower layer, when using the authentication information as a key delivery means such as generating an encryption key in the seeds for encrypted communication, if a relatively large amount of ciphertext is generated using the set key, the key delivery The authentication method used for is not required to have such high speed performance. It should be noted that "high speed performance" in the authentication method is a feature that is almost equivalent to "small processing load".

However, with the development of IoT technology, etc., in the realization of secure communication with devices whose processing performance is not so high in low layers, the higher the speed performance of the one-time password authentication method used for authentication or key distribution, that is, The smaller the processing load, the wider the range of applications.

The SAS-2 authentication method shown in the above background technology is a one-time password authentication method having the highest speed performance in the currently known technology.

The speed performance of the one-time password authentication method is determined by the operation used, but usually the one-way conversion function is realized by combining many operations such as exclusive OR and addition, so it is one-way. The processing load of the conversion function is heavy. Therefore, the load of each operation of exclusive OR and addition can be almost ignored as compared with the load of the operation by the one-way conversion function. Therefore, the speed performance of the one-time password authentication method can be evaluated by the number of times the one-way conversion function is applied.

Conventionally, in the SAS-2 authentication method, which is said to be extremely high speed, the one-way conversion function "H" is applied three times in the authenticated device (see steps S1201 and S1203). Reusing A _n generated in step S1201 are previously stored, the authentication apparatus can be a number of applications of the one-way conversion function twice. The one-way conversion function is applied once in the authentication device (see step S1205). That is, the number of times the unidirectional conversion function of the SAS-2 authentication method is applied is 3 times for the authenticated device and 1 time for the authenticated device. If the previously calculated authentication information for this time is stored, the number of times this one-way conversion function is applied is twice for the authenticated device and once for the authentication device.

That is, in the prior art, it is necessary to apply the one-way conversion function at least once in both the authentication device and the authenticated device, and a terminal having a low processing capacity is used in response to the progress of IoT technology and the like. In some cases, the speed of the one-time password authentication process is not sufficient, and the processing load may be too large.

In view of this, the present invention realizes a secure one-time password authentication method that can increase the processing speed and reduce the processing load as compared with the conventional SAS-2 authentication method that has been said to be extremely high speed. By doing so, it is aimed to realize the addition of security functions to a wider range of technical fields such as IoT.

The authentication system of the first invention is an authentication system including an authenticated device which is an authenticated device and an authentication device which is an apparatus for authenticating the authenticated device, and the authentication device is the nth. first data authentication information _{(a n)} and (n + 1) th authentication information _{(a n + 1)} calculation of the exclusive OR between _{(a n XOR a n + 1} ) first data acquired with the (alpha) is stored The storage unit, the first transmission unit that transmits the first data (α) to the authenticated device, the first data (α) transmitted by the first transmission unit, and the nth authentication information ( _An ). The first operation is performed using the n + 1 authentication information ( _{An + 1} ) acquired by using the exclusive logical sum operation (α XOR _An ) with and the nth authentication information ( _An ). The first receiver that receives the acquired second data (β) from the authenticated device and the first data (α) transmitted by the first transmitter are the sources from which the first data (α) is acquired. A predetermined relationship between the result of the first calculation using the authentication information ( _An ) of n and the authentication information ( _{An + 1} ) of the n + 1 and the second data (β) received by the first receiver. A first authentication unit that determines whether or not the data is provided, and a first authentication result processing unit that performs processing using the determination result of the first authentication unit, and the authenticated device includes the nth authentication information. A _{second authentication information storage unit in which (An} ) is stored, a second receiving unit that receives the first data (α) from the authentication device, the first data (α), and the nth authentication information. (a _n) exclusively performs the operation (α XOR a _n) of the logical sum of the second exclusive OR unit that acquires the (n + 1) of the authentication information (a n _{+ 1),} the second exclusive-OR section The second calculation unit that performs the first calculation and acquires the second data (β) using the n + 1 authentication information ( _{An + 1} ) and the nth authentication information ( _{An) acquired by} It is an authentication system including a second transmission unit that transmits the second data (β) to the authentication device.

With such a configuration, the one-time password authentication process can be performed at high speed.

Further, the authentication system of the second invention further includes a first symbol storage unit for storing the symbol n in the authentication device for the first invention, and the first transmission unit is the n. And the first data (α) are transmitted to the authenticated device, and the second receiving unit receives the n and the first data (α) from the authenticated device, and the second exclusive logic. OR unit performs said first data (alpha), the calculation (alpha XOR a _n) of the exclusive OR of the authentication information (a _n) of the n corresponding to n of the second receiving unit receives , An authentication system that acquires the n + 1th authentication information ( _{An + 1).}

With such a configuration, the one-time password authentication process can be performed at high speed.

Further, in the authentication system of the third invention, with respect to the first or second invention, the authentication device has a first password storage unit for storing a password (S) and an n + 1 random number (N _{n + 1).} ), The exclusive OR calculation (SXOR N _{n + 1} ) of the password (S) and the n + 1 random number (N _{n + 1} ), and the calculation result is acquired. The exclusive OR unit and the first conversion unit that applies the unidirectional conversion function H to the operation result acquired by the first exclusive OR unit to acquire the n + 1 authentication information ( _{An + 1).} Further, the first exclusive OR unit is an exclusive OR of the nth authentication information ( _An ) and the n + 1 authentication information ( _{An + 1} ) acquired by the first conversion unit. The operation ( _An XOR _{An + 1} ) is performed to acquire the first data (α), and the first data (α) transmitted by the first transmission unit is the first acquired by the first exclusive OR unit. One data (α), _{the first operation is performed using the nth authentication information (An} ) and the n + 1 authentication information ( _{An + 1} ), and the first operation result is acquired. The first authentication unit further includes a calculation unit, and the first authentication unit has a predetermined relationship between the first calculation result acquired by the first calculation unit and the second data (β) received by the first reception unit. It is an authentication system that determines whether or not to have it.

With such a configuration, the one-time password authentication process can be performed at high speed.

Further, in the authentication device of the fourth invention, with respect to the third invention, the first random number generator generates the first random number (N ₁ ), and the first exclusive OR unit generates the first exclusive OR. The exclusive OR calculation (SXOR N ₁ ) of the password (S) and the first random number (N ₁ ) is performed, the first calculation result is acquired, and the first conversion unit performs the first conversion unit. The unidirectional conversion function H is applied to the first calculation result acquired by the exclusive OR unit to acquire the first authentication information (A ₁ ), and the first transmission unit obtains the first authentication information. The second receiving unit is an authentication system constituting the authentication system, which transmits (A ₁ ) to the authenticated device and receives the first authentication information (A _1).

With such a configuration, the one-time password authentication process can be performed at high speed.

Further, in the authentication system of the fifth invention, for any one of the first to fourth inventions, the first data (α) stored in the first data storage unit in the authentication device is Using the n + 1 authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth confidential information (M _n ), the exclusive OR calculation ( _{An + 1} XOR _An XOR M) _n ) is performed, and the second exclusive OR unit is the first data (α), the nth authentication information ( _An ), and the nth confidential information (M _n). ) To perform an exclusive OR operation (α XOR _An XOR M _n ) to acquire the n + 1th authentication information ( _{An + 1} ), and the second arithmetic unit performs the n + 1 authentication information. This is an authentication system that acquires the n + 1 confidential information (M _{n + 1 ) by performing a second operation using (An + 1} ) and the nth confidential information (M _n).

With such a configuration, the one-time password authentication process can be performed at high speed and robustness.

Further, in the authentication system of the sixth invention, for any one of the first to fifth inventions, the first arithmetic unit has the nth authentication information ( _An ) and the n + 1 authentication information (A). _{Using n + 1} ) and the nth confidential information (M _n ), the first operation is performed and the result of the first operation is acquired, and the second operation unit is the n + 1 acquired by the second exclusive OR unit. Performs the first operation using the authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth confidential information ( _Mn ), and acquires the second data (β).

Further, the authentication system of the seventh invention generates _{the first confidential information (M 1} ) which is the secret information used for the authentication in the authentication device for the fifth or sixth invention. A secret information generation unit is further provided, and the first transmission unit transmits the first authentication information (A ₁ ) and the first confidential information (M ₁ ) to the authenticated device, and the second transmission unit. The receiving unit is an authentication system that receives the first authentication information (A ₁ ) and the first confidential information (M _1).

With such a configuration, the one-time password authentication process can be performed at high speed and robustness.

Further, the eighth authentication system of the present invention, to the seventh one aspect from the fifth, in the authentication apparatus, the (n + 1) th authentication information (A n _{+ 1)} and authentication information (A _n of the n-th ) And the exclusive OR operation ( _{An + 1} XOR _An XOR M _n ) of the nth confidential information (M _n ), and the first exclusive OR part for acquiring the first data (α) is obtained. Further, the first transmission unit transmits the first data (α) acquired by the first exclusive OR unit to the authenticated device, and the nth authentication information ( _An ) and the first by using the n secret information (M _n), carried out the second operational, a further authentication system comprising a first arithmetic unit for obtaining the (n + 1) of the confidential information (M n _{+ 1).}

With such a configuration, the one-time password authentication process can be performed at high speed.

According to the authentication device according to the present invention, the one-time password authentication process can be performed at high speed.

The figure which shows the conceptual diagram of the authentication system A in Embodiment 1. Block diagram of the authentication system A Block diagram of the authenticated device 2 constituting the authentication system A A flowchart showing an example of initial registration processing in the authentication system A A flowchart showing an example of the authentication process at the time of the nth authentication in the authentication system A. Block diagram of the authentication system B according to the second embodiment A flowchart showing an example of the initial registration process of the authentication system B. A flowchart showing an example of the authentication process at the time of the nth authentication in the authentication system B. Block diagram of the authentication system C in the third embodiment Block diagram of the authenticated device 6 constituting the authentication system C A flowchart showing an example of the authentication process at the time of the nth authentication in the authentication system C. Overview of the computer system according to the above embodiment Block diagram of the computer system Flowchart showing an example of initial registration processing in the prior art Flow chart showing an example of authentication processing at the time of the nth authentication in the prior art

Hereinafter, embodiments of the authentication device and the like will be described with reference to the drawings. In addition, since the components with the same reference numerals perform the same operation in the embodiment, the description may be omitted again.

(Embodiment 1)
In the present embodiment, an authentication system that performs authentication processing at high speed will be described so that the number of executions of the one-way conversion function can be reduced. In particular, since the number of executions of the one-way conversion function in the authenticated device during the authentication process is 0, the authentication system in which the load on the authenticated device can be extremely small will be described.

FIG. 1 is a conceptual diagram of the authentication system A according to the present embodiment. The authentication system A includes an authentication device 1 and one or more authentication devices 2. The authentication device 1 and each of the 1 or more authenticated devices 2 can communicate with each other via a network such as the Internet. The authentication device 1 is a device that authenticates the authenticated device 2. The authentication device 1 is an information processing device capable of communicating with the authenticated device 2, and is, for example, a so-called cloud server, an ASP server, or the like, but the type thereof does not matter. The authenticated device 2 is a device to be authenticated. The authenticated device 2 may be, for example, any device such as a so-called personal computer, tablet terminal, smartphone, mobile phone, television, automobile, etc., and the type thereof does not matter. Needless to say, the type of communication means and network between the authentication device 1 and each of the 1 or more authenticated devices 2 does not matter.

FIG. 2 is a block diagram of the authentication system A according to the present embodiment. FIG. 3 is a block diagram of the authenticated device 2 constituting the authentication system A in the present embodiment.

The authentication system A includes authentication devices 1, 1 or two or more authenticated devices 2. The authentication system A may include two or more authentication devices 1.

The authentication device 1 includes a first storage unit 11, a first processing unit 12, a first transmission unit 13, and a first reception unit 14. The first storage unit 11 includes a first password storage unit 111, a first random number storage unit 112, a first authentication information storage unit 113, a first confidential information storage unit 114, a first symbol storage unit 115, and a first data storage unit. It is equipped with 116. The first processing unit 12 includes a first random number generation unit 121, a first exclusive OR unit 122, a first conversion unit 123, a first confidential information generation unit 124, a first calculation unit 125, a first authentication unit 126, and The first authentication result processing unit 127 is provided.

The authenticated device 2 includes a second storage unit 21, a second receiving unit 22, a second processing unit 23, and a second transmitting unit 24. The second storage unit 21 includes a second authentication information storage unit 211 and a second confidential information storage unit 212. The second processing unit 23 includes a second exclusive OR unit 231 and a second arithmetic unit 232.

Various types of information are stored in the first storage unit 11 that constitutes the authentication device 1. The various types of information include, for example, a password described later, a random number described later, authentication information described later, confidential information described later, a symbol described later, first data described later, and the like.

The password (S) is stored in the first password storage unit 111. The password (S) is arbitrary information and may be anything. S is, for example, "ABC", "125XYZ", "aiueo Q!", And the like. The password (S) may be used as an identifier of the authenticated device 2, for example.

_{The nth random number (N n} ) is stored in the first random number storage unit 112. Note that n is a natural number of 1 or more. The first random number storage unit 112 may store a large number of random numbers such as _{the first random number (N 1} ), the second random number (N ₂ ), ... The nth random number (N _{n). , Only the nth random number (N n} ), which is the latest random number, may be stored. _{The nth random number (N n} ) of the first random number storage unit 112 is usually generated by the authentication device 1, but one or two or more random numbers may be stored in the first random number storage unit 112 in advance.

_{The nth authentication information (An} ) is stored in the first authentication information storage unit 113. The authentication information is information used for authentication, and is information as a result of applying a one-way conversion function described later. The first authentication information storage unit 113 stores a large number of authentication information such as _{the first authentication information (A 1} ), the second authentication information (A ₂ ), ... The nth authentication information ( _An). It may be performed, or only the authentication information of the nth authentication information ( _An ) and the authentication information of the n + 1th authentication information ( _{An + 1} ) used in the nth authentication may be stored. _{The nth authentication information (An} ) of the first authentication information storage unit 113 is usually generated by the authentication device 1, but one or more authentication information (A ₁ , A _{2) is generated in the first authentication information storage unit 113.} , ..., _An ) may be stored in advance.

The nth confidential information ( _Mn ) is stored in the first confidential information storage unit 114. Confidential information is confidential information used for authentication. The content and type of confidential information does not matter. The first confidential information storage unit 114 stores a large amount of confidential information such as _{the first confidential information (M 1} ), the second confidential information (M ₂ ), ... The nth confidential information (M _n). However, only the nth secret information (M _n ) and the n + 1 secret information (M _{n + 1} ) used in the nth authentication may be stored. The nth confidential information (M _n ) of the first confidential information storage unit 114 is usually generated by the authentication device 1, but one or more confidential information (M ₁ , M _{2) is generated in the first confidential information storage unit 114.} , ..., _Mn ) may be stored in advance.

The nth symbol is stored in the first symbol storage unit 115. One symbol may be distinguishable from other symbols. It is preferable that the symbols are information having an order. The symbol is, for example, a natural number of 1 or more (1, 2, ..., N). The symbol is, for example, a character string composed of one or more alphabets. _{N of the nth} random number (N n), the nth authentication information ( _An ), and the nth confidential information (M _n ) is a symbol. The nth symbol of the first symbol storage unit 115 is usually generated by the authentication device 1, but one or more symbols may be stored in advance in the first symbol storage unit 115. The generation of the symbol in the authentication device 1 is, for example, an increment of a numerical value.

The first data (α) is stored in the first data storage unit 116. The first data (α) is the data obtained by performing an exclusive OR operation ( _An XOR _{An + 1 ) between the nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1).} is there. The first data (alpha), the operation _{(A n} exclusive OR with the authentication information of the n _{(A n)} and (n + 1) th authentication information _{(A n + 1)} and confidential information of the n _{(M n)} It is preferable that the data is acquired by performing _{XOR An + 1} XOR M _n). Exclusive-OR operation between the A _n and _{A n + 1} and _{M n} is the exclusive-OR operation using the _{A n} and _{A n + 1.} The authentication device 1 usually performs such an operation, but another device may perform the calculation. The first data (α) of the first data storage unit 116 is usually generated by the authentication device 1, but may be stored in advance. One or two or more first data (α) may be stored in advance in the first data storage unit 116. Each of the two or more first data (α) is data in which _n of the exclusive OR operation “(An XOR _{An + 1} ) or ( _An XOR _{An + 1} XOR M _n )” is different. Further, the n first data (α) are, for example, data obtained by performing an exclusive OR operation while shifting the subscript n by 1 from 1 to n.

The first processing unit 12 performs various processes. The various processes include, for example, the first random number generation unit 121, the first exclusive OR unit 122, the first conversion unit 123, the first confidential information generation unit 124, the first calculation unit 125, the first authentication unit 126, and the like. This is a process performed by the first authentication result processing unit 127.

The first random number generation unit 121 generates the n + 1th random number (N _{n + 1} ) and stores it in the first random number storage unit 112 at least temporarily.

The first random number generation unit 121 generates the first random number (N ₁ ) and stores it in the first random number storage unit 112 at least temporarily. Further, the first random number generation unit 121 generates the n + 1th random number (N _{n + 1} ) and at least temporarily stores it in the first random number storage unit 112.

The algorithm that generates random numbers does not matter. Further, since the process of generating random numbers is a known technique, detailed description thereof will be omitted.

Further, the timing at which the first random number generation unit 121 generates a random number does not matter. For example, the first random number generation unit 121 generates a random number in response to an instruction from the user. For example, the first random number generation unit 121 generates a random number when an instruction is received from an external device. For example, the first random number generation unit 121 generates a random number when a predetermined time is reached.

The first exclusive OR unit 122 performs an exclusive OR operation on two or more pieces of information and acquires the operation result.

The first exclusive OR unit 122 performs, for example, an exclusive OR operation (SXOR N ₁ ) between the password (S) and the first random number (N ₁ ), and acquires the operation result. Further, the first exclusive OR unit 122 performs an exclusive OR operation (SXOR N _{n + 1} ) between the password (S) and the random number (N _{n + 1} ) of the n + 1th, and acquires the operation result.

Further, the first exclusive OR unit 122 uses, for example, the n + 1th authentication information ( _{An + 1} ) and the nth authentication information ( _An ) to perform an exclusive OR calculation ( _{An + 1} XOR _An). ) To acquire the first data (α).

Further, the first exclusive OR unit 122 uses, for example, the n + 1th authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth confidential information ( _Mn ) to be exclusive. The operation of the logical sum ( _{An + 1} XOR _An XOR M _n ) is performed, and the first data (α) is acquired.

Further, the first exclusive OR unit 122 uses, for example, the n + 1 authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth secret information ( _Mn ) to perform an operation (Mn). (A _{n + 1} XOR _An ) + M _n )) is performed to acquire the first data (α). The "+" here may be another operation (for example, "-", "x", etc.). That is, the first exclusive OR unit 122 may execute an operation including an operation other than the exclusive OR.

The first conversion unit 123 applies the one-way conversion function H to the calculation result acquired by the first exclusive OR unit 122, acquires the first authentication information (A ₁ ), and stores the first authentication information. Accumulate in unit 113. As described above, the one-way conversion function H is, for example, a hash function, but the type thereof does not matter. The calculation result here is the result of the exclusive OR operation (SXOR N ₁ ) of the password (S) and the first random number (N _1).

The first conversion unit 123, operation result subjected to one-way conversion function H with respect to, the (n + 1) of the authentication information _{(A n + 1)} obtains, stores the (n + 1) th authentication information _{(A n + 1)} first authentication information Accumulate in unit 113. It can be said that applying the one-way conversion function H is to execute the one-way conversion function. Here, the accumulation _{may mean overwriting the nth authentication information (An + 1} ) with the nth authentication information (An) or adding it.

The calculation result used by the first conversion unit 123 is, for example, the information acquired by the first exclusive OR unit 122.

The first confidential information generation unit 124 generates the first confidential information (M ₁ ) which is the secret information used for authentication, and transfers the first confidential information (M ₁ ) to the first confidential information delivery unit 114. , At least temporarily accumulate. Here, the first confidential information (M ₁ ) is arbitrary information and may be anything. It is preferable that the number of bits of the password (S), the random number (N), and the authentication information (A) is the same as the number of bits of the confidential information (M).

Further, the method in which the first confidential information generation unit 124 generates the first confidential information (M ₁ ) does not matter. The first confidential information generation unit 124 may acquire _{the first confidential information (M 1).} The first confidential information generation unit 124 selects information from, for example, candidates for confidential information stored in the first storage unit 11. The first confidential information generation unit 124, for example, performs predetermined processing on the original information (source information for generating the confidential information) stored in advance, and acquires new confidential information. The predetermined process is, for example, to give the original information as a parameter to the function stored in advance and execute the function.

The first calculation unit 125 performs the first calculation using the nth authentication information ( _An ) and the n + 1th authentication information ( _{An + 1} ), and acquires the first calculation result. Here, the first operation is, for example, sum, difference, multiplication, division, average value calculation, etc., and the type of operation does not matter. The first calculation unit 125 acquires β by, for example, the sum operation “β = _Ann + _{Ann + 1”.}

The first calculation unit 125 performs the first calculation using, for example, the nth authentication information ( _An ), the n + 1th authentication information ( _{An + 1} ), and the nth confidential information (M _n ), and performs the first calculation. (1) Acquire the calculation result. The first calculation unit 125 is first set by, for example, "β = _An + _{An + 1} + M _n ", "β = _An + _{An + 1} −M _n ", and “β = ( _An −A _{n + 1} ) × M _n ”. Get the calculation result.

Further, the first calculation unit 125 uses, for example, one or more of the nth confidential information ( _Mn ), the n + 1th authentication information ( _{An + 1} ), and the nth authentication information ( _An ). performs calculation Te to obtain a (n + 1) th secret information _{(M n + 1),} the (n + 1) th secret information _{(M n + 1)} to the first confidential information housed unit 114 stores at least occasionally. The type of such operation does not matter. Further, such an operation is, for example, "M _{n + 1} = M _n + _An ", "M _{n + 1} = _{An + 1} + _An + M _n ", "M _{n + 1} = M _n + _{An + 1} ", "M _{n + 1} = M _n + x (x is). Constant) ". Needless to say, "+" may be another operation.

Further, the first calculation unit 125 performs a second calculation using, for example, the nth authentication information ( _An ) and the nth secret information (M _n ), and performs the second calculation, and the n + 1 secret information (M _{n + 1} ). Is acquired, and the n + 1 confidential information (M _{n + 1} ) is stored at least temporarily in the first confidential information storage unit 114.

When the first exclusive OR unit 122 calculates the first data (α) or when the first calculation unit 125 calculates the first calculation result, at least one of them is the confidential information (M). Is preferably used. The confidential information (M) may be used both when the first exclusive OR unit 122 calculates the first data (α) and when the first calculation unit 125 calculates the first calculation result. ..

The first authentication unit 126 determines whether or not the first calculation result and the second data (β) have a predetermined relationship. A predetermined relationship is usually a match. However, the predetermined relationship may be a relationship in which the first calculation result and the data derived from the second data (β) match. In such a case, the authenticated device 2 does not transmit the result of the first calculation performed using the _{n + 1th authentication information (An + 1} ) and the nth authentication information ( _{An), but rather the n + 1th authentication information (An + 1).} The second data (β) derived from the result of the first calculation performed using the authentication information ( _{An + 1} ) and the nth authentication information ( _{An) is transmitted to the authentication device 1.}

The second data first operation derived from operation result performed (beta) may be, for example, is the data acquired by the function f (operation result) by using the (A n _{+ 1)} and (A _n) .. In such a case, the predetermined relationship is "function f (first calculation result) = second data (β)".

The first authentication unit 126 determines, for example, whether or not the first calculation result and the second data (β) match.

Here, the first calculation result is the information obtained by performing the first calculation (for example, sum calculation) using _{the nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1).} is there. The nth authentication information ( _An ) and the n + 1th authentication information ( _{An + 1} ) are the information from which the first data (α) is acquired. The second data (β) is information received by the first receiving unit 14, which will be described later.

The first authentication unit 126 determines, for example, whether or not the first calculation result acquired by the first calculation unit 125 and the second data (β) received by the first reception unit 14 match. The first calculation result may be stored in advance in the first storage unit 11.

The first authentication result processing unit 127 performs processing using the determination result of the first authentication unit 126. The first authentication result processing unit 127 transmits, for example, the determination result of the first authentication unit 126 to the authenticated device 2. Further, the first authentication result processing unit 127 permits the login of the authenticated device 2 or the user, for example, when the determination result is the authentication permission. Further, the first authentication result processing unit 127 enables the authenticated device 2 to operate, for example, when the determination result is the authentication permission. Further, the first authentication result processing unit 127 transmits an error message to the authenticated device 2, for example, when the determination result is authentication disapproval.

The first transmission unit 13 transmits the first data (α) to the authenticated device 2. The first transmission unit 13 transmits, for example, the symbol n and the first data (α) to the authenticated device 2. The symbol n is, for example, a natural number that is incremented each time authentication is performed.

The first transmission unit 13 transmits the first authentication information (A ₁ ) to the authenticated device 2. The first transmission unit 13 may transmit the first authentication information (A ₁ ) and the first confidential information (M ₁ ) to the authenticated device 2.

The first receiving unit 14 receives the second data (β) from the authenticated device 2. The second data (β) is, for example, the result of performing the first operation using the _{n + 1th authentication information (An + 1} ) and the nth authentication information ( _An). (N + 1) th authentication information _{(A n + 1)} are, for example, calculation (alpha XOR A _n exclusive OR of the first data (alpha) and the authentication information of the n-th first transmission unit 13 transmits _{(A n)} ) Is the information obtained. The second data (β) is, for example, the result of an operation performed using _{the first data (α), the nth authentication information (An} ), and the nth confidential information (M _n). For the second data (β), for example, _{the first calculation is performed using the n + 1th authentication information (An + 1} ) and the nth authentication information ( _An ), and the calculation result is determined in advance. It may be the result of calculation.

The first receiving unit 14 usually receives the second data (β) from the authenticated device 2 in response to the transmission of the first data (α) by the first transmitting unit 13.

The trigger for starting the authentication process of the authentication device 1 does not matter. For example, upon receiving the instruction from the authenticated device 2, the authentication device 1 starts the authentication process. Further, for example, the authentication device 1 starts the authentication process in response to the reception unit (not shown) receiving the instruction from the user. For example, when the reception unit (not shown) receives a command from an external device, the authentication device 1 starts the authentication process. For example, when the first processing unit 12 detects that the time has reached a predetermined time, the authentication device 1 starts the authentication process.

Various types of information are stored in the second storage unit 21 that constitutes the authenticated device 2. The various types of information are, for example, authentication information and confidential information.

_{The nth authentication information (An} ) is stored in the second authentication information storage unit 211. The first authentication information (A ₁ ) is usually information received from the authentication device 1. The second and subsequent authentication information (A ₂ , A ₃ , ..., _An ) is usually information generated by the authenticated device 2. The second authentication information storage unit 211 stores a large number of authentication information such as _{the first authentication information (A 1} ), the second authentication information (A ₂ ), ... The nth authentication information ( _An). May be done.

The nth confidential information (M _n ) is stored in the second confidential information storage unit 212. The first confidential information (M ₁ ) is usually information received from the authentication device 1. The second and subsequent confidential information (M ₂ , M ₃ , ..., M _n ) is usually information generated by the authenticated device 2. The second confidential information storage unit 212 stores a large amount of confidential information such as _{the first confidential information (M 1} ), the second confidential information (M ₂ ), ... The nth confidential information (M _n). However, only the nth secret information (M _n ) and the n + 1 secret information (M _{n + 1} ) used in the nth authentication may be stored.

The second receiving unit 22 receives the first data (α) from the authentication device 1. The second receiving unit 22 receives, for example, the symbol n and the first data (α) from the authentication device 1.

Second reception unit 22 receives, for example, the first authentication information (A _1), the first authentication information (A ₁₎ to the second authentication information storage unit 211 stores at least occasionally. Further, the second receiving unit 22 receives, for example, the first confidential information (M ₁ ), and stores the first confidential information (M ₁ ) in the second confidential information storage unit 212 at least temporarily.

The second processing unit 23 performs various processes. The various processes are, for example, processes performed by the second exclusive OR unit 231 and the second arithmetic unit 232.

The second exclusive-OR section 231, for example, by using the first data (alpha) and authentication information of the n _{(A n),} performs exclusive-OR operation (α XOR A _n), the n + 1 Authentication information ( _{An + 1} ) is acquired.

The second exclusive OR unit 231 uses, for example, the first data (α), the nth authentication information ( _An ), and the nth secret information ( _Mn ) to perform an exclusive OR calculation (Mn). α XOR _An XOR M _n ) is performed to acquire the n + 1th authentication information (An _{n + 1).}

_{The second calculation unit 232 performs the first calculation using the n + 1 authentication information (An + 1} ) acquired by the second exclusive OR unit 231 and the nth authentication information ( _An ), and performs the first calculation. Two data (β) are acquired. As described above, the first operation is, for example, "+", but "-", "*", etc. are not limited.

The second calculation unit 232 performs a calculation using, for example, one or more of the nth confidential information ( _Mn ), the n + 1th authentication information ( _{An + 1} ), and the nth authentication information ( _An ). This is performed, the secret information (M _{n + 1} ) of the n + 1 is acquired, and the secret information (M _{n + 1} ) of the n + 1 is stored at least temporarily in the second secret information storage unit 212. The type of such operation does not matter. Further, such an operation is, for example, "M _{n + 1} = M _n + _An ", "M _{n + 1} = _{An + 1} + _An + M _n ", "M _{n + 1} = M _n + _{An + 1} ", "M _{n + 1} = M _n + x (x is). Constant) ". Needless to say, "+" may be another operation.

The second calculation unit 232 performs the second calculation using, for example, the nth authentication information ( _An ) and the nth secret information (M _n ), and acquires the _{n + 1} secret information (M n + 1). Then, it is stored in the second confidential information storage section 212. Here, the second operation is, for example, sum, difference, multiplication, division, average value calculation, and the like. However, the type of the second operation does not matter. The second calculation unit 232 acquires β by, for example, the sum operation “M _{n + 1} = _An + M _n”. Further, the first operation and the second operation may be the same type of operation (for example, both +) or different types of operations (for example, one is + and the other is −). The second calculation unit 232 performs the second calculation using, for example, the n + 1 authentication information ( _{An + 1} ) and the nth secret information (M _n ), and performs the second calculation, and the n + 1 secret information (M _{n + 1} ). May be acquired and stored in the second confidential information storage unit 212. The type of the second operation in such a case does not matter.

The second transmission unit 24 transmits the second data (β) to the authentication device 1. The second data (β) is usually information acquired by the second calculation unit 232.

First storage unit 11, first password storage unit 111, first random number storage unit 112, first authentication information storage unit 113, first confidential information storage unit 114, first symbol storage unit 115, first data storage unit 116, The second storage unit 21, the second authentication information storage unit 211, and the second confidential information storage unit 212 are preferably non-volatile recording media, but can also be realized by volatile recording media.

The process in which the information is stored in the first storage unit 11 or the like does not matter. For example, the information may be stored in the first storage unit 11 or the like via the recording medium, and the information transmitted via the communication line or the like may be stored in the first storage unit 11 or the like. Alternatively, the information input via the input device may be stored in the first storage unit 11 or the like.

First processing unit 12, first random number generation unit 121, first exclusive OR unit 122, first conversion unit 123, first confidential information generation unit 124, first calculation unit 125, first authentication unit 126, first The authentication result processing unit 127, the second processing unit 23, the second exclusive OR unit 231 and the second arithmetic unit 232 can usually be realized from an MPU, a memory, or the like. The processing procedure of the first processing unit 12 and the like is usually realized by software, and the software is recorded on a recording medium such as a ROM. However, it may be realized by hardware (dedicated circuit).

The first transmission unit 13 and the second transmission unit 24 are usually realized by wireless or wired communication means, but may be realized by broadcasting means.

The first receiving unit 14 and the second receiving unit 22 are usually realized by wireless or wired communication means, but may be realized by means for receiving broadcasts.

Next, the operation of the authentication system A will be described. First, an example of the initial registration process in the authentication system A will be described with reference to the flowchart of FIG. It is assumed that the authentication device 1 holds the password (S) in the first password storage unit 111 at the start of operation.

(Step S401) The first random number generation unit 121 of the authentication device 1 generates the first random number (N ₁ ) and stores it in the first random number storage unit 112.

(Step S402) The first exclusive OR unit 122 calculates the exclusive OR of the stored password (S) and the first random number (N ₁ ) acquired in step S401 (SXOR N _1). ) To obtain the first calculation result. Further, the first conversion unit 123 applies the one-way conversion function H to the first calculation result acquired by the first exclusive OR unit 122 to acquire the first authentication information (A ₁ ). Further, the first confidential information generation unit 124 generates the first confidential information (M ₁ ) which is the secret information used for the authentication.

(Step S403) The first conversion unit 123 stores the acquired first authentication information (A ₁ ) in the first authentication information storage unit 113. Further, the first confidential information generation unit 124 stores the generated first confidential information (M ₁ ) in the first confidential information storage unit 114.

(Step S404) The first transmission unit 13 transmits the acquired first authentication information (A ₁ ) and the first confidential information (M ₁ ) to the authentication device 2 by a secure means. Here, the initial registration process of the authentication device 1 is completed.

The second receiver 22 of (step S405) prover 2 receives the first authentication information (A _1), and accumulates the first authentication information (A ₁₎ to the second authentication information storage unit 211 .. The second receiving unit 22 receives the first encryption information (M _1), and accumulates the first confidential information (M ₁₎ to the second confidential information paid unit 212. Here, the initial registration process of the authenticated device 2 is completed. The second receiving unit 22 normally receives the first authentication information (A ₁ ) and the first confidential information (M ₁ ) together, but may receive them separately.

In the flowchart of FIG. 4, the authentication device 1 stores the first authentication information (A ₁ ) and the first confidential information (M ₁ ) in advance, and the first authentication information (A ₁ ). And the first confidential information (M ₁ ) may be transmitted to the authenticated device 2. In such a case, the processing of steps S401 to S403 is unnecessary.

Further, when the authentication system A _{does not use the confidential information (Mn} ), the authentication device 1 may _{transmit only the first authentication information (A 1} ) to the authenticated device 2.

Next, an example of the authentication process at the time of the nth authentication in the authentication system A will be described with reference to the flowchart of FIG. At the start of the nth authentication process, the authentication device 1 holds the password (S) in the first password storage unit 111 and holds the random number (N _n ) in the first random number storage unit 112. Yes. Further, at the start of the nth authentication process, the authenticated device 2 holds the nth authentication information ( _An ) in the second authentication information storage unit 211, and stores the nth confidential information (M _n ). It is assumed that it is held in the second confidential information storage section 212.

(Step S501) The first exclusive OR unit 122 performs an exclusive OR operation (SXOR N _n ) between the stored password (S) and the stored nth random number (N _n). And get the calculation result. Next, the first conversion unit 123 applies the one-way conversion function H to the calculation result acquired by the first exclusive OR unit 122, and acquires the nth authentication information ( _An ).

(Step S502) The first random number generation unit 121 generates the n + 1th random number (N _{n + 1} ) and stores it in the first random number storage unit 112.

(Step S503) The first exclusive OR unit 122 performs an exclusive OR operation (SXOR N _{n + 1} ) between the password (S) and the n + 1 random number (N _{n + 1} ), and acquires the operation result. Next, the first conversion unit 123 applies the one-way conversion function H to the calculation result, _{and acquires the authentication information (An + 1} ) of the n + 1th. Next, the first exclusive OR unit 122 uses the n + 1 authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth confidential information (M _n ) exclusively. The operation of the logical sum ( _{An + 1} XOR _An XOR M _n ) is performed, and the first data (α) is acquired.

(Step S504) The first transmission unit 13 transmits the first data (α) acquired in step S503 to the authenticated device 2 by a safe means. Here, it is preferable that the first transmission unit 13 also transmits n to the authenticated device 2. It is preferable that the first transmission unit 13 also transmits n to the authenticated device 2, for example, even if an error occurs in the past processing.

(Step S505) The second receiving unit 22 of the authenticated device 2 receives the first data (α) from the authentication device 1. Then, the second exclusive OR unit 231 uses the first data (α), the nth authentication information ( _An ), and the nth secret information ( _Mn ) to calculate the exclusive OR (Mn). α XOR _An XOR M _n ) is performed, and the calculation result (usually, the _{information corresponding to the n + 1th authentication information (An + 1} )) is acquired. Next, the second calculation unit 232 performs the first calculation using the calculation result acquired by the second exclusive OR unit 231 and the nth authentication information ( _An ), and performs the first calculation, and the second data (β). ) Is obtained. The first operation here is, for example, "sum".

(Step S506) The second transmission unit 24 of the authenticated device 2 transmits the second data (β) acquired in step S505 to the authentication device 1.

(Step S507) The second calculation unit 232 of the authenticated device 2 _{performs the second calculation using the nth authentication information (An} ) and the nth confidential information ( _Mn ), and conceals the n + 1th. Information (M _{n + 1} ) is acquired, and the secret information (M _{n + 1} ) of the n + 1 is stored in the second secret information storage unit 212. Here, the process for the nth authentication of the authenticated device 2 is completed.

(Step S508) The first receiving unit 14 of the authentication device 1 receives the second data (β) from the authenticated device 2. Then, the first calculation unit 125 performs the first calculation using the nth authentication information ( _An ) and the n + 1th authentication information ( _{An + 1} ), and acquires the first calculation result. Next, the first authentication unit 126 determines whether or not the acquired first calculation result matches the received second data (β). If it is determined that the first authentication unit 126 matches, the process proceeds to step S509, and if it is determined that they do not match, the process proceeds to step S510. The first operation here is, for example, a sum operation.

(Step S509) When the control is transferred to step S509, it is the case where the authentication is established. Then, the first conversion unit 123 _{stores the first authentication information (An + 1} ) acquired in step S503 in the first authentication information storage unit 113. Further, the first calculation unit 125 performs the second calculation using _{the nth authentication information (An} ) and the nth secret information (M _n ), and acquires the _{n + 1 secret information (M n + 1).} Then, the secret information (M _{n + 1} ) of the n + 1 is stored in the first secret information storage unit 114. Further, the first calculation unit 125 increments the symbol n. The first authentication result processing unit 127 may perform processing corresponding to the authentication permission. Further, the second operation is, for example, a sum operation here.

(Step S510) When the control is transferred to step S510, it is a case where the authentication is not established. Then, the first authentication result processing unit 127 performs a process corresponding to the authentication disapproval. Such processing is, for example, sending an error message or the like to the authentication device 1.

Here, the nth authentication process of the authentication device 1 is completed.

In the flowchart of FIG. 5, the same operation is performed during the authentication process after n + 1 times.

Further, in the flowchart of FIG. 5, the authentication device 1, the first data (alpha) (first authentication information (A ₁₎ second authentication information corresponding to the first authentication information (A ₁₎ (A ₂ ) and alpha acquired using), a first data corresponding to the second authentication information (a _{2) (α)} (second authentication information (a ₂₎ and the third authentication information (a ₃₎ alpha) obtained using, ..., (first data (alpha) (authentication information of the n _{(a n} corresponding to _{a n))} and (n + 1) th authentication information authentication information of the n _{(a n + 1} ) And α) obtained by using) and the like may be stored in advance. In such a case, the processing of steps S501 to S503 can be omitted. Further, in such a case, the process of acquiring the first calculation result in step S508 can be omitted.

Further, in the flowchart of FIG. 5, the authentication device 1 may _{store the first nth secret information (M 1} ), ..., The nth secret information (M _n ) in advance. In such a case, the process of acquiring and accumulating the n + 1 secret information (M _{n + 1) in step S509 can be omitted.}

Further, when the authentication system A _{does not use the confidential information (M n} ), the first data (α) is the information calculated without using the _{confidential information (M n).} If the authentication system A does not use the confidential information _{(M n),} the n + need not processing for calculating 1 of confidential information _{(M n + 1)} at step S509.

As described above, according to the present embodiment, in the one-time password authentication process, the number of executions of the one-way conversion function can be reduced, so that the authentication process can be performed at high speed. The fact that the authentication process can be performed at high speed means that the load of the authentication process can be reduced.

More specifically, as shown in the flowcharts of FIGS. 4 and 5 above, in this authentication method, at the time of authentication, the authentication device 1 generates the authentication information by performing the unidirectional conversion function twice and the first operation (1st calculation ( For example, one addition), four exclusive ORs, and one second operation (for example, addition) are required. Since the processing load of each operation of the first operation (for example, addition), the exclusive OR, and the second operation can be ignored as compared with the one-way conversion function, the processing load in the authentication process is substantially one. It can be said that it is a load due to the application of the direction conversion function twice. Further, if the authentication information _An is saved, the one-way conversion function is applied only once in the authentication process, and the authentication process can be performed at extremely high speed.

Further, the processing load in the authenticated device 2 is a processing load of two exclusive ORs, one first operation (for example, addition), and one second operation (for example, addition), and they are substantially the same. The processing load of is negligible.

As described above, in the present embodiment, the fusion calculation of the next authentication information and the current authentication information (the first calculation described above) is mainly added, but the fusion calculation of the next authentication information and the current authentication information is exclusive. Any operation can be used except for the exclusive OR. It is also permitted to add confidential information and arbitrary constants this time. A variation is also conceivable, in which the combination information of the fusion calculation is concealed by the authentication information this time and sent from the authentication device 1 to the authenticated device 2 for sharing.

Further, in the present embodiment, the next confidential information is mainly calculated by adding the current authentication information and the current confidential information, but the next authentication information and the current confidential information are added, or the current authentication information and the next authentication information are combined. This time, it may be calculated by adding the confidential information. Further, the next confidential information may be calculated by an operation other than addition or a combination of a plurality of operations.

Further, in the above embodiment, after the authentication completion, the authentication device 1 generates H (A _n) from the current authentication information A _n, sends it to the prover 2, the prover in the authenticated apparatus 2 compared with the similarly generated from a _n to hold the apparatus 2 H (a _n), may also be realized such additional functions mutual authentication is established if the same.

Further, the processing in the present embodiment may be realized by software. Then, this software may be distributed by software download or the like. Further, this software may be recorded on a recording medium such as a CD-ROM and disseminated. This also applies to other embodiments herein. The software that realizes the authentication device 1 in this embodiment is the following program. That is, this program is the first data (α) acquired by the exclusive OR calculation ( _An XOR _{An + 1 ) of the nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1).} A computer that can access the first data storage unit in which the data is stored, the first transmission unit that transmits the first data (α) to the authenticated device, and the first data (α) transmitted by the first transmission unit. the n-th authentication information _{(a n)} and exclusive (n + 1) th authentication information acquired by the calculation of the logical sum (alpha XOR a _n) of the _{(a n + 1),} the authentication information of the first n and _(a n) The first operation is performed using and, and the first receiving unit that receives the acquired second data (β) from the authenticated device and the first data (α) transmitted by the first transmitting unit are _{The result of the first calculation of the nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1} ), which is the source of the acquisition, and the second data (β) received by the first receiver. It is a program for functioning as a first authentication unit that determines whether or not has a predetermined relationship and a first authentication result processing unit that performs processing using the determination result of the first authentication unit.

Further, in the above program, the first data (α) stored in the first data storage unit includes the n + 1 authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth. It is preferable that the data is acquired by performing an exclusive OR operation ( _{An + 1} XOR _An XOR M _n ) using the confidential information (M _n).

Further, the software that realizes the authenticated device 2 in the present embodiment is the following program. That is, this program includes _{a computer that can access the second authentication information storage unit in which the nth authentication information (An} ) is stored, a second receiver that receives the first data (α) from the authentication device, and the second receiver. performs the operation (α XOR a _n) of the exclusive OR of the first data (alpha) and the authentication information of the _{n (a} n), a second exclusive to obtain the (n + 1) th authentication information _{(a n + 1)} Using the target logical sum part, the n + 1 authentication information ( _{An + 1} ) acquired by the second exclusive OR part, and the nth authentication information ( _An ), the first calculation is performed. It is a program for functioning as a second calculation unit for acquiring the second data (β) and a second transmission unit for transmitting the second data (β) to the authentication device.

Further, in the above program, the second exclusive OR unit uses the first data (α), the nth authentication information ( _An ), and the nth confidential information ( _Mn ). The exclusive OR operation (α XOR _An XOR M _n ) is performed to acquire the n + 1th authentication information ( _{An + 1} ), and the second arithmetic unit uses the nth authentication information (An _n ) and the above. by using the confidential information of the n (M _n), carried out the second operational, as to obtain the (n + 1) th secret information (M n _{+ 1),} it is preferably a program for causing a computer to function.

(Embodiment 2)
The authentication system according to the present embodiment will be described, which is different from the first embodiment in that the authentication process is performed without using confidential information.

The conceptual diagram of the authentication system B in the present embodiment is the same as the conceptual diagram of the authentication system A except for the difference in reference numerals. The authentication system B includes an authentication device 3 and one or more authentication devices 4. The authentication device 3 is a device that authenticates the authenticated device 4. The authentication device 3 may be any device as long as it can communicate with the authenticated device 4. The authentication device 3 is an information processing device capable of communicating with the authenticated device 4, and is, for example, a so-called cloud server, an ASP server, or the like, but the type thereof does not matter. The authenticated device 4 is a device to be authenticated. The authenticated device 4 may be, for example, any device such as a so-called personal computer, tablet terminal, smartphone, mobile phone, television, automobile, etc., and the type thereof does not matter. Needless to say, the type of communication means and network between the authentication device 3 and each of the 1 or more authenticated devices 4 does not matter.

FIG. 6 is a block diagram of the authentication system B according to the present embodiment.

The authentication system B includes an authentication device 3 and one or more authentication devices 4. The authentication system B may include two or more authentication devices 3.

The authentication device 3 includes a first storage unit 31, a first processing unit 32, a first transmission unit 13, and a first reception unit 14. The first storage unit 31 includes a first password storage unit 111, a first random number storage unit 112, a first authentication information storage unit 113, a first symbol storage unit 115, and a first data storage unit 116. The first processing unit 32 includes a first random number generation unit 121, a first exclusive OR unit 122, a first conversion unit 123, a first calculation unit 125, a first authentication unit 126, and a first authentication result processing unit 127. Be prepared.

The authenticated device 4 includes a second storage unit 41, a second receiving unit 22, a second processing unit 43, and a second transmitting unit 24. The second storage unit 41 includes a second authentication information storage unit 211.

Various types of information are stored in the first storage unit 31 that constitutes the authentication device 3. The various types of information include, for example, passwords, random numbers, authentication information, and the like.

Various types of information are stored in the second storage unit 41 that constitutes the authenticated device 4. The various types of information are, for example, authentication information and the like.

Next, the operation of the authentication system B will be described. First, an example of the initial registration process of the authentication system B will be described with reference to the flowchart of FIG. It is assumed that the authentication device 3 holds the password (S) in the first password storage unit 111 at the start of operation.

(Step S701) The first random number generator 121 of the authentication device 3 generates a first random number _{(N 1),} and accumulates the first random number _{(N 1)} to the first random number storage unit 112.

(Step S702) The first exclusive OR unit 122 calculates the exclusive OR of the stored password (S) and the first random number (N ₁ ) acquired in step S701 (SXOR N _1). ) To get the calculation result. Further, the first conversion unit 123 applies the one-way conversion function H to the calculation result acquired by the first exclusive OR unit 122 to acquire the first authentication information (A ₁ ).

(Step S703) The first conversion unit 123 stores the first authentication information (A ₁ ) acquired in step S702 in the first authentication information storage unit 113.

(Step S704) The first transmission unit 13 transmits the acquired first authentication information (A ₁ ) to the authenticated device 4. Here, the initial registration process of the authentication device 3 is completed.

The second receiver 22 of (step S705) prover 4 receives the first authentication information (A _1), and accumulates the first authentication information (A ₁₎ to the second authentication information storage unit 211 .. Here, the initial registration process of the authenticated device 4 is completed.

In the flowchart of FIG. 7, the authentication device 1 stores the first authentication information (A ₁ ) in advance, and the first authentication information (A ₁ ) may be transmitted to the authenticated device 2. .. In such a case, the processing of steps S701 to S703 is unnecessary.

Next, an example of the authentication process at the time of the nth authentication in the authentication system B will be described with reference to the flowchart of FIG. At the start of the nth authentication process, the authentication device 3 holds the password (S) in the first password storage unit 111 and holds the random number (N _n ) in the first random number storage unit 112. Yes. Further, it is assumed that the authenticated device 4 holds the nth authentication information ( _An ) in the second authentication information storage unit 211 at the start of the nth authentication process.

(Step S801) The first exclusive OR unit 122 performs an exclusive OR operation (SXOR N _n ) between the stored password (S) and the stored nth random number (N _n). And get the calculation result. Next, the first conversion unit 123 applies the one-way conversion function H to the calculation result acquired by the first exclusive OR unit 122, and acquires the nth authentication information ( _An ).

(Step S802) The first random number generation unit 121 generates the n + 1th random number (N _{n + 1} ) and stores it in the first random number storage unit 112.

(Step S803) The first exclusive OR unit 122 performs an exclusive OR operation (SXOR N _{n + 1} ) between the password (S) and the n + 1 random number (N _{n + 1} ), and acquires the operation result. Next, the first conversion unit 123 applies the one-way conversion function H to the calculation result _{and acquires the authentication information (An + 1} ) of the n + 1th. Next, the first exclusive OR unit 122 uses the n + 1th authentication information ( _{An + 1} ) and the nth authentication information ( _An ) to calculate the exclusive OR ( _{An + 1} XOR _An ). To acquire the first data (α).

(Step S804) The first transmission unit 13 transmits the first data (α) acquired in step S803 to the authenticated device 2 by a safe means. Here, it is preferable that the first transmission unit 13 also transmits n to the authenticated device 2.

(Step S805) The second receiving unit 22 of the authenticated device 2 receives the first data (α) from the authentication device 3. Then, the second exclusive-OR section 231, using the first data (alpha) and authentication information of the n _{(A n),} performs exclusive-OR operation (α XOR A _n), the n + 1 Authentication information ( _{An + 1} ) is acquired. Next, the second arithmetic unit 232 performs the first arithmetic using _{the n + 1 authentication information (An + 1} ) acquired by the second exclusive OR unit 231 and the nth authentication information ( _An). And acquire the second data (β). The first operation here is, for example, "sum".

(Step S806) The second transmission unit 24 of the authenticated device 2 transmits the second data (β) acquired in step S805 to the authentication device 3.

(Step S807) The first receiving unit 14 of the authentication device 1 receives the second data (β) from the authenticated device 2. _{Then, the first calculation unit 125 uses the nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1} ), which are the sources of the acquisition of the first data (α), to perform the first calculation. To obtain the first calculation result. Next, the first authentication unit 126 determines whether or not the acquired first calculation result matches the received second data (β). If it is determined that the first authentication unit 126 matches, the process proceeds to step S808, and if it is determined that they do not match, the process proceeds to step S809. The first operation here is, for example, a sum operation.

(Step S808) When the control is transferred to step S808, it is the case where the authentication is established. Then, the first conversion unit 123 stores the n + 1 authentication information ( _{An + 1} ) acquired in step S803 in the first authentication information storage unit 113. Further, the first calculation unit 125 increments the symbol n. The first authentication result processing unit 127 may perform processing corresponding to the authentication permission. Further, the second operation is, for example, a sum operation here.

(Step S809) When the control is transferred to step S809, it is a case where the authentication is not established. Then, the first authentication result processing unit 127 performs a process corresponding to the authentication disapproval. Such processing is, for example, sending an error message or the like to the authentication device 1.

Here, the nth authentication process of the authentication device 3 is completed.

In the flowchart of FIG. 8, the same operation is performed during the authentication process after n + 1 times.

Further, in the flowchart of FIG. 8, the authentication device 1, the first data (alpha) (first authentication information (A ₁₎ second authentication information corresponding to the first authentication information (A ₁₎ (A ₂ ) and alpha acquired using), a first data corresponding to the second authentication information (a _{2) (α)} (second authentication information (a ₂₎ and the third authentication information (a ₃₎ alpha) obtained using, ..., (first data (alpha) (authentication information of the n _{(a n} corresponding to _{a n))} and (n + 1) th authentication information authentication information of the n _{(a n + 1} ) And α) obtained by using) and the like may be stored in advance. In such a case, the processing of steps S801 to S803 can be omitted.

As described above, according to the present embodiment, in the one-time password authentication process, the number of executions of the one-way conversion function can be reduced, so that the authentication process can be performed at high speed.

Further, the software that realizes the authentication device 3 in the present embodiment is the following program. That is, this program is the first data (α) acquired by the exclusive OR calculation ( _An XOR _{An + 1 ) of the nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1).} A computer that can access the first data storage unit in which the data is stored, the first transmission unit that transmits the first data (α) to the authenticated device, and the first data (α) transmitted by the first transmission unit. the n-th authentication information _{(a n)} and exclusive (n + 1) th authentication information acquired by the calculation of the logical sum (alpha XOR a _n) of the _{(a n + 1),} the authentication information of the first n and _(a n) The first operation is performed using and, and the first receiving unit that receives the acquired second data (β) from the authenticated device and the first data (α) transmitted by the first transmitting unit are _{The result of the first calculation of the nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1} ), which is the source of the acquisition, and the second data (β) received by the first receiver. It is a program for functioning as a first authentication unit that determines whether or not has a predetermined relationship and a first authentication result processing unit that performs processing using the determination result of the first authentication unit.

The software that realizes the authenticated device 4 in the present embodiment is the following program. That is, this program includes _{a computer that can access the second authentication information storage unit in which the nth authentication information (An} ) is stored, a second receiver that receives the first data (α) from the authentication device, and the second receiver. performs the operation (α XOR a _n) of the exclusive OR of the first data (alpha) and the authentication information of the _{n (a} n), a second exclusive to obtain the (n + 1) th authentication information _{(a n + 1)} Using the target logical sum part, the n + 1 authentication information ( _{An + 1} ) acquired by the second exclusive OR part, and the nth authentication information ( _An ), the first calculation is performed. It is a program for functioning as a second calculation unit for acquiring the second data (β) and a second transmission unit for transmitting the second data (β) to the authentication device.

(Embodiment 3)
In the present embodiment, an authentication system that performs authentication processing at high speed will be described so that the number of executions of the one-way conversion function can be reduced. In particular, since the number of executions of the one-way conversion function in the authenticated device during the authentication process is 0, the authentication system in which the load on the authenticated device can be extremely small will be described.

The conceptual diagram of the authentication system C in the present embodiment is the same as the conceptual diagram of the authentication system A except for the difference in reference numerals. The authentication system C includes an authentication device 5 and one or more authentication devices 6. The authentication device 5 and one or more authenticated devices 6 can communicate with each other via a network such as the Internet. The authentication device 5 is a device that authenticates the authenticated device 6. The authentication device 5 is an information processing device capable of communicating with the authenticated device 6, and is, for example, a so-called cloud server, an ASP server, or the like, but the type thereof does not matter. The authenticated device 6 is a device to be authenticated. The authenticated device 6 may be any device such as a so-called personal computer, tablet terminal, smartphone, mobile phone, television, automobile, etc., and the type thereof does not matter. Needless to say, the type of communication means and network between the authentication device 5 and each of the 1 or more authenticated devices 6 does not matter.

FIG. 9 is a block diagram of the authentication system C according to the present embodiment. FIG. 10 is a block diagram of the authenticated device 6 constituting the authentication system C in the present embodiment.

The authentication device 5 includes a first storage unit 11, a first processing unit 52, a first transmission unit 13, and a first reception unit 14. The first processing unit 52 includes a first random number generation unit 121, a first exclusive OR unit 122, a first conversion unit 123, a first confidential information generation unit 124, a first calculation unit 525, a first authentication unit 126, and The first authentication result processing unit 127 is provided.

The authenticated device 6 includes a second storage unit 21, a second receiving unit 22, a second processing unit 63, and a second transmitting unit 24. The second processing unit 63 includes a second exclusive OR unit 231 and a second arithmetic unit 632.

The first calculation unit 525 performs the first calculation using the nth authentication information ( _An ) and the n + 1th authentication information ( _{An + 1} ), and acquires the first calculation result. Here, the first operation is, for example, sum, difference, multiplication, division, average value calculation, etc., and the type of operation does not matter. The first calculation unit 525 acquires the first calculation result by, for example, the sum calculation "first calculation result = _Ann + _{Ann + 1".}

The first calculation unit 525 performs the first calculation using, for example, the nth authentication information ( _An ), the n + 1th authentication information ( _{An + 1} ), and the nth confidential information ( _Mn ), and performs the first calculation. (1) Acquire the calculation result. The first calculation unit 125 acquires the first calculation result by, for example, "first calculation result = _Ann + _{Ann + 1} + M _n". The first calculation unit 125 acquires the first calculation result by, for example, "first calculation result = _An + _{An + 1-} M _n " and "first calculation result = ( _An -An _{+ 1} ) x M _n". ..

Further, the first calculation unit 525 uses, for example, one or more of the nth confidential information ( _Mn ), the n + 1th authentication information ( _{An + 1} ), and the nth authentication information ( _An ). performs calculation Te to obtain a (n + 1) th secret information _{(M n + 1),} the (n + 1) th secret information _{(M n + 1)} to the first confidential information housed unit 114 stores at least occasionally. The type of such operation does not matter. Further, such an operation is, for example, "M _{n + 1} = M _n + _An ", "M _{n + 1} = _{An + 1} + _An + M _n ", "M _{n + 1} = M _n + _{An + 1} ", "M _{n + 1} = M _n + x (x is). Constant) ". Needless to say, "+" may be another operation.

Further, the first calculation unit 525 performs the second calculation using, for example, the n + 1 authentication information ( _{An + 1} ) and the nth secret information (M _n ), and performs the second calculation, and the n + 1 secret information (M _{n + 1} ). Is acquired, and the n + 1 confidential information (M _{n + 1} ) is stored at least temporarily in the first confidential information storage unit 114.

When the first exclusive OR unit 122 calculates the first data (α) or when the first calculation unit 525 calculates the first calculation result, at least one of them is the confidential information (M). Is preferably used. The confidential information (M) may be used both when the first exclusive OR unit 122 calculates the first data (α) and when the first calculation unit 525 calculates the first calculation result. ..

The second arithmetic unit 632 has, for example, the first n + 1 authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth confidential information (M _{n) acquired by the second exclusive OR unit 231.} ) And, the first operation is performed and the second data (β) is acquired. As described above, the first operation is, for example, "+", but "-", "*", etc. are not limited. The second calculation unit 632 acquires the second data (β) by, for example, the calculation formula “β = _{An + 1} + _An + M _n”.

_{The second arithmetic unit 632 performs the first arithmetic using the n + 1th authentication information (An + 1} ) acquired by the second exclusive OR unit 231 and the nth authentication information ( _An ), and performs the first operation. Two data (β) are acquired. As described above, the first operation is, for example, "+", but "-", "*", etc. are not limited.

The second calculation unit 632 performs a calculation using, for example, one or more of the nth confidential information ( _Mn ), the n + 1th authentication information ( _{An + 1} ), and the nth authentication information ( _An ). This is performed, the secret information (M _{n + 1} ) of the n + 1 is acquired, and the secret information (M _{n + 1} ) of the n + 1 is stored at least temporarily in the second secret information storage unit 212. The type of such operation does not matter. Further, such an operation is, for example, "M _{n + 1} = M _n + _An ", "M _{n + 1} = _{An + 1} + _An + M _n ", "M _{n + 1} = M _n + _{An + 1} ", "M _{n + 1} = M _n + x (x is). Constant) ". Needless to say, "+" may be another operation. The second calculation unit 632 performs the second calculation using, for example, the n + 1 authentication information ( _{An + 1} ) and the nth secret information (M _n ), and acquires the _{n + 1} secret information (M n + 1). Then, it is stored in the second confidential information storage section 212. Here, the second operation is, for example, sum, difference, multiplication, division, average value calculation, and the like. However, the type of the second operation does not matter. The second calculation unit 632 acquires β by, for example, the sum operation “M _{n + 1} = _{An + 1} + M _n”. Further, the first operation and the second operation may be the same type of operation (for example, both +) or different types of operations (for example, one is + and the other is −).

The first processing unit 52, the first calculation unit 525, the second processing unit 63, and the second calculation unit 632 can usually be realized from an MPU, a memory, or the like. The processing procedure of the first processing unit 52 or the like is usually realized by software, and the software is recorded on a recording medium such as a ROM. However, it may be realized by hardware (dedicated circuit).

Next, the operation of the authentication system C will be described. First, the initial registration processing of the authentication device 5 and the authenticated device 6 in the authentication system C is the same as the initial registration processing of the authentication device 1 and the authenticated device 2, respectively, and thus the description thereof will be omitted.

Next, an example of the authentication process at the time of the nth authentication in the authentication system C will be described with reference to the flowchart of FIG. At the start of the nth authentication process, the authentication device 5 holds the password (S) in the first password storage unit 111 and holds the random number (N _n ) in the first random number storage unit 112. Yes. Further, at the start of the nth authentication process, the authenticated device 6 holds the nth authentication information ( _An ) in the second authentication information storage unit 211, and stores the nth confidential information (M _n ). It is assumed that it is held in the second confidential information storage section 212.

(Step S1101) The first exclusive OR unit 122 performs an exclusive OR operation (SXOR N _n ) between the stored password (S) and the stored nth random number (N _n). And get the calculation result. Next, the first conversion unit 123 applies the one-way conversion function H to the calculation result acquired by the first exclusive OR unit 122, and acquires the nth authentication information ( _An ).

(Step S1102) The first random number generation unit 121 generates the n + 1th random number (N _{n + 1} ) and stores it in the first random number storage unit 112.

(Step S1103) The first exclusive OR unit 122 performs an exclusive OR operation (SXOR N _{n + 1} ) between the password (S) and the random number (N _{n + 1} ) of the n + 1th, and acquires the operation result. Next, the first conversion unit 523 applies the one-way conversion function H to the calculation result, _{and acquires the authentication information (An + 1} ) of the n + 1th. Next, the first exclusive OR unit 122 uses the n + 1 authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth confidential information (M _n ) exclusively. The operation of the logical sum ( _{An + 1} XOR _An XOR M _n ) is performed, and the first data (α) is acquired.

(Step S1104) The first transmission unit 13 transmits the first data (α) acquired in step S1103 to the authenticated device 2 by a safe means. Here, it is preferable that the first transmission unit 13 also transmits n to the authenticated device 2. It is preferable that the first transmission unit 13 also transmits n to the authenticated device 2, for example, even if an error occurs in the past processing.

(Step S1105) The second receiving unit 22 of the authenticated device 6 receives the first data (α) from the authentication device 1. It is preferable that the second receiving unit 22 receives the first data (α) and n from the authentication device 1.

Then, the second exclusive OR unit 231 uses the first data (α), the nth authentication information ( _An ), and the nth secret information ( _Mn ) to calculate the exclusive OR (Mn). α XOR _An XOR M _n ) is performed, and the calculation result (usually, the _{information corresponding to the n + 1th authentication information (An + 1} )) is acquired. Next, the second calculation unit 632 uses the calculation result acquired by the second exclusive OR unit 231, the nth authentication information ( _An ), and the nth secret information (M _n ) to perform the second operation. Perform one operation and acquire the second data (β). The first operation here is, for example, "sum". That is, for example, the second data (β) can be obtained by the arithmetic expression “β = (α XOR _An XOR M _n ) + _An + M _n”.

(Step S1106) The second transmission unit 24 of the authenticated device 6 transmits the second data (β) acquired in step S1105 to the authentication device 1.

(Step S1107) The second calculation unit 632 of the authenticated device 6 performs the second calculation using the n + 1 authentication information ( _{An + 1} ) and the nth secret information (M _n ), and conceals the n + 1 th. Information (M _{n + 1} ) is acquired, and the secret information (M _{n + 1} ) of the n + 1 is stored in the second secret information storage unit 212. Further, the second calculation unit 632 increments the symbol n. Here, the process for the nth authentication of the authenticated device 2 is completed.

(Step S1108) The first receiving unit 14 of the authentication device 5 receives the second data (β) from the authenticated device 6. Then, the first calculation unit 525 performs the first calculation using the nth authentication information ( _An ), the n + 1 authentication information ( _{An + 1} ), and the nth secret information (M _n ), and performs the first calculation. (1) Acquire the calculation result. That is, the first calculation unit 525 acquires the first calculation result by the _{calculation formula "first calculation result = Ann} + _{Ann + 1} + M _n".

Next, the first authentication unit 126 determines whether or not the acquired first calculation result matches the received second data (β). If it is determined that the first authentication unit 126 matches, the process proceeds to step S1109, and if it is determined that the first authentication unit 126 does not match, the process proceeds to step S1110. The first operation here is, for example, a sum operation.

(Step S1109) When the control is transferred to step S1109, it means that the authentication is established. Then, the first conversion unit 123 stores the n + 1 authentication information ( _{An + 1} ) acquired in step S1103 in the first authentication information storage unit 113. Further, the first calculation unit 525 performs the second calculation using _{the n + 1 authentication information (An + 1} ) and the nth secret information (M _n ), and acquires the _{n + 1 secret information (M n + 1).} Then, the secret information (M _{n + 1} ) of the n + 1 is stored in the first secret information storage unit 114. Further, the first calculation unit 525 increments the symbol n. The first authentication result processing unit 127 may perform processing corresponding to the authentication permission. Further, the second operation is, for example, a sum operation here.

(Step S1110) When the control is transferred to step S1110, it is a case where the authentication is not established. Then, the first authentication result processing unit 127 performs a process corresponding to the authentication disapproval. Such processing is, for example, sending an error message or the like to the authentication device 1.

Here, the nth authentication process of the authentication device 1 is completed.

In the flowchart of FIG. 11, the same operation is performed during the authentication process after n + 1 times.

Further, in the flowchart of FIG. 11, the authentication apparatus 5, the first data (alpha) (first authentication information (A ₁₎ second authentication information corresponding to the first authentication information (A ₁₎ (A ₂ ) and alpha acquired using), a first data corresponding to the second authentication information (a _{2) (α)} (second authentication information (a ₂₎ and the third authentication information (a ₃₎ alpha) obtained using, ..., (first data (alpha) (authentication information of the n _{(a n} corresponding to _{a n))} and (n + 1) th authentication information authentication information of the n _{(a n + 1} ) And α) obtained by using) and the like may be stored in advance. In such a case, the processing of steps S1101 to S1103 can be omitted. Further, in such a case, the process of acquiring the first calculation result in step S1108 can be omitted.

Further, in the flowchart of FIG. 11, the authentication device 5 may _{store the first nth secret information (M 1} ), ..., The nth secret information (M _n ) in advance. In such a case, the process of acquiring and accumulating the n + 1 secret information (M _{n + 1) in step S1109 can be omitted.}

Further, when the authentication system C _{does not use the confidential information (M n} ), the first data (α) is the information calculated without using the _{confidential information (M n).} If the authentication system A does not use the confidential information _{(M n),} need not processing for calculating the (n + 1) th secret information in step S1109 _{(M n + 1).}

As described above, according to the present embodiment, in the one-time password authentication process, the number of executions of the one-way conversion function can be reduced, so that the authentication process can be performed at high speed. The fact that the authentication process can be performed at high speed means that the load of the authentication process can be reduced.

More specifically, as shown in the flowcharts of FIGS. 4 and 11 above, in this authentication method, at the time of authentication, the authentication device 5 generates the authentication information by performing the unidirectional conversion function twice and the first operation ( For example, one addition), four exclusive ORs, and one second operation (for example, addition) are required. Since the processing load of each operation of the first operation (for example, addition), the exclusive OR, and the second operation can be ignored as compared with the one-way conversion function, the processing load in the authentication process is substantially one. It can be said that it is a load due to the application of the direction conversion function twice. Further, if the authentication information _An is saved, the one-way conversion function is applied only once in the authentication process, and the authentication process can be performed at extremely high speed.

Further, the processing load in the authenticated device 6 is a processing load of two exclusive ORs, one first operation (for example, addition), and one second operation (for example, addition), and they are substantially the same. The processing load of is negligible.

As described above, in the present embodiment, the fusion calculation of the next authentication information and the current authentication information (the first calculation described above) is mainly added, but the fusion calculation of the next authentication information and the current authentication information is exclusive. Any operation can be used except for the exclusive OR. It is also permitted to add confidential information and arbitrary constants this time. A variation is also conceivable, in which the combination information of the fusion calculation is concealed by the authentication information this time and sent from the authentication device 1 to the authenticated device 2 for sharing.

Further, in the present embodiment, the next confidential information is mainly calculated by adding the next authentication information and the current confidential information, but the addition of the current authentication information and the current confidential information, or the current authentication information and the next authentication information This time, it may be calculated by adding the confidential information. Further, the next confidential information may be calculated by an operation other than addition or a combination of a plurality of operations.

Further, in the above embodiment, after the authentication completion, the authentication device 5 generates H (A _n) from the current authentication information A _n, sends it to the prover 6, the prover in the authenticated apparatus 6 compared with the similarly generated from a _n to hold the apparatus 2 H (a _n), may also be realized such additional functions mutual authentication is established if the same.

The authentication system described in the above embodiment generates an encryption key in an information communication system or the like by using, for example, qualification authentication of a user or a communication partner, or authentication information that changes for each authentication, and uses the encryption key. It is related to the one-time password authentication processing method that realizes the encrypted communication.

The authentication processing method in the authentication system described in the above embodiment can be applied to authentication at the time of login of a cloud system, an application providing service system, etc. as a general one-time password authentication method, and is also high-speed. From the advantage of being able to update the authentication information, it is possible to generate an encryption key by using the authentication information as a seed and realize encrypted communication with a different key for each information transmission unit. This can be realized even in low-layer communication, and application such as realizing encrypted communication with a different key for each packet in layer 3 becomes possible.

Further, since this authentication processing method is extremely high speed, for example, when the authentication information is 64-bit, if the Burnham cipher that adds the authentication information to the 64-bit plain text by an exclusive logical sum is used, it is 64-bit. It is also possible to realize encrypted communication with a different key for each information transmission unit.

For example, in IoT, if the terminal side is the authenticated unit and the terminal accommodating device is the authenticated unit, the processing load of the authenticated unit is almost 0. Therefore, if the Burnham encryption is used, encrypted communication is performed without encryption / decryption processing. Can be realized. This means that an encrypted communication function can be added to a network of a device having a limited processing capacity such as a sensor network or an IC tag / RFID network.

With the spread of IoT infrastructure in the future, it will be necessary to realize security communication not only in home appliances, connected cars, and smart grids, but also in processing systems that include devices with low processing capacity such as sensor networks and IC tags. It is expected that the number of cases will increase. With this authentication processing method, high-speed authentication, key distribution, and high-speed encrypted communication can be easily realized even in such an environment, so IoT security measures can be realized in various situations by combining appropriate encryption methods. can do.

Further, FIG. 12 shows an example of the appearance of a computer that executes the program described in the present specification to realize the authentication devices 1, 3, 5 and the authenticated devices 2, 4, 6 of the various embodiments described above. Is shown. The embodiments described above may be implemented in computer hardware and computer programs running on it. FIG. 12 is an overview view of the computer system 300, and FIG. 13 is a block diagram of the system 300.

In FIG. 12, the computer system 300 includes a computer 301 including a CD-ROM drive, a keyboard 302, a mouse 303, and a monitor 304.

In FIG. 13, in addition to the CD-ROM drive 3012, the computer 301 is connected to the MPU 3013, the bus 3014 connected to the CD-ROM drive 3012 and the like, the ROM 3015 for storing a program such as a bootup program, and the MPU 3013. It includes a RAM 3016 that is connected and for temporarily storing instructions of an application program and providing a temporary storage space, and a hard disk 3017 for storing an application program, a system program, and data. Although not shown here, the computer 301 may further include a network card that provides a connection to the LAN.

The program for causing the computer system 300 to execute the functions of the authentication device 1 and the like according to the above-described embodiment may be stored in the CD-ROM 3101, inserted into the CD-ROM drive 3012, and further transferred to the hard disk 3017. Alternatively, the program may be transmitted to the computer 301 via a network (not shown) and stored on the hard disk 3017. The program is loaded into RAM 3016 at run time. The program may be loaded directly from the CD-ROM3101 or network.

The program does not necessarily include an operating system (OS) that causes the computer 301 to execute functions such as the authentication device 1 of the above-described embodiment, or a third-party program or the like. The program need only include a portion of the instruction that calls the appropriate function (module) in a controlled manner to obtain the desired result. It is well known how the computer system 300 works, and detailed description thereof will be omitted.

In the above program, in the step of transmitting information and the step of receiving information, processing performed by hardware, for example, processing performed by a modem or interface card in the transmission step (performed only by hardware). Processing) is not included.

Further, the number of computers that execute the above program may be singular or plural. That is, centralized processing may be performed, or distributed processing may be performed.

Further, in each of the above-described embodiments, each process may be realized by centralized processing by a single device, or may be realized by distributed processing by a plurality of devices.

It goes without saying that the present invention is not limited to the above embodiments, and various modifications can be made, and these are also included in the scope of the present invention.

As described above, the authentication system according to the present invention has an effect that the authentication process of the one-time password can be performed at high speed, and is useful as an authentication system or the like.

Claims (15)

An authentication system including an authenticated device that is an authenticated device and an authentication device that is a device that authenticates the authenticated device.
The authentication device is
The first data (α) acquired by using the exclusive OR operation ( _An XOR _{An + 1} ) of the nth authentication information ( _An ) and the n + 1th authentication information ( _{An + 1) is stored.} The first data storage unit and
A first transmission unit that transmits the first data (α) to the authenticated device, and
(N + 1) th authentication information said first transmission section is obtained using the calculation (alpha XOR A _n) of the exclusive OR of the authentication information (A _n) of the n-th and the first data transmitted (alpha) The first receiving unit that receives the second data (β) obtained by performing the first calculation using ( _{An + 1} ) and the nth authentication information ( _{An) from the authenticated device.} ,
The first operation using _{the nth authentication information (An} ) and the n + 1 authentication information ( _{An + 1} ) from which the first data (α) transmitted by the first transmission unit is acquired. A first authentication unit that determines whether or not the result and the second data (β) received by the first receiving unit have a predetermined relationship.
It is provided with a first authentication result processing unit that performs processing using the judgment result of the first authentication unit.
The authenticated device is
A second authentication information storage unit that stores the nth authentication information ( _{An), and}
A second receiver that receives the first data (α) from the authentication device,
Performs the operation (α XOR A _n) of the exclusive OR of the first data (alpha) and the authentication information of the _{n (A} n), a second exclusive to obtain the (n + 1) th authentication information _{(A n + 1)} With the exclusive OR
The first operation is performed using the n + 1 authentication information ( _{An + 1} ) acquired by the second exclusive OR unit and the nth authentication information ( _An ), and the second data (β) is performed. ) And the second arithmetic unit
An authentication system including a second transmission unit that transmits the second data (β) to the authentication device. In the authentication device
Further provided with a first symbol storage unit for storing the symbol n,
The first transmitter is
The n and the first data (α) are transmitted to the authenticated device to transmit the n and the first data (α) to the authenticated device.
The second receiver is
The n and the first data (α) are received from the authentication device, and the n and the first data (α) are received from the authentication device.
The second exclusive OR part is
An exclusive OR calculation (α XOR _An ) is performed between the first data (α) and the nth authentication information ( _An ) corresponding to n received by the second receiver, and the n + 1 is performed. The authentication system according to claim _{1, wherein the} authentication information (An + 1) is acquired. The authentication device is
The first password storage unit that stores the password (S) and
The first random number generator that generates the n + 1th random number (N _{n + 1),}
An exclusive OR operation (SXOR N _{n + 1} ) of the password (S) and the n + 1 random number (N _{n + 1} ) is performed, and the first exclusive OR unit for obtaining the operation result, and the first exclusive OR unit.
It further includes a first conversion unit that applies a one-way conversion function H to the calculation result acquired by the first exclusive OR unit and acquires the authentication information ( _{An + 1) of the n + 1th.}
The first exclusive OR part is
The authentication information of the n and _{(A n),} performs exclusive-OR operation between the (n + 1) th authentication information first conversion unit obtains _{(A n + 1) (A} n XOR A n + 1), the first data Get (α) and
The first data (α) transmitted by the first transmission unit is the first data (α) acquired by the first exclusive OR unit.
A first calculation unit for performing the first calculation and acquiring the first calculation result by using the nth authentication information ( _An ) and the n + 1 authentication information ( _{An + 1) is further provided.}
The first certification unit
Claim 1 or claim 2 for determining whether or not the first calculation result acquired by the first calculation unit and the second data (β) received by the first reception unit have a predetermined relationship. The authentication device described. The first random number generator
Generate the first random number (N ₁ ) and
The first exclusive OR part is
The exclusive OR calculation (SXOR N ₁ ) of the password (S) and the first random number (N ₁ ) is performed, and the first calculation result is acquired.
The first conversion unit
The one-way conversion function H is applied to the first calculation result acquired by the first exclusive OR part to acquire the first authentication information (A ₁ ).
The first transmitter is
The first authentication information (A ₁ ) is transmitted to the authenticated device, and the first authentication information (A 1) is transmitted to the authenticated device.
The second receiver is
The authentication device according to claim 3, which constitutes an authentication system and receives the first authentication information (A _1). In the authentication device
The first data (α) stored in the first data storage unit includes the n + 1 authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth confidential information ( _Mn ). It is the data acquired by performing the exclusive OR operation ( _{An + 1} XOR _An XOR M _{n) using and.}
The second exclusive OR part is
Using the first data (α), the nth authentication information ( _An ), and the nth confidential information (M _n ), an exclusive OR operation (α XOR _An XOR M _n ) is performed. And get the n + 1 authentication information ( _{An + 1} ),
The second arithmetic unit
Claims 1 to claim 1 to obtain the n + 1 secret information (M _{n + 1} ) by performing a second calculation using the n + 1 authentication information ( _{An + 1} ) and the nth secret information (M _n). 4 The authentication system described in any one of the items. The first arithmetic unit
The first calculation is performed using the nth authentication information ( _An ), the n + 1 authentication information ( _{An + 1} ), and the nth confidential information ( _Mn ), and the first calculation result is obtained. To get and
The second arithmetic unit
Using the n + 1 authentication information ( _{An + 1} ) acquired by the second exclusive OR unit, the nth authentication information ( _An ), and the nth confidential information (M _n ), The authentication system according to any one of claims 1 to 5, wherein the first calculation is performed and the second data (β) is acquired. In the authentication device
It is further equipped with a first confidential information generation unit that generates the first confidential information _{(M 1} ), which is confidential information used for authentication.
The first transmitter is
The first authentication information (A ₁ ) and the first confidential information (M ₁ ) are transmitted to the authenticated device, and the first authentication information (A 1) is transmitted to the authenticated device.
The second receiver is
The authentication system according to claim 5 or 6, wherein the first authentication information (A ₁ ) and the first confidential information (M _{1) are received.} In the authentication device
Calculation of the exclusive OR of the n + 1 authentication information ( _{An + 1} ), the nth authentication information ( _An ), and the nth confidential information (M _{n ) (An + 1} XOR _An XOR M _n ) Is further provided with a first exclusive OR to acquire the first data (α).
The first transmitter is
The first data (α) acquired by the first exclusive OR unit is transmitted to the authenticated device, and the first data (α) is transmitted to the authenticated device.
Using the nth authentication information ( _An ) and the nth secret information (M _n ), a second calculation is performed, and a first calculation unit for acquiring _{the n + 1 secret information (M n + 1) is further added.} The authentication system according to any one of claims 5 to 7. The first data (α) acquired by using the exclusive OR operation ( _An XOR _{An + 1} ) of the nth authentication information ( _An ) and the n + 1th authentication information ( _{An + 1) is stored.} The first data storage unit and
The first transmitter that transmits the first data (α) to the authenticated device, and
(N + 1) th authentication information said first transmission section is obtained using the calculation (alpha XOR A _n) of the exclusive OR of the authentication information (A _n) of the n-th and the first data transmitted (alpha) The first receiving unit that receives the second data (β) obtained by performing the first calculation using ( _{An + 1} ) and the nth authentication information ( _{An) from the authenticated device.} ,
The first operation using _{the nth authentication information (An} ) and the n + 1 authentication information ( _{An + 1} ) from which the first data (α) transmitted by the first transmission unit is acquired. A first authentication unit that determines whether or not the result and the second data (β) received by the first receiving unit have a predetermined relationship.
An authentication device including a first authentication result processing unit that performs processing using the determination result of the first authentication unit. A second authentication information storage unit that stores the nth authentication information ( _{An), and}
The second receiver that receives the first data (α) from the authentication device,
Performs the operation (α XOR A _n) of the exclusive OR of the first data (alpha) and the authentication information of the _{n (A} n), a second exclusive to obtain the (n + 1) th authentication information _{(A n + 1)} With the exclusive OR
Using the n + 1 authentication information ( _{An + 1} ) acquired by the second exclusive OR unit and the nth authentication information ( _An ), the first operation is performed and the second data (β) is performed. And the second arithmetic unit to get
An authenticated device including a second transmission unit that transmits the second data (β) to the authentication device. Obtained using the exclusive OR calculation ( _An XOR _{An + 1 ) between the nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1} ) in the authentication device that authenticates the authenticated device. In the first data storage unit in which the first data (α) is stored, the first transmission unit, the first reception unit, the first authentication unit, the first authentication result processing unit, and the authenticated device. It is realized by a second authentication information storage unit that stores the nth authentication information ( _An ), a second reception unit, a second exclusive OR unit, a second arithmetic unit, and a second transmission unit. Authentication method
The first transmission step in which the first transmission unit transmits the first data (α) to the authenticated device, and
A second receiving step in which the second receiving unit receives the first data (α) from the authentication device,
Said second exclusive OR unit performs calculation (α XOR A _n) of the exclusive OR of the first data (alpha) and the authentication information of the n (A _n), (n + 1) th authentication information The second exclusive OR step to obtain ( _{An + 1) and}
The second calculation unit uses the n + 1 authentication information ( _{An + 1} ) acquired in the second exclusive OR step and the nth authentication information ( _An ) to perform the first calculation. The second calculation step to perform and acquire the second data (β),
A second transmission step in which the second transmission unit transmits the second data (β) to the authentication device,
The first receiving unit uses an exclusive OR calculation (α XOR _An ) of the first data (α) transmitted in the first transmission step and the nth authentication information ( _An). The first calculation is performed using the acquired n + 1 authentication information ( _{An + 1} ) and the nth authentication information ( _An ), and the acquired second data (β) is used as the authenticated device. The first receive step to receive from
_{The nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1} ) from which the first authentication unit acquired the first data (α) transmitted in the first transmission step. The first authentication step of determining whether or not the result of the first calculation using the above and the second data (β) received by the first receiving unit have a predetermined relationship.
An authentication method including a first authentication result processing step in which the first authentication result processing unit performs processing using the determination result in the first authentication step. The first data (α) acquired by using the exclusive OR operation ( _An XOR _{An + 1} ) of the nth authentication information ( _An ) and the n + 1th authentication information ( _{An + 1) is stored.} It is an authentication method realized by the first data storage unit, the first transmission unit, the first reception unit, the first authentication unit, and the first authentication result processing unit.
The first transmission step in which the first transmission unit transmits the first data (α) to the authenticated device, and
The first receiving unit uses an exclusive OR calculation (α XOR _An ) of the first data (α) transmitted in the first transmission step and the nth authentication information ( _An). The first calculation is performed using the acquired n + 1 authentication information ( _{An + 1} ) and the nth authentication information ( _An ), and the acquired second data (β) is used as the authenticated device. The first receive step to receive from
_{The nth authentication information (An} ) and the n + 1th authentication information ( _{An + 1} ) from which the first authentication unit acquired the first data (α) transmitted in the first transmission step. The first authentication step of determining whether or not the result of the first calculation of the above and the second data (β) received by the first receiving unit have a predetermined relationship.
An authentication method including a first authentication result processing step in which the first authentication result processing unit performs processing using the determination result in the first authentication step. It is realized by a second authentication information storage unit that stores the nth authentication information ( _An ), a second receiving unit, a second exclusive OR unit, a second arithmetic unit, and a second transmitting unit. It is a method to be authenticated.
The second receiving step in which the second receiving unit receives the first data (α) from the authentication device, and
Said second exclusive OR unit performs calculation (α XOR A _n) of the exclusive OR of the first data (alpha) and the authentication information of the n (A _n), (n + 1) th authentication information The second exclusive OR step to obtain ( _{An + 1) and}
The second calculation unit uses the n + 1 authentication information ( _{An + 1} ) acquired in the second exclusive OR step and the nth authentication information ( _An ) to perform the first calculation. The second calculation step to perform and acquire the second data (β),
A method to be authenticated, wherein the second transmission unit includes a second transmission step of transmitting the second data (β) to the authentication device. The first data (α) acquired by using the exclusive OR operation ( _An XOR _{An + 1} ) of the nth authentication information ( _An ) and the n + 1th authentication information ( _{An + 1) is stored.} A computer that can access the first data storage
The first transmitter that transmits the first data (α) to the authenticated device, and
(N + 1) th authentication information said first transmission section is obtained using the calculation (alpha XOR A _n) of the exclusive OR of the authentication information (A _n) of the n-th and the first data transmitted (alpha) The first receiving unit that receives the second data (β) obtained by performing the first calculation using ( _{An + 1} ) and the nth authentication information ( _{An) from the authenticated device.} ,
The first operation using _{the nth authentication information (An} ) and the n + 1 authentication information ( _{An + 1} ) from which the first data (α) transmitted by the first transmission unit is acquired. A first authentication unit that determines whether or not the result and the second data (β) received by the first receiving unit have a predetermined relationship.
A program for functioning as the first authentication result processing unit that performs processing using the judgment result of the first authentication unit. A computer that can access the second authentication information storage unit in which the nth authentication information ( _{An) is stored.}
The second receiver that receives the first data (α) from the authentication device,
Performs the operation (α XOR A _n) of the exclusive OR of the first data (alpha) and the authentication information of the _{n (A} n), a second exclusive to obtain the (n + 1) th authentication information _{(A n + 1)} With the exclusive OR
Using the n + 1 authentication information ( _{An + 1} ) acquired by the second exclusive OR unit and the nth authentication information ( _An ), the first operation is performed and the second data (β) is performed. And the second arithmetic unit to get
A program for functioning as a second transmitter for transmitting the second data (β) to the authentication device.

Images