KR20040102968A - Apparatus and method having a function of client-to-clinet authenticattion - Google Patents

Abstract

PURPOSE: An Apparatus and method having a function of client-to-client authentication are provided to decrease a system load on a server by minimizing an operation of the server during a session key generation among users. CONSTITUTION: An apparatus and method having a function of client-to-client authentication includes receivers(325,345), transmitters(326,346), secret key generators(322,342), and session key generators(323,343). The receivers receive a ticket encoded with a symmetry key shared with an authentication server(310) and a server(330) of a connection target terminal, and it receives a first encoded message coded with a hash key generated from the ticket from the target terminal. The transmitters transmit the encoded ticket to the target terminal. The secret key generators generate a secret key shared with the target terminal based on the first encoded message and a password. The session key generators decode an encode random variable received from the target terminal using the secret key to generate a session key.

Description

Apparatus and method having a function of client-to-clinet authenticattion}

The present invention relates to a communication apparatus and method having an authentication function between a terminal and a terminal in a communication environment, and more particularly, a communication apparatus capable of authenticating between a terminal and a terminal by exchanging password authentication keys between users having different passwords; It is about a method.

Due to the diversification of communication environments such as mobile networks and home networking, end-to-end safety is considered one of the important concerns. For example, in a mobile environment, secure end-to-end channel formation between a user belonging to cell A and a user belonging to cell B (or another user belonging to the same cell A) is an important concern. It can also minimize the amount of communication between network components from the user's point of view.

The password authentication key exchange protocol assumes that two entities have a password in advance offline. The two entities use a password to create a common session key, and perform a key verification process on the formed session key. Conventional password authentication key exchange protocols only consider authenticated key exchange for the same password between the user and the server.

Password-based authentication is a widely used method of user authentication in a client-server architecture. However, because passwords are chosen in a form that is easy to memorize short information, there is a serious weakness that can allow an attacker to perform an offline dictionary attack. Various protocols have been proposed based on different cryptographic assumptions to prevent such permanent attacks and to achieve secure and efficient password authentication key exchange.

However, the conventional password authentication key exchange protocol performs authentication between terminals by a common password, and there is no authentication method based on different passwords.

SUMMARY OF THE INVENTION The present invention has been made in an effort to provide a communication device, an authentication system, and a method having a secure terminal-to-terminal authentication function based on different passwords without prior secret value distribution among users.

Another technical problem to be solved by the present invention is a computer-readable recording medium that records a program for executing a secure terminal-to-terminal authentication method on a computer based on different passwords without prior secret value distribution among users. To provide.

1 is a diagram illustrating a Kerberos authentication system;

FIG. 2 is a diagram illustrating a fake ticket protocol.

3 is a diagram showing a communication device having an authentication function between terminals in a multiple environment according to the present invention;

4a, 4b is a view showing the flow of the terminal-to-terminal authentication method in multiple environments according to the present invention;

5 is a diagram illustrating an authentication system between terminals in a single server ticketless environment according to the present invention;

6 is a diagram illustrating a flow of a terminal-to-terminal authentication method in a single server ticketless environment according to the present invention;

7 is a diagram illustrating a communication device having an authentication function between terminal to terminal in a single server ticket environment according to the present invention.

In order to achieve the above technical problem, an embodiment of a terminal-to-terminal communication apparatus according to the present invention is a response to a first random value and a first random value encrypted with a first password and transmitted to an authentication server. A first session key generation unit generating a first session key based on a second random value received encrypted by the first password from the authentication server; Receiving a ticket including the first password and a third random value generated by the authentication server and a first encryption message including the third random value from the authentication server, and includes a second password of the terminal to be connected. A receiving unit for receiving a second encryption message from the connection target terminal; A transmitter for transmitting the encrypted ticket to the connection target terminal; A secret key generation unit for generating a secret key based on the first encryption message, the second encryption message, and the first password; And a second session key based on a fourth random value encrypted by the secret key and transmitted to the access target terminal and a fifth random value encrypted and received by the secret key from the access target terminal in response to the fourth random value. It has a second session key generation unit for generating a. Here, the ticket is encrypted with a symmetric key shared between the authentication server and an external server, the first encryption message is encrypted with the first session key, the second encryption message is the first password included in the ticket and And a hash key calculated based on the third random value.

Another embodiment of the terminal-to-terminal communication apparatus according to the present invention for achieving the above technical problem is a response to the first random value and the first random value encrypted with the first password and transmitted to the authentication server. A first session key generation unit generating a first session key based on a second random value received encrypted by the first password from the authentication server; Receive a ticket including the second password and the third random value of the terminal to be connected from the terminal, the fourth random value generated by the authentication server, the second password included in the ticket and the third A receiving unit for receiving a first encryption message including a random value and a second encryption message including the first password from the authentication server; A transmitter for transmitting the encrypted ticket to the authentication server and transmitting the second encryption message to the client; A secret key generation unit generating a secret key based on the first password and the first encryption message; The second session key is encrypted based on the fifth random value received by encrypting with the secret key from the access target terminal in response to the fifth random value and the fifth random value transmitted by encrypting with the secret key. It has a second session key generation unit to generate. The ticket is encrypted with a symmetric key shared between the authentication server and an external server, the first encryption message is encrypted with the first session key, and the second encryption message is included in the ticket. And a hash key calculated based on the third random value.

In order to achieve the above technical problem, an embodiment of the authentication system according to the present invention includes a first random value encrypted with a password of the first client from a first client and a password of the second client from a second client. A receiver for receiving an encrypted second random value; Encrypting the first result value calculated by performing a predetermined logical operation on the received first and third random values with a password of the second client, and receiving the received second and third random values. An encryption unit for encrypting a second result value calculated by performing the logical operation on a value with a password of the first client; And a transmitter for transmitting the encrypted first result value to the second client and transmitting the encrypted second result value to the first client.

In order to achieve the above technical problem, an embodiment of the terminal-to-terminal authentication method according to the present invention includes a response to the first random value and the first random value encrypted with a first password and transmitted to the authentication server. Generating a first session key based on a second random value received after being encrypted with the first password from the authentication server; Receiving a ticket including a third random value generated by the first password and the authentication server and a first encryption message including the third random value from the authentication server; Transmitting the encrypted ticket to an access target terminal; Receiving a second encryption message including the second password of the terminal to be connected from the terminal to be connected; Generating a secret key based on the first encryption message, the second encryption message, and the first password; And a second session key based on a fourth random value encrypted by the secret key and transmitted to the access target terminal and a fifth random value encrypted and received by the secret key from the access target terminal in response to the fourth random value. Generating; has a. The ticket is encrypted with a symmetric key shared between the authentication server and an external server, the first encryption message is encrypted with the first session key, and the second encryption message is included in the ticket. And a hash key calculated based on the third random value.

In order to achieve the above technical problem, another embodiment of the terminal-to-terminal authentication method according to the present invention includes: receiving a ticket including a first password and a first random value of a terminal to be connected from the terminal to be connected; ; Transmitting the encrypted ticket to an authentication server; A first session key based on a second random value encrypted by a second password and transmitted by the authentication server and a third random value generated by the authentication server and encrypted by the second password in response to the second random value; Generating a; A fourth random value generated by the authentication server, a first encryption message including the first password and the first random value included in the ticket, and a second including the second password and the fourth random value Receiving an encryption message from the authentication server; Transmitting the second encryption message to the connection target terminal; Generating a secret key based on the first encryption message and the second password; And a second session key based on a fifth random value encrypted by the secret key from the terminal to be transmitted in response to the fifth random value and the fifth random value transmitted by encrypting with the secret key. Generating; has a. Here, the ticket is encrypted with a symmetric key shared between the authentication server and an external server, a first encryption message is encrypted with the first session key, and a second encryption message is included in the ticket. And a hash key calculated based on a random value.

In order to achieve the above technical problem, another embodiment of the terminal-to-terminal authentication method according to the present invention comprises: receiving a first random value encrypted with a password of the first client from a first client; Encrypting a result value calculated by performing a predetermined logical operation on the received first and second random values with a password of the second client and transmitting the encrypted result to the second client; Receiving a third random value encrypted with the password of the second client from the second client; And encrypting a result value calculated by performing the logical operation on the second random value and the received third random value with a password of the first client and transmitting the encrypted result to the first client.

This provides authentication using different passwords between terminals in multiple domains and single domains, and is safe against offline dictionary attacks, man-in-the-middle attacks and replay attacks, and sessions between users. Minimizing the server's participation in the key generation process can increase the efficiency of the system.

The communication apparatus and method having a terminal-to-terminal authentication function according to the present invention are based on a Kerberos system and a fake-ticket protocol for exchanging tickets between servers.

1 shows a Kerberos authentication system.

Referring to FIG. 1, in the Kerberos system, the session key distribution between the user 120 and the application server S 150 may include an authentication server (AS) 112 and 142 and a ticket granting server (TGS) 114 and 144. Is performed due to the intervention of the Kerberos server (110,140) is included. Kerberos systems that provide full service provide authentication in multiple realms. This authentication protocol provides an efficient multi-zone framework and reduces the complexity of transmission between multiple realms.

The multi-zone environment enables the user group 120 belonging to the zone A 100 to access the application server S 150 belonging to the zone B 130. In step 1, _A requests TGT _A from the authentication server AS _A 112 to which he belongs. AS _A 112, which is requested by box 120, issues TGT _A to step 120 that can access TGS _A 114. In step (3) _A requests the TGS _A 114 the TGT _B to be used for communication with the TGS _B 144. After verifying TGT _A in step 4, TGS _A 114 issues TGT _B encrypted with K _{TGS (A), TGS (B)} to head 120. Shell 120 is TGS to _B (144) and requests a ticket, TGS _B (144) in step (6) with the TGT _B in step 5 is to issue a ticket to communicate with the application server S (150).

Table 1 summarizes the data flow of the Kerberos authentication system.

Data transfer direction data A-AS _A ID _A AS _A- > box TGT _A , Former-> TGS _A ID _A , ID _S , TGT _A , TGS _A- > Box TGT _B , Former-> TGS _B ID _A , TGT _A , TGS _B- > box Ticket _S , Pack-> Server S ID _A , Ticket _S , TGT _A = TGT _B = Ticket _S =

The Kerberos authentication system has a problem in that off-line dictionary attacks on user passwords are possible. This problem was prevented in 1996 by Jaspan's proposal of PA-ENC-DH, which applied the DH-EKE scheme between the user and the Kerberos server.

However, the PA-ENC-DH scheme only assumes password sharing between users and Kerberos servers, and symmetric key sharing between application servers and Kerberos servers. If the pre-shared symmetric key between the application server and Kerberos server is converted to a password, the PA-ENC-DH scheme allows easy pre-attack.

In other words, PA-ENC-DH cannot be used when two entities (users, application servers) registered on the Kerberos server attempt to communicate using a password. The reason is that there are new security concepts and attacks due to the existence of two passwords and multiple session keys.

2 illustrates a Fake-Ticket protocol.

Referring to FIG. 2, in the log-in step, A 220 obtains TGT _A from KDC _A 210 (21, 22). Party 220 with the TGT _A will request a service ticket to the _{KDC A (210) (23)} , KDC A (210) is a random session key, K _A, to generate _B, hweyikeu (fake) tickets (FTKT Is issued to the box 220 (24). Pack 220 delivers the received FTKT to 250 (25). A with FTKT 250 requests a ticket (TKT) to KDC _B (240) and _{(26), KDC B (240} ) is issued to the the TKT be used for the shell 220 and the communication 250 (27 ). The remaining portions 28, 29 and 30 are identical to the multi-domain Kerberos authentication system. In a distributed environment, it is inefficient that the server KDC _A 210 always participates in sharing the session key between the head 220 and the head 250.

Table 2 summarizes the data flow of the Fake-Ticket protocol.

1.KDC _A login step A-KDC _A ID _A KDC _A- > Gap TGT _A , 2.FTKT Issuance Steps Former-> TGS _A ID _A , ID _B , TGT _A , TGS _A- > Box FTKT, Gap-> ID _A , FTKT, 3. KDC _B Login Steps -> KDC _B ID _B KDC _B- > TGT _B , 4.Ticket issuance stage -> TGS _B FTKT, TGT _B , TGS _B- > TKT, -> Former TKT, TGT _A = TGT _B = TKT = FTKT =

First, models, definitions, and computational assumptions required for a communication apparatus and method having a terminal-to-terminal authentication function according to the present invention will be described.

The Shared Password-Aunthentication Model (SPA) provides authenticated key exchange for a common password pre-distributed between user A and server B. This model also assumes that User A has a password, and Server B stores its password-verifier over a secure channel. Most password authentication key exchange protocols are based on this model.

Different Password-Aunthentication Models (DPAs) provide authenticated key exchange using different passwords between user A1 and user A2. This model is divided into a cross-realm environment and a single-server environment. In a multi-zone environment, it consists of users A1 and A2 and two servers B1 and B2. However, A1 and A2 are users registered to the servers B1 and B2, respectively. In a single server environment, it consists of two users A1 and A2 and one server B, and users A1 and A2 are users of server B. Users A1 and A2 are authenticated using a different password between users with the help of servers B1 and B2 in a multi-domain environment, or with the help of B in a single server environment.

In SPA only one common password is used, while in DPA two passwords are involved in the authentication process. To address the safety concept of the DPA model, the relevant safety concepts must be newly defined according to the model definition. Accordingly, a communication apparatus and method having a terminal-to-terminal authentication function according to the present invention satisfy the following definitions and assumptions.

(Definition 1) If the loss of a long-term secret (password) does not mean the loss of the session key of the protocol P created before the loss of the long-term secret, then protocol P is the perfect forward secrecy in the SPA model. Say satisfactory).

In the DPA model, there are more long-term secrets involved than the SPA model. The concept of perfect forward secrecy for this added long term secret should be included.

(Definition 2) If the loss of long-term secrets of all participants of protocol P does not mean the loss of all session keys of protocol P generated prior to the loss of long-term secrets, then the given protocol P is a perfect forward secret in the DPA model. forward secrecy).

By definitions 1 and 2, if the protocol P satisfies the perfect forward secrecy in the DPA model, we can see that it satisfies the perfect forward secrecy in the SPA model (but not vice versa).

Next, we look at the Denning-Sacco attack in the SPA model, and define this attack in the DPA model. As defined below, the DPA model has many session keys, so the definition of a Denning-Sacco attack should include these concepts.

(Definition 3) If an attacker must not be able to proactively attack common passwords using the session key, and also cannot use the previous session key to impersonate objects belonging to protocol P afterwards, protocol P is the Denning- Says Sacco is resistant to attacks.

(Definition 4) An attacker must not be able to proactively attack the protocol P's long-term secrets using all the session keys used in protocol P, and further impersonate users belonging to protocol P later using all previous session keys. If not, later protocol P is said to be resistant to Denning-Sacco attacks in the DPA model.

Password-based protocols in the SPA model must always be resistant to off-line dictionary attacks, and password-based protocols in the DPA model must also satisfy this property. However, there are more passwords than SPA models to consider in the pre-attack of the DPA model. Therefore, the pre-attack in the DPA model is defined as

(Definition 5) If the protocol P satisfies the following two things, the DPA model is said to be safe for advance attack. First, all attacks belonging to protocol P should be impossible to attack in advance. Also, when an attacker is given a password, it must not be possible to preempt other passwords.

In the password-based protocol of the SPA model, many attacks exist. For example, man-in-the-middle attack, replay attack, and the like are representative examples. However, these attacks can be applied from the SPA model to the DPA model without modification. The following describes the safety of the DPA protocol.

(Safety of DPA protocol) Suppose that a poly-time attacker E attacks a given protocol using well-known attack methods. In the case of an online pre-attack, E will try all possible passwords in the log-in phase. If the server accepts the password chosen by attacker E, the guesswork for the attacker's password is successful, and if rejected, attacker E can delete the password from the password dictionary. The probability that an attacker E will succeed in guessing a password after successive denials of R servers is (However, | D | is the dictionary size of the password.) In practice, an online dictionary attack is inevitable, and its probability of success should be the lowerbound advantage of any attacker attacking a given protocol. . In other words, if attacker E's advantage of attacking protocol P is determined as follows, protocol P is safe in the DPA model.

(Where ε (k) is the negligible function, R is the number of rejections in the login phase, k is the safety parameter, and the second term on the right side of the inequality is the advantage of attacker E over attacks defined in the DPA model.)

(Calculated assumption)

The schemes proposed in the present invention are based on mathematical and computational assumptions. p, q Let 's be a sufficiently large prime that satisfies, and let G be a subgroup of Z _p ^* of order q. Constructor during the initialization phase, And hash functions (H ₁ , H ₂ , H ₃ , H ₄ , H ₅ ) are publicly available. All protocols presented in the present invention are based on the discrete algebraic assumption (DLA) and the Diffie-Hellman hypothesis (DHA). These assumptions are defined as follows.

(Definition 6) Discrete Logarithm Assumption

For all polynomial time algorithms A,

P _r [A (p, g, y) = x st y = g ^x mod p]

here, Is a negligible function and x Z _q .

(Definition 7) Diffie-Hellman Assumption

For all polynomial time algorithms A,

P _r [A ((p, g, y), (g ^a , g ^b )) = st = g ^ab mod p]

here, Is a negligible function and x Z _q .

Table 3 summarizes the notation used in the description of the communication device and method with a terminal-to-terminal authentication function according to the present invention.

Mark meaning A Honest User or Client ID _a , ID _b I and I identifiers pwa, pwb Password of A and E E _x E _x : {0,1} ^l {0,1} ^l Symmetric Key Cryptographic Algorithm H ₁ , H ₂ , H ₃ , H ₄ , H ₅ H _i : {0,1} ^* {0,1} ^l , 1 i 5 Cryptographic Hash Functions (eg SHA-1) Ticket _B Kerberos ticket for user A to receive service from server B

Hereinafter, with reference to the accompanying drawings will be described in detail a password authentication key exchange method and apparatus according to the present invention.

3 is a diagram illustrating an authentication method between terminal to terminal in a multi-environment according to the present invention.

Referring to FIG. 3, a communication device having a terminal-to-terminal authentication function according to the present invention includes an authentication server A 310, a client 1 320, an authentication server B 330, and a client 2 340. . Client 1 320 and Client 2 340 are the first session key generator 321 and 341, the secret key generator 322 and 342, the second session key generator 323 and 343, the session key checker 324 and 344, and the receiver ( 325, 345 and transmitters 326, 346.

When the authentication server A 310 receives the first random value encrypted with the password of the client 1 320, the authentication server A 310 encrypts the second random value generated by the authentication server A 310 with the password of the client 1 320. And the ticket and the first encryption message are generated and transmitted. The authentication server A 310 stores the ID and password of the client 1 320 in advance.

The authentication server B 330 receives the third random value encrypted with the password of the client 2 340 and the ticket, and decrypts the ticket with the symmetric key shared between the authentication server A 310 and the authentication server B 330. The fourth random value encrypted with the password of the client 2 340 is transmitted, and the second encryption message and the third encryption message are generated and transmitted. The authentication server B 330 stores the ID and password of the client 2 340 in advance.

The first session key generation unit 321 of the first client 320 transmits the first random value encrypted with the password of the first client 320 to the authentication server A 310, and corresponds to the first random value transmitted. A second random value generated by the authentication server A 310 and encrypted with the password of the first client 320 is received to generate a first session key based on the first random value and the second random value.

The first session key generator 341 of the client 2 340 transmits the third random value encrypted with the password of the client 2 340 to the authentication server B 330, and corresponds to the transmitted third random value. The fourth server generates a second session key based on the third random value and the fourth random value by receiving the fourth random value generated by the authentication server B 330 and encrypted with the password of the client 2 340.

The secret key generation unit 322 of the client 1 320 based on the first encryption message received from the authentication server A (310), the third encryption message received from the client 2 (340) and the password of the client 1 (320). Generates a secret key by performing a predetermined operation.

The secret key generation unit 342 of the client 2 340 generates a secret key by performing a predetermined operation process based on the second encryption message received from the authentication server B 330 and the password of the client 2 340. .

The second session key generation unit 323 of the client 1 320 transmits the fifth random value encrypted with the secret key to the client 2 340, and responds to the transmitted fifth random value by the client 2 340. The sixth random value generated and encrypted with the secret key is received to generate a third session key based on the fifth random value and the sixth random value.

The second session key generation unit 343 of the client 2 340 receives the fifth random value encrypted with the secret key from the client 1 320 and is generated by the client 2 340 in response to the reception and encrypted with the secret key. The sixth random value is transmitted and a third session key is generated based on the fifth random value and the sixth random value.

The session key confirming unit 324 of the client 1 320 verifies the third session key based on the fifth random value received after being encrypted with the third session key from the client 2 340.

The session key verification unit 344 of the client 2 340 verifies the third session key based on the sixth random value received after being encrypted with the third session key from the client 1 320.

Receiving unit 325 of the first client 320, the first encryption message including the second random value and the ticket including the password and the second random value generated by the authentication server A (310) It receives from the authentication server A (310), and receives a third encryption message from the client 2 (340) including a password of the client 2 (340) and the fourth random value generated by the authentication server B (330). Here, the ticket is encrypted with a symmetric key shared between the authentication server A 310 and the authentication server B 330, the first encryption message is encrypted with the first session key, and the third encryption message is the client 1 320 included in the ticket. Is encrypted with a hash key calculated from a predetermined hash function based on the password and the second random value.

The receiving unit 345 of the client 2 340 receives the ticket from the client 1 320, the fourth random value generated by the authentication server B 330, and the password and the first password of the client 1 320 included in the ticket. A second encryption message including a second random value and a third encryption message including a password of the first client 320 and a fourth random value generated by the authentication server B 330 are received from the authentication server B 330. . The second encryption message is encrypted with the first session key, and the third encryption message is encrypted with the hash key calculated based on the password and the second random value of the client 1 320 included in the ticket.

The transmitter 326 of the client 1 320 transmits the encrypted ticket to the client 2 340. The transmitting unit 346 of the client 2 340 transmits the ticket to the authentication server B 320 and transmits a second encryption message to the client 1 320.

It is assumed that the authentication server A 310 and the authentication server B 330 share the symmetric key K safely using a public key cryptography method. The representative method is PKCROSS. Encrypting with the password, pwa, means that pwa is encrypted by transforming it into a size of 1 bit by a one-way function. In addition, the use of pwa in exponential power means that it is transformed by a one-way function having a range of q. Hereinafter, the equations used in the present invention will be described first, and then the authentication method according to the present invention will be described in detail.

mod p (Diffie-Hellman key agreement protocol)

here, ego, To satisfy.

Here, x is a random value generated in the client 1 (320), y is a random value generated in the authentication server A (310), H ₁ is a hash function. R is a session key shared between Client 1 320 and Authentication Server A 310.

Here, x 'is a random value generated in client 2 340, y' is a random value generated in authentication server B 330, H ₂ is a hash function. R 'is a session key shared between Client2 340 and Certificate Server B 330.

Where R is the session key between authentication server A 310 and client 1 320, x is a random value generated at client 1 320, y and r are random values generated at authentication server A 310. , L is the validity period of the ticket.

Where R ^' is the session key between the authentication server B 330 and Client2 340, and L is the validity period of the ticket.

Where H ₄ is the hash function, pwa is the password of A, pwb is the password of r, and r and r 'are random values generated at KDC _A.

Where K is the symmetric key shared between authentication servers, pwa is the password of the former, and L is the validity period of the ticket.

Here, pwa and pwb is the password of the client 1 320 and client-2 340, respectively, r and r 'are each a random value generated by the authentication server A (310) and the authentication server B (330) is ₅ .H Hash function.

Here, a and b are random values generated in Client 1 320 and Client 2 340, respectively, and H ₃ is a hash function. sk is a session key shared between Client 1 320 and Client 2 340.

4 is a diagram illustrating a flow of a terminal-to-terminal authentication method according to the present invention.

Referring to Figure 4, Client 1 (402) is random Then select To calculate and send to the authentication server A (400) with ID _B , ID _A (S410).

Certificate Server A (400)By decryptingIt is obtained (S412). AndSelect randomly andTo calculate (S412). In addition, after determining the validity period (L) of the ticket, the authentication server A (400)_B) (S412),,It is delivered to the client 1 (402) (S414).

Client 1 (402) received this message from authentication server A (400). Can be calculated (S416), By decoding Can be obtained.

Client 1 402 transmits a ticket (Ticket _B ) to client 2 404 (S418).

Client 2 (404) Select the Calculate Then, the authentication server B (406) with Ticket _B , ID _A , ID _B , Transfer (S420).

The authentication server B 406 decrypts Ticket _B , Can also get Select randomly Calculate (S422). Authentication server B (406) is another random value Select Is calculated, Create (S422) , In addition, the transfer to the client 2 (404) (S424).

Client 2 (404) By decoding By getting Can be calculated and Using Decrypt Client 2 404 ultimately You can get Can be made (S426).

Client2 (404) has a new random value After creating the By calculating Together with the client 1 (402) (S428).

Client 1 (402) With his pwa To create it. And client 1 (402) uses this Can decrypt Get Also, as with Client 2 (404) By using, it is possible to calculate the cs value (S430).

Finally random value Select To produce To check the session key for client2 (404) , Send (S432).

Client 2 (404) , After receiving You can get the session key using the random value a you chose. To form (S434). Client2 (404) checks the session key, Is sent to Client1 (402). Client 1 (402) receives this with its session key. The session key verification is finished by confirming (S436).

Table 4 summarizes the data flow of the terminal-to-terminal authentication method according to the present invention.

1. Ticket issuance stage Client 1-> Certificate Server A ID _A , ID _B , Certificate Server A-> Client 2 , , Ticket _B 2. Mutual Authentication and Session Key Formation Steps Client 1-> Client 2 Ticket _B , ID _A , L Client2-> Certificate Server B Ticket _B , , ID _A , ID _B , L Certificate Server B-> Client2 , , Client2-> Client1 , , Client 1-> Client 2 , Client2-> Client1 Ticket _B =

5 is a diagram illustrating an authentication system between terminals in a single server ticketless environment according to the present invention.

Referring to FIG. 5, the authentication system according to the present invention includes an authentication server 510, a client 1 520, and a client 2 530. The authentication server 510 includes a receiving unit 512, an encryption unit 514, and a transmitting unit 516, and the client 1 520 and the client 2 530 are session key generation units 522 and 532 and session key confirmation unit ( 524,534).

The receiver 512 receives the first random value encrypted with the password of the client 1 520 from the client 1 520 and the second random value encrypted with the password of the client 2 530 from the client 2 530.

The encryption unit 514 encrypts the first result value calculated by performing a predetermined logical operation based on the received first random value and the third random value generated by the authentication server 510 with the password of the client 2 530. The second result value calculated by performing a predetermined logical operation based on the received second random value and the third random value is encrypted with the password of the client 1 (520).

The authentication server 510 stores IDs and passwords of the client 1 520 and the client 2 530.

The transmitter 516 transmits a first result value to the client 2 530 and a second result value to the client 1 520.

The session key generators 522 and 532 generate a session key by performing a predetermined logical operation on the first random value, the second random value, and the third random value.

The session key verification unit 524 of the client 1 520 compares the first random value received encrypted by the session key from the client 2 520 with the first random value previously generated by the client 1 520 to compare the session key. Check it. The session key checking unit 534 of the client 2 530 compares the second random value received encrypted by the session key from the client 1 520 with the second random value previously generated by the client 2 530 to compare the session key. Check it.

6 is a diagram illustrating a terminal-to-terminal authentication method in a single server ticketless environment according to the present invention.

Referring to FIG. 6, when Client 1 600 wants to communicate with Client 2 604 registered in the same authentication server 602, Client 1 600 It is transmitted to the authentication server 602 (S610).

Since authentication server 602 knows the password pwa of client 1, After obtaining the random value Select Calculate and transfer to client 2 (604) (S612).

Client 2 (604) Then select After calculating Is sent to the authentication server (602) (S614). The authentication server 602 applies the value of s Is transmitted to the client 1 600 (S616), and the client 1 600 is also the session key like the client 2 604. Calculate

Client 1 (600) to check the session key, Is sent to the client 2 (604) (S618).

Client2 (604) checks the session key, Is transmitted to the client 1 (600) (S620). Client 1 (600) who received this with his session key Finish the session key verification by checking.

Table 5 summarizes the data flow of the end-to-end authentication method in a single server ticketless environment.

Client 1-> Authentication Server ID (A), ID (B), Authentication Server-> Client 2 ID (B), Client2-> Authentication Server ID (A), Authentication Server-> Client 1 ID (A),

7 is a diagram illustrating a communication device having an authentication function between terminals in a single server ticket environment according to the present invention.

Referring to FIG. 7, a communication apparatus having a terminal-to-terminal authentication function in a single server ticket environment according to the present invention includes an authentication server 700, a client 1 720, and a client 2 740. Client 1 720 and Client 2 740 are the first session key generator 721,741, the secret key generator 722, 742, the second session key generator 723, 743, the session key checker 724, 744, the receiver ( 724,744 and transmitters 725,745.

Configurations and functions of the client 1 720 and the client 2 740 are the same as those of the communication apparatus described with reference to FIG. 3, and thus a detailed description thereof will be omitted.

The authentication server 700 operates as the authentication server of the client 1 720 and the client 2 740 and has a private key for encrypting and decrypting the ticket. Since other functions and configurations are the same as those of the authentication servers 310 and 330 illustrated in FIG. 3, detailed descriptions thereof will be omitted.

The terminal-to-terminal authentication method in a single server ticket environment can be easily constructed by modifying the terminal-to-terminal authentication method in a multi-domain. In the multi-domain terminal-to-terminal authentication method, a symmetric key, K, is shared in a secure public key scheme for secure communication between the Kerberos domains. By converting such a pre-symmetric key K into a private key (PK) of the authentication server 700, a terminal-to-terminal authentication method is constructed in a single server ticket environment. The structure of the ticket is a form encrypted using PK. Except for that point, the remaining part is the same as the authentication method between the terminal to the terminal in the multi-server environment described with reference to FIG. Like K, however, it is assumed that PK is always stored safely.

Hereinafter, it will be described that the communication device and method having a terminal-to-terminal authentication function according to the present invention are safe from external attacks.

Attacker E is represented by E (1 ^k , m), a probabilistic polynomial time ( ^where 1 ^k is a safety parameter and m is useful information given to the attacker). Also, attacker E is a discrete algebra problem and Diffie-Hellman. Assume that it is impossible to solve the problem. Therefore any negligible function About It can be said.

First, we look at perfect forward secrecy in the DPA model.

When an attacker says the advantage of attacking perfect forward secrecy in the DPA model Seems to be.

Suppose that attacker E is given pwa. E (1 ^k , pwa) is , Can be decoded to obtain g ^x , g ^y . However, g ^x, g ^y E with ^{(1 k, pwa, g x} , g y) is unable to solve the Diffie-Hellman problem still Cannot be determined. If E is given up to R, the attacker can get cs and g ^a , g ^b , but E (1 ^k , pwa, g ^x , g ^y , g ^a , g ^b , R, cs) Still as long as you do not break the DHA Cannot be obtained. So the advantage of the attacker's perfect forward secrecy Determined by Since all session keys in the protocol are based on DHA, this result is natural.

Suppose that attacker E is given pwb. Like Case 1, the attacker can get g ^{x '} and g ^y' but not R '. Also, even if the attacker is given up to R ', E (1 ^k , pwa, g ^x , g ^y , g ^a , g ^b , R', cs) cannot obtain the session key sk unless it breaks the DHA.

(Case 3) The same applies to Case 1 and Case 2, even if the attacker is given both pwa and pwb. That is, E (1 ^k , pwa, pwb, g ^x , g ^y , g ^a , g ^b , R, R ', cs) Finding is equivalent to breaking DHA.

By case 1,2,3 Seemed.

Next, we look at the Denning-Sacco attack in the DPA model.

Assuming that the DPA model has the advantage that the co-worker will attack Denning-Sacco, Seems to be. There are two types of attackers: one is an outside attacker and the other is an insider attacker. An external attacker is an attacker who doesn't get pwa or pwb, and an internal attacker is a legitimate user registered on the system with either. Examine each case separately.

External attacker Assume that an external attacker who obtains R, sk, R 'rather than a password assumes that the attacker Can be obtained using the above information. However, this information does not help the attacker to proactively attack pwb or pwa. To verify the password pwa ', pwb' chosen by the attacker You should get However, since x, y, x ', y' is a random value that is chosen for each session, it is possible to advance the attack depending on the probability of guessing this value. This is determined by this. therefore , Which is (Where p is a large enough prime)

Internal attacker : to a legitimate user A who knows pwa Suppose is given. A legitimate internal attacker with an attempt to show that a prior attack on pwb is impossible. First of all, E is using R ' Can be obtained. However, E is due to the one-way nature of the hash function. in Cannot be obtained, Cannot be obtained. Is a very important value, if you The value is known Once the value is available, a pre-attack against pwa is possible by:

(Step 1) E is pwa Using To get.

(Step 2) E is pwa Using Value Obtained by decoding

(Step 3) The attacker selects the candidate password pwb 'for pwb, Is calculated, and this value is Compare with Eventually, by comparing the two values, it is possible to reduce the size of the candidate password size for pwb, thus enabling advance attack. In other words, to be safe in advance attack Value It must go through the blind process by. This probability determines the benefits of the Denning-Sacco attack, as it allows for pre-attacks as long as the probability of guessing. therefore Where p is a large enough prime.

Internal attacker Assume that attacker E is a legitimate attacker with pwb. To attacker E Even if given, it will show that a prior attack on the pwa is impossible. First, E is used by R Can be obtained. But E Because I do not know the value, Can't get the value. If attacker E If you can get the value, you can do a pre-attack against pwa by:

(Step 1) The attacker must Because I know By decrypting Get

(Step 2) Attacker Can be decrypted, Using Can be calculated.

(Step 3) E selects candidate pwa 'for pwa After calculating By decoding it, for any r ₁ , r ₂ Can be obtained. Attacker You can remove pwb from Exponential power pwa 'selected in, Then calculate the You can perform a pre-attack by comparing with. In other words, if the two values match, pwa 'is pwa, so the guess is successful. In other cases, the password dictionary size can be reduced. therefore Properly blinding is essential. Attacker With a probability of guessing This probability determines the benefit of the Denning-Sacco attack in this case. The problem of impersonating the user shown in the definition is that the session key verification process is performed because a and b are always randomly selected, so they cannot be used in subsequent sessions using the previous session key.

Thus, by case 1,2,3, Showed that.

Next, we look at dictionary attacks in the DPA model.

When attacker E is the advantage of performing a dictionary attack in the DPA model, To show that The analysis is similar to the Denning-Sacco attack, and is divided into two cases, an internal attacker and an external attacker.

(Case 1) In case of external attacker

The external attacker of the pre-attack means an attacker who does not own pwa or pwb but only tries to conduct a pre-attack against pwa, pwb by looking only at the contents of the protocol, assuming that the external attacker cannot obtain session keys. do. Each password is Encrypt it. Since x, y, x ', y' is randomly drawn from Z _q , the probability of pre-attack has the advantage of guessing this value. The transmission of the rest of the protocol does not help the advance attack because the attacker cannot obtain the session key. If q is a large enough prime, the possibility of a pre-attack of an external attacker has the advantage of negligible.

(Case 2) In case of internal attack

The internal attacker of a dictionary attack means an attacker who knows only one password of pwa or pwb and tries to launch a dictionary attack against another password. As in Case 1, we do not assume the problem of possessing a session key of an internal attacker. For a security analysis involving attacker's ability to obtain session keys, see Denning-Sacco Attacks in the DPA Model. Case 2 can be subdivided into an attacker who owns pwa only and an attacker who owns pwb. First, an attacker who owns pwa does not get any data about a prior attack against pwb unless he knows the session key R information. Even if we get the session key R, the pre-attack is impossible, as analyzed in the Denning-Sacco attack in the DPA model. Therefore, an internal attacker who owns a pwa can determine the benefit of a pre-attack with a probability of guessing x '. This has a negligible probability as analyzed in case 1. For an internal attacker who owns pwb, the same applies to the analysis above.

By case 1,2, It can be seen that can be ignored.

Next, we look at online guess attacks.

This attack can be prevented by specifying the number of failed login attempts. However, from the attacker's point of view, the password dictionary can be further reduced by the number of failures. Therefore, when the server rejects a number of R's, the probability that an attacker can guess to be.

Finally, we will look at mid- and replay attacks.

A main-in middel attack is one in which attacker E either legally masquerades or fools both entities. Attacker E, using all the conversations in the protocol, will not pass the session key verification process unless he or she knows pwa or pwb. Only users who know pwa or pwb are allowed to legally impersonate both entities. Replay attack refers to an attack that successfully impersonates a user or passes a key verification process by using a conversation content, which is used previously, in a next session. However, because all messages are made random or ephemeral for each session, the benefits of an attacker can be ignored.

Based on the above analysis, the following conclusions can be drawn.

Online guessing attacks are an inevitable attack in the password authentication key exchange protocol. Therefore, this advantage should be the lower limit of the probability of success when the attacker attacks the communication apparatus and method with the terminal-to-terminal authentication function according to the present invention in the DPA model. here Since it is negligible, it satisfies the safety definition defined above.

The invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

The foregoing descriptions are merely illustrative of preferred embodiments, and the present invention is not limited to the above-described embodiments and can be variously changed within the scope of the appended claims. For example, the shape and structure of each component specifically shown in the embodiment of the present invention can be modified.

According to the present invention, it provides authentication using different passwords between end-to-end terminals in a multi-zone and a single-zone, and is safe against offline dictionary attack, man-in-the-middle attack and replay attack The efficiency of the system can be improved by minimizing the server's participation in the session key formation process.

You can also reuse the ticket within the validity period of the ticket. I.e. tickets owned by the shell (Ticket _B) has, and transmits a ticket (Ticket _B) to the, while reducing the transmission rate of the inter-region also without a connection authentication server that belongs to its own zone.

Claims (34)

A receiving unit for receiving a ticket encrypted with a symmetric key shared by an authentication server and a server of a connection target terminal from the authentication server, and receiving a first encryption message encrypted with a hash key generated from the ticket from the connection target terminal; A transmitting unit which transmits the encrypted ticket to a connection target terminal; A secret key generation unit for generating a secret key shared with the connection target terminal based on the received first encryption message and password; And And a session key generator for generating a session key by decrypting the encrypted random value received from the terminal to be connected with the secret key. A first session key generation unit generating a first session key based on a first random value transmitted to the authentication server and a second random value received from the authentication server in response to the first random value; Receiving a first encrypted message encrypted with the symmetric key and the first session key encrypted between the authentication server and the server of the connection target terminal from the authentication server, the second encryption encrypted with the hash key generated from the ticket A receiving unit which receives a message from the terminal to be connected; A transmitter for transmitting the encrypted ticket to the connection target terminal; A secret key generation unit for generating a secret key based on the first encryption message, the second encryption message, and a password; And The second session key is encrypted based on the fourth random value received by encrypting with the secret key from the terminal to be responded to in response to the third random value and the third random value transmitted by encrypting with the secret key. And a second session key generation unit for generating a communication device having an authentication function between terminals. The method according to claim 1 or 2, The ticket includes ticket validity information, And a terminal-to-terminal authentication function, wherein the ticket is reused in the authentication process with the terminal to be connected if the valid period has elapsed. The method of claim 2, And a session key confirming unit for verifying the second session key by decrypting the fourth random value received after being encrypted with the second session key from the terminal to be connected. Communication device provided. The method of claim 2, And the first to fourth random values are selected within a predetermined range satisfying DHA (Diffie-Hellman Assumption). The method of claim 2, The authentication server receives a first random value encrypted with the password, transmits the second random value encrypted with the password, and generates and transmits the ticket and the first encryption message. Communication device having an authentication function between terminals. The method of claim 2, The authentication server operates as an authentication server for authenticating the connection target terminal. And the symmetric key is a private key stored in the authentication server. A receiving unit for receiving a ticket encrypted with a symmetric key shared by an authentication server and a server of a connection target terminal from the connection target terminal, and receiving the ticket decrypted with the symmetric key from the authentication server; A transmitter for transmitting the ticket to the authentication server; A secret key generation unit generating a secret key shared with the access target terminal based on the decrypted ticket and password; And And a session key generator for generating a session key by decrypting the encrypted random value received from the terminal to be connected with the secret key. A first session key generation unit generating a first session key based on a first random value transmitted to the authentication server and a second random value received from the authentication server in response to the first random value; Receiving a ticket encrypted with the symmetric key shared between the authentication server and the server of the connection target terminal from the connection target terminal, the first encryption message encrypted with the first session key and the second encryption encrypted with the hash key generated from the ticket Receiving unit for receiving a message from the authentication server; A transmitter for transmitting the encrypted ticket to the authentication server and transmitting the second encryption message to the client; A secret key generation unit generating a secret key based on the first password and the first encryption message; The second session key is encrypted based on the fourth random value received by encrypting with the secret key from the terminal to be responded to in response to the third random value and the third random value transmitted by encrypting with the secret key. And a second session key generation unit for generating a communication device having an authentication function between terminals. The method according to claim 8 or 9, The ticket includes ticket validity information, And a terminal-to-terminal authentication function, wherein the ticket is reused in the authentication process with the terminal to be connected if the valid period has elapsed. The method of claim 9, And a session key confirming unit for verifying the second session key by decrypting the fourth random value received after being encrypted with the second session key from the terminal to be connected. Communication device provided. The method of claim 9, And the first to fourth random values are selected in a predetermined range satisfying DHA (Diffie-Hellman Assumption). The method of claim 9, The authentication server receives the first random value encrypted with the password and the ticket, decrypts the ticket with the symmetric key, transmits the second random value encrypted with the password, the first encryption message and And a terminal-to-terminal authentication function, wherein the second encryption message is generated and transmitted. The method of claim 9, The authentication server operates as an authentication server for authenticating the connection target terminal. And the symmetric key is a private key stored in the authentication server. A receiving unit receiving a first random value encrypted with a password of the first client from a first client and a second random value encrypted with a password of the second client from a second client; Encrypting the first result value calculated by performing a predetermined logical operation on the received first and third random values with a password of the second client, and receiving the received second and third random values. An encryption unit for encrypting a second result value calculated by performing the logical operation on a value with a password of the first client; And Authentication unit with a terminal-to-terminal authentication function comprising a; transmission unit for transmitting the encrypted first result value to the second client and the encrypted second result value to the first client; system. The method of claim 15, A session key generation unit configured to generate a session key by performing a predetermined operation process based on the first random value, the second random value, and the third random value; And A session key verification unit for verifying the second session key based on the second random value encrypted with the session key by the first client and the first random value encrypted with the session key by the second client; Authentication system having an authentication function between the terminal to the terminal further comprising. The method of claim 15, The first random value, the second random value and the third random value are selected from a predetermined range satisfying Diffie-Hellman Assumption (DHA). . Receiving a ticket encrypted with a symmetric key shared by an authentication server and a server of a connection target terminal, from the authentication server; Transmitting the ticket to a connection target terminal; Receiving a first encryption message encrypted with a hash key generated from the ticket from the terminal to be connected; Generating a secret key shared with the terminal to be connected based on the received first encryption message and password; And And generating a session key by decrypting the encrypted random value received from the access target terminal with the secret key. Generating a first session key based on a first random value transmitted to the authentication server and a second random value received from the authentication server in response to the first random value; Receiving a ticket encrypted with a symmetric key shared between the authentication server and a server of a connection target terminal and a first encryption message encrypted with the first session key from the authentication server; Transmitting the encrypted ticket to the connection target terminal; Receiving a second encryption message encrypted with a hash key generated from the ticket from the terminal to be connected; Generating a secret key based on the first encryption message, the second encryption message and a password; And The second session key is encrypted based on the fourth random value received by encrypting with the secret key from the terminal to be responded to in response to the third random value and the third random value transmitted by encrypting with the secret key. Step of generating; Authentication method between the terminal to the terminal comprising a. The method of claim 18 or 19, The ticket includes ticket validity information, And if the validity period has elapsed, reusing the ticket in the authentication process with the terminal to be connected. The method of claim 19, And confirming the second session key by decrypting the fourth random value received after being encrypted with the second session key from the terminal to be connected. The method of claim 19, And the authentication server receives the first random value encrypted with the password, transmits the second random value encrypted with the password, and generates and transmits the ticket and the first encryption message. Authentication method between terminals. The method of claim 19, Wherein the first to fourth random values are selected within a predetermined range that satisfies a predetermined DHA (Diffie-Hellman Assumption). The method of claim 19, The authentication server operates as an authentication server for authenticating the connection target terminal. The symmetric key is a private key stored in the authentication server. Receiving a ticket encrypted with a symmetric key shared by an authentication server of an authentication server and a connection target terminal, from the connection target terminal; Transmitting the ticket to an authentication server; Receiving the ticket decrypted with the symmetric key from the authentication server; Generating a secret key shared with the access target terminal based on the decrypted ticket and password; And And generating a session key by decrypting the encrypted random value received from the terminal to be accessed with the secret key. Receiving a ticket encrypted with a symmetric key shared by the authentication server and the server of the connection target terminal, from the connection target terminal; Sending the encrypted ticket to the authentication server; Generating a first session key based on a first random value transmitted to the authentication server and a second random value received from the authentication server in response to the first random value; Receiving a first encryption message encrypted with the first session key and a second encryption message encrypted with a hash key generated from the ticket, from the authentication server; Transmitting the second encryption message to the connection target terminal; Generating a secret key based on the first encryption message and password; And The second session key is encrypted based on the fourth random value received by encrypting with the secret key from the terminal to be responded to in response to the third random value and the third random value transmitted by encrypting with the secret key. Step of generating; Authentication method between the terminal to the terminal comprising a. The method of claim 26, And confirming the second session key by decrypting the fourth random value received after being encrypted with the second session key from the terminal to be connected. The method of claim 26, Wherein the first to fourth random values are selected within a predetermined range that satisfies a predetermined DHA (Diffie-Hellman Assumption). The method of claim 26, The authentication server receives the first random value encrypted with the password and the ticket, decrypts the ticket with the symmetric key, transmits the second random value encrypted with the password, the first encryption message and And generating and transmitting the second encryption message. The method of claim 26, The authentication server operates as an authentication server for aquatic authentication of the connection target terminal. The symmetric key is a private key stored in the authentication server. Receiving a first random value encrypted with a password of the first client from a first client; Encrypting a result value calculated by performing a predetermined logical operation on the received first and second random values with a password of the second client and transmitting the encrypted result to the second client; Receiving a third random value encrypted with the password of the second client from the second client; And encrypting a result value calculated by performing the logical operation on the second random value and the received third random value with a password of the first client and transmitting the encrypted result to the first client. Terminal to terminal authentication method. The method of claim 31, wherein Generating a session key by performing a predetermined operation process based on the first random value, the second random value, and the third random value; And Identifying the second session key based on the second random value encrypted with the session key by the first client and the first random value encrypted with the session key by the second client; Terminal to terminal authentication method characterized in that. The method of claim 31, wherein Wherein the first random value, the second random value, and the third random value are selected within a predetermined range satisfying Diffie-Hellman Assumption (DHA). A computer-readable recording medium having recorded thereon a program capable of executing the terminal-to-terminal authentication method according to any one of claims 18, 19, 25, 26, and 31.