KR20050028720A - Authentication using human memorable password and public key cryptsystem - Google Patents

Abstract

An authentication technology using a human memorable password and a public key encryption system on communication environment is provided to offer security against diverse attacks by encrypting the password inputted from a user through the public key encryption system, while processing the human memorable password. A device-B generates a public/private key of the public key encryption system, opens the public key, and stores the private key. When the user inputs the password for registration, the device-B represents the private key. After mapping information for representing the password to other information, the device-B stores mapped information to a storage. When the user inputs the password in order to access the device-B(210), a device-A represents the password. After mapping the information representing the password to other value, the device-A encrypts the mapped information with the public key of the device-B and transmits an encryption result to the device-B(240). The device-B judges whether the user inputs the right password by comparing the result decrypting the information received from the device-A through the private key with the information stored in the storage.

Description

Authentication using human memorable password and public key cryptsystem}

Authentication is embodied by the authentication system in reality as the system accessor confirms the authorized user authorization. Examples of authentication systems include cryptographic technology based authentication systems and biometric systems. The present invention relates to a cryptographic technology based authentication system using a public key cryptosystem.

The cryptographic technology based authentication system includes a password system for processing secret information stored by a user and a challenge-response based system and a zero knowledge-based system for processing secret information stored in a medium. In reality, the challenge-response method is used as a medium that stores secret information that is difficult for the user to remember, and the Young Knowledge-based method is rarely used in reality due to inefficiency. The present invention relates to a password system.

The password system is divided into a case of storing a password in a storage device without processing the password and a case of storing a password processing result in a storage device using a cryptographic algorithm such as a hash function or a symmetric key block cryptographic algorithm. The present invention relates to a case where a result of processing a password using an encryption algorithm is stored in a storage device.

On the other hand, it is known that authentication techniques to date that use password algorithms are not safe from various attacks including off-line speculative attacks, authentication of password files, and guns.

The authentication technique according to the present invention has an object of presenting a secure authentication technique from various attacks while processing secret information that can be stored by the user. At this time, the secret information entered by the user is encrypted using a public key cryptosystem.

Let's say that the information you do not want your users to see is confidential. Examples of such secret information are passwords and passwords. The environment in which the user authentication encryption technology according to the present invention is used includes a device for enabling secret information input to a user, a device for determining whether the user has input correct secret information, and an information transmission path. In the present invention, a device for allowing the user to input secret information for convenience is called device A, and a device for determining whether the user inputs correct secret information is called device B. Here, device A and device B do not necessarily need to be different.

According to the present invention, a user authentication encryption technique includes (1) a process in which a device B generates a public key and a secret key of a public key cryptosystem, discloses the public key and stores the secret key, and (2) secret information for the user to register. When the device is input, the device B expresses the secret information, (3) the device B uses the information representing the secret information as another information, and stores the mapped information in the storage device, and (4) the user When the secret information is entered to access B, the process of expressing the secret information in the device A, (5) mapping the information representing the secret information in the device A to a different value and then maps the mapped information to the public key of the device B. Transmitting the encrypted result to the device B after encrypting using the same; (6) comparing the result of the device B decrypting the information received from the device A using the secret key with the information stored in the storage device. The user includes a process for determining the entity type the correct secret. In step (5), the device A does not necessarily map the information representing the secret information to another value.

Let P's secret information.

Device B generates a public key and a secret key of the determined public key cryptosystem, then publishes the public key and stores the secret key in storage. Here all known public key cryptosystems can be used, including RSA and elliptic curve cryptosystems.

1 illustrates a process of processing P in device B when a user inputs P to register. Referring to FIG. 2, when the user inputs P, the secret information expression function 2 and the secret information processing function 2 are sequentially operated in the device B, and information including the result of the secret information processing function 2 is registered (stored) in the storage device. do.

When the user inputs P ', processing for determining whether the user inputs P' with P '= P is divided into processing performed in device A and processing performed in device B.

FIG. 2 illustrates a process of the device A in a process for determining whether the user inputs P 'when P' = P when the user inputs P '. Referring to FIG. 2, when the user inputs P ', the secret information expression function 1 and the secret information processing function 1 are sequentially operated in the device A, and include the result of the secret information processing function 1 or the result of the secret information processing function 1. The information is encrypted by the device B's public key and transmitted to device B.

FIG. 3 illustrates a process of the device B in the process of determining whether the user inputs P 'when P' = P when the user inputs P '. Referring to FIG. 3, the secret information comparison function operating on the device B decrypts the encrypted information from the device A and uses the information received from the device A including the decrypted information and the information stored in the device B. It is determined whether or not P 'is input. The result of the decision is to allow system access only when the user enters P 'with P' = P.

Now, when the user inputs P to register, the secret information expression function 2 and the secret information processing function 2 in the device B will be described.

Let secret information expression function 2 be F ₂ . Then, F ₂ expresses P by selecting one of various numbers that can express P. For example, suppose that F ₂ represents P as a (X ₁ , X ₂ ) pair that satisfies P = X ₁ -X ₂ , and F ₂ is _one of the infinite branches of the (X ₁ , X ₂ ) pair. Choose to express P.

These inputs and outputs of F ₂ can be generalized as follows. The input of F ₂ is a subset of P and a set of operators and operands, and the output of F ₂ is a subset of the set of operands. Here, the union of the subset of the operand set that is the input of F _{2 and} the subset of the operand set that is the output is an operand set. For example, suppose that F ₂ represents P as a (X ₁ , X ₂ ) pair that satisfies P = X ₁ -X ₂ , and the input of F ₂ is P and the operator set {-} and the operand set {X ₁ , X ₂ } is an empty set and the output of F ₂ is {X ₁ , X ₂ }, which is a subset of the set of operands. Here, in a subset of the F of the operand set input of a _second empty set and the output operand set union of {X _1, X _2} subset {X _1, X _2} of the the {X _1, X _2} operand set to be.

The secret information P and a set of operators F ₂ O, F ₂ and outputting a set of operand part F ₂ Q to the input the portion of the operand set set _{F 2 P F 2 (P,} F 2 O, F 2 P) = F 2 It is represented by Q. Here, the order in which the operators in F ₂ O are applied and the operands for the operators are predetermined between devices A and B. For example, when F ₂ (P, {+, mod}, {N}) = {X ₁ , X ₂ }, perform X ₁ + X _{2 and} then perform (X ₁ + X ₂ ) mod N It is predetermined between the device A and the device B. In X mod Y, mod is the operator that takes the remainder of X divided by Y as the result.

In a preferred embodiment of the F _2, F ₂ of the at least one element Q when Q is F ₂ rather than {P} is a number extracted at random.

In a preferred embodiment of the _{F 2, F 2 (P,} Ø, Ø) = a {P}.

In a preferred embodiment of the F _2, F ₂ is the (P, {+}, Ø ) = {X 21, X 22}. Here, X ₂ may be a negative integer.

F In a preferred embodiment of a _2, a F ₂ (P, {+, mod} , {N}) = {X 21, X 22}.

F In a preferred embodiment of a _2, a F ₂ (P, {+, mod} , Ø) = {X 21, X 22, N}.

In a preferred embodiment of the _{F 2, F 2 (P,} { }, Ø) = {X ₂₁ , X ₂₂ }.

In a preferred embodiment of the _{F 2, F 2 (P,} { }, Ø) = {X ₂₁ , X ₂₂ }. From here Denotes an exclusive logical product.

Let secret information processing function 2 be G ₂ . Then, G ₂ is the element in the subset of the F ₂ Q (a) or a function which maps to a different value by the elements present in a subset of the F ₂ Q or a function which maps a value to a different value F ₂ Q A function that maps a value to another value by mapping the elements in the subset of to other values.

The elements in a subset of the F ₂ Q G ₂ I represents G ₂ which maps to a different value in G ₂ (G ₂ I) = G ₂ O, using the element G ₂ I in a subset of the F ₂ Q G ₂ , which maps one value W to another, is represented by G ₂ (G ₂ I, W) = G ₂ O, and the element G ₂ I in the subset of F ₂ Q is converted to another value M (G ₂ I). A function of mapping a value W to another value using the mapped value is represented by G ₂ (M (G ₂ I), W) = G ₂ O.

In a preferred embodiment of G ₂ (G ₂ I), G ₂ O = G ₂ I.

As a preferred embodiment of G ₂ (G ₂ I), G ₂ is a trapdoor one-way function.

As a preferred embodiment when G ₂ is a trapdoor unidirectional function, G ₂ O = {X ₁ ² mod M} for X ₁ ∈F ₂ Q. Where M is the product of two odd numbers.

As a preferred embodiment of G ₂ (G ₂ I), G ₂ is a one-way hash function.

As a preferred embodiment when G ₂ is a one-way hash function, G ₂ O = {H (X ₁ )} for X ₁ ∈F ₂ Q. Where H represents a hash function.

As a preferred embodiment of G ₂ (G ₂ I, W), G ₂ is a symmetric key block cryptographic algorithm that encrypts W using G ₂ I as a key.

As a preferred embodiment when G ₂ is a symmetric key block cryptographic algorithm, G ₂ O = {E (X ₁ , W)} for X ₁ ∈F ₂ Q. In E (X ₁ , S), E represents a symmetric key block cryptographic algorithm that encrypts the bitstring W with X ₁ as the key.

As a preferred embodiment of G ₂ (M (G ₂ I), W), G ₂ is a symmetric key block cryptographic algorithm that encrypts W using M (G ₂ I) as a key.

As a preferred embodiment when G ₂ is a symmetric key block cryptographic algorithm, M is a trapdoor one-way function.

As a preferred embodiment when G ₂ is a symmetric key block cryptographic algorithm, G ₂ O = {E (X ₁ , W)} for X ₁ ∈F ₂ Q. In E (X ₁ , S), E represents a symmetric key block cryptographic algorithm that encrypts the bitstring W with M (X ₁ ) as the key.

Now, the information stored in the storage of the device B will be described. For convenience, when the information stored in the storage device of the device B is represented as a set, the storage device of the device B stores {G ₂ O, F ₂ QG ₂ I}.

When the user inputs P ', before the device B determines whether P = P', how the secret information presentation function 1 and secret information processing function 1 operate in the device A and what information is determined by the public key of the device B. We will describe the information that is encrypted and transmitted from device A to device B.

Let's represent the secret expression function 1 as F ₁ . Then, F ₁ represents P by selecting one of various numbers that can represent P. For example, suppose that F ₁ represents P as a (X ₁ , X ₂ ) pair that satisfies P = X ₁ -X ₂ , and F ₁ is _one of the infinite branches of the (X ₁ , X ₂ ) pair. Choose to express P.

The input and output of F ₁ can be generalized as follows. The input of F ₁ is a subset of P and the operator and operand sets, and the output of F ₁ is a subset of the operand sets. Here, the union of the subset of the operand set that is the input of F _{1 and} the subset of the operand set that is the output is an operand set. For example, suppose that F ₁ represents P as a (X ₁ , X ₂ ) pair that satisfies P = X ₁ -X ₂ , and the input of F ₁ is P and the operator set {-} and the operand set {X ₁ , X ₂ } is an empty set and the output of F ₁ is {X ₁ , X ₂ }, which is a subset of the set of operands. Here, in the F input of a subset of the operand set of the _first empty and the output operand set {X _1, X _2} The union of the subset of {X _1, X _2} is the {X _1, X _2} operand set to be.

The secret information P and a set of operators F ₁ O, F ₁ which outputs a set of operand portions F ₁ Q using as input a part of the operand set set _{F 1 P F 1 (P,} F 1 O, F 1 P) = F 1 It is represented by Q. Here, the order in which the operators in F ₁ O are applied and the operands for the operators are predetermined between the devices A and B. For example, when F ₁ (P, {+, mod}, {N}) = {X ₁ , X ₂ }, perform X ₁ + X _{2 and} then perform (X ₁ + X ₂ ) mod N It is predetermined between the device A and the device B.

In a preferred embodiment of the F _1, F ₁ Q is at least one element of F ₁ Q for non-{P} is a number extracted at random.

In a preferred embodiment of the _{F 1, F 1 (P,} Ø, Ø) = a {P}.

In a preferred embodiment of the F _1, F ₁ is (P, {+}, Ø ) = {X 11, X 12}. Where X ₁₂ can be a negative integer.

In a preferred embodiment of the F _1, F ₁ is (P, {+, mod} , {N}) = {X 11, X 12}.

In a preferred embodiment of the F _1, F ₁ is (P, {+, mod} , Ø) = {X 11, X 12, N}.

In a preferred embodiment of the _{F 1, F 1 (P,} { }, Ø) = {X ₁₁ , X ₁₂ }.

In a preferred embodiment of the _{F 1, F 1 (P,} { }, Ø) = {X ₁₁ , X ₁₂ }.

Let secret information processing function 1 be represented by G ₂ . Then, G ₁ has the elements in the subset of the F ₁ Q (a) or a function which maps to a different value by the elements present in a subset of the F ₁ Q or a function which maps a value to a different value F ₁ Q A function that maps one value to another using a value that maps elements in a subset of to a different value, or maps the result of an operation on an element and a value in a subset of F ₁ Q to a different value. Is a function.

Represents a G ₁ which maps the elements in a subset of the F ₁ Q G ₁ I (a) to another value G ₁ O in G ₁ (G ₁ I) = G ₁ O, F subset of the ₁ Q G ₁ I the G ₁ which maps the results taken in the operation element and a certain value W to a different value in the indicated by G ₁ (G ₁ I⊙W) = G ₁ O, the elements present in a subset of the F ₁ G ₁ Q I G ₁ , which maps one value W to another, is represented by G ₁ (G ₁ I, W) = G ₁ O and maps the elements in subset G ₁ I of F ₁ Q to other values. G ₁ , which maps one value W to another, is represented by G ₁ (M (G ₁ I), W) = G ₁ O.

In a preferred embodiment of G ₁ (G ₁ I), G ₁ O = G ₁ I.

As a preferred embodiment of G ₁ (G ₁ I), G ₁ is a trapdoor one-way function.

As a preferred embodiment when G ₁ in G ₁ (G ₁ I) is a trapdoor unidirectional function, G ₁ O = {X ₁ ² mod M} for X ₁ ∈F ₁ Q. Where M is the product of two odd numbers.

As a preferred embodiment of G ₁ (G ₁ IW), ⊙ is + and G ₁ is a trapdoor one-way function.

In the case of G ₁ (G ₁ IW), where ⊙ is + and G ₁ is a trapdoor unidirectional function, G ₁ O = {(X ₁ + W) ² mod for X ₁ ∈F ₁ Q M}.

As a preferred embodiment of W in G ₁ (G ₁ IW), W is a timestamp, a random number, or a value that adds a fixed value to the value of W used in the user's previous system approach to be the new W.

As a preferred embodiment of G ₁ (G ₁ I), G ₁ is a one-way hash function.

As a preferred embodiment when G ₁ is a one-way hash function, G ₁ O = {H (X ₁ )} for X ₁ ∈F ₁ Q.

As a preferred embodiment of G ₁ (G ₁ I, W), G ₁ is a symmetric key block cryptographic algorithm that maps W to different values using elements in a subset of F ₁ Q.

As a preferred embodiment when G ₁ is a symmetric key block cryptographic algorithm, G ₁ O = {E (X ₁ , W)} for X ₁ ∈F ₁ Q. In E (X ₁ , W), E represents a symmetric key block cryptographic algorithm that encrypts the bitstring W with X ₁ as the key.

As a preferred embodiment of G ₁ (M (G ₁ I), W), M is a trapdoor one-way function and G ₁ is a symmetric key block cryptographic algorithm that maps W to another value using M (G ₁ I). .

As a preferred embodiment when G ₁ is a symmetric key block cryptographic algorithm in G ₁ (M (G ₁ I), W), for X ₁ ∈ F ₁ Q, M maps X ₁ to X ₁ ² mod M . Where M is the product of two odd numbers.

_{G 1 (M (G 1 I} ), W) G 1 is a symmetric key block as a preferred embodiment in the case where the encryption _{algorithm, X 1 ∈F G 1 O =} {E (M (X 1) with respect to ₁ Q in, W)}. In E (M (X ₁ ), W), E represents a symmetric key block cryptographic algorithm that encrypts the bitstring W with M (X ₁ ) as the key.

The information (s) transmitted from device A to device B will now be described. For convenience, the information (s) transmitted from the device A to the device B are represented as a set. Shows a result taken by the operation for the elements with which the value W in the subset of Q F ₁ G ₁ to G I ₁ which maps to a different value in G ₁ (G ₁ I⊙W) G ₁ = O, in the F ₁ Q subset with elements in the G ₁ I represents a G ₁ which maps any value W to a different value in G ₁ (G ₁ I, W) = G ₁ O, with a subset of the F ₁ Q G ₁ I G ₁ (M (G ₁ I), W) = G ₁ O is represented by G ₁ which maps a value W to another value by using an element mapped to another value.

Device A then encrypts each value belonging to G ₁ O using the public key of device B, or encrypts some of the values belonging to G ₁ O and does not encrypt others.

Device A transmits a non-encrypted value, if some of the values belonging to the result and the G ₁ O encrypted values belonging to G ₁ O that is not encrypted to the device B.

Now, when the user inputs P ', a method of determining whether the user inputs P' with P = P 'in the secret information comparison function of the device B will be described.

The secret information comparison function first decrypts the encrypted information. The secret information comparison function uses the information J received from G ₂ O and the device A to determine whether the user inputs P with P = P ′. At this time, the secret information comparison function is performed by using {G ₁ O, F ₁ QG ₁ I} and G ₂ O or {G ₁ O, W, F ₁ QG ₁ I} and G ₂ O In order to determine ', {G ₁ O, F ₁ QG ₁ I} and G ₂ O must be comparable and {G ₁ O, W, F ₁ QG ₁ I} and G ₂ O must be comparable. Here, comparable means that the secret information comparison function can determine whether P 'is input, where P = P'. For example, F ₂ (P, Ø, Ø) = {P}, G ₂ I = P, G ₂ O = G ₂ I, G ₁ I = P, G ₁ (M (G ₁ I), W) Where M is a function that maps P to P ² mod M and G ₁ is a symmetric key block cryptographic algorithm that encrypts W using M (G ₁ I) as the key and W is the hash value H of the bitstrings S and S Assume that (S) is the result of splicing and that the results of G ₁ (M (G ₁ I), W) are transferred from device A to device B. Then, the secret information comparison function calculates P ² mod M, which is a key of the symmetric key block cryptographic algorithm, using P stored in the memory, and then decrypts G ₁ (M (G ₁ I), W). After confirming that the decoded result W is the result of concatenating the hash values H (S) of the bitstrings S and S, the user is limited to the case where W is the result of concatenating the hash values H (S) of the bitstrings S and S. Can be determined to input P 'with P = P', so that {G ₁ O, F ₁ QG ₁ I} and G ₂ O are comparable.

The secret information comparison function uses the comparable {G ₁ O, F ₁ QG ₁ I} and G ₂ O or {G ₁ O, W, F ₁ QG ₁ I} and G ₂ O Determine whether P 'is entered.

The present invention provides an authentication technique that is secured from attacks against various authentication techniques using a user-rememberable secret information and a public key cryptosystem.

1 is a diagram showing functions and an operation sequence of functions when a user inputs secret information to register;

2 is a diagram illustrating the functions used and the operation order of the functions used before determining whether the user has entered the correct secret information;

3 is a diagram illustrating a function for determining whether a user inputs correct secret information and input information of a function

Claims (21)

A secret information expression function for expressing secret information by selecting one of various kinds of secret information when the user inputs to register secret information; Considering the result of the secret expression function as a set, a function that maps elements in the subset of the set that is the result of the secret expression function to another value or a subset of the set that is the result of the secret expression function. A function that maps one value to another by using an element to map one value to another, or a value that maps an element in a subset of the set that is the result of the secret expression to another. A secret information expression function including a secret information processing function, which is a function, and expresses secret information by selecting one of various kinds of secret information in the process of determining whether the user is an authorized user; Considering the result of the secret expression function as a set, a function that maps elements in the subset of the set that is the result of the secret expression function to another value or a subset of the set that is the result of the secret expression function. A function that maps a value to another using an element or maps a value to another using a value that maps an element in the subset of the set that is the result of the secret expression to another. Secret information processing function; And a secret information comparison function that compares the result of the secret information processing function when the user inputs to register the secret information with the result of the secret information processing function at the time of determining whether the user is an authorized user. Authentication password technology. 2. The user authentication cryptography technique of claim 1, wherein said secret information expressing function represents a user's secret information as a sum of integers. 2. The user authentication cryptography technique of claim 1, wherein the secret information expression function modifies the secret information of the user on the result of the addition of the integers. 2. The user authentication cryptography technique of claim 1, wherein the secret information expressing function represents the secret information of the user by one of the logical sum or logical product of the bitstrings. 6. A user authentication cryptographic technique according to any one of claims 2 or 3 or 4 or 5, wherein at least one integer is selected at random. 2. The user authentication cryptography technique of claim 1, wherein the secret information processing function is a trapdoor one-way function. 7. The user authentication of claim 6, wherein a trapdoor one-way function maps X ₁ to X ₁ ² mod M (M is the product of two odd numbers) for an element X ₁ in the set that is the result of the secret expression function. Password technology. 2. The user authentication cryptography technique of claim 1, wherein the secret information processing function is a one-way hash function. 9. A user cryptographic description as recited in claim 8, wherein the hash function H maps X ₁ to H (X ₁ ) for an element X ₁ in the set that is the result of said secret information presentation function. 2. The user authentication cryptography technique of claim 1, wherein the secret information processing function is a symmetric key block cryptographic algorithm. 11. A user authentication cryptography technique as recited in claim 10, wherein the symmetric key block cryptographic algorithm encrypts the bitstring using X ₁ as the key for one element X ₁ in the set that is the result of the secret information function. The method of claim 10, wherein the secret information X ₁ with respect to the element X ₁ in the resulting set of representations function is mapped to the X ₂ symmetric key block cipher algorithm, a user authentication password to encrypt the bit string by using the X ₂ km Technology. 2. A user according to claim 1, comprising a secret processing function which maps the result of adding X ₁ to another element X ₁ in the set which is the result of the secret information function to another value by a trapdoor one-way function. Authentication password technology. 15. The user authentication cryptographic technique of claim 13, wherein the trapdoor one-way function maps X ₁ + W to (X ₁ + W) ² mod M (M is the product of two odd numbers). 14. The user authentication password technique of claim 13, wherein the value added to X ₁ is a timestamp or random number or a result of adding a fixed value to the value used in the user's previous system access. 2. The user of claim 1, wherein the secret information comparison function inputs a value other than the value used in the secret information processing function among the result values of the secret information processing function and the secret information expression function in the process of determining the authorized user. Authentication password technology. 2. The user of claim 1, wherein the secret information comparison function inputs a value other than the value used in the secret information processing function among the result values of the secret information processing function and the secret information expression function in the process of determining the authorized user. Authentication password technology. 2. The user authentication encryption technique according to claim 1, wherein the secret information comparison function is a value which is not a value by the secret information expression function or a result processed by the secret information processing function. 2. The user authentication cryptography technique of claim 1, further comprising encrypting any or all of the results of the secret information processing function using a public key cryptosystem. The user authentication encryption technique of claim 1, wherein the secret information comparison function further includes a portion for decrypting the received cipher text using the secret key in the storage device. 21. A user authentication as claimed in any of claims 19 or 20, using a public key cryptographic system of any one of RSA, elliptic curve cryptographic system, ElGamal, RABIN for either cipher text or for decryption of cipher text.