WO2011152084A1

WO2011152084A1 - Efficient mutual authentication method, program, and device

Info

Publication number: WO2011152084A1
Application number: PCT/JP2011/053093
Authority: WO
Inventors: 尚宜佐藤; 恵輔伯田
Original assignee: 株式会社日立製作所
Priority date: 2010-05-31
Filing date: 2011-02-15
Publication date: 2011-12-08
Also published as: JP5393594B2; JP2011250335A

Abstract

Challenge-response type mutual authentication combines a signature method and a public key encryption method. When a signature is generated, the signature method makes it possible for the amount of processing performed when signature target data is input to be decreased by means of precomputation. When encryption is performed for public key encryption, the public key encryption method makes it possible for the amount of processing performed when encryption target data is input to be decreased by means of precomputation. By focusing on procedures which can perform precomputation as well as performing authentication, the actual processing time for authentication is reduced to a comparable level with mutual authentication based on common key encryption.

Description

Efficient mutual authentication method, program, and apparatus

Import by reference

This application claims the priority of Japanese Patent Application No. 2010-123722 filed on May 31, 2010, and is incorporated herein by reference.

The present invention relates to security technology, and more particularly to technology for mutually authenticating a partner or a device.

Authenticating technology is a technology for confirming that the other party of communication or dialogue is the intended person or thing, and is a fundamental technology for ensuring security in devices that can be accessed by Internet communications and unspecified majority. Authentication includes a method using an encryption technique and biometric authentication in which identity verification is performed based on biometric information.

In any case, authentication is performed at the beginning of communication or the like, and if it is the intended partner, permission to enter the room or encrypted communication using the shared key after executing the key sharing protocol. At that time, if the authentication is not secure and the other party's legitimacy is unclear, it is guaranteed that unauthorized use of the service and leakage of confidential information are prevented by providing subsequent services and sending / receiving important information. I can't do it. The security of certification should be carefully considered.

In authentication using encryption technology, a certain user (or thing) is executed in the form of creating certain data based on confidential information known only by the user and confirming it with the other party. It must be configured using encryption technology so that the secret information of the user is not shared with the other party after the authentication process.
Authentication methods using cryptographic techniques are mainly divided into those based on common key cryptographic techniques and those based on public key cryptographic techniques (see, for example, Non-Patent Documents 1 and 2).

Here, the secret key (Secret key) is shared in advance between the two parties to be authenticated, and when one of them authenticates the other, only the one that has the secret key (Secret key) is executed The method of determining whether or not it is possible is called common key encryption technology-based authentication. Using common key cryptography, a random number is encrypted, and it is confirmed whether the other party can be decrypted correctly. A challenge response type authentication based on the common key cryptography and a message authenticator (Message Authentication Code, MAC) ) Is generated, and MAC-based authentication or the like that confirms whether or not the MAC is correct is typical.

In authentication based on public key cryptography, only the prover (person who proves himself / herself) has the private key (Private key), and the verifier uses the corresponding public key to obtain the private key (Private key). This is a method for judging whether or not the correct certifier is based on whether or not only the possessed item can execute the possible processing. Use public key cryptography such as RSA cryptography to check whether the other party can correctly decrypt the encrypted random number, public key cryptography based authentication, or ask the other party to generate a digital signature for the random number, There are digital signature-based authentication for confirming whether or not the signature is correct, and public-key cryptography-based authentication methods (for example, see Non-Patent Document 3) designed exclusively for authentication.

In the authentication using encryption technology, the authentication based on the common key encryption technology generally has a fast processing speed and a relatively small implementation scale, so that authentication with a low resource device such as an IC card or a large number of users is possible. It is used in servers that have to process them simultaneously, and ticket gates that have to complete authentication in a very short time.

However, there are problems such as the cost for pre-sharing keys and the explosive increase in the number of secret keys (Secret key) required due to the increase in the number of users. Depending on the system, there is one secret key (Secret key) for multiple users. ) May be used. But obviously such a compromise is a safety issue. For example, as an extreme example, when operating with a single secret key (Secret key) that is common in the system, the security of the entire system is compromised due to the leakage of the key from one user, and the entire key is replaced. A large-scale recovery process occurs. In this way, in a system with a large number of users, it is necessary to spend key management costs in order to ensure security.

On the other hand, in the authentication based on public key cryptography, each user has one private key (Private key) and the corresponding public key is made public, so the key management cost is lower than the authentication based on common key cryptography. I'll do it. That is, the secret information that may be leaked from one user is the user's own private key (Private key), and the influence on the entire system is minimal.

However, in general, the processing speed of public key cryptography is about 100 to 1000 times slower than the authentication based on the common key cryptography, and the memory area and circuit scale required for implementation also increase. Although there is an example in which it is mounted on an IC card and used, it must be a system that can take a processing time for authentication from one second to several seconds.

Such a long processing time is not allowed in the mutual authentication between the IC card and the ticket checker at the ticket gate of public transportation, and the current situation is that the authentication based on the common key encryption technology has to be used. Also, even when it is necessary to instantly authenticate between cars passing each other at high speed, the authentication based on the public key cryptosystem takes too much time.

In this way, in authentication using cryptographic technology, it is necessary to realize an authentication method that achieves the processing speed as in the common key cryptographic technology base while having the ease of key management as in the public key cryptographic technology based authentication. It has been.

In this specification, public key cryptography and digital signature (online / offline publication) that can be executed as fast as common key cryptography by executing pre-calculation in mutual authentication and performing processing after an actual processing target is input. And a mutual authentication technique using a combination of key encryption and online / offline signature).

As disclosed, by performing pre-calculation, it is possible to achieve a processing speed equivalent to mutual authentication based on the common key encryption technology during actual authentication.

As a result, the key management cost can be reduced, and mutual authentication with low-resource devices such as IC cards, high-speed mutual authentication that requires instantaneous processing, and speeding up of a server that performs simultaneous processing for a large number of users can be achieved. It becomes possible.

As an example, in a system including two types of devices A and B capable of transmitting and receiving data by communication, mutual authentication in which the device A and the device B mutually confirm the validity of the partner device is disclosed. Is the method.

The above mutual authentication method is
In the step in which the device A confirms the validity of the device B,
According to apparatus A above
Generating a random number rA during authentication;
Transmitting the generated random number rA to the device B;
According to device B above
Generating a signature for the random number rA using the stored signature generation pre-calculation data after receiving the random number rA;
Transmitting the generated signature to the device A;
According to apparatus A above
Verifying the received signature using the signature verification key of device B;
Determining that the device B is valid if it is determined that the signature is correct, and determining that the device B is invalid if it is determined that the signature is not correct.

Further, in the mutual authentication method, in the step where the device B performing mutual authentication confirms the validity of the device A,
According to device B above
Generating a random number rB during authentication;
Performing public key encryption of the random number rB using the stored pre-calculation data for encryption;
Transmitting the ciphertext resulting from the encryption to the device A;
According to apparatus A above
Decrypting the received ciphertext using the private key of the device A;
Transmitting the decryption result to the device B;
According to device B above
Collating the stored random number rB with the decryption result received from the device A;
A step of determining that the device A is valid if the random number rB matches the decryption result, and determining that the device A is invalid if they do not match.

According to the present invention, key management costs can be reduced and high-speed mutual authentication can be performed.
Other objects, features and advantages of the present invention will become apparent from the following description of embodiments of the present invention with reference to the accompanying drawings.

The figure which illustrates the outline of the mutual authentication apparatus which is 1st embodiment. The figure which illustrates the sequence of the signature utilization part in mutual authentication. The figure which illustrates the sequence of the public key encryption utilization part in mutual authentication. The figure which illustrates the structure of the reader / writer and IC card in 2nd embodiment. The figure which illustrates the sequence of the proxy prior calculation process in 2nd embodiment. The figure which illustrates the structure of the mass user and server in 3rd embodiment. The figure which illustrates the structure of the traveling vehicle and roadside machine in 4th embodiment.

Embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a schematic diagram of mutual authentication executed by the mutual authentication device A100 and the mutual authentication device B200 according to the first embodiment of the present invention.

As illustrated, the mutual authentication device A100 includes a processing unit 110, a storage unit 120, a random number generation unit 131, and an external communication unit 132.

The mutual authentication device B includes a processing unit 210, a storage unit 220, a random number generation unit 231, and an external communication unit 232.

The external communication unit 132 of the mutual authentication device A100 and the external communication unit 232 of the mutual authentication device B200 can communicate with the communication line 310 via a network.

In this embodiment, mutual authentication between the mutual authentication device A100 and the mutual authentication device B is performed.

The processing unit 110 of the mutual authentication apparatus A100 includes a signature verification unit 111 and a public key encryption / decryption unit 112. The storage unit 120 of the mutual authentication apparatus A100 includes a signature verification key storage area 121 that stores the signature verification key of the mutual authentication apparatus B200, and a public key encryption / decryption key storage area 122 that stores the decryption key of the mutual authentication apparatus A100. Prepare.

The processing unit 210 of the mutual authentication apparatus B200 includes a signature generation unit 211, a public key encryption / encryption unit 212, and a pre-data calculation unit 213 used for signature generation and public key encryption / encryption. The storage unit 220 of the mutual authentication device B200 includes a signature generation key storage region 221 that stores the signature generation key of the mutual authentication device 200, a public key encryption / cryptography key storage region 222 that stores the public key of the mutual authentication device A, and A calculation data storage area 223 and a temporary data storage area 224 are provided.

The signature verification unit 111 reads the signature verification key from the signature verification key storage area 121 and performs signature verification on the signature verification target data obtained through the external communication unit 132.

The public key encryption / decryption unit 112 reads the decryption key from the public key encryption / decryption key storage area 122 and decrypts the decryption target data obtained via the external communication unit 132.

The signature generation unit 211 reads the signature generation key from the signature generation key storage area 221, reads the precalculation data from the precalculation data storage area 223, obtains a random number from the random number generation unit 231, and is obtained via the external communication unit 232. The signature is generated for the signature generation target data.

The public key encryption / encryption unit 212 reads the encryption key from the public key encryption / encryption key storage area 222, reads the precalculation data from the precalculation data storage area 223, and encrypts the random number obtained from the random number generation unit 231.

The prior data calculation unit 213 is obtained from the signature generation key read from the signature generation key storage area 221 and the random number generation unit 231 at an arbitrary time before the mutual authentication device A100 and the mutual authentication device B200 perform mutual authentication. All the calculations necessary for signature generation that can be executed before the signature target data is given are performed using the random numbers, and the results are stored in the precalculation data storage area 223. The prior data calculation unit 213 obtains the encryption key read from the public key encryption / decryption key storage area 222 and the random number generation unit 231 at an arbitrary time before the mutual authentication device A100 and the mutual authentication device B200 perform mutual authentication. Using the obtained random number, all calculations necessary for encryption that can be executed before the data to be encrypted are given are performed, and the results are stored in the pre-calculated data storage area 223.

The functions of the

processing units

110 and 210 of the mutual authentication device A100 and the mutual authentication device B200 are executed by a CPU that executes a program stored in the storage device in a computer including a CPU, a storage device, and a communication device. This is realized. Similarly, the random

number generation units

131 and 231 may be realized by the CPU executing a program, or may be realized by hardware.

The program may be stored in the storage device in advance, or if necessary, the program is introduced into the storage device from another device via an external interface or communication device (not shown) and a medium that can be used by the computer. May be. The medium refers to, for example, a storage medium that can be attached to and detached from an external interface, or a communication medium (that is, a wired, wireless, optical network, or a carrier wave or digital signal that propagates through the network 320).

In the mutual authentication between the mutual authentication device A100 and the mutual authentication device B200, the mutual authentication device A first obtains a random number rA from the random number generation unit 131 and transmits it from the external communication unit 132 to the mutual authentication device B. The random number rA is sent to the external communication unit 232 via the communication line 310, the network 320, and the like.

The mutual authentication device B generates a signature sB according to the above procedure for the sent random number rA. Further, a random number rB is obtained from the random number generator 231 and stored in the temporary data storage area 224. Further, rB is encrypted by the above procedure to calculate ciphertext C. The external communication unit 232 transmits sB and C to the mutual authentication device A.

The mutual authentication device A first verifies the signature of sB and C obtained through the external communication unit 132 by the above procedure for sB. If it is determined that the signature is correct, it is determined that the mutual authentication device B is correct, then C is decrypted by the above procedure, and the decryption result rB ′ is transmitted to the mutual authentication device B via the external communication unit 132 again. If the signature is not judged correct, the mutual authentication device B is not judged correct.

The mutual authentication device B compares the rB ′ received via the external communication unit 232 with the rB read from the temporary data storage area 224 and determines that the mutual authentication device A is correct.
If they do not match, the mutual authentication device A is not judged correct.

The signature method used in the mutual authentication may be any method that can reduce the processing amount when the signature target data is input by performing pre-calculation before the signature target data is input in the signature generation. Further, the public key encryption method used in the mutual authentication method is a method that can reduce the amount of processing when data to be encrypted is input by performing pre-calculation before the data to be encrypted is input in encryption. Anything is fine.

FIG. 2 is a sequence diagram showing processing of a signature use part of mutual authentication when an elliptical Schnoor signature (see Non-Patent Document 3) is used as an example of a signature method.

The rational point P on the elliptic curve suitable for elliptical Schnoor signature is fixed and stored in the signature verification key storage area 121 of the mutual authentication apparatus A100 and the signature generation key storage area of the mutual authentication apparatus B200. The private key (Private key) x of the mutual authentication device B 200 is stored in the signature generation key storage area 221, and the public key Q = xP is stored in the signature verification key storage area 121.

First, as pre-computation on the mutual authentication device B 200 side, the data of the rational point P is read from the signature generation key storage area (S10), then the random number generation unit 231 generates a random number r and sends it to the pre-data calculation unit 213 (S11). ). The pre-data calculation unit 213 calculates R = rP, and stores r and R in the pre-calculation data storage area 223 (S12).

Next, when the mutual authentication device A100 authenticates the mutual authentication device B, first, the random number generation unit 131 generates a random number rA and transmits it to the mutual authentication device B200 through the external communication unit 132 (S13).

After receiving rA through the external communication unit 232, the mutual authentication device B200 reads r and R from the precalculation data storage area 223 (S14), and reads the signature generation key x from the signature generation key storage area 221 (S15).

The signature generation unit 211 calculates S = r + H (rA, R). Here, H is a hash function. The mutual authentication device B200 transmits [R, H (rA, R), S] as a signature value for rA to the mutual authentication device A100 through the external communication unit 232 (S16).

Upon receiving the signature values [R, H (rA, R), S] through the external communication unit 132, the mutual authentication device A100 first uses the signature verification unit 111 to open the public key Q of the mutual authentication device B200 from the signature verification key storage area 121. The system parameter P is read (S17), and it is checked whether or not R = SP + H (rA, R) Q is satisfied.

If it is established, it is determined that the mutual authentication device B200 is correct, otherwise it is determined to be illegal.

The signature method used in the present embodiment is not only the elliptic Schnoer signature but also a method in which pre-calculation in the signature generation process greatly reduces the processing after inputting the signature target data and is safe as a signature. Applicable if available.

FIG. 3 is a sequence diagram showing processing of a public key encryption using part of mutual authentication when a modified El Gamal encryption is used as an example of public key encryption.

The rational point P ′ on the elliptic curve suitable for the modified El Gamal encryption is fixed and stored in the public key encryption key storage area of the mutual authentication device B200. The private key (Private key) x ′ of the mutual authentication device A 100 is stored in the public key encryption / decryption key storage area 122, and the public key Q ′ = x′P ′ is stored in the public key encryption / decryption key storage area 222.

First, as pre-computation on the mutual authentication device B 200 side, the data of the rational points P ′ and Q ′ are read from the public key encryption / decryption key storage area 222 (S20), and then the random number generation unit 231 generates the random number r1, and the pre-data The data is sent to the calculation unit 213 (S21). The pre-data calculation unit 213 calculates R1 = r1P ′ and Q1 = r1Q ′ and stores them in the pre-calculation data storage area 223 (S22).

Next, when the mutual authentication device B200 authenticates the mutual authentication device A100, first, the random number generation unit 131 generates random numbers r2 and rB and sends them to the public key encryption unit 212 (S23).

RB is also sent to and stored in the temporary data storage area 224 (S24).

The public key encryption unit 212 reads the constant c0 from the public key encryption key storage area 222 (S26), and calculates C = E (Q1, c0 || r2 || rB) using the common key encryption E. Here, the key of the common key encryption E is Q1, and the encryption target data is c0 || r2 || rB. Also, || represents a data combination.

The mutual authentication device B200 transmits [R1, C] to the mutual authentication device A100 through the external communication unit 232 (S27).

After receiving [R1, C] through the external communication unit 132, the mutual authentication device A100 reads the decryption key x ′ from the public key encryption / decryption key storage area 122 (S28), and Q1 = x′R1, c0 || r2 | | RB ′ = D (Q1, C) is calculated. Here, D is a decryption function of the common key encryption E, the key is Q1, and the decryption target data is C.

The public key encryption / decryption unit 112 confirms that the constant c0 is correct, and if correct, transmits rB 'to the mutual authentication device B200 through the external communication unit 132 (S29).

The mutual authentication device B200 that has received rB ′ through the external communication unit 232 reads rB from the temporary data storage area 224 (S30). If rB and rB ′ match, the mutual authentication device A100 is determined to be correct. Judged as illegal.

The public key encryption used in the present embodiment is not limited to the above-described modified El Gamal encryption, the processing after the input of the data to be encrypted is greatly reduced by performing pre-calculation in the encryption processing, and the encryption is safe. Any method is applicable.

In this embodiment, the order of the processing part using the signature and the processing part using the public key cryptography may be switched.

Next, a method for mutual authentication between a low resource device such as an IC card and a server having a relatively high computing capacity, which is a second embodiment, will be described.

For example, FIG. 4 is a configuration diagram of the IC card 400 and its reader / writer 300. These have communication means 501 and 502 and can transmit and receive data. The communication means may be contact or non-contact.

The reader / writer 300 is applied as the mutual authentication device A100 in the first embodiment, and the IC card 400 is applied as the mutual authentication device B200.

While the pre-data calculation unit of the IC card 400 is energized, it may perform pre-calculation necessary for the number of subsequent mutual authentications and store the pre-calculation data, or at the time of shipment. Precalculation data may be calculated in advance and stored in a storage area. In these cases, new precalculation data may be used each time mutual authentication is performed while managing consumption of the precalculation data.

Further, as described with reference to FIG. 5, a method may be used in which a trusted server executes a pre-calculation for the next time on behalf of each server when each mutual authentication is normally completed, and the calculation result is received and stored.

FIG. 5 is a sequence diagram showing the procedure of the n-th mutual authentication.

The IC card 400 stores pre-calculation data necessary for the n-th mutual authentication. The reader / writer 300 and the IC card 400 perform mutual authentication by the method described in the first embodiment (S13, S16, S27, S29). Here, communication S16 and S27 may be performed in parallel. Further, the order of S13, S16 and S27, S29 may be changed, and communication may be performed in the order of S27, S29, S13, S16. In that case, you may perform communication S29 and S13 in parallel. When the reader / writer 300 determines that the IC card 400 is correct and the IC card 400 determines that the reader / writer 300 is correct, the reader / writer 300 acts as a proxy for the pre-calculation necessary for the (n + 1) th authentication of the IC card 400. Run with. The pre-calculation data is transmitted to the IC card 400 (S40).

The IC card 400 stores the precomputed data in the precomputed data storage area and uses it for the (n + 1) th mutual authentication.

For the pre-calculation performed by the reader / writer 300 on behalf, a dedicated computer that performs the pre-calculation may be used separately.

If one of the mutual authentications does not determine that the other is correct, the subsequent processing or service may be stopped, or a mutual authentication request may be made again. Even in that case, mutual authentication is performed a prescribed number of times, and if all are not determined to be correct, subsequent processing and services are stopped.

Next, a third embodiment, which is a server that simultaneously performs mutual authentication with a large number of users, will be described.

A large number of users may be taps (smart taps) that have a function of transmitting information such as the power consumption status of each user to each server in the sensor network and the smart grid.

FIG. 6 is a configuration diagram of a server that performs mutual authentication with a large number of users.

The server 600 can communicate with a large number of users 500 through the network 700.

The server 600 is applied as the mutual authentication device A100 in the first embodiment, and each user in a large number of users 500 is applied as the mutual authentication device B200. The server 600 can communicate with the pre-calculation server 900 that performs the pre-calculation through the communication path 800, and the pre-calculation server may perform the pre-calculation in the mutual authentication apparatus A100.

The server 600 prepares precalculation data for the required number of times according to the number of users and the frequency.

Actually, when mutual authentication requests from a large number of users 500 are almost simultaneously received, mutual authentication is performed for each user by the method described in the first embodiment using the pre-calculation data.

An embodiment that performs mutual authentication between a traveling vehicle and a communication device (hereinafter, a roadside machine) installed on a road, which is a fourth embodiment, will be described.

FIG. 7 is a configuration diagram of the traveling vehicle 1020 and the roadside machine 1010.

The traveling vehicle 1020 and the roadside machine 1010 can transmit and receive data by wireless communication 1030.

The vehicle 1020 is applied as the mutual authentication device A100 in the first embodiment, and the roadside machine 1010 is applied as the mutual authentication device B200.

The roadside device 1010 includes a communication unit 1011 and a mutual authentication device A1012.

The vehicle 1020 includes a communication unit 1021 and a mutual authentication device B1022.

The vehicle 1020 calculates the precalculation data described in the first embodiment before executing the mutual authentication, and stores it in the storage unit in the mutual authentication device B1022.

When the vehicle 1020 is traveling and approaches the range where wireless communication 1031 and 1032 with the roadside device 1010 is possible, communication is started and mutual authentication is performed according to the procedure described in the first embodiment.

As a result of mutual authentication, if either of the vehicle 1020 or the roadside machine 1010 does not determine that the other is correct, the other is notified that it is an authentication error, and processing according to the communication content that has occurred thereafter is executed. do not do. When the vehicle 1020 approaches a range where wireless communication with another roadside device is possible, mutual authentication is performed again.
While the above description has been made with reference to exemplary embodiments, it will be apparent to those skilled in the art that the invention is not limited thereto and that various changes and modifications can be made within the spirit of the invention and the scope of the appended claims.

100 point generator 111 storage unit 112 rational function storage area 113 base storage area 114 parameter storage area 120 processing unit 121 rational function calculation unit 122 finite field calculation calculation unit 131 input unit 132 output unit 133 communication unit

Claims

In a system comprising two types of devices A and B capable of transmitting and receiving data by communication, the device A and the device B are mutual authentication methods for confirming the validity of the partner device,
In the step in which the device A confirms the validity of the device B,
According to the device A,
Generating a random number rA during authentication;
Transmitting the generated random number rA to the device B;
According to the device B,
Generating a signature for the random number rA using the pre-calculation data for signature generation stored after receiving the random number rA;
Transmitting the generated signature to the device A;
According to the device A,
Verifying the received signature using the signature verification key of the device B;
And a step of determining that the device B is valid if it is determined that the signature is correct, and determining that the device B is invalid if it is determined that the signature is not correct.
The mutual authentication method according to claim 1,
In the step where the device B performing mutual authentication confirms the validity of the device A,
According to the device B,
Generating a random number rB during authentication;
Performing public key encryption of the random number rB using stored pre-calculation data for encryption;
Transmitting the ciphertext that is the result of the encryption to the device A;
According to the device A,
Decrypting the received ciphertext using the device A's private key;
Transmitting the decryption result to the device B;
According to the device B,
Collating the stored random number rB with the decryption result received from the device A;
A mutual authentication method comprising: determining that the device A is valid if the random number rB and the decryption result match, and determining that the device A is invalid if they do not match .
The mutual authentication method according to claim 1,
When the device A and the device B determine that each other device is valid, the device A calculates the pre-calculation data for encryption or the pre-calculation data for signature generation, and transmits it to the device B A mutual authentication method characterized by the above.
The mutual authentication method according to claim 1,
As the step of calculating the pre-calculation data for signature generation by the device A or the device B,
Generating a random number r;
Calculating a scalar multiplication R = rP for points on the elliptic curve;
Storing the random number r and the scalar multiplication result R. A mutual authentication method comprising:
The mutual authentication method according to claim 2,
As the step of calculating the precalculation data for encryption by the device A or the device B,
Generating a random number r1,
Calculating a scalar multiplication R1 = r1P ′ of points on the elliptic curve;
Calculating a scalar multiplication Q1 = r1Q ′ of points on the elliptic curve;
Storing R1 and Q1, and a mutual authentication method.
The mutual authentication method according to claim 4,
The device A and the device B store a fixed rational point P on the elliptic curve and Q = xP which is the signature verification key of the device B,
The device B stores the signature generation key x,
In the step of generating a signature for the random number rA by the device B,
Based on the received random number rA and the scalar multiplication result R, a hash value H (rA, R) is calculated, S = r + H (rA, R) is calculated, and [R, H (rA, R) ), S] as a signature for the random number rA,
Verifying the signature received by the device A,
For the received signature [R, H (rA, R), S], by using the signature verification key Q of the device B, it is determined whether or not R = SP + H (rA, r) Q is established. Verifying the signature [R, H (rA, R), S].
The mutual authentication method according to claim 5, wherein
The device A and the device B performing mutual authentication hold a fixed rational point P ′ on the elliptic curve and the public key Q ′ = x′P ′ of the device A,
The device A stores the decryption key x ′;
In the step of confirming the validity of the device A by the device B,
Generating a random number r2 and a random number rB;
C = E, using a constant c0 stored in common by the device A and the device B, and a common key encryption E using Q1 as a key and c0 || r2 || rB as encryption target data. Calculating (Q1, c0 || r2 || rB);
Sending [R1, C] to A;
According to the device A,
For the received [R1, C] using the decryption key x ′ of the device A,
Calculating Q1 = x′R1;
Calculating c0 || r2 || rB '= D (Q1, C) using a decryption function D corresponding to the common key encryption E, with Q1 as a key and decryption target data as C When,
Collating a constant c0 to be stored with c0 of the decoding result;
And a step of setting rB ′ as the decryption result if the constant c0 and the decryption result c0 coincide with each other.
The mutual authentication method according to claim 1,
The system further includes a device B ′ capable of communicating with the device B,
According to the device B ′,
Calculating the pre-calculation data for signature generation according to claim 4, or calculating the pre-calculation data for encryption according to claim 5;
Transmitting the calculated pre-calculation data for signature generation or the pre-calculation data for encryption to the apparatus B. A mutual authentication method comprising:
The mutual authentication method according to claim 2,
The system includes a plurality of the devices A,
The steps according to claim 1 and 2 are executed by the device B and the other device A when the device A is determined to be invalid in the mutual authentication between the one device A and the device B. A mutual authentication method comprising the step of:
A mutual authentication system comprising two types of devices A and B capable of transmitting and receiving data by communication, wherein the devices A and B mutually confirm the validity of the counterpart device,
The device A includes
Means for generating a random number rA;
Means for transmitting the generated random number rA to the device B;
Means for verifying the signature generated by device B using the signature verification key of device B;
Means for determining that the device B is valid if it is determined that the signature is correct, and for determining that the device B is invalid if it is determined that the signature is not correct,
The device B is
Means for generating a signature for the random number rA received from the device A using the pre-calculation data for signature generation stored;
Means for transmitting the generated signature to the device A, and a mutual authentication system.
The mutual authentication system according to claim 10, comprising:
The device B is
Means for generating a random number rB;
Means for public key encryption using the pre-calculation data for encryption stored in the random number rB;
Means for transmitting a ciphertext as a result of the encryption to the device A;
Means for collating the random number rB with the decryption result received from the device A;
Means for determining that the device A is valid if the random number rB matches the decryption result, and determining that the device A is invalid if they do not match,
The device A includes
Means for decrypting the ciphertext received using the private key of the device A to obtain the decryption result;
Means for transmitting the decryption result to the device B, and a mutual authentication system.
A program that allows two computers A and B capable of transmitting and receiving data by communication to implement a mutual authentication system that mutually verifies the validity of a partner computer
As the step of the computer A confirming the validity of the computer B,
In the computer A,
Generating a random number rA;
Transmitting the generated random number rA to the computer B;
Verifying the signature generated by the computer B using the signature verification key of the computer B;
Determining that the computer B is valid if it is determined that the signature is correct, and determining that the computer B is invalid if it is determined that the signature is not correct;
In the computer B,
Generating a signature for the random number rA received from the computer A using stored signature generation pre-calculation data;
A step of transmitting the generated signature to the computer A.
A program according to claim 12,
As a step in which the computer B confirms the validity of the computer A,
In the computer B,
Generating a random number rB;
Performing public key encryption of the random number rB using stored pre-calculation data for encryption;
Sending the ciphertext resulting from the encryption to the computer A;
Collating the random number rB with the decryption result received from the computer A;
Determining that the computer A is valid if the random number rB matches the decryption result, and determining that the computer A is invalid if they do not match,
In the computer A,
Decrypting the received ciphertext using the private key of the computer A to obtain the decryption result;
Transmitting the decryption result to the computer B.