JP4948789B2 - Authentication information delegation method and security device in authentication system - Google Patents

Description

The present invention relates to authentication information delegation methods and security devices definitive authentication system.

  It is a big problem how to register personal authentication information when using a tamper device or a portable terminal such as an IC card that is commercially available for personal authentication. Moreover, when using authentication information, having to carry a plurality of reliable IC cards greatly impairs convenience.

For this reason, a security device is required on the user side in order for the server to authenticate a specific user so that it is possible to cope with the case where different authentication methods are used in each server without depending on the client. There has been proposed a personal authentication system equipped with a function (converting user authentication data into a data format to be authenticated by the server) (see, for example, Patent Document 1).
JP 2004-118377 A

By the way, it is desirable that the authentication information can be delegated and used by a PC (Personal Computer) or the like other than the portable terminal in order to receive service provision using the same authentication information. Therefore, there is a need for a system that can store authentication information in another IC card or mobile terminal and delegate the authentication information to an arbitrary terminal.
However, it is desirable that the method can always be easily performed by the user, but at this time, there is a possibility that unauthorized information may be written by the user. Thus, safety and convenience are in a trade-off relationship.

The present invention has been made in view of the above circumstances, and in a series of flows in which authentication information is delegated and a service is used using the delegated authentication information, personal authentication data is efficiently and safely written. can, and to provide authentication information delegation methods and security devices definitive authentication system.
In addition, an anonymized delegation method is realized by building a mechanism in which a user who has been delegated authentication information cannot obtain owner information from the authentication information, ensuring the safety of the authentication information and also to ensure confidentiality of the owner information, also aims to provide an authentication information delegation methods and security devices definitive authentication system.

  In order to solve the above-described problems, the present invention provides a security device in which user authentication information is stored in a memory, a server that provides a service to a user, communication with the security device, and via the server and a network. The security device comprises a secret key information sharing a common key with the server and the possession of the authentication information based on the authentication information issued through the server. Generating information obtained by encrypting the user information, generating a temporary authentication information by applying an electronic signature to the information, and transferring the temporary authentication information to the client. Means for performing mutual authentication with the server using the temporary authentication information when using the service; And features.

  The present invention also provides a security device in which user authentication information is stored in a memory, a server that provides a service to a user, a client that communicates with the security device and is connected to the server via a network, An authentication information delegation method in an authentication system comprising: secret key information that the security device shares a common key with the server based on authentication information issued through the server, and owner information of the authentication information A first step of generating a temporary authentication information by applying an electronic signature to the information, and transferring the machine name authentication information to the client temporarily; In using the service, a second step of performing mutual authentication with the server using the temporary authentication information. And having a flop, a.

  Also, in the authentication information delegation method in the authentication system of the present invention, the first step is to generate a first random number in the security device, and provide the first random number and the user's public key certificate as a service. A first hash function value with a key using the sub-step of encryption with the provider's public key, the first random number and the user identification information extracted from the public key certificate of the user as an input Sub-step of calculating the authentication information, sub-step of defining an expiration date of the authentication information, sub-step of generating the electronic ticket information by concatenating the encrypted random number, the user identification information, and the expiration date information, A sub-step of applying an electronic signature to the electronic ticket information with the user's private key, and the electronic ticket information on which the electronic signature has been applied to the class. Characterized in that it comprises a sub-step of transferring the Ant, the.

  Also, in the authentication information delegation method in the authentication system of the present invention, the second step includes the temporary transfer of the electronic ticket information with electronic signature transferred and the first hash function value with key in the client. A sub-step of storing in the memory as authentic authentication information, a third random number generated and transmitted by the server, the second and third random numbers, the electronic ticket information, and the first keyed A sub-step of generating a second keyed hash function value using the hash function value as a key and the first keyed hash function value as a key; the second and third random numbers; and the electronic ticket information And a sub-step of transmitting the second keyed hash function value to the server and prompting authentication.

  Further, in the authentication information delegation method in the authentication system of the present invention, the second step includes the second and third random numbers, the electronic ticket information, and the second information transmitted from the client in the server. A sub-step of receiving the keyed hash function value of 2; a sub-step of decrypting and verifying the user's public key certificate; and verifying an electronic signature of the electronic ticket information using the public key; And a sub-step of confirming the expiration date, and a sub-step of decrypting the electronic ticket information to extract the encrypted first random number, decrypting it with its own secret key, and acquiring the first random number And calculating a first keyed hash function value from the first random number and the user identification information extracted from the public key certificate of the user, and the first keyed hash A sub-step of verifying the second keyed hash function value based on a numerical value, and a second key as a first keyed hash function value from the first keyed hash function value and the third random number The method further includes a sub-step of generating the first keyed hash function value and the third random number using the keyed hash function value and transmitting the same to the client for prompting authentication.

  The present invention also provides a security device in which user authentication information is stored in a memory, a server that provides a service to a user, a client that communicates with the security device and is connected to the server via a network, The security device in an authentication system comprising: encrypted secret key information sharing a common key with the server and owner information of the authentication information based on the authentication information issued via the server Authentication control means for generating information, generating a temporary authentication information by applying an electronic signature to the information, and transferring the temporary authentication information to the client for prompting authentication. .

  Further, in the security device of the present invention, the authentication control means includes a random number generation unit that generates a random number, an encryption unit that encrypts the random number and the user's public key certificate with a public key of a service provider, A hash calculation unit that inputs the random number and user identification information extracted from the user's public key certificate and calculates a hash function value with a key using the random number as a key, and an addition that defines an expiration date of the authentication information An information defining unit; an electronic ticket generating unit that generates electronic ticket information by linking the encrypted random number, user identification information, and expiration date information; and an electronic signature with the user's private key to the electronic ticket information. And an authentication information transfer unit that transfers the electronic ticket information to which the electronic signature has been applied to the client.

According to the present invention, based on the authentication information issued via the server, the security device generates information obtained by encrypting the secret key information sharing the server and the common key and the owner information of the authentication information, Apply digital signature to generate temporary authentication information and transfer it to the client. When using the service, the client can use the service by performing mutual authentication with the server using temporary authentication information. become.
Therefore, the security of the authentication information can be ensured, the authentication can be performed only with the temporary authentication information, and the authentication information can be stored in an offline environment. In addition, by setting a short expiration date for temporary authentication information, the risk can be minimized even if the authentication information is temporarily stolen. For example, if the client is always used, only temporary authentication information can be stored, so that it can be dealt with in case of loss or theft.
In addition, it is possible to realize a delegation method that is anonymized by building a mechanism in which a user to whom authentication information has been delegated cannot obtain owner information from the authentication information, ensuring the security of the authentication information In addition, the confidentiality of the owner information regarding the authentication information can be ensured.

FIG. 1 is a diagram illustrating an example of a system configuration of an authentication system according to an embodiment of the present invention.
In FIG. 1, reference numeral 1 denotes a security device (H) in which user authentication information is stored in a memory. Here, a mobile terminal, an IC card, a PC, and the like are assumed. Reference numeral 2 denotes a client (C), which communicates with the security device 1 and is connected to a server (S) 3 managed and operated by a service provider (SP) via a network. Here, it is assumed that a PC installed in a public place or an STB (Set Top Box) installed in a home.

  In the present invention, the security device 1 generates temporary authentication information (hereinafter referred to as SI: Secondary Information) based on authentication information (hereinafter referred to as PI: Primary Information) issued by the service provider, and the client 2 However, when using the service, the service can be used by performing mutual authentication with the server 3 using SI.

Specifically, the service provider issues a PI to the security device 1 (1), and the user uses self-delegation (authentication information delegation), which will be described later, to authenticate various client devices such as PCs and STBs. (2).
When delegating, special electronic ticket information in which secret information for sharing a common key (authentication session key) with the server 3 and owner information of the authentication information is encrypted and concealed is generated, and the electronic information Delegate the ticket information with an electronic signature. Then, mutual authentication is performed between the client 2 and the server 3 in accordance with an authentication protocol described later based on the delegated SI (3).

  According to the method described above, since the public key is used as the PI, the person who first issues the authentication information and the person who provides the service may not be the same. In other words, it can be applied to a business model in which a certain person collectively manages users such as an authentication agent and a billing agent. Each entity providing the service does not need to manage user information. On the other hand, SI is a common key and electronic ticket information. Therefore, authentication processing at the time of service provision can be executed at high speed. Even if the user's private key leaks, the security of the already delegated SI is guaranteed and high security can be realized. Further, by encrypting owner information in the SI, a secret delegation method in which the SI user cannot identify the PI owner can be realized. Detailed description will be given below.

FIG. 2 is a block diagram showing an expanded function of the internal configuration of the security device shown in FIG.
Based on the PI issued via the server 3, the security device 1 generates information obtained by encrypting the secret key information sharing the common key with the server 3 and the owner information of the PI. And an authentication control means 10 for generating SI as temporary authentication information and transferring the SI to the client 2 to prompt authentication. The authentication control means 10 includes a random number generation unit 11, an encryption unit 12, a hash calculation unit 13, an additional information definition unit 14, an electronic ticket generation unit 15, an electronic signature assignment unit 16, and an SI transfer unit 17. , A PI storage unit 18 and an SP public key certificate storage unit 19.

The random number generation unit 11 generates a random number and supplies it to the encryption unit 12 and the hash calculation unit 13. The encryption unit 12 encrypts the random number generated by the random number generation unit 11 and the user identification information extracted from the public key certificate of the user stored in the PI storage unit 18 with the public key of the service provider, and electronically It is supplied to the ticket generation unit 15. The hash calculator 13 calculates a keyed hash function value using the random number and the user identification information as inputs, and supplies the calculated value to the SI transfer unit 17.
On the other hand, the additional information definition unit 14 defines the expiration date of the SI and supplies it to the electronic ticket generation unit 15. The electronic ticket generation unit 15 generates electronic ticket information by connecting the encrypted random number, user identification information, expiration date information, and the like, and supplies the electronic ticket information to the SI transfer unit 17. The SI transfer unit 17 stores the information obtained by applying the electronic signature to the electronic ticket information output from the electronic ticket generation unit 15 by the electronic signature adding unit 16, as well as the hash function value and SP public key certificate storage unit 19. It has a function of concatenating the SP public key certificate and transferring it to the client 2.

3, 4, and 5 are flowcharts cited for explaining operations according to the embodiment of the present invention, and show processing procedures in each of the security device 1, the client 2, and the server 3.
The operation of the embodiment of the present invention shown in FIGS. 1 and 2 will be described in detail below with reference to the flowcharts shown in FIGS.

First, a service provider (SP) issues a public key (certificate), a private key pair, and user identification information (hereinafter referred to as Uid) as a PI. Subsequently, the user stores the PI in the security device 1 (PI storage unit 18) such as an IC card or a mobile phone. Also, a public key (certificate) of the service provider (SP) is acquired and stored in the SP public key certificate storage unit 19 in the same manner.
The user operates the security device 1 in which the PI is stored in a desired client (for example, a home computer, a PC on the street, a rented portable terminal, etc.), thereby transferring SI (Secondary Information) described later ( Self-delegation).

Specifically, as shown in the flowchart of FIG. 3, the security device 1 generates a random number R with the built-in random number generation unit 11 (S31), and the random number R and the user's public key certificate Cert are SP. Encryption is performed with the public key Pu (S) of the service provider stored in the public key certificate storage unit 19 (S32). Let this be Enc (Pu (S), Cert + R). Further, the hash calculator 13 calculates a keyed hash function (R is a key) using the random number R and the Uid extracted from the user's public key certificate as input (S33). This is k_auth. Further, the additional information definition unit 14 defines information such as the expiration date of the SI and the service ID (S34), which is set as Info.
Electronic ticket information is generated by the electronic ticket generation unit 15 by connecting Enc (Pu (S), Cert + R) and Info generated as described above (S35). Subsequently, the electronic signature giving unit 16 performs an electronic signature Sig (H) on the electronic ticket information with the user's private key, and supplies it to the SI transfer unit 17 (S36). The SI transfer unit 17 uses the electronic ticket Enc (Pu (S), Cert + R), Info, Sig (H) with the electronic signature and the hash value k_auth with the key as the temporary authentication information SI, and performs the service. Transfer to the client 2 to be used (S37).

Hereinafter, the mutual authentication operation by the client and the server using the SI generated as described above will be described with reference to the flowcharts shown in FIGS.
The client 2 receives the SI transferred from the security device 1 and stores it in a built-in memory (not shown) (S41 and S42 in FIG. 4). Then, the user operates the client 2 to issue a service provision request to the server 3 that provides the service (S43). Note that the operator of the server 3 that provides the service may be different from the service provider that issued the PI.
Next, the server 3 generates a random number R ′ and transmits it to the client 2 (S62 in FIG. 5). In addition, depending on the service, an ID (Service ID) of a service to be transferred or a public key (certificate) of the service provider may be transmitted. It is assumed that a PI (a public / private key pair and Uid) has been issued in advance (S61).

  On the other hand, the client 2 newly generates a random number R ″ (S44 in FIG. 4). The client 2 receives the newly generated random number R ′, the random number R ″ received from the server 3, Uid, electronic ticket information, and k_auth, and inputs a hash function value with a key (the key is k_auth). The value generated here is set as the MAC (S45). Next, random numbers R ′, R ″, electronic ticket information, user public key certificate information, and MAC values are transmitted to the server 3 (S 46).

When the server 3 receives the random numbers R ′, R ″, the electronic ticket information, the user public key certificate information, and the MAC value from the client 2 (S63 in FIG. 5), the server 3 decrypts and verifies the user public key certificate. Then, the electronic signature of the electronic ticket is verified using the public key (S65). Further, the expiration date of the electronic ticket is confirmed (S66). Then, the random number R and the user's public key certificate are extracted from the electronic ticket (S67).
Also, k_auth is calculated from the random number R and the Uid extracted from the user's public key certificate by using a keyed hash function (S68). The MAC is verified based on the k_auth calculated here (S69). The server 3 determines that the user is a valid user when all the above verifications are successful.
Next, the server 3 generates a MAC (k_auth, R ″) from the k_auth and the random number R ″ using a keyed hash function (the key is k_auth) and sends it back to the client 2 (S70).

After receiving the MAC (k_auth, R ″) from the server 3 (S47 in FIG. 4), the client 2 verifies the MAC (k_auth) (S48), and if correct, determines that the server 3 is a valid server. .
As described above, the service is provided after the validity of both the client 2 and the server 3 is confirmed. The expired electronic ticket is automatically deleted by the client 2 (S49, S50). Note that the authentication protocol at the time of service provision may be any other method as long as it uses a provision key.

FIG. 6 is a sequence diagram illustrating a data flow among the security device 1 (H), the client 2 (C), and the server 3 (S).
As shown in FIG. 6, the client 2 sends to the security device 1 the service ID (Service ID) to be delegated, the public key certificate Pu (S) of the service provider, and the public key certificate Cert of the user. Is sent (S71). On the other hand, the security device 1 sends to the client 2 a hash function value k_auth with a key using a random number R as a key and electronic ticket information with a signature (Ticket = Enc (Pu (S) + R, Info, Sig (H) ) Is transmitted (S72).

On the other hand, the client 2 receives the random number R ′ from the server 3 (S73), and sends the second and third random numbers (R ′ and R ″, respectively) and the electronic ticket information with signature to the server 3. (Ticket) and the second hash function value with key (MAC) are transmitted to prompt authentication (S74). Then, the server 3 validates if the verification of the public key certificate, the electronic signature (Sig (H)) verification of the electronic ticket information, and all the verifications of the second keyed hash function value (MAC) are successful. It can be determined that the user is a simple user.
Further, the server 3 uses the first keyed hash function value (k_auth) and the third random number (R ″) as the first keyed hash function value (k_auth) to the client 2. The first keyed hash function value and the third random number (MAC (k_auth, R ″)) are transmitted using the keyed hash function value (MAC) of 2 to prompt authentication (S75). If the client 2 verifies MAC (k_auth, R ″) and is correct, the client 3 determines that the server 3 is a valid server. A service is provided when the validity of both the server 3 and the client 2 is confirmed.

As described above, according to the present invention, it is possible to authenticate only with SI and use a service. Accordingly, the following enumeration can be realized.
(1) PI safety can be secured. That is, since authentication is possible only by SI, PI can be secured safely in an offline environment. Further, by setting the SI expiration date short, the risk can be minimized even for theft of SI. For example, if only the SI is put in a mobile phone terminal that is always carried, it can cope with any loss or theft.
(2) It can be used as an authority delegation tool. That is, the PI is stored in a mobile phone terminal with strong personal ties, and the SI is delegated to other terminals for use. This makes it possible to temporarily delegate authority to various terminals by using the above self-delegation. For example, delegation of authority to a PC installed in a public place or a home STB can be considered. As another application, an application that temporarily lends authority to a customer when visiting the customer can be considered.

(3) Untraceable authentication can be realized. That is, the delegated SI is different every time. Therefore, it is possible to realize an authentication method in which the service usage status of the user cannot be traced. This solves one of the problems of privacy protection in service usage.
(4) Centralized management of authentication information is possible. In other words, centralized management of authentication information is possible by delegating various authentication information to a single terminal. For example, if authentication information stored in a plurality of owned credit cards is transferred to a portable terminal, various services can be received just by carrying the portable terminal.
(5) Authentication information can be unified. That is, seamless service authentication is realized by making it possible to use authentication information unified by the above-mentioned self-delegation on a plurality of platforms. For example, by transferring the information used for authentication in the mobile terminal to the PC, the same service can be used in the PC.

As described above, according to the present invention, the security device 1 uses the authentication information issued via the server 3 to obtain the secret key information sharing the common key with the server 3 and the owner information of the authentication information. Generate encrypted information, apply digital signature to generate temporary authentication information and transfer it to the client 2. The client 2 uses temporary authentication information with the server 3 when using the service. By using mutual authentication, the service can be used.
Therefore, the security of the authentication information can be ensured, the authentication can be performed only with the temporary authentication information, and the authentication information can be stored in an offline environment. In addition, by setting a short expiration date for temporary authentication information, the risk can be minimized even if the authentication information is temporarily stolen. For example, if the client is always used, only temporary authentication information can be stored, so that it can be dealt with in case of loss or theft.
In addition, it is possible to realize a delegation method that is anonymized by building a mechanism in which a user to whom authentication information has been delegated cannot obtain owner information from the authentication information, ensuring the security of the authentication information In addition, the confidentiality of the owner information regarding the authentication information can be ensured.

As described above, the user stores various kinds of authentication information in the security device 1 such as a mobile phone terminal. This greatly expands the purpose of use of the mobile phone terminal, and provides for a billing agency service and the like. Growth is also expected. In addition, if a service is used on a variety of terminals with a single user account and authentication information set, not only will the convenience of the user be improved, but cross-platform user management will be possible, and users will be enclosed. Will be able to do. At the same time, integrated management of authentication information for mobile systems and fixed systems can reduce operating costs to about half that of conventional systems.
Furthermore, an authentication infrastructure that is safer than before can be realized by the method of the present invention that can theoretically illuminate safety. Therefore, it is considered that the present invention greatly contributes to an increase in customer satisfaction (CS) in order to greatly improve the safety and convenience of the service.

It is a figure which shows an example of the system configuration | structure of the authentication system concerning embodiment of this invention. It is the block diagram which expanded and showed the function of the internal structure of the security device shown in FIG. It is the flowchart quoted in order to demonstrate operation | movement of the security device concerning embodiment of this invention. It is the flowchart quoted in order to demonstrate operation | movement of the client concerning embodiment of this invention. It is the flowchart quoted in order to demonstrate operation | movement of the server concerning embodiment of this invention. It is a figure which shows the operation | movement sequence of the authentication system concerning embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Security device (H), 2 ... Client (C), 3 ... Server (S), 10 ... Authentication control means, 11 ... Random number generation part, 12 ... Encryption part, 13 ... Hash calculation part, 14 ... Additional information Definition part 15 ... Electronic ticket generation part 16 ... Electronic signature giving part 17 ... SI transfer part 18 ... PI storage part 19 ... Public key certificate storage part

Claims (4)

A server of a service provider that provides a service to a user, a security device that stores authentication information including at least the user's public key certificate and private key issued by the service provider, and communication with the security device And an authentication information delegation method in an authentication system comprising a client connected to the server via a network,
The security device encrypts the user's public key certificate with the service provider's public key, and generates a temporary authentication information by applying an electronic signature to the encrypted information with the user's private key. A first step of transferring the temporary authentication information to the client;
A second step in which the client performs mutual authentication with the server using the temporary authentication information when using the service;
I have a,
The first step includes
Generating a first random number, and encrypting the first random number and the public key certificate of the user with the public key of the service provider to generate encrypted information;
A sub-step of calculating a first keyed hash function value using the first random number and user identification information extracted from the public key certificate of the user as an input, and using the random number as a key;
A sub-step of generating expiration date information defining an expiration date of the temporary authentication information;
A sub-step of generating an electronic ticket by concatenating the encryption information and the expiration date information;
Sub-signing the electronic ticket with the user's private key;
A sub-step of transferring the electronic ticket with the electronic signature and the hash function value with the first key to the client as the temporary authentication information;
An authentication information delegation method in an authentication system , comprising : The second step includes
A sub-step of storing the transferred temporary authentication information in a memory;
Receiving a second random number generated and transmitted by the server, generating a third random number, generating the second and third random numbers, the electronic ticket with the electronic signature, and the first key; Generating a second keyed hash function value with the keyed hash function value as a key and the first keyed hash function value as a key;
A step of sending the second and third random numbers, the electronic ticket with the electronic signature, and the second keyed hash function value to the server for prompting authentication;
The authentication information delegation method in the authentication system according to claim 1 , further comprising: The server further comprises a third step of authenticating;
The third step includes
Receiving the second and third random numbers, the electronic ticket with the electronic signature, and the second keyed hash function value transmitted from the client;
A sub-step of decrypting and verifying the encrypted public key certificate of the user included in the received electronic ticket with the secret key of the service provider;
Verifying the electronic signature of the electronic ticket using the public key of the verified public key certificate and confirming the expiration date; and
Subtracting the encrypted first random number from the electronic ticket and decrypting with the service provider's private key to obtain the first random number;
The first keyed hash function is calculated by calculating the first keyed hash function value using the acquired first random number and the user identification information extracted from the verified public key certificate of the user. Verifying the second keyed hash function value based on a value;
Using the first keyed hash function value and the received third random number as input, a keyed hash function value using the first keyed hash function value as a key is generated and transmitted to the client for authentication. A sub-step
The authentication information delegation method in the authentication system according to claim 2 , further comprising: A server of a service provider that provides a service to a user, a security device that stores authentication information including at least the user's public key certificate and private key issued by the service provider, and communication with the security device The security device in an authentication system comprising a client connected to the server via a network,
The user's public key certificate is encrypted with the service provider's public key, and the encrypted information is digitally signed with the user's private key to generate temporary authentication information. Authentication control means for transferring authentication information to the client to prompt authentication;
Equipped with,
The authentication control means includes
A random number generator for generating random numbers;
An encryption unit that encrypts the random number and the public key certificate of the user with the public key of the service provider to generate encryption information;
A hash calculation unit that calculates a keyed hash function value using the random number as a key by inputting the random number and user identification information extracted from the user's public key certificate;
An additional information definition unit that generates expiration date information defining an expiration date of the temporary authentication information;
An electronic ticket generating unit that generates an electronic ticket by linking the encrypted information and the expiration date information;
An electronic signature providing unit that electronically signs the electronic ticket with the user's private key;
An authentication information transfer unit for transferring the electronic ticket with the electronic signature and the hash function value with the first key to the client as the temporary authentication information;
A security device comprising:

Images