JPH01259443A - Terminal admitting method - Google Patents

Abstract

PURPOSE:To keep the security of a secret password key by preventing appearance of data and password data corresponding to said data on a communication line. CONSTITUTION:A second terminal 2 responds to transmitted data X with e<-1>K2[e<-1>K2(X)]. Therefore, hostile chosen-plaintext attack of a first terminal is impossible. The first terminal 1 and the second terminal 2 are a fair pair. K1=K2 and RN=Y are true. Consequently, data on the communication line is eK1(RN) and e<-1>K1(RN). Thus, the security of the secret password key is kept because known-plaintext attack of a third person who taps data on the communication line is impossible.

Description

DETAILED DESCRIPTION OF THE INVENTION Field of Industrial Application The present invention relates to a method of authentication performed between constituent terminals in a communication system, and in particular, when two terminals have common secret data, the authenticity of each other is verified. Regarding how to check.

Conventional technology As a conventional terminal authentication method, for example, U.S. Patent No. 4471
No. 216. FIG. 2 shows a configuration diagram when a first terminal authenticates a second terminal in this conventional terminal authentication method.

11 is a first terminal, and 12 is a second terminal. 13 (inside the first terminal) is a random number generating section; 14 (inside the first terminal) is a storage section storing 1 as the secret encryption key of the first terminal;
16 (in the second terminal) is a storage unit storing 2 as the secret encryption key of the second terminal;
17 (in the first terminal) is an encryption section that encrypts data using 1 as the encryption key, 18 (in the first terminal) is sent from the second terminal Comparing the data that has been sent and the output of the encryption section 17,
This is an authentication unit that authenticates the validity of the second terminal only when the second terminal is the same.

Note that the encryption algorithm is shared between the first terminal and the second terminal, and does not necessarily need to be kept secret. Further, in this example, a case will be explained in which the first terminal authenticates the second terminal, but mutual authenticity can be authenticated by performing an operation in which the positions of the terminals are switched. Furthermore, in the subsequent figures, the operation of encrypting data

The operation when the first terminal authenticates the second terminal in the conventional terminal authentication method configured as described above will be described below.

(1) The first terminal generates a random number RN in the random number generator 13.

(2) The first terminal transmits the random number RN to the second terminal.

(3) The first terminal encrypts the RN in the encryption unit 17 using 1 as the secret encryption key stored in the storage unit 14. Let X be the encrypted data.

(4) The second terminal uses 2 as the secret encryption key stored in the storage unit 16 in the encryption unit 16, and the first
Encrypt the data sent from the terminal. Let Y be the encrypted data.

(6) The second terminal transmits data Y to the first terminal.

(6) The first terminal compares X and Y on the first day of the authentication section. If terminal 2 is a valid terminal for terminal 1, K1 and 2, and X and Y match. Therefore, the first terminal authenticates the second terminal only when X=Y.

However, in the above method, the second terminal encrypts the transmitted data with its own secret encryption key and responds with the result. Therefore, if terminal 1 is an adversary, the first terminal can obtain the ciphertext for the data it has selected from the second terminal. Conversely, for the second terminal, it is a chosen-plaintext attack.
), which threatens the security of the secret encryption key. Furthermore, even if the first terminal is not an adversary, a third party may perform a known-plaintext attack by eavesdropping on the communication between the first terminal and the second terminal. Become.

Therefore, a terminal authentication method, for example, disclosed in Japanese Patent Publication No. Sho F30-21501, has been devised in which the pair of data and its ciphertext does not appear on the communication path.

FIG. 3 shows a block diagram of this second conventional terminal authentication method. 21 is a first terminal, and 22 is a second terminal. 23 (inside the first terminal) is a random number generation unit, 24 (inside the first terminal) is a storage unit that stores 1 as the secret encryption key of the first terminal, and 26 (inside the second terminal) is a random number generator. A storage unit storing 2 as the secret encryption key of the second terminal, 26 (in the first terminal), and an encryption unit 27 (in the second terminal) that encrypts data using 1 as the encryption key. A decryption unit 28 (in the second terminal) decrypts data using the decryption key 2, and a conversion unit 28 (in the second terminal) performs a conversion φ determined in advance between terminals 1 and 2 on the output data of the decryption unit 27. Part, 29 (Second
30 (in the first terminal) is an encryption unit that encrypts the output data of the conversion unit 28 using 2 as the encryption key, and 30 (in the first terminal) is the second encryption unit.
A decryption unit 31 (in the first terminal) decrypts the data transmitted from the encryption unit 29 of the terminal using 1 as a decryption key, and a decryption unit 31 (in the first terminal) inputs the output data of the random number generator 23 into the data transmitted from the encryption unit 29 in the second terminal. A converting unit 32 (in the first terminal) that performs the same transformation φ as the converting unit 28 compares the output value of the decoding unit 30 and the output value of the converting unit 31, and determines that the second terminal is valid only when the two are the same. This is the authentication section that authenticates the identity of the user.

Note that the encryption method in this case is assumed to be a common key encryption method such as I) ES encryption. The encryption algorithm and its inverse decryption algorithm do not necessarily need to be secret. The same key is used for both, but it will be called an encryption key or a decryption key depending on which key it is used for. Further, the conversion φ determined in advance between the terminals 1 and 2 is a simple conversion such as inverting a certain bit, and there is no need to keep this conversion algorithm secret.

The operation when the first terminal authenticates the second terminal in the second conventional terminal authentication method configured as above will be described below.

(1) The first terminal generates a random number RN in the random number generator 23.

(2) The first terminal encrypts the RN in the encryption unit 26 using 1 as the secret encryption key stored in the storage unit 24. Do X on the encrypted data.

(3) The first terminal transmits data X to the second terminal.

(4) In the decryption unit 27, the second terminal uses 2 as the secret decryption key stored in the storage unit 16, and in (3) the second terminal
The data X sent from the terminal is decoded. Let Y be the decoded data.

(5) The second terminal converts the data Y in the data conversion unit 28.
Apply transformation φ to . Let Z be the data after conversion.

(6) The second terminal encrypts the data Z in the encryption unit 29 using 2 as the secret encryption key stored in the storage unit 26. Let the encrypted data be U.

('7) The second terminal transmits data U to the first terminal.

(8) The first terminal uses the secret decryption key 1 stored in the storage unit 24 in the decryption unit 30 to decrypt the data U transmitted from the second terminal. Let the data be V.

(9) The first terminal receives the data R in the data conversion unit 31.
Apply transformation φ to N. Let W be the data after conversion.

(10) The first terminal compares V and W in the authentication unit 32. If terminal 2 is a legitimate terminal for terminal 1, K1
and 2, RN and y, and w and 2 and v, respectively. Therefore, the first terminal authenticates the second terminal as legitimate only when vW.

In this method, the second terminal responds to the transmitted data X with 0, (φ(e=xz(3))).

However, in the second conventional example, the first terminal could not select a single text file from the first terminal.
n-plaintext attack) becomes impossible. Furthermore, if the first terminal and the second terminal are a valid pair, the data appearing on the communication path is the encrypted data X-e K1 (RN) of the RH and the encrypted data U'' of the converted value of RN. eKl(φ(FIN). Therefore, a known-plaintext attack (known-plaintext at
tack) is also impossible.

Problems to be Solved by the Invention However, in the second conventional example, in addition to the encryption algorithm and the decryption algorithm, it is necessary to share a certain conversion algorithm between the first terminal and the second terminal.

In view of the above, the present invention provides a terminal authentication method in which a pair of data and its ciphertext does not appear on a communication path, and in which there is no need to share any conversion algorithm other than an encryption algorithm and a decryption algorithm. With the goal.

Means for Solving the Problems The present invention provides that when a first terminal authenticates a second terminal, the first
a step in which the terminal generates a first number; a step in which the first terminal encrypts the first number with the first encryption key to obtain a second number; decrypting the first number with the first encryption key to obtain a third number;
a step in which the first terminal transmits the second number to a second terminal; and a step in which the second terminal decrypts the second number with the second encryption key to obtain a fourth number. , a second terminal decrypts the fourth number using the second encryption key and obtains a fifth number.
a step in which the second terminal transmits the fifth number to the first terminal; and a step in which the first terminal compares the third number and the fifth number, is the same, the second
This is a terminal authentication method that consists of a process of authenticating the validity of a terminal.

Effect of the present invention With the above-described configuration, the second number appearing on the communication path is the encrypted data of the first number, and the fifth number is the fourth number (if both encryption keys are the same, the number of the tube 4 - 1st
number) is the decoded data. Therefore, the data and its encrypted data never appear on the communication path. Furthermore, the only algorithms shared between terminals are the encryption algorithm and its inverse function, the decryption algorithm.

Embodiment FIG. 1 shows an explanatory diagram of a terminal authentication method in an embodiment of the present invention. Note that this figure shows a configuration in which a first terminal authenticates a second terminal.

In FIG. 1, 1 is a first terminal, and 2 is a second terminal. 3 (in the first terminal) is a random number generator, 4 (in the first terminal) is a storage unit that stores 1 as the secret encryption key of the first terminal, and 6 (in the second terminal) is a A storage unit that stores 2 as the secret encryption key of the second terminal, 6 (in the first terminal), and an encryption unit that encrypts data using 1 as the encryption key, 7 (in the second terminal) A first decryption unit that decrypts data using Hani 2 as a decryption key, 8 (in the second terminal) a second decryption unit that decrypts data using Hani 2 as a decryption key, 9 (in the first terminal) a decryption unit 10 that decrypts data using Hani 1 as a decryption key;
(in the first terminal) is an authentication process that compares the data sent from the decryption unit 8 of the second terminal and the output data of the decryption unit 9, and authenticates the authenticity of the second terminal only when the two are the same. Department.

Note that the encryption method in this case is assumed to be a common key encryption method such as DES encryption. The encryption algorithm and its inverse decryption algorithm do not necessarily need to be secret. The same key is used for both, but it will be called an encryption key or a decryption key depending on which key it is used for.

The operation when the first terminal authenticates the second terminal in the conventional terminal authentication method configured as described above will be described below.

(1) The first terminal generates a random number RN in the random number generator 3.

(2) The first terminal uses 1 as the secret encryption key stored in the storage unit 4 in the encryption unit 6 and uses the above! 'Encrypt IN. Do X on the encrypted data.

(3) The first terminal transmits data X to the second terminal.

(4) The second terminal decrypts the data X sent from the first terminal in (3) using the secret decryption key 2 stored in the storage unit 6 in the first decryption unit 7. do. Let Y be the decoded data.

(5) The second terminal decrypts the data Y in the second decryption unit 8 using 2 as the secret decryption key stored in the storage unit 6. Let the decoded data be 2.

(θ) The second terminal transmits data 2 to the first terminal.

('7) The first terminal decrypts the random number RN in the decryption unit 9 using 1 as the secret decryption key stored in the storage unit 4. Let the decoded data be U.

(8) The first terminal compares 2 and U in the authentication unit 10. If terminal 2 is a valid terminal for terminal 1, K1 and 2, RN and Y, and Z and U; h-'i=' match. Therefore, the first terminal authenticates the second terminal only when Z=U.

As described above, according to this embodiment, the second terminal responds to the transmitted data X with 2 (e-', (3)) for θ-'. Therefore, a chosen-plain text attack by a hostile first terminal that could be performed in the first conventional example is not possible.
ck) becomes impossible. Further, if the first terminal and the second terminal are a valid pair, K1=2 and RN=Y. Therefore, the data on the communication path is eKl(RN) and θ-'
+(Ru). Therefore, a third party who eavesdropped on the data on the communication path
wn-plaintaxt attzck) becomes impossible.

Note that the random number generated by the first terminal can be shared between the two terminals without appearing on the communication path. Therefore, this value can be used as a session key. Mutual authentication between the terminals can also be performed by performing the above operation in which the positions of the two terminals are switched. The random number used when the first terminal authenticated the second terminal may be used as the common secret key when the second terminal authenticates the first terminal.

As described in detail, according to the present invention, data and encrypted data for the data do not appear on the communication path, so that a hostile terminal cannot choose a text attack.
n-plaintext attack) and a known-plaintext attack (known-plaintext attack) by a third party who eavesdrops on data on the communication path.
ck) becomes impossible. Therefore, the security of the secret cryptographic key is guaranteed. Furthermore, if the system is implemented using software for each terminal, it is only necessary to prepare modules for common encryption and decryption algorithms.

[Brief explanation of the drawing]

FIG. 1 is an explanatory diagram of a terminal authentication method according to an embodiment of the present invention, FIG. 2 is an explanatory diagram of a first conventional terminal authentication method, and FIG. 3 is an explanatory diagram of a second conventional terminal authentication method. It is a diagram. 1.11.21...First terminal, 2,12゜22
゛=-゛Second terminal, 3, 13, 23...
・Random number generator, 4, 14.24... 1 storage section for encryption key, 5, 15, 2 E5-- 2 storage sections for encryption key, 10° 18.32 .・Authentication department.

Claims (1)

[Claims] A terminal authentication method in which a first terminal and a second terminal have first and second encryption keys, respectively, and authenticate each other when the encryption keys are the same for both terminals, the first terminal and the second terminal having the same encryption key. When authenticating a terminal, the first terminal generates a first number, and the first terminal encrypts the first number with the first encryption key to obtain a second number. , a first terminal decrypts the first number with the first encryption key and receives a third number.
the first terminal transmits the second number to the second terminal, and the second terminal decrypts the second number with the second encryption key and decrypts the second number. the second terminal decrypts the fourth number with the second encryption key to obtain a fifth number; the second terminal decrypts the fourth number with the second encryption key; The process of sending the number 5 and the first
the terminal compares the third number and the fifth number,
A terminal authentication method comprising a process of authenticating the validity of a second terminal when both terminals are the same.