JP7098099B2 - Certificate issuance and authentication system - Google Patents

Description

The present invention relates to an important authentication system that is the gateway to a computer system. This is an authentication system that verifies the existence of access rights to sensitive data and systems that are important to the customer and permits access if the customer has access rights before the customer accesses important confidential data and systems from applications.

There are many authentication methods, from those using a user ID password to those using biometric authentication, and the authentication method to be selected is determined by the importance of data and the cost of the authentication system. However, adopting the conventional simple and fragile authentication system due to cost emphasis can be a simple logic but powerful because it can easily break through hackers and become a stepping stone and a hotbed of crime. You need an authentication system.

Although there is a prior art as shown in Patent Document 1, in this technique, a method of calculating the current authentication number by using a function from the previous authentication number and the authentication number n times before is adopted. With such a method, there is a problem that the previous authentication number is eavesdropped and anyone can be authenticated if the function used is known. However, with the method of the present application, no matter how many times the wiretapping is performed, the authentication is not performed unless the contents of the circulation sequence are known, so that a safe and secure environment can be constructed without being broken by a hacker.

Although there is a prior art as shown in Patent Document 2, this technique can issue a large number of passwords as in the present application, but the purpose is to group terminals using the issued passwords every time. It cannot be used as a countermeasure against eavesdropping by issuing a different password.

Japanese Unexamined Patent Publication No. 2001-177519 JP-A-2007-134990

The present invention relates to a cheap and simple authentication method for determining whether the person who tried to access is a legitimate user or a malicious attacker. With the spread of the Internet, unauthorized access acts are increasing year by year, and many of the methods are plagiarism of identification codes such as IDs. In addition, since the number of cases of unauthorized acquisition of IDs due to phishing fraud using phishing sites is increasing, inexpensive, easy, and strong authentication technology is required.

In the present invention, if there is a terminal such as a PC, a smartphone, or a tablet computer easily from anywhere, a triple check is actually performed between the server and the terminal, but the user is aware of only one authentication. It is the provision of technology whose main feature is that it can be authenticated safely without making it possible.

The authentication system of the present invention allows the user to use a triple powerful and secure authentication system without preparing a special device such as biometric authentication without being aware of only one authentication, so that phishing can be performed. It has the advantage of avoiding fraudulent damage such as theft of personal information by hijacking an account on a site or the like.

Overall block diagram showing an example of the present invention Flow chart for certification of the present invention Circular sequence processing Initial authentication process Authentication process Safety proof diagram of circulation sequence Number of random number extraction types by circular sequence Digit increase in circular sequence When the circular sequence and the number of divisions are natural numbers When the circular sequence is a natural number and the partition number is a prime number

FIG. 1 is an overall schematic view of a network system which is an example of an embodiment of the present invention.
The present invention is an authentication system that protects important confidential information that must never be leaked to the outside by constructing an authentication system with safe and simple logic. In recent years, it has become difficult to protect confidential corporate information with conventional password authentication against increasingly sophisticated hacker attacks such as “spoofing” and “illegal use”. Therefore, there is an increasing need to strengthen information security measures, but there are problems that expensive equipment is required for biometric authentication and that authentication takes time because the logic is complicated and heavy. To solve this problem, the present invention has an advantage that triple authentication can be performed by a simple logic and authentication by a certificate authority can be obtained. As shown in FIG. 1, this authentication system authenticates the user from the 106PC to the 101 certificate issuing system and issues a circular number sequence, and the circular number sequence is issued at three locations of the 101 certificate issuing system, the 105 authentication device, and the 106PC. It is shared and secure authentication is performed.

Since the system of the present invention is constructed by the respective software and devices individually named by the inventor and the applicant, the description of the names is described below.

-101 Certificate issuance system A system for issuing certificates for 106PCs to obtain authentication to servers, creating an environment for issuing certificates, and creating one-time passwords.
-102 Circular sequence A basic sequence for creating certificates and one-time passwords.
In this application, the length and number of sequences are expressed as "digits", but the expression "term" is also considered to be the same.
・ 103LAN
A common local area network.
-104 Internet A computer network that uses the Internet protocol.
-105 Authentication device A system that certifies 106PC when logging in to a server or device on the network.
・ 106PC
Electronic devices such as PCs, smartphones, tablet computers, and IoT.

FIG. 2 is a diagram describing the initial user authentication of the present invention. The purpose of the initial user authentication is to prepare so that the correct user can be easily authenticated by the 105 authentication device from the next time and receive services such as a Web server.

The 106PC provided to the user by the 201 administrator in FIG. 2, the 106PC whose identity has been proved by the 201 administrator, or the 106PC directly by the 201 administrator himself, and the 202 certificate issuance request is sent to the 101 certificate issuing system. On the other hand, the 101 certificate issuing system that received the 202 certificate issuance request creates information related to authentication such as the circulation sequence by 204 circulation sequence processing, and circulates to 105 authentication device and 106 PC by 205 circulation sequence transmission. Send information related to authentication such as sequences. Next, create points for creating certificates by creating 207 certificate points, send certificate points to 105 authentication devices and 106 PCs by sending 208 certificate points, and 209 certificates for 105 authentication devices and 106 PCs. Receive certificate points by receiving written points. The 105 authentication device and 106PC use the received certificate points to create a certificate in the 210 certificate creation process, the 106PC sends the created certificate to the 105 authentication device, and the 105 authentication device receives the 211 certificate. Receive the certificate created by 106PC. The 105 authentication device confirms whether the received certificate and the certificate created by the 105 authentication device have the same certificate contents, and if they are the same, the 106PC is 213 correct by recognizing the new user as the 212 correct certificate. Recognize as a user and register 106PC as a new user in the storage device of the 105 authentication device.

FIG. 3 is a diagram describing the cyclic sequence processing of the present invention. The purpose of the circular sequence processing is to create a circular sequence and to create various information for creating a certificate by the circular sequence.

In the creation of the 301 circulation sequence in FIG. 3, the circulation sequence is created, but the logic for creation is described separately. Next, in 302 random number generation, random numbers are generated for the number of digits of the circular sequence using all the symbols that can be used from hexadecimal number 00 to hexadecimal FF, and the circular sequence is encrypted by 303 circular sequence encryption, 304. Save the encrypted random number in the circular sequence save.

FIG. 4 is a diagram describing the 210 initial certification process of the present invention. 101 The certificate issuance system is instructed to take out a part of the circular sequence and create a certificate.

At the 401 certificate point, using the specified start point, the random number for the divided numerical value is extracted from the start point of the circular sequence, the random number extracted by 402 hashing is hashed with SHA1, etc., and the 403 encryption is performed. The time stamp etc. is encrypted by the original encryption, and the two values are combined by 404 combination.

FIG. 5 is a diagram describing the user authentication of the present invention. The purpose of user authentication is to enable correct users to be easily and safely authenticated and receive services such as Web servers.

When the 106PC takes an action against the 101 certificate issuing system, the input screen of the ID and the password is presented to the 106PC by the 501ID and the password request, and the 106PC takes in the ID and the password by the 502ID and the password input and 101. Send to the certificate issuing system, check if the ID and password are correct with 503, and if correct, make a request to send the certificate used last time to 106PC with 504 last time certificate request, and 505 last time certificate 101. Send to the certificate issuing system, 101 the certificate issuing system receives 505 previous certificate at 506 previous certificate reception, 507 at the judgment of correct certificate 505 when the previous certificate is correct, 508 login notification The login is notified to the 105 authentication device and 106 PC. When the 105 authentication device confirms that an approval request comes from 106PC with a new certificate, it creates a communicable situation such as opening a port to 106PC by preparing for 509 login, and the start point used last time at 510 start point. Create a new start point by adding the divided numerical value from, and execute the 210 authentication creation process. On the other hand, the 106PC that received the 508 login notification creates a new start point by adding the divided numerical value from the point of certificate issuance used last time at the 511 start point, executes the 210 authentication creation process, and stores the 512 certificate. The created certificate is stored, the certificate is sent to the 105 authentication device by sending the 513 certificate, and the 105 authentication device receives the certificate by receiving the 514 certificate. For the 105 authentication device, check if the 105 authentication device and the certificate created separately by 106PC are the same with the 515 correct certificate, and further combine the time stamps included in the certificate within n minutes. If there is no problem after confirming that the certificate was created in, the login is successful and the service is started.

The purpose of creating a circular sequence is to create a random number once without changing the length of the random number, without reissuing the random number, and depending on the number of digits in the circular sequence, tens of thousands, hundreds of thousands, or millions of times. Can be converted into a different random number.

The definition of the circular sequence and the number of divisions is described again in the explanation of the name.
What is a circular sequence?
-A set of random numbers created for prime digits.
-Use a prime number that is larger than the number of divisions.
-A set of random numbers generated using hexadecimal numbers 00 to hexadecimal numbers FF.
-Conceptually, it is not a single column of numbers but a sequence of numbers.
(Actually repeated for a certain length)
-For security reasons, it is desirable to create it for each user and each device used.
What is the number of divisions:
・ A prime number of 10 or more.
One digit may be used, but it is desirable to use a prime number with two or more digits for security reasons.
-A prime number used when dividing a circular sequence.
-A prime number smaller than the number of digits in the circular sequence (a fixed length that is repeated).
-By changing the number of divisions to a prime number other than the prime number currently in use, it is possible to change the certificate without changing the certificate creation logic.
Relationship between circular sequence and number of divisions:
-Even if the number of divisions is used and random numbers for the number of divisions are extracted from the circular sequence, the same sequence will not be cut unless it is circulated several times.
-When the number of digits in the circular sequence is circulated, the number of divisions is changed to the next prime number and a new random number is extracted from the circular sequence.

FIG. 6 is an explanatory diagram when the prime number 7 is used for explanation and the number of divisions is 7 digits, and the number of divisions is the prime number 2, the prime number 3, and the prime number 5.
601 When the number of cycles is 7 digits and the number of divisions is 2, an explanatory diagram using prime numbers 7 and 2 is obtained. In the 602 cyclic number sequence, the numbers 1 to 7 are described, but in reality, a larger random number is used, but the numbers 1 to 7 are used for the sake of clarity.
603 The first division is taken out from the circulation sequence for the number of divisions. The random numbers taken out are 1 and 2.
The second 604 division is taken out from the circulation sequence for the number of divisions. The random numbers taken out are 3 and 4.
The third 605 division is taken out from the circulation sequence for the number of divisions. The random numbers taken out are 5 and 6.
At the 4th division of 606, it is taken out from the circulation sequence for the number of divisions. The extracted random numbers are 7 and 1.
At the 5th division of 607, it is taken out from the circulation sequence for the number of divisions. The random numbers taken out are a few.
At the 6th division of 608, it is taken out from the circulation sequence for the number of divisions. The random numbers taken out are 4 and 5.
609 At the 7th division, take out from the circulation sequence for the number of divisions. The extracted random numbers are 6 and 7.
610 The 8th division is taken out from the circulation sequence for the number of divisions. The random numbers taken out become 1 and 2 and return to the original.
Next, the number of divisions is set to the prime number 3 without changing the circular sequence.
613 At the first division, take out from the circulation sequence for the number of divisions. The extracted random numbers are 1, 2, and 3.
614 The second division is taken out from the circulation sequence for the number of divisions. The extracted random numbers are 4, 5, and 6.
615 The third division is taken out from the circulation sequence for the number of divisions. The extracted random numbers are 7, 1, and 2.
616 At the 4th division, take out from the circulation sequence for the number of divisions. The extracted random numbers are 3, 4, and 5.
617 Take out from the circulation sequence for the number of divisions at the 5th division. The extracted random numbers are 6, 7, and 1.
618 The 6th division is taken out from the circulation sequence for the number of divisions. The extracted random numbers are 2, 3, and 4.
619 The 7th division is taken out from the circulation sequence for the number of divisions. The extracted random numbers are 5, 6 and 7.
620 At the 8th division, take out from the circulation sequence for the number of divisions. The random numbers taken out become 1, 2, 3, and return to the original.
Next, the number of divisions is set to the prime number 5 without changing the circular sequence.
623 The first division is taken out from the circulation sequence for the number of divisions.
The extracted random numbers are 1, 2, 3, 4, and 5.
624 The second division is taken out from the circulation sequence for the number of divisions.
The extracted random numbers are 6, 7, 1, 2, and 3.
625 The third division is taken out from the circulation sequence for the number of divisions.
The extracted random numbers are 4, 5, 6, 7, and 1.
At the 4th division of 626, the number of divisions is taken out from the circulation sequence.
The extracted random numbers are 2, 3, 4, 5, and 6.
At the 5th division of 627, it is taken out from the circulation sequence for the number of divisions.
The extracted random numbers are 7, 1, 2, 3, and 4.
At the 6th division of 628, the number of divisions is taken out from the circulation sequence.
The extracted random numbers are 5, 6, 7, 1, and 2.
629 The 7th division is taken out from the circulation sequence for the number of divisions.
The extracted random numbers are 3, 4, 5, 6, and 7.
630 At the 8th division, take out from the circulation sequence for the number of divisions.
The random numbers taken out become 1, 2, 3, 4, 5 and return to the original.
In any case where the number of cycles is 7 digits and the number of divisions is 2, 3 or 5, the process returns to the original 8th time.
It was proved that by changing the number of divisions, different random numbers can be extracted from a set of random numbers called a circular sequence by the length of the number of divisions and by the number of digits of the circular sequence x the type of random number.
In other words, if you use a circular sequence for the number of digits of the prime number and a prime number smaller than the prime number used in the circular sequence for the number of divisions, you can always retrieve different random numbers for the number of digits in the circular sequence, so you can exchange the circular sequence with each other only once. Then you can extract an infinite number of random numbers.
In this case, a 7-digit random number was used for the circular sequence, but it is possible to extract 21 different random numbers with only 7 digits.

As shown in Fig. 7, if the 702 circulation sequence is 503 digits, even if the 703 division number is a prime number from 11 for safety, there are 91 kinds of prime numbers up to the prime number 503, and of course, they are prime numbers, so 704. The quotient is not divisible. The formula for calculating the type of random number is as follows.
503 x 91 = 45,773 (types of random numbers that can be retrieved)
The fact that 45,773 types of random numbers can be retrieved means that even if you log in 5 times a day, 45,773 ÷ 5 times ÷ 365 days = 25.08, and you can retrieve random numbers for 25 years. If this is a natural number and it is divisible by using the circular sequence and the number of divisions, the random numbers will be extracted from the same place in the circular sequence, so it is not possible to face the random numbers from different places for 25 years. For this reason, the combination of prime numbers and prime numbers is important, and it is possible to authenticate each other using different random numbers every 25 years by exchanging a circular sequence once. With one circular sequence exchange, there is no exchange of information with each other after that, and a certificate that can authenticate each other can be issued.
There are a total of 168 prime numbers of 1000 or less. If a circular sequence is created with a prime number 1009, 1009 x (168-4) = 165, 476 (types of random numbers that can be retrieved).
165, 476 ÷ 5 times ÷ 365 days = 90.67
Therefore, even if authentication is performed 5 times a day, it is possible to easily and safely create a different certificate every time for 90 years. In other words, it is possible to increase the number of years of use exponentially by the length of the circular sequence. This is because "-4" in the above equation excludes the prime numbers 2, 3, 5, and 7.

By issuing a safe and secure certificate called a circular sequence once, it is possible to safely create an infinite number of new certificates from that certificate.
This is because if all the circular sequences are used, the underlying circular sequence should be changed to a new prime number digit and the shortage of random numbers should be added. For example, if the circulation sequence has 503 digits, when changing the circulation sequence to the next large prime number 509, a 6-digit random number is added to the base circulation sequence, and 503 can be used for the number of divisions, so 509 new numbers can be used. It becomes possible to make a certificate.
Further, if the next prime number is 521, the number of divisions 503 and 509 can be used, and 1030 random numbers can be extracted in total.
Since it is proved by Euclid's theorem that the number of prime numbers is infinite, it is possible to issue a certificate infinitely. Furthermore, a prime number can be easily obtained by using a Rabin-Miller-Rabin primality test method or the like.

FIG. 8 is an explanatory diagram when the digit increase of the circulation number sequence is increased from 5 digits of the circulation number sequence and 2 or 3 divisions to 7 digits of the circulation number sequence and the number of divisions is changed to 5 newly. In this example, new random numbers a and b are inserted consecutively at the beginning, but a and b are inserted separately at different locations, and the inserted position information is inserted between the 101 certificate issuing system, 105 authentication device, and 106 PC. You can synchronize with.
The advantage of adding random numbers is that there is no need to exchange raw certificates on the net, and only the newly inserted random numbers and the position information where the random numbers are inserted need to be synchronized using the net, so it is said that the certificate is leaked. It is possible to avoid the problem.

When the random number inserted is included as in the case of increasing to 7 digits of the 827 circulation sequence and increasing the number of divisions to 5 or increasing to 7 digits of the 830 circulation sequence and setting the number of divisions 5, the certificate for the number of locations x the number of divisions It will be possible to increase. In this case, the number of certificates to be increased by 0023 is further increased by a random number × a prime number.
However, it is preferable not to use this pattern in applied technology because it complicates management.

FIG. 9 When the circular sequence and the number of divisions are natural numbers, an example of using natural numbers without using prime numbers is shown.
When the 901 circulation sequence has 8 digits and the number of divisions is 4, only two types of random numbers can be extracted even though the circulation sequence has 8 digits.
906 When the number of cycles is 8 digits and the number of divisions is 4, and the number of cycles is shifted by 1 digit, the sequence of cycles is 8 digits, so it is shifted by 1 digit in order to extract the maximum random number. As you can see by comparing the 1st 908 division and the 2nd 909 division, only 1 byte is deviated, so from the perspective of an eavesdropper, if 1 byte, that is, 256 types of Hex is added to the 1st 908 division, the random number of the 2nd 909 division It is not safe because it can be easily deciphered, so complicated management is required.

When the circular sequence is set to a natural number and the number of divisions is set to a number that cannot be divided by the natural number as shown in FIG. Is in complex management. It has already been proved that prime numbers are absolutely indivisible. Furthermore, many methods such as Euclid's theorem and the Rabin-Miller-Rabin primality test make it possible to easily know the types and values of small prime numbers contained in large prime numbers, but in the case of natural numbers, one by one. It is complicated because you have to investigate and manage it yourself.

Because the logic is simple, it can be implemented inexpensively, and contrary to the fact that the logic is simple, the password is disposable, so even if a brute force attack or password is leaked, it has a robust security function that you do not know what to use next. It will be used as an authentication system that can be used with confidence in IoT, which is expected to become more and more popular in the future.

Claims (3)

It is an authentication system that has a certificate issuing system, an authentication device, and a PC, and is composed of two prime numbers. One prime number used for the number of digits is larger than the other prime number used for the number of divisions, and the circular sequence is a collection of random numbers created using hexadecimal numbers 0 to F. In the initial user authentication, the certificate issuing system creates a circular number sequence and sends it to the authentication device and the PC, and then the certificate issuing system . Creates a start point and sends it to the authentication device and PC, and the authentication device and PC each use the received start point to create a certificate in the authentication creation process, and in user authentication, The authentication device and the PC each create a new start point shifted by the number of divisions from the previously used start point, create a certificate in the authentication creation process using the new start point, and perform the above-mentioned authentication creation process. Extracts the number of divisions of random numbers from the starting point to be used from the circular sequence, hashes the extracted random numbers, encrypts the time stamp, and combines the hashed random number and the encrypted time stamp to create a certificate. This is an authentication system that can create a different certificate each time by changing the number of divisions to a prime number other than the prime number currently used when the cycle is performed several times . After extracting random numbers that differ by the length of the number of divisions from the underlying circular number column by multiplying the number of digits of the circular number column by the number of types of prime numbers used for the number of divisions, the circular number sequence When the number of digits of is changed to one new large prime number and random numbers for the insufficient number of digits are inserted into the original circular number sequence to form a new circular number sequence, the newly inserted random number and random number are inserted. By synchronizing the location information between the certificate issuing system, the authentication device, and the PC, the number of types of prime numbers that are smaller than the new one large prime number and larger than the last used division number and the new one. The authentication system according to claim 1, which can form a new circular number sequence that enables a new certificate to be created by the number obtained by multiplying two large prime numbers. After extracting random numbers that differ by the length of the number of divisions from the underlying sequence of cycles , multiplying the number of digits of the sequence of cycles and the number of types of prime numbers used for the number of divisions , then the basis. The shortage of random numbers to be newly inserted into the base circular sequence without exposing the circular sequence to be published using communication means such as a network, creating a new circular sequence and synchronizing with each other on the network, etc. The authentication system according to claim 1, wherein a new circular sequence can be created by synchronizing only the position information into which the random number is inserted between the certificate issuing system, the authentication device, and the PC .

Images