JPH0368582B2 - - Google Patents

Description

[Detailed Description of the Invention] [Field of Industrial Application] The present invention prevents falsification of communications when transmitting and receiving important information via public communication lines such as farm banking, and also detects whether or not the communications have been tampered with. This invention relates to a digital signature system that can verify user authenticity.

[Conventional technology]

In recent years, opportunities to trade important information such as financial information using public communication lines have increased, but these transactions are susceptible to falsification of data by a third party, fraud on the part of the user, or even internal crime on the part of the host. Data falsification has become a problem. An effective method for preventing third party intervention is for the user and the host to hold a common encryption key that is kept secret from third parties in each communication, and for the user to encrypt the communication using the common key. A common key method is known in which the host receives the encrypted text and decrypts the encrypted text using a common key to obtain the communication. With this method, by increasing the sophistication of the encryption method, it is possible to more reliably prevent third parties from interfering with the data, and the encryption and decryption procedures are also relatively easy, making it a simple method. Because it is possible to build a system with equipment,
It can be said that it is suitable for building a wide network targeting a large number of users, but on the other hand,
This method has the problem of how to distribute the encryption key at the start of communication. An even more important problem is that since the encryption key is common, there is room for the host and user to tamper with the data in place of their respective communication partners, and this method is not susceptible to third party intervention. Although it is secure, there is a problem in that it essentially cannot prevent fraudulent acts by the parties concerned.

In order to solve this problem, a so-called public key method has recently been proposed, in which the encryption key held by the user and the decryption key held by the host are separate, and the encryption key is made public in a public file. It's starting to come out. According to this method, even if the encryption key is known to another person, there is no risk of the secret of the message being leaked, so it is possible to prevent third parties from interfering with the data, and it is also possible for the user to know the decryption key. Since this information cannot be known, fraud by users can also be prevented. However, this method requires extremely sophisticated encryption and decryption techniques to make it virtually impossible to unravel the decryption key from the encryption key and ciphertext. It is necessary to set up a fair third-party organization to manage the public file of encryption keys, and expensive equipment is also required for implementation, so it is not suitable for networks targeting a large number of users such as farm banking. It was impossible to do so.

[Means for solving problems]

The present invention was made in view of the current situation, and by realizing a digital signature system with high security comparable to the public key method using a device as simple as the common key method, it is possible to prevent communication by a third party. The purpose of this system is to prevent text falsification, make it possible to verify the authenticity of users, and achieve an authentication effect in correspondence transactions that is equivalent to a signature or a seal in document transactions.

Generally speaking, digital signature systems require that a third party cannot forge a signature.

The signature cannot be forged by the recipient.

The sender (user) cannot later deny the fact that the signature was sent.

is important.

In order to achieve the above object, the present inventor placed a digital signature device between a user terminal and a host computer, which has a neutral status with respect to both, and inside the device, a digital signature device that is kept secret from the host computer. The user key that has been sent and the host key that is kept secret from the user are set in a state that cannot be tampered with and cannot be read, and the message sent from the user terminal is stored inside the digital signature device as the user key. We decided to perform double authentication using the host key.

The gist of the invention completed by this method is that it consists of a digital signature device installed on the user side and a verification device installed on the host side. The user key (UK) is set arbitrarily by the user under the condition that the user is using the device, and the terminal key (TK) is set by the host in a state that is kept secret from the user.b) The message (M) is authenticated with the user key (UK) a user authentication processing unit that creates a user authentication code (UAC) and combines the user authentication code (UAC) and the message (M) to obtain a user-signed message (M+UAC); c. the user-signed message (M+UAC); of,
Furthermore, a terminal authenticator (TAC) is created by performing authentication processing using the terminal key (TK), and the terminal authenticator (TAC)
and the user-signed message (M+UAC) are combined to create the user/device-signed message (M+UAC+
The host-side verification device that receives the user/terminal signed message (M+UAC+TAC) includes: d) the terminal key (TK) set in the digital signature device; Same host key (HK), e User/device signed message (M+UAC+
a comparison verification unit that creates a host authenticator (HAC) by authenticating the host authenticator (TAC) with the host key (HK) and compares the host authenticator (HAC) with the terminal authenticator (TAC); f user/terminal; Signed message (M+UAC+
The purpose of the present invention is to provide a digital signature system comprising: a record storage section for recording TAC);

[Effect]

In the digital signature system having such a configuration, messages are exchanged as follows.

First, the message (M) input into the digital signature device is authenticated using the user key (UK) to create a user authentication code (UAC), and the user authentication code (UAC) is recognized as the message (M). Combine them to create a user-signed message (M+UAC). Next, the user-signed message (M+UAC) is further authenticated using the terminal key (TK) to create a terminal authenticator (TAC), and the terminal authenticator (TAC) is combined with the user-signed message (M+UAC). Create a message with user/terminal signatures (M+UAC+TAC) containing the signatures of both the user and the terminal, and send this to the host side via the communication line.

On the other hand, user/device signed message (M+UAC
The host computer that receives the message (M+UAC+TAC) processes the user/terminal signed message (M+UAC+TAC) via the verification device.
TAC) is separated into a user-signed message (M+UAC) and a terminal authenticator (TAC) based on the field length.
+UAC) using the host key (HK) to obtain the host authenticator (HAC). Next, the host authentication code (HAC) and the terminal authentication code (TAC) are compared to examine the authenticity of the user/terminal signed message (M+UAC+TAC).

Host Authenticator (HAC) and Terminal Authenticator (TAC)
If they match, it is determined that the communication has been sent from a legitimate user terminal device, and the contents of the message (M) are executed.

In addition, the message with user/terminal signature (M+UAC+
TAC) is recorded and saved in a data file on the host side as evidence in the event of a problem.

〔Example〕

Next, details of the present invention will be explained based on illustrated embodiments. FIG. 1 is an explanatory diagram showing the overall configuration of a digital signature system according to the present invention. This system is a terminal interface device (hereinafter referred to as a personal computer) that has a built-in digital signature device 2 in a personal computer (hereinafter referred to as a personal computer) 1.
A host key (HK) provided on the host computer 4 side and matching each terminal key (TK)
It mainly consists of a host side device B having a verification device 6 connected to a security file 5 that records and stores the information. The user terminal device A and the host device B are connected by a public communication line C, and it is assumed that a large number of user terminal devices A are connected to one host device B. The user terminal device A is installed in each office or home, while the host device B is installed in a financial institution such as a bank or a securities company.

TID3 is the message (M) sent from PC 1
The message that has been authenticated by TID3 is returned to the PC 1 and sent to the communication line C via the PC 1. on the other hand,
The verification device 6 installed on the host side is for verifying the validity of the message sent from the personal computer 1, and this function can also be realized by a hardware device installed upstream of the host computer 4. It can also be configured in a software manner using a program within a host computer. The TID 3 includes a digital signature device 2 that performs an authentication function, a communication section 7 that conforms the data format of the communication to the so-called Zengin standard procedure, a modem 8, and an NCU (network control unit) 9. Although not shown, the modem 8 and NCU 9 can be configured separately from the TID 3. In this case, the existing modem 8 and NCU 9 can be used, and the TID 3
can be constructed at low cost.

The digital signature device 2 corresponds to the heart of the present invention, and after the user key (UK) and terminal key (TK), which are authentication keys, are set, the digital signature device 2 is completely sealed to prevent tampering. In addition, it is configured so that internal data will be destroyed if an attempt is made to disassemble it and decipher it. Both user key (UK) and terminal key (TK) are digital signature device 2
The user key (UK) is set arbitrarily by the user while being kept secret from the host, while the terminal key (TK) is set by the host while being kept secret from the user. is set arbitrarily. To set these authentication keys, for example, when the digital signature device 2 is installed, the user first sets a user key (UK), then the host sets a terminal key (TK) unique to each terminal, and then the host sets the terminal key (TK) unique to each terminal. It is conceivable to mechanically and electrically seal the Mechanically sealing means housing the part in a strong container that cannot be disassembled, and electrically sealing means taking electrical protection measures to prevent internal information from leaking from the outside. For example, it is possible to erase the memory contents by cutting off the power supply at the same time as opening the container, or to electrically destroy the memory.

A digital signature device 2 and a verification device 6 installed on the host side corresponding to the digital signature device 2
The internal structure of is schematically shown in FIG. That is, the digital signature device 2 creates a user authentication code (UAC) and uses the user authentication code (UAC).
User authentication processing unit 1 that combines the above with the message (M) to create a message with user signature (M+UAC)
0 and the user-signed message (M+UAC) are further authenticated with the terminal key (TK) to create a terminal authenticator (TAC), and the terminal authenticator (TAC) and user-signed message (M+UAC) are combined. and a terminal authentication processing unit 11 for creating a message with a user/terminal signature (M+UAC+TAC).

To create a user authenticator (UAC), a user key (UK) is given as a parameter to an authentication algorithm using a one-way function, which determines the authentication method and uses the method to generate a message (M). This is done through encryption, and the generated user authentication code (UAC) is combined with the message (M) to generate a user-signed message (M+UAC). In the diagram, AUK (M) = UAC means that the message (M) is sent using the user key (UK).
This indicates that a user authenticator (UAC) was obtained as a result of the authentication process. The user authentication code (UAC) corresponds to the user's signature in document transactions, and guarantees that the message (M) has been approved by the user.

Message with user signature added by user authentication processing unit 10 (M+UAC)
is then input to the terminal authentication processing unit 11 in order to attach a terminal-specific signature to the message. Message with user signature input to the terminal authentication processing unit 11 (M+
The UAC) is further authenticated using the terminal key (TK) as a parameter, and the terminal authenticator (TAC)
At the same time, the terminal authentication code (TAC) is combined with the user-signed message (M+UAC) to create a user/terminal-signed message (M+UAC+
TAC) is generated. In addition, terminal authenticator (TAC)
is designed to be generated only for messages with a user authentication code (UAC) attached.
A terminal authentication code (TAC) is not generated for messages that do not have a user authentication code (UAC). By doing this, it is guaranteed that the user signature and the terminal signature are always written on the message that has passed through the terminal authentication processing section 11. Furthermore, since the terminal signature is comprehensively applied to the entire message signed by the user, the effect is similar to that of overwriting the terminal signature text on top of the user signature text, and the message cannot be tampered with. It is. Note that the algorithm for obtaining the user authentication code (UAC) from the message (M) and the algorithm for obtaining the terminal authentication code (TAC) from the user-signed message (M+UAC) can be the same except for the authentication key.
In the above embodiment, in order to simplify the explanation, the user key (UK) and terminal key (TK) are static, but they can also be dynamically generated using random numbers or the like.

The user/terminal signed message (M+UAC+TAC) created as described above is returned to the personal computer 1, passes through the personal computer 1, and is then transmitted to the host computer 4 via the public communication line C. On the other hand, the configuration of host side device B is schematically illustrated as follows. The host side device B separates the message with user/terminal signature (M+UAC+TAC) sent via public communication line C into the message with user signature (M+UAC) and the terminal authentication code (TAC), and also sends the message after separation. Message with user signature (M
+UAC) with a host key (HK) to obtain a host authentication code (HAC), and compares the host authentication code (HAC) and terminal authentication code (TAC) to authenticate the user. / Comparison verification unit 13 for verifying the authenticity of the terminal-signed message (M+UAC+TAC). The host key (HK) is the same as the terminal key (TK) set on each terminal, but when the host side sets the terminal key (TK) when installing the digital signature device 2, the host key (HK) is the same as the terminal key (TK) set on each terminal. The information recorded and saved in Security File 5 shall be used.

Since the host key (HK) and terminal key (TK) are exactly the same, the user/terminal signed message (M+
If the UAC + TAC) is being sent from a legitimate user terminal device A and has not been tampered with during the process, the host authenticator (HAC) and terminal authenticator (TAC) should naturally match. be. Moreover, since the terminal key (TK) is set by the host in a state that is hidden from the user, it is impossible for the user to know the terminal key (TK), and therefore the host authenticator (HAC) The match between the message and the terminal authentication code (TAC) is the basis for guaranteeing that the message is definitely sent from the predetermined user terminal device A. If it is confirmed that the message is genuine, the contents of the message are executed; on the other hand, if it is not genuine, processing such as cutting off the line is performed.

In addition, the message with user/terminal signature (M+UAC+
TAC) is saved and recorded in the data file 14 in case a trouble occurs later.

If the user objects to the details of the transaction, the authenticity of the transaction is verified using the procedure shown in FIG. That is, it reads the user/terminal signed message (M+UAC+TAC) of the transaction from the data file 14, separates it into the message (M) and user authentication code (UAC), and provides the separated message (M) to the user. Then, the digital signature device 2 performs authentication processing, and the validity of the message (M) is verified based on whether or not the same user authentication code (UAC) as the user authentication code (UAC) is obtained. It is. Although the host can know the terminal key (TK),
Since the user key (UK) cannot be known,
If the user authentication code (UAC) recorded and saved by the host in the data file 14 matches the user authentication code (UAC) created by the digital signature device 2 for verification, the validity of the message is confirmed. It is guaranteed. Even if the validity of the message (M) is guaranteed through the above verification, in case the user objects to the details of the transaction due to a malfunction of the digital signature device 2, etc. and a representative of the host side are present to authenticate the standard message (M) with the digital signature device 2 on the user side, and an agreement is made that the authentication result will be used as a parameter for verification in the event of a problem. It's more reliable if you do.

FIG. 4 shows an example of processing when exchanging electronic messages (HIRATA) using this digital signature system. In this process, the message [HIRATA] is authenticated using the user key (UK) to obtain the user authentication code [YU].

Authenticate the user-signed message (HIRATA+YU) using the terminal key (TK) to obtain the terminal authenticator [E].

Sends a message with user/terminal signature (HIRATA + U + H) to the host side via a public communication line.

Authenticate the user-signed message (HIRATA+U) with the host key (HK) and obtain the host authenticator [E].

Compare the host authentication code [E] and the terminal authentication code [E] to confirm that there is no intervention in the message [HIRATA].

As described above, in this system, both the user key (UK) and host key (HK) are set in the digital signature device in an untamperable and unreadable state, and the user key (UK) is known only to the user and Since the host key (HK) is known only to the host, it is impossible for the host to use the user key (UK) illegally, and it is also impossible for the user to use the host key (HK) illegally. be. The validity of the message (M) is guaranteed because the message (M) always has a user authentication code (UAC) that is the user's trail and a terminal authenticator (TAC) that is the device's trail. It is.
In addition, only the user can create a user authentication code (UAC), so as long as the user authentication code (UAC) is included in the message, the user cannot deny the fact that it has been sent. There is no room for fraud.

Note that the digital signature device 2 in the digital signature system according to the present invention can also be realized by an IC card, which has become popular in recent years. The authentication algorithm in this system can ensure sufficient security without using a complicated algorithm like the conventional public key method, so it can be implemented with a one-chip custom LSI, and it is suitable for IC cards. is extremely suitable. In this case, if the setting of the user key (UK) and terminal key (TK) to the IC card is done as a bank teller service, the introduction of this system will be extremely smooth.

Although not shown, in this embodiment, regarding the activation of the digital signature device 2, consideration is given to providing a double locking mechanism for activating the user authentication processing section and for activating the terminal authentication processing section. be done. That is, in order to operate the user authentication processing unit 10, the insertion of a certain authorized person card is required, and on the other hand, in order to operate the terminal authentication processing unit,
First, a call is made from the host side, and the terminal authentication processing unit 11 can be activated only when the terminal returns a valid response to the call to the host side. By doing this, it is possible to prevent unauthorized use of the terminal by the user.

〔Effect of the invention〕

The digital signature system according to the present invention has a blackboxed digital signature device placed on the user side, and contains a user key (UK) kept secret from the host and a user key (UK) kept secret from the user. The terminal key (TK) is set so that it cannot be tampered with, and the host is given the same host key (HK) as the terminal key (TK). The message is first authenticated using the user key (UK) and then sent to the user key (UK). Since we decided to further authenticate the entire message with the ``UK'' added using the terminal key (TK), both the user's trail and the terminal's trail can be left in the message, and the host can check whether the received message has been tampered with. Key (HK)
In addition, if a problem occurs with the content of the transaction, the user authentication code (UAC) included in the message can be verified to ensure that the transaction is performed using the valid user key (UK). Since it is possible to check whether or not this is the case, there is no possibility that the user will suffer any disadvantage due to fraud on the part of the host or a third party. Although this system requires the digital signature device installed on the user side to be configured in hardware, the verification device on the host side can also be configured on the software of the host computer, so it is based on conventional devices. This system can be installed as is. Furthermore,
Since the authentication process performed within the digital signature device does not require the sophisticated encryption process used in public key systems, it is possible to use a simple device, and in that sense, the introduction of this system is extremely easy. It's easy.

[Brief explanation of drawings]

FIG. 1 is an explanatory diagram showing the overall configuration of the digital signature system according to the present invention, FIG. 2 is an explanatory diagram showing the internal configuration of the digital signature device, and FIG. 3 is an explanatory diagram showing the verification method when a problem transaction occurs. Fourth
The figure is an explanatory diagram showing the exchange of messages using example sentences. A: User terminal device, B: Host side device,
C: Public communication line, 1: Personal computer, 2: Digital signature device, 3: TID, 4: Host computer, 5: Security file, 6: Verification device, 7: Communications department, 8: Modem, 9: NCU, 1
0: User authentication processing section, 11: Terminal authentication processing section, 12: Host authentication processing section, 13: Comparison verification section, 14: Data file.

Claims (1)

[Claims] 1. When exchanging messages between a user terminal and a host computer via a public communication line,
In a digital signature system that is used to guarantee the validity of the message and consists of a digital signature device installed on the user side and a verification device installed on the host side, the digital signature device on the user side includes: a) A user key (UK) that is set by the user arbitrarily while being kept secret from the host, and a terminal key (TK) that is set by the host while being kept secret from the user; b) A message (M) is sent using the user key (UK). a user authentication processing unit that performs authentication processing to create a user authentication code (UAC), and combines the user authentication code (UAC) and the message (M) to obtain a message with a user signature (M+UAC); c. the user signature; Attached message (M+UAC),
Furthermore, a terminal authenticator (TAC) is created by performing authentication processing using the terminal key (TK), and the terminal authenticator (TAC)
and the user-signed message (M+UAC) are combined to create the user/device-signed message (M+UAC+
a terminal authentication processing unit that obtains the user/terminal signed message (M+UAC+
The verification device on the host side that receives the TAC) has d a host key (HK) that is the same as the terminal key (TK) set in the digital signature device, and e a message with user/terminal signature (M+UAC+
f user/ Message with terminal signature (M+UAC+
A digital signature system comprising: a record storage section for recording TAC); 2. The digital signature system according to claim 1, wherein the functions of a digital signature device installed at a user are realized by an IC card.