JPH07325785A - Network user identifying method, ciphering communication method, application client and server - Google Patents

Abstract

PURPOSE:To provide a compatibility with a conventional password identifying system, to make the control of a cryptographic key safe and easy, to facilitate the individual addition/cancellation of a user and to invalidate a retransmittion attack, regarding a method improving the security of a network. CONSTITUTION:In a network application system identifying a user by transmitting user identification data ID and a password PW from a client and confirming the existence of the petinent ID and PW by a server, a client C ciphers the ID and PW by the open key Kp of an open key system and transmits the key Kp to a server S, and the server S takes out the ID and PW by decoding the key by his own secret key Ks. At the beginning of the identification, the server S transmits a random number R to the client C, the client C includes the ID, the PW and the received random number R and ciphers them by the open key Kp and transmits them to the server S, and the server S confirms that the decoded random number R' is the same as the random number R transmitted previously.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for improving security in a network environment where many computers are connected.

In a recent distributed processing environment, a remote virtual terminal application (telnet) or a file transfer application (ftp) that can operate a computer in a remote place via a network as if they were directly connected. Is widely used.

It is considered that these network applications are essential elements for realizing services such as remote maintenance work of computers and online distribution of software in the era of commercial networks. However, these network applications are constructed based on an open architecture, and usually employ a protocol that transfers a user identifier and a password as they are as a user authentication method. In this case, eavesdropping by various monitoring devices can be performed relatively easily. Eavesdropping is fatal because it leads to the theft of the password immediately.

[0004]

2. Description of the Related Art Heretofore, various authentication methods based on cryptography have been proposed as alternatives to password authentication. The encryption methods are roughly classified into a common key method and a public key method.

In the common key system, the encryption key on the transmission side and the decryption key on the reception side are the same encryption key, and the transmission side encrypts the communication text (plaintext) with the encryption key and transmits it. The communication text (ciphertext) received in step 1 is decrypted with the same encryption key. Both the sending side and the receiving side must keep the encryption key secret. It is also called a private key method or a conventional encryption method.

In the public key system, an encryption key on the transmitting side and a decryption key on the receiving side are different from each other, and one (public key)
Is made public and the other (private key) is made secret. An example of the encryption authentication method is shown below. A method in which an authentication server is provided, the client issues a ticket from the authentication server, and the ticket is encrypted by the common key method and sent to the application server for authentication. Using the public key method, each user generates his / her own private key and public key, manages the private key, registers the public key in a public file, and encrypts the message (password) with the private key. A method in which the server extracts the user's public key from the public file, decrypts it, and inspects it. The server authenticates the user using an electronic signature.

In addition to these, various attempts have been proposed such as one using zero-knowledge proof and one using a meaningful identifier as a public key. However, these schemes are not compatible with traditional network applications and require major changes to be practically applied. For example, a separate authentication server is required, users must communicate with the authentication server in addition to the application server, and all users must have their private keys and register their public keys. Moreover, it is necessary to securely manage the private key.

[0008] In particular, in applications such as inter-organizational connections, the number of users who need security is limited,
Considering that they are often used together with conventional network applications, these changes can be a heavy burden. In addition, a large change in the operation method may cause a feeling of resistance to the user.

Therefore, a method has been proposed in which encryption technology is applied to conventional password authentication to enhance security. This is to encrypt the whole session including the user identifier and the password with common key cryptography. However, there remains a problem of how to manage the encryption key used at that time.

For example, consider a case where a user temporarily belongs to another organization (research union, etc.) and accesses the LAN of the original organization (original affiliation) via WAN. In this case, since the user uses the network application by using the computer of another organization, it is dangerous to store the important information such as the encryption key in the file of the computer. This is because another person can impersonate the administrator of the computer and forcefully read the contents of the file.

Generally, there are many clients for one server. In other words, many users access via WAN. If a common encryption key is given to all of these users, if someone leaks the encryption key, the effect will be on everyone. Further, even one of them must redistribute a new encryption key to all users of the server if the user qualification is lost. It is a heavy burden on the server to create and manage a different encryption key for each user. Also, users may access many servers. Having a private encryption key for each server makes it even more difficult for users to manage.

On the other hand, as an illegal act on the network, there is an "attack" that interferes with the network in addition to the "tapping" of stealing information. Among the attacks, there is a retransmission attack. This means that even if the communication text is encrypted, the session is taken out by eavesdropping, stored as it is, and sent to the server again as it is, impersonating the client and causing confusion in the server. It is also necessary to take countermeasures against this retransmission attack.

[0013]

The present invention is compatible with conventional password authentication methods in network applications, makes encryption key management in the client safe and easy, and makes it easy to add and cancel individual users. Yes, it is intended as a security measure to nullify the retransmission attack.

[0014]

FIG. 1 shows the principle of the present invention. Invention of Claim 1: User identifier ID and password PW
Is transmitted from the client C to the server S, and the server S refers to the file and confirms that the corresponding user identifier ID and password PW are present, thereby performing the user authentication. Encrypts the user identifier ID and the password PW with the public key Kp of the public key system server S and transmits them to the server S, and the server S decrypts them with its own secret key Ks. The identifier ID 'and the password PW' are taken out.

Invention of Claim 2: In the invention of Claim 1, the server S sends a random number R to the client C at the beginning of authentication, and the client C includes the user identifier ID, the password PW, and the received random number R. And transmits it to the server S by encrypting it with the public key Kp, and the server S confirms by comparison that the decrypted random number R ′ is the same as the previously transmitted random number R.

Invention of claim 3: In the network application system, the client C generates a session encryption key SK of a common key method, and according to the invention of claim 1 or claim 2, the client identifier C and the password PW are used together with the above. The session encryption key SK is included in the encrypted public key Kp for transmission, and both the server S and the client C encrypt the entire session after the authentication based on the session encryption key SK.

Invention of Claim 4: In the network application client, the user authentication method described in Claim 1 or 2 is used. Alternatively, the encrypted communication method according to claim 3 is used.

Invention of claim 5: In the network application server, the user authentication method described in claim 1 or 2 is used, or the encrypted communication method described in claim 3 is used.

[0019]

[Action]

Invention of Claim 1: Client C uses user identifier I
D and the password PW are encrypted with the public key Kp of the public key server S and transmitted to the server S. Therefore, the password PW, which is the secret information, does not appear on the communication path as it is.

The server S decrypts it with its own secret key Ks to obtain the user identifier ID 'and the password P.
Take out W '. If these user identifier ID 'and password PW' are correctly encrypted / decrypted, the user identifier I before being encrypted by the client C
It should match D and password PW. Therefore, for the user authentication, it is sufficient to check whether or not the user identifier ID and the password PW corresponding to the file exist as in the conventional case.

Invention of Claim 2: At the beginning of authentication, the server S
The random number R sent by is encrypted with the public key Kp and returns to the server S. By confirming that the decrypted random number R ′ is the same as the previously transmitted random number R, user authentication can be ensured. That is, even if a replay attack is performed by using wiretapping using the previous contents, the random number R is different and is invalid.

Invention of Claim 3: The client C generates a session encryption key SK of the common key system based on a random number or the like, and according to the invention of Claim 1 or 2, the public key together with the user identifier ID and the password PW. Encrypt with Kp and send. Both the client C and the server S encrypt the entire session after the authentication based on the session encryption key SK. Thereby, the communication text is encrypted. Moreover, the session encryption key SK is only for the session, and both the client C and the server S
No need to save and manage.

[0023]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 2 shows a configuration diagram of a server and a client according to the embodiment of the present invention.

The application system is executed by the client and hardware in which a terminal (workstation, personal computer, etc.) that serves as a client and a computer (general-purpose machine, workstation, personal computer, etc.) that serves as a server are connected by a network. And a server program SP executed by the server. There may be a plurality of server programs SP (and client programs CP), and each may be on different hardware (computer) or the same hardware. Below, the hardware and the program are integrated into one client C and server S for one application.
Call. Each user has a user identifier ID and a password PW.

The client C includes a communication processing unit 14 for controlling communication between networks, a user interface (input unit) 18, authentication information (user identifier ID and password PW).
Public key encryption processing unit 11 for encrypting other), server S
From the public key storage unit 12 that holds the retrieved public key Kp and the server S that manages the public key Kp corresponding to the private key Ks of FIG. A random number storage unit 13 that stores the received random number R, a service execution unit (not shown) that executes the requested service, a session key generation unit 16 that generates a session key SK, and a session key storage that holds the session key SK. It comprises a unit 17, a common key system encryption / decryption processing unit 15 for encrypting / decrypting a session, and a general control unit (not shown) for controlling the whole.

The server S transmits to the communication processing unit 24 for controlling the communication between networks, the public key system decryption processing unit 21 for decrypting the authentication information, the secret key storage unit 22 for holding the secret key Ks, and the client C. Random number generator 2 for generating random number R
6, a random number storage unit 23 for holding the random number R, a random number collation unit 29 for collating the random number R with the received and decrypted random number R ′, user identifiers ID of all users, and password PW are managed.
ID / PW file 30, password verification unit 28, service execution unit (not shown) that executes the requested service,
Common key encryption that encrypts / decrypts sessions
The decryption processing unit 25 includes an overall control unit (not shown) that controls the whole.

A known method may be used as the encryption method. For example, public key cryptography RSA is used to encrypt the authentication information, and common key cryptography DE is used to encrypt the session.
The CFB64 operation mode of S is used.

In the following, according to the protocol explanatory diagram of FIG.
The operation procedure will be described. Step 1: Client C sends an authentication request to server S. Step 2: The server S generates a random number R and sends it back to the client C.

Step 3: The client C randomly generates a session key SK, encrypts it with the public key Kp of the server S together with the ID, PW, and the random number R sent from the server S, and sends it to the server S.

Step 4: The server S decrypts the received encrypted data with its own secret key Ks to obtain the user identifier I.
D'and password PW 'are taken out. Step 5: The server S confirms whether R ′ is the same as R transmitted in step 2, confirms whether ID ′ and PW ′ are registered in the internal database, and notifies the result to the client C. .

The steps up to this point are the authentication steps, and if there is no abnormality in step 5, the session is entered. Step 6: The subsequent sessions are wholly encrypted with the session key SK, and the client C and the server S both send the information encrypted with the session key SK, and decrypt the received information with the session key SK.

Here, the interface viewed from the user is only the input of the ID and PW, which is no different from the conventional password authentication. Also, application changes can be small.

In the present embodiment, the secret information PW is stored only by the user in addition to the server S and is encrypted on the communication path. The secret key of the server S is only possessed by the server S and does not appear on the communication path. The server S may be used as the client C or a computer, monitoring device, or the like that is in the middle of the process.
Only the public key of (which is not secret information) remains, and no secret information remains. The addition or cancellation of users may be performed by changing the database (file) of the server S, and other users will not be affected. The user authentication information (including the secret information PW) stored in the file of the server S may be stolen, but this is separately encrypted and filed, and decrypted and used at the time of authentication. You can do it.

First (step 2), the random number R is transmitted from the server S to the client C. Since this value is determined by the server S and a different value is used every time, even a third party flows to the network. Even if a so-called retransmission attack is attempted in which the encrypted authentication information is eavesdropped and recorded and then the client C is spoofed and sent to the server S, the probability of success can be negligibly small.

Since the session key SK arbitrarily generated by the client C at the time of authentication is passed to the server S and the subsequent session is encrypted by the common key method for communication, eavesdropping and tampering can be prevented. The session key SK
Is different each time, and when it is passed to the server S, it is encrypted with the public key Kp of the server S, so the session key SK is very likely to be decrypted unless the secret key Ks of the server S is present. Few.

[0036]

As described above, according to the present invention,
The interface seen from the user only inputs the user identifier ID and the password PW, and is the same as the conventional password authentication. Also, application changes can be small.

In the present invention, the secret information PW is stored only by the user in addition to the server S, and is encrypted on the communication path. The secret key Ks of the server S is only possessed by the server S and does not appear in the communication path. The public key Kp (this is not secret information) of the server S only remains in the client C or a computer, a monitoring device, etc. that enters in the middle of the network, but no secret information remains. Therefore, management of the encryption key is easy and safe.

The addition or cancellation of the user may be performed by changing the database of the server S, as in the conventional case, without affecting other users. In the second aspect of the present invention, first (step 2 of the embodiment), the server S transmits the random number R to the client C. Since this value is determined by the server S and a different value is used every time, even if a third party eavesdrops and records the encrypted authentication information flowing on the network, it impersonates the client later and sends it to the server. Even if a so-called retransmission attack is attempted, the probability of success can be made small enough to be ignored.

In the third aspect of the present invention, the session key SK arbitrarily generated by the client C at the time of authentication is passed to the server, and the entire subsequent session is encrypted for communication, so that eavesdropping and nuisance can be prevented. . The session key SK is different every time, and when it is passed to the server S, it is encrypted with the public key Kp of the server S, so the session key SK can be decrypted unless there is the secret key Ks of the server S. Very unlikely.

[Brief description of drawings]

[Figure 1] Principle diagram

FIG. 2 is a configuration diagram of an embodiment.

FIG. 3 is an explanatory diagram of a protocol according to an embodiment.

[Explanation of symbols]

ID, ID 'User identifier PW, PW' Password R, R'Random number Kp Public key Ks Private key SK Session key C Client S server 11 Public key encryption processing unit 21 Public key decryption processing unit 12 Public key storage Part 22 Private key storage unit 13 Random number storage unit 23 Random number storage unit 14 Communication processing unit 24 Communication processing unit 15 Common key method encryption / decryption processing unit 25 Common key method encryption / decryption processing unit 16 Session key generation unit 26 Random number generator 17 Session key storage 27 Session key storage 18 User interface 28 Password collation 29 Random collation 30 ID / PW file

Claims (5)

[Claims] 1. A user identifier (ID) and password (P
W) is transmitted from the client (C) to the server (S), and the server (S) refers to the file and confirms that the corresponding user identifier (ID) and password (PW) exist. In a network application system for performing user authentication, a client (C) encrypts a user identifier (ID) and a password (PW) with a public key (Kp) of a public key system server (S), and then the server (S). ), And the server (S) decrypts it with its own secret key (Ks) to retrieve the user identifier (ID ') and password (PW'). Authentication method. 2. The server (S) is a random number (R) at the beginning of the authentication.
To the client (C), the client (C) encrypts it with the public key (Kp) including the user identifier (ID), the password (PW) and the received random number (R), and sends it to the server (S). The network user authentication method according to claim 1, wherein the server (S) confirms that the decrypted random number (R ') is the same as the previously transmitted random number (R). . 3. The network user authentication method according to claim 1 or 2, wherein the client (C) generates a session encryption key (SK) of a common key system, and a user identifier (ID) and a password ( PW), the session encryption key (SK) is included and encrypted by the public key (Kp) and transmitted. The server (S) and the client (C) both send the entire session after the authentication to the session encryption key (SK). ), An encrypted communication method characterized by performing encryption based on. 4. A network application client using the user authentication method according to claim 1 or 2, or a network application client using the encrypted communication method according to claim 3. 5. A network application server using the user authentication method according to claim 1 or 2, or a network application server using the encrypted communication method according to claim 3.