Verification device

Abstract

The present invention implements one-time password verification at low cost. The verification device of the present invention comprises: a clock unit that uses a built-in clock to record the time; and an authentication calculation unit having a secondary password FIFO that can store (N+1) values ​​written therein, from the last value written therein to the value written therein N times (N is a natural number) previously. Based on the time indicated by the clock, a first verification one-time password is generated at a predetermined first time interval for a time point having a predetermined time relationship with the current time, and the generated first verification one-time password is written into the secondary password FIFO. Authentication is determined to be successful if the authentication target one-time password received in response to a first authentication request matches any one of the (N+1) first verification one-time passwords in the secondary password FIFO.

Description

Technical Field

[0001] The present invention relates to an authentication technology for determining whether a subject has the authority to access a target object. Background Art

[0002] Conventionally, user authentication used in online banking and the like was performed based on the premise that a legitimate user possessed a physical device called a hardware token, and that the person accessing the system using the hardware token was the legitimate user.

[0003] Figure 1 This is a conceptual diagram showing the user authentication procedure for online banking using a hardware token.

[0004] A hardware token 100 is issued to a user 102 who has an account on an online bank managed by an online banking server 103. Hardware token 100 contains a clock 101 precisely synchronized with a clock 104 on the online banking server 103. Clock 101 within hardware token 100 cannot be easily set by anyone other than the manufacturer. Furthermore, hardware token 100 stores a passcode 110, a symmetric key unique to each user and shared with the online banking server 103. Due to the tamper-resistant nature of hardware token 100, passcode 110 cannot be deciphered even if hardware token 100 is disassembled.

[0005] When user 102 attempts to log in to online banking server 103, he or she enters a one-time password (OTP) 111 displayed on hardware token 100 as OTP 112 from a password input screen (not shown), thereby disclosing the OTP 112 to online banking server 103. Online banking server 103 uses passcode 110 shared with hardware token 100 to determine whether OTP 112 disclosed by user 102 is legitimate.

[0006] The one-time password is calculated using a one-way hash function using the same algorithm in both the hardware token 100 and the online banking server 103 , with the current time at each specified time step given by the clocks 101 and 104 and the passcode 110 as input.

[0007] Therefore, only when the two clocks 101 and 104 are synchronized, the OTP 111 displayed on the hardware token 100 will be consistent with the one-time password associated with the user 102 calculated within the online banking server 103. By confirming their consistency, user authentication is performed.

[0008] Furthermore, since OTP 111 is calculated using the current time of clock 101, it changes at predetermined time intervals. Therefore, even if a malicious third party eavesdrops on the online authentication signal and illegally obtains the one-time password, the password will become invalid after the predetermined time has passed. A replay attack, in which a malicious third party impersonates the user and discloses the eavesdropped one-time password 111 to the online banking server 103 at a different time than the time of eavesdropping, will prevent successful authentication. A replay attack is an attack in which an eavesdropper directly records past information or sequences circulating in the channel and then directly provides this information or sequence to the target, thereby deceiving the target.

[0009] This type of one-time password is called a time-synchronized one-time password. One of the core components of time-synchronized one-time password technology is a method for aligning the time of the clock 101 of the hardware token 100 with the time of the clock 104 of the online banking server 103. Various technologies for aligning the time of these two clocks 101 and 104 have been designed and disclosed (for example, see Patent Document 1). Patent Document 1 discloses a technology that includes a radio-wave clock receiver within an authentication terminal (equivalent to the hardware token 101 described above) to receive a standard radio wave, thereby accurately synchronizing the terminal's internal clock with the server's internal clock.

[0010] Furthermore, Non-Patent Document 1 discloses a technique of allowing a certain time difference between the clocks of a terminal and a server, and absorbing the difference on the server side.

[0011] Prior art literature

[0012] Patent Literature

[0013] Patent Document 1: Japanese Patent Application Laid-Open No. 2005-50292

[0014] Patent Document 2: Japanese Patent No. 6078686

[0015] Non-patent literature

[0016] Non-Patent Document 1: ITmedia Co., Ltd., "Keywords for Understanding Technology and Trends: One-Time Passwords (3 / 4)", [Online], July 6, 2006, ITmedia Enterprise (ITmedia is a registered trademark), [retrieved February 3, 2020], URL:

[0017] <https: / / www.itmedia.co.jp / enterprise / articles / 0607 / 06 / news011_3.html> Summary of the Invention

[0018] Problems to be solved by the invention

[0019] In the technology disclosed in Patent Document 1, the cost of the authentication terminal increases by the amount of the receiving unit for receiving the standard radio wave. In addition, the location where the terminal can be installed is limited to a location where the standard radio wave can be received.

[0020] In contrast, the technology of Non-Patent Document 1 allows a certain time difference between the clocks of the terminal and the server, and therefore does not require a receiving unit for receiving standard radio waves to be provided in the terminal.

[0021] Figure 2 This is a diagram for summarizing the technology of Non-Patent Document 1, in which the technology disclosed in Non-Patent Document 1 is converted into a flowchart.

[0022] refer to Figure 2 , user authentication starts from step S200. In the determination step S201, the server determines whether there is an authentication request from the user's terminal. If there is an authentication request, the process proceeds to step S202, otherwise it proceeds to step S207 and ends the procedure.

[0023] In step S202, the server is able to identify the user who has requested authentication, so it is able to identify the characteristics of the hardware token of the matching user pre-stored in the server, namely the pass code and the time deviation attribute of the hardware token relative to the server clock (information on how much slower / faster the hardware token is relative to the server clock).

[0024] Therefore, the current time inside the hardware token can be inferred based on this information, so that a password group can be generated at one time as needed for a total of 5 consecutive moments, namely the current time identified by the hardware token and the time with a 1-minute step offset within ±2 minutes.

[0025] In step S203, the server determines whether there is a password in the five-point password group that matches the password received from the terminal together with the authentication request. If there is no matching password, the server declares "Authentication NG" in step S206 and ends the process (step S207).

[0026] If the password matches, the server proceeds to step S204 and updates the hardware token's clock time offset (time offset attribute) based on the offset corresponding to the password. This is equivalent to learning the hardware token's clock time offset attribute within a range of 0±2, based on the time step of the password change.

[0027] Then, the server declares "Authentication OK" in step S205 and ends the processing in step S207.

[0028] In the techniques of Patent Document 1 and Non-Patent Document 1, one-time password verification is performed on a server with relatively high hardware processing capabilities. However, due to cost and other factors, there are cases where one-time password verification must be performed on a device with limited hardware processing capabilities, as the target of one-time password authentication.

[0029] For example, consider a system that utilizes one-time password authentication technology to manage the onboard ECU (Electronic Control Unit) installed in each vehicle, thereby performing one-time password verification within the onboard ECU. Patent Document 2 discloses a system that performs one-time password verification within the onboard ECU, which is the target object accessed by the user.

[0030] Figure 3 This is a conceptual diagram of a system that performs one-time password verification on the object side for the subject to access. Figure 3 In the system, the OTP 311 issued by the user authentication & OTP issuing server 300 is disclosed to the locking device 303 as the OTP 312 via the user 302, and the locking device 303 performs the one-time password verification process.

[0031] exist Figure 3 In the system, a locking device 303 is installed inside with a device having the equivalent Figure 1 The OTP verification chip 400 , which functions as a hardware token, is used for verifying the one-time password in the locking device 303 .

[0032] The clock 304 within the OTP verification chip 400 is synchronized with the clock 301 within the user authentication and OTP issuance server 300. Furthermore, there are multiple locking devices 303, and each of these symmetric keys, or passcodes 310, is stored within the OTP verification chip 400 in a tamper-resistant format. Furthermore, the user authentication and OTP issuance server 300 manages a passcode 310, identical to the passcode stored in the OTP verification chip 400, associated with each locking device 303.

[0033] Therefore, once the locking device 303 is identified, the user authentication & OTP issuing server 300 can easily issue the one-time password 311 corresponding to the locking device 303. Furthermore, the OTP verification chip 400 installed in the locking device 303 has the function of verifying whether the one-time password 312 disclosed by the user 302 is a password legally issued to the user.

[0034] User 302 can obtain a one-time password 311 through user authentication 313 performed by the user authentication & OTP issuance server 300. For example, this can be done using ID and password authentication or biometric authentication. This prevents malicious third parties from interfering with the issuance of one-time passwords 311 and 312. Furthermore, issued one-time passwords 311 and 312 expire after a specified time. This makes the one-time password authentication performed by this system robust against replay attacks by malicious third parties eavesdropping.

[0035] Thus, according to Patent Document 2 and Figure 3 The system can use one-time password authentication in the management of vehicle ECU.

[0036] However, Patent Document 2 does not disclose the appropriate structure and operation principle of the OTP verification chip, and it is necessary to seek implementation of the structure and operation suitable for the OTP verification chip.

[0037] exist Figure 3 In this system, the OTP verification chip 400 is housed within the locking device 303, which may not maintain an environment capable of receiving standard radio waves. Therefore, it is not possible to provide a receiver within the locking device 303 to receive standard radio waves and provide the OTP verification chip 400 with time information. Therefore, it is considered to incorporate an internal clock within the locking device 303 that autonomously calculates the time. For example, consider housing the OTP verification chip 400 with an internal clock that can be set from the mother chip and then autonomously calculates the time after the setting. In this case, implementing the function of setting the time from the mother chip requires security considerations to prevent replay attacks.

[0038] In addition, Figure 1 In the case of online banking as shown, the flow of one-time password information is from the small device (hardware token) to the server (online banking server). Figure 3 In the system, the flow of one-time password information is from the server (user authentication & OTP issuing server) to the small device (OTP verification chip) in the opposite direction.

[0039] Therefore, in order to allow a certain degree of time deviation between the server's clock and the clock inside the OTP verification chip and synchronize the time of the server and the device through the method disclosed in non-patent document 1, it is necessary to prepare multiple one-time passwords and update the clock time on the OTP verification chip side according to the time deviation of the consistent one-time passwords.

[0040] However, the OTP verification chip is also limited in computing power to keep costs low, making it difficult to generate multiple one-time passwords on demand as the server in the technology of Non-Patent Document 1 does.

[0041] If this technology is used for an OTP verification chip, depending on the computing power of the chip, it may take a long time to generate the password group, or the password may have been changed by the time the password group is generated.

[0042] An object of the present disclosure is to provide a technology for implementing one-time password verification with a device of low computing power, that is, at low cost.

[0043] Technical means to solve the problem

[0044] A verification device in one form disclosed herein comprises: a clock unit, which calculates the time using a built-in clock; and an authentication calculation unit, which has a first storage area capable of continuously storing (N+1) numerical values ​​from the last written value to the value written N (N is a natural number) times before. According to the time indicated by the clock, a first one-time verification password is generated in a time synchronization manner at a specified first time interval for a time point in a specified time relationship with the current time and written into the first storage area. The authentication is determined to be successful when the one-time verification password of the authentication object received through the first authentication request is consistent with any one of the (N+1) first one-time verification passwords in the first storage area.

[0045] Effects of the Invention

[0046] According to one aspect of the present disclosure, authentication that tolerates clock deviation within a certain period of time can be achieved while reducing the processing load for generating a one-time password for verification, thereby enabling one-time password verification at low cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a conceptual diagram showing the user authentication procedure for online banking using a hardware token.

[0048] Figure 2 This is a diagram for summarizing the technology of Non-Patent Document 1.

[0049] Figure 3 This is a conceptual diagram of a system that verifies a one-time password on the side of an object accessed by a subject.

[0050] Figure 4 It is a block diagram showing the structure of the verification device of this embodiment.

[0051] Figure 5 for Figure 4The data flow diagram inside the OTP verification chip is shown.

[0052] Figure 6 To express Figure 4 The flowchart of the process of generating the secondary password and primary password for verification in the OTP verification chip is shown.

[0053] Figure 7 To express Figure 4 Flowchart of the secondary time authentication process in the OTP verification chip shown.

[0054] Figure 8 To express Figure 4 The flowchart of the main time authentication process in the OTP verification chip is shown.

[0055] Figure 9 To conceptually represent Figure 4 The diagram shown is of the timing adjustment in the OTP check chip.

[0056] Figure 10 To express Figure 4 The diagram shows the flow of a replay attack in the OTP verification chip 400.

[0057] Figure 11 To express Figure 4 The flowchart shown is a timing process in the OTP verification chip 400 that incorporates constraints for counteracting replay attacks. DETAILED DESCRIPTION

[0058] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. It should be noted that the embodiments described below do not limit the invention of the claims, and that not all elements and combinations thereof described in the embodiments are necessarily essential to the technical means of the invention.

[0059] In the drawings for explaining the embodiment, the same reference numerals are given to portions having the same functions, and their repeated descriptions are omitted.

[0060] In addition, in the following description, as an example of information, expressions such as "xxx register" and "xxx memory" are sometimes used to refer to information storage areas. However, the attributes related to the characteristics of the storage area, such as the method of specifying the location, the advantages and disadvantages related to the access speed, volatility or non-volatility with respect to power operation or refresh action, or read-writable or read-only, are not classified by these terms. In addition, the data structure of the information is arbitrary. That is, to indicate that the information does not depend on the structure of the storage area, "xxx register contents" can be referred to as "xxx memory contents." Furthermore, "xxx memory contents" is sometimes simply referred to as "xxx contents." Furthermore, in the following description, the structure of each information is an example, and the information can be stored separately or in combination.

[0061] Figure 4 It is a block diagram showing the structure of the verification device of this embodiment.

[0062] In this embodiment, if Figure 4 As shown, the interior of the locking device 303 is composed of a main CPU 410 and an OTP verification chip 400 connected to the main CPU via a signal.

[0063] Conventionally, security-related calculations were centralized in a separate chip from the main chip. This was to prevent the leakage of information such as private keys (information referred to in public key cryptography) and symmetric keys (information referred to in symmetric key cryptography) stored in the security chip, which should be kept secret.

[0064] By consolidating security-related calculations into a separate chip from the main chip, the memory space can be completely obscured from the main chip, preventing the leakage of hidden information. Furthermore, from a tamper-resistant perspective, it is possible to employ silicon processes (floating capacitors) for the security chip alone, such as by opening the chip after resin molding to eliminate the loss of information.

[0065] The reason for setting the main CPU 410 and the OTP verification chip 400 as different entities is, as mentioned above, to ensure the tamper-proofness of the OTP verification chip 400 itself and to prevent the main CPU 410 from reading the symmetric key and private key (here is the private key) hidden in the OTP verification chip 400. Figure 3 Information of the pass code 310 for knowledge sharing with the user authentication & OTP issuing server 300).

[0066] As an activity connected to the locking device 303 from the outside, like Figure 4As shown, the following modes are considered: one is wireless connection via wireless receiver 420, and the other is wired connection via wired connection tool 430. When these activities are combined with locking device 303, it is necessary to perform authentication to determine whether the activities are legal.

[0067] This authentication action is performed using the one-time password ( Figure 3 The verification is performed by the OTP 312), and the main body performing the verification is the OTP verification chip 400.

[0068] The one-time password is sent to the OTP verification chip 400 via the main CPU 410 via the communication line 411. The verification result is sent back to the main CPU 410 from the OTP verification chip 400 via the communication line 412. The main CPU 410 determines the next action to be taken based on the result.

[0069] Detailed information on the data carried on the communication lines connecting the main CPU 410 and the OTP verification chip 400 includes: communication line 411 carries commands from the main CPU to the OTP verification chip, timing data for the OTP verification chip's internal clock (described later), or externally authenticated OTP data. Furthermore, communication line 412 carries authentication results or various status report values ​​sent back from the OTP verification chip to the main CPU.

[0070] These channels 411 and 412 can be serial transmission channels or parallel transmission channels such as buses. Furthermore, they can be networks controlled by higher-level protocols other than serial / parallel. They are handled by the I / O unit 402 within the OTP check chip 400.

[0071] The OTP verification chip 400 is internally composed of a control unit 401 , the aforementioned I / O unit 402 , a clock unit 403 , an authentication calculation unit 405 , a non-volatile memory 406 , and a passcode storage 407 .

[0072] The control unit 401 is a part that controls the overall operation of the OTP verification chip 400 and can be implemented through a PLC (Programmable Logic Controller) or through software or firmware managed by a normal CPU.

[0073] The clock unit 403 keeps time using a built-in clock. This clock is initially set to an initial value by the main CPU 410 via a channel 411 and then continues to keep time autonomously. A backup power supply ensures that even if the entire locking device 303 is powered off, only the clock unit 403 continues to operate. Furthermore, an external clock crystal oscillator 404 is connected.

[0074] When the backup power supply is cut off and the clock stops, or when the clock is initialized due to a chip reset operation, this state is reported to the main CPU 410 through the channel 412 described above.

[0075] The authentication calculation unit 405 internally stores a comparison reference value for one-time password authentication. These storage areas are the secondary password FIFO 510 (a first storage area) and the primary password memory 520 (a second storage area), described later. This information cannot be read from outside the OTP verification chip 400. These values ​​are used to compare the externally transmitted password against each other and determine whether the authentication is OK or NG.

[0076] Non-volatile memory 406 stores the most recent time of successful authentication to prevent replay attacks caused by time changes, as described later. This stored data is not erased even when all power sources, including the aforementioned clock backup power supply, are turned off, or even when the chip is reset. Only the value from authentication calculation unit 405 can be overwritten.

[0077] The passcode storage (symmetric key storage unit) 407 is the part that stores the symmetric key for knowledge sharing with the server, that is, the passcode 310, ensuring a high degree of tamper resistance and protecting the content from being read out from outside the chip. Of course, the main CPU 410 cannot read the content.

[0078] Figure 5 for Figure 4 The data flow diagram inside the OTP verification chip 400 is shown to outline the password verification operation.

[0079] The clock 501 is housed in Figure 4 The clock in the clock unit 403 shown must be in a format that is strictly consistent with the clock on the user authentication & OTP issuing server 300. As long as they are consistent, any time format can be used, such as Japanese Standard Time (JST), Coordinated Universal Time (UTC), GPS (Global Positioning System) time, or UNIX time (UNIX is a registered trademark).

[0080] In process 502, the clock contents are quantized. Quantization involves dividing the clock contents by the time interval between one-time password changes and discarding the remainder to convert the result into a natural number. For example, if the change interval is [minutes], this is equivalent to dividing the seconds representation of clock 501 by 60 and discarding the remainder. This quantized moment is referred to herein as the secondary moment.

[0081] That is, the so-called secondary time is the time when the value of the one-time password is changed.

[0082] When the current minor time increases by 1 compared to the previous minor time, a series of sequences starting from process 500 is started.

[0083] In process 503, a speed-up offset (here +2) is added to the secondary time, and combined with the pass code 504 stored in the pass code storage 407 to calculate a hash value in process 505. This becomes a one-time password at a time that is faster than the current secondary time by the offset amount.

[0084] The hash value is calculated by calling a hash function (not shown) stored in the authentication calculation unit 405. Here, the so-called hash function (hereinafter referred to as hash() in the form of a mathematical function) is a cryptographic function that compresses data of any length into data of a fixed length (approximately 128 to 512 bits) and has the following properties (1) to (3).

[0085] (1) One-way: It is difficult to find the input value from the output value. That is, given a hash value h, it must be difficult to find any m that satisfies h = hash (m).

[0086] (2) Second preimage computation difficulty: It is difficult to find another input whose hash value is the same as a certain input value. That is, when m is given, it must be difficult to find m' such that hash(m) = hash(m') (where m≠m').

[0087] (3) Collision difficulty: It is difficult to find two input values ​​that generate the same output value. In other words, it must be difficult to find m and m' that satisfy hash(m) = hash(m') (where m≠m').

[0088] That is, a cryptographic function in which the output can be easily calculated with exact reproducibility given an input, but it is difficult (and extremely time-consuming) to reverse-calculate the input from the output.

[0089] Therefore, even if the one-time password circulated between the external activity and the locking device 303 is eavesdropped and recorded, it is difficult to infer the passcode 504 based on this information.

[0090] The one-time password calculated by the process 505 is inserted from the right into the secondary password FIFO 510 as the first verification one-time password. At this time, the oldest one-time password, that is, the leftmost value, is squeezed out of the FIFO and discarded.

[0091] The secondary password FIFO is structured with a secondary time step size of -2 from left to right, then 0, and then +2, for a total of five points. This means that the authentication range is sufficient to accommodate time synchronization differences between the server and the OTP verification chip, a total of five "secondary times," and to achieve password authentication.

[0092] Here, Figure 5 Each password value is expressed in 6-bit base 62 (a system representing characters 0-9, A-Z, and a-z). This corresponds to approximately 36 bits in binary, which is smaller than the output of the hash function mentioned above (which has a fixed length of approximately 128-512 bits). The password is constructed using a subset of the hash function output values. The password size is determined by balancing the probability of the same password being generated within a certain period (the risk of being cracked) with the simplicity of storage and verification. By assessing the acceptable risk, the password size can be arbitrarily determined during deployment.

[0093] Looking back at the above data flow, the hash function is only started once at the update time of the minor moment, so it can be executed even in a chip with insufficient computing power, thereby keeping the cost of the OTP verification chip itself low.

[0094] Furthermore, the OTP verification chip 400 calculates the one-time password for the fastest time within the authentication allowable range (i.e., the rightmost end of the secondary password FIFO 510) when the secondary time is updated. This has the following effect: even if maintenance of the secondary password FIFO is interrupted due to the authentication request processing described later, only the generation of the rightmost end of the authentication allowable range is delayed, thereby minimizing the risk of authentication failure due to processing delays by the OTP verification chip 400.

[0095] Here, when the first authentication request, namely the secondary-time authentication request 511, arrives, the comparator 512 searches the secondary password FIFO 510 to see if the password (the one-time password to be authenticated) included in the secondary-time authentication request 511 exists. If the search results in a matching password, the authentication is deemed OK in the determination process 513. If not, the authentication is deemed NG.

[0096] Thus, the OTP verification chip 400 includes a clock unit 403 that uses a built-in clock to keep time, and an authentication calculation unit 405. The authentication calculation unit 405 includes a secondary password FIFO 510 that can store (N+1) values, from the last value written to it until the value written N times (N is a natural number) previously. Based on the time indicated by the clock and the time interval at the secondary time, which serves as a predetermined first time interval, a first verification one-time password is generated using a time synchronization method for a time point with a predetermined temporal relationship to the current time and written into the secondary password FIFO 510. Authentication is determined to be successful if the authentication target one-time password received in response to the first authentication request matches any of the (N+1) first verification one-time passwords in the secondary password FIFO 510. By storing the (N+1) first verification one-time passwords generated at different times and verifying them against the authentication target one-time password, authentication can be achieved that tolerates clock deviations within a certain period while reducing the processing load for generating the verification one-time passwords, thereby enabling low-cost one-time password verification.

[0097] If the password included in the secondary time authentication request 511 exists in the secondary password FIFO 510, the server-side clock is known to be ahead (or behind) the clock of the OTP verification chip 400 by a certain amount, measured in units of the secondary time width (quantum time). This information is then fed back to the clock 501, and time correction processing 514 is performed on the clock 501. Specifically, the authentication calculation unit 405 corrects the clock time based on the time corresponding to the verification one-time password that matches the one-time password being authenticated. By correcting the clock time based on the time corresponding to the verification one-time password that matches the one-time password being authenticated, it is possible to prevent time synchronization failures with the device that generated the one-time password being authenticated due to clock accuracy.

[0098] If Figure 5 Using the example of , the contents of time adjustment processing 514 are shown. Since the password matches the password with an offset of +1 in the secondary password FIFO 510, the server's internal clock is running faster than the contents of clock 501 by +1 secondary time width (quantum time). Therefore, clock 501 is set forward by +1 secondary time width (quantum time) to achieve synchronization with the server's internal clock.

[0099] If authentication is successful, the time 501 (more precisely, the time after time adjustment 514) is saved to the "Latest Verification Success Time" register 530 via signal gate 526 driven by OR gate 525. The "Latest Verification Success Time" register 530 is stored in non-volatile memory and retains its value even if power is turned off or the OTP verification chip itself is reset. During initialization, the register contents are set to the most recent value represented by clock 501 and are updated to a future value each time authentication is successful.

[0100] The contents of this register (and the accompanying capture and reference actions) are described later.

[0101] In the comparison process 507 , the secondary time (output of the process 503 ) of the added degree of the speed-up offset is compared to see whether it matches the primary time 506 .

[0102] The so-called major time is a password update cycle with a smaller step size than the minor time. In other words, the major time interval (the second time interval) is larger than the minor time interval (the first time interval). For example, if the minor time is measured in minutes, the major time can be measured in days. In this case, the major time 506 is the previous major time plus the step size of 24 * 60 = 1440 minor times.

[0103] If a match is determined in the determination process 508 , the hash function output 505 at this time is stored in the main password memory 520 via the signal gate 509 as a one-time password for the [day] period.

[0104] Here, when the second authentication request, namely the primary time authentication request 521, arrives, the comparator 522 compares the password included in the primary time authentication request 521 with the contents of the primary password memory 520 to see if they match. If the passwords match, the authentication is deemed OK in the determination process 523. If not, the authentication is deemed NG.

[0105] If the authentication is OK, the primary password memory 520 is cleared using the feedback signal 524. Thus, primary authentication is prohibited until the next primary time period arrives and the content of the primary password memory 520 is updated.

[0106] If the primary time authentication is successful, the time 501 is stored in the "Latest Verification Success Time" register 530 via a signal gate 526 driven by an OR gate 525, similar to the secondary time authentication. This register is stored in non-volatile memory and is referenced in the processing described below, similar to the primary time authentication.

[0107] The primary time authentication is equivalent to the forced unlocking process when the secondary time authentication fails multiple times due to time deviation. Figure 1 When the time deviation of the hardware token in such online banking becomes serious, the current token is returned to the server-side organization and reissued.

[0108] However, the OTP verification chip 400 embedded in the device cannot adopt such a solution, so it is only a temporary measure in this situation. Due to its huge impact, in order to prevent exhaustive attacks (brute force attacks) as described below, it is necessary to set certain usage regulations based on the reasons for failure of secondary moment authentication for security reasons.

[0109] Will use Figure 5 The operation described above is summarized and an example of realizing it by software is shown in FIG. Figures 6 to 8 Flowchart of the process.

[0110] Figure 6 To express Figure 4 The flowchart of the process of generating the secondary password and the primary password for verification in the OTP verification chip 400 is shown. This process is executed by the authentication calculation unit 405 according to the instruction of the control unit 401.

[0111] Step S600 is initiated by the clock update interrupt of the clock 501. It is assumed that the clock update interrupt is initiated at the minor time interval itself or at an interval that is an integer fraction thereof.

[0112] In step 601, a predetermined register of a clock device is read and the value representing the time is substituted into a variable time.

[0113] In decision step S602, the variable time is divided by min.time, the internal representation of the minor time interval, to determine the remainder. If the remainder is zero, the minor time has arrived, and the process proceeds to step S603. On the other hand, if the remainder is anything other than zero, the minor time has not arrived, and the process proceeds to step S609, terminating the process immediately.

[0114] When the clock update interrupt S600 arrives with a resolution of an integer fraction of the minor time interval, the determination in step S602 serves to divide the time into the minor time intervals.

[0115] Therefore, when the clock update interrupt S600 is originally set to arrive at the minor time interval itself, this determination is unnecessary.

[0116] In the next step S603, the internal representation of the clock is converted to a value A in units of minor time. Here, for example, the minor time is set to [minutes]. In step S604, an offset corresponding to the degree of speed increase (here, +2) is added to the minor time to set the value to B.

[0117] In step S605, this B is combined with the pass code 504 stored in the pass code storage 407 and used as an argument of a one-way hash function (hash()) to obtain a one-time password C with a secondary time + 2 degrees of speed.

[0118] The format of the value B itself, the method of combining the value B and the passcode (using "∪" as the union operator for strings, for example, left union: B∪passcode, or right union: passcode∪B, or internal insertion: passcode part 1∪B∪passcode2, etc.), and the type of one-way hash function (MD4, MD5, SHA, SHA-1, SHA-2, SHA-3, etc.) must be consistent with the server side.

[0119] In addition, the one-time password C can be fine-tuned by adjusting the output of the one-way hash function (fixed length 128 to 512 bits) as described above. Figure 5 Again, this is determined by a balance between the resistance to cryptographic attacks (relating to risk), the amount of memory consumed (relating to cost), and the processing speed (relating to cost and performance).

[0120] In the next step S606, the one-time password C is loaded into the secondary password FIFO. Thus, the oldest data (the slowest password value) is squeezed out of the FIFO and discarded. Figure 5 In the example shown in FIG5 , the latest password value is loaded into the secondary password FIFO 510 from the right, and the leftmost old password is squeezed out from the left and discarded.

[0121] In decision step S607, the secondary time B being processed is checked for a remainder relative to the ratio of the primary time to the secondary time (maj.time / min.time). If the remainder is zero, the primary time has arrived, so the process proceeds to step S608, where the one-time password C is also stored in primary password memory 520. The series of processes ends in step S609. As previously mentioned, the primary time is assumed to be [day].

[0122] If there is a remainder, the main time has not yet arrived, so the process proceeds to step S609 and ends.

[0123] In this way, the password time series values ​​that must be calculated on demand in online banking can be accumulated in the OTP verification chip 400 by generating only one password at each critical moment. As a result, the processing performance of the OTP verification chip itself can be lower, helping to reduce chip costs.

[0124] In this way, by setting the total number of times the secondary password FIFO 501 is written to an odd number N+1 (N is an even number), the authentication calculation unit 405 generates a one-time password for verification and writes it into the secondary password FIFO 501 at a time point that is N / 2 faster than the current time by a specified time unit, thereby allowing deviations in any direction before or after the clock.

[0125] In addition, the authentication calculation unit 405 stores the symmetric key used in generating the one-time password for verification in the pass code vault 407. The authentication calculation unit 405, the control unit 401, the clock unit 403 and the pass code vault 407 are packaged as a whole in the form of an OTP verification chip, so the leakage of symmetric key information can be reduced.

[0126] Figure 7 To express Figure 4 Flowchart of the secondary time authentication process in the OTP verification chip 400 is shown. This process is executed by the authentication calculation unit 405 according to the instruction of the control unit 401.

[0127] This process is activated by a command issued from the main CPU 410 via the communication line 411 .

[0128] If this step S700 is not executed in time, the secondary password itself will change, so it must be executed as quickly as possible. Figure 6 Therefore, the clock update interruption is interrupted when executing step S700. However, the clock update interruption is originally used to process the password at the end of the secondary password FIFO 510 with a large time deviation, so the risk to the authentication calculation process (the risk of authentication failure) is estimated to be small.

[0129] In step S701, an authentication request value x is obtained from the main CPU 410. In the next step S702, it is checked whether this x exists in the secondary cipher FIFO.

[0130] If there is a matching password in step S703, the process proceeds to step S704. If there is no matching password, the secondary authentication failure counter n is incremented in step S709, and the authentication is deemed to be NG (step S710), and the process ends in step S711.

[0131] If there is a matching password, authentication is achieved, so the secondary authentication failure counter is cleared in step S704.

[0132] In the next step S705, the consistency offset ( Figure 5The clock correction value α is calculated by multiplying the quantization time width (clock representation value of the secondary time interval) by the element suffix of the secondary cipher FIFO 510 (-2 to 0 to +2). In the next step S706, the clock is corrected by adding the correction value α.

[0133] In step S707, the clock value at that time (the value corrected in step S706) is stored in the non-volatile memory as the latest successful verification time β. Figure 5 The storage area of ​​530 is equivalent to the "last successful verification time". Figure 4 in the non-volatile memory 406.

[0134] In the next step S708 , the authentication is deemed to be OK, and the process ends in step S711 .

[0135] exist Figure 7 If secondary time authentication repeatedly fails (secondary authentication failure counter n increases monotonically), it is assumed that the difference between the clock 304 inside the OTP verification chip and the clock 301 inside the server has increased. The solution to this problem is primary time authentication as described below.

[0136] Figure 8 To express Figure 4 The flowchart of the main time authentication process in the OTP verification chip 400 is shown. This process is executed by the authentication calculation unit 405 according to the instruction of the control unit 401.

[0137] This process is also started in response to a command issued from the main CPU 410 via the communication line 411 .

[0138] In step S801 , the authentication request value y is obtained from the main CPU 410 .

[0139] In step S802, it is checked whether the secondary authentication failure counter n is greater than a specified value (here 3). If it is less than the specified value, it is not yet time to try primary authentication, so authentication is not allowed in step S814 and the process ends in step S815.

[0140] If the secondary authentication fails repeatedly and exceeds a predetermined value, the primary password memory ( Figure 5 520) is empty.

[0141] The indication that the primary password memory is empty has two meanings: (1) and (2) as shown below. (1) This indicates that no primary password has been generated since the OTP verification chip was activated. (2) This indicates that a primary password has been generated, but the result of the primary password authentication has been cleared due to some circumstances, and the primary password will not be generated until the next primary password is generated.

[0142] In step S803, in either of the states (1) and (2), there is no qualification to attempt primary time authentication, so the process proceeds to step S814 without permitting authentication, and the process ends in step S815.

[0143] If the secondary authentication fails for more than a specified number of times and the primary password memory is not empty, the process proceeds to decision step S804 to check whether the obtained value y is consistent with the content of the primary password memory.

[0144] If the obtained value y is inconsistent with the content of the primary password memory, the authentication fails, so the process proceeds to step S809 to increment the primary authentication failure counter m.

[0145] In the next determination step S810, it is checked whether the number of primary authentication failures is greater than a predetermined number (here, 2). If it is less than the predetermined value, the process proceeds to step S813 and is deemed as authentication NG, and the process ends in step S815.

[0146] If the primary authentication failure counter m is above the specified value, it may be subjected to an exhaustive attack (brute force attack), so the primary password memory content is cleared in step S811 (the judgment step S803 mentioned above has the effect of rejecting the primary authentication before the next primary password is generated).

[0147] In the next step S812, the main authentication failure counter m is cleared to prevent the number of failures from accumulating, and the process proceeds to step S813 where it is considered as authentication NG, and the process ends in step S815.

[0148] If the value y obtained in determination step S804 is consistent with the contents of the primary password memory, the primary password memory is cleared in step 805 (this also has the effect of rejecting primary authentication before the next primary password generation time in determination step S803 described above). This is to eliminate the possibility that the primary password at this time (when authentication is successful at the primary moment) is being eavesdropped on by a malicious third party, thus being vulnerable to a replay attack before the next primary moment arrives (when the primary password is changed).

[0149] In the next step S806, since the authentication is successful, the main authentication failure counter m is cleared to zero. In step S807, the clock value at this time is compared with the Figure 7 The step S707 is similarly stored as the latest successful verification time β in the non-volatile memory. Figure 5 The storage area of ​​530 is equivalent to the "last successful verification time". Figure 4 The non-volatile memory 406, which is also related to Figure 7 same.

[0150] In the next step S808 , the authentication is deemed to be OK, and the process ends in step 815 .

[0151] Thus, in this embodiment, the actions of the OTP verification chip can be translated into a series of software processes and deployed.

[0152] As described above, if the time corresponding to the first verification one-time password written into the secondary password FIFO 510 matches the current time, which is calculated based on a time interval from the primary time that is longer than the time interval from the secondary time, the authentication calculation unit 405 writes the first verification one-time password into the primary password memory 520 as the second verification one-time password. Therefore, the second verification one-time password remains unchanged over a relatively long period, such as the primary time. Furthermore, authentication is determined to be successful if the authentication target one-time password received in the second authentication request matches the second verification one-time password written into the primary password memory 520. This provides a solution for situations where the clock time is significantly out of sync.

[0153] Furthermore, when the authentication calculation unit 405 determines that the authentication is successful because the authentication object one-time password included in the authentication request is consistent with the second verification one-time password written in the main password memory 520, the second verification one-time password written in the main password memory 520 is cleared, and authentication under the second authentication request before the second verification one-time password is next updated is prohibited. Thus, after successful authentication, authentication for relief when a large deviation occurs in the clock time is prohibited, thereby improving security within the relatively long second time interval.

[0154] Furthermore, the authentication calculation unit 405 counts the number of authentication failures in the first authentication request and permits the second authentication request if the number of failures reaches a predetermined number. This allows the second authentication request to be used as a remedy for repeated authentication failures in the first authentication request, and permits authentication in such a case, thereby achieving a security-conscious remedy. Specifically, by concealing the number of first authentication failures leading up to the second authentication request from the outside and providing a delay time (not shown) between the first authentication and the second authentication being permitted, it is possible to detect situations where the first authentication has failed to a certain degree and is being subjected to an external exhaustive attack.

[0155] Furthermore, the authentication calculation unit 405 counts the number of authentication failures in the second authentication request. If the number of failures reaches a predetermined number, authentication in the second authentication request is prohibited until the second verification one-time password written to the primary password memory 520 is updated. This prohibits the second authentication request if authentication in the second authentication request repeatedly fails, thereby improving the security of the second authentication request. This also serves as a function for detecting brute force attacks.

[0156] The hardware token used in online banking is time-adjusted by the issuer before being distributed to the user. However, since the OTP verification chip 400 is not equipped with a standard radio wave receiver, the initial time adjustment must be performed with the help of the main CPU 410.

[0157] Figure 9 To conceptually represent Figure 4 The timing diagram of the OTP verification chip 400 is shown.

[0158] For the main CPU 410 , the source of the time information can be variously assumed according to the application field of the locking device 303 .

[0159] For example, in the case of a time source 901 under a wireless connection, consider time reception based on GPS / GNSS (Global Positioning System / Global Navigation Satellite System) based on satellite waves, connection to an NTP (Network Time Protocol) server based on the Internet, connection to the user's smartphone based on Bluetooth (Bluetooth is a registered trademark), etc.

[0160] In addition, in the case of a wired time source 902, various methods are considered, such as receiving the user's time adjustment information from a clock device in the same system via a LAN (Local Area Network), and receiving information from a charging terminal via a charging cable in the case of an onboard device in an EV (Electric Vehicle).

[0161] The main CPU 410 must obtain the current time from these time sources (901, 902) during initial operation (when the system is initialized for the first time, or when the system is restarted after stopping due to power failure, or when it is reset and restarted due to some reason).

[0162] Afterwards, a time adjustment command must be issued to the OTP verification chip 400 via the channel 411, thereby synchronizing the time of the clock unit 403 with the server time.

[0163] Therefore, with Figure 1Compared to hardware tokens that can only be adjusted at the issuing source, OTP verification chips offer greater flexibility in adjusting the time. This increases the potential for attacks on this part, creating security risks and requiring countermeasures.

[0164] Figure 10 To express the Figure 4 The diagram shows the flow of a replay attack to exploit the risk of timing adjustment in the OTP check chip 400.

[0165] Figure 10 In (a), the "impostor and recording device" 1000 monitors the communication between the legitimate user 302 and the locking device 303, and records the information of the one-time password 1001 and the time information 1002 at that time. It is assumed that the time information 1002 is equal to the clock information 304 inside the OTP verification chip 400.

[0166] Figure 10 In (b), the "impostor and recording device" 1000 attempts to illegally unlock the locking device 303. At the time the "impostor and recording device" 1000 connects, the internal clock of the OTP verification chip 400 has already been updated to 1003. Therefore, the "impostor and recording device" 1000 powers off or resets the locking device 303, forcing the locking device 303 to undergo clock initialization.

[0167] When the locking device 303 requests external clock information, the "impostor and recording device" 1000 will Figure 10 The counterfeit time information 1002 recorded in (a) is given to the locking device in an attempt to tamper with the clock time of the OTP verification chip 400.

[0168] Figure 10 In (c), it is assumed that the clock of the OTP check chip has been tampered with by the above operation to 1002. At this time, the "impostor and recording device" 1000 replays Figure 10 The one-time password 1001 recorded in (a). Since the combination of the one-time password and the clock information is Figure 10 The OTP verification chip is deceived, and the authentication OK signal 1010 is sent back to the main CPU.

[0169] This is a replay attack that rewinds time to disguise it. Compared with hardware tokens, OTP verification chips have to prevent such time rewind attacks.

[0170] Figure 11 To express Figure 4 The flowchart shown is a timing process in which constraints are added to prevent replay attacks in the OTP verification chip 400. This process is executed by the control unit 401.

[0171] Figure 11 In the example, from the perspective of the OTP check chip 400, step S1100 is started when a clock adjustment action occurs (ie, when the main CPU 410 sends a clock adjustment command).

[0172] In step S1101 , the new time setting value z sent from the main CPU 410 is obtained.

[0173] In the combination of decision step S1102 and decision step S1103 , if the clock has not been initialized or if the clock has been initialized and the time is changed by going back in time from the current time, the process proceeds to step S1104 .

[0174] Otherwise, that is, when the clock has been initialized and advanced toward the future, the clock register is changed in step S1106, the update is deemed to be OK in step S1107, and the processing is terminated in step S1108.

[0175] In step S1104, it is checked whether the time change value of the clock is rewinded to the time before the most recent successful verification time β. Figure 5 The value explained as the most recent successful check time 530, or Figure 7 In step S707, the value of β is recorded, or Figure 8 The value recorded as β in step S807 is the same, and the value will not be lost even if the power is cut off or reset.

[0176] If it is a rewind to the time before β, it may be Figure 10 Since this is a replay attack based on time tampering as shown in (b), the time update is deemed to be NG (not permitted) in step S1105 and the processing is ended in step S1108.

[0177] If the branch of step S1104 is yes and the clock has not been initialized, the result is that all functions of the OTP verification chip 400 are stopped. In addition, if the branch of step S1104 is yes and the clock has been initialized, the time is not changed from the current state. Figure 10 Such a replay attack corresponds to the risk.

[0178] If step S1104 is determined to be negative, that is, the time is changed to a future time relative to the most recent successful verification time β, the clock register is changed in step S1106 , and the update is deemed to be OK in step S1107 , and the process ends normally in step S1108 .

[0179] If no authentication has been successful in the past, the initial value of the verification success time β is the most recent value in the clock representation, so the determination in step S1104 is always negative, and the clock is always updated in step S1106.

[0180] In this way, the control unit 401 can set the time of the clock, and the authentication calculation unit 405 records the current time of the clock as the authentication success time when it determines that the authentication is successful for the first authentication request or the second authentication request. The control unit 401 prohibits setting to the authentication success time or the time before it, thereby eliminating the risk corresponding to the replay attack.

[0181] If the method proposed in the above embodiment is adopted, it can be executed in a cheap OTP check chip. Figure 1 and Figure 2 The time synchronization function within the server described in the online banking service can realize a highly reliable authentication agency.

[0182] Therefore, popularizing the one-time password-based mechanism with good security effects in embedded applications that were previously used for fixed key authentication will help improve social credibility.

[0183] In addition, sufficient countermeasures can be taken against the security risks caused by the embedding of the OTP verification chip, namely the risk of tampering (disguise) at any time.

[0184] Furthermore, the OTP verification chip 400 is considered to be housed in an electronic control unit (ECU) mounted in a car. In this case, the one-time password verification can be realized at a low cost in the in-vehicle electronic control unit which is required to be low-cost.

[0185] While the embodiments encompassing the present invention have been specifically described above, the present invention is not limited to the embodiments shown here, and various modifications can be made without departing from the spirit and scope of the invention.

[0186] In particular, all or part of the above-mentioned components, functions, and processing units can be implemented in hardware, for example, by designing them using integrated circuits. As described in the embodiments, PLCs and sequencers are also included within this scope. Furthermore, as other implementation examples, software implementation can be achieved by having a processor execute programs that implement the various functions, or in the form of device control languages ​​or firmware closely related to integrated circuits.

[0187] In addition, in the above embodiment, the control lines and information lines are shown as those considered necessary for explanation, and not all control lines and information lines may be shown on the product. All components can be connected to each other.

[0188] As described above, the technology described in the embodiment can realize one-time password verification at low cost.

[0189] Specifically, the ability to inexpensively manufacture OTP verification chips will facilitate the widespread adoption of one-time passwords in embedded devices. This innovative technology addresses the risk posed by the loss of tools containing keys or key information, and the inability to easily replace the lock on the user's side, leading to a significant increase in demand.

[0190] Specifically, various applications can be carried out, including secure changes to vehicle-mounted ECU programs and data as shown in Patent Document 2, implementation of keyless coin lockers, inexpensive implementation and popularization of express lockers, security assurance of ATM (Automated Teller Machine) payment collection, fairness assurance of election ballot box counting, security improvement of gates to important security locations such as nuclear power plants, and locking / unlocking of safety devices for destructive equipment.

[0191] Explanation of symbols

[0192] 300…User authentication & OTP issuing server, 302…User, 303…Locking device, 311, 312…OTP (OneTime Password), 400…OTP verification chip, 410…Main CPU, 401…Control unit, 402…I / O, 403…Clock unit, 404…Crystal oscillator, 405…Authentication calculation unit, 406…Non-volatile memory, 407…Pass code vault, 504…Pass code, 510…Secondary password FIFO, 520…Primary password memory, 530…Last successful verification time register, 901…Wirelessly connected time source, 902…Wired connected time source, 1000…Impostor and recording device.

Claims

1. A checking device, characterized in that: have: A clock unit that keeps track of time using a built-in clock; and An authentication calculation unit includes a first storage area capable of storing (N+1) numerical values ​​written last until the number written N times before, generates a first verification one-time password in a time synchronization manner at a predetermined first time interval for a time point having a predetermined time relationship with the current time point based on the time indicated by the clock, writes the first verification one-time password generated at different time points one by one into the first storage area, and determines that the authentication is successful when the authentication object one-time password received in response to the first authentication request matches any one of the (N+1) first verification one-time passwords in the first storage area, wherein N is a natural number. It also includes a control unit capable of setting the time of the clock, When the authentication calculation unit determines that the authentication is successful with respect to the first authentication request, the authentication calculation unit records the current time of the clock as the authentication success time. The control unit prohibits setting to the authentication success time or a time before the authentication success time.

2. The checking device according to claim 1, characterized in that: N is an even number, The authentication calculation unit generates the first verification one-time password at a time point that is N / 2 faster than the current time in a predetermined time unit, and writes the generated one-time password into the first storage area.

3. The checking device according to claim 1, characterized in that: The authentication calculation unit corrects the time of the clock based on the time corresponding to the verification one-time password that matches the authentication target one-time password.

4. The checking device according to claim 1, characterized in that: When the time point corresponding to the first verification one-time password written into the first storage area is consistent with the current time calculated with a second time interval longer than the first time interval, the authentication calculation unit writes the first verification one-time password into the second storage area as the second verification one-time password, and determines that the authentication is successful when the authentication object one-time password received through the second authentication request is consistent with the second verification one-time password.

5. The checking device according to claim 4, characterized in that: When the authentication object one-time password and the second verification one-time password match and the authentication is determined to be successful, the authentication calculation unit prohibits authentication under the second authentication request until the second verification one-time password in the second storage area is subsequently updated.

6. The checking device according to claim 4, characterized in that: The authentication calculation unit counts the number of authentication failures in the first authentication request, and permits authentication in the second authentication request when the number of failures reaches a predetermined number.

7. The checking device according to claim 4, characterized in that: The authentication calculation unit counts the number of authentication failures in the second authentication request, and prohibits authentication in the second authentication request until the second verification one-time password in the second storage area is next updated if the number of failures reaches a predetermined number.

8. The checking device according to claim 1, characterized in that: The authentication calculation unit includes a symmetric key storage unit that stores a symmetric key used to generate the first verification one-time password. The authentication calculation unit, the control unit, the clock unit, and the symmetric key storage unit are integrated into an integrated circuit chip and packaged.

9. The checking device according to any one of claims 1 to 4, characterized in that: The verification device is housed in an electronic control unit mounted in an automobile.

Images