Authentication code generation device, authentication code generation method, and authentication code generation program

Abstract

To provide an authentication code generation device, an authentication code generation method, and an authentication code generation program, in which an alteration of a message is difficult.SOLUTION: An authentication code generation device 1 comprises: a storage part 111 that stores a data related to a transmitted message in the case where a plurality of messages are sequentially received and transmitted with the other device; an extraction part 112 that extracts data related to the transmitted message to be stored when transmitting and receiving a new message with the other device; and an arithmetic part 113 that calculates the message authentication code in order to be allied to the new message by a predetermined arithmetic by using a data string obtained by coupling the new message with the data related to the transmitted and received message to be extracted as an input.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to techniques for generating message authentication codes. [Background technology]

[0002] Conventionally, when a sender and a receiver share a key, a Message Authentication Code (MAC) is used as a technology for detecting tampering of a message being sent and received and for authenticating the integrity of the message. A MAC is generated by taking a common key and the message to be authenticated as input and performing a specific calculation. The sender appends this MAC to the message, and the receiver who has the common key compares it with a MAC generated in the same way to detect message tampering. For example, Non-Patent Document 1 proposes a generation algorithm using a keyed hash function. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Dang, Q. (2008), The Keyed-Hash Message Authentication Code (HMAC), Federal Information Processing Standards Publication 198-1, National Institute of Standards and Technology. Summary of the Invention [Problem to be solved by the invention]

[0004] Incidentally, the security of a MAC also depends on its data length, so it is necessary to determine an appropriate length according to the level of security required. However, when a MAC of sufficient length cannot be ensured due to protocol constraints, etc., it may be possible to tamper with a message with a realistic amount of calculations even if a secure MAC generation method is used.

[0005] An object of the present invention is to provide an authentication code generation device, an authentication code generation method, and an authentication code generation program that make it more difficult to tamper with a message. [Means for solving the problem]

[0006] The authentication code generation device of the present invention includes a storage unit that stores data related to messages that have already been transmitted and received when transmitting and receiving multiple messages sequentially with another device; an extraction unit that extracts the stored data related to the transmitted and received messages when transmitting and receiving a new message with the other device; and a calculation unit that uses as input a data string that concatenates the new message and the extracted data related to the transmitted and received messages, and calculates a message authentication code to be assigned to the new message through a predetermined calculation.

[0007] The data relating to a sent or received message may be the message itself.

[0008] The data relating to the sent or received message may be the message authentication code added to the message.

[0009] The extraction unit may extract a maximum number of data items not exceeding a predetermined number from the most recent data items among the stored data items relating to the sent and received messages.

[0010] The authentication code generation method of the present invention includes the following steps, executed by a computer: a storage step of storing data relating to messages that have already been sent or received when multiple messages are sent or received sequentially with another device; an extraction step of extracting the stored data relating to the sent or received messages when a new message is sent or received with the other device; and a calculation step of using as input a data string concatenating the new message and the extracted data relating to the sent or received messages, and calculating, through a predetermined calculation, a message authentication code to be assigned to the new message.

[0011] An authentication code generating program according to the present invention causes a computer to function as the authentication code generating device. Effect of the Invention

[0012] According to the present invention, message tampering becomes difficult and tampering can be appropriately detected. [Brief description of the drawings]

[0013] [Figure 1] FIG. 2 is a diagram illustrating a functional configuration of an authentication code generating device according to an embodiment. [Diagram 2] 4 is a sequence diagram illustrating a procedure for transmitting and receiving a message between devices in an embodiment. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] The present invention will be described below by taking as examples first to third embodiments. In these embodiments, in order to improve the integrity of data transmitted between devices, the method of generating a message authentication code that is assigned to each piece of data (message) is improved from conventional methods.

[0015] [First embodiment] FIG. 1 is a diagram showing a functional configuration of an authentication code generating device 1 in this embodiment. The authentication code generation device 1 is an information processing device (computer) equipped with a control unit 11, a memory unit 12, and various communication devices, and may be a general-purpose device such as a server or a personal computer, or small hardware such as a mobile terminal or an IoT device. In addition, the authentication code generation device 1 is assumed to be incorporated into each device that sends and receives messages, but it may also be a separate device that is communicatively connected, and further, it may be configured as an authenticated encryption system in combination with a specified encryption method.

[0016] The control unit 11 is a part that controls the entire authentication code generation device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 12. The control unit may be a CPU. The storage unit 12 is a storage area for various programs for causing the hardware group to function as the authentication code generation device 1, various data, and the like, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), or the like.

[0017] In addition, the authentication code generating device 1 may be configured so that the control unit 11 executes the authentication code generating program stored in the memory unit 12, but the control unit 11 and the memory unit 12 may be implemented as a hardware circuit dedicated to the authentication code generating device 1.

[0018] The control unit 11 includes a storage unit 111, an extraction unit 112, and a calculation unit 113, and outputs a generated message authentication code for an input common key and a message to be authenticated.

[0019] When a plurality of messages are sequentially transmitted and received between another device, the saving unit 111 saves in the memory unit 12 data relating to the messages that have already been transmitted and received. Here, the data relating to the transmitted and received message may be the message itself, but may also be a common operation (such as a hash operation) performed on both the transmitted and received message.

[0020] When transmitting or receiving a new message to or from another device that is a communication partner, the extraction unit 112 extracts data relating to messages that have already been transmitted or received and that are stored in the storage unit 12.

[0021] The calculation unit 113 receives as input a data string obtained by concatenating the new message and the extracted data relating to the transmitted and received messages together with the common key, and performs a predetermined calculation to calculate a message authentication code to be assigned to the new message.

[0022] Specifically, when a sender and a receiver continuously transmit and receive messages (m1, m2, ...), the calculation unit 113 calculates the MAC of one message m by including past messages in the MAC calculation. i is used for multiple MAC calculations as follows, where H K_MAC () is a MAC generation algorithm constructed using a hash function or a block cipher algorithm, etc., and a common secret key K_MAC is used for both transmission and reception. H K_MAC (m1) (1) H K_MAC (m1 / m2) (2) H K_MAC (m1∥m2∥m3) (3) H K_MAC (m1∥m2∥m3∥m4) (4) H K_MAC (m1∥m2∥m3∥m4∥m5) (5)

[0023] FIG. 2 is a sequence diagram illustrating a procedure for transmitting and receiving a message between devices in this embodiment. It is assumed that device A (Alice) and device B (Bob) have shared in advance a secret key K_MAC to be used for the MAC calculation.

[0024] First, when Alice sends the first message m1 to Bob, Alice uses H K_MAC Calculate (m1). Next, let m2 be the response from Bob to Alice for message m1. Bob uses H K_MAC Calculate (m1|m2). In the subsequent communications, m3, m4, ... will be sent and received. i The MAC to be assigned to H K_MAC (m1∥m2∥…∥m i ) is calculated.

[0025] Although the example shows a case where Alice and Bob alternately send messages, this embodiment can be applied to sending and receiving messages in any order. For example, the same is true for a case where multiple messages are sent sequentially from one device (terminal) to another device (server).

[0026] [Second embodiment] In the first embodiment, the message m i When sending, all messages m1,…,m i-1 In the case where the above-mentioned is used for the MAC calculation, the authentication code generation device 1 needs to hold all messages.

[0027] In the second embodiment, the authentication code generation device 1 uses only messages from a certain period (number of times) in the past. That is, the extraction unit 112 extracts the maximum number of data relating to sent and received messages stored in the storage unit 12, starting from the most recent one and not exceeding a predetermined number.

[0028] For example, if the data of the most recent five messages including the new message to be transmitted is used, the calculation unit 113 calculates the new message m i The MAC to be assigned to (i ≧ 5) is H K_MAC (m i-4 m i-3 ∥...∥m i ) is calculated.

[0029] [Third embodiment] In the third embodiment, data relating to sent and received messages stored in the storage unit 111 is different from that in the first and second embodiments. That is, the MAC that was assigned to a sent or received message is saved, rather than the message itself, and is used to generate a MAC for a new message.

[0030] Specifically, the calculation unit 113 calculates a new message m i The MAC to be assigned to (i ≧ 2) is H K_MAC (H K_MAC (m i-1 )∥m i ) is calculated. Here, only the MAC assigned to the previous message is concatenated to the new message, but this is not limited thereto, and multiple MACs from the past may be concatenated as in the second embodiment.

[0031] According to the above-described embodiment, when the authentication code generation device 1 sequentially transmits and receives multiple messages with other devices, it stores data related to the messages that have already been transmitted and received, and when transmitting or receiving a new message, it calculates a MAC from a data string that concatenates the stored data related to the transmitted and received messages and the new message. Therefore, the authentication code generation device 1 can detect tampering of multiple messages because it calculates the MAC from inputs including messages previously sent and received. In addition, the MAC calculation is performed multiple times for one message, which is similar to the effect of extending the MAC length.

[0032] In other words, if an attacker were to tamper with a message at a certain point in time, he or she would need to continue tampering with subsequent messages so as not to change the subsequent MACs, making tampering extremely difficult.

[0033] Furthermore, the authentication code generation device 1 may retain the transmitted and received message itself and use it as the MAC to be added to a new message, but may also use the generated MAC instead of the message itself. This allows the authentication code generation device 1 to generate a new MAC based on a past message while saving storage capacity by using a MAC that is usually shorter than the message itself. Furthermore, by concatenating only one past MAC, capacity and processing load can be reduced. Furthermore, even if the authentication code generation device 1 stores and concatenates the messages themselves, it is possible to reduce the capacity and processing load by limiting the number of messages.

[0034] In addition, the above-mentioned embodiment makes it difficult to tamper with messages and improves the integrity of messages sent and received, which makes it possible to contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, which is to "Develop resilient infrastructure, promote sustainable industrialization and foster innovation."

[0035] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0036] The authentication code generation method by the authentication code generation device 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0037] 1. Authentication code generator 11 Control section 12 Storage section 111 Preservation Department 112 Extraction unit 113 Calculation Department

Claims

1. a storage unit for storing data on messages that have already been transmitted or received when a plurality of messages are transmitted or received sequentially between the device and another device; an extracting unit that extracts data related to the stored transmitted and received messages when transmitting or receiving a new message to or from the other device; a calculation unit that calculates a message authentication code to be assigned to the new message by performing a predetermined calculation using as input a data string that concatenates the new message and the extracted data related to the transmitted and received messages.

2. The authentication code generating device according to claim 1 , wherein the data relating to the sent or received message is the message itself.

3. The authentication code generating device according to claim 1 , wherein the data relating to the transmitted or received message is the message authentication code added to the message.

4. 4. The authentication code generation device according to claim 1, wherein the extraction unit extracts a maximum number of messages not exceeding a predetermined number from the most recent message among the stored data relating to the transmitted and received messages.

5. a storage step for storing data on messages that have already been transmitted or received when a plurality of messages are transmitted or received sequentially between the device and another device; an extraction step of extracting data relating to the stored transmitted / received messages when transmitting / receiving a new message to / from the other device; a computing step of computing, by a predetermined computation, a message authentication code to be assigned to the new message, using as input a data string obtained by concatenating the new message and the extracted data related to the previously sent or received messages.

6. An authentication code generating program for causing a computer to function as the authentication code generating device according to any one of claims 1 to 4.

Images