Authentication device

Abstract

This provides authentication technology that enhances resistance to dictionary attacks and brute-force attacks, and increases the cost of candidate verification. [Solution] An initial bit grid is generated from user input data and random number data. A spatial transformation is applied before each evolutionary step based on a pseudo-random number sequence dependent on the input data, and multi-step state transitions are performed using cellular automaton rules selected from a known rule set and an input-dependent dynamically generated rule set. The resulting final grid state is output as authentication information, and authentication is performed by comparing it with the registration information.

Description

Technical Field

[0001] The present invention relates to an authentication device used for user authentication.

Background Art

[0002] In conventional authentication methods, comparison of the password itself, comparison using a hash value or key derived from the password, a challenge-response method, etc. are widely used.

[0003] For example, when applying public key authentication within a social network, a technique has been proposed for setting a certification authority (CA) that guarantees the validity of the public key to a highly reliable terminal among the terminals in the network. Specifically, a relationship based on the approval actions between users is stored as a graph structure (social graph), the reliability of each terminal is calculated based on the graph structure, and one user terminal is set as the certification authority according to the level of its reliability, and further, a configuration for centralized management and publication of public keys by the certification authority is disclosed.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] On the other hand, due to the improvement in the efficiency of parallel trials by GPUs and ASICs, simple verification value comparison is likely to simplify the evaluation function for attackers and reduce the trial cost. Also, when quantum computers are put into practical use in the future, it has been pointed out that the number of search times can be reduced in search problems, and there is a possibility that candidate search will be accelerated. However, as a countermeasure against actual attacks, it strongly depends not only on the "number of search times" but also on the "cost of verifying (oracle evaluation) for one candidate", so it is important to make the calculation and memory requirements of the candidate verification function itself high by design and make execution difficult.

[0006] Furthermore, if regularity or symmetry remains in the authentication information generation process, it may create an opportunity for attackers to optimize the search space using statistical features, periodicity, autocorrelation, or learning / approximation. Therefore, it is desirable to provide an evaluation function with a structure in which even small differences in input data propagate significantly to the final state, and in which predicting, reverse-calculating, or approximating intermediate states is difficult. In addition to the aforementioned challenges, the certificate authority configuration device described in the above prior art focuses on "selecting and configuring a certificate authority (CA) to guarantee the legitimacy of public keys as a highly trusted user terminal, and centrally managing and disclosing public keys" based on a social graph. The methods described in prior literature are based on the formation and updating of social graphs and the selection of certification authorities based on trust calculations, and conventional technologies have been criticized for issues such as the complexity of users having to evaluate and input data from other devices. Therefore, from a different perspective than the framework shown in prior literature, it is desirable to provide an authentication technology that enhances resistance to dictionary attacks and brute-force attacks in authentication based on user input data, and that can increase practical attack time even in situations where acceleration through quantum search is possible. [Means for solving the problem]

[0007] In view of the above, an authentication device for user authentication is characterized by comprising: an initial grid generation means for generating an initial bit grid using user input data and random number data; a step-by-step spatial transformation means for applying a spatial transformation determined by a pseudo-random number sequence based on the user input data to the initial bit grid at each evolutionary step; a cellular automaton rule selection means; a transition rule application means for executing a multi-step state transition according to the cellular automaton rule selection means; an authentication information output means for outputting the obtained final grid state as authentication information; a registration means for registering the final grid generated from user information in a recording unit; and a matching means for comparing the obtained final grid state with the final grid registered in the recording unit. [Effects of the Invention]

[0008] According to the present invention, it is possible to enhance computational security. [Brief explanation of the drawing]

[0009] [Figure 1] This is an overview of the authentication system. [Figure 2] This is a detailed diagram illustrating step-by-step spatial transformations (linear transformations). [Figure 3] This is an explanatory diagram showing the set of evolutionary rules and the method of rule selection and evolution at each step. [Figure 4] This figure shows examples of safety simulations (entropy, Kolmogorov complexity approximation, autocorrelation, etc.). [Figure 5] This figure shows the change in the final grid state (Hamming distance, avalanche property) for a single character difference in the input data. [Figure 6] This figure shows the two-dimensional autocorrelation index (maximum correlation value other than zero lag, etc.) calculated by FFT. [Modes for carrying out the invention]

[0010] (A. System Configuration: Registration Process and Authentication Process) As shown in Figure 1, the authentication system of this embodiment comprises a user terminal 0 (including an input unit and a display unit), an authentication device (server or terminal module), and a storage unit (database) for storing registered authentication information. The authentication device calculates the final grid state (or its hash) from the same input data and random number data (at least a salt) stored in the storage unit during user registration and login, and determines whether authentication is possible by comparing it with the stored final grid state (or hash). During registration, the system receives at least a username and password, generates a salt, and stores it in memory. It is desirable that the salt be a different value for each user. During login, the salt associated with the same username is retrieved from memory and combined with the entered password to generate authentication information.

[0011] The random number information (seed of the pseudo-random number sequence) includes a configuration determined by user input data such as the username. For example, the seed may be composed of "username∥salt" or "username∥salt∥password," and then formatted to a fixed length using HMAC-SHA256 or similar for use in CSPRNG initialization. This makes it less likely for the initial state and conversion / rule sequences to match even if the same password is used by different users.

[0012] (B. A brief explanation of cellular automata (CA)) A cellular automaton (CA) is a computational model in which a large number of cells arranged in a grid (each cell on a two-dimensional grid in this embodiment) each take on a discrete state (a bit state of 0 or 1 in this embodiment), and as time progresses in discrete steps, the next state of each cell is simultaneously updated according to rules based on the "state of neighboring cells".

[0013] In two-dimensional CA, a neighborhood including the up, down, left, right, and diagonal directions (Moore neighborhood: 8 neighborhoods) or only the up, down, left, and right directions (Von Neumann neighborhood: 4 neighborhoods) is used around a given cell. In this embodiment, the Moore neighborhood is used, and the "number of 1s (sum of neighborhoods)" in the 8 cells surrounding the central cell is calculated, and the next state of the central cell is updated to 0 / 1 according to that value.

[0014] A common expression is the Birth / Survive (B / S) format. This rule states that if the central cell is 0 (dead), it changes to 1 (alive) if the sum of its neighbors belongs to set B (Birth); if the central cell is 1 (alive), it remains 1 if the sum of its neighbors belongs to set S (Survive); otherwise, it becomes 0. For example, "B3 / S23" means that if the central cell is 0, it is born if the sum of its neighbors is 3, and if the central cell is 1, it survives if the sum of its neighbors is 2 or 3.

[0015] Even though CA involves iterative application of local rules, a slight difference in the initial state can spread over a wide range with time evolution, generating complex and difficult-to-predict patterns. This property of "local update → global complexity" is useful as a diffusion mechanism for authentication information generation because it strongly amplifies a slight difference in the input to the output (avalanche property).

[0016] However, not all rules exhibit desirable complexity. Some rules tend to converge to fixed points (all 0s / all 1s), transition to simple cycles, or generate regular structures such as stripe patterns. Therefore, in the present invention, known rule sets are selected according to a security index, and inappropriate rules are excluded on the generation algorithm side even for dynamically generated rules (described later), thereby ensuring security from viewpoints such as entropy, an approximate index of Kolmogorov complexity, and autocorrelation.

[0017] (C. Initial grid generation means: PBKDF2 and bit arrangement) The initial grid generation means takes user input data (at least a password) and random number data (at least a salt) as inputs and executes PBKDF2-HMAC-SHA256 to obtain a derived bit sequence. The number of iterations of PBKDF2 is set to be 100 or more and 10^6 or less, and in actual operation, it is adjusted according to the terminal performance, authentication frequency, and threat model as described later.

[0018] Examples of the method for arranging the derived bit sequence include: (i) directly expanding the PBKDF2 output as a bit sequence and arranging GRID_SIZE^2 bits in order from the beginning to the grid; (ii) initializing a cryptographically secure pseudo-random number generator (CSPRNG) with the PBKDF2 output as a seed and arranging GRID_SIZE^2 bits sequentially generated from the CSPRNG; (iii) mixing (i) and (ii) above and arranging multiple blocks using different generation methods to increase the mixing degree, etc. <000009​Furthermore, as a direct mixing of input data, it may be configured to bit-serialize a password or username and embed it into a partial area of the grid using XOR or the like. For example, by repeatedly XORing the message bit string to the first row or the first block, in addition to the randomness derived from the KDF, an input-dependent structure can be embedded and diffused by spatial transformation and evolution. (D. Space transformation means for each step: Input-dependent linear operation)

[0020] The space transformation means for each step applies a space transformation to the grid by a pseudo-random number sequence determined depending on the input data immediately before each evolution step. The space transformation may include a linear operation, a substitution operation, or a combination thereof on the indices (coordinates) of the grid.

[0021] Examples of space transformation are as follows (see Figure 2). (1) Circular shift (roll): Circularly move by a predetermined amount in the x and y directions. (2) Inversion: Invert left and right, up and down, or both. (3) Rotation: In units of 90 degrees, or a combination of rotation and inversion. (4) Row permutation - column permutation: Rearrange rows and columns based on a permutation vector generated by a pseudo-random number. (5) Block permutation: Divide the grid into blocks and permute by block. (6) Linear mapping: Apply (x’,y’)=A(x,y)(mod GRID_SIZE) using a 2×2 matrix A to the index vector (x,y), and rearrange by the mapping (select a matrix A that is invertible modulo GRID_SIZE, etc.).

[0022] The above operations may be used alone or in combination. The type, parameters, and order of the operations applied in each step are determined by at least a CSPRNG derived from the input data. For example, it may be configured to generate a seed using HMAC-SHA256 and sequentially obtain an operation ID, a shift amount, a substitution index, matrix elements, etc. therefrom.

[0023] Inserting spatial transformations at each step disrupts the coordinate system with respect to local neighborhood updates in CA, resulting in (i) the breakdown of periodic structures and symmetries that can arise from iterative single rules, (ii) weakening of the locality that underlies rule estimation and approximation, and (iii) a complex mixture of input-dependent properties. Therefore, it can make it difficult for attackers to perform statistical feature extraction and stabilize learning.

[0024] (E. Transition rule application methods: Known rule set and dynamically generated rule set) The transition rule application means performs grid state transitions over multiple steps (number of evolution steps: NUM_STEPS), with each step following a CA rule selected by the cellular automaton rule selection means. The update may be configured to update each cell simultaneously (synchronous update). The boundary condition can be set to a cyclic boundary (torus) to suppress bias due to edge characteristics.

[0025] In this invention, at least two sets of rules are maintained. (a) Known rule set: A set of predefined rules that are adopted if their safety (entropy, an approximate index of Kolmogorov complexity, low autocorrelation, etc.) is ensured by the safety indicators described below. (b) Dynamically generated rule set: A set of rules generated by an algorithm based on user input data, and the rule set or sequence of rules may change for each input.

[0026] The rule selection method at each step involves selecting either set (a) or (b) based on a cryptographically pseudorandom number sequence derived from the input data, and then selecting and applying rules within that set. The selection order may be the "order in which the rules were generated from the input data". For example, the rules may be applied sequentially according to the order in which the dynamically generated rule set was created, with a switch to a known set midway through using CSPRNG, or a selection index from a known set obtained and applied (see Figure 3).

[0027] Performing set switching and rule selection step by step in this manner results in: (i) difficulty in analysis and learning assuming a fixed rule sequence; (ii) difficulty in pre-calculating (table creation) and reusing the rule sequence to speed up candidate validation because the rule sequence differs with different inputs; and (iii) a large amplification of the rule sequence estimation error towards the final state, resulting in a structure where matching authentication information is difficult to achieve. (F. Ensuring the security of the known rule set (mandatory))

[0028] A set of known rules that ensures safety will be used. Here, safety means that a predetermined threshold (criteria) is met when evaluated using at least the following indicators. (1) Entropy: The proportion of 1 in the final grid is not extremely skewed, and there is sufficient uncertainty both locally and globally. (2) Kolmogorov complexity (approximation): Low compressibility of the grid. In practice, the compression ratio of common compressors such as gzip / LZ is used as a proxy metric, and rules with excessively high compression ratios (= strong regularity) are eliminated. (3) Autocorrelation: In the two-dimensional autocorrelation function, there are no prominent peaks other than at the origin, i.e., there is no strong periodic structure or repeating pattern.

[0029] The procedure for constructing a set of known rules can be carried out, for example, as follows: (a) Generate a large number of candidate rules (such as combinations of B / S). (b) Prepare multiple initial conditions (random, low density, high density, simulates input bit embedding, etc.). (c) Each candidate rule is evolved for a predetermined number of steps, and the statistics of the final grid are calculated. (d) Only candidates that satisfy (1) to (3) above are selected and registered as a fixed set of known rules. (e) Figure 4 shows the index distribution of the adopted rule group and explains that the safety standards are met.

[0030] By limiting the set of known rules to those that are "secure," the opportunity for attackers to exploit regularities to streamline their searches can be reduced. (G. Algorithms for generating dynamic generation rule sets)

[0031] The dynamically generated rule set is generated by an algorithm based on user input data. The algorithm for generating the dynamically generated rule set should preferably have at least the following properties: (1) Input dependency: The set of rules (or sequence of rules) changes depending on input information such as username, salt, and password. (2) Cryptographic pseudorandomness: The generation of rules is determined by a CSPRNG and is difficult to predict from the outside. (3) Elimination of inappropriate rules: Includes constraints or checks to eliminate rules that tend to produce fixed-point convergence, short periods, or significant regularities.

[0032] As an example of dynamic generation, the following algorithm can be used. (a) Seed generation: Generate a seed using seed=HMAC-SHA256(key=KDF output, msg=username∥salt∥context), etc. (b) Candidate generation: Based on random numbers obtained from CSPRNG, sets B and S are generated. Specifically, an adoption flag is determined randomly for each value of the neighbor sum from 0 to 8. (c) Imposing constraints: For example, restricting the number of elements in B to the range of 2 to 6, restricting the number of elements in S to the range of 2 to 7, or including the intersection of B and S or a specific value (e.g., 3), thereby excluding rules that would obviously simplify things. (d) Simple safety check (reject sampling): The candidate rule is tested with multiple initial conditions for a small number of steps (e.g., T_pre), and if the simple indicators of entropy bias, compression ratio, and autocorrelation are below (or above) the threshold, it is discarded and the next candidate is generated. (e) Collection: Generate a predetermined number of rules (e.g., M rules) and store them in an array in an order dependent on the input.

[0033] The above simplified safety check does not need to be as rigorous as a known rule set, but it is desirable to at least eliminate "extremely simple rules" and "highly biased rules." This ensures that the statistical safety of the final state can be maintained at a certain level or higher, even if the rule set changes dynamically depending on the input. (H. Authentication information output and comparison using verification means (mandatory))

[0034] The authentication information output means outputs the final grid state after the evolution process (NUM_STEPS) is completed as authentication information. The comparison determination means compares the authentication information saved at registration (final grid, or verification value derived from the final grid) with the authentication information calculated using the same procedure at login, and determines that authentication is successful if they match.

[0035] The comparison using the matching method may involve comparing the bit arrays of the final grid for an exact match, or it may involve comparing the value obtained by hashing the final grid using SHA-256 or similar after converting it to a bit string. From a database protection standpoint, it is preferable to store only the hashed verification value rather than directly storing the final grid. (I. Parameter Design Considerations (Required: GRID_SIZE, PBKDF, Number of Evolutionary Steps))

[0036] The security and computational cost of this invention primarily depend on GRID_SIZE, the number of PBKDF2 iterations, and the number of evolutionary steps (NUM_STEPS). These should be appropriately adjusted depending on the actual application system (server authentication, mobile, embedded, offline terminal authentication, etc.). Below are some examples of realistic ranges and their justifications. (1) Range of GRID_SIZE

[0037] GRID_SIZE is determined by balancing security (size of the state space, diffusion, and suppression of statistical bias) and authentication computation cost (roughly proportional to O(GRID_SIZE^2 × NUM_STEPS), including memory bandwidth load). As a practical guideline, GRID_SIZE can be defined as 64 or more and 1024 or less, more preferably 128 or more and 512 or less. Considering minimum security and memory load, the range in which the authentication function is effective can be defined as 32 ≤ GRID_SIZE ≤ 4096.

[0038] If GRID_SIZE is too small, the statistical characteristics of the final state are more easily observed, and bias and periodicity may remain depending on the rules and transformations. On the other hand, if GRID_SIZE is too large, the authentication delay for legitimate users becomes excessive, which is particularly disadvantageous in terms of power consumption and perceived latency in in-terminal authentication. Therefore, the above examples represent a range that can easily secure a sufficient state space while keeping the latency within a practical range (e.g., tens of milliseconds to a few seconds) with typical CPU / server / terminal performance. (2) PBKDF2 range of repetitions

[0039] The number of iterations in PBKDF2 directly increases the cost per trial for offline guessing. If the number of iterations is too low, attackers can easily perform a large number of trials using GPUs, etc. On the other hand, if it is too high, latency and power consumption for legitimate users increase, and the quality of service deteriorates. As a practical guideline, within the range included in the billing scope (100 to 10^6), It can be defined as 10^4 times or more and 5 × 10^5 times or less, more preferably 5 × 10^4 times or more and 3 × 10^5 times or less. Furthermore, the number of iterations should be adjusted according to the operating environment, such as increasing the number of iterations when sufficient computing resources are available on the server side or for high-security applications, and appropriately decreasing it for mobile devices, etc.

[0040] (3) Range of evolution steps (NUM_STEPS) NUM_STEPS represents a trade-off between diffusion achievement and computational complexity. If the number of steps is too small, initial state locality remains, increasing the room for analysis using approximations and partial matches. On the other hand, if it is too large, authentication delay becomes excessive. As a practical guideline, 200 to 5000, more preferably 500 to 2000. It can be defined as follows.

[0041] In particular, this invention promotes mixing even with fewer steps through step-by-step spatial transformation and rule switching, while hundreds to thousands of steps are effective from the viewpoint of maintaining an attack cost above a certain level.

[0042] (J. Examination of quantum resistance (mandatory)) This invention primarily aims to enhance resistance to password theft (offline guessing), and, taking into account the possibility of faster searches using quantum computers, it is designed to increase the evaluation cost of candidate verification. Even if the number of searches can be reduced by quantum search, the evaluation cost remains high because verifying a single candidate requires PBKDF2 and large-scale CA evolution (including spatial transformation and rule switching).

[0043] Furthermore, under the assumption of quantum search, parameters can be set in a way that counteracts the search advantage by (a) strengthening the password length and character types, (b) increasing the number of PBKDF2 iterations, (c) increasing GRID_SIZE, (d) increasing NUM_STEPS, (e) increasing the number and check strength of dynamic generation rules, etc. Therefore, the present invention includes room for parameter adjustment in light of advancements in quantum computers.

[0044] (K. Implementation Example: Specific Example of Processing Flow) The registration process using the registration method is performed, for example, by following the steps below. (1) Accept username and password. (2) Generate a salt and store it in the memory unit, associating it with the username. (3) Generate the derived value using PBKDF2-HMAC-SHA256 (the number of iterations is within a predetermined range). (4) Generate an initial grid using the derived value (or a CSPRNG that uses the derived value as seed). (5) Mix the input bit string (derived from username and password) into the grid as needed. (6) Initialize the input-dependent CSPRNG, apply spatial transformations at each step, and perform CA updates NUM_STEPS while switching and selecting rule sets. (7) Obtain the final grid and save it as authentication information (you may save only the hash of the final grid).

[0045] The login process is performed, for example, using the following steps: (1) Accept username and password. (2) Obtain the salt and registered authentication information (or hash) corresponding to the username from the storage unit. (3) Recalculate the final grid (or hash) using the same method as during registration. (4) Compare the registered authentication information with the authentication information. If they match, authentication is successful; otherwise, authentication fails. (L. Safety Evaluation (Positioning in Figures 4, 5, and 6))

[0046] Figure 4 shows the results of evaluating the following safety indicators through simulation, for example. (1) The ratio distribution of the final grid (presence or absence of bias) (2) Hamming distance distribution of the final grid for input differences (e.g., a one-character difference in passwords) (avalanche property) (3) Two-dimensional autocorrelation (peak structure, periodicity) (4) Compression ratio (a proxy measure of complexity) (5) Changes in the above indicators when the number of steps, GRID_SIZE, PBKDF2, and number of iterations are changed.

[0047] This demonstrates that the set of known rules satisfies safety criteria, that dynamically generated rules can maintain equivalent levels of performance through exclusion conditions and simplified checks, and that safety and computational cost can be balanced through parameter adjustments.

[0048] Each of the indicators in Figure 4 can be defined, for example, as follows: (a) Entropy: Using the fact that the state of each cell in the final grid is binary (0 / 1), the probability p of occurrence of 1 in the entire final grid or for each region is calculated and evaluated as the binary Shannon entropy H = -p log2 p (1-p) log2(1-p)(bits / cell). The closer H is to 1, the smaller the bias tends to be. (b) Autocorrelation (simplified): The grid is mapped to {-1, +1} and the mean is removed. Then, the correlation coefficient with respect to the neighborhood shift (e.g., ±1, ±2 cells, etc.) is calculated, and the mean or maximum value of this correlation is used as a proxy index. (c) Kolmogorov complexity (approximation): Since the exact value of Kolmogorov complexity is difficult to calculate, the compression ratio (compressed size / original size) is calculated using a general compressor, and this is used as a surrogate index, assuming that the less compressible it is, the weaker the regularity tends to be.

[0049] Figure 5 evaluates how much minute differences in input data are spread to the final state, and can be evaluated, for example, using the following procedure: Prepare a base password and several modified passwords in which only one character of the base password is changed, and obtain the final grid for each under the same username and salt. Next, calculate the Hamming distance (percentage of different cells) between the base final grid and the modified final grid, and show it as the change in distance relative to the change position. The tendency for the distance to be concentrated around 0.5 indicates that the input differences are spread over a wide area (avalanche).

[0050] Figure 6 shows how to calculate two-dimensional autocorrelation using FFT and evaluate the persistence of periodic structures. For example, this can be evaluated using the following procedure: The grid is mapped from {0,1} to {-1,+1} and the mean is removed. Then, a frequency-domain representation is obtained using two-dimensional FFT, the power spectrum (square of the absolute value of the complex spectrum) is calculated, and an autocorrelation map is obtained using inverse FFT. The autocorrelation map is normalized at the zero lag (center point of autocorrelation), and the maximum absolute correlation value (maximum peak) in the region excluding the vicinity of the zero lag is used as an indicator. The smaller this indicator, the weaker the tendency for prominent periodic or repeating structures to be present.

[0051] The indicators in Figures 4 to 6 are examples of statistical evaluations for understanding the effects of the present invention (mixing, diffusion, and suppression of regularity), and it is desirable to keep the following points in mind. (a) The indicators are "exemplary" and the conditions for the authentication method to be established should not depend solely on the indicator values: Since the authentication of the present invention is achieved by matching the final grid (or its hash), the indicators are primarily supplementary materials to explain the security trend. (b) The exact value of Kolmogorov complexity is difficult to calculate, and compression ratio is a surrogate metric: Compression ratio can depend on the type of compressor (gzip, zlib, etc.), parameters, data representation (bit packing method), etc. Therefore, it is desirable to measure under the same conditions in comparative evaluation. (c) Entropy is one aspect of bias and does not negate all structurality: Even with high binary entropy, local structure and higher-order correlations may remain, so it is desirable to evaluate them in combination with autocorrelation and complexity indicators. (d) Simplified autocorrelation indices only observe small-lag correlations: While simplified indices are computationally efficient, they may miss long-period structures or structures in specific directions. FFT autocorrelation indices like the one shown in Figure 6 are more effective for detecting global structures. (e) The FFT autocorrelation index depends on the normalization and exclusion window: The value may change depending on the exclusion range near zero lag, the normalization method, boundary conditions (assuming a cyclic boundary), etc., so it is desirable to specify the conditions under which the reproducibility can be achieved. (f) A "deterioration" of the indicator does not immediately mean failure: Even if there are periods when autocorrelation temporarily and locally increases, authentication based on the matching of the final grid does not necessarily fail. On the other hand, if clear weaknesses such as fixed-point convergence or short-period convergence are observed, countermeasures can be taken by re-selecting the set of known rules, strengthening the rejection conditions of dynamically generated rules, adjusting GRID_SIZE / NUM_STEPS, etc. (g) Evaluation results depend on parameters: Since the index values ​​can change depending on GRID_SIZE, PBKDF2 iteration count, evolution step count, type and strength of spatial transformation, and the structure of the rule set, it is desirable to evaluate them in conjunction with parameter design according to the implementation environment (terminal performance, acceptable latency, threat model). (M. Variant / Alternative Embodiment (Reinforcement description with rejection response in mind))

[0052] The present invention is not limited to the embodiments described above. For example, the following modifications are possible. (1) KDF variation While PBKDF2-HMAC-SHA256 has been used as an example, configurations using other memory-hardened KDFs such as scrypt and Argon2 may also be included, to the extent that they achieve the same objective. The type of KDF may be substituted as a derivative implementation dependent on the scope of the claims.

[0053] (2) Modification of neighborhood update rules Not limited to Moore neighborhoods, von Neumann neighborhoods, extended neighborhoods, and non-uniform neighborhoods may also be used. The update rules are not limited to the B / S format; lookup table format, Boolean function format, and non-uniform rules (where the rules change depending on the cell position and step) may also be adopted.

[0054] (3) Extension of spatial transformations This includes not only linear operations but also permutations similar to linear operations, block mixing, and the composition of reversible maps. In particular, using reversible maps can enhance mixing while minimizing information loss. On the other hand, when adding irreversible operations (e.g., downsampling), they should be adopted only to the extent that the reproducibility of authentication is not compromised.

[0055] (4) Format of authentication information In addition to comparing the final grid itself, verification values ​​derived from the final grid (hash, hash set of multiple regions, feature hash, etc.) may also be compared. However, in order to satisfy the purpose of "authentication by comparing the final grid," a match determination based on the final grid state must be performed at least.

[0056] (5) Changes in server and terminal configuration The calculation can be performed on the server side, or it can be performed on the terminal side and only the verification value is sent. When extending to a challenge-response system, it is also possible to incorporate the challenge into spatial transformation or rule selection, and to generate and verify a different final grid for each session. (6) Integration into evolutionary means Since both the step-by-step spatial (linear) transformation means 7 and the rule application means 8 are functional elements that constitute the grid state update process at each evolutionary step, they may be functionally integrated and implemented as a single processing block. For example, the process of determining a spatial transformation based on a pseudo-random number sequence determined based on input data and applying it to the grid, and the process of executing state transitions according to cellular automaton rule selection may be executed integrally at each evolutionary step. In this case, the integrated processing block is referred to as the "evolutionary means," and the evolutionary means includes (i) selection, parameter determination, and application of spatial transformations, and (ii) switching of rule sets, rule selection, and execution of state transitions. The order of spatial transformation processing and state transition processing within the same step is not limited to a configuration in which spatial transformations precede, but may also include a configuration in which state transitions precede, or a configuration in which both are executed alternately multiple times.

[0057] In the step-by-step spatial transformation means, the "types" of linear operations that can be performed on the grid are fixedly defined in advance as a finite set determined by the user (implementer), and linear operations not included in the finite set are not performed.

[0058] The step-by-step spatial transformation means selects a linear operation to be applied at each evolutionary step from a finite set of fixedly defined linear operations, and determines the order in which the linear operations are applied and the parameters of each linear operation (at least a portion of the shift amount, inversion direction, rotation angle, matrix coefficients, permutation index, and block division number).

[0059] The selection of the linear operations, the order of application, and the determination of the parameters are performed based on a sequence of pseudorandom numbers generated by a cryptographic pseudorandom number generator derived from user input data (which may include at least a username and password, and a salt). The same sequence of linear operations (operation type sequence, order, and parameter sequence) is reproduced when the same user input data is given, while the sequence of linear operations is characterized to be different when the user input data is different.

[0060] The pseudorandom number sequence is determined by a seed derived from at least user input data and random number data (salt), and is characterized in that the seed is generated as a sequence that is difficult to predict from the outside by using a cryptographic hash function or a message authentication code (HMAC) to derive the seed.

[0061] Therefore, although the type of linear operation is fixed, the spatial transformation in this invention is characterized by an input-dependent pseudorandom number sequence that determines "which operation," "in what order," and "with what parameters" it is applied. As the spatial transformation sequence changes according to the difference in the inputs, it becomes difficult to utilize regularity and symmetry in the state transition process.

[0062] This authentication device may be implemented using a computer or similar means. [Explanation of symbols]

[0063] 0: User terminal 1: Pseudorandom number generation method 2: Input information-to-grid conversion means 3: Initial grid generation means 4: Spatial transformation characteristic generation means 5: Dynamic generation rule set 6: Known rule set 7: Step-by-step spatial (linear) transformation means 8: Transition Rule Application Method 9: Authentication information output means 10: Registration method 11: Verification means 12: Memory Department

Claims

1. An authentication device for user authentication, An initial grid generation means that generates an initial bit grid using user input data and random number data, A step-by-step spatial transformation means applies a spatial transformation determined by a pseudo-random number sequence based on the user input data to the initial bit grid at each evolutionary step, Cellular automaton rule selection method, A transition rule application means that executes multiple step state transitions according to the cellular automaton rule selection means, Authentication information output means that outputs the obtained final grid state as authentication information, A registration means for registering the final grid generated from user information in the recording unit, An authentication device characterized by comprising a verification means for comparing the obtained final grid state with the final grid registered in the recording unit.

2. In determining the transition rule, (a) A predefined set of known rules, (b) Hold the rule set that is dynamically generated by the algorithm for generating a dynamically generated rule set, The authentication device according to claim 1, characterized in that, for each evolutionary step, it selects rules to be applied from either the known set of rules or the dynamically generated set of rules in an order based on a cryptographic pseudorandom number sequence derived from the user input data, and applies them sequentially.

3. The authentication device according to claim 1, characterized in that the initial bit grid is generated by sequentially arranging a bit sequence derived by PBKDF2-HMAC-SHA256, which takes the password included in the user input data and the salt, which is random number data, as inputs, into a grid of GRID_SIZE × GRID_SIZE (32 ≤ GRID_SIZE ≤ 4096).

4. The authentication device according to claim 1 or 2, characterized in that the step-by-step spatial transformation means performs linear operations on the grid at each step, and the characteristics and order of the operations are determined by a cryptographic pseudorandom number generator using the user input data as a seed.

5. The authentication device according to claim 3, characterized in that the number of iterations of PBKDF2-HMAC-SHA256 is 100 or more and 1,000,000 or less.

Images