Authentication server, authentication system, authentication method, and program

Abstract

This invention improves password security without increasing the burden on the user. This authentication server comprises: an authentication information registration unit for generating a first registration hash value by first processing and a second registration hash value by second processing, from a password that was received along with a registration request, and registering the foregoing in a database along with a user identifier; and an authentication information check unit for generating a first check hash value by the first processing and a second check hash value by the second processing, from the password that was received along with the authentication request, and if the first registration hash value of a record having a user identifier matching the user identifier in the database matches the first check hash value and also the second registration hash value matches the second check hash value, then allowing authentication to succeed. The first processing includes hashing, and the second processing includes hashing and is different from the first processing.

Description

Authentication server, authentication system, authentication method and program

[0001] The present invention relates to an authentication server, an authentication system, an authentication method, and a program.

[0002] When using passwords for authentication, the password must be stored in advance in a database on the authenticating server so that it can be compared during authentication. If the password is stored in plain text on the server side, there is a risk that the password may be stolen by an attacker if the database is accessed illegally.

[0003] There is a technology for protecting against attacks by unauthorized access by simultaneously transmitting update parameters when transmitting a password and successively updating the passwords held on the server side (see, for example, Patent Document 1).

[0004] There is also a method in which hashed passwords are stored, and during authentication, the password sent is hashed and compared with the stored data for authentication. With this method, even if information in the database is leaked due to unauthorized access, the password itself will not be leaked. However, due to the characteristics of the hash function used for hashing, it is possible that an identical hash can be generated from a different password, and attacks based on this, so-called hash value collisions, are known.

[0005] In response to this, there is a technology in which the server calculates a verification value by encoding the hash value of the password sent for registration, stores this on the server side, and provides it to the user, and when authenticating, the user is prompted to send the password and verification value (see, for example, Patent Document 2).

[0006] JP 2015-1764 A JP 2014-27494 A

[0007] The following analysis is provided by the present invention.

[0008] According to the technology disclosed in Patent Document 1, the user is required to transmit a password and update information during authentication. Also, according to the technology disclosed in Patent Document 2, the user is required to transmit a password and a verification value. In either case, this places a heavy burden on the user.

[0009] Furthermore, although there are several methods for preventing guessing passwords from hash values, such as stretching and adding salts, there is an equal chance that the same hash value will be generated with each method, and this does not necessarily increase the security of passwords against attacks that exploit hash value collisions.

[0010] Therefore, when storing hash values ​​on the server side in password-based authentication, it is desirable to reduce the possibility of attacks exploiting hash value collisions by minimizing the possibility of generating the same hash value without increasing the burden on users.

[0011] The present invention has been made in view of the above circumstances, and has as its object to provide a technique for improving the security of passwords without increasing the burden on users.

[0012] According to a first aspect of the present invention, there is provided an authentication server comprising: an authentication information registration unit that, upon receiving authentication information including a user identifier and a password together with a registration request, performs a first process including hashing on the password to generate a first registered hash value, and performs a second process including hashing different from the first process on the password to generate a second registered hash value, and registers the first registered hash value and the second registered hash value as registration information in a database by associating the user identifier as a registered user identifier with the registered user identifier; and an authentication information matching unit that, upon receiving authentication information including a user identifier and a password together with an authentication request, performs the first process on the password to generate a first verification hash value, and performs the second process on the password to generate a second verification hash value, and determines whether the first verification hash value matches the first registered hash value and whether the second verification hash value matches the second registered hash value of the registration information having the registered user identifier that matches the user identifier received along with the authentication request, and determines that the authentication is successful if both the first verification hash value and the second verification hash value match.

[0013] According to a second aspect of the present invention, there is provided a database for storing registration information; an authentication information registration device for generating the registration information from authentication information including a registered user identifier and a registered password and registering the registration information in the database; and an authentication information matching device for generating matching information from authentication information including a matched user identifier and a matched password, matching the matching information with the registration information, and outputting a matching result, wherein the registration information includes the registered user identifier, a first registered hash value, and a second registered hash value, the first registered hash value being a value obtained by applying a first process including hashing to the registered password, and the second registered hash value being a value obtained by applying a second process including hashing and different from the first process to the registered password, the matching information including the matched user identifier, the first matching hash value, and a second matching hash value, the first matching hash value being a value obtained by applying the first process to the matched password, and the second matching hash value being a value obtained by applying the second process to the matched password, An authentication system is provided in which the authentication information matching device determines the matching result to be successful authentication if the first registered hash value of the registration information having the registered user identifier that matches the matching user identifier matches the first matching hash value, and the second registered hash value of the registration information matches the second matching hash value.

[0014] According to a third aspect of the present invention, there is provided an authentication method by an authentication server, which, upon receiving authentication information including a registered user identifier and a registered password, performs a first process including hashing on the registered password to generate a first registered hash value, and performs a second process including hashing different from the first process on the registered password to generate a second registered hash value, and registers the first registered hash value and the second registered hash value in a database in association with the registered user identifier, and upon receiving authentication information including a matching user identifier and a matching password, performs the first process on the matching password to generate a first matching hash value, and performs the second process on the matching password to generate a second matching hash value, and determines whether the first matching hash value matches the first registered hash value and whether the second matching hash value matches the second registered hash value of the registration information having the registered user identifier that matches the matching user identifier, and determines that the authentication is successful if both the first matching hash value and the second matching hash value match.

[0015] According to a fourth aspect of the present invention, there is provided a program for causing a computer to function as: means for, upon receiving authentication information including a registered user identifier and a registered password, performing a first process including hashing on the registered password to generate a first registered hash value, and performing a second process including hashing different from the first process on the registered password to generate a second registered hash value, and registering the first registered hash value and the second registered hash value in a database in association with the registered user identifier; and means for, upon receiving authentication information including a matching user identifier and a matching password, performing the first process on the matching password to generate a first matching hash value, and performing the second process on the matching password to generate a second matching hash value, determining whether the first matching hash value matches the first registered hash value and whether the second matching hash value matches the second registered hash value of the registration information having the registered user identifier that matches the matching user identifier, and determining that authentication is successful if both the first matching hash value and the second matching hash value match.

[0016] The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product.

[0017] According to the present invention, the security of passwords is improved without increasing the burden on users.

[0018] 1A and 1B are explanatory diagrams illustrating an overview of authentication information pre-registration processing according to a conventional system and an embodiment of the present invention, respectively. FIGS. ... example of the overall configuration of an embodiment of the present invention, and FIGS. 1B and 1C are explanatory diagrams illustrating an example of authentication information according to an embodiment of the present invention. FIGS. 1A and 1C are explanatory diagrams illustrating a functional block diagram and a hardware configuration diagram of an example of an authentication server according to an embodiment of the present invention, respectively. FIGS. 1A to 1C are explanatory diagrams illustrating second password generation according to an embodiment of the present invention, and FIGS. 1E and 1C are explanatory diagrams illustrating an example of registration information according to an embodiment of the present invention. FIGS. 1A and 1C are explanatory diagrams illustrating an example of an authentication information registration screen and an example of an authentication information input screen, respectively, according to an embodiment of the present invention. FIGS. 1A and 1B are flowcharts illustrating processes performed when a pre-registration request for authentication information is made and when authentication is requested, according to an embodiment of the present invention. FIGS. 1B and 1C are flowcharts of authentication information registration processing according to an embodiment of the present invention. FIGS. 1B and 1C are flowcharts of authentication processing according to an embodiment of the present invention. FIGS. 1C and 1D are explanatory diagrams illustrating an example of the overall configuration of a modified example of the present invention.

[0019] An overview of one embodiment of the present invention (hereinafter referred to as the present embodiment) will be described below with reference to the drawings. Note that reference numerals in the drawings are assigned to each element for convenience as an example to facilitate understanding, and are not intended to limit the present invention to the illustrated form. Furthermore, connection lines between blocks in the drawings and the like referred to in the following description include both bidirectional and unidirectional lines. Unidirectional arrows are used to schematically indicate the flow of the main signal (data) and do not exclude bidirectionality.

[0020] In addition, although there are ports and interfaces at the connection points of input and output of each block in the figure, they are not shown. In the following explanation, "A and / or B" means either A or B, or A and B.

[0021] Before describing the embodiments of the present invention, an overview will be provided. In this embodiment, a server that performs authentication stores a hash value of the password instead of the password, and performs authentication using the hash value. In this embodiment, the server generates multiple different hash values ​​from a single password registered by a user and stores them. During authentication, two hash values ​​are similarly generated from the password sent by the user, and if both match the stored hash values, authentication is deemed successful.

[0022] A hash value is the value obtained by converting the original data using a hash function. A hash function is a one-way function (algorithm) that converts data (bit strings) of any length into data (bit strings) of a fixed length.

[0023] First, for comparison, a conventional method of registering a hash value instead of a password and performing authentication will be described. As shown in FIG. 1A, when pre-registering authentication information, a user transmits a user ID and password A to a server and requests registration. The user ID is information that uniquely identifies the user, such as a username. In response, the server hashes password A to generate hash value A. The server then registers hash value A in a database in association with the user ID, but does not register the password itself.

[0024] 2A, during authentication, the user requests authentication by sending the server their user ID and password A. The server generates a hash value A from the received password A, compares (collates) the user ID with the hash value A, and if they match, the authentication is successful.

[0025] This allows authentication to be performed using a combination of user ID and password, as long as the user manages the password. Furthermore, since the server does not store the password, the password will not be leaked even if the database is attacked.

[0026] However, it is vulnerable to attacks that try to guess the original value from the hash value. Also, encryption technology that uses hash functions converts the original text into a string of a fixed size regardless of the size of the original text, so that the same hash value can be output from different data, which is called a hash value collision. Therefore, it is also vulnerable to attacks that take advantage of this type of hash value collision.

[0027] Therefore, in this embodiment, as described above, multiple hash values ​​are generated from one password within the server and stored in association with each other.

[0028] Specifically, as shown in FIG. 1(b), when registering authentication information, the user transmits their user ID and password A to the server and requests registration, just as in the past. The server then hashes password A to generate hash value A. It then adds a predetermined character string X to password A to generate password B (B = A + X). The generated password B is then hashed to generate hash value B. The hash values ​​A and B are then registered in a database in association with the user ID, but the password itself is not registered.

[0029] As shown in Figure 2(b), during authentication, the user sends their user ID and password A to the server to request authentication, just as in the past. The server generates a hash value A from the received password A. It also adds a character string X to password A to generate password B (B = A + X), which is hashed to generate hash value B. The three pieces of data, the user ID, hash value A, and hash value B, are then compared (collated), and if they match, authentication is successful.

[0030] According to this embodiment, the server also compares password A sent by a user with hash value B, which is generated from password B by adding a predetermined character string X. For example, assume that character string C is a character string that generates the same hash value A as password A. The hash value of character string C plus character string X (X+C) is extremely unlikely to become hash value B. This provides an authentication system that is extremely resistant to attacks that exploit hash value collisions.

[0031] Furthermore, since the number of hash values ​​to be guessed doubles, the computational resources required for a guessing attack become enormous. Therefore, an authentication system that is strong against guessing attacks can be obtained.

[0032] Furthermore, according to this embodiment, the processing on the user side remains the same as in the past.

[0033] [Overall Configuration] Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings. Fig. 3 is a configuration diagram of an authentication system 100 of this embodiment. As shown in this figure, the authentication system 100 of this embodiment includes a user terminal 300 and an authentication server 200. Note that this figure illustrates an example in which three user terminals 300 are included, but the number of user terminals 300 is not limited to this.

[0034] The user terminal 300 receives authentication information from the user and transmits it to the authentication server 200 via the network 900. The authentication information is received at the time of registration and at the time of authentication request.

[0035] As shown in FIG. 3B, the authentication information 350 received by the user terminal 300 and transmitted to the authentication server 200 includes a user ID (User Identification) 351 and a password 352. The user ID 351 is information that uniquely identifies a user or the user terminal 300, and is a predetermined character string. In this embodiment, the user ID 351 may be set by an individual user, or may be assigned by the authentication server 200 or the like. The password 352 is information known only to the person who has the user ID 351, and entering it is data used to verify that the person is the person who has the user ID 351. The password 352 is also a predetermined character string.

[0036] As will be described later, for example, when registering authentication information, the user terminal 300 transmits a registration request to the authentication server 200, receives an authentication information input screen for registration (authentication information registration screen) from the authentication server 200, and accepts the user's input of authentication information 350 via that screen. Also, when requesting authentication, the user terminal 300 transmits an authentication request to the authentication server 200, receives an authentication information input screen for authentication from the authentication server 200, and accepts the user's input of authentication information 350 via that screen.

[0037] [Authentication Server] When the authentication server 200 is requested by the user terminal 300 to register the authentication information 350, it registers the registration information generated from the transmitted authentication information 350 in the authentication information database 260. Furthermore, when the user terminal 300 requests authentication, it compares the information generated from the transmitted authentication information 350 with the information registered in the authentication information database 260 and performs authentication.

[0038] 4A is a functional block diagram of the authentication server 200 according to this embodiment. As shown in this figure, the authentication server 200 according to this embodiment includes an authentication information receiving unit 210, an authentication information registration unit 220, an authentication information matching unit 230, a result output unit 240, and a hash value generation unit 250.

[0039] The authentication server 200 may also include an authentication information database 260 that stores the authentication information transmitted from the user terminal 300. The authentication information database 260 may be built in a dedicated database server connected to the authentication server 200 via a local network.

[0040] The authentication information receiving unit 210 receives authentication information 350 from the user terminal 300. Then, the received authentication information 350 is determined to be a request for registration or a request for authentication. If it is a request for registration, the information is passed to the authentication information registration unit 220, and if it is a request for authentication, the information is passed to the authentication information matching unit 230.

[0041] For example, when the authentication information receiving unit 210 of this embodiment receives an authentication information registration request from the user terminal 300, it transmits an authentication information registration screen stored in advance to the user terminal 300 that made the request. Then, when it receives authentication information 350 from the user terminal 300 via the authentication information registration screen, it determines that registration is being requested. Also, when it receives an authentication request from the user terminal 300, it transmits an authentication information input screen stored in advance to the user terminal 300 that made the request. Then, when it receives authentication information 350 from the user terminal 300 via the authentication information input screen, it determines that authentication is being requested.

[0042] The hash value generation unit 250 generates two types of hash values ​​from the password 352 included in the authentication information 350. In this embodiment, a first hash value and a second hash value are generated.

[0043] The first hash value is calculated by performing a first process, including hashing, on the password 352. In this embodiment, the first hash value is obtained by hashing the password 352 using a predetermined first hash function. The second hash value is calculated by performing a second process, including hashing, on the password 352. In this embodiment, a predetermined character string X is first added to the password 352 to generate a second password, and the generated second password is then hashed using a predetermined second hash function.

[0044] The first hash function and the second hash function may be, for example, SHA (Secure Hash Algorithm)-256, SHA-384, SHA-512, etc. The first hash function and the second hash function may be the same.

[0045] The position where the character string X is added does not matter. For example, as shown in FIG. 5( a), if the password 352 is "abcdefg" and the character string X is "opqrstu," the character string X may be added after the password 352 as shown in FIG. 5( b). Alternatively, the character string X may be added before the password 352 as shown in FIG. 5( c). Furthermore, the character string X may be inserted at a predetermined position. For example, the character string X may be inserted at the third bit from the front as shown in FIG. 5( d). The authentication server 200 stores rules regarding the addition position together with the character string X.

[0046] The authentication information registration unit 220 executes an authentication information registration process, which generates registration information from the authentication information 350 received from the authentication information reception unit 210 and registers the generated registration information in the authentication information database 260 as a new record.

[0047] The authentication information registration unit 220 causes the hash value generation unit 250 to generate a first hash value and a second hash value from the password 352 of the authentication information 350. The hash value is then associated with the user ID 351 and registered as registration information in the authentication information database 260.

[0048] 5( e) shows an example of a record 269 of registration information registered in the authentication information database 260. As shown in this figure, each record 269 includes a user ID 261, a first hash value 262, and a second hash value 263.

[0049] After generating the registration information, the authentication information registration unit 220 deletes the transmitted authentication information 350 within a predetermined time. After registration, the authentication information registration unit 220 may also transmit a registration completion notification to the user terminal 300 that is the sender.

[0050] The authentication information matching unit 230 executes authentication processing by generating matching information from the authentication information 350 received from the authentication information receiving unit 210 and comparing (matching) the generated matching information with registered information registered in the authentication information database 260.

[0051] When the authentication information matching unit 230 receives the authentication information 350, it causes the hash value generation unit 250 to generate a first hash value and a second hash value from the password 352, and uses these values ​​as matching information. The authentication information matching unit 230 then compares the matching information with the registered information. Here, the generated first hash value and second hash value are compared with the first hash value 262 and the second hash value 263 of the registered information record 269 in the authentication information database 260, which has a user ID 261 that matches the user ID 351 of the authentication information 350.

[0052] If both the first hash value and the second hash value match, the authentication information matching unit 230 determines that the authentication is successful. On the other hand, if either one does not match, the authentication is determined to be unsuccessful. The authentication result is output to the result output unit 240. After generating the matching information, the authentication information matching unit 230 also deletes the authentication information 350 sent within a predetermined time.

[0053] The result output unit 240 transmits the matching result obtained by the authentication information matching unit 230 to the requesting user terminal 300. When another process is executed based on the authentication, the result of the authentication may be notified to the executing unit of the process.

[0054] 6A shows an example of an authentication information registration screen 410 that the authentication information receiving unit 210 presents to the user terminal 300. As shown in this figure, the authentication information registration screen 410 includes a user ID input area 411, a password input area 412, and a transmission instruction area (OK button) 413.

[0055] The user inputs a user ID via the user ID input area 411 and a password via the password input area 412. Then, a transmission instruction is issued by pressing the OK button in the transmission instruction area 413. In response to this, the user terminal 300 transmits a registration request together with the authentication information 350 to the authentication server 200.

[0056] 6B shows an example of an authentication information input screen 420 that the authentication information receiving unit 210 presents to the user terminal 300. Similar to the authentication information registration screen 410, the authentication information input screen 420 includes a user ID input area 421, a password input area 422, and a transmission instruction area (OK button) 423.

[0057] The user inputs a user ID via the user ID input area 421 and a password via the password input area 422. Then, a transmission instruction is issued by pressing the OK button in the transmission instruction area 423. In response to this, the user terminal 300 transmits an authentication request together with the authentication information 350 to the authentication server 200.

[0058] [Processing at the Time of Authentication Information Registration Request] Here, a description will be given of data transmission and reception between the user terminal 300 and the authentication server 200 when requesting pre-registration of authentication information. Fig. 7A shows the processing flow at the time of pre-registration request.

[0059] The user terminal 300 transmits an authentication information registration request to the authentication server 200 (step S1101). The authentication server 200 presents an authentication information registration screen 410 to the user terminal 300 that sent the request (step S1102). For example, the screen data stored in the authentication server 200 may be displayed in a specified layout on the web browser of the user terminal 300.

[0060] When the user terminal 300 receives the input of authentication information via the authentication information registration screen 410 (step S1103), the user terminal 300 transmits the received authentication information 350 to the authentication server 200 (step S1104).

[0061] The authentication server 200 performs authentication information registration processing on the authentication information 350 (step S1105), and then ends the processing. Details of the authentication information registration processing will be described later. Note that, when the registration is completed, the authentication server 200 may send a registration completion notification to the user terminal 300.

[0062] [Processing at the Time of Authentication Request] Next, a description will be given of data transmission and reception between the user terminal 300 and the authentication server 200 when requesting authentication. Fig. 7B shows the processing flow at the time of authentication request.

[0063] The user terminal 300 transmits an authentication request to the authentication server 200 (step S1201). The authentication server 200 presents an authentication information input screen 420 to the user terminal 300 that sent the request (step S1202). For example, the screen data stored in the authentication server 200 may be displayed in a specified layout on the web browser of the user terminal 300.

[0064] When the user terminal 300 receives the input of authentication information via the authentication information input screen 420 (step S1203), the user terminal 300 transmits the received authentication information 350 to the authentication server 200 (step S1204).

[0065] The authentication server 200 performs authentication processing on the authentication information 350 (step S1205), notifies the user terminal 300 of the authentication result (step S1206), and terminates the processing. Details of the authentication processing will be described later.

[0066] [Authentication Information Registration Processing] Here, the flow of the authentication information registration processing in step S1105 performed by the authentication server 200 will be described. The authentication information registration processing is mainly performed by the authentication information registration unit 220 of the authentication server 200. Fig. 8 shows the processing flow of the authentication information registration processing of this embodiment. This processing is started when the authentication information 350 is received from the authentication information receiving unit 210.

[0067] Hereinafter, to distinguish it from the authentication information 350 sent during the authentication process described below, it will be referred to as registered authentication information 350, and the information contained therein will be referred to as a registered user ID 351 and a registered password 352. The generated hash values ​​will also be referred to as a first registered hash value 262 and a second registered hash value 263, respectively.

[0068] The authentication information registration unit 220 first determines whether a record 269 having the same user ID as the registered user ID 351 of the registered authentication information 350 has already been registered in the authentication information database 260 (step S1301).

[0069] If it is determined that the password is not registered, the authentication information registration unit 220 causes the hash value generation unit 250 to generate a first registered hash value 262 and a second registered hash value 263. Specifically, the hash value generation unit 250 first adds a character string X to the registered password 352 to generate a second registered password (step S1302).Then, the hash value generation unit 250 generates the first registered hash value 262 from the registered password 352 and the second registered hash value 263 from the second registered password (step S1303).

[0070] The authentication information registration unit 220 stores the registered user ID 351 as the registered user ID 261, in association with the first registered hash value 262 and the second registered hash value 263, in the authentication information database 260 (step S1304).

[0071] The authentication information registration unit 220 erases the registered password 352 and the second registered password (step S1305), and ends the process.

[0072] If it is determined in step S1301 that the information has been registered, the authentication information registration unit 220 notifies the user terminal 300 that sent the information (step S1311), erases the registered password 352 (step S1312), and terminates the processing.

[0073] [Authentication Processing] Here, the flow of the authentication processing in step S1205 performed by the authentication server 200 will be described. The authentication processing is mainly performed by the authentication information matching unit 230 of the authentication server 200. Figure 9 shows the processing flow of the authentication processing in this embodiment. This processing is initiated when authentication information 350 is received from the authentication information receiving unit 210. Hereinafter, as described above, the term "matching" will be added and these will be referred to as the matching authentication information 350, the matching user ID 351, 261, the matching password 352, the first matching hash value, and the second matching hash value.

[0074] The authentication information matching unit 230 first determines whether a record 269 having the same user ID as the matching user ID 351 of the authentication information 350 is registered in the authentication information database 260 (step S1401).

[0075] If the password is registered, the authentication information matching unit 230 causes the hash value generation unit 250 to generate a first matching hash value and a second matching hash value. Specifically, the hash value generation unit 250 first adds the character string X to the matching password 352 to generate a second matching password (step S1402). The hash value generation unit 250 then generates a first matching hash value from the matching password 352 and a second matching hash value from the second matching password (step S1403).

[0076] The authentication information matching unit 230 compares the calculated first matching hash value with the first registered hash value 262 of the record 269 having the same user ID as the matching user ID 351, and compares the calculated second matching hash value with the second registered hash value 263 of the same record 269 (step S1404).

[0077] The authentication information matching unit 230 determines whether the first matching hash value and the second matching hash value match the first registered hash value 262 and the second registered hash value 263, respectively (step S1405). If they match, it determines that the authentication has been successful and notifies the result output unit 240 of this success (step S1406). Then, it erases the matching password 352 and the second password (step S1408), and ends the process.

[0078] If any one of the information does not match in step S1405, the authentication information matching unit 230 determines that the authentication has failed, notifies the result output unit 240 of the authentication failure (step S1407), and proceeds to step S1408.

[0079] If it is determined in step S1401 that the user ID 351 is not registered, the authentication information matching unit 230 notifies the result output unit 240 that the user ID 351 is not registered (step S1411), erases the matching password 352 from the transmitted matching authentication information 350 (step S1412), and ends the process.

[0080] [Hardware Configuration] The following describes the hardware configuration of the authentication server 200 of this embodiment. The authentication server 200 of this embodiment can be realized by a so-called general-purpose information processing device (computer).

[0081] As shown in FIG. 4B, the authentication server 200 of this embodiment includes, for example, a CPU (Central Processing Unit) 291, a main storage device (memory) 292, an auxiliary storage device 293, a communication I / F 294, and an expansion I / F 295, which are interconnected by an internal bus.

[0082] The CPU 291, for example, loads a program stored in the auxiliary storage device 293 into the main storage device 292 and executes it, thereby realizing the above-mentioned functions and comprehensively controlling the entire authentication server 200. Note that one or more processors such as an MPU (Micro Processing Unit) may be used instead of the CPU 291.

[0083] The main storage device 292 is a memory such as a RAM (Random Access Memory), and is a work area used by the CPU 291 when the CPU 291 processes programs executed by the authentication server 200.

[0084] The auxiliary storage device 293 is, for example, a read-only memory (ROM), a hard disk drive (HDD), or a solid state drive (SSD). The auxiliary storage device 293 stores various programs executed by the information exchange device. The auxiliary storage device 293 may include storage media such as a flexible disk, a hard disk, an optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile memory card, or a DVD.

[0085] The programs stored in the auxiliary storage device 293 can be provided as program products recorded on a non-transitory computer-readable storage medium. The auxiliary storage device 293 can be used to store various programs recorded on the non-transitory computer-readable storage medium for the medium to long term.

[0086] The communication I / F 294 transmits and receives signals and data via a wired or wireless connection. The communication I / F 294 may include, for example, a network interface card (NIC). In this embodiment, the user terminal 300 may be connected via the communication I / F 294.

[0087] The expansion I / F 295 is an interface for connecting a display device, an input device, etc. The display device is, for example, a liquid crystal monitor, etc. The input device is, for example, a device that accepts user operations, such as a keyboard or a mouse.

[0088] Each of the above functions of the authentication server 200 of this embodiment is realized by the CPU 291 loading a program stored in the auxiliary storage device 293 into the main storage device 292 and executing the program.

[0089] Furthermore, the information managed by the authentication server 200 may be stored in the auxiliary storage device 293. Furthermore, data generated during processing is stored in the main storage device 292 or the auxiliary storage device 293.

[0090] The hardware configuration of the authentication server 200 is not limited to this, and may include hardware not shown.

[0091] In addition, a program for realizing the above-described functions of the authentication server 200 of this embodiment can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product.

[0092] The user terminal 300 includes at least a processing unit such as a CPU, a storage device such as a memory, and a communication interface. As with the authentication server 200, the above functions are realized by the processing unit loading programs stored in the storage device into its work area and executing them. Various types of information (data) are also stored in the storage device.

[0093] As described above, the authentication server 200 of this embodiment includes an authentication information registration unit 220 that generates registration information from authentication information 350 received together with a registration request and registers the registration information in the authentication information database 260, an authentication information matching unit 230 that generates matching information from the authentication information 350 received together with the authentication request and matches the matching information with the registration information registered in the authentication information database 260, a result output unit 240 that outputs the matching result, and a hash value generation unit 250 that generates a hash value from a password 352. The authentication information 350 includes a user identifier (user ID 351) and the password 352.

[0094] In addition, the hash value generation unit 250 performs a first process, including hashing, on the password 352 to calculate a first hash value, and also performs a second process, including hashing and different from the first process, on the password 352 to calculate a second hash value.

[0095] The authentication information registration unit 220 causes the hash value generation unit 250 to generate the first hash value and the second hash value from the password 352 included in the authentication information 350 received along with the registration request, and registers them as the first registered hash value and the second registered hash value, respectively, in the authentication information database 260 as the registration information together with the user ID 351 included in the authentication information 350.

[0096] Then, the authentication information matching unit 230 causes the hash value generation unit 250 to generate the first hash value and the second hash value from the password 352 included in the authentication information 350 received along with the authentication request, and sets these as the first matching hash value and the second matching hash value of the matching information, respectively.If the first registered hash value of the registration information having a user ID 261 that matches the user ID 351 included in the authentication information 350 matches the first matching hash value, and the second registered hash value of the registration information matches the second matching hash value, the matching result is considered to be authentication success.

[0097] Therefore, the authentication server 200 of this embodiment is resistant to attacks that use the collision characteristics of hash values. Furthermore, since the number of hash values ​​to be guessed is doubled, it is also robust against guessing attacks. Furthermore, as with conventional methods, the user only needs to enter a user ID and one password, so the burden on the user is not increased.

[0098] Therefore, according to this embodiment, it is possible to improve the security of passwords without increasing the burden on the user.

[0099] Furthermore, according to this embodiment, as described above, there is resistance to attacks due to collisions of hash values, making it possible to use a hash function that is less difficult to detect collisions, thereby reducing the calculation load on the CPU, etc.

[0100] <Variation 1> In the above embodiment, one character string X is prepared and added to the password 352 to generate a second hash value, but the number of character strings prepared is not limited to one. For example, multiple character strings may be prepared, each added to the password 352, and a hash value may be generated from each of them. In this case, additional hash values ​​are generated for each of the prepared character strings.

[0101] This further increases the probability of collision avoidance and also improves the effectiveness of preventing eavesdropping, further improving safety.

[0102] <Modification 2> Furthermore, multiple different hash values ​​may be calculated by changing the position at which the same character string X is added to the password 352. For example, character string X may be added to the end of password 352 to generate a second password, and the same character string X may be added to the beginning of password 352 to generate a third password. Hash values ​​may then be generated from each of these and registered in the authentication information database 260 as registration information.

[0103] <Variation 3> Furthermore, if the number of hash values ​​registered as registration information is three or more, authentication may be performed using a hash value less than the number of registered hash values. For example, as described above, even if three or more hash values ​​are registered as registration information, two hash values ​​may be generated during authentication. In this case, if all of the hash values ​​generated during authentication are included in the registration information, authentication is deemed successful. This reduces the processing load during authentication while maintaining the same level of security.

[0104] <Modification 4> In the present embodiment, the same character string X is added to the password 352 of all the authentication information 350 to generate the second password, but this is not limiting. For example, the character string X to be added may be different for each user.

[0105] In this case, the character string to be added does not have to be one prepared in advance. For example, the character string to be added may be a hash value calculated from the password 352 or a character string obtained by extracting a predetermined bit from the hash value. Alternatively, a hash value may be calculated from the user ID 351, and the character string to be added may be the hash value or a character string obtained by extracting a predetermined bit from the hash value.

[0106] <Variation 5> In the above embodiment, the second password is generated by adding the character string X to the password 352, and the second hash value 263 is generated from the second password. However, the method of generating the second password by modifying the password 352 is not limited to adding the character string X. Anything that can be generated from the password 352 and that is likely to produce a hash value different from the password 352 may be generated. For example, the second password may be generated by removing predetermined bits from the password 352. Alternatively, the second password may be generated by performing predetermined processing on the password 352.

[0107] <Variation 6> In the above embodiment, hash values ​​are calculated directly from the password 352 and the second password obtained by adding a prepared character string X to the password 352, but this is not limiting. For example, a salt (a data string of any length) may be added to at least one of the password 352 and the second password. The salt may be added before or after the password. It may also be added to a predetermined bit position in the middle of the password. Furthermore, an existing stretching method may be applied when calculating a hash value from the password 352 and the second password. The stretching method may be applied to at least one of the first process and the second process. This further enhances security.

[0108] <Variation 7> In the above embodiment, the authentication server 200 is described as being realized by a single server device, but this is not limited to this. Each function may be an independent device as long as it is capable of data communication. For example, as shown in FIG. 10 , the authentication server 200 may be realized by an authentication system 101 including an authentication information registration device 201 that performs authentication information registration processing, an authentication information matching device 202 that performs authentication processing, and a database server 203 that has an authentication information database 260.

[0109] In the flowcharts used in the above explanation, multiple steps (processes) are described in order, but the order in which each step is performed is not limited to the order described. For example, the order of the steps shown in the drawings can be changed to the extent that the content is not affected, such as by performing each process in parallel.

[0110] In addition, the programs stored in the auxiliary storage device 293 of the authentication server 200 can be provided as program products recorded on a non-transitory computer-readable storage medium, which can be used to store various programs recorded on a non-transitory computer-readable storage medium for the medium to long term.

[0111] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and further modifications, substitutions, and adjustments can be made without departing from the basic technical concept of the present invention. For example, the network configurations and the configurations of the elements shown in the drawings are examples to aid in understanding the present invention, and the present invention is not limited to the configurations shown in these drawings.

[0112] Some or all of the above-described embodiments and modified examples can be described as, but are not limited to, the following supplementary embodiments. an authentication information registration unit that, upon receiving authentication information including a user identifier and a password together with a registration request, performs a first process including hashing on the password to generate a first registered hash value, and performs a second process including hashing different from the first process on the password to generate a second registered hash value, and registers the first registered hash value and the second registered hash value as registration information in a database by associating the user identifier as a registered user identifier with the registered user identifier; and an authentication information matching unit that, upon receiving authentication information including a user identifier and a password together with an authentication request, performs the first process on the password to generate a first verification hash value, and performs the second process on the password to generate a second verification hash value, and determines whether the first verification hash value matches the first registered hash value and whether the second verification hash value matches the second registered hash value of the registration information having the registered user identifier that matches the user identifier received along with the authentication request, and determines that the authentication is successful if both the first verification hash value and the second verification hash value match. (Supplementary Note 2) In the authentication server described in Supplementary Note 1, it is preferable that the first process is a process of hashing the password with a first hash function, and the second process is a process of transforming the password to generate a second password and hashing the second password with a second hash function. (Supplementary Note 3) In the authentication server described in Supplementary Note 2, it is preferable that the transformation of the password is a process of adding a predetermined character string to the password. (Supplementary Note 4) In the authentication server described in Supplementary Note 3, it is preferable that the character string is prepared for each user identifier. (Supplementary Note 5) In the authentication server described in any of Supplements 2 to 4, it is preferable that the first hash function and the second hash function are the same.(Supplementary Note 6) In the authentication server described in any of Supplements 1 to 5, it is desirable that at least one of the first process and the second process add a salt, which is a data string of any length, to the password prior to hashing. (Supplementary Note 7) In the authentication server described in any of Supplements 1 to 6, it is desirable that at least one of the first process and the second process executes hashing of the password multiple times. (Supplementary Note 8) A system comprising: a database for storing registration information; an authentication information registration device for generating the registration information from authentication information including a registered user identifier and a registered password and registering the registration information in the database; and an authentication information matching device for generating matching information from authentication information including a matching user identifier and a matching password, matching the matching information with the registration information, and outputting a matching result, wherein the registration information includes the registered user identifier, a first registered hash value, and a second registered hash value, wherein the first registered hash value is a value obtained by applying a first process including hashing to the registered password, and the second registered hash value is a value obtained by applying a second process including hashing to the registered password that is different from the first process, and the matching information includes the matching user identifier, the first matching hash value, and a second matching hash value, wherein the first matching hash value is a value obtained by applying the first process to the matching password, and the second matching hash value is a value obtained by applying the second process to the matching password, The authentication information matching device determines the matching result to be successful authentication if the first registered hash value of the registration information having the registered user identifier that matches the matching user identifier matches the first matching hash value, and the second registered hash value of the registration information matches the second matching hash value.(Supplementary Note 9) An authentication method by an authentication server, comprising: upon receiving authentication information including a registered user identifier and a registered password, performing a first process including hashing on the registered password to generate a first registered hash value, and performing a second process including hashing different from the first process on the registered password to generate a second registered hash value; registering the first registered hash value and the second registered hash value in a database in association with the registered user identifier; upon receiving authentication information including a matching user identifier and a matching password, performing the first process on the matching password to generate a first matching hash value, and performing the second process on the matching password to generate a second matching hash value; determining whether the first matching hash value matches the first registered hash value of the registration information having the registered user identifier that matches the matching user identifier, and whether the second matching hash value matches the second registered hash value; and determining that the authentication is successful if both the first matching hash value and the second matching hash value match.(Supplementary Note 10) A program for causing a computer to function as: means for, upon receiving authentication information including a registered user identifier and a registered password, performing a first process including hashing on the registered password to generate a first registered hash value, and performing a second process including hashing different from the first process on the registered password to generate a second registered hash value, and registering the first registered hash value and the second registered hash value in a database as registration information in association with the registered user identifier; and means for, upon receiving authentication information including a matching user identifier and a matching password, performing the first process on the matching password to generate a first matching hash value, and performing the second process on the matching password to generate a second matching hash value, determining whether the first matching hash value matches the first registered hash value of the registration information having the registered user identifier that matches the matching user identifier, and whether the second matching hash value matches the second registered hash value, and determining that authentication is successful if both the first matching hash value and the second matching hash value match. In addition, each of the forms of Supplementary Notes 8-10 can be expanded into the forms of Supplementary Notes 2-7 in the same way as the form of Supplementary Note 1.

[0113] The disclosures of the above-mentioned patent documents and other documents are incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the scope of the claims), and further based on the basic technical concept thereof. Furthermore, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible within the scope of the disclosure of the present invention. In other words, the present invention naturally includes various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure, including the scope of the claims, and the technical concept thereof. In particular, with regard to the numerical ranges described herein, any numerical value or subrange included within the range should be construed as being specifically described, even if not otherwise specified.

[0114] 100: Authentication system, 101: Authentication system, 200: Authentication server, 201: Authentication information registration device, 202: Authentication information matching device, 203: Database server, 210: Authentication information reception unit, 220: Authentication information registration unit, 230: Authentication information matching unit, 240: Result output unit, 250: Hash value generation unit, 260: Authentication information database, 261: User ID, registered user ID, matching user ID, 262: First hash value, first registered hash value, 263: Second hash value, second registered hash value, 269: Record, 291: CPU, 292: Main storage device, 293: Auxiliary storage device, 294: Communication I / F, 295: Expansion I / F, 300: User terminal, 350: Authentication information, registered authentication information, matching authentication information, 351: User ID, registered user ID, matching user ID, 352: Password, registered password, matching password, 410: Authentication information registration screen, 411: User ID input area, 412: Password input area, 413: Transmission instruction area, 420: Authentication information input screen, 421: User ID input area, 422: Password input area, 423: Transmission instruction area, 900: Network

Claims

1. When authentication information including a user identifier and a password is received together with a registration request, performing a first process including hashing on the password to generate a first registered hash value, and performing a second process including hashing and different from the first process on the password to generate a second registered hash value; an authentication information registration unit that registers the first registered hash value and the second registered hash value as registration information in a database in association with the user identifier as a registered user identifier; When authentication information including a user identifier and a password is received together with an authentication request, performing the first process on the password to generate a first verification hash value and performing the second process on the password to generate a second verification hash value; determining whether the first verification hash value matches the first registered hash value and whether the second verification hash value matches the second registered hash value of the registration information having the registered user identifier that matches the user identifier received together with the authentication request; an authentication information matching unit that determines that the authentication is successful when both the first matching hash value and the second matching hash value match.

2. 2. The authentication server according to claim 1, the first processing is processing of hashing the password using a first hash function, The second processing is processing of transforming the password to generate a second password and hashing the second password with a second hash function.

3. 3. The authentication server according to claim 2, The authentication server, wherein the password transformation is a process of adding a predetermined character string to the password.

4. 4. The authentication server according to claim 3, The character string is prepared for each user identifier. An authentication server.

5. 5. The authentication server according to claim 2, wherein: The authentication server, wherein the first hash function and the second hash function are the same.

6. An authentication server according to claim 1, In at least one of the first process and the second process, a salt, which is a data string of an arbitrary length, is added to the password prior to hashing.

7. An authentication server according to claim 1, At least one of the first process and the second process performs hashing of the password multiple times.

8. a database for holding registration information; an authentication information registration device that generates registration information from authentication information including a registration user identifier and a registration password and registers the registration information in the database; an authentication information verification device that generates verification information from authentication information including a verification user identifier and a verification password, collates the information with the registered information, and outputs a verification result; the registration information includes the registered user identifier, a first registered hash value, and a second registered hash value; the first registered hash value is a value obtained by performing a first process including hashing on the registered password, the second registered hash value is a value obtained by subjecting the registered password to a second process, which includes hashing and is different from the first process, the verification information includes the verification user identifier, a first verification hash value, and a second verification hash value; the first verification hash value is a value obtained by performing the first process on the verification password, the second verification hash value is a value obtained by performing the second processing on the verification password, The authentication information matching device determines the matching result to be successful authentication if the first registered hash value of the registration information having the registered user identifier that matches the matching user identifier matches the first matching hash value, and the second registered hash value of the registration information matches the second matching hash value.

9. An authentication method by an authentication server, comprising: When authentication information including a registered user identifier and a registered password is received, performing a first process including hashing on the registered password to generate a first registered hash value, and performing a second process including hashing and different from the first process on the registered password to generate a second registered hash value; registering the first registered hash value and the second registered hash value in a database as registration information in association with the registered user identifier; When authentication information including a verification user identifier and a verification password is received, performing the first process on the verification password to generate a first verification hash value, and performing the second process on the verification password to generate a second verification hash value; determining whether the first verification hash value matches the first registered hash value of the registration information having the registered user identifier that matches the verification user identifier, and whether the second verification hash value matches the second registered hash value of the registration information; An authentication method using an authentication server, in which if both the first verification hash value and the second verification hash value match, it is determined that the authentication is successful.

10. Computer, When authentication information including a registered user identifier and a registered password is received, performing a first process including hashing on the registered password to generate a first registered hash value, and performing a second process including hashing and different from the first process on the registered password to generate a second registered hash value; a means for registering the first registered hash value and the second registered hash value as registration information in a database in association with the registered user identifier; When authentication information including a verification user identifier and a verification password is received, performing the first process on the verification password to generate a first verification hash value, and performing the second process on the verification password to generate a second verification hash value; determining whether the first verification hash value matches the first registered hash value of the registration information having the registered user identifier that matches the verification user identifier, and whether the second verification hash value matches the second registered hash value of the registration information; a program for functioning as a means for determining that authentication has been successful when the first verification hash value and the second verification hash value both match;