Authentication code generation device, authentication code generation method, and authentication code generation program

Abstract

This authentication code generation device comprises: a preservation unit for preserving data relating to a transmitted / received message when sequentially transmitting and receiving a plurality of messages to and from another device; an extraction unit for extracting the data relating to the preserved transmitted / received message when transmitting or receiving a new message to or from the other device; and a computation unit for accepting, as input, a data string in which the data relating to the new message and the extracted transmitted / received messages are concatenated, and calculating a message authentication code to be added to the new message by using a prescribed computation.

Description

Authentication code generation device, authentication code generation method, and authentication code generation program

[0001] The present invention relates to a technique for generating a message authentication code. This application claims priority to Japanese Patent Application No. 2023-110739, filed on July 5, 2023, the contents of which are incorporated herein by reference.

[0002] When a key is shared between a sender and a receiver, a Message Authentication Code (MAC) has conventionally been used as a technology for detecting tampering of a message being sent and received and authenticating the integrity of the message. A MAC is generated by receiving a common key and a message to be authenticated as input and performing a predetermined calculation. The sender adds this MAC to the message, and a receiver who has the common key compares it with a MAC similarly generated, thereby detecting message tampering. For example, Non-Patent Document 1 proposes a generation algorithm using a keyed hash function.

[0003] Dang, Q. (2008), The Keyed-Hash Message Authentication Code (HMAC), Federal Information Processing Standards Publication 198-1, National Institute of Standards and Technology.

[0004] Since the security of a MAC also depends on the data length of the MAC, it is necessary to determine an appropriate length depending on the level of security required. However, if a MAC of sufficient length cannot be ensured due to protocol constraints or the like, it may be possible to tamper with a message with a realistic amount of calculation even when a secure MAC generation method is used.

[0005] An object of the present invention is to provide an authentication code generation device, an authentication code generation method, and an authentication code generation program that make it more difficult to tamper with messages.

[0006] The authentication code generation device of the present invention includes a storage unit that stores data related to messages that have already been sent and received when multiple messages are sent and received sequentially with another device; an extraction unit that extracts the stored data related to the sent and received messages when a new message is sent and received with the other device; and a calculation unit that receives as input a data string that concatenates the new message and the extracted data related to the sent and received messages, and calculates, through a predetermined calculation, a message authentication code to be assigned to the new message.

[0007] The data relating to the sent or received message may be the message itself.

[0008] The data relating to the sent or received message may be the message authentication code added to the message.

[0009] The extraction unit may extract a maximum number of data items not exceeding a predetermined number from the most recent data items among the stored data items relating to the sent and received messages.

[0010] The authentication code generation method of the present invention is carried out by a computer, and includes the following steps: a storage step of storing data related to messages that have already been sent and received when multiple messages are sent and received sequentially with another device; an extraction step of extracting stored data related to the sent and received messages when a new message is sent and received with the other device; and a calculation step of calculating a message authentication code to be assigned to the new message by performing a predetermined calculation using as input a data string that concatenates the new message and the extracted data related to the sent and received messages.

[0011] An authentication code generation program according to the present invention is for causing a computer to function as the authentication code generation device.

[0012] According to the present invention, it becomes difficult to tamper with a message, and tampering can be detected appropriately.

[0013] It is a block diagram showing the functional configuration of an authentication code generation device in an embodiment.It is a sequence diagram showing an example of a procedure for transmitting and receiving a message between devices in an embodiment.

[0014] The present invention will be described below by way of examples of embodiments 1 to 3. In these embodiments, the method of generating a message authentication code assigned to each piece of data (message) is improved from conventional methods in order to improve the integrity of data transmitted and received between communication devices.

[0015] [First Embodiment] FIG. 1 is a diagram showing the functional configuration of an authentication code generation device 1 according to this embodiment. The authentication code generation device 1 includes a control unit 11 and a storage unit 12. The authentication code generation device 1 is an information processing device (computer) equipped with various communication devices. The authentication code generation device 1 may be a general-purpose device such as a server or a personal computer, or may be small hardware such as a mobile terminal or an IoT device. The authentication code generation device 1 is incorporated into each device that transmits and receives messages, but may also be a separate device connected to the device for communication. Furthermore, the authentication code generation device 1 may be configured as an authenticated encryption system in combination with a predetermined encryption method.

[0016] The control unit 11 controls the entire authentication code generation device 1. The control unit 11 realizes each function of this embodiment by appropriately reading and executing various programs stored in the storage unit 12. The control unit 11 may be a CPU. The storage unit 12 is a storage area for various programs and various data for causing the hardware group to function as the authentication code generation device 1. The storage unit 12 may be a ROM, RAM, flash memory, hard disk drive (HDD), etc.

[0017] The authentication code generation device 1 may be configured such that the control unit 11 executes an authentication code generation program stored in the storage unit 12. Furthermore, the control unit 11 and the storage unit 12 may be implemented as hardware circuits dedicated to the authentication code generation device 1.

[0018] The control unit 11 includes a storage unit 111, an extraction unit 112, and a calculation unit 113. The control unit 11 generates a message authentication code for the input common key and message to be authenticated and outputs the generated message authentication code.

[0019] When multiple messages are sequentially transmitted and received between the storage unit 111 and another communication device, the storage unit 111 stores data relating to the transmitted and received messages in the storage unit 12. Here, the data relating to the transmitted and received messages may be the messages themselves, or may be data on which a common operation (such as a hash operation) is performed for both the transmission and reception.

[0020] When a new message is transmitted or received with another device that is a communication partner, the extraction unit 112 extracts data relating to messages that have already been transmitted or received and stored in the storage unit 12 .

[0021] The calculation unit 113 receives as input a data string that concatenates the new message and the extracted data related to the sent and received messages, along with the common key, and performs a predetermined calculation to calculate a message authentication code to be assigned to the new message.

[0022] Specifically, the calculation unit 113 continuously exchanges messages (m １ , m ２ , ...), by including past messages in the MAC calculation, one message m ｉ is used for multiple MAC calculations as follows: Ｋ＿ＭＡＣ () is a MAC generation algorithm configured using a hash function or a block encryption algorithm, and a common secret key K_MAC is used for both transmission and reception. Ｋ＿ＭＡＣ (m １ ) (1) H Ｋ＿ＭＡＣ (m １ ∥m ２ ) (2) H Ｋ＿ＭＡＣ (m １ ∥m ２ ∥m ３ ) (3) H Ｋ＿ＭＡＣ (m １ ∥m ２ ∥m３ ∥m ４ ) (4) H Ｋ＿ＭＡＣ (m １ ∥m ２ ∥m ３ ∥m ４ ∥m ５ ) (5)

[0023] 2 is a sequence diagram illustrating a procedure for transmitting and receiving messages between devices in this embodiment. It is assumed that device A (Alice) and device B (Bob) share in advance a secret key K_MAC to be used for MAC calculation.

[0024] First, Alice sends the first message m １ When sending m １ As a MAC for Ｋ＿ＭＡＣ (m １ ) is calculated. Then, the message m １ Let m be the response from Bob to Alice. ２ Then, Bob is m ２ As a MAC for Ｋ＿ＭＡＣ (m １ ∥m ２ ) is calculated. ３ , m ４ , ... are sent and received, and each message m ｉ The MAC to be assigned to Ｋ＿ＭＡＣ (m １ ∥m ２ ∥…∥m ｉ ) is calculated as follows.

[0025] Although the example shown here illustrates a case where two parties, Alice and Bob, alternately send messages, this embodiment can be applied to sending and receiving messages in any order, such as when multiple messages are sent sequentially from one device (terminal) to another device (server).

[0026] [Second embodiment] In the first embodiment, the message m ｉ When sending a message, all messages m １ , …, m ｉ－１When using the above for MAC calculation, the authentication code generation device 1 needs to store all messages.

[0027] In the second embodiment, the authentication code generation device 1 uses only messages from a certain period (number of times) in the past. That is, the extraction unit 112 extracts the maximum number of messages, starting from the most recent message, that do not exceed a predetermined number from the data related to sent and received messages stored in the storage unit 12.

[0028] For example, if the most recent five messages including the newly transmitted message are used, the calculation unit 113 calculates the new message m ｉ (i≧5) is assigned a MAC by H Ｋ＿ＭＡＣ (m ｉ－４ ∥m ｉ－３ ∥…∥m ｉ ) is calculated as follows.

[0029] In the third embodiment, data related to transmitted and received messages stored in the storage unit 111 differs from those in the first and second embodiments. That is, instead of the messages themselves, MACs assigned to transmitted and received messages are stored and used to generate MACs for new messages.

[0030] Specifically, the calculation unit 113 calculates a new message m ｉ (i≧2) is assigned a MAC by H Ｋ＿ＭＡＣ (H Ｋ＿ＭＡＣ (m ｉ－１ )∥m ｉ Here, only the MAC assigned to the previous message is concatenated to the new message, but this is not limiting, and multiple MACs from the past may be concatenated, as in the second embodiment.

[0031] According to the above-described embodiment, when the authentication code generation device 1 sequentially transmits and receives multiple messages to and from another device, it stores data related to the previously transmitted and received messages. When transmitting or receiving a new message, the authentication code generation device 1 calculates a MAC from a data string that combines the stored data related to the previously transmitted and received messages with the new message. Therefore, the authentication code generation device 1 calculates a MAC from input that includes previously transmitted and received messages, enabling tampering detection for multiple messages. Furthermore, by performing MAC calculations multiple times for one message, an effect similar to that achieved by extending the MAC length can be achieved.

[0032] That is, even if an attacker manages to tamper with a message at a certain timing, the attacker must continue to tamper with subsequent messages so as not to change the subsequent MACs, making tampering extremely difficult.

[0033] The authentication code generation device 1 may retain previously transmitted and received messages and use them as the MAC to be assigned to a new message, or may use the generated MAC instead of the message itself. This allows the authentication code generation device 1 to generate a new MAC based on a past message while saving storage space by using a MAC that is usually shorter than the message itself. Furthermore, by concatenating only one past MAC, capacity and processing load can be reduced. Even when the authentication code generation device 1 stores and concatenates messages themselves, capacity and processing load can be reduced by limiting the number of messages.

[0034] The above-described embodiment makes it difficult to tamper with messages, thereby improving the integrity of transmitted and received messages. Therefore, the above-described embodiment can contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0035] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0036] The authentication code generation method by the authentication code generation device 1 is realized by software. When realized by software, the programs constituting this software are installed on an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded.

[0037] REFERENCE SIGNS LIST 1 authentication code generation device 11 control unit 12 storage unit 111 saving unit 112 extraction unit 113 calculation unit

Claims

1. An authentication code generation device comprising: a storage unit that stores data related to messages that have already been sent and received when multiple messages are sent and received sequentially with another device; an extraction unit that extracts the stored data related to the sent and received messages when a new message is sent and received with the other device; and a calculation unit that uses as input a data string that concatenates the new message and the extracted data related to the sent and received messages, and calculates a message authentication code to be assigned to the new message through a predetermined calculation.

2. The authentication code generating device according to claim 1, wherein the data relating to the sent or received message is the message itself.

3. The authentication code generating device according to claim 1, wherein the data relating to the sent or received message is the message authentication code added to the message.

4. An authentication code generating device according to any one of claims 1 to 3, wherein the extraction unit extracts a maximum number of stored data relating to the sent and received messages, the maximum number not exceeding a predetermined number, starting from the most recent message.

5. A method for generating an authentication code, the method comprising: a storage step for storing data relating to messages that have already been sent or received when multiple messages are sent or received sequentially with another device; an extraction step for extracting the stored data relating to the sent or received messages when a new message is sent or received with the other device; and a calculation step for calculating, by a predetermined calculation, a message authentication code to be assigned to the new message, using as input a data string that concatenates the new message and the extracted data relating to the sent or received messages.

6. An authentication code generating program for causing a computer to function as the authentication code generating device according to any one of claims 1 to 4.

Images