JP2014140102A - Secure authentication method - Google Patents

Abstract

Provided is a secure authentication technique capable of ensuring safety even when an intermediate server exists.
A client device 1 registers in a first to third secret calculation servers 3 to 5 via an intermediate server 2 that a password of a user u who uses the system is w _u . Some random numbers used together with the authentication are also generated by the client device 1 and sent to each secret calculation server. If user u attempts to authenticate with password w ′, coordinate the difference between w _u and w ′ to be zero to ensure that the registered passwords _{u u} and w ′ match. Lead by calculation. For each participant, the authentication authority is not biased to any of the intermediate server 2, the first secret calculation server 3, the second secret calculation server 4, or the third secret calculation server 5 that are the participants constituting the system. Calculate for authentication.
[Selection] Figure 1

Description

  The present invention relates to a technique in which a plurality of servers simultaneously and securely authenticate users in authentication on a network.

  Conventionally, a technique described in Non-Patent Document 1 is known as a technique for securely authenticating simultaneously to each server when a user receives a service across multiple servers (see Non-Patent Document 1, for example). ). The technique described in Non-Patent Document 1 is an authentication technique in a secure storage service, in which a user sets a password and stores data in a server by a secure method called secret sharing. If the password at the time of authentication is correct, the user can restore the correct data, and if the password is incorrect, the restoration fails.

A.Bagherzandi, S.Jarecki, N.Saxena, L, Yanbin, “Password-protected secret sharing”, Proceedings of the ACM CCS 2011, pp.433-444

  However, the technology described in Non-Patent Document 1 is based on the premise that the user and the storage server are directly connected, and safety when an intermediate server as a gateway exists like a Web server in a Web service or the like. Cannot be guaranteed.

  An object of the present invention is to provide a secure authentication method capable of guaranteeing safety even when an intermediate server exists.

A secure authentication method according to an aspect of the present invention includes:
c _x , c _y , c _z , d _x , d _y , d _z , e _x , e _y , e _z are given constants,
The client device has random numbers r _{(W) u} , s _{(W) x} , s _{(W) y} , s _{(W) z} , r _{(X) u} , s _{(X) x} , s _{(X) y} , s _{(X ) z} , r _{(Y) u} , s _{(Y) x} , s _{(Y) y} , s _{(Y) z} , r _{(Z) u} , s _{(Z) x} , s _{(Z) y} , s _{(Z) z} A step of generating
The client device secretly distributes each of user u's password w _u and random numbers r _{(W) u} , r _{(X) u} , r _{(Y) u} , r _{(Z) u} , and the distributed value w _{ux of} w _u , w _uy , w _uz , r _{(W) u} variance value r _{(W) ux} , r _{(W) uy} , r _{(W) uz} , r _{(X) u} variance value r _{(X) ux} , r _{(X ) uy} , r _{(X) uz} , r _{(Y) u} variances r _{(Y) ux} , r _{(Y) uy} , r _{(Y) uz} and r _{(Z) u} variances r _{(Z) ux} , r _{Obtaining (Z) uy} , r _{(Z) uz} ;
If the client device is s _{(W) ux} = s _{(W) x} -s _{(W) z} , s _{(W) uy} = s _{(W) y} -s _{(W) x} , s _{(W) uz} = s _{(W) z} -s _{(W) y} , s _{(X) ux} = s _{(X) x} -s _{(X) z} , s _{(X) uy} = s _{(X) y} -s _{(X) x} , s _{(X) uz} = s _{(X) z} -s _{(X) y} , s _{(Y) ux} = s _{(Y) x} -s _{(Y) z} , s _{(Y) uy} = s _{(Y) y} -s _{(Y) x} , s _{( Y) uz} = s _{(Y) z} -s _{(Y) y} , s _{(Z) ux} = s _{(Z) x} -s _{(Z) z} , s _{(Z) uy} = s _{(Z) y} -s _(Z) calculating _x , s _{(Z) uz} = s _{(Z) z} -s _{(Z) y} ;
Client device is w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux)} encrypted with _{(Z) ux} with a common key between the client device and the first secret calculation server , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{(Z) ux} ) are generated and sent to the intermediate server, w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} is encrypted with a common key between the client device and the second _secure calculation server E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} ) to the intermediate server, w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} encrypted with a common key between the client device and the third secure calculation server E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X ) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} ) to the intermediate server;
The intermediate server receives E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{( Z) ux} , s _{(Z) ux} ) is sent to the first secret computation server and received E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} ) are sent to the second secret computation server and received E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} ) And steps to
The first secret computation server receives E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{(Z) ux} ) are decrypted with a common key between the client device and the first secret calculation server, and w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{(Z) ux} are generated and stored in the storage unit;
The second secret calculation server receives E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} ) are decrypted with the common key between the client device and the second secret computation server, and _wuy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} are generated and stored in the storage unit,
The third secret calculation server receives the received E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} ) with a common key between the client device and the third secret calculation server, and w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} are generated and stored in the storage unit,
The client device secretly distributes the input password w ′ to obtain the distributed values w ′ _x , w ′ _y , w ′ _z of w ′;
Client device, w and sends the generated intermediate server 'the _x common key encrypted E _x (w a client device and a first confidential calculation servers' _x), the client device w' _y and the second concealment E _y (w ′ _y ) encrypted with a common key with the calculation server is generated and sent to the intermediate server, and w ′ _z is encrypted with a common key between the client device and the third secret calculation server E _z (w ′ _Z ) and sending it to the intermediate server;
The intermediate server sends the received E _x (w ′ _x ) to the first secret calculation server, sends the received E _y (w ′ _y ) to the second secret calculation server, and receives the received E _z (w ′ _z ) To the third secret calculation server;
First confidential calculation server generates a random number _{r '(W) x, s} ' (W) x, w ux, r (W) ux, s (W) ux, w' x from q _{(W) x} = c _x r _{(W) ux} (w _ux -w ′ _x ) + s _{(W) ux} is calculated and q _{(W) x} is encrypted with the common key between the intermediate server and the first secret calculation server E _WX ( q _XY (r ′ _{(W) x} , q _{(W) x} ) and r ′ _{(W) x} , s ′ _{(W) x} encrypted with a common key between the first secret calculation server and the second secret calculation server s ′ _{(W) x} ) and sending it to the intermediate server;
The second secret calculation server generates random numbers r ′ _{(W) y} , s ′ _{(W) y} , and from w _uy , r _{(W) uy} , s _{(W) uy} , w ′ _y to q _{(W) y} = c _y r _{(W) uy} (w _uy -w ′ _y ) + s _{(W) uy} is calculated, and q _{(W) y} is encrypted with a common key between the intermediate server and the second secret calculation server E _WY ( E _YZ (r ′ _{(W) y} , q _{(W) y} ) and r ′ _{(W) y} , s ′ _{(W) y} encrypted with a common key between the second secret calculation server and the third secret calculation server s ′ _{(W) y} ) and sending it to the intermediate server;
Third confidential calculation server generates a random number _{r '(W) z, s} ' (W) z, w uz, r (W) uz, s (W) uz, w' z from q _{(W) z} = _{c z r (W) uz (} w uz -w 'z) + s (W) uz was calculated and encrypted q a _{(W) z} a common key between the intermediate server and the third secret calculation server E _WZ ( E _ZX (r ′ _{(W) z} , q _{(W) z} ) and r ′ _{(W) z} , s ′ _{(W) z} encrypted with a common key between the first and third secure calculation servers s ′ _{(W) z} ) and sending it to the intermediate server;
The intermediate server decrypts the received E _WX (q _{(W) x} ), E _WY (q _{(W) y} ), E _WZ (q _{(W) z} ) and decodes q _{(W) x} , q _{(W) y} , q _(W) to generate a _z calculates the _{q (W) = q (W} ) x + q (W) y + q (W) z, determining the authentication success in the case of q _(W) = 0 And steps to
The intermediate server sends E _ZX (r ′ _{(W) z} , s ′ _{(W) z} ) to the first secret calculation server, and E _XY (r ′ _{(W) x} , s ′ _{(W) x} ) Transmitting to the second secret calculation server, and transmitting E _YZ (r ′ _{(W) y} , s ′ _{(W) y} ) to the third secret calculation server;
The first secret calculation server decrypts the received E _ZX (r ′ _{(W) z} , s ′ _{(W) z} ) with the common key of the first secret calculation server and the third secret calculation server, and r ′ _{(W ) z} , s ′ _{(W) z} and r _{(W) ux} = d _x r ′ _{(W) x} + e _x r ′ _{(W) z} , s _{(W) ux} = s ′ _{(W) x} − updating r _{(W) ux} , s _{(W) ux} by calculating s ′ _{(W) z} ;
The second secret calculation server decrypts the received E _XY (r ′ _{(W) x} , s ′ _{(W) x} ) with the common key of the first secret calculation server and the second secret calculation server, and r ′ _{(W ) x} , s ′ _{(W) x} and r _{(W) uy} = d _y r ′ _{(W) y} + e _y r ′ _{(W) x} , s _{(W) uy} = s ′ _{(W) y} − updating r _{(W) uy} , s _{(W) uy} by calculating s ′ _{(W) x} ;
The third secret calculation server decrypts the received E _YZ (r ′ _{(W) y} , s ′ _{(W) y} ) with the common key of the second secret calculation server and the third secret calculation server, and r ′ _{(W ) y} , s ′ _{(W) y} and r _{(W) uz} = d _z r ′ _{(W) z} + e _z r ′ _{(W) y} , s _{(W) uz} = s ′ _{(W) z} − updating r _{(W) uz} , s _{(W) uz} by calculating s ′ _{(W) y} ;
The first secret calculation server generates random numbers r ′ _{(X) x} , s ′ _{(X) x} , and from w _ux , r _{(X) ux} , s _{(X) ux} , w ′ _x to q _{(X) x} = c _x r _{(X) ux} (w _ux -w ′ _x ) + s _{(X) ux} is calculated, and r ′ _{(X) x} and s ′ _{(X) x} are calculated as the first secret calculation server and the second secret calculation server. Sending E _XY (r ′ _{(X) x} , s ′ _{(X) x} ) encrypted with a common key to the intermediate server;
The second secret calculation server generates random numbers r ′ _{(X) y} , s ′ _{(X) y} , and from w _uy , r _{(X) uy} , s _{(X) uy} , w ′ _y to q _{(X) y} = c _y r _{(X) uy} (w _uy -w ′ _y ) + s _{(X) uy} is calculated, and q _{(X) y} is encrypted with the common key of the first secret calculation server and the second secret calculation server E _XY (q _{(X) y} ) and r ′ _{(X) y} , s ′ _{(X) y} are encrypted with a common key with the second and third secure calculation servers E _YZ (r ′ _{(X ) y} , s ′ _{(X) y} ) to the intermediate server;
The third secret calculation server generates random numbers r ′ _{(X) z} , s ′ _{(X) z} , and from w _uz , r _{(X) uz} , s _{(X) uz} , w ′ _z to q _{(X) z} = c _z r _{(X) uz} (w _uz -w ′ _z ) + s _{(X) uz} is calculated and q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} is the first secret calculation server And E _ZX (q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} ) encrypted with a common key with the third secret calculation server, to the intermediate server;
The intermediate server sends E _XY (q _{(X) y} ), E _ZX (q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} ) to the first secret calculation server, and the second secret Send E _XY (r ′ _{(X) x} , s ′ _{(X) x} ) to the computation server and send E _YZ (r ′ _{(X) y} , s ′ _{(X) y} ) to the third secret computation server Steps,
The first secret computation server decrypts the received E _XY (q _{(X) y} ) with the common key of the first secret computation server and the second secret computation server, generates q _{(X) y} , and receives the received E _{Decrypt ZX} (q _{(X) z} ) with the common key of the first and third secure calculation servers to generate q _{(X) z} , and q _(X) = q _{(X) x} + q _{( X) y} + q _{(X) z} is calculated.If q _(X) = 0, it is determined that authentication is successful, and r _{(X) ux} = d _x r ′ _{(X) x} + e _x r ′ ₍ Updating r _{(X) ux} , s _{(X) ux} by computing _{X) z} , s _{(X) ux} = s ′ _{(X) x-} s ′ _{(X) z} ;
The second secret calculation server decrypts the received E _XY (r ′ _{(X) x} , s ′ _{(X) x} ) with the common key of the first secret calculation server and the second secret calculation server, and r _{(X) u y} = d _y r ′ _{(X) y} + e _y r ′ _{(X) x} , s _{(X) uy} = s ′ _{(X) y} -s ′ _{(X) x} by calculating r _{(X) uy} , s _{(X) uy} update step;
The third secret calculation server decrypts the received E _YZ (r ′ _{(X) y} , s ′ _{(X) y} ) with the common key of the second secret calculation server and the third secret calculation server, and r _(X) By calculating _uz = d _z r ′ _{(X) z} + e _z r ′ _{(X) y} , s _{(X) uz} = s ′ _{(X) z} -s ′ _{(X) y} , r _{(X) uz} , s _{(X) uz} update step;
First confidential calculation server generates a random number _{r '(Y) x, s} ' (Y) x, w ux, r (Y) ux, s (Y) ux, from _{w' x q (Y) x} = c _x r _{(Y) ux} (w _ux -w ′ _x ) + s _{(Y) ux} is calculated and q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} is the first secret calculation server Transmitting E _XY (q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) encrypted with a common key between the server and the second secret calculation server to the intermediate server;
The second secret calculation server generates random numbers r ′ _{(Y) y} , s ′ _{(Y) y} , and from w _uy , r _{(Y) uy} , s _{(Y) uy} , w ′ _y to q _{(Y) y} = c _y r _{(Y) uy} (w _uy -w ′ _y ) + s _{(Y) uy} is calculated, and r ′ _{(Y) y} , s ′ _{(Y) y} is calculated as the second secret calculation server and the third secret calculation server. Sending E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ) encrypted with a common key to the intermediate server;
The third secret calculation server generates random numbers r ′ _{(Y) z} , s ′ _{(Y) z} , and w _{( uz} , r _{(Y) uz} , s _{(Y) uz} , w ′ _z to q _{(Y) z} = c _z r _{(Y) uz} (w _uz -w ′ _z ) + s _{(Y) uz} is calculated, and q _{(Y) z} is encrypted with the second secret calculation server and the third secret calculation server. E _YZ (q _{(Y) z} ) and r ′ _{(Y) z} , s ′ _{(Y) z} are encrypted using a common key with the first and third secure calculation servers E _ZX (r ′ _{(Y ) z} , s ′ _{(Y) z} ) to the intermediate server;
The intermediate server sends E _ZX (r ′ _{(Y) z} , s ′ _{(Y) z} ) to the first secret calculation server, and E _YZ (q _{(Y) z} ), E _XY ( q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) and E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ) to the third secret calculation server Steps,
The second secret calculation server decrypts the received E _YZ (q _{(Y) z} ) with the common key of the second secret calculation server and the third secret calculation server, generates q _{(Y) z} , and receives, E _XY (q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) is decrypted with the common key between the first secret calculation server and the second secret calculation server, and q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} is generated, q _(Y) = q _{(Y) x} + q _{(Y) y} + q _{(Y) z} is calculated, and q _(Y) = 0 In this case, it is determined that the authentication is successful, and r _{(Y) uy} = d _y r ′ _{(Y) y} + e _y r ′ _{(Y) x} , s _{(Y) uy} = s ′ _{(Y) y} -s ′ _{(Y )} updating r _{(Y) uy} , s _{(Y) uy} by calculating _x ;
The first secret calculation server decrypts the received E _ZX (r ′ _{(Y) z} , s ′ _{(Y) z} ) with the common key of the first secret calculation server and the third secret calculation server, and r _{(Y) ux} = d _x r ′ _{(Y) x} + e _x r ′ _{(Y) z} , s _{(Y) ux} = s ′ _{(Y) x} -s ′ _{(Y) z} by calculating r _{(Y) ux} , s updating the _{(Y) ux} ;
The third secret calculation server decrypts the received E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ) with the common key of the second secret calculation server and the third secret calculation server, and r _(Y) By calculating _uz = d _z r ′ _{(Y) z} + e _z r ′ _{(Y) y} , s _{(Y) uz} = s ′ _{(Y) z} -s ′ _{(Y) y} , r _{(Y) uz} , s _{(Y) uz} update step,
The first secret calculation server generates random numbers r ′ _{(Z) x} , s ′ _{(Z) x} , and w _ux , r _{(Z) ux} , s _{(Z) ux} , w ′ _x to q _{(Z) x} = c _x r _{(Z) ux} (w _ux -w ′ _x ) + s _{(Z) ux} is calculated, and q _{(Z) x} is encrypted with the common key of the first and third secure calculation servers E _ZX (q _{(Z) x} ) and r ′ _{(Z) x} , s ′ _{(Z) x} are encrypted with a common key between the first and second secure calculation servers E _XY (r ′ _{(Z ) x} , s ′ _{(Z) x} ) to the intermediate server;
The second secret calculation server generates random numbers r ′ _{(Z) y} , s ′ _{(Z) y} , and from w _uy , r _{(Z) uy} , s _{(Z) uy} , w ′ _y to q _{(Z) y} = c _y r _{(Z) uy} (w _uy -w ′ _y ) + s _{(Z) uy} is calculated and q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} is calculated as the second secret calculation server And E _YZ (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) encrypted with a common key with the third secret calculation server,
The third secret calculation server generates random numbers r ′ _{(Z) z} , s ′ _{(Z) z} , and from w _uz , r _{(Z) uz} , s _{(Z) uz} , w ′ _z to q _{(Z) z} = c _z r _{(Z) uz} (w _uz -w ′ _z ) + s _{(Z) uz} is calculated, and r ′ _{(Z) z} and s ′ _{(Z) z} are calculated as the first secret calculation server and the third secret calculation server. Sending E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ) encrypted with a common key to the intermediate server;
The intermediate server sends E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ) to the first secret calculation server, and E _XY (r ′ _{(Z) x} , s ′ _{( Z) x} ) and E _ZX (q _{(Z) x} ), E _YZ (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) to the third secret calculation server Steps,
The third secret calculation server decrypts the received E _ZX (q _{(Z) x} ) with the common key of the first secret calculation server and the third secret calculation server, generates q _{(Z) x} , and receives the received E _{ZX YZ} (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) is decrypted with the common key of the first secret calculation server and the third secret calculation server, and q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} is generated, q _(Z) = q _{(Z) x} + q _{(Z) y} + q _{(Z) z} is calculated, and q _(Z) = 0 Is determined to be successful, and r _{(Z) uz} = d _z r ′ _{(Z) z} + e _z r ′ _{(Z) y} , s _{(Z) uz} = s ′ _{(Z) z} -s ′ _(Z) updating r _{(Z) uz} , s _{(Z) uz} by calculating _y ; and
The first secret calculation server decrypts the received E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ) with the common key of the first secret calculation server and the third secret calculation server, and r _{(Z) ux = d x r '(Z} ) x + e x r' (Z) z, s (Z) ux = s '(Z) x -s' (Z) r by computing _{z (Z) ux,} updating s _{(Z) ux} =
The second secret calculation server decrypts the received E _XY (r ′ _{(Z) x} , s ′ _{(Z) x} ) with the common key between the first secret calculation server and the second secret calculation server, and r _{(Z) u y} = d _y r ′ _{(Z) y} + e _y r ′ _{(Z) x} , s _{(Z) uy} = s ′ _{(Z) y} -s ′ _{(Z) x} by calculating r _{(Z) uy} , updating s _{(Z) uy} ;
Have

  Even if an intermediate server exists, safety can be guaranteed.

The block diagram for demonstrating the example of a secure authentication apparatus. The flowchart for demonstrating the example of a secure authentication method. The flowchart for demonstrating the example of a secure authentication method.

  Hereinafter, an embodiment of a secure authentication method will be described with reference to the drawings.

[First embodiment]
As shown in FIG. 1, the secure authentication system of the first embodiment that performs the secure authentication method includes a client device 1, an intermediate server 2, a first secret calculation server 3, a second secret calculation server 4, and a third secret calculation server 5. For example. The client device 1 and the intermediate server 2 are connected so that data can be transmitted and received. The intermediate server 2 and each secret calculation server are connected so that data can be transmitted and received.

First, an outline of the secure authentication method of the first embodiment will be described. First, it is registered that the password of the user u who uses the system is w _u (step S1 to step S6, FIG. 2). Some random numbers used together with the authentication are also generated by the client and sent to each secret calculation server. At this time, in order to prevent the intermediate server 2 that is an intermediary server 2, for example, from misusing these information and impersonating the client, the distributed value to be transmitted is encrypted with a shared key with each secret calculation server.

Next, an authentication procedure will be described. If user u attempts to authenticate with password w ′, coordinate the difference between w _u and w ′ to be zero to ensure that the registered passwords _{u u} and w ′ match. Derived by calculation (step S7 to step S38). For each participant, the authentication authority is not biased to any of the intermediate server 2, the first secret calculation server 3, the second secret calculation server 4, or the third secret calculation server 5 that are the participants constituting the system. Calculate for authentication. The collaborative calculation is performed in combination with random numbers so that w _u and w ′ are not known to each participant. In addition, updating is performed at the end of the authentication procedure so that the random numbers used at this time are not reused in the next authentication.

<User registration / password change (from step S1 to step S6)>
<< Processing of Client Device 1 (Step S1 to Step S4) >>
The password w _u and the random number of the client user u are secretly distributed and transmitted from the client device 1 to each secret calculation server via the intermediate server 2. Here, it is assumed that the client apparatus 1 and each secret calculation server share a common key in advance.

A common key between the client device 1 and the first secret calculation server 3 is represented as _x, and encryption using the common key _x is represented as Ex.

A common key between the client apparatus 1 and the second secret calculation server 4 is represented by _y, and encryption using the common key _y is represented by E _y .

A common key between the client apparatus 1 and the third secret calculation server 5 is represented by _z, and encryption using the common key _z is represented by E _z .

<<< Step S1 >>>
The client device 1 has random numbers r _{(W) u} , s _{(W) x} , s _{(W) y} , s _{(W) z} , r _{(X) u} , s _{(X) x} , s _{(X) y} , s _{( X) z} , r _{(Y) u} , s _{(Y) x} , s _{(Y) y} , s _{(Y) z} , r _{(Z) u} , s _{(Z) x} , s _{(Z) y} , s _{(Z) z} is generated (step S1).

r _{(W) u} , s _{(W) x} , s _{(W) y} , s _{(W) z} are random numbers used in authentication of the intermediate server 2 subject.

r _{(X) u} , s _{(X) x} , s _{(X) y} , s _{(X) z} are random numbers used for authentication of the first secret calculation server 3 main body.

r _{(Y) u} , s _{(Y) x} , s _{(Y) y} , s _{(Y) z} are random numbers used in the authentication of the second secret calculation server 4 subject.

r _{(Z) u} , s _{(Z) x} , s _{(Z) y} , s _{(Z) z} are random numbers used in authentication of the third secret calculation server 5 main body.

<<< Step S2 >>>
The client device 1 secretly distributes the password w _{u of the} user u and the random numbers r _{(W) u} , r _{(X) u} , r _{(Y) u} , r _{(Z) u} , and obtains the following distributed values: (Step S2). Secret sharing is appropriately performed by an existing method.

The variance value of w _u is w _ux , w _uy , w _uz .

The variance of r _{(W) u} is r _{(W) ux} , r _{(W) uy} , r _{(W) uz} .

The dispersion values of r _{(X) u} are r _{(X) ux} , r _{(X) uy} , r _{(X) uz} .

The variance of r _{(Y) u} is r _{(Y) ux} , r _{(Y) uy} , r _{(Y) uz} .

The dispersion value of r _{(Z) u} is r _{(Z) ux} , r _{(Z) uy} , r _{(Z) uz} .

<<< Step S3 >>>
The client devices are defined as follows: (s _{(W) ux} , s _{(W) uy} , s _{(W) uz} ), (s _{(X) ux} , s _{(X) uy} , s _{(X) uz} ), (s _{(Y) ux} , s _{(Y) uy} , s _{(Y) uz} ), (s _{(Z) ux} , s _{(Z) uy} , s _{(Z) uz} ) are calculated (step S3).

s _{(W) ux} = s _{(W) x} -s _{(W) z} , s _{(W) uy} = s _{(W) y} -s _{(W) x} , s _{(W) uz} = s _{(W) z} -s _{( W) y}
s _{(X) ux} = s _{(X) x} -s _{(X) z} , s _{(X) uy} = s _{(X) y} -s _{(X) x} , s _{(X) uz} = s _{(X) z} -s _{( X) y}
s _{(Y) ux} = s _{(Y) x} -s _{(Y) z} , s _{(Y) uy} = s _{(Y) y} -s _{(Y) x} , s _{(Y) uz} = s _{(Y) z} -s _{( Y) y}
s _{(Z) ux} = s _{(Z) x} -s _{(Z) z} , s _{(Z) uy} = s _{(Z) y} -s _{(Z) x} , s _{(Z) uz} = s _{(Z) z} -s _{( Z)} Calculate _y
<<< Step S4 >>>
The client device 1 uses the ciphertext E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{(Z) ux} ), E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{( Y) uy} , r _{(Z) uy} , s _{(Z) uy} ), E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y ) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} ) are generated and transmitted to the intermediate server 2 (step S4).

E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{( Z) ux} ) is w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{(Z) ux} is encrypted using a common key x between the client device 1 and the first secret calculation server 3.

E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{( Z) uy} ) is w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} is a ciphertext obtained by encrypting the client device 1 and the second secret calculation server 4 with a common key y.

E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{( Z) uz} ) is w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} is a ciphertext obtained by encrypting the client device 1 and the third secret calculation server 5 with a common key z.

<< Process of Intermediate Server 2 (Step S5) >>
<<< Step S5 >>>
The intermediate server 2 transmits the ciphertext received from the client device 1 to each secret calculation server (step S5). Specifically, the following processing is performed.

The intermediate server 2 is represented by E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z ) ux} , s _{(Z) ux} ) is transmitted to the first secret calculation server 3.

The intermediate server 2 is represented by E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z ) uy} , s _{(Z) uy} ) is transmitted to the second secret calculation server 4.

The intermediate server 2 is configured as E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z ) uz} , s _{(Z) uz} ) is transmitted to the third secret calculation server 5.

<< Secret calculation server processing (step S6) >>
<<< Step S6 >>>
Each secret calculation server decrypts the ciphertext sent from the client apparatus 1 via the intermediate server, and stores the password and the random number distributed value in a storage unit (not shown) (step S6). Specifically, the following processing is performed.

The first secret computation server 3 receives the received ciphertext E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{( Y) ux} , r _{(Z) ux} , s _{(Z) ux} ) is decrypted with the common key x between the client apparatus 1 and the first secret calculation server 3, and _wux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{(Z) ux} are generated and stored in the storage unit.

The second secret calculation server 4 receives the received ciphertext E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{( Y) uy} , r _{(Z) uy} , s _{(Z) uy} ) are decrypted with the common key y between the client apparatus 1 and the second secret calculation server 4, and _wuy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} are generated and stored in the storage unit.

The third secret calculation server 5 receives the received ciphertext E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{( Y) uz} , r _{(Z) uz} , s _{(Z) uz} ) is decrypted with the common key z between the client apparatus 1 and the third secret calculation server 5, and w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} are generated and stored in the storage unit.

<Authentication (basic operation) (step S7 to step S37)>
As illustrated in FIG. 3, the authentication includes (1) pre-processing for authentication, (2) phase W in which authentication is performed by the intermediate server 2, (3) phase X in which authentication is performed by the first secret calculation server 3, (4 (5) Phase Y in which authentication is performed by the second secret calculation server 4 and (5) Phase Z in which authentication is performed by the third secret calculation server 5. The authentication consists of step S7 to step S37, step 7 to step S9 correspond to the pre-processing of authentication, step S10 to step S16 correspond to phase W, step S17 to step S23 correspond to phase X, step Steps S24 to S30 correspond to phase Y, and steps S31 to S37 correspond to phase Z.

  An authentication method when the password w ′ comes as the user u is shown. It is assumed that a common key is shared in advance between the secure calculation servers and between the intermediate server 2 and each secure calculation server.

The common key between the first secret calculation server 3 and the second secret calculation server 4 is expressed as _XY, and encryption using the common key _XY is expressed as E _XY .

A common key between the second secret calculation server 4 and the third secret calculation server 5 is expressed as _YZ, and encryption using the common key _YZ is expressed as E _YZ .

A common key between the third secret calculation server 5 and the first secret calculation server 3 is expressed as _ZX, and encryption using the common key _ZX is expressed as E _ZX .

A common key between the intermediate server 2 and the first secret calculation server 3 is expressed as _WX, and encryption using the common key _WX is expressed as E _WX .

A common key between the intermediate server 2 and the second secret calculation server 4 is expressed as _WY, and encryption using the common key _WY is expressed as E _WY .

A common key between the intermediate server 2 and the third secret calculation server 5 is expressed as _WZ, and encryption using the common key _WZ is expressed as E _WZ .

<< Processing of Client Device 1 (Step S7 to Step S8) >>
The client device 1 tries to authenticate with the password w ′ as the user u.

<<< Step S7 >>>
The client device secretly distributes the input password w ′ to obtain the distributed values w ′ _x , w ′ _y , and w ′ _z of w ′ (step S7).

<<< Step S8 >>>
The client device 1 encrypts each of the distributed values w ′ _x , w ′ _y , and w ′ _z with a common key, and transmits it to the intermediate server 2 (step S8). Specifically, the following processing is performed.

Client device 1 generates and transmits 'encrypted E _x (w common key x of the _x and the client device 1 and the first confidential calculation server 3' _x) w to an intermediate server 2.

The client device 1 sends w to an intermediate server 2 generates 'a _y client device 1 and encrypted E _y (w common key y of the second confidential calculation server 4' _y).

Client device 1 generates and transmits 'encrypted E _z (w common key z of the _z client apparatus 1 and the third confidential calculation server 5' _z) w to an intermediate server 2.

<< Process of Intermediate Server 2 (Step S9) >>
<<< Step S9 >>>
The intermediate server 2 transmits the received ciphertext to each secret calculation server. Specifically, the following processing is performed (step S9).

The intermediate server 2 transmits the received E _x (w ′ _x ) to the first secret calculation server 3.

The intermediate server 2 transmits the received E _y (w ′ _y ) to the second secret calculation server 4.

The intermediate server 2 transmits the received E _z (w ′ _z ) to the third secret calculation server 5.

* Phase X *
<< Secret calculation server processing (from step S10 to step S12) >>
Each secret calculation server decrypts the ciphertext sent from the client device 1 via the intermediate server 2 and checks whether it matches the stored password. Specifically, the following processing is performed.

_{c x, c y, c z} , d x, d y, d z, e x, e y, e z is a predetermined constant determined according to the manner of secret sharing. For example, w _{u is changed} to w _ux = w _u + 2r ′ ′ (mod p), w _uy = w _u + 3r ′ ′ (mod p) and w _uz = w _u + 4r ′ ′ (mod p) (where r ′ ′ ≠ p), c _x = 6, c _y = -8, c _z = 3, d _x = 1/2, d _y = -1 / 2, d _z = -1 / 3, e _{Let x} = 1/3, e _y = 1/4, e _z = -1 (mod p). c _x , c _y , c _z , d _x , d _y , d _z , e _x , e _y , e _z are q _(W) = q _{(W) x} + q _{(W) y} + when the password is correct q _{(W) z} is determined to satisfy _z = 0.

<<< Step S10 >>>
The first secret calculation server 3 generates random numbers r ′ _{(W) x} and s ′ _{(W) x} , and w _ux , r _{(W) ux} , s _{(W) ux} , w ′ _x to q _{(W) x} = c _x r _{(W) ux} (w _ux -w ′ _x ) + s _{(W) ux} is calculated, and q _{(W) x} is encrypted with the common key WX between the intermediate server 2 and the first secret calculation server 3 E _WX (q _{(W) x} ) and r ′ _{(W) x} , s ′ _{(W) x} are encrypted with the common key XY of the first secret calculation server 3 and the second secret calculation server 4 E _XY ( r ′ _{(W) x} , s ′ _{(W) x} ) are generated and transmitted to the intermediate server 2 (step S10).

  In other words, the first secret calculation server 3 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(W) x} and s ′ _{(W) x} .

(b) w _ux , r _{(W) ux} , s _{(W) ux} , w ′ _x to q _{(W) x} = c _x r _{(W) ux} (w _ux -w ′ _x ) + s _{(W) ux} calculate.

(c) q _{(W) x} , r ′ _{(W) x} , s ′ _{(W) x} is encrypted and E _WX (q _{(W) x} ), E _XY (r ′ _{(W) x} , s ′ _{(W ) x} ) is transmitted to the intermediate server 2.

<<< Step S11 >>>
Second confidential calculation server 4 generates a random number _{r '(W) y, s} ' (W) y, w uy, r (W) uy, s (W) uy, w' y from q _{(W) y} = c _y r _{(W) uy} (w _uy -w ′ _y ) + s _{(W) uy} is calculated, and q _{(W) y} is encrypted with the common key WY between the intermediate server 2 and the second secret calculation server 4 E _WY (q _{(W) y} ) and r ′ _{(W) y} , s ′ _{(W) y} are encrypted with a common key YZ between the second secret computation server 4 and the third secret computation server 5 E _YZ ( r ′ _{(W) y} , s ′ _{(W) y} ) are generated and transmitted to the intermediate server 2 (step S11).

  In other words, the second secret calculation server 4 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(W) y} and s ′ _{(W) y} .

(b) w _uy , r _{(W) uy} , s _{(W) uy} , w ′ _y to q _{(W) y} = c _y r _{(W) uy} (w _uy -w ′ _y ) + s _{(W) uy} calculate.

(c) q _{(W) y} , r ′ _{(W) y} , s ′ _{(W) y} is encrypted and E _WY (q _{(W) y} ), E _YZ (r ′ _{(W) y} , s ′ _{(W ) y} ) is transmitted to the intermediate server 2.

<<< Step S12 >>>
Third confidential calculation server 5 generates a random number _{r '(W) z, s} ' (W) z, w uz, r (W) uz, s (W) uz, w' z from q _{(W) z} = c _z r _{(W) uz} (w _uz -w ′ _z ) + s _{(W) uz} is calculated, and q _{(W) z} is encrypted with the common key WZ between the intermediate server 2 and the third secret calculation server 5 E _WZ (q _{(W) z} ) and r ′ _{(W) z} , s ′ _{(W) z} are encrypted with a common key ZX between the first secret calculation server 3 and the third secret calculation server 5 E _ZX ( r ′ _{(W) z} , s ′ _{(W) z} ) are generated and transmitted to the intermediate server 2 (step S12).

  In other words, the third secret calculation server 5 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(W) z} and s ′ _{(W) z} .

(b) w _uz , r _{(W) uz} , s _{(W) uz} , w ′ _z to q _{(W) z} = c _z r _{(W) uz} (w _uz -w ′ _z ) + s _{(W) uz} calculate.

(c) q _{(W) z} , r ′ _{(W) z} , s ′ _{(W) z} is encrypted and E _WZ (q _{(W) z} ), E _ZX (r ′ _{(W) z} , s ′ _{(W ) z} ) is transmitted to the intermediate server 2.

<< Process of Intermediate Server 2 (Step S13 to Step S14) >>
<<< Step S13 >>>
The intermediate server 2 decrypts the received E _WX (q _{(W) x} ), E _WY (q _{(W) y} ), and E _WZ (q _{(W) z} ) with the common keys WX, WY, and WZ, respectively. _{(W) x} , q _{(W) y} , q _{(W) z} is generated, q _(W) = q _{(W) x} + q _{(W) y} + q _{(W) z} is calculated, and q _(W) = If it is 0, it is determined that the authentication is successful (step S13). q If _(W) ≠ 0, it is determined that authentication has failed. The result of the determination is notified to the client device 1.

  In other words, the intermediate server 2 performs the following processes (a) and (b).

(a) The received E _WX (q _{(W) x} ), E _WY (q _{(W) y} ), E _WZ (q _{(W) z} ) are decrypted with the common keys WX, WY, WZ, respectively, and q _{(W ) x} , q _{(W) y} , q _{(W) z} are generated and q _(W) = q _{(W) x} + q _{(W) y} + q _{(W) z} is calculated.

(b) If q _(W) = 0, it is determined that the authentication is successful. q If _(W) ≠ 0, it is determined that authentication has failed. The determination result is transmitted to the client device 1.

<<< Step S14 >>>
The intermediate server 2 transmits the ciphertext to the secret calculation server (step S14). Specifically, the following processing is performed.

The intermediate server 2 transmits E _ZX (r ′ _{(W) z} , s ′ _{(W) z} ) to the first secret calculation server 3.

The intermediate server 2 transmits E _XY (r ′ _{(W) x} , s ′ _{(W) x} ) to the second secret calculation server 4.

The intermediate server 2 transmits E _YZ (r ′ _{(W) y} , s ′ _{(W) y} ) to the third secret calculation server 5.

<< Secret calculation server processing (from step S15 to step S17) >>
<<< Step S15 >>>
The first secret calculation server 3 decrypts the received E _ZX (r ′ _{(W) z} , s ′ _{(W) z} ) with the common key of the first secret calculation server 3 and the third secret calculation server 5, and r ′ _{(W) z} , s ′ _{(W) z} and r _{(W) ux} = d _x r ′ _{(W) x} + e _x r ′ _{(W) z} , s _{(W) ux} = s ′ _{(W ) x} -s' _{(W) z} is calculated to update r _{(W) ux} , s _{(W) ux} (step S15).

  In other words, the first secret calculation server 3 performs the following processes (a) and (b).

(a) E _ZX (r ′ _{(W) z} , s ′ _{(W) z} ) is decoded to generate r ′ _{(W) z} , s ′ _{(W) z} . Here, no verification is performed.

(b) r _{(W) ux} , s _{(W) ux} is updated as follows.

r _{(W) ux} = d _x r ′ _{(W) x} + e _x r ′ _{(W) z}
s _{(W) ux} = s ′ _{(W) x} -s ′ _{(W) z}
<<< Step S16 >>>
The second secret calculation server 4 decrypts the received E _XY (r ′ _{(W) x} , s ′ _{(W) x} ) with the common key of the first secret calculation server 3 and the second secret calculation server 4, and r ′ _{(W) x} , s ′ _{(W) x} and r _{(W) uy} = d _y r ′ _{(W) y} + e _y r ′ _{(W) x} , s _{(W) uy} = s ′ _{(W ) y} -s' _{(W) x} is calculated to update r _{(W) uy} , s _{(W) uy} (step S16).

  In other words, the second secret calculation server 4 performs the following processes (a) and (b).

(a) E _XY (r ′ _{(W) x} , s ′ _{(W) x} ) is decoded to generate r ′ _{(W) x} , s ′ _{(W) x} . Here, no verification is performed.

(b) r _{(W) uy} , s _{(W) uy} is updated as follows.

r _{(W) uy} = d _y r ′ _{(W) y} + e _y r ′ _{(W) x}
s _{(W) uy} = s ′ _{(W) y} -s ′ _{(W) x}
<<< Step S17 >>>
The third secret calculation server 5 decrypts the received E _YZ (r ′ _{(W) y} , s ′ _{(W) y} ) with the common key of the second secret calculation server 4 and the third secret calculation server 5 and r ′ _{(W) y} , s ′ _{(W) y} is generated, r _{(W) uz} = d _z r ′ _{(W) z} + e _z r ′ _{(W) y} , s _{(W) uz} = s ′ _{(W ) z} -s ′ _{(W) y} is calculated to update r _{(W) uz} , s _{(W) uz} (step S17).

  In other words, the second secret calculation server 4 performs the following processes (a) and (b).

(a) E _YZ (r ′ _{(W) y} , s ′ _{(W) y} ) is decoded to generate r ′ _{(W) y} , s ′ _{(W) y} . Here, no verification is performed.

(b) r _{(W) uz} , s _{(W) uz} is updated as follows.

r _{(W) uz} = d _z r ′ _{(W) z} + e _z r ′ _{(W) y}
s _{(W) uz} = s ′ _{(W) z} -s ′ _{(W) y}
* Phase X *
<< Secret calculation server processing (from step S18 to step S20) >>
<<< Step S18 >>>
First confidential calculation server 3 generates a random number _{r '(X) x, s} ' (X) x, w ux, r (X) ux, s (X) ux, from w' _x q _{(X) x} = c _x r _{(X) ux} (w _ux -w ′ _x ) + s _{(X) ux} is calculated, and r ′ _{(X) x} and s ′ _{(X) x} are calculated as the first secret calculation server 3 and the second secret E _XY (r ′ _{(X) x} , s ′ _{(X) x} ) encrypted with the common key with the calculation server 4 is transmitted to the intermediate server 2 (step S18).

  In other words, the first secret calculation server 3 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(X) x} and s ′ _{(X) x} .

(b) w _ux , r _{(X) ux} , s _{(X) ux} , w ′ _x to q _{(X) x} = c _x r _{(X) ux} (w _ux -w ′ _x ) + s _{(X) ux} calculate.

(c) r ′ _{(X) x} and s ′ _{(X) x} are encrypted, and E _XY (r ′ _{(X) x} and s ′ _{(X) x} ) is transmitted to the intermediate server 2.

<<< Step S19 >>>
The second secret calculation server 4 generates random numbers r ′ _{(X) y} , s ′ _{(X) y} , and from w _uy , r _{(X) uy} , s _{(X) uy} , w ′ _y to q _{(X) y} = c _y r _{(X) uy} (w _uy -w ′ _y ) + s _{(X) uy} is calculated, and q _{(X) y} is a common key between the first secret calculation server 3 and the second secret calculation server 4 E _{YZ obtained} by encrypting encrypted E _XY (q _{(X) y} ) and r ′ _{(X) y} , s ′ _{(X) y} with the second secret calculation server 4 and the third secret calculation server 5 (r ' _{(X) y} , s' _{(X) y} ) is transmitted to the intermediate server 2 (step S19).

  In other words, the second secret calculation server 4 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(X) y} and s ′ _{(X) y} .

(b) w _uy , r _{(X) uy} , s _{(X) uy} , w ′ _y to q _{(X) y} = c _y r _{(X) uy} (w _uy -w ′ _y ) + s _{(X) uy} calculate.

(c) q _{(X) y} , r ′ _{(X) y} , s ′ _{(X) y} is encrypted and E _YZ (r ′ _{(X) y} , s ′ _{(X) y} ), E _XY (q _{(X ) y} ) is transmitted to the intermediate server 2.

<<< Step S20 >>>
Third confidential calculation server 5 generates a random number _{r '(X) z, s} ' (X) z, w uz, r (X) uz, s (X) uz, from w' _z q _{(X) z} = c _z r _{(X) uz} (w _uz -w ′ _z ) + s _{(X) uz} and q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} E _ZX (q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} ) encrypted with a common key with the server 3 and the third secret calculation server 5 is transmitted to the intermediate server 2 (step S20). ).

  In other words, the second secret calculation server 4 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(X) z} and s ′ _{(X) z} .

(b) w _uz , r _{(X) uz} , s _{(X) uz} , w ′ _z to q _{(X) z} = c _z r _{(X) uz} (w _uz -w ′ _z ) + s _{(X) uz} calculate.

(c) Encrypt q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} and convert E _ZX (q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} ) to Transmit to the intermediate server 2.

<< Process of Intermediate Server 2 (Step S21) >>
<<< Step S21 >>>
The intermediate server 2 transmits the received ciphertext to the secret calculation server (step S21). Specifically, the following processing is performed.

The intermediate server 2 transmits E _XY (q _{(X) y} ), E _ZX (q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} )) to the first secret calculation server 3.

The intermediate server 2 transmits E _XY (r ′ _{(X) x} , s ′ _{(X) x} ) to the second secret calculation server 4.

The intermediate server 2 transmits E _YZ (r ′ _{(X) y} , s ′ _{(X) y} ) to the third secret calculation server 5.

<< Process of First Secret Calculation Server 3 (Step S22) >>
<<< Step S22 >>>
The first secret calculation server 3 decrypts the received E _XY (q _{(X) y} ) with the common key of the first secret calculation server 3 and the second secret calculation server 4 to generate q _{(X) y} , The received E _ZX (q _{(X) z} ) is decrypted with the common key of the first secret calculation server 3 and the third secret calculation server 5 to generate q _{(X) z} , and q _(X) = q _{(X ) x} + q _{(X) y} + q _{(X) z.If} q _(X) = 0, it is determined that authentication is successful, and r _{(X) ux} = d _x r ′ _{(X) x} + By calculating e _x r ′ _{(X) z} , s _{(X) ux} = s ′ _{(X) x} -s ′ _{(X) z} , r _{(X) ux} , s _{(X) ux} is updated (step S22). ).

  In other words, the first secret calculation server 3 performs the following processes (a) and (b).

(a) Decode E _XY (q _{(X) y} ), E _ZX (q _{(X) z} ) and calculate q _(X) = q _{(X) x} + q _{(X) y} + q _{(X) z} If q _(X) = 0, it is determined that the authentication is successful, and if q _(X) ≠ 0, it is determined that the authentication is unsuccessful.

(b) r _{(X) ux} , s _{(X) ux} is updated as follows.

r _{(X) ux} = d _x r ′ _{(X) x} + e _x r ′ _{(X) z}
s _{(X) ux} = s ′ _{(X) x} -s ′ _{(X) z}
<< Process of Other Secure Calculation Server (Step S23 to Step S24) >>
<<< Step S23 >>>
The second secret calculation server 4 decrypts the received E _XY (r ′ _{(X) x} , s ′ _{(X) x} ) with the common key of the first secret calculation server 3 and the second secret calculation server 4, and r _{(X) uy = d y r} '(X) y + e y r' (X) x, s (X) uy = s '(X) y -s' (X) r by calculating _{x (X ) uy} , s _{(X) uy} is updated (step S23).

  In other words, the second secret calculation server 4 performs the following processes (a) and (b).

(a) Decode E _XY (r ′ _{(X) x} , s ′ _{(X) x} ). Here, no verification is performed.

(b) r _{(X) uy} , s _{(X) uy} is updated as follows.

r _{(X) uy} = d _y r ′ _{(X) y} + e _y r ′ _{(X) x}
s _{(X) uy} = s ′ _{(X) y} -s ′ _{(X) x}
<<< Step S24 >>>
The third secret calculation server 5 decrypts the received E _YZ (r ′ _{(X) y} , s ′ _{(X) y} ) with the common key of the second secret calculation server 4 and the third secret calculation server 5, and r _{(X) uz = d z r} '(X) z + e z r' (X) y, s (X) uz = s '(X) z -s' (X) r by calculating _{y (X ) uz} , s _{(X) uz} is updated (step S24).

  In other words, the third secret calculation server 5 performs the following processes (a) and (b).

(a) Decode E _YZ (r ′ _{(X) y} , s ′ _{(X) y} ). Here, no verification is performed.

(b) r _{(X) uz} , s _{(X) uz} is updated as follows.

r _{(X) uz} = d _z r ′ _{(X) z} + e _z r ′ _{(X) y}
s _{(X) uz} = s ′ _{(X) z} -s ′ _{(X) y}
* Phase Y *
<< Secret calculation server processing (from step S25 to step S27) >>
<<< Step S25 >>>
First confidential calculation server 3 generates a random number _{r '(Y) x, s} ' (Y) x, w ux, r (Y) ux, s (Y) ux, w' x from q _{(Y) x} = c _x r _{(Y) ux} (w _ux -w ′ _x ) + s _{(Y) ux} is calculated, and q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} is the first secret calculation E _XY (q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) encrypted with a common key between the server 3 and the second secret calculation server 4 is transmitted to the intermediate server 2 (step S25). ).

  In other words, the first secret calculation server 3 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(Y) x} and s ′ _{(Y) x} .

(b) w _ux , r _{(Y) ux} , s _{(Y) ux} , w ′ _x to q _{(Y) x} = c _x r _{(Y) ux} (w _ux -w ′ _x ) + s _{(Y) ux} calculate.

(c) Encrypt q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} and convert E _XY (q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) Transmit to the intermediate server 2.

<<< Step S26 >>>
Second confidential calculation server 4 generates a random number _{r '(Y) y, s} ' (Y) y, w uy, r (Y) uy, s (Y) uy, w' y from q _{(Y) y} = c _y r _{(Y) uy} (w _uy -w ′ _y ) + s _{(Y) uy} is calculated, and r ′ _{(Y) y} and s ′ _{(Y) y} are calculated as the second secret calculation server 4 and the third secret E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ) encrypted with the common key with the calculation server 5 is transmitted to the intermediate server 2 (step S26).

  In other words, the second secret calculation server 4 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(Y) y} and s ′ _{(Y) y} .

(b) w _uy , r _{(Y) uy} , s _{(Y) uy} , w ′ _y to q _{(Y) y} = c _y r _{(Y) uy} (w _uy -w ′ _y ) + s _{(Y) uy} calculate.

(c) r ′ _{(Y) y} and s ′ _{(Y) y} are encrypted and E _YZ (r ′ _{(Y) y} and s ′ _{(Y) y} ) are transmitted to the intermediate server 2.

<<< Step S27 >>>
Third confidential calculation server 5 generates a random number _{r '(Y) z, s} ' (Y) z, w uz, r (Y) uz, s (Y) uz, w' z from q _{(Y) z} = c _z r _{(Y) uz} (w _uz -w ′ _z ) + s _{(Y) uz} is calculated, and q _{(Y) z} is a common key between the second secret calculation server 4 and the third secret calculation server 5 E _{ZX obtained} by encrypting the encrypted E _YZ (q _{(Y) z} ) and r ′ _{(Y) z} , s ′ _{(Y) z} with a common key with the first secret calculation server 3 and the third secret calculation server 5 (r ' _{(Y) z} , s' _{(Y) z} ) is transmitted to the intermediate server 2 (step S27).

  In other words, the second secret calculation server 4 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(Y) z} and s ′ _{(Y) z} .

(b) w _uz , r _{(Y) uz} , s _{(Y) uz} , w ′ _z to q _{(Y) z} = c _z r _{(Y) uz} (w _uz -w ′ _z ) + s _{(Y) uz} calculate.

(c) q _{(Y) z} , r ′ _{(Y) z} , s ′ _{(Y) z} is encrypted and E _YZ (q _{(Y) z} ), E _ZX (r ′ _{(Y) z} , s ′ _{(Y ) z} ) is transmitted to the intermediate server 2.

<< Process of Intermediate Server 2 (Step S28) >>
<<< Step S28 >>>
The intermediate server 2 transmits the received ciphertext to the secret calculation server (step S28). Specifically, the following processing is performed.

The intermediate server 2 transmits E _ZX (r ′ _{(Y) z} , s ′ _{(Y) z} ) to the first secret calculation server 3.

The intermediate server 2 transmits E _YZ (q _{(Y) z} ), E _XY (q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) to the second secret calculation server 4.

The intermediate server 2 transmits E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ) to the third secret calculation server 5.

<< Process of Second Secret Calculation Server 4 (Step S29) >>
<<< Step S29 >>>
The second secret calculation server 4 decrypts the received E _YZ (q _{(Y) z} ) with the common key of the second secret calculation server 4 and the third secret calculation server 5 to generate q _{(Y) z} , The received E _XY (q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) is decrypted with the common key of the first secret calculation server 3 and the second secret calculation server 4 and q _{( Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} is generated, q _(Y) = q _{(Y) x} + q _{(Y) y} + q _{(Y) z} is calculated, and q _{(Y )} = 0, it is determined that authentication is successful, and r _{(Y) uy} = d _y r ′ _{(Y) y} + e _y r ′ _{(Y) x} , s _{(Y) uy} = s ′ _{(Y) y} r _{(Y) uy} and s _{(Y) uy} are updated by calculating -s' _{(Y) x} (step S29).

  In other words, the second secret calculation server 4 performs the following processes (a) and (b).

(a) The received E _YZ (q _{(Y) z} ) is decrypted with the common key of the second secret calculation server 4 and the third secret calculation server 5 to generate q _{(Y) z} , and the received E _XY (q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) is decrypted with the common key of the first secret calculation server 3 and the second secret calculation server 4 and q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} is generated, q _(Y) = q _{(Y) x} + q _{(Y) y} + q _{(Y) z} is calculated, and q _(Y) = 0 In this case, it is determined that the authentication has succeeded, and when q _(Y) ≠ 0, it is determined that the authentication has failed.

(b) r _{(Y) uy} , s _{(Y) uy} is updated as follows.

r _{(Y) uy} = d _y r ′ _{(Y) y} + e _y r ′ _{(Y) x}
s _{(Y) uy} = s ′ _{(Y) y} -s ′ _{(Y) x}
<< Processes of other secure calculation servers (from step S30 to step S31) >>
<<< Step S30 >>>
The first secret calculation server 3 decrypts the received E _ZX (r ′ _{(Y) z} , s ′ _{(Y) z} ) with the common key of the first secret calculation server 3 and the third secret calculation server 5, and r _{(Y) ux = d x r} '(Y) x + e x r' (Y) z, s (Y) ux = s '(Y) x -s' (Y) r by computing the _{z (Y ) ux} , s _{(Y) ux} is updated (step S30).

  In other words, the first secret calculation server 3 performs the following processes (a) and (b).

(a) Decode E _ZX (r ′ _{(Y) z} , s ′ _{(Y) z} ). Here, no verification is performed.

(b) r _{(Y) ux} , s _{(Y) ux} is updated as follows.

r _{(Y) ux} = d _x r ′ _{(Y) x} + e _x r ′ _{(Y) z}
s _{(Y) ux} = s ′ _{(Y) x} -s ′ _{(Y) z}
<<< Step S31 >>>
The third secret calculation server 5 decrypts the received E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ) with the common key of the second secret calculation server 4 and the third secret calculation server 5, and r _{(Y) uz = d z r} '(Y) z + e z r' (Y) y, s (Y) uz = s '(Y) z -s' (Y) r by computing the _{y (Y ) uz} , s _{(Y) uz} is updated (step S31).

  In other words, the third secret calculation server 5 performs the following processes (a) and (b).

(a) Decode E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ). Here, no verification is performed.

(b) r _{(Y) uz} , s _{(Y) uz} is updated as follows.

r _{(Y) uz} = d _z r ′ _{(Y) z} + e _z r ′ _{(Y) y}
s _{(Y) uz} = s ′ _{(Y) z} -s ′ _{(Y) y}
* Phase Z *
<< Secret calculation server processing (from step S32 to step S34) >>
<<< Step S32 >>>
The first secret calculation server 3 generates random numbers r ′ _{(Z) x} , s ′ _{(Z) x} , and from w _ux , r _{(Z) ux} , s _{(Z) ux} , w ′ _x to q _{(Z) x} = c _x r _{(Z) ux} (w _ux -w ′ _x ) + s _{(Z) ux} is calculated, and q _{(Z) x} is a common key between the first secret calculation server 3 and the third secret calculation server 5 E _{XY obtained} by encrypting the encrypted E _ZX (q _{(Z) x} ) and r ′ _{(Z) x} , s ′ _{(Z) x} with the common key of the first secret calculation server 3 and the second secret calculation server 4 (r ' _{(Z) x} , s' _{(Z) x} ) is transmitted to the intermediate server 2 (step S32).

  In other words, the first secret calculation server 3 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(Z) x} and s ′ _{(Z) x} .

(b) w _ux , r _{(Z) ux} , s _{(Z) ux} , w ′ _x to q _{(Z) x} = c _x r _{(Z) ux} (w _ux -w ′ _x ) + s _{(Z) ux} calculate.

(c) q _{(Z) x} , r ′ _{(Z) x} , s ′ _{(Z) x} is encrypted and E _ZX (q _{(Z) x} ), E _XY (r ′ _{(Z) x} , s ′ _{(Z ) x} ) is transmitted to the intermediate server 2.

<<< Step S33 >>>
Second confidential calculation server 4 generates a random number _{r '(Z) y, s} ' (Z) y, w uy, r (Z) uy, s (Z) uy, w' y from q _{(Z) y} = c _y r _{(Z) uy} (w _uy -w ′ _y ) + s _{(Z) uy} and calculate q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} E _YZ (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) encrypted with a common key with the server 4 and the third secret calculation server 5 is transmitted to the intermediate server 2 (step S33). ).

  In other words, the second secret calculation server 4 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(Z) y} and s ′ _{(Z) y} .

(b) w _uy , r _{(Z) uy} , s _{(Z) uy} , w ′ _y to q _{(Z) y} = c _y r _{(Z) uy} (w _uy -w ′ _y ) + s _{(Z) uy} calculate.

(c) q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} is encrypted and E _YZ (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) is Transmit to the intermediate server 2.
<<< Step S34 >>>
The third secret calculation server 5 generates random numbers r ′ _{(Z) z} and s ′ _{(Z) z} , and from w _uz , r _{(Z) uz} , s _{(Z) uz} , w ′ _z to q _{(Z) z} = c _z r _{(Z) uz} (w _uz -w ′ _z ) + s _{(Z) uz} is calculated and r ′ _{(Z) z} and s ′ _{(Z) z} are calculated as the first secret calculation server 3 and the third secret E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ) encrypted with the common key with the calculation server 5 is transmitted to the intermediate server 2 (step S34).

  In other words, the second secret calculation server 4 performs the following processes (a) to (c).

(a) Generate random numbers r ′ _{(Z) z} and s ′ _{(Z) z} .

(b) w _uz , r _{(Z) uz} , s _{(Z) uz} , w ′ _z to q _{(Z) z} = c _z r _{(Z) uz} (w _uz -w ′ _z ) + s _{(Z) uz} calculate.

_{(c) r '(Z)} z, s' (Z) encrypted with the common key between the first confidential calculation server 3 and the third confidential calculation server 5 _z the _{E ZX (r '(Z)} z, s' _{(Z) z} ) is transmitted to the intermediate server 2.

<< Secret Calculation Server Processing (Step S35) >>
<<< Step S35 >>>
The intermediate server 2 transmits the received ciphertext to the secret calculation server (step S35). Specifically, the following processing is performed.

The intermediate server 2 transmits E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ) to the first secret calculation server 3.

The intermediate server 2 transmits E _XY (r ′ _{(Z) x} , s ′ _{(Z) x} ) to the second secret calculation server 4.

The intermediate server 2 transmits E _ZX (q _{(Z) x} ), E _YZ (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) to the third secret calculation server 5.

<< Process of Third Secret Calculation Server 5 (Step S36) >>
<<< Step S36 >>>
The third secret calculation server 5 decrypts the received E _ZX (q _{(Z) x} ) with the common key of the first secret calculation server 3 and the third secret calculation server 5 to generate q _{(Z) x} , The received E _YZ (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) is decrypted with the common key of the first secret calculation server 3 and the third secret calculation server 5, and q _{(Z ) y} , r ′ _{(Z) y} , s ′ _{(Z) y} is generated, q _(Z) = q _{(Z) x} + q _{(Z) y} + q _{(Z) z} is calculated, and q _(Z) If = 0, it is determined that authentication is successful, and r _{(Z) uz} = d _z r ′ _{(Z) z} + e _z r ′ _{(Z) y} , s _{(Z) uz} = s ′ _{(Z) z} − By calculating s ′ _{(Z) y} , r _{(Z) uz} and s _{(Z) uz} are updated (step S36).

  In other words, the third secret calculation server 5 performs the following processes (a) and (b).

(a) E _ZX (q _{(Z) x} ), E _YZ (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) is decoded and q _(Z) = q _{(Z) x} + q _{(Z) y} + q _{(Z) z} is calculated. When q _(Z) = 0, it is determined that authentication is successful, and when q _(Z) ≠ 0, it is determined that authentication is failed.

(b) r _{(Z) uz} , s Update _{(Z) uz} as follows.

r _{(Z) uz} = d _z r ′ _{(Z) z} + e _z r ′ _{(Z) y}
s _{(Z) uz} = s ′ _{(Z) z} -s ′ _{(Z) y}
<< Process of Other Secure Calculation Server (Step S37 to Step S38) >>
<<< Step S37 >>>
The first secret calculation server 3 decrypts the received E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ) with the common key of the first secret calculation server 3 and the third secret calculation server 5, and r _{(Z) ux = d x r} '(Z) x + e x r' (Z) z, s (Z) ux = s '(Z) x -s' (Z) r by computing _{z (Z ) ux} , s _{(Z) ux} = is updated (step S37).

  In other words, the first secret calculation server 3 performs the following processes (a) and (b).

(a) Decode E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ). Here, no verification is performed.

(b) r _{(Z) ux} , s _{(Z) ux} = is updated as follows.

r _{(Z) ux} = d _x r ′ _{(Z) x} + e _x r ′ _{(Z) z}
s _{(Z) ux} = s ′ _{(Z) x} -s ′ _{(Z) z}
<<< Step S38 >>>
The second secret calculation server 4 decrypts the received E _XY (r ′ _{(Z) x} , s ′ _{(Z) x} ) with the common key of the first secret calculation server 3 and the second secret calculation server 4, and r _{(Z) uy = d y r} '(Z) y + e y r' (Z) x, s (Z) uy = s '(Z) y -s' (Z) r by calculating _{x (Z ) uy} , s _{(Z) uy} is updated (step S38).

  In other words, the second secret calculation server 4 performs the following processes (a) and (b).

(a) Decode E _XY (r ′ _{(Z) x} , s ′ _{(Z) x} ).

(b) r _{(Z) uy} , s _{(Z) uy} is updated as follows.

r _{(Z) uy} = d _y r ′ _{(Z) y} + e _y r ′ _{(Z) x}
s _{(Z) uy} = s ′ _{(Z) y} -s ′ _{(Z) x}
[Second Embodiment]
The secure authentication method of the second embodiment is an improved method of the first embodiment, in which a replay attack by reusing a ciphertext exchanged via the intermediate server 2 in the authentication procedure (reusing a ciphertext that has been successfully authenticated). In order to cope with the attack that the intermediate server 2 impersonates the client device 1 and succeeds in authentication), a random number is generated in advance in each secret calculation server and shared with the client device, so that a ciphertext of a password transmitted at the time of authentication Can not be reused.

  The countermeasure against the replay attack, in other words, the anti-replay attack authentication is executed between step S6 and step S7.

<Replay attack authentication (from step R1 to step R10)>
<< Secret calculation server processing (from step R1 to step R3) >>
<<< Step R1 >>>
First confidential calculation server 3 generates a random number t _X, encrypts the common key of the t _X a first confidential calculation server 3 and the second confidential calculation server 4 generates the E _XY (t _X), t _X is encrypted with a common key between the first secret calculation server 3 and the third secret calculation server 5 to generate E _ZX (t _X ), and t _X , E _XY (t _X ), and E _ZX (t _X ) are It transmits to the intermediate server 2 (step R1).

  In other words, the first secret calculation server 3 performs the following processes (1) and (2).

(1) generates a random number t _X.

(2) The t _X is encrypted, and t _X , E _XY (t _X ), and E _ZX (t _X ) are transmitted to the intermediate server 2.

<<< Step R2 >>>
Second confidential calculation server 4 generates a random number t _Y, encrypts the t _Y common key with the second confidential calculation server 4 and the third confidential calculation server 5 generates the E _YZ (t _Y), t _Y is encrypted with the common key of the first secret calculation server 3 and the third secret calculation server 5 to generate E _XY (t _Y ), and t _Y , E _YZ (t _Y ), and E _XY (t _Y ) are Transmit to the intermediate server 2 (step R2).

  In other words, the first secret calculation server 3 performs the following processes (1) and (2).

(1) Generate a random number t _Y.

(2) encrypts the _{t Y, t Y, E YZ} (t Y), and transmits E _XY a (t _Y) to an intermediate server 2.

<<< Step R3 >>>
Third confidential calculation server 5 generates a random number t _Z, a t _Z encrypts the common key with the second confidential calculation server 4 and the third confidential calculation server 5 generates the E _ZX (t _Z), t _Z is encrypted with the common key of the first secret calculation server 3 and the third secret calculation server 5 to generate E _YZ (t _Z ), and t _Z , E _ZX (t _Z ), and E _YZ (t _Z ) are It transmits to the intermediate server 2 (step R3).

  In other words, the first secret calculation server 3 performs the following processes (1) and (2).

(1) Generate a random number t _Z.

(2) The t _Z encrypts, transmits _{t Z, E ZX (t Z} ), E YZ a (t _Z) in the intermediate server 2
<< Process of intermediate server 2 (step R4) >>
<<< Step R4 >>>
The intermediate server 2 calculates t = t _X + t _Y + t _Z and transmits it to the client device 1 (step R4).

<< Processing of Client Device 1 (Step R5 to Step R6) >>
<<< Step R5 >>>
The client apparatus 1 secretly distributes w ′ to obtain the distributed values w ′ _x , w ′ _y , and w ′ _z of w ′ (step R5).

<<< Step R6 >>>
The client device _{1, t, w '(x E} x t, w) and encrypted with the common key _x a client apparatus 1 and the first confidential calculation server 3' generates, t, w _'y the client device E _y (t, w ′ _y ) is generated by encrypting with a common key between 1 and the second secret calculation server 4, and t, w ′ _z is generated with a common key between the client device 1 and the third secret calculation server 5. E _z (t, w ′ _z ) is generated by encryption, and E _x (t, w ′ _x ), E _y (t, w ′ _y ), E _z (t, w ′ _z ) are transferred to the intermediate server 2 Transmit (step R6).

<< Process of intermediate server 2 (step R7) >>
<<< Step R7 >>>
The intermediate server 2 transmits the received ciphertext to the secret calculation server (step R7). Specifically, the following processing is performed.

The intermediate server 2 transmits E _x (t, w ′ _x ), E _XY (t _Y ), and E _ZX (t _Z ) to the first secret calculation server 3.

The intermediate server 2 transmits E _y (t, w ′ _y ), E _XY (t _X ), and E _YZ (t _Z ) to the second secret calculation server 4.

The intermediate server 2 transmits E _z (t, w ′ _z ), E _ZX (t _X ), and E _YZ (t _Y ) to the third secret calculation server.

<< Secret calculation server processing (from step R8 to step R10) >>
<<< Step R8 >>>
The first secret computation server 3 decrypts E _x (t, w ′ _x ), E _XY (t _Y ), E _ZX (t _Z ) to generate t, w ′ _x , t _Y , t _Z t ′ = t _X + t _Y + t _Z is calculated. If t ′ ≠ t, it is determined that the authentication has failed (step R8).

  In other words, the first secret calculation server 3 performs the following processes (1) and (2).

(1) Decode E _x (t, w ′ _x ), E _XY (t _Y ), E _ZX (t _Z ), and calculate t ′ = t _X + t _Y + t _Z.

  (2) If t ′ ≠ t, it is determined that the authentication has failed.

<<< Step R9 >>>
The second secret calculation server 4 decrypts E _y (t, w ′ _y ), E _XY (t _X ), E _YZ (t _Z ) and generates t, w ′ _y , t _X , t _Z , t ′ = t _X + t _Y + t _Z is calculated. If t ′ ≠ t, it is determined that the authentication has failed (step R9).

  In other words, the second secret calculation server 4 performs the following processes (1) and (2).

(1) Decode E _y (t, w ′ _y ), E _XY (t _X ), E _YZ (t _Z ), and calculate t ′ = t _X + t _Y + t _Z.

  (2) If t ′ ≠ t, it is determined that the authentication has failed.

<<< Step R10 >>>
The third secret calculation server 5 decrypts E _z (t, w ′ _z ), E _ZX (t _X ), E _YZ (t _Y ) to generate t, w ′ _z , t _X , t _Y , t ′ = t _X + t _Y + t _Z is calculated. If t ′ ≠ t, it is determined that the authentication has failed (step R10).

  In other words, the third secret calculation server 5 performs the following processes (1) and (2).

(1) Decode E _z (t, w ′ _z ), E _ZX (t _X ), E _YZ (t _Y ), and calculate t ′ = t _X + t _Y + t _Z.

  (2) If t ′ ≠ t, it is determined that the authentication has failed.

  Thereafter, the processing after step S7 is performed in the same manner as in the first embodiment.

[Third embodiment]
The third embodiment provides a predetermined service when authentication is successful in the first embodiment or the second embodiment.

  In other words, when the user receives the server service via the Web page, the user is the client device 1, the Web page server is the intermediate server 2, and each service provider is the secure calculation server. After performing the authentication of the second embodiment, each service provider provides the service to the user.

  The predetermined service to be provided may be a service performed by two or more servers of the intermediate server 2, the first secret calculation server 3, the second secret calculation server 4, and the third secret calculation server 5, It may be a service that can be implemented by only one of these servers.

  For example, the form which uses invention of 1st embodiment and 2nd embodiment as a system of a single sign-on can be considered. The user can receive each service of each server with one password. Thereby, the risk of leakage due to impersonation can be reduced.

  Further, the predetermined service to be provided may be, for example, a storage service using secret sharing. Secret sharing is a division method that divides data into three shares, and it is a division method that never obtains information of the original data with only one share. If this is the case, the original data can be completely restored.

  It can be said that this is a match with the present invention, in which communication between servers is unnecessary, since it is not necessary for the servers to communicate with each other even if the service is performed in cooperation.

[point]
In this way, even if an intermediate person such as a Web server is used, the unauthorized person cannot impersonate the user and succeed in authentication. An unauthorized person is also assumed to be an intermediary or a server. That is, it includes that neither the intermediate person nor the server knows the password.

  The points of the first embodiment will be described below. In addition to being able to apply the Web service model, 1. Users do not need to install multiple passwords or cumbersome certificates, 2. No intermediate man or server can impersonate, 3. Communication between servers The key points are that a route is not necessary, and that the response time to the user can be minimized because the number of communications until the response to the user is minimal is four.

  The requirements of 1. and 4. are natural. 2. In the model where the server is a single entity, the server has its own data, so there is little merit of fraudulently through authentication from the outside, but when there are multiple servers and each has different data There is an advantage in browsing data of other servers from the outside. Particularly in secret sharing, this problem is serious because the security effectiveness is lost when two pieces of data are collected.

  3. means that linked services can be deployed even on servers that do not have communication paths between each other during system construction. For example, an application provider can develop its own service on a plurality of appropriate cloud services on the cloud service. Cloud services do not need to be linked.

  Due to the requirements of 1. and 2., the password is protected by a secret sharing where there is one password and neither the server nor the intermediary knows the password. A hash function is not sufficient because dictionary attacks are possible locally on the server.

  In addition, because of the requirements of 3. and 4., it is sufficient to use a well-known secret circuit calculation if communication between servers is allowed (corresponding to 3.). It can be set to the same setting as when there is no person (corresponding to 4), but the secret circuit calculation with a low communication frequency with the middle person in between is designed exclusively.

[Modification]
The processes described in the above apparatus and method are not only executed in time series according to the order of description, but may be executed in parallel or individually as required by the processing capability of the apparatus that executes the process.

  Further, when each process in the secure authentication method is realized by a computer, the processing content of the function that the secure authentication method should have is described by a program. Then, by executing this program on a computer, processing means in the secure authentication method is realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  Each processing means may be configured by executing a predetermined program on a computer, or at least a part of these processing contents may be realized by hardware.

  Needless to say, other modifications are possible without departing from the spirit of the present invention.

1 Client device 2 Intermediate server 3 First secure calculation server 4 Second secure calculation server 5 Third secure calculation server

Claims (5)

c _x , c _y , c _z , d _x , d _y , d _z , e _x , e _y , e _z are given constants,
The client device has random numbers r _{(W) u} , s _{(W) x} , s _{(W) y} , s _{(W) z} , r _{(X) u} , s _{(X) x} , s _{(X) y} , s _{(X ) z} , r _{(Y) u} , s _{(Y) x} , s _{(Y) y} , s _{(Y) z} , r _{(Z) u} , s _{(Z) x} , s _{(Z) y} , s _{(Z) z} A step of generating
The client device secretly distributes each of user u's password w _u and random numbers r _{(W) u} , r _{(X) u} , r _{(Y) u} , r _{(Z) u} , and the distributed value w _{ux of} w _u , w _uy , w _uz , r _{(W) u} variance value r _{(W) ux} , r _{(W) uy} , r _{(W) uz} , r _{(X) u} variance value r _{(X) ux} , r _{(X ) uy} , r _{(X) uz} , r _{(Y) u} variances r _{(Y) ux} , r _{(Y) uy} , r _{(Y) uz} and r _{(Z) u} variances r _{(Z) ux} , r _{Obtaining (Z) uy} , r _{(Z) uz} ;
If the client device is s _{(W) ux} = s _{(W) x} -s _{(W) z} , s _{(W) uy} = s _{(W) y} -s _{(W) x} , s _{(W) uz} = s _{(W) z} -s _{(W) y} , s _{(X) ux} = s _{(X) x} -s _{(X) z} , s _{(X) uy} = s _{(X) y} -s _{(X) x} , s _{(X) uz} = s _{(X) z} -s _{(X) y} , s _{(Y) ux} = s _{(Y) x} -s _{(Y) z} , s _{(Y) uy} = s _{(Y) y} -s _{(Y) x} , s _{( Y) uz} = s _{(Y) z} -s _{(Y) y} , s _{(Z) ux} = s _{(Z) x} -s _{(Z) z} , s _{(Z) uy} = s _{(Z) y} -s _(Z) calculating _x , s _{(Z) uz} = s _{(Z) z} -s _{(Z) y} ;
Client device is w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux)} encrypted with _{(Z) ux} with a common key between the client device and the first secret calculation server , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{(Z) ux} ) are generated and sent to the intermediate server, w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} is encrypted with a common key between the client device and the second _secure calculation server E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} ) to the intermediate server, w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} encrypted with a common key between the client device and the third secure calculation server E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X ) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} ) to the intermediate server;
The intermediate server receives E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{( Z) ux} , s _{(Z) ux} ) is sent to the first secret computation server and received E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} ) are sent to the second secret computation server and received E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} ) And steps to
The first secret computation server receives E _x (w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{(Z) ux} ) are decrypted with a common key between the client device and the first secret calculation server, and w _ux , r _{(W) ux} , s _{(W) ux} , r _{(X) ux} , s _{(X) ux} , r _{(Y) ux} , s _{(Y) ux} , r _{(Z) ux} , s _{(Z) ux} are generated and stored in the storage unit;
The second secret calculation server receives E _y (w _uy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} ) are decrypted with the common key between the client device and the second secret computation server, and _wuy , r _{(W) uy} , s _{(W) uy} , r _{(X) uy} , s _{(X) uy} , r _{(Y) uy} , s _{(Y) uy} , r _{(Z) uy} , s _{(Z) uy} are generated and stored in the storage unit,
The third secret calculation server receives the received E _z (w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} ) with a common key between the client device and the third secret calculation server, and w _uz , r _{(W) uz} , s _{(W) uz} , r _{(X) uz} , s _{(X) uz} , r _{(Y) uz} , s _{(Y) uz} , r _{(Z) uz} , s _{(Z) uz} are generated and stored in the storage unit,
The client device secretly distributes the input password w ′ to obtain the distributed values w ′ _x , w ′ _y , w ′ _z of w ′;
Client device, w and sends the generated intermediate server 'the _x common key encrypted E _x (w a client device and a first confidential calculation servers' _x), the client device w' _y and the second concealment E _y (w ′ _y ) encrypted with a common key with the calculation server is generated and sent to the intermediate server, and w ′ _z is encrypted with a common key between the client device and the third secret calculation server E _z (w ′ _Z ) and sending it to the intermediate server;
The intermediate server sends the received E _x (w ′ _x ) to the first secret calculation server, sends the received E _y (w ′ _y ) to the second secret calculation server, and receives the received E _z (w ′ _z ) To the third secret calculation server;
First confidential calculation server generates a random number _{r '(W) x, s} ' (W) x, w ux, r (W) ux, s (W) ux, w' x from q _{(W) x} = c _x r _{(W) ux} (w _ux -w ′ _x ) + s _{(W) ux} is calculated and q _{(W) x} is encrypted with the common key between the intermediate server and the first secret calculation server E _WX ( q _XY (r ′ _{(W) x} , q _{(W) x} ) and r ′ _{(W) x} , s ′ _{(W) x} encrypted with a common key between the first secret calculation server and the second secret calculation server s ′ _{(W) x} ) and sending it to the intermediate server;
The second secret calculation server generates random numbers r ′ _{(W) y} , s ′ _{(W) y} , and from w _uy , r _{(W) uy} , s _{(W) uy} , w ′ _y to q _{(W) y} = c _y r _{(W) uy} (w _uy -w ′ _y ) + s _{(W) uy} is calculated, and q _{(W) y} is encrypted with a common key between the intermediate server and the second secret calculation server E _WY ( E _YZ (r ′ _{(W) y} , q _{(W) y} ) and r ′ _{(W) y} , s ′ _{(W) y} encrypted with a common key between the second secret calculation server and the third secret calculation server s ′ _{(W) y} ) and sending it to the intermediate server;
Third confidential calculation server generates a random number _{r '(W) z, s} ' (W) z, w uz, r (W) uz, s (W) uz, w' z from q _{(W) z} = _{c z r (W) uz (} w uz -w 'z) + s (W) uz was calculated and encrypted q a _{(W) z} a common key between the intermediate server and the third secret calculation server E _WZ ( E _ZX (r ′ _{(W) z} , q _{(W) z} ) and r ′ _{(W) z} , s ′ _{(W) z} encrypted with a common key between the first and third secure calculation servers s ′ _{(W) z} ) and sending it to the intermediate server;
The intermediate server decrypts the received E _WX (q _{(W) x} ), E _WY (q _{(W) y} ), E _WZ (q _{(W) z} ) and decodes q _{(W) x} , q _{(W) y} , q _(W) to generate a _z calculates the _{q (W) = q (W} ) x + q (W) y + q (W) z, determining the authentication success in the case of q _(W) = 0 And steps to
The intermediate server sends E _ZX (r ′ _{(W) z} , s ′ _{(W) z} ) to the first secret calculation server, and E _XY (r ′ _{(W) x} , s ′ _{(W) x} ) Transmitting to the second secret calculation server, and transmitting E _YZ (r ′ _{(W) y} , s ′ _{(W) y} ) to the third secret calculation server;
The first secret calculation server decrypts the received E _ZX (r ′ _{(W) z} , s ′ _{(W) z} ) with the common key of the first secret calculation server and the third secret calculation server, and r ′ _{(W ) z} , s ′ _{(W) z} and r _{(W) ux} = d _x r ′ _{(W) x} + e _x r ′ _{(W) z} , s _{(W) ux} = s ′ _{(W) x} − updating r _{(W) ux} , s _{(W) ux} by calculating s ′ _{(W) z} ;
The second secret calculation server decrypts the received E _XY (r ′ _{(W) x} , s ′ _{(W) x} ) with the common key of the first secret calculation server and the second secret calculation server, and r ′ _{(W ) x} , s ′ _{(W) x} and r _{(W) uy} = d _y r ′ _{(W) y} + e _y r ′ _{(W) x} , s _{(W) uy} = s ′ _{(W) y} − updating r _{(W) uy} , s _{(W) uy} by calculating s ′ _{(W) x} ;
The third secret calculation server decrypts the received E _YZ (r ′ _{(W) y} , s ′ _{(W) y} ) with the common key of the second secret calculation server and the third secret calculation server, and r ′ _{(W ) y} , s ′ _{(W) y} and r _{(W) uz} = d _z r ′ _{(W) z} + e _z r ′ _{(W) y} , s _{(W) uz} = s ′ _{(W) z} − updating r _{(W) uz} , s _{(W) uz} by calculating s ′ _{(W) y} ;
The first secret calculation server generates random numbers r ′ _{(X) x} , s ′ _{(X) x} , and from w _ux , r _{(X) ux} , s _{(X) ux} , w ′ _x to q _{(X) x} = c _x r _{(X) ux} (w _ux -w ′ _x ) + s _{(X) ux} is calculated, and r ′ _{(X) x} and s ′ _{(X) x} are calculated as the first secret calculation server and the second secret calculation server. Sending E _XY (r ′ _{(X) x} , s ′ _{(X) x} ) encrypted with a common key to the intermediate server;
The second secret calculation server generates random numbers r ′ _{(X) y} , s ′ _{(X) y} , and from w _uy , r _{(X) uy} , s _{(X) uy} , w ′ _y to q _{(X) y} = c _y r _{(X) uy} (w _uy -w ′ _y ) + s _{(X) uy} is calculated, and q _{(X) y} is encrypted with the common key of the first secret calculation server and the second secret calculation server E _XY (q _{(X) y} ) and r ′ _{(X) y} , s ′ _{(X) y} are encrypted with a common key with the second and third secure calculation servers E _YZ (r ′ _{(X ) y} , s ′ _{(X) y} ) to the intermediate server;
The third secret calculation server generates random numbers r ′ _{(X) z} , s ′ _{(X) z} , and from w _uz , r _{(X) uz} , s _{(X) uz} , w ′ _z to q _{(X) z} = c _z r _{(X) uz} (w _uz -w ′ _z ) + s _{(X) uz} is calculated and q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} is the first secret calculation server And E _ZX (q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} ) encrypted with a common key with the third secret calculation server, to the intermediate server;
The intermediate server sends E _XY (q _{(X) y} ), E _ZX (q _{(X) z} , r ′ _{(X) z} , s ′ _{(X) z} ) to the first secret calculation server, and the second secret Send E _XY (r ′ _{(X) x} , s ′ _{(X) x} ) to the computation server and send E _YZ (r ′ _{(X) y} , s ′ _{(X) y} ) to the third secret computation server Steps,
The first secret computation server decrypts the received E _XY (q _{(X) y} ) with the common key of the first secret computation server and the second secret computation server, generates q _{(X) y} , and receives the received E _{Decrypt ZX} (q _{(X) z} ) with the common key of the first and third secure calculation servers to generate q _{(X) z} , and q _(X) = q _{(X) x} + q _{( X) y} + q _{(X) z} is calculated.If q _(X) = 0, it is determined that authentication is successful, and r _{(X) ux} = d _x r ′ _{(X) x} + e _x r ′ ₍ Updating r _{(X) ux} , s _{(X) ux} by computing _{X) z} , s _{(X) ux} = s ′ _{(X) x-} s ′ _{(X) z} ;
The second secret calculation server decrypts the received E _XY (r ′ _{(X) x} , s ′ _{(X) x} ) with the common key of the first secret calculation server and the second secret calculation server, and r _{(X) u y} = d _y r ′ _{(X) y} + e _y r ′ _{(X) x} , s _{(X) uy} = s ′ _{(X) y} -s ′ _{(X) x} by calculating r _{(X) uy} , s _{(X) uy} update step;
The third secret calculation server decrypts the received E _YZ (r ′ _{(X) y} , s ′ _{(X) y} ) with the common key of the second secret calculation server and the third secret calculation server, and r _(X) By calculating _uz = d _z r ′ _{(X) z} + e _z r ′ _{(X) y} , s _{(X) uz} = s ′ _{(X) z} -s ′ _{(X) y} , r _{(X) uz} , s _{(X) uz} update step;
First confidential calculation server generates a random number _{r '(Y) x, s} ' (Y) x, w ux, r (Y) ux, s (Y) ux, from _{w' x q (Y) x} = c _x r _{(Y) ux} (w _ux -w ′ _x ) + s _{(Y) ux} is calculated and q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} is the first secret calculation server Transmitting E _XY (q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) encrypted with a common key between the server and the second secret calculation server to the intermediate server;
The second secret calculation server generates random numbers r ′ _{(Y) y} , s ′ _{(Y) y} , and from w _uy , r _{(Y) uy} , s _{(Y) uy} , w ′ _y to q _{(Y) y} = c _y r _{(Y) uy} (w _uy -w ′ _y ) + s _{(Y) uy} is calculated, and r ′ _{(Y) y} , s ′ _{(Y) y} is calculated as the second secret calculation server and the third secret calculation server. Sending E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ) encrypted with a common key to the intermediate server;
The third secret calculation server generates random numbers r ′ _{(Y) z} , s ′ _{(Y) z} , and w _{( uz} , r _{(Y) uz} , s _{(Y) uz} , w ′ _z to q _{(Y) z} = c _z r _{(Y) uz} (w _uz -w ′ _z ) + s _{(Y) uz} is calculated, and q _{(Y) z} is encrypted with the second secret calculation server and the third secret calculation server. E _YZ (q _{(Y) z} ) and r ′ _{(Y) z} , s ′ _{(Y) z} are encrypted using a common key with the first and third secure calculation servers E _ZX (r ′ _{(Y ) z} , s ′ _{(Y) z} ) to the intermediate server;
The intermediate server sends E _ZX (r ′ _{(Y) z} , s ′ _{(Y) z} ) to the first secret calculation server, and E _YZ (q _{(Y) z} ), E _XY ( q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) and E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ) to the third secret calculation server Steps,
The second secret calculation server decrypts the received E _YZ (q _{(Y) z} ) with the common key of the second secret calculation server and the third secret calculation server, generates q _{(Y) z} , and receives, E _XY (q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} ) is decrypted with the common key between the first secret calculation server and the second secret calculation server, and q _{(Y) x} , r ′ _{(Y) x} , s ′ _{(Y) x} is generated, q _(Y) = q _{(Y) x} + q _{(Y) y} + q _{(Y) z} is calculated, and q _(Y) = 0 In this case, it is determined that the authentication is successful, and r _{(Y) uy} = d _y r ′ _{(Y) y} + e _y r ′ _{(Y) x} , s _{(Y) uy} = s ′ _{(Y) y} -s ′ _{(Y )} updating r _{(Y) uy} , s _{(Y) uy} by calculating _x ;
The first secret calculation server decrypts the received E _ZX (r ′ _{(Y) z} , s ′ _{(Y) z} ) with the common key of the first secret calculation server and the third secret calculation server, and r _{(Y) ux} = d _x r ′ _{(Y) x} + e _x r ′ _{(Y) z} , s _{(Y) ux} = s ′ _{(Y) x} -s ′ _{(Y) z} by calculating r _{(Y) ux} , s updating the _{(Y) ux} ;
The third secret calculation server decrypts the received E _YZ (r ′ _{(Y) y} , s ′ _{(Y) y} ) with the common key of the second secret calculation server and the third secret calculation server, and r _(Y) By calculating _uz = d _z r ′ _{(Y) z} + e _z r ′ _{(Y) y} , s _{(Y) uz} = s ′ _{(Y) z} -s ′ _{(Y) y} , r _{(Y) uz} , s _{(Y) uz} update step,
The first secret calculation server generates random numbers r ′ _{(Z) x} , s ′ _{(Z) x} , and w _ux , r _{(Z) ux} , s _{(Z) ux} , w ′ _x to q _{(Z) x} = c _x r _{(Z) ux} (w _ux -w ′ _x ) + s _{(Z) ux} is calculated, and q _{(Z) x} is encrypted with the common key of the first and third secure calculation servers E _ZX (q _{(Z) x} ) and r ′ _{(Z) x} , s ′ _{(Z) x} are encrypted with a common key between the first and second secure calculation servers E _XY (r ′ _{(Z ) x} , s ′ _{(Z) x} ) to the intermediate server;
The second secret calculation server generates random numbers r ′ _{(Z) y} , s ′ _{(Z) y} , and from w _uy , r _{(Z) uy} , s _{(Z) uy} , w ′ _y to q _{(Z) y} = c _y r _{(Z) uy} (w _uy -w ′ _y ) + s _{(Z) uy} is calculated and q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} is calculated as the second secret calculation server And E _YZ (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) encrypted with a common key with the third secret calculation server,
The third secret calculation server generates random numbers r ′ _{(Z) z} , s ′ _{(Z) z} , and from w _uz , r _{(Z) uz} , s _{(Z) uz} , w ′ _z to q _{(Z) z} = c _z r _{(Z) uz} (w _uz -w ′ _z ) + s _{(Z) uz} is calculated, and r ′ _{(Z) z} and s ′ _{(Z) z} are calculated as the first secret calculation server and the third secret calculation server. Sending E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ) encrypted with a common key to the intermediate server;
The intermediate server sends E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ) to the first secret calculation server, and E _XY (r ′ _{(Z) x} , s ′ _{( Z) x} ) and E _ZX (q _{(Z) x} ), E _YZ (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) to the third secret calculation server Steps,
The third secret calculation server decrypts the received E _ZX (q _{(Z) x} ) with the common key of the first secret calculation server and the third secret calculation server, generates q _{(Z) x} , and receives the received E _{ZX YZ} (q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} ) is decrypted with the common key of the first secret calculation server and the third secret calculation server, and q _{(Z) y} , r ′ _{(Z) y} , s ′ _{(Z) y} is generated, q _(Z) = q _{(Z) x} + q _{(Z) y} + q _{(Z) z} is calculated, and q _(Z) = 0 Is determined to be successful, and r _{(Z) uz} = d _z r ′ _{(Z) z} + e _z r ′ _{(Z) y} , s _{(Z) uz} = s ′ _{(Z) z} -s ′ _(Z) updating r _{(Z) uz} , s _{(Z) uz} by calculating _y ; and
The first secret calculation server decrypts the received E _ZX (r ′ _{(Z) z} , s ′ _{(Z) z} ) with the common key of the first secret calculation server and the third secret calculation server, and r _{(Z) ux = d x r '(Z} ) x + e x r' (Z) z, s (Z) ux = s '(Z) x -s' (Z) r by computing _{z (Z) ux,} updating s _{(Z) ux} =
The second secret calculation server decrypts the received E _XY (r ′ _{(Z) x} , s ′ _{(Z) x} ) with the common key between the first secret calculation server and the second secret calculation server, and r _{(Z) u y} = d _y r ′ _{(Z) y} + e _y r ′ _{(Z) x} , s _{(Z) uy} = s ′ _{(Z) y} -s ′ _{(Z) x} by calculating r _{(Z) uy} , updating s _{(Z) uy} ;
A secure authentication method including: The secure authentication method of claim 1, comprising:
First confidential calculation server generates a random number t _X, generates the E _XY (t _X) by encrypting the t _X a common key between the first confidential calculating server and a second confidential calculation server, a t _X first E _ZX (t _X ) is generated by encrypting with the common key of the first and second secret calculation servers, and t _X , E _XY (t _X ), and E _ZX (t _X ) are sent to the intermediate server Steps,
Second confidential calculation server generates a random number t _Y, generates an E _YZ (t _Y) encrypts t _Y common key with the second confidential calculating server and a third concealment calculation server, a t _Y a E _XY (t _Y ) is generated by encrypting with the common key of the first and second secret calculation servers, and t _Y , E _YZ (t _Y ) and E _XY (t _Y ) are transmitted to the intermediate server Steps,
Third confidential calculation server generates a random number t _Z, generates the E _ZX (t _Z) encrypts t _Z a common key with the second confidential calculating server and a third concealment calculation server, a t _Z The E _YZ (t _Z ) is generated by encrypting with the common key of the first and second secret calculation servers, and t _Z , E _ZX (t _Z ), and E _YZ (t _Z ) are sent to the intermediate server Steps,
An intermediate server calculates t = t _X + t _Y + t _Z and sends it to the client device;
The client device secretly distributes w ′ to obtain the distributed values w ′ _x , w ′ _y , w ′ _z of w ′;
Client device, t, 'encrypts _x with the common key between the client device and the first confidential calculation server E _x (t, w' w generate _x), t, w _'y the client device and a second E _y (t, w ′ _y ) is generated by encrypting with a common key with the secure calculation server, and t, w ′ _z is encrypted with a common key between the client device and the third secure calculation server and E _z (t , w ′ _z ) and sending E _x (t, w ′ _x ), E _y (t, w ′ _y ), E _z (t, w ′ _z ) to the intermediate server;
The intermediate server sends E _x (t, w ′ _x ), E _XY (t _Y ), E _ZX (t _Z ) to the first secret computation server, and E _y (t, w ′ _y ), E _XY ( t _X ), E _YZ (t _Z ) are sent to the second secret calculation server, and E _z (t, w ′ _z ), E _ZX (t _X ), E _YZ (t _Y ) are sent to the third secret calculation server. Sending, and
The first secret computation server generates T, w ′ _x , t _Y , t _Z by decoding E _x (t, w ′ _x ), E _XY (t _Y ), E _ZX (t _Z ), and t ′ = T _X + t _Y + t _Z is calculated, and if t ′ ≠ t, the step of determining the authentication failure,
The second secret computation server decrypts E _y (t, w ′ _y ), E _XY (t _X ), E _YZ (t _Z ) and generates t, w ′ _y , t _X , t _Z and t ′ = T _X + t _Y + t _Z is calculated, and if t ′ ≠ t, the step of determining the authentication failure,
The third secret calculation server decrypts E _z (t, w ′ _z ), E _ZX (t _X ), E _YZ (t _Y ) to generate t, w ′ _z , t _X , t _Y , and t ′ = T _X + t _Y + t _Z is calculated, and if t ′ ≠ t, the step of determining the authentication failure,
A secure authentication method further comprising: The secure authentication method according to claim 1 or 2,
If it is determined that authentication is successful and authentication failure is not determined by the secure authentication method,
A predetermined service is provided to the client device.
A secure authentication method characterized by the above. The secure authentication method according to claim 3,
The predetermined service is a service provided by a plurality of servers.
A secure authentication method characterized by the above. The secure authentication method according to claim 3,
The predetermined service is a storage service.
A secure authentication method characterized by the above.

Images