JP4663676B2 - One-time password device and system - Google Patents

Description

  The present invention relates to a one-time password device and system for generating a one-time password.

  Technology for authenticating users is important in networks. User authentication is a technique for determining whether or not a user of a terminal to be connected is appropriate when connecting to a computer system from a terminal such as a PDA, a mobile phone, or a notebook PC via a network. In order to access important information safely and reliably, user authentication technology is important. In user authentication, ID and password are often used. In recent years, an increase in unauthorized access due to password leakage has become a problem.

  As a measure for preventing unauthorized access, there is a technique that uses a stronger one-time password than authentication using a password (see, for example, Patent Document 1).

  The one-time password is generated, for example, by an OTP (one time password) generation device (also called a token) in association with the OTP seed issued by the provider and the time information. Further, the server device providing this provider stores an OTP seed corresponding to the user identification information, and generates a one-time password corresponding to the OTP seed and time information. The OTP generation device and the server device have the same OTP seed information and the same algorithm for generating a one-time password. Furthermore, since the time information is also synchronized, the one-time password generated by the OTP generation device and the one-time password generated by the server device are the same, and user authentication can be performed.

Since the one-time password can be used only once for authentication because time information changes, the one-time password authentication can ensure high security.
JP 2004-171056 A

  However, when a user uses a one-time password with a plurality of providers, it is necessary to use an OTP generation device corresponding to each provider. Therefore, the user can use an OTP generation device for a plurality of providers. It is necessary to carry it, which is inconvenient for the user.

  In addition, when one-time passwords are shared among a plurality of providers, a secret OTP seed necessary for generating a one-time password needs to be shared between providers. If this secret OTP seed is shared between providers, it may lead to leakage of the secret OTP seed, which is problematic in terms of security.

  The present invention has been made in consideration of the above-described circumstances, and an object of the present invention is to provide a one-time password device and system that can safely use a one-time password with a plurality of providers.

In order to solve the above-described problems, a one-time password device according to the present invention is a one-time password device that generates a one-time password to be used when communicating with a server device, and is a provider identification of a provider that provides a service. Information and a seed that is a sequence for generating a one-time password corresponding to the provider identification information are associated with one set, and this set is stored for a plurality of providers. wherein all different storage means for each set, a time generating means for generating time information, a first obtaining means for obtaining a first provider identification information provider, the first corresponding seed that corresponds to the first provider identification information Second acquisition means for acquiring from the storage means, third acquisition means for acquiring the time information, and the acquired time information The OTP generation means for generating a first one-time password is a numeric value corresponding to a first corresponding seed, and a display means for displaying the first one-time password, and the first first portion of the corresponding seed the First generation means for generating calculation information obtained by calculating the first portion of the time information;
Second generation means for generating first cryptographic information obtained by encrypting the calculation information with the second portion of the first corresponding seed, and a first cryptographic seed that is a numerical value corresponding to the first cryptographic information. 1 cipher seed generation means, and the server device associates user identification information with a seed that is a sequence for generating a one-time password corresponding to the user identification information, and makes one set. A plurality of sets are stored, and the second one-time password corresponding to the time information and the second corresponding seed corresponding to the user identification information of the one-time password device matches the first one-time password. The server device permits the user to provide the service of the provider having the first provider identification information, and the OTP generation means includes the first corresponding seed. A first one-time password corresponding to the first cipher seed instead and the time information is generated, and the server device stores a plurality of second cipher seeds corresponding to the first cipher seed instead of the seed. When the second one-time password corresponding to the second cipher seed instead of the second corresponding seed and the time information matches the first one-time password, the server device The user is allowed to provide a service of a provider having the first provider identification information .

The one-time password device of the present invention is a one-time password device that generates a one-time password to be used when communicating with a server device, and includes a plurality of provider identification information of providers providing services , storage means for one and a single seed which is sequence for generating a down-time password are store, a time generating means for generating time information, the first obtaining of acquiring first provider identification information provider Means, first generation means for generating first calculation information obtained by calculating the first part of the single seed and the first provider identification information, and the first calculation information as the second part of the single seed. Second generation means for generating the first encryption information encrypted in step 1; first encryption seed generation means for generating a first encryption seed that is a numerical value corresponding to the first encryption information; The third generation means for generating second calculation information obtained by calculating the first portion of the first cryptographic seed and the first portion of the time information, and the second calculation information as the second portion of the first cryptographic seed. Fourth generation means for generating second encryption information encrypted in step (2), second encryption seed generation means for generating a second encryption seed that is a numerical value corresponding to the second encryption information, and second time for acquiring the time information. a second acquiring unit, the second encryption seed, the OTP generation means for generating a first one-time password that corresponds to said obtained time information, and display means for displaying the first one-time password, the The server device stores a plurality of third cryptographic seeds corresponding to the second cryptographic seed, and a second one-time password corresponding to the third cryptographic seed and the time information is the first one-time password. password The server device when the match is, and permits the provision of a service provider having a first provider identification information to the user.

The one-time password system of the present invention is a one-time password system comprising a server device and a one-time password device that generates a one-time password used when communicating with the server device,
The one-time password device associates provider identification information of a provider providing a service with a seed that is a sequence for generating a one-time password corresponding to the provider identification information into a set, A set is stored for a plurality of providers, provider identification information and seed are all different for each set, first storage means for acquiring first provider identification information of a provider that a user desires to connect to, and Second acquisition means for acquiring a first corresponding seed corresponding to first provider identification information from the first storage means, first time generation means for generating first time information, the first time information, and the first A first OTP generating means for generating a first one-time password which is a numerical value corresponding to one corresponding seed; and the first one-time password is displayed. Comprising a display unit, the,
The server device associates user identification information with a seed that is a sequence for generating a one-time password corresponding to the user identification information into one set, stores a plurality of sets, and stores the user identification information. And second seeds that are different for each set, second time generating means for generating second time information synchronized with the first time information, user identification information, and second information corresponding to the user identification information. A second acquisition unit for generating a second one-time password corresponding to the second time information and the second corresponding seed; Fourth acquisition means for acquiring a first one-time password, determination means for determining whether or not the first one-time password and the second one-time password match; If it is determined that the constant means are coincident, and ingredients Bei and permitting means, the permitting provision of a service provider having a first provider identification information,
The one-time password device includes: first generation means for generating calculation information obtained by calculating a first part of the first corresponding seed and a first part of the first time information; Second generation means for generating first encryption information encrypted with the second part of the seed, and first encryption seed generation means for generating a first encryption seed that is a numerical value corresponding to the first encryption information, Equipped,
The first OTP generation means generates a first one-time password corresponding to the first cipher seed instead of the first corresponding seed and the first time information, and the second storage means Instead, a second encryption seed corresponding to the first encryption seed is stored, and the second OTP generation means corresponds to the second encryption seed instead of the second correspondence seed and the second time information. The second one-time password is generated .

  According to the one-time password device and system of the present invention, a one-time password can be safely used with a plurality of providers.

Hereinafter, a one-time password device and a program according to an embodiment of the present invention will be described in detail with reference to the drawings. Note that, in the following embodiments, the same numbered portions are assumed to perform the same operation, and repeated description is omitted.
(First embodiment)
The one-time password device of this embodiment will be described with reference to FIG.
As shown in FIG. 1, the one-time password device of this embodiment includes a time generation unit 101, a key management unit 102, an OTP (one time password) generation unit 103, an OTP / CID display unit 104, and an input unit. 105 and a control unit 106 are included. This one-time password device is, for example, a mobile phone.

  The time generation unit 101 generates time. This time is synchronized with the time generated by the time generation unit 301 included in the server device described later.

The key management unit 102 stores key data. This key data associates the identification information of the provider providing the service with the OTP seed, which is a sequence for generating a one-time password corresponding to the identification information, into one set, and this set is this Only the number of providers to which the user of the one-time password device tries to connect is stored. The identification information and the seed are all different for each set. As shown in FIG. 2, the key management unit 102 stores, for example, a provider ID and a CID (communication identifier) for the provider as provider identification information. The CID is an ID assigned to each set of provider and user. Each provider has a different CID for each user, and each user has a different CID for each provider. A certain CID is the same for a corresponding one provider and a corresponding one user. Details of the data stored in the key management unit 102 will be described later with reference to FIG.
The OTP generation unit 103 inputs the time when the time generation unit 101 is generated and the OTP seed corresponding to the provider input by the user among the OTP seeds stored in the key management unit 102, and this time and Generate a number from the OTP seed. This numerical value is generated using, for example, a hash function. The hash function (for example, SHA-256) of the OTP generation unit 103 receives, for example, 32-bit data as a time and 256-bit data as an OTP seed, and outputs a 256-bit numerical value. The OTP generation unit 103 outputs a part of the numerical value obtained by the hash function (for example, 20 bits) as a one-time password.

  The OTP / CID display unit 104 displays the one-time password generated by the OTP generation unit 103 and the CID corresponding to the one-time password acquired from the key management unit 102 by the control unit 106. For example, the OTP / CID display unit 104 displays a password input screen and a provider selection screen.

The input unit 105 is used, for example, when the user selects a service.
The control unit 106 acquires the CID corresponding to the OTP seed corresponding to the provider input by the user from the key management unit 102 and passes it to the OTP / CID display unit 104. The control unit 106 controls each unit included in the one-time password device.

Next, key data stored in the key management unit 102 of FIG. 1 will be described with reference to FIG.
The key management unit 102 stores, for each one-time password device, data that includes a provider ID, a CID, and an OTP seed as many as the number of providers with which the user is affiliated. These CID and OTP seed are determined for each user (that is, for each one-time password device). That is, generally, even in the same provider, the CID and the OTP seed are different depending on the user. Therefore, the one-time password generated from the CID and the OTP seed is excellent in safety and can communicate with a correct partner on the network.

  The key data stored in the key management unit 102 is the same as the number of affiliated providers, but is normally expected to be about 100. The provider ID and CID are each indicated by, for example, 8 digits, and the OTP seed has 256 bits, for example. In this case, the key management unit 102 stores about 4000 bytes of data.

Next, a server apparatus with which the user exchanges data using the one-time password apparatus of FIG. 1 will be described with reference to FIG. A server device is installed for each provider. That is, only one provider information is stored in one server device.
As shown in FIG. 3, the server device includes a time generation unit 301, a key management unit 302, a seed processing unit 303, an OTP generation unit 304, a network I / F (interface) unit 305, and a control unit 306. .

  The time generation unit 301 generates time. This time is synchronized with the time generated by the time generation unit 101 included in the one-time password device.

  The key management unit 302 stores key data for each provider. The key data for each provider is a set of CIDs of registered users and OTP seeds, which are a sequence for generating a one-time password corresponding to the CID, as one set, and a plurality of sets of these sets. Storing. The CID and OTP seed stored in the key management unit 302 are all different for each set. The OTP seed related to the corresponding provider in the key data stored in the key management unit 102 of the one-time password device is equal to the OTP seed of the corresponding user in the OTP seed stored in the key management unit 302. I'm doing it. Details of the data stored in the key management unit 302 will be described later with reference to FIG.

  The OTP seed related to a provider among the key data stored in the key management unit 102 of the one-time password device is the OTP seed stored in the key management unit 302 of the server device corresponding to the provider. It is set so as to match the OTP seed corresponding to this user. For example, as will be described later with reference to FIG. 5, when the user performs usage registration for each corresponding provider, the user's CID and one-time password are transmitted to the server device. Also, the key management company mails key data to the user and the provider in advance, and the user copies the key data to the key management unit 102 of the one-time password device. In addition, the one-time password device may download the key data from the server device using a communication line excellent in confidentiality or a communication technology excellent in confidentiality.

  The seed processing unit 303 performs processing for generating an OTP seed from data stored in the key management unit 302. The seed processing unit 303 acquires an OTP seed corresponding to the user from the key management unit 302 and passes it to the OTP generation unit 304.

  The OTP generation unit 304 inputs the time generated by the time generation unit 301 and the OTP seed acquired from the seed processing unit 303, and generates a numerical value from this time and the OTP seed. The algorithm for generating this numerical value is the same as that of the OTP generation unit 103 in the one-time password device of this embodiment. That is, since the input OTP seed and the time are the same, the one-time password generated by the server device and the one-time password generated by the one-time password device are the same.

  The network I / F unit 305 exchanges data with a computer that logs in to the server device using the one-time password generated by the one-time password device. For example, the network I / F unit 305 receives a user login from a computer, or receives a CID and a one-time password from the computer, as will be described later with reference to FIG.

  The control unit 306 controls each unit of the server device. The control unit 306 determines whether the one-time password generated by the OTP generation unit 304 matches the one-time password received from the computer by the network I / F unit 305. If it is determined that they match, service provision to the computer is permitted and service provision is started, and if they do not match, service provision to the computer is rejected.

Next, key data stored in the key management unit 302 will be described with reference to FIG.
The key management unit 302 stores, for each provider, data that includes a set of CIDs and OTP seeds for at least the number of users. These CID and OTP seed are determined for each user. That is, generally, even in the same provider, the CID and the OTP seed are different depending on the user. Therefore, the one-time password generated from the CID and the OTP seed is excellent in safety and can communicate with a correct partner on the network.

  The key data stored in the key management unit 302 is the same as the number of registered users, but is usually about 10 million. The CID is indicated by 8 digits, for example, and the OTP seed has 256 bits, for example. In this case, the key management unit 302 stores about 360 million bytes of data per provider.

Next, referring to FIG. 5 for an example of an operation for registering the use of the one-time password device of FIG. 1 to the provider of the server device of FIG. 3 via a computer connected to the server device. I will explain.
The user logs in to the server apparatus operating the desired provider site using the computer (step S501). At this time, the user logs in, for example, by inputting an ID and a password (PW in FIG. 5), which are user identification information. Normally, this ID and password are temporary for registration and are used only once.

  The user transmits an instruction signal for instructing the server device to use the one-time password using the computer (step S502).

  The server device transmits a request signal for inputting the CID and the one-time password to the computer (step S503).

  The user selects a provider who wants to receive the service using the mobile phone (step S504). This provider is the provider of the site logged in at step S501.

  In the mobile phone, the OTP generation unit 103 generates a one-time password from the OTP seed of the provider selected in step S504, and displays the generated one-time password and CID on the OTP / CID display unit 104 (step S505).

The user inputs the one-time password and CID displayed in step S505 to the computer, and the input one-time password and CID are transmitted to the server device (step S506).
The server apparatus receives the one-time password and CID input in step S506, recognizes that these are the key data of the registered user, and generates the one-time password and CID and the time generation unit 301. Based on the time, an OTP seed for the registered user is generated, and the OTP seed and CID are stored in the key management unit 302 as key data for the user.

Next, an example of the operation of the one-time password system including the one-time password device shown in FIG. 1, the server device shown in FIG. 3, and a computer connected to the server device will be described with reference to FIGS.
The user displays a desired provider site on the computer (step S601).

  The user uses a mobile phone and selects a provider who wants to receive the service (step S602). For example, the user uses the input unit 105 as shown in (1) of FIG. 7 and inputs a password as a password on the screen of the mobile phone, and provides a service as shown in (2) of FIG. A list of providers to be displayed is displayed, and the provider displayed in step S601 is selected from a plurality of providers.

  In the mobile phone, the OTP generation unit 103 generates a one-time password from the OTP seed of the provider selected in step S602, and displays the generated one-time password on the OTP / CID display unit 104 (step S603). For example, the cellular phone displays a one-time password as shown in (3) of FIG.

The user inputs the user ID and the one-time password displayed in step S603 to the computer, and the input one-time password is transmitted to the server device (step S604).
The server device receives the user ID and the one-time password input in step S604, and checks whether the received one-time password matches the one-time password generated by the server device (authentication process) (step S605). If they match, the server device starts providing services to the computer. The server device may measure the error of the time information generated by the time generator 101 of the one-time password device and store information for correcting the error.

  According to the first embodiment described above, the CID and OTP seed are stored in advance for each provider in the one-time password device, and the same information is stored in advance in the server device for each user. As a result, there is no leakage of OTP seeds between providers, and a single one-time password device can securely receive services from a plurality of providers.

(Second Embodiment)
The one-time password device of this embodiment will be described with reference to FIG.
As shown in FIG. 8, the one-time password device of the present embodiment includes a key management unit 801 and a control unit 803 instead of the key management unit 102 and the control unit 106 in the first embodiment, respectively, As a new device portion from the one-time password device of the embodiment, a time-varying seed processing unit 802 is included.

  The key management unit 801 stores the same key data as the key management unit 102. The difference from the key management unit 102 is that, as schematically shown in FIG. 9, a part of the OTP seed stored in the key management unit 801 is used to overlap the time information, and the other part of the OTP seed. Is used for encryption. Any OTP seed portion is used in the time-varying seed processing unit 802.

The time-varying seed processing unit 802 changes the OTP seed according to time information. For example, the time-varying seed processing unit 802 acquires time information from the time generation unit 101, acquires the second half of the OTP seed and time information, calculates these information using a certain calculation method, and calculates the calculated information. The first half of the OTP seed is encrypted (eg, by AES), and the output of the hash function is obtained using the encrypted data as the input of the hash function (eg, SHA-256). This output is used as an OTP seed input to the OTP generation unit 103. If only the year and month are input as time information, the OTP seed can be changed every month.
In the calculation method, when x is the second half of the OTP seed, y is time information, and z is the calculation result, y and z are obtained when x is fixed in the calculation defined by f (x, y) = z. The calculation corresponds to one to one. An example of an operation that satisfies this condition is addition (x + y = z).

The control unit 803 acquires a CID corresponding to the OTP seed corresponding to the provider input by the user from the key management unit 801, and passes it to the OTP / CID display unit 104. The control unit 803 also controls the time-varying seed processing unit 802 in addition to the control processing of the control unit 106.
In the second embodiment, the key management unit 302 stores the same seed as the OTP seed output from the time-varying seed processing unit 802 in association with user information.

  According to the second embodiment described above, in addition to the effects of the first embodiment, the OTP seed can be changed and the one-time password can be changed every time a predetermined period elapses. . Therefore, a more secure one-time password can be used.

(Third embodiment)
The one-time password device of this embodiment will be described with reference to FIG.
As shown in FIG. 10, the one-time password device of the present embodiment includes a key management unit 1001 and a control unit 1003 instead of the key management unit 102 and the control unit 106 in the second embodiment, respectively. A compression seed processing unit 1002 is included as a new device portion from the one-time password device of the embodiment.

The key management unit 1001 stores key data. The key data stores the provider ID, the provider CID, and one OTP seed. It differs from the other embodiments in that only one OTP seed is stored instead of storing an OTP seed for each provider.
The provider ID and CID stored in the key management unit 1001 are determined for each user. That is, in general, even in the same provider, the CID differs depending on the one-time password device.

  As shown in FIG. 11, the key data stored in the key management unit 1001 is the same as the number of partner providers, but is usually about 100. The provider ID and CID are each indicated by, for example, 8 digits, and the OTP seed has 256 bits, for example. In this case, the key management unit 1001 stores data of about 832 bytes, and the data storage amount is significantly smaller than the storage amount of about 4000 bytes in other embodiments.

The compression seed processing unit 1002 generates an OTP seed corresponding to this provider from the provider ID, the CID, and a single OTP seed. For example, the compression seed processing unit 1002 calculates the provider ID and the second half of the OTP seed as described in the second embodiment, and calculates the calculated information in the first half of the single OTP seed (for example, AES And obtain the output of the hash function with the encrypted information as input of the hash function (eg, SHA-256). This output is an OTP seed that is input to the time-varying seed processing unit 802.
The control unit 1003 acquires the CID corresponding to the OTP seed corresponding to the provider input by the user from the key management unit 1001 and passes it to the OTP / CID display unit 104. The control unit 1003 also controls the compression seed processing unit 1002 in addition to the control processing of the control unit 803.

  In the third embodiment, the key management unit 302 stores the same seed as the OTP seed output from the time-varying seed processing unit 802 in association with user information.

(Modification)
A modification of the one-time password device of the third embodiment will be described with reference to FIG.
As shown in FIG. 12, the one-time password device of this modification includes a compression seed processing unit 1201 and a control unit 1202, respectively, instead of the compression seed processing unit 1002 and the control unit 1003 in the third embodiment. The time-varying seed processing unit 802 in the third embodiment is excluded. The control unit 1202 also controls the compression seed processing unit 1201 in addition to the control processing of the control unit 106.

The compression seed processing unit 1201 is different from the compression seed processing unit 1002 only in the calculation part. The compression seed processing unit 1201 calculates the provider ID and the second half of the OTP seed as in the case of the compression seed processing unit 1002, and further calculates the calculation result and the time information acquired from the time generation unit 101. Calculate. The operation in the compression seed processing unit 1201 after encrypting the final calculation result in the first half of a single OTP seed (for example, by AES) is the same as that in the third embodiment described above. is there. The output of the hash function of the compression seed processing unit 1201 is output to the OTP generation unit 103 as an OTP seed. The calculation method is the same as in the other embodiments.
According to this modification, it is not necessary to install the time-varying seed processing unit 802.

  According to the third embodiment described above, in addition to the effects of the second embodiment, the amount of information that the one-time password device should store is significantly reduced, and the free space of the memory is increased. Memory can be used for other purposes. Conversely, a one-time password device can generate an appropriate one-time password with a small amount of memory.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

1 is a block diagram of a one-time password device according to a first embodiment. The figure which shows the key data which the key management part of FIG. 1 has stored. The block diagram of the server apparatus which exchanges data with a computer using the one-time password apparatus of FIG. The figure which shows the key data which the key management part of FIG. 3 has stored. FIG. 4 is a flowchart illustrating an example of an operation for registering use in the server apparatus of FIG. 3 using the one-time password apparatus of FIG. 1. The flowchart which shows an example of operation | movement of the one-time password system containing the one-time password apparatus of FIG. 1, the server apparatus of FIG. 3, and the computer connected to this server apparatus. The figure which shows the display screen of the one-time password apparatus of FIG. 1 in a certain step of FIG. The block diagram of the one-time password apparatus which concerns on 2nd Embodiment. The figure which shows the key data which the key management part of FIG. 8 has stored. The block diagram of the one-time password apparatus which concerns on 3rd Embodiment. The figure which shows the key data which the key management part of FIG. 10 has stored. The block diagram of the one-time password apparatus which concerns on the modification of 3rd Embodiment.

Explanation of symbols

101, 301: Time generating unit, 102, 302, 801, 1001 ... Key management unit, 103, 304 ... OTP generating unit, 104 ... OTP / CID display unit, 105 ... Input unit 106, 306, 803, 1003, 1202 ... control unit, 303 ... seed processing unit, 305 ... network I / F unit, 802 ... time-varying seed processing unit, 1002, 1201 ... Compression seed processing unit.

Claims (16)

A one-time password device that generates a one-time password to be used when communicating with a server device,
The provider identification information of the provider that provides the service and the seed that is a sequence for generating a one-time password corresponding to the provider identification information are associated with one set, and this set is for a plurality of providers. Storing, the provider identification information and the seed are all different storage means for each set;
Time generating means for generating time information;
First acquisition means for acquiring first provider identification information of the provider;
Second acquisition means for acquiring a first corresponding seed corresponding to the first provider identification information from the storage means;
Third acquisition means for acquiring the time information;
OTP generating means for generating a first one-time password that is a numerical value corresponding to the acquired time information and the first corresponding seed;
Display means for displaying the first one-time password;
First generation means for generating calculation information obtained by calculating the first portion of the first corresponding seed and the first portion of the time information;
Second generation means for generating first cryptographic information obtained by encrypting the calculation information with the second part of the first corresponding seed;
A first encryption seed generator means for generating a first encryption seed is a value corresponding to the first encryption information, to immediately Bei and
The server device associates user identification information with a seed, which is a sequence for generating a one-time password corresponding to the user identification information, as one set, stores a plurality of sets, and sets the time information If the second one-time password corresponding to the second corresponding seed corresponding to the user identification information of the one-time password device matches the first one-time password, the server device To provide the service of the provider having the first provider identification information,
The OTP generation means generates a first one-time password corresponding to the first encryption seed instead of the first corresponding seed and the time information,
The server device stores a plurality of second encryption seeds corresponding to the first encryption seed instead of the seed, and corresponds to the second encryption seed instead of the second correspondence seed and the time information. one-time password, the when they coincide with the first one-time password the server apparatus, wherein the to Ruwa to permit provision of service providers having the first provider identification information to the user One-time password device.   The first generation unit performs a one-to-one operation between another input value and the output value of the first generation unit when one of two input values is fixed. The one-time password device according to claim 1. A one-time password device that generates a one-time password to be used when communicating with a server device,
Storage means for storing a plurality of provider identification information of providers providing a service and one single seed that is a sequence for generating a one-time password;
Time generating means for generating time information;
First acquisition means for acquiring first provider identification information of the provider;
First generation means for generating first calculation information obtained by calculating the first portion of the single seed and the first provider identification information;
Second generation means for generating first encryption information obtained by encrypting the first calculation information with the second part of the single seed;
First encryption seed generating means for generating a first encryption seed that is a numerical value corresponding to the first encryption information;
Third generation means for generating second calculation information obtained by calculating the first part of the first cryptographic seed and the first part of the time information;
Fourth generation means for generating second cryptographic information obtained by encrypting the second calculation information with the second part of the first cryptographic seed;
Second encryption seed generating means for generating a second encryption seed that is a numerical value corresponding to the second encryption information;
Second acquisition means for acquiring the time information;
OTP generating means for generating a first one-time password corresponding to the second encryption seed and the acquired time information;
Display means for displaying the first one-time password,
The server device stores a plurality of third cryptographic seeds corresponding to the second cryptographic seed, and a second one-time password corresponding to the third cryptographic seed and the time information is identical to the first one-time password. If it does, the server device permits the user to provide the service of the provider having the first provider identification information.   At least one of the first generation unit and the third generation unit has a pair of another input value and an output value of the generation unit when one of the two input values is fixed. The one-time password device according to claim 3, wherein an operation corresponding to 1 is performed. A one-time password device that generates a one-time password to be used when communicating with a server device,
Storage means for storing a plurality of provider identification information of providers providing a service and one single seed that is a sequence for generating a one-time password;
Time generating means for generating time information;
First acquisition means for acquiring first provider identification information of the provider;
First generation means for generating first calculation information obtained by calculating the first portion of the single seed and the first provider identification information;
Second generation means for generating second calculation information obtained by calculating the first calculation information and the first portion of the time information;
Third generation means for generating first encryption information obtained by encrypting the second calculation information with the second part of the single seed;
First encryption seed generating means for generating a first encryption seed that is a numerical value corresponding to the first encryption information;
Second acquisition means for acquiring the time information;
OTP generating means for generating a first one-time password corresponding to the first cryptographic seed and the acquired time information;
Display means for displaying the first one-time password,
The server device stores a plurality of second encryption seeds corresponding to the first encryption seed, and a second one-time password corresponding to the second encryption seed and the time information is identical to the first one-time password. If it does, the server device permits the user to provide the service of the provider having the first provider identification information. The provider identification information includes a provider ID (identifier) and a CID (communication identifier) assigned to each set of provider and user, the user identification information includes a CID, and the storage means and the server device are: the first assigned to the provider and the user with the provider identification information, one-time password device according to any one of claims 1 to 5, characterized in that storing the same CID. The one-time password device according to claim 6 , wherein the display unit displays the first one-time password and a CID corresponding to the first one-time password. It said first generating means, characterized in that when fixing the one of two input values, the calculation of the output value of another input value and said first generating means is a one-to-one correspondence The one-time password device according to any one of claims 5 to 7 . A one-time password system comprising a server device and a one-time password device that generates a one-time password used when communicating with the server device,
The one-time password device is
The provider identification information of the provider that provides the service and the seed that is a sequence for generating a one-time password corresponding to the provider identification information are associated with one set, and this set is for a plurality of providers. Storing the first storage means in which the provider identification information and the seed are all different for each set;
First acquisition means for acquiring first provider identification information of a provider that the user desires to connect;
Second acquisition means for acquiring a first corresponding seed corresponding to the first provider identification information from the first storage means;
First time generating means for generating first time information;
First OTP generating means for generating a first one-time password that is a numerical value corresponding to the first time information and the first corresponding seed;
Display means for displaying the first one-time password,
The server device
User identification information and a seed that is a sequence for generating a one-time password corresponding to the user identification information are associated with each other, and a plurality of sets are stored. Different second storage means,
Second time generating means for generating second time information synchronized with the first time information;
Third acquisition means for acquiring the user identification information and a second corresponding seed corresponding to the user identification information from the second storage means;
Second OTP generating means for generating a second one-time password corresponding to the second time information and the second corresponding seed;
Fourth acquisition means for acquiring the first one-time password;
Determination means for determining whether or not the first one-time password and the second one-time password match;
If it is determined that the determination means match, the permission means for permitting the provision of the service of the provider having the first provider identification information,
The one-time password device is
First generation means for generating calculation information obtained by calculating the first portion of the first corresponding seed and the first portion of the first time information;
Second generation means for generating first cryptographic information obtained by encrypting the calculation information with the second part of the first corresponding seed;
First encryption seed generating means for generating a first encryption seed that is a numerical value corresponding to the first encryption information,
The first OTP generation means generates a first one-time password corresponding to the first encryption seed instead of the first corresponding seed and the first time information;
The second storage means stores a second encryption seed corresponding to the first encryption seed instead of the seed;
Wherein said 2OTP generating means, the second and the second encryption seed instead of the corresponding seed, the characteristics and to Ruwa-Time Password System to generate a second one-time password corresponding to the second time information .   The first generation unit performs a one-to-one operation between another input value and the output value of the first generation unit when one of two input values is fixed. The one-time password system according to claim 9. A one-time password system comprising a server device and a one-time password device that generates a one-time password used when communicating with the server device,
The one-time password device is
The provider identification information of the provider that provides the service and the seed that is a sequence for generating a one-time password corresponding to the provider identification information are associated with one set, and this set is for a plurality of providers. Storing the first storage means in which the provider identification information and the seed are all different for each set;
First acquisition means for acquiring first provider identification information of a provider that the user desires to connect;
Second acquisition means for acquiring a first corresponding seed corresponding to the first provider identification information from the first storage means;
First time generating means for generating first time information;
First OTP generating means for generating a first one-time password that is a numerical value corresponding to the first time information and the first corresponding seed;
Display means for displaying the first one-time password,
The server device
User identification information and a seed that is a sequence for generating a one-time password corresponding to the user identification information are associated with each other, and a plurality of sets are stored. Different second storage means,
Second time generating means for generating second time information synchronized with the first time information;
Third acquisition means for acquiring the user identification information and a second corresponding seed corresponding to the user identification information from the second storage means;
Second OTP generating means for generating a second one-time password corresponding to the second time information and the second corresponding seed;
Fourth acquisition means for acquiring the first one-time password;
Determination means for determining whether or not the first one-time password and the second one-time password match;
If it is determined that the determination means match, the permission means for permitting the provision of the service of the provider having the first provider identification information,
The one-time password device is
In place of the first storage means, a third storage means for storing a plurality of provider identification information of providers providing services and one single seed that is a sequence for generating a one-time password Comprising
The one-time password device is
First generation means for generating first calculation information obtained by calculating the first portion of the single seed and the first provider identification information;
Second generation means for generating first encryption information obtained by encrypting the first calculation information with the second part of the single seed;
First encryption seed generating means for generating a first encryption seed that is a numerical value corresponding to the first encryption information;
Third generation means for generating second calculation information obtained by calculating the first part of the first cryptographic seed and the first part of the first time information;
Fourth generation means for generating second cryptographic information obtained by encrypting the second calculation information with the second part of the first cryptographic seed;
Second encryption seed generating means for generating a second encryption seed that is a numerical value corresponding to the second encryption information,
The first OTP generating means generates a first one-time password corresponding to the second encryption seed instead of the first corresponding seed and the first time information;
The second storage means stores a third encryption seed corresponding to the second encryption seed instead of the seed,
Wherein said 2OTP generating means, said second and said third encryption seed instead of the corresponding seed, the characteristics and to Ruwa-Time Password System to generate a second one-time password corresponding to the second time information .   At least one of the first generation unit and the third generation unit has a pair of another input value and an output value of the generation unit when one of the two input values is fixed. The one-time password system according to claim 11, wherein an operation corresponding to 1 is performed. A one-time password system comprising a server device and a one-time password device that generates a one-time password used when communicating with the server device,
The one-time password device is
The provider identification information of the provider that provides the service and the seed that is a sequence for generating a one-time password corresponding to the provider identification information are associated with one set, and this set is for a plurality of providers. Storing the first storage means in which the provider identification information and the seed are all different for each set;
First acquisition means for acquiring first provider identification information of a provider that the user desires to connect;
Second acquisition means for acquiring a first corresponding seed corresponding to the first provider identification information from the first storage means;
First time generating means for generating first time information;
First OTP generating means for generating a first one-time password that is a numerical value corresponding to the first time information and the first corresponding seed;
Display means for displaying the first one-time password,
The server device
User identification information and a seed that is a sequence for generating a one-time password corresponding to the user identification information are associated with each other, and a plurality of sets are stored. Different second storage means,
Second time generating means for generating second time information synchronized with the first time information;
Third acquisition means for acquiring the user identification information and a second corresponding seed corresponding to the user identification information from the second storage means;
Second OTP generating means for generating a second one-time password corresponding to the second time information and the second corresponding seed;
Fourth acquisition means for acquiring the first one-time password;
Determination means for determining whether or not the first one-time password and the second one-time password match;
If it is determined that the determination means match, the permission means for permitting the provision of the service of the provider having the first provider identification information,
The one-time password device is
In place of the first storage means, a third storage means for storing a plurality of provider identification information of providers providing services and one single seed that is a sequence for generating a one-time password When,
First generation means for generating first calculation information obtained by calculating the first portion of the single seed and the first provider identification information;
Second generation means for generating second calculation information obtained by calculating the first calculation information and the first portion of the first time information;
Third generation means for generating first encryption information obtained by encrypting the second calculation information with the second part of the single seed;
First encryption seed generating means for generating a first encryption seed that is a numerical value corresponding to the first encryption information,
The first OTP generation means generates a first one-time password corresponding to the first encryption seed instead of the first corresponding seed and the first time information;
The second storage means stores a second encryption seed corresponding to the first encryption seed instead of the seed;
Wherein said 2OTP generating means, the second and the second encryption seed instead of the corresponding seed, the characteristics and to Ruwa-Time Password System to generate a second one-time password corresponding to the second time information . The provider identification information includes a provider ID (identifier) and a CID (communication identifier) assigned to each set of provider and user, the user identification information includes a CID, and the one-time password device and the server device are The one-time password system according to any one of claims 9 to 13 , wherein the same CID assigned to the provider having the first provider identification information and the user is stored. The one-time password according to any one of claims 9 to 14 , wherein the display means displays the first one-time password and a CID corresponding to the first one-time password. system. It said first generating means, characterized in that when fixing the one of two input values, the calculation of the output value of another input value and said first generating means is a one-to-one correspondence The one-time password system according to any one of claims 9 to 15 .

Images