Method for password based authentication and apparatus executing the method

1. An authentication method, of a terminal, comprising:

generating an identifier (ID)-based secret key K using an ID of a user of the terminal and key generation factors exchanged with a server;

encrypting a password of the user using a symmetric key encryption algorithm taking the ID-based secret key K generated by the terminal as a symmetric key;

requesting authentication for the terminal user by transmitting the encrypted password to the server; and

receiving a response to the authentication request from the server,

wherein the response is determined using a hardware security module (HSM) of the server, and

wherein the generating of the secret key K includes:

transmitting, to the server, a first secret key element X calculated from a terminal-side random number x;

receiving, from the server, a second secret key element Y;

generating the secret key K using the terminal-side random number x, the first secret key element X, the second secret key element Y, and the ID; and

generating a common hash value e using the first secret key element X, the second secret key element Y, and a hash value I of the ID, wherein the generating of the secret key K is performed using the common hash value e, the terminal-side random number x, the first secret key element X, the second secret key element Y, and the hash value I of the ID.

2. The authentication method of claim 1 , wherein the generating of the secret key K is performed by hashing a first string including:

the common hash value e,

the terminal-side random number x,

the first secret key element X,

the second secret key element Y, and

the hash value I of the ID.

3. The authentication method of claim 2 , wherein the first secret key element X is calculated according to the following equation:

X=g x

where:

g is a generator of a cyclic subgroup G generated from g={tilde over (g)} z when a maximal cyclic subgroup, of a finite group Z N ={0, 1, 2, . . . , N−1}, is {tilde over (g)},

N is an integer satisfying N=pq, and

p and q are prime numbers that satisfy p=3 (mod 4) and q=3 (mod 4) respectively.

4. The authentication method of claim 3 , wherein the secret key K is calculated according to the following equation:

K=h 1 ( X ,( Y,I ),( YI e ) x )

where:

h 1 is a first random hash function,

I=H(ID), and

H is a hash function satisfying H:{0, 1}*→G.

5. The authentication method of claim 4 , further comprising, after the transmitting of the encrypted password to the server:

generating a session key sk by hashing a string including: the common hash value e, the terminal-side random number x, the first secret key element X, the second secret key element Y, and the hash value I of the ID using a second random hash function h 2 ;

generating a first verification value by hashing a second string including: the first secret key element X, the second secret key element Y, the hash value I of the ID, the session key sk and the password using a third random hash function h 3 ; and

transmitting, to the server, the first verification value.

6. The authentication method of claim 5 , wherein the session key sk is calculated according to the following equation:

sk=h 2 ( X ,( Y,I ),( Yr ) x ).

7. The authentication method of claim 5 , wherein the terminal transmits the ID to the server together with one of the first secret key element X and the first verification value.

8. The authentication method of claim 5 , further comprising, after the transmitting of the first verification value to the server:

receiving, from the server, a second verification value; and

verifying the second verification value using the first secret key element X, the second secret key element Y, the hash value I of the ID, the session key sk, the password, and a fourth random hash function h 4 .

9. An authentication method, of a server, comprising:

generating an identifier (ID)-based secret key K using an ID of a user of a terminal and key generation factors exchanged with the terminal;

receiving, from the terminal, an encrypted password of the user;

decrypting the encrypted password using a symmetric key decryption algorithm taking the ID-based secret key K generated by the server as a symmetric key; and

authenticating the terminal user using the decrypted password and a hardware security module (HSM) of the server,

wherein the generating of the secret key K includes:

storing a private key s ID corresponding to the ID issued by a private key generator (PKG);

receiving, from the terminal, a first secret key element X;

transmitting, to the terminal, a second secret key element Y calculated from a server-side random number y;

generating the secret key K using the first secret key element X, the server-side random number y, the second secret key element Y, the ID, and the private key s ID ; and

generating a common hash value e using the first secret key element X, the second secret key element Y, and a hash value I of the ID, wherein the generating of the secret key K is performed using the common hash value e, the first secret key element X, the server-side random number y, the second secret key element Y, the hash value I of the ID, and the private key s ID .

10. The authentication method of claim 9 , wherein the generating of the secret key K is performed by hashing a first string including:

the common hash value e,

the first secret key element X,

the server-side random number y,

the second secret key element Y,

the hash value I of the ID, and

the private key s ID .

11. The authentication method of claim 10 , wherein the private key s ID is calculated according to the following equation:

s ID =log g H ( ID )=Σ i=1 α s IDi

where:

g is a generator of a cyclic subgroup G generated from g={tilde over (g)} z when a maximal cyclic subgroup, of a finite group Z N ={0, 1, 2, . . . , N−1}, is {tilde over (g)},

N is an integer satisfying N=pq,

p and q are prime numbers that satisfy p=3 (mod 4) and q=3 (mod 4) respectively,

ID i is an i th character constituting the ID,

α is a length of the ID, H(ID)=(h(ID)) 2 =┌ i=1 α (h(ID i )) 2 ,

h is a random hash function satisfying h: {0, 1}→Z N ,

s IDi =log g H(ID i ), and

H is a hash function satisfying H:{0, 1}*→G.

12. The authentication method of claim 11 , wherein the second secret key element Y is calculated according to the following equation:

Y=g y .

13. The authentication method of claim 12 , wherein the secret key K is calculated according to the following equation:

K=h 1 ( X ,( Y,I ), X y+sID*e )

where:

h 1 is a first random hash function,

I=H(ID), and

H is a hash function satisfying H:{0, 1}*→G.

14. The authentication method of claim 13 , further comprising, after the authenticating of the terminal user:

receiving, from the terminal, a first verification value;

generating a session key sk by hashing a string including: the common hash value e, the first secret key element X, the server-side random number y, the second secret key element Y, the hash value I of the ID, and the private key s ID using a second random hash function h 2 ; and

verifying the first verification value using the first secret key element X, the second secret key element Y, the hash value I of the ID, the session key sk, the decrypted password, and a third random hash function h 3 .

15. The authentication method of claim 14 , wherein the session key sk is calculated according to the following equation:

sk=h 2 ( X ,( Y,I ), X y+sID*e ).

16. The authentication method of claim 14 , wherein the server receives the ID together with one of the first secret key element X and the first verification value.

17. The authentication method of claim 14 , further comprising, after the verifying of the first verification value:

generating a second verification value by hashing a second string including: the first secret key element X, the second secret key element Y, the hash value I of the ID, the session key sk, and the password using a fourth random hash function h 4 ; and

transmitting, to the terminal, the second verification value.

18. The authentication method of claim 9 , wherein the authenticating of the terminal user includes:

generating a message authentication code (MAC) value of the decrypted password using the HSM; and

determining whether the generated MAC value corresponds to a previously stored value.

19. A non-transitory computer-readable recording medium storing a terminal program configured to enable a hardware processor of a computer to perform operations comprising:

generating an identifier (ID)-based secret key K using an ID of a user of the terminal and key generation factors exchanged with a server;

encrypting a password of the user using a symmetric key encryption algorithm taking the ID-based secret key K generated by the terminal as a symmetric key;

requesting authentication for the terminal user by transmitting the encrypted password to the server; and

receiving a response to the authentication request from the server,

wherein the response is determined using a hardware security module (HSM) of the server, and

wherein the generating of the secret key K includes:

transmitting, to the server, a first secret key element X calculated from a terminal-side random number x;

receiving, from the server, a second secret key element Y;

generating the secret key K using the terminal-side random number x, the first secret key element X, the second secret key element Y, and the ID; and

generating a common hash value e using the first secret key element X, the second secret key element Y, and a hash value I of the ID, wherein the generating of the secret key K is performed using the common hash value e, the terminal-side random number x, the first secret key element X, the second secret key element Y, and the hash value I of the ID.

20. A non-transitory computer-readable recording medium storing a server program configured to enable a hardware processor of a computer to perform operations comprising:

generating an identifier (ID)-based secret key K using an ID of a user of a terminal and key generation factors exchanged with the terminal;

receiving, from the terminal, an encrypted password of the user;

decrypting the encrypted password using a symmetric key decryption algorithm taking the ID-based secret key K generated by the server as a symmetric key; and

authenticating the terminal user using the decrypted password and a hardware security module (HSM) of the server,

wherein the generating of the secret key K includes:

storing a private key s ID corresponding to the ID issued by a private key generator (PKG);

receiving, from the terminal, a first secret key element X;

transmitting, to the terminal, a second secret key element Y calculated from a server-side random number y;

generating the secret key K using the first secret key element X, the server-side random number y, the second secret key element Y, the ID, and the private key s ID ; and

generating a common hash value e using the first secret key element X, the second secret key element Y, and a hash value I of the ID, wherein the generating of the secret key K is performed using the common hash value e, the first secret key element X, the server-side random number y, the second secret key element Y, the hash value I of the ID, and the private key s ID .

21. An apparatus, comprising:

at least one hardware processor;

a memory accessible by the hardware processor; and

at least one program stored in the memory,

wherein the at least one program is configured to be executed by the at least one hardware processor, and includes commands enabling the hardware processor to:

generate an identifier (ID)-based secret key using an ID of a user of a terminal and key generation factors exchanged with a server;

encrypt a password of the user using a symmetric key encryption algorithm taking the ID-based secret key generated by the terminal as a symmetric key;

request authentication for the terminal user by transmitting the encrypted password to the server; and

receive a response to the authentication request from the server,

wherein the response is determined using a hardware security module (HSM) of the server, and

wherein the commands enabling the hardware processor to generate the secret key K includes commands enabling the hardware processor to:

transmit, to the server, a first secret key element X calculated from a terminal-side random number x;

receive, from the server, a second secret key element Y;

generate the secret key K using the terminal-side random number x, the first secret key element X, the second secret key element Y, and the ID; and

generate a common hash value e using the first secret key element X, the second secret key element Y, and a hash value I of the ID, wherein the command enabling the hardware processor to generate the secret key K is performed using the common hash value e, the terminal-side random number x, the first secret key element X, the second secret key element Y, and the hash value I of the ID.

22. An apparatus, comprising:

at least one hardware processor;

a memory accessible by the hardware processor; and

at least one program stored in the memory,

wherein the at least one program is configured to be executed by the at least one hardware processor, and includes commands enabling the hardware processor to:

generate an identifier (ID)-based secret key using an ID of a user of a terminal and key generation factors exchanged with the terminal;

receive an encrypted password of the user from the terminal;

decrypt the encrypted password using a symmetric key decryption algorithm taking the ID-based secret key generated by a server as a symmetric key; and

authenticate the terminal user using the decrypted password and a hardware security module (HSM) of the server,

wherein the commands enabling the hardware processor to generate the secret key K includes commands enabling the hardware processor to:

store a private key s ID corresponding to the ID issued by a private key generator (PKG);

receive, from the terminal, a first secret key element X;

transmit, to the terminal, a second secret key element Y calculated from a server-side random number y;

generate the secret key K using the first secret key element X, the server-side random number y, the second secret key element Y, the ID, and the private key s ID ; and

generate a common hash value e using the first secret key element X, the second secret key element Y, and a hash value I of the ID, wherein the command enabling the hardware processor to generate the secret key K is performed using the common hash value e, the first secret key element X, the server-side random number y, the second secret key element Y, the hash value I of the ID, and the private key s ID .